Implement org/user agents (#3539)

cmd/server/docs/docs.go

@@ -101,7 +101,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/agents/{agent}": {
+        "/agents/{agent_id}": {
             "get": {
                 "produces": [
                     "application/json"
@@ -211,7 +211,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/agents/{agent}/tasks": {
+        "/agents/{agent_id}/tasks": {
             "get": {
                 "produces": [
                     "application/json"
@@ -1063,6 +1063,193 @@ const docTemplate = `{
                 }
             }
         },
+        "/orgs/{org_id}/agents": {
+            "get": {
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "List agents for an organization",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "default": "Bearer \u003cpersonal access token\u003e",
+                        "description": "Insert your personal access token",
+                        "name": "Authorization",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the organization's id",
+                        "name": "org_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "default": 1,
+                        "description": "for response pagination, page offset number",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "default": 50,
+                        "description": "for response pagination, max items per page",
+                        "name": "perPage",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/definitions/Agent"
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "description": "Creates a new agent with a random token, scoped to the specified organization",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "Create a new organization-scoped agent",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "default": "Bearer \u003cpersonal access token\u003e",
+                        "description": "Insert your personal access token",
+                        "name": "Authorization",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the organization's id",
+                        "name": "org_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "the agent's data (only 'name' and 'no_schedule' are read)",
+                        "name": "agent",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/Agent"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/Agent"
+                        }
+                    }
+                }
+            }
+        },
+        "/orgs/{org_id}/agents/{agent_id}": {
+            "delete": {
+                "produces": [
+                    "text/plain"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "Delete an organization-scoped agent",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "default": "Bearer \u003cpersonal access token\u003e",
+                        "description": "Insert your personal access token",
+                        "name": "Authorization",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the organization's id",
+                        "name": "org_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the agent's id",
+                        "name": "agent_id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "No Content"
+                    }
+                }
+            },
+            "patch": {
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "Update an organization-scoped agent",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "default": "Bearer \u003cpersonal access token\u003e",
+                        "description": "Insert your personal access token",
+                        "name": "Authorization",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the organization's id",
+                        "name": "org_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "integer",
+                        "description": "the agent's id",
+                        "name": "agent_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "the agent's updated data",
+                        "name": "agent",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/Agent"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/Agent"
+                        }
+                    }
+                }
+            }
+        },
         "/orgs/{org_id}/permissions": {
             "get": {
                 "produces": [
@@ -4418,6 +4605,10 @@ const docTemplate = `{
                 "no_schedule": {
                     "type": "boolean"
                 },
+                "org_id": {
+                    "description": "OrgID is counted as unset if set to -1, this is done to ensure a new(Agent) still enforce the OrgID check by default",
+                    "type": "integer"
+                },
                 "owner_id": {
                     "type": "integer"
                 },

server/api/agent.go

@@ -15,12 +15,10 @@
 package api
 
 import (
-	"encoding/base32"
 	"net/http"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
-	"github.com/gorilla/securecookie"
 
 	"go.woodpecker-ci.org/woodpecker/v2/server"
 	"go.woodpecker-ci.org/woodpecker/v2/server/model"
@@ -28,6 +26,10 @@ import (
 	"go.woodpecker-ci.org/woodpecker/v2/server/store"
 )
 
+//
+// Global Agents.
+//
+
 // GetAgents
 //
 //	@Summary	List agents
@@ -50,14 +52,14 @@ func GetAgents(c *gin.Context) {
 // GetAgent
 //
 //	@Summary	Get an agent
-//	@Router		/agents/{agent} [get]
+//	@Router		/agents/{agent_id} [get]
 //	@Produce	json
 //	@Success	200	{object}	Agent
 //	@Tags		Agents
 //	@Param		Authorization	header	string	true	"Insert your personal access token"	default(Bearer <personal access token>)
 //	@Param		agent			path	int		true	"the agent's id"
 func GetAgent(c *gin.Context) {
-	agentID, err := strconv.ParseInt(c.Param("agent"), 10, 64)
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
 	if err != nil {
 		_ = c.AbortWithError(http.StatusBadRequest, err)
 		return
@@ -74,14 +76,14 @@ func GetAgent(c *gin.Context) {
 // GetAgentTasks
 //
 //	@Summary	List agent tasks
-//	@Router		/agents/{agent}/tasks [get]
+//	@Router		/agents/{agent_id}/tasks [get]
 //	@Produce	json
 //	@Success	200	{array}	Task
 //	@Tags		Agents
 //	@Param		Authorization	header	string	true	"Insert your personal access token"	default(Bearer <personal access token>)
 //	@Param		agent			path	int		true	"the agent's id"
 func GetAgentTasks(c *gin.Context) {
-	agentID, err := strconv.ParseInt(c.Param("agent"), 10, 64)
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
 	if err != nil {
 		_ = c.AbortWithError(http.StatusBadRequest, err)
 		return
@@ -107,7 +109,7 @@ func GetAgentTasks(c *gin.Context) {
 // PatchAgent
 //
 //	@Summary	Update an agent
-//	@Router		/agents/{agent} [patch]
+//	@Router		/agents/{agent_id} [patch]
 //	@Produce	json
 //	@Success	200	{object}	Agent
 //	@Tags		Agents
@@ -124,7 +126,7 @@ func PatchAgent(c *gin.Context) {
 		return
 	}
 
