feat: allow users to pause prebuilt workspace reconciliation (coder#18700)

This PR provides two commands:
* `coder prebuilds pause`
* `coder prebuilds resume`

These allow the suspension of all prebuilds activity, intended for use
if prebuilds are misbehaving.

Author: SasSwart

coderd/apidoc/docs.go

@@ -24,6 +24,7 @@ type Auditable interface {
 		database.NotificationsSettings |
 		database.OAuth2ProviderApp |
 		database.OAuth2ProviderAppSecret |
+		database.PrebuildsSettings |
 		database.CustomRole |
 		database.AuditableOrganizationMember |
 		database.Organization |

coderd/apidoc/swagger.json

@@ -113,6 +113,8 @@ func ResourceTarget[T Auditable](tgt T) string {
 		return "" // no target?
 	case database.NotificationsSettings:
 		return "" // no target?
+	case database.PrebuildsSettings:
+		return "" // no target?
 	case database.OAuth2ProviderApp:
 		return typed.Name
 	case database.OAuth2ProviderAppSecret:
@@ -176,6 +178,9 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 	case database.NotificationsSettings:
 		// Artificial ID for auditing purposes
 		return typed.ID
+	case database.PrebuildsSettings:
+		// Artificial ID for auditing purposes
+		return typed.ID
 	case database.OAuth2ProviderApp:
 		return typed.ID
 	case database.OAuth2ProviderAppSecret:
@@ -231,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
 		return database.ResourceTypeHealthSettings
 	case database.NotificationsSettings:
 		return database.ResourceTypeNotificationsSettings
+	case database.PrebuildsSettings:
+		return database.ResourceTypePrebuildsSettings
 	case database.OAuth2ProviderApp:
 		return database.ResourceTypeOauth2ProviderApp
 	case database.OAuth2ProviderAppSecret:
@@ -288,6 +295,9 @@ func ResourceRequiresOrgID[T Auditable]() bool {
 	case database.NotificationsSettings:
 		// Artificial ID for auditing purposes
 		return false
+	case database.PrebuildsSettings:
+		// Artificial ID for auditing purposes
+		return false
 	case database.OAuth2ProviderApp:
 		return false
 	case database.OAuth2ProviderAppSecret:

coderd/audit/diff.go

@@ -2304,6 +2304,10 @@ func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuil
 	return q.db.GetPrebuildMetrics(ctx)
 }
 
+func (q *querier) GetPrebuildsSettings(ctx context.Context) (string, error) {
+	return q.db.GetPrebuildsSettings(ctx)
+}
+
 func (q *querier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
 	empty := database.GetPresetByIDRow{}
 
@@ -5101,6 +5105,13 @@ func (q *querier) UpsertOAuthSigningKey(ctx context.Context, value string) error
 	return q.db.UpsertOAuthSigningKey(ctx, value)
 }
 
+func (q *querier) UpsertPrebuildsSettings(ctx context.Context, value string) error {
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceDeploymentConfig); err != nil {
+		return err
+	}
+	return q.db.UpsertPrebuildsSettings(ctx, value)
+}
+
 func (q *querier) UpsertProvisionerDaemon(ctx context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
 	res := rbac.ResourceProvisionerDaemon.InOrg(arg.OrganizationID)
 	if arg.Tags[provisionersdk.TagScope] == provisionersdk.ScopeUser {

coderd/audit/request.go

@@ -5071,6 +5071,12 @@ func (s *MethodTestSuite) TestPrebuilds() {
 		check.Args().
 			Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead)
 	}))
+	s.Run("GetPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) {
+		check.Args().Asserts()
+	}))
+	s.Run("UpsertPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) {
+		check.Args("foo").Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate)
+	}))
 	s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
 		check.Args().
 			Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).

coderd/database/dbauthz/dbauthz.go

@@ -297,6 +297,7 @@ type data struct {
 	presets                          []database.TemplateVersionPreset
 	presetParameters                 []database.TemplateVersionPresetParameter
 	presetPrebuildSchedules          []database.TemplateVersionPresetPrebuildSchedule
+	prebuildsSettings                []byte
 }
 
 func tryPercentileCont(fs []float64, p float64) float64 {
@@ -4277,7 +4278,14 @@ func (*FakeQuerier) GetPrebuildMetrics(_ context.Context) ([]database.GetPrebuil
 	return make([]database.GetPrebuildMetricsRow, 0), nil
 }
 
-func (q *FakeQuerier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
+func (q *FakeQuerier) GetPrebuildsSettings(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return string(slices.Clone(q.prebuildsSettings)), nil
+}
+
+func (q *FakeQuerier) GetPresetByID(_ context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()
 
@@ -12316,6 +12324,14 @@ func (q *FakeQuerier) UpsertOAuthSigningKey(_ context.Context, value string) err
 	return nil
 }
 
+func (q *FakeQuerier) UpsertPrebuildsSettings(_ context.Context, value string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.prebuildsSettings = []byte(value)
+	return nil
+}
+
 func (q *FakeQuerier) UpsertProvisionerDaemon(_ context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
 	if err := validateDatabaseType(arg); err != nil {
 		return database.ProvisionerDaemon{}, err