coder · jscottmiller · Aug 11, 2026 · Aug 6, 2026 · Aug 10, 2026 · jscottmiller
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -6921,6 +6921,19 @@ func (q *querier) LockChatByID(ctx context.Context, id uuid.UUID) (uuid.UUID, er
 	return q.db.LockChatByID(ctx, id)
 }
 
+func (q *querier) LockProvisionerKeyByIDForShare(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	// The lock query returns only the key ID, so fetch the key to authorize
+	// the read against its RBAC object.
+	key, err := q.db.GetProvisionerKeyByID(ctx, id)
+	if err != nil {
+		return uuid.Nil, err
+	}
+	if err := q.authorizeContext(ctx, policy.ActionRead, key); err != nil {
+		return uuid.Nil, err
+	}
+	return q.db.LockProvisionerKeyByIDForShare(ctx, id)
+}
+
 func (q *querier) MarkAllInboxNotificationsAsRead(ctx context.Context, arg database.MarkAllInboxNotificationsAsReadParams) error {
 	resource := rbac.ResourceInboxNotification.WithOwner(arg.UserID.String())
 

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -4488,6 +4488,13 @@ func (s *MethodTestSuite) TestProvisionerKeys() {
 		dbm.EXPECT().GetProvisionerKeyByID(gomock.Any(), pk.ID).Return(pk, nil).AnyTimes()
 		check.Args(pk.ID).Asserts(pk, policy.ActionRead).Returns(pk)
 	}))
+	s.Run("LockProvisionerKeyByIDForShare", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		org := testutil.Fake(s.T(), faker, database.Organization{})
+		pk := testutil.Fake(s.T(), faker, database.ProvisionerKey{OrganizationID: org.ID})
+		dbm.EXPECT().GetProvisionerKeyByID(gomock.Any(), pk.ID).Return(pk, nil).AnyTimes()
+		dbm.EXPECT().LockProvisionerKeyByIDForShare(gomock.Any(), pk.ID).Return(pk.ID, nil).AnyTimes()
+		check.Args(pk.ID).Asserts(pk, policy.ActionRead).Returns(pk.ID)
+	}))
 	s.Run("GetProvisionerKeyByHashedSecret", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		org := testutil.Fake(s.T(), faker, database.Organization{})
 		pk := testutil.Fake(s.T(), faker, database.ProvisionerKey{OrganizationID: org.ID, HashedSecret: []byte("foo")})

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
@@ -2613,6 +2613,27 @@ func TestAcquireProvisionerJob(t *testing.T) {
 		})
 		require.ErrorIs(t, err, sql.ErrNoRows)
 	})
+
+	t.Run("ProvisionerKeyLock", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db, _ = dbtestutil.NewDB(t)
+			ctx   = testutil.Context(t, testutil.WaitMedium)
+			org   = dbgen.Organization(t, db, database.Organization{})
+			key   = dbgen.ProvisionerKey(t, db, database.ProvisionerKey{OrganizationID: org.ID})
+		)
+
+		// While the key exists, the lock returns its ID.
+		id, err := db.LockProvisionerKeyByIDForShare(ctx, key.ID)
+		require.NoError(t, err)
+		require.Equal(t, key.ID, id)
+
+		// Once the key is deleted, the lock reports no rows.
+		err = db.DeleteProvisionerKey(ctx, key.ID)
+		require.NoError(t, err)
+		_, err = db.LockProvisionerKeyByIDForShare(ctx, key.ID)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+	})
 }
 
 func TestUserLastSeenFilter(t *testing.T) {

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/provisionerkeys.sql b/coderd/database/queries/provisionerkeys.sql
@@ -19,6 +19,19 @@ FROM
 WHERE
     id = $1;
 
+-- name: LockProvisionerKeyByIDForShare :one
+-- Locks the provisioner key row with FOR KEY SHARE for the remainder of the
+-- current transaction. FOR KEY SHARE conflicts with DELETE, so while the lock
+-- is held the key cannot be deleted, and a committed deletion is observed as
+-- no rows by later calls.
+SELECT
+    id
+FROM
+    provisioner_keys
+WHERE
+    id = $1
+FOR KEY SHARE;
+
 -- name: GetProvisionerKeyByHashedSecret :one
 SELECT
     *

diff --git a/coderd/provisionerdserver/acquirer.go b/coderd/provisionerdserver/acquirer.go
@@ -15,9 +15,11 @@ import (
 
 	"cdr.dev/slog/v3"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
 	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/quartz"
 )
 