-	agentID, err := strconv.ParseInt(c.Param("agent"), 10, 64)
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
 	if err != nil {
 		_ = c.AbortWithError(http.StatusBadRequest, err)
 		return
@@ -135,6 +137,8 @@ func PatchAgent(c *gin.Context) {
 		handleDBError(c, err)
 		return
 	}
+
+	// Update allowed fields
 	agent.Name = in.Name
 	agent.NoSchedule = in.NoSchedule
 	if agent.NoSchedule {
@@ -172,11 +176,10 @@ func PostAgent(c *gin.Context) {
 
 	agent := &model.Agent{
 		Name:       in.Name,
-		NoSchedule: in.NoSchedule,
 		OwnerID:    user.ID,
-		Token: base32.StdEncoding.EncodeToString(
+		OrgID:      model.IDNotSet,
-			securecookie.GenerateRandomKey(32),
+		NoSchedule: in.NoSchedule,
-		),
+		Token:      model.GenerateNewAgentToken(),
 	}
 	if err = store.FromContext(c).AgentCreate(agent); err != nil {
 		c.String(http.StatusInternalServerError, err.Error())
@@ -188,7 +191,7 @@ func PostAgent(c *gin.Context) {
 // DeleteAgent
 //
 //	@Summary	Delete an agent
-//	@Router		/agents/{agent} [delete]
+//	@Router		/agents/{agent_id} [delete]
 //	@Produce	plain
 //	@Success	200
 //	@Tags		Agents
@@ -197,7 +200,7 @@ func PostAgent(c *gin.Context) {
 func DeleteAgent(c *gin.Context) {
 	_store := store.FromContext(c)
 
-	agentID, err := strconv.ParseInt(c.Param("agent"), 10, 64)
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
 	if err != nil {
 		_ = c.AbortWithError(http.StatusBadRequest, err)
 		return
@@ -227,3 +230,194 @@ func DeleteAgent(c *gin.Context) {
 	}
 	c.Status(http.StatusNoContent)
 }
+
+//
+// Org/User Agents.
+//
+
+// PostOrgAgent
+//
+//	@Summary	Create a new organization-scoped agent
+//	@Description Creates a new agent with a random token, scoped to the specified organization
+//	@Router		/orgs/{org_id}/agents [post]
+//	@Produce	json
+//	@Success	200	{object}	Agent
+//	@Tags		Agents
+//	@Param		Authorization	header	string	true	"Insert your personal access token"	default(Bearer <personal access token>)
+//	@Param		org_id			path	int		true	"the organization's id"
+//	@Param		agent			body	Agent	true	"the agent's data (only 'name' and 'no_schedule' are read)"
+func PostOrgAgent(c *gin.Context) {
+	_store := store.FromContext(c)
+	user := session.User(c)
+
+	orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Invalid organization ID")
+		return
+	}
+
+	in := new(model.Agent)
+	err = c.Bind(in)
+	if err != nil {
+		c.String(http.StatusBadRequest, err.Error())
+		return
+	}
+
+	agent := &model.Agent{
+		Name:       in.Name,
+		OwnerID:    user.ID,
+		OrgID:      orgID,
+		NoSchedule: in.NoSchedule,
+		Token:      model.GenerateNewAgentToken(),
+	}
+
+	if err = _store.AgentCreate(agent); err != nil {
+		c.String(http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	c.JSON(http.StatusOK, agent)
+}
+
+// GetOrgAgents
+//
+//	@Summary	List agents for an organization
+//	@Router		/orgs/{org_id}/agents [get]
+//	@Produce	json
+//	@Success	200	{array}	Agent
+//	@Tags		Agents
+//	@Param		Authorization	header	string	true	"Insert your personal access token"				default(Bearer <personal access token>)
+//	@Param		org_id			path	int		true	"the organization's id"
+//	@Param		page			query	int		false	"for response pagination, page offset number"	default(1)
+//	@Param		perPage			query	int		false	"for response pagination, max items per page"	default(50)
+func GetOrgAgents(c *gin.Context) {
+	_store := store.FromContext(c)
+
+	orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Error parsing org id. %s", err)
+		return
+	}
+
+	agents, err := _store.AgentListForOrg(orgID, session.Pagination(c))
+	if err != nil {
+		c.String(http.StatusInternalServerError, "Error getting agent list. %s", err)
+		return
+	}
+
+	c.JSON(http.StatusOK, agents)
+}
+
+// PatchOrgAgent
+//
+//	@Summary	Update an organization-scoped agent
+//	@Router		/orgs/{org_id}/agents/{agent_id} [patch]
+//	@Produce	json
+//	@Success	200	{object}	Agent
+//	@Tags		Agents
+//	@Param		Authorization	header	string	true	"Insert your personal access token"	default(Bearer <personal access token>)
+//	@Param		org_id			path	int		true	"the organization's id"
+//	@Param		agent_id		path	int		true	"the agent's id"
+//	@Param		agent			body	Agent	true	"the agent's updated data"
+func PatchOrgAgent(c *gin.Context) {
+	_store := store.FromContext(c)
+
+	orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Invalid organization ID")
+		return
+	}
+
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Invalid agent ID")
+		return
+	}
+
+	agent, err := _store.AgentFind(agentID)
+	if err != nil {
+		c.String(http.StatusNotFound, "Agent not found")
+		return
+	}
+
+	if agent.OrgID != orgID {
+		c.String(http.StatusBadRequest, "Agent does not belong to this organization")
+		return
+	}
+
+	in := new(model.Agent)
+	if err := c.Bind(in); err != nil {
+		c.String(http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Update allowed fields
+	agent.Name = in.Name
+	agent.NoSchedule = in.NoSchedule
+	if agent.NoSchedule {
+		server.Config.Services.Queue.KickAgentWorkers(agent.ID)
+	}
+
+	if err := _store.AgentUpdate(agent); err != nil {
+		c.String(http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	c.JSON(http.StatusOK, agent)
+}
+
+// DeleteOrgAgent
+//
+//	@Summary	Delete an organization-scoped agent
+//	@Router		/orgs/{org_id}/agents/{agent_id} [delete]
+//	@Produce	plain
+//	@Success	204
+//	@Tags		Agents
+//	@Param		Authorization	header	string	true	"Insert your personal access token"	default(Bearer <personal access token>)
+//	@Param		org_id			path	int		true	"the organization's id"
+//	@Param		agent_id		path	int		true	"the agent's id"
+func DeleteOrgAgent(c *gin.Context) {
+	_store := store.FromContext(c)
+
+	orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Invalid organization ID")
+		return
+	}
+
+	agentID, err := strconv.ParseInt(c.Param("agent_id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "Invalid agent ID")
+		return
+	}
+
+	agent, err := _store.AgentFind(agentID)
+	if err != nil {
+		c.String(http.StatusNotFound, "Agent not found")
+		return
+	}
+
+	if agent.OrgID != orgID {
+		c.String(http.StatusBadRequest, "Agent does not belong to this organization")
+		return
+	}
+
+	// Check if the agent has any running tasks
+	info := server.Config.Services.Queue.Info(c)
+	for _, task := range info.Running {
+		if task.AgentID == agent.ID {
+			c.String(http.StatusConflict, "Agent has running tasks")
+			return
+		}
+	}
+
+	// Kick workers to remove the agent from the queue
+	server.Config.Services.Queue.KickAgentWorkers(agent.ID)
+
+	if err := _store.AgentDelete(agent); err != nil {
+		c.String(http.StatusInternalServerError, "Error deleting agent. %s", err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}

