Skip to content

feat: add cors_behavior support to template resource#294

Merged
ethanndickson merged 9 commits intomainfrom
matifali/cors-behavior
Feb 6, 2026
Merged

feat: add cors_behavior support to template resource#294
ethanndickson merged 9 commits intomainfrom
matifali/cors-behavior

Conversation

@blinkagent
Copy link
Contributor

@blinkagent blinkagent bot commented Jan 21, 2026

Summary

Adds support for the cors_behavior field in the coderd_template resource to allow configuring CORS settings for workspace apps via Terraform.

Changes

Template Resource

  • Added cors_behavior field to TemplateResourceModel struct
  • Added schema attribute with validation (simple or passthru)
  • Handle cors_behavior in Create, Read, and Update operations
  • Added cors_behavior to toUpdateRequest for API calls
  • Added cors_behavior to EqualTemplateMetadata comparison

Template Data Source

  • Added cors_behavior field to data source struct and schema
  • Added reading cors_behavior in the Read function

Usage

resource "coderd_template" "example" {
  name          = "example"
  cors_behavior = "passthru"  # or "simple" (default)
  
  versions {
    # ...
  }
}

Background

The Coder backend supports a cors_behavior field on templates with two possible values:

  • simple - uses the default CORS middleware
  • passthru - bypasses CORS middleware for workspace apps

This setting is available in the Template Settings page in the Coder UI but was not previously configurable via the Terraform provider.

Fixes #293


Created on behalf of @matifali

@matifali matifali requested a review from Emyrk January 21, 2026 14:51
data.MaxPortShareLevel = types.StringValue(string(mpslResp.MaxPortShareLevel))
}

// Handle cors_behavior - can't be set during create, needs update
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch - the comment is misleading. cors_behavior CAN be set during create in the Coder API, but I followed the same pattern as max_port_share_level which was implemented as a workaround for backwards compatibility with older Coder versions (see the TODO comments above for max_port_share_level and use_classic_parameter_flow).

I'll update the comment to be more accurate, or alternatively we could add CORSBehavior to toCreateRequest to set it during creation directly. Let me know which approach you'd prefer!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Emyrk can decide better here. I think it should be supported on creation, too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done! I've updated the code to set cors_behavior during template creation via toCreateRequest instead of using a post-create update call. This is cleaner and matches the API behavior. The change simplifies the Create function and removes the unnecessary update call.

@sreya sreya requested a review from ethanndickson February 5, 2026 15:45
blink-so bot and others added 6 commits February 6, 2026 12:38
This adds the ability to configure the CORS behavior for workspace apps
via Terraform. The cors_behavior field accepts "simple" (default CORS
middleware) or "passthru" (bypass CORS middleware).

Changes:
- Add cors_behavior field to TemplateResourceModel struct
- Add schema attribute with validation
- Handle cors_behavior in Create, Read, and Update operations
- Add cors_behavior to toUpdateRequest for API calls
- Add cors_behavior field to data source as well

Fixes #293
Instead of using a post-create update call, cors_behavior is now set
directly via the CreateTemplateRequest which is cleaner and matches
the API behavior.
When cors_behavior is not specified (unknown/empty), we should not
pass an empty string to the API. Instead, we return nil to use the
server default.
- Delete custom corsPtr helper; use ptr.Ref (update) and
  (*codersdk.CORSBehavior)(ValueStringPointer()) (create) to match
  the UseClassicParameterFlow pattern.
- On read, map empty CORSBehavior (old servers) to types.StringNull()
  instead of storing an invalid empty string.
- Add cors_behavior to BasicUsage enterprise subtest (simple → passthru → simple).
- Add cors_behavior check to data source test.
Adds TestAccTemplateResourceBackCompat that spins up Coder v2.25.0
(which does not support cors_behavior), creates a template without
setting cors_behavior, and verifies the attribute is absent in state.
@ethanndickson ethanndickson force-pushed the matifali/cors-behavior branch from 46a5a98 to 0eee153 Compare February 6, 2026 01:44
Replace the repeated if/else null-on-empty-string pattern at all 4
CORSBehavior read sites with a single stringValueOrNull() call.
@ethanndickson ethanndickson force-pushed the matifali/cors-behavior branch from a60f0d6 to 37c5589 Compare February 6, 2026 01:49
@ethanndickson ethanndickson merged commit 064e64e into main Feb 6, 2026
13 checks passed
@ethanndickson ethanndickson deleted the matifali/cors-behavior branch February 6, 2026 02:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add cors_behavior support to template resource

2 participants