From 703398bd2cabab4ac318a783e26b9ddcfacb6273 Mon Sep 17 00:00:00 2001
From: Hare <kei.hiracchi.0928@gmail.com>
Date: Sat, 22 Aug 2026 23:27:27 +0900
Subject: [PATCH] fix: reject invalid coder principals safely

---
 crates/workspace-server/src/server.rs | 20 ++++++++++++++++++++
 crates/workspace-server/src/store.rs  |  6 +++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/crates/workspace-server/src/server.rs b/crates/workspace-server/src/server.rs
index 5fbf920b..f54e72ff 100644
--- a/crates/workspace-server/src/server.rs
+++ b/crates/workspace-server/src/server.rs
@@ -15669,6 +15669,26 @@ mod tests {
                 updated_at: TEST_CREATED_AT.to_string(),
             })
             .unwrap();
+        let invalid_coder = scoped_set_ticket_assignment(
+            State(api.clone()),
+            AxumPath((
+                TEST_WORKSPACE_ID.to_string(),
+                ticket_id.clone(),
+                "coder".to_string(),
+            )),
+            Json(SetTicketRoleAssignmentRequest {
+                operation_id: "invalid-workspace-agent-coder".to_string(),
+                principal: TicketAssignmentPrincipal::WorkspaceAgent {
+                    agent_key: "workspace-orchestrator".to_string(),
+                },
+                expected_assignment_id: None,
+            }),
+        )
+        .await
+        .unwrap_err()
+        .into_response();
+        assert_eq!(invalid_coder.status(), StatusCode::CONFLICT);
+
         let assignment = TicketCoderAssignmentRecord {
             workspace_id: TEST_WORKSPACE_ID.to_string(),
             ticket_id: ticket_id.clone(),
diff --git a/crates/workspace-server/src/store.rs b/crates/workspace-server/src/store.rs
index bb7b4022..f34856ac 100644
--- a/crates/workspace-server/src/store.rs
+++ b/crates/workspace-server/src/store.rs
@@ -3843,7 +3843,11 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
                 runtime_id,
                 worker_id,
             } => (None, Some(runtime_id.as_str()), Some(worker_id.as_str())),
-            TicketAssignmentPrincipal::WorkspaceAgent { .. } => unreachable!(),
+            TicketAssignmentPrincipal::WorkspaceAgent { .. } => {
+                return Err(Error::TicketAssignmentConflict(
+                    "Workspace agent principal cannot occupy the Coder role".to_string(),
+                ));
+            }
         };
         let principal_json = serde_json::to_string(&record.principal).map_err(|error| {
             Error::Store(format!("serialize Ticket assignment principal: {error}"))