server/grpc/auth_server.go

@@ -60,13 +60,12 @@ func (s *WoodpeckerAuthServer) getAgent(agentID int64, agentToken string) (*mode
 	// global agent secret auth
 	if s.agentMasterToken != "" {
 		if agentToken == s.agentMasterToken && agentID == -1 {
-			agent := new(model.Agent)
+			agent := &model.Agent{
-			agent.Name = ""
+				OwnerID:  model.IDNotSet,
-			agent.OwnerID = -1 // system agent
+				OrgID:    model.IDNotSet,
-			agent.Token = s.agentMasterToken
+				Token:    s.agentMasterToken,
-			agent.Backend = ""
+				Capacity: -1,
-			agent.Platform = ""
+			}
-			agent.Capacity = -1
 			err := s.store.AgentCreate(agent)
 			if err != nil {
 				log.Error().Err(err).Msg("error creating system agent")

server/grpc/rpc.go

@@ -57,8 +57,6 @@ func (s *RPC) Next(c context.Context, agentFilter rpc.Filter) (*rpc.Workflow, er
 		log.Debug().Msgf("agent connected: %s: polling", hostname)
 	}
 
-	filterFn := createFilterFunc(agentFilter)
-
 	agent, err := s.getAgentFromContext(c)
 	if err != nil {
 		return nil, err
@@ -69,6 +67,20 @@ func (s *RPC) Next(c context.Context, agentFilter rpc.Filter) (*rpc.Workflow, er
 		return nil, nil
 	}
 
+	agentServerLabels, err := agent.GetServerLabels()
+	if err != nil {
+		return nil, err
+	}
+
+	// enforce labels from server by overwriting agent labels
+	for k, v := range agentServerLabels {
+		agentFilter.Labels[k] = v
+	}
+
+	log.Trace().Msgf("Agent %s[%d] tries to pull task with labels: %v", agent.Name, agent.ID, agentFilter.Labels)
+
+	filterFn := createFilterFunc(agentFilter)
+
 	for {
 		// poll blocks until a task is available or the context is canceled / worker is kicked
 		task, err := s.queue.Poll(c, agent.ID, filterFn)
@@ -91,6 +103,15 @@ func (s *RPC) Next(c context.Context, agentFilter rpc.Filter) (*rpc.Workflow, er
 
 // Wait blocks until the workflow with the given ID is done.
 func (s *RPC) Wait(c context.Context, workflowID string) error {
+	agent, err := s.getAgentFromContext(c)
+	if err != nil {
+		return err
+	}
+
+	if err := s.checkAgentPermissionByWorkflow(c, agent, workflowID, nil, nil); err != nil {
+		return err
+	}
+
 	return s.queue.Wait(c, workflowID)
 }
 
