fix: reject unsupported watch-list options

Author: ThomasK33

internal/aggregated/storage/template.go

@@ -197,6 +197,10 @@ func (s *TemplateStorage) Watch(ctx context.Context, opts *metainternalversion.L
 		return nil, err
 	}
 
+	if err := validateUnsupportedWatchListOptions(opts); err != nil {
+		return nil, apierrors.NewBadRequest(fmt.Sprintf("invalid watch options: %v", err))
+	}
+
 	filter, err := filterForListOptions(requestNamespace, opts)
 	if err != nil {
 		return nil, apierrors.NewBadRequest(fmt.Sprintf("invalid watch options: %v", err))

internal/aggregated/storage/watch.go

@@ -38,6 +38,26 @@ func validateFieldSelector(sel fields.Selector) error {
 	return nil
 }
 
+// validateUnsupportedWatchListOptions rejects watch-list options that this storage
+// does not implement yet.
+func validateUnsupportedWatchListOptions(opts *metainternalversion.ListOptions) error {
+	if opts == nil {
+		return nil
+	}
+
+	if opts.SendInitialEvents != nil {
+		return fmt.Errorf("sendInitialEvents is not supported for this watch endpoint")
+	}
+	if opts.ResourceVersionMatch != "" {
+		return fmt.Errorf(
+			"resourceVersionMatch %q is not supported for this watch endpoint",
+			opts.ResourceVersionMatch,
+		)
+	}
+
+	return nil
+}
+
 // filterForListOptions builds a watch.FilterFunc that applies namespace, label, and field selector filtering.
 // Returns nil if no filtering is needed.
 func filterForListOptions(requestNamespace string, opts *metainternalversion.ListOptions) (watch.FilterFunc, error) {

internal/aggregated/storage/watch_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
@@ -288,6 +289,87 @@ func TestWatchStopsOnContextCancel(t *testing.T) {
 	assertWatchClosed(t, watcher, watchEventTimeout)
 }
 
+func TestWorkspaceWatchRejectsUnsupportedWatchListOptions(t *testing.T) {
+	t.Parallel()
+
+	server, _ := newMockCoderServer(t)
+	defer server.Close()
+
+	workspaceStorage := NewWorkspaceStorage(newTestClientProvider(t, server.URL))
+	defer workspaceStorage.Destroy()
+
+	ctx := namespacedContext("control-plane")
+
+	t.Run("sendInitialEvents", func(t *testing.T) {
+		sendInitialEvents := true
+		watcher, err := workspaceStorage.Watch(ctx, &metainternalversion.ListOptions{SendInitialEvents: &sendInitialEvents})
+		assertBadRequestWatchOptionsError(t, watcher, err, "sendInitialEvents")
+	})
+
+	t.Run("resourceVersionMatch", func(t *testing.T) {
+		watcher, err := workspaceStorage.Watch(ctx, &metainternalversion.ListOptions{
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		})
+		assertBadRequestWatchOptionsError(t, watcher, err, "resourceVersionMatch")
+	})
+}
+
+func TestTemplateWatchRejectsUnsupportedWatchListOptions(t *testing.T) {
+	t.Parallel()
+
+	server, _ := newMockCoderServer(t)
+	defer server.Close()
+
+	templateStorage := NewTemplateStorage(newTestClientProvider(t, server.URL))
+	defer templateStorage.Destroy()
+
+	ctx := namespacedContext("control-plane")
+
+	t.Run("sendInitialEvents", func(t *testing.T) {
+		sendInitialEvents := true
+		watcher, err := templateStorage.Watch(ctx, &metainternalversion.ListOptions{SendInitialEvents: &sendInitialEvents})
+		assertBadRequestWatchOptionsError(t, watcher, err, "sendInitialEvents")
+	})
+
+	t.Run("resourceVersionMatch", func(t *testing.T) {
+		watcher, err := templateStorage.Watch(ctx, &metainternalversion.ListOptions{
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		})
+		assertBadRequestWatchOptionsError(t, watcher, err, "resourceVersionMatch")
+	})
+}
+
+func TestValidateUnsupportedWatchListOptions(t *testing.T) {
+	t.Parallel()
+
+	if err := validateUnsupportedWatchListOptions(nil); err != nil {
+		t.Fatalf("expected nil list options to be accepted, got %v", err)
+	}
+
+	if err := validateUnsupportedWatchListOptions(&metainternalversion.ListOptions{}); err != nil {
+		t.Fatalf("expected empty list options to be accepted, got %v", err)
+	}
+
+	sendInitialEvents := true
+	err := validateUnsupportedWatchListOptions(&metainternalversion.ListOptions{SendInitialEvents: &sendInitialEvents})
+	if err == nil {
+		t.Fatal("expected sendInitialEvents to be rejected")
+	}
+	if !strings.Contains(err.Error(), "sendInitialEvents") {
+		t.Fatalf("expected sendInitialEvents error, got %v", err)
+	}
+
+	err = validateUnsupportedWatchListOptions(&metainternalversion.ListOptions{
+		ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+	})
+	if err == nil {
+		t.Fatal("expected resourceVersionMatch to be rejected")
+	}
+	if !strings.Contains(err.Error(), "resourceVersionMatch") {
+		t.Fatalf("expected resourceVersionMatch error, got %v", err)
+	}
+}
+
 func TestValidateFieldSelector(t *testing.T) {
 	t.Parallel()
 
@@ -459,6 +541,27 @@ func assertWatchClosed(t *testing.T, watcher watch.Interface, timeout time.Durat
 	}
 }
 
+func assertBadRequestWatchOptionsError(t *testing.T, watcher watch.Interface, err error, wantErrSubstring string) {
+	t.Helper()
+
+	if err == nil {
+		if watcher != nil {
+			watcher.Stop()
+		}
+		t.Fatalf("expected watch options error containing %q", wantErrSubstring)
+	}
+	if watcher != nil {
+		watcher.Stop()
+		t.Fatalf("expected watcher to be nil when watch options are rejected, got %T", watcher)
+	}
+	if !apierrors.IsBadRequest(err) {
+		t.Fatalf("expected bad request error, got %v", err)
+	}
+	if !strings.Contains(err.Error(), wantErrSubstring) {
+		t.Fatalf("expected error containing %q, got %v", wantErrSubstring, err)
+	}
+}
+
 func templateFromWatchEvent(t *testing.T, evt watch.Event) *aggregationv1alpha1.CoderTemplate {
 	t.Helper()
 

internal/aggregated/storage/workspace.go

@@ -186,6 +186,10 @@ func (s *WorkspaceStorage) Watch(ctx context.Context, opts *metainternalversion.
 		return nil, err
 	}
 
+	if err := validateUnsupportedWatchListOptions(opts); err != nil {
+		return nil, apierrors.NewBadRequest(fmt.Sprintf("invalid watch options: %v", err))
+	}
+
 	filter, err := filterForListOptions(requestNamespace, opts)
 	if err != nil {
 		return nil, apierrors.NewBadRequest(fmt.Sprintf("invalid watch options: %v", err))