@@ -61,9 +63,12 @@ func WithClock(clock quartz.Clock) AcquirerOption {
 	}
 }
 
-// AcquirerStore is the subset of database.Store that the Acquirer needs
+// AcquirerStore is the subset of database.Store that the Acquirer needs. Job
+// acquisition runs in a transaction that locks the worker's deletable
+// provisioner key (LockProvisionerKeyByIDForShare) before claiming a job
+// (AcquireProvisionerJob), so a claim cannot commit after the key's deletion.
 type AcquirerStore interface {
-	AcquireProvisionerJob(context.Context, database.AcquireProvisionerJobParams) (database.ProvisionerJob, error)
+	InTx(func(database.Store) error, *database.TxOptions) error
 }
 
 func NewAcquirer(ctx context.Context, logger slog.Logger, store AcquirerStore, ps pubsub.Pubsub,
@@ -88,11 +93,15 @@ func NewAcquirer(ctx context.Context, logger slog.Logger, store AcquirerStore, p
 // tags from the database.  The call blocks until a job is acquired, the context is
 // done, or the database returns an error _other_ than that no jobs are available.
 // If no jobs are available, this method handles retrying as appropriate.
+// When keyID is a deletable provisioner key, the claim only succeeds while
+// that key row still exists. Reserved keys and the zero value are not
+// checked, as they have no row to delete.
 func (a *Acquirer) AcquireJob(
-	ctx context.Context, organization uuid.UUID, worker uuid.UUID, pt []database.ProvisionerType, tags Tags,
+	ctx context.Context, organization uuid.UUID, worker uuid.UUID, pt []database.ProvisionerType, tags Tags, keyID uuid.UUID,
 ) (
 	retJob database.ProvisionerJob, retErr error,
 ) {
+	deletableKey := codersdk.IsDeletableProvisionerKey(keyID)
 	logger := a.logger.With(
 		slog.F("organization_id", organization),
 		slog.F("worker_id", worker),
@@ -120,19 +129,52 @@ func (a *Acquirer) AcquireJob(
 			return database.ProvisionerJob{}, err
 		case <-clearance:
 			logger.Debug(ctx, "got clearance to call database")
-			job, err := a.store.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
-				OrganizationID: organization,
-				StartedAt: sql.NullTime{
-					Time:  dbtime.Now(),
-					Valid: true,
-				},
-				WorkerID: uuid.NullUUID{
-					UUID:  worker,
-					Valid: true,
-				},
-				Types:           pt,
-				ProvisionerTags: dbTags,
-			})
+			var job database.ProvisionerJob
+			err := a.store.InTx(func(tx database.Store) error {
+				if deletableKey {
+					// Lock the key for the rest of the transaction so the claim
+					// below cannot commit after the key's deletion. A missing row
+					// means the key was deleted.
+					_, err := tx.LockProvisionerKeyByIDForShare(
+						//nolint:gocritic // The acquire context has no actor that can
+						// read provisioner keys, so scope the read to this narrow subject.
+						dbauthz.AsSystemReadProvisionerDaemons(ctx), keyID)
+					if xerrors.Is(err, sql.ErrNoRows) {
+						return ErrProvisionerKeyDeleted
+					}
+					if err != nil {
+						return xerrors.Errorf("lock provisioner key: %w", err)
+					}
+				}
+				acquired, err := tx.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+					OrganizationID: organization,
+					StartedAt: sql.NullTime{
+						Time:  dbtime.Now(),
+						Valid: true,
+					},
+					WorkerID: uuid.NullUUID{
+						UUID:  worker,
+						Valid: true,
+					},
+					Types:           pt,
+					ProvisionerTags: dbTags,
+				})
+				if err != nil {
+					return err
+				}
+				job = acquired
+				return nil
+			}, nil)
+			if xerrors.Is(err, ErrProvisionerKeyDeleted) {
+				logger.Debug(ctx, "provisioner key deleted, exiting acquire")
+				// cancel (not done) hands an in-progress clearance to another
+				// acquiree in the domain, re-dispatching the wakeup this
+				// acquiree consumed.
+				if internalError := a.cancel(dk, clearance); internalError != nil {
+					return database.ProvisionerJob{}, internalError
+				}
+				return database.ProvisionerJob{}, ErrProvisionerKeyDeleted
+			}
 			if xerrors.Is(err, sql.ErrNoRows) {
 				logger.Debug(ctx, "no job available")
 				continue