@@ -106,11 +127,15 @@ func (s *RPC) Extend(c context.Context, workflowID string) error {
 		return err
 	}
 
-	return s.queue.Extend(c, workflowID)
+	if err := s.checkAgentPermissionByWorkflow(c, agent, workflowID, nil, nil); err != nil {
+		return err
+	}
+
+	return s.queue.Extend(c, agent.ID, workflowID)
 }
 
 // Update updates the state of a step.
-func (s *RPC) Update(_ context.Context, strWorkflowID string, state rpc.StepState) error {
+func (s *RPC) Update(c context.Context, strWorkflowID string, state rpc.StepState) error {
 	workflowID, err := strconv.ParseInt(strWorkflowID, 10, 64)
 	if err != nil {
 		return err
@@ -128,6 +153,11 @@ func (s *RPC) Update(_ context.Context, strWorkflowID string, state rpc.StepStat
 		return err
 	}
 
+	agent, err := s.getAgentFromContext(c)
+	if err != nil {
+		return err
+	}
+
 	step, err := s.store.StepByUUID(state.StepUUID)
 	if err != nil {
 		log.Error().Err(err).Msgf("cannot find step with uuid %s", state.StepUUID)
@@ -149,6 +179,11 @@ func (s *RPC) Update(_ context.Context, strWorkflowID string, state rpc.StepStat
 		return err
 	}
 
+	// check before agent can alter some state
+	if err := s.checkAgentPermissionByWorkflow(c, agent, strWorkflowID, currentPipeline, repo); err != nil {
+		return err
+	}
+
 	if err := pipeline.UpdateStepStatus(s.store, step, state); err != nil {
 		log.Error().Err(err).Msg("rpc.update: cannot update step")
 	}
@@ -192,6 +227,7 @@ func (s *RPC) Init(c context.Context, strWorkflowID string, state rpc.WorkflowSt
 	if err != nil {
 		return err
 	}
+
 	workflow.AgentID = agent.ID
 
 	currentPipeline, err := s.store.GetPipeline(workflow.PipelineID)
@@ -206,6 +242,11 @@ func (s *RPC) Init(c context.Context, strWorkflowID string, state rpc.WorkflowSt
 		return err
 	}
 
+	// check before agent can alter some state
+	if err := s.checkAgentPermissionByWorkflow(c, agent, strWorkflowID, currentPipeline, repo); err != nil {
+		return err
+	}
+
 	if currentPipeline.Status == model.StatusPending {
 		if currentPipeline, err = pipeline.UpdateToStatusRunning(s.store, *currentPipeline, state.Started); err != nil {
 			log.Error().Err(err).Msgf("init: cannot update pipeline %d state", currentPipeline.ID)
@@ -272,6 +313,16 @@ func (s *RPC) Done(c context.Context, strWorkflowID string, state rpc.WorkflowSt
 		return err
 	}
 
+	agent, err := s.getAgentFromContext(c)
+	if err != nil {
+		return err
+	}
+
+	// check before agent can alter some state
+	if err := s.checkAgentPermissionByWorkflow(c, agent, strWorkflowID, currentPipeline, repo); err != nil {
+		return err
+	}
+
 	logger := log.With().
 		Str("repo_id", fmt.Sprint(repo.ID)).
 		Str("pipeline_id", fmt.Sprint(currentPipeline.ID)).
@@ -328,10 +379,6 @@ func (s *RPC) Done(c context.Context, strWorkflowID string, state rpc.WorkflowSt
 		s.pipelineTime.WithLabelValues(repo.FullName, currentPipeline.Branch, string(workflow.State), workflow.Name).Set(float64(workflow.Finished - workflow.Started))
 	}
 
-	agent, err := s.getAgentFromContext(c)
-	if err != nil {
-		return err
-	}
 	return s.updateAgentLastWork(agent)
 }
 
@@ -348,6 +395,17 @@ func (s *RPC) Log(c context.Context, stepUUID string, rpcLogEntries []*rpc.LogEn
 		return err
 	}
 
+	currentPipeline, err := s.store.GetPipeline(step.PipelineID)
+	if err != nil {
+		log.Error().Err(err).Msgf("cannot find pipeline with id %d", step.PipelineID)
+		return err
+	}
+
+	// check before agent can alter some state
+	if err := s.checkAgentPermissionByWorkflow(c, agent, "", currentPipeline, nil); err != nil {
+		return err
+	}
+
 	err = s.updateAgentLastWork(agent)
 	if err != nil {
 		return err
@@ -441,6 +499,44 @@ func (s *RPC) ReportHealth(ctx context.Context, status string) error {
 	return s.store.AgentUpdate(agent)
 }
 
