From 927b1f7a7a1ecb92ac51dedf71f9bba3814ebb5f Mon Sep 17 00:00:00 2001 From: Wyatt Fry Date: Thu, 16 Jul 2026 07:18:30 -0400 Subject: [PATCH 1/3] mark the proxy session token as sensitive --- internal/provider/workspace_proxy_resource.go | 1 + 1 file changed, 1 insertion(+) diff --git a/internal/provider/workspace_proxy_resource.go b/internal/provider/workspace_proxy_resource.go index 8cb16a70..146bc882 100644 --- a/internal/provider/workspace_proxy_resource.go +++ b/internal/provider/workspace_proxy_resource.go @@ -66,6 +66,7 @@ func (r *WorkspaceProxyResource) Schema(ctx context.Context, req resource.Schema "session_token": schema.StringAttribute{ MarkdownDescription: "Session token for the workspace proxy.", Computed: true, + Sensitive: true, PlanModifiers: []planmodifier.String{ stringplanmodifier.UseStateForUnknown(), }, From b986f3764c913629c9c5b14e1fd0e91041fc900a Mon Sep 17 00:00:00 2001 From: Wyatt Fry Date: Thu, 16 Jul 2026 08:22:52 -0400 Subject: [PATCH 2/3] docs: mark proxy session token sensitive --- docs/resources/workspace_proxy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/resources/workspace_proxy.md b/docs/resources/workspace_proxy.md index 72262ff6..fa875845 100644 --- a/docs/resources/workspace_proxy.md +++ b/docs/resources/workspace_proxy.md @@ -58,4 +58,4 @@ resource "kubernetes_deployment" "syd_wsproxy" { ### Read-Only - `id` (String) Workspace Proxy ID -- `session_token` (String) Session token for the workspace proxy. +- `session_token` (String, Sensitive) Session token for the workspace proxy. From 7505f43f856cc26c778ebf19e200a21cbe06f1dd Mon Sep 17 00:00:00 2001 From: Wyatt Fry Date: Mon, 27 Jul 2026 07:43:51 -0400 Subject: [PATCH 3/3] test(coderd_workspace_proxy): assert session token is sensitive --- internal/provider/workspace_proxy_resource_test.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/internal/provider/workspace_proxy_resource_test.go b/internal/provider/workspace_proxy_resource_test.go index 4829f858..2e5ed444 100644 --- a/internal/provider/workspace_proxy_resource_test.go +++ b/internal/provider/workspace_proxy_resource_test.go @@ -1,6 +1,7 @@ package provider import ( + "context" "os" "regexp" "strings" @@ -9,10 +10,22 @@ import ( "github.com/coder/coder/v2/coderd/util/ptr" "github.com/coder/terraform-provider-coderd/integration" + fwresource "github.com/hashicorp/terraform-plugin-framework/resource" "github.com/hashicorp/terraform-plugin-testing/helper/resource" "github.com/stretchr/testify/require" ) +func TestWorkspaceProxyResourceSessionTokenSensitive(t *testing.T) { + t.Parallel() + + resp := &fwresource.SchemaResponse{} + (&WorkspaceProxyResource{}).Schema(context.Background(), fwresource.SchemaRequest{}, resp) + require.Empty(t, resp.Diagnostics) + + attr := resp.Schema.Attributes["session_token"] + require.True(t, attr.IsSensitive()) +} + func TestAccWorkspaceProxyResource(t *testing.T) { t.Parallel() if os.Getenv("TF_ACC") == "" {