🤖 fix: require resourceVersion on aggregated storage updates

- reject workspace/template updates that omit metadata.resourceVersion
- preserve optimistic-lock semantics and return conflicts on mismatches
- add regression tests for missing resourceVersion update requests

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$0.45`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=0.45 -->

Author: ThomasK33

internal/aggregated/storage/template.go

@@ -364,7 +364,10 @@ func (s *TemplateStorage) Update(
 		)
 	}
 
-	if candidate.ResourceVersion != "" && candidate.ResourceVersion != existing.ResourceVersion {
+	if candidate.ResourceVersion == "" {
+		return nil, false, apierrors.NewBadRequest("metadata.resourceVersion is required for update")
+	}
+	if candidate.ResourceVersion != existing.ResourceVersion {
 		return nil, false, apierrors.NewConflict(
 			aggregationv1alpha1.Resource("codertemplates"),
 			name,

internal/aggregated/storage/template_test.go

@@ -199,3 +199,33 @@ func TestTemplateStorageDeleteAmbiguousWithoutNamespace(t *testing.T) {
 		t.Fatalf("expected BadRequest for ambiguous delete, got %v", err)
 	}
 }
+
+func TestTemplateStorageUpdateRequiresResourceVersion(t *testing.T) {
+	t.Helper()
+
+	templateStorage := NewTemplateStorage()
+	ctx := genericapirequest.WithNamespace(context.Background(), "default")
+
+	currentObj, err := templateStorage.Get(ctx, "starter-template", nil)
+	if err != nil {
+		t.Fatalf("get template: %v", err)
+	}
+	current := currentObj.(*aggregationv1alpha1.CoderTemplate)
+
+	modified := current.DeepCopy()
+	modified.Spec.Running = !current.Spec.Running
+	modified.ResourceVersion = ""
+
+	_, _, err = templateStorage.Update(
+		ctx,
+		modified.Name,
+		rest.DefaultUpdatedObjectInfo(modified),
+		nil,
+		nil,
+		false,
+		nil,
+	)
+	if !apierrors.IsBadRequest(err) {
+		t.Fatalf("expected BadRequest when resourceVersion is missing, got %v", err)
+	}
+}

internal/aggregated/storage/workspace.go

@@ -365,7 +365,10 @@ func (s *WorkspaceStorage) Update(
 		)
 	}
 
-	if candidate.ResourceVersion != "" && candidate.ResourceVersion != existing.ResourceVersion {
+	if candidate.ResourceVersion == "" {
+		return nil, false, apierrors.NewBadRequest("metadata.resourceVersion is required for update")
+	}
+	if candidate.ResourceVersion != existing.ResourceVersion {
 		return nil, false, apierrors.NewConflict(
 			aggregationv1alpha1.Resource("coderworkspaces"),
 			name,

internal/aggregated/storage/workspace_test.go

@@ -199,3 +199,33 @@ func TestWorkspaceStorageDeleteAmbiguousWithoutNamespace(t *testing.T) {
 		t.Fatalf("expected BadRequest for ambiguous delete, got %v", err)
 	}
 }
+
+func TestWorkspaceStorageUpdateRequiresResourceVersion(t *testing.T) {
+	t.Helper()
+
+	workspaceStorage := NewWorkspaceStorage()
+	ctx := genericapirequest.WithNamespace(context.Background(), "default")
+
+	currentObj, err := workspaceStorage.Get(ctx, "dev-workspace", nil)
+	if err != nil {
+		t.Fatalf("get workspace: %v", err)
+	}
+	current := currentObj.(*aggregationv1alpha1.CoderWorkspace)
+
+	modified := current.DeepCopy()
+	modified.Spec.Running = !current.Spec.Running
+	modified.ResourceVersion = ""
+
+	_, _, err = workspaceStorage.Update(
+		ctx,
+		modified.Name,
+		rest.DefaultUpdatedObjectInfo(modified),
+		nil,
+		nil,
+		false,
+		nil,
+	)
+	if !apierrors.IsBadRequest(err) {
+		t.Fatalf("expected BadRequest when resourceVersion is missing, got %v", err)
+	}
+}