+func (s *RPC) checkAgentPermissionByWorkflow(_ context.Context, agent *model.Agent, strWorkflowID string, pipeline *model.Pipeline, repo *model.Repo) error {
+	var err error
+	if repo == nil && pipeline == nil {
+		workflowID, err := strconv.ParseInt(strWorkflowID, 10, 64)
+		if err != nil {
+			return err
+		}
+
+		workflow, err := s.store.WorkflowLoad(workflowID)
+		if err != nil {
+			log.Error().Err(err).Msgf("cannot find workflow with id %d", workflowID)
+			return err
+		}
+
+		pipeline, err = s.store.GetPipeline(workflow.PipelineID)
+		if err != nil {
+			log.Error().Err(err).Msgf("cannot find pipeline with id %d", workflow.PipelineID)
+			return err
+		}
+	}
+
+	if repo == nil {
+		repo, err = s.store.GetRepo(pipeline.RepoID)
+		if err != nil {
+			log.Error().Err(err).Msgf("cannot find repo with id %d", pipeline.RepoID)
+			return err
+		}
+	}
+
+	if agent.CanAccessRepo(repo) {
+		return nil
+	}
+
+	msg := fmt.Sprintf("agent '%d' is not allowed to interact with repo[%d] '%s'", agent.ID, repo.ID, repo.FullName)
+	log.Error().Int64("repoId", repo.ID).Msg(msg)
+	return errors.New(msg)
+}
+
 func (s *RPC) completeChildrenIfParentCompleted(completedWorkflow *model.Workflow) {
 	for _, c := range completedWorkflow.Children {
 		if c.Running() {

server/model/agent.go

@@ -14,6 +14,13 @@
 
 package model
 
+import (
+	"encoding/base32"
+	"fmt"
+
+	"github.com/gorilla/securecookie"
+)
+
 type Agent struct {
 	ID          int64  `json:"id"            xorm:"pk autoincr 'id'"`
 	Created     int64  `json:"created"       xorm:"created"`
@@ -28,13 +35,51 @@ type Agent struct {
 	Capacity    int32  `json:"capacity"      xorm:"capacity"`
 	Version     string `json:"version"       xorm:"'version'"`
 	NoSchedule  bool   `json:"no_schedule"   xorm:"no_schedule"`
+	// OrgID is counted as unset if set to -1, this is done to ensure a new(Agent) still enforce the OrgID check by default
+	OrgID int64 `json:"org_id"        xorm:"INDEX 'org_id'"`
 } //	@name Agent
 
+const (
+	IDNotSet         = -1
+	agentFilterOrgID = "org-id"
+)
+
 // TableName return database table name for xorm.
 func (Agent) TableName() string {
 	return "agents"
 }
 
 func (a *Agent) IsSystemAgent() bool {
-	return a.OwnerID == -1
+	return a.OwnerID == IDNotSet
+}
+
+func GenerateNewAgentToken() string {
+	return base32.StdEncoding.EncodeToString(securecookie.GenerateRandomKey(32))
+}
+
+func (a *Agent) GetServerLabels() (map[string]string, error) {
+	filters := make(map[string]string)
+
+	// enforce filters for user and organization agents
+	if a.OrgID != IDNotSet {
+		filters[agentFilterOrgID] = fmt.Sprintf("%d", a.OrgID)
+	} else {
+		filters[agentFilterOrgID] = "*"
+	}
+
+	return filters, nil
+}
+
+func (a *Agent) CanAccessRepo(repo *Repo) bool {
+	// global agent
+	if a.OrgID == IDNotSet {
+		return true
+	}
+
+	// agent has access to the organization
+	if a.OrgID == repo.OrgID {
+		return true
+	}
+
+	return false
 }

server/model/agent_test.go

@@ -0,0 +1,90 @@
+// Copyright 2024 Woodpecker Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGenerateNewAgentToken(t *testing.T) {
+	token1 := GenerateNewAgentToken()
+	token2 := GenerateNewAgentToken()
+
+	assert.NotEmpty(t, token1)
+	assert.NotEmpty(t, token2)
+	assert.NotEqual(t, token1, token2)
+	assert.Len(t, token1, 56)
+}
+
+func TestAgent_GetServerLabels(t *testing.T) {
+	t.Run("EmptyAgent", func(t *testing.T) {
+		agent := &Agent{}
+		filters, err := agent.GetServerLabels()
+		assert.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			agentFilterOrgID: "0",
+		}, filters)
+	})
+
+	t.Run("GlobalAgent", func(t *testing.T) {
+		agent := &Agent{
+			OrgID: IDNotSet,
+		}
+		filters, err := agent.GetServerLabels()
+		assert.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			agentFilterOrgID: "*",
+		}, filters)
+	})
+
+	t.Run("OrgAgent", func(t *testing.T) {
+		agent := &Agent{
+			OrgID: 123,
+		}
+		filters, err := agent.GetServerLabels()
+		assert.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			agentFilterOrgID: "123",
+		}, filters)
+	})
+}
+
+func TestAgent_CanAccessRepo(t *testing.T) {
+	repo := &Repo{ID: 123, OrgID: 12}
+	otherRepo := &Repo{ID: 456, OrgID: 45}
+
+	t.Run("EmptyAgent", func(t *testing.T) {
+		agent := &Agent{}
+		assert.False(t, agent.CanAccessRepo(repo))
+	})
+
+	t.Run("GlobalAgent", func(t *testing.T) {
+		agent := &Agent{
+			OrgID: IDNotSet,
+		}
+
+		assert.True(t, agent.CanAccessRepo(repo))
+	})
+
+	t.Run("OrgAgent", func(t *testing.T) {
+		agent := &Agent{
+			OrgID: 12,
+		}
+		assert.True(t, agent.CanAccessRepo(repo))
+		assert.False(t, agent.CanAccessRepo(otherRepo))
+	})
+}

server/model/task.go

@@ -41,6 +41,18 @@ func (t *Task) String() string {
 	return sb.String()
 }
 
+func (t *Task) ApplyLabelsFromRepo(r *Repo) error {
+	if r == nil {
+		return fmt.Errorf("repo is nil but needed to get task labels")
+	}
+	if t.Labels == nil {
+		t.Labels = make(map[string]string)
+	}
+	t.Labels["repo"] = r.FullName
+	t.Labels[agentFilterOrgID] = fmt.Sprintf("%d", r.OrgID)
+	return nil
+}
+
 // ShouldRun tells if a task should be run or skipped, based on dependencies.
 func (t *Task) ShouldRun() bool {
 	if t.runsOnFailure() && t.runsOnSuccess() {

server/model/task_test.go

@@ -0,0 +1,87 @@
+// Copyright 2024 Woodpecker Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTask_GetLabels(t *testing.T) {
+	t.Run("Nil Repo", func(t *testing.T) {
+		task := &Task{}
+		err := task.ApplyLabelsFromRepo(nil)
+
+		assert.Error(t, err)
+		assert.Nil(t, task.Labels)
+		assert.EqualError(t, err, "repo is nil but needed to get task labels")
+	})
+
+	t.Run("Empty Repo", func(t *testing.T) {
+		task := &Task{}
+		repo := &Repo{}
+
+		err := task.ApplyLabelsFromRepo(repo)
+
+		assert.NoError(t, err)
+		assert.NotNil(t, task.Labels)
+		assert.Equal(t, map[string]string{
+			"repo":           "",
+			agentFilterOrgID: "0",
+		}, task.Labels)
+	})
+
+	t.Run("Empty Labels", func(t *testing.T) {
+		task := &Task{}
+		repo := &Repo{
+			FullName: "test/repo",
+			ID:       123,
+			OrgID:    456,
+		}
+
+		err := task.ApplyLabelsFromRepo(repo)
+
+		assert.NoError(t, err)
+		assert.NotNil(t, task.Labels)
+		assert.Equal(t, map[string]string{
+			"repo":           "test/repo",
+			agentFilterOrgID: "456",
+		}, task.Labels)
+	})
+
+	t.Run("Existing Labels", func(t *testing.T) {
+		task := &Task{
+			Labels: map[string]string{
+				"existing": "label",
+			},
+		}
+		repo := &Repo{
+			FullName: "test/repo",
+			ID:       123,
+			OrgID:    456,
+		}
+
+		err := task.ApplyLabelsFromRepo(repo)
+
+		assert.NoError(t, err)
+		assert.NotNil(t, task.Labels)
+		assert.Equal(t, map[string]string{
+			"existing":       "label",
+			"repo":           "test/repo",
+			agentFilterOrgID: "456",
+		}, task.Labels)
+	})
+}

server/pipeline/queue.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 
 	"go.woodpecker-ci.org/woodpecker/v2/pipeline/rpc"
 	"go.woodpecker-ci.org/woodpecker/v2/server"
@@ -31,18 +32,19 @@ func queuePipeline(ctx context.Context, repo *model.Repo, pipelineItems []*stepb
 		if item.Workflow.State == model.StatusSkipped {
 			continue
 		}
-		task := new(model.Task)
+		task := &model.Task{
-		task.ID = fmt.Sprint(item.Workflow.ID)
+			ID:     fmt.Sprint(item.Workflow.ID),
-		task.Labels = map[string]string{}
+			Labels: make(map[string]string),
-		for k, v := range item.Labels {
+		}
-			task.Labels[k] = v
+		maps.Copy(task.Labels, item.Labels)
+		err := task.ApplyLabelsFromRepo(repo)
+		if err != nil {
+			return err
 		}
-		task.Labels["repo"] = repo.FullName
 		task.Dependencies = taskIDs(item.DependsOn, pipelineItems)
 		task.RunOn = item.RunsOn
 		task.DepStatus = make(map[string]model.StatusValue)
 
-		var err error
 		task.Data, err = json.Marshal(rpc.Workflow{
 			ID:      fmt.Sprint(item.Workflow.ID),
 			Config:  item.Config,

server/queue/fifo.go

@@ -191,12 +191,16 @@ func (q *fifo) Wait(c context.Context, id string) error {
 }
 
 // Extend extends the task execution deadline.
-func (q *fifo) Extend(_ context.Context, id string) error {
+func (q *fifo) Extend(_ context.Context, agentID int64, id string) error {
 	q.Lock()
 	defer q.Unlock()
 
 	state, ok := q.running[id]
 	if ok {
+		if state.item.AgentID != agentID {
+			return ErrAgentMissMatch
+		}
+
 		state.deadline = time.Now().Add(q.extension)
 		return nil
 	}

server/queue/queue.go

@@ -28,6 +28,9 @@ var (
 
 	// ErrNotFound indicates the task was not found in the queue.
 	ErrNotFound = errors.New("queue: task not found")
+
+	// ErrAgentMissMatch indicates a task is assigned to a different agent.
+	ErrAgentMissMatch = errors.New("task assigned to different agent")
 )
 
 // InfoT provides runtime information.
@@ -79,7 +82,7 @@ type Queue interface {
 	Poll(c context.Context, agentID int64, f FilterFn) (*model.Task, error)
 
 	// Extend extends the deadline for a task.
-	Extend(c context.Context, id string) error
+	Extend(c context.Context, agentID int64, workflowID string) error
 
 	// Done signals the task is complete.
 	Done(c context.Context, id string, exitStatus model.StatusValue) error

server/router/api.go

@@ -71,6 +71,11 @@ func apiRoutes(e *gin.RouterGroup) {
 					org.GET("/registries/:registry", api.GetOrgRegistry)
 					org.PATCH("/registries/:registry", api.PatchOrgRegistry)
 					org.DELETE("/registries/:registry", api.DeleteOrgRegistry)
+
+					org.GET("/agents", api.GetOrgAgents)
+					org.POST("/agents", api.PostOrgAgent)
+					org.PATCH("/agents/:agent_id", api.PatchOrgAgent)
+					org.DELETE("/agents/:agent_id", api.DeleteOrgAgent)
 				}
 			}
 		}
@@ -217,10 +222,10 @@ func apiRoutes(e *gin.RouterGroup) {
 			agentBase.Use(session.MustAdmin())
 			agentBase.GET("", api.GetAgents)
 			agentBase.POST("", api.PostAgent)
-			agentBase.GET("/:agent", api.GetAgent)
+			agentBase.GET("/:agent_id", api.GetAgent)
-			agentBase.GET("/:agent/tasks", api.GetAgentTasks)
+			agentBase.GET("/:agent_id/tasks", api.GetAgentTasks)
-			agentBase.PATCH("/:agent", api.PatchAgent)
+			agentBase.PATCH("/:agent_id", api.PatchAgent)
-			agentBase.DELETE("/:agent", api.DeleteAgent)
+			agentBase.DELETE("/:agent_id", api.DeleteAgent)
 		}
 
 		apiBase.GET("/forges", api.GetForges)

server/store/datastore/agent.go

@@ -22,8 +22,7 @@ import (
 
 var ErrNoTokenProvided = errors.New("please provide a token")
 
-func (s storage) AgentList(p *model.ListOptions) ([]*model.Agent, error) {
+func (s storage) AgentList(p *model.ListOptions) (agents []*model.Agent, _ error) {
-	var agents []*model.Agent
 	return agents, s.paginate(p).OrderBy("id").Find(&agents)
 }
 
@@ -55,3 +54,7 @@ func (s storage) AgentUpdate(agent *model.Agent) error {
 func (s storage) AgentDelete(agent *model.Agent) error {
 	return wrapDelete(s.engine.ID(agent.ID).Delete(new(model.Agent)))
 }
+
+func (s storage) AgentListForOrg(orgID int64, p *model.ListOptions) (agents []*model.Agent, _ error) {
+	return agents, s.paginate(p).Where("org_id = ?", orgID).OrderBy("id").Find(&agents)
+}

server/store/datastore/agent_test.go

@@ -67,12 +67,10 @@ func TestAgentList(t *testing.T) {
 	agent1 := &model.Agent{
 		ID:   int64(1),
 		Name: "test-1",
-		Token: "secret-token-1",
 	}
 	agent2 := &model.Agent{
 		ID:   int64(2),
 		Name: "test-2",
-		Token: "secret-token-2",
 	}
 	err := store.AgentCreate(agent1)
 	assert.NoError(t, err)
@@ -106,3 +104,43 @@ func TestAgentUpdate(t *testing.T) {
 	err = store.AgentUpdate(agent)
 	assert.NoError(t, err)
 }
+
+func TestAgentListForOrg(t *testing.T) {
+	store, closer := newTestStore(t, new(model.Agent))
+	defer closer()
+
+	agent1 := &model.Agent{
+		ID:    int64(1),
+		Name:  "test-1",
+		OrgID: int64(100),
+	}
+	agent2 := &model.Agent{
+		ID:    int64(2),
+		Name:  "test-2",
+		OrgID: int64(100),
+	}
+	agent3 := &model.Agent{
+		ID:    int64(3),
+		Name:  "test-3",
+		OrgID: int64(200),
+	}
+	assert.NoError(t, store.AgentCreate(agent1))
+	assert.NoError(t, store.AgentCreate(agent2))
+	assert.NoError(t, store.AgentCreate(agent3))
+
+	agents, err := store.AgentListForOrg(100, &model.ListOptions{All: true})
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(agents))
+	assert.Equal(t, "test-1", agents[0].Name)
+	assert.Equal(t, "test-2", agents[1].Name)
+
+	agents, err = store.AgentListForOrg(200, &model.ListOptions{All: true})
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(agents))
+	assert.Equal(t, "test-3", agents[0].Name)
+
+	agents, err = store.AgentListForOrg(100, &model.ListOptions{Page: 1, PerPage: 1})
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(agents))
+	assert.Equal(t, "test-1", agents[0].Name)
+}

server/store/datastore/migration/015_add_org_agents.go

@@ -0,0 +1,49 @@
+// Copyright 2024 Woodpecker Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package migration
+
+import (
+	"fmt"
+
+	"src.techknowlogick.com/xormigrate"
+	"xorm.io/xorm"
+
+	"go.woodpecker-ci.org/woodpecker/v2/server/model"
+)
+
+type agentV015 struct {
+	ID      int64 `xorm:"pk autoincr 'id'"`
+	OwnerID int64 `xorm:"INDEX 'owner_id'"`
+	OrgID   int64 `xorm:"INDEX 'org_id'"`
+}
+
+func (agentV015) TableName() string {
+	return "agents"
+}
+
+var addOrgAgents = xormigrate.Migration{
+	ID: "add-org-agents",
+	MigrateSession: func(sess *xorm.Session) (err error) {
+		if err := sess.Sync(new(agentV015)); err != nil {
+			return fmt.Errorf("sync models failed: %w", err)
+		}
+
+		// Update all existing agents to be global agents
+		_, err = sess.Cols("org_id").Update(&model.Agent{
+			OrgID: model.IDNotSet,
+		})
+		return err
+	},
+}

server/store/datastore/migration/migration.go

@@ -43,6 +43,7 @@ var migrationTasks = []*xormigrate.Migration{
 	&renameStartEndTime,
 	&fixV31Registries,
 	&removeOldMigrationsOfV1,
+	&addOrgAgents,
 }
 
 var allBeans = []any{

server/store/mocks/store.go

@@ -143,6 +143,36 @@ func (_m *Store) AgentList(p *model.ListOptions) ([]*model.Agent, error) {
 	return r0, r1
 }
 
+// AgentListForOrg provides a mock function with given fields: orgID, opt
+func (_m *Store) AgentListForOrg(orgID int64, opt *model.ListOptions) ([]*model.Agent, error) {
+	ret := _m.Called(orgID, opt)
+
+	if len(ret) == 0 {
+		panic("no return value specified for AgentListForOrg")
+	}
+
+	var r0 []*model.Agent
+	var r1 error
+	if rf, ok := ret.Get(0).(func(int64, *model.ListOptions) ([]*model.Agent, error)); ok {
+		return rf(orgID, opt)
+	}
+	if rf, ok := ret.Get(0).(func(int64, *model.ListOptions) []*model.Agent); ok {
+		r0 = rf(orgID, opt)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Agent)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(int64, *model.ListOptions) error); ok {
+		r1 = rf(orgID, opt)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // AgentUpdate provides a mock function with given fields: _a0
 func (_m *Store) AgentUpdate(_a0 *model.Agent) error {
 	ret := _m.Called(_a0)

server/store/store.go

@@ -180,6 +180,7 @@ type Store interface {
 	AgentList(p *model.ListOptions) ([]*model.Agent, error)
 	AgentUpdate(*model.Agent) error
 	AgentDelete(*model.Agent) error
+	AgentListForOrg(orgID int64, opt *model.ListOptions) ([]*model.Agent, error)
 
 	// Workflow
 	WorkflowGetTree(*model.Pipeline) ([]*model.Workflow, error)

web/src/assets/locales/en.json

@@ -266,6 +266,9 @@
       },
       "registries": {
         "desc": "Organization registry credentials can be added to use private images for all pipelines of an organization."
+      },
+      "agents": {
+        "desc": "Agents registered for this organization."
       }
     }
   },
@@ -313,6 +316,9 @@
           "desc": "The max amount of parallel pipelines executed by this agent.",
           "badge": "capacity"
         },
+        "org": {
+          "badge": "org"
+        },
         "version": "Version",
         "last_contact": "Last contact",
         "never": "Never",
@@ -415,6 +421,9 @@
         "download_cli": "Download CLI",
         "reset_token": "Reset token",
         "swagger_ui": "Swagger UI"
+      },
+      "agents": {
+        "desc": "Agents registered to your account repos."
       }
     }
   },

web/src/components/admin/settings/AdminAgentsTab.vue

@@ -1,202 +1,23 @@
 <template>
-  <Settings :title="$t('admin.settings.agents.agents')" :desc="$t('admin.settings.agents.desc')">
+  <AgentManager
-    <template #titleActions>
+    :desc="$t('admin.settings.agents.desc')"
-      <Button
+    :load-agents="loadAgents"
-        v-if="selectedAgent"
+    :create-agent="createAgent"
-        :text="$t('admin.settings.agents.show')"
+    :update-agent="updateAgent"
-        start-icon="back"
+    :delete-agent="deleteAgent"
-        @click="selectedAgent = undefined"
+    :is-admin="true"
   />
-      <Button v-else :text="$t('admin.settings.agents.add')" start-icon="plus" @click="showAddAgent" />
-    </template>
-
-    <div v-if="!selectedAgent" class="space-y-4 text-wp-text-100">
-      <ListItem
-        v-for="agent in agents"
-        :key="agent.id"
-        class="items-center !bg-wp-background-200 !dark:bg-wp-background-100"
-      >
-        <span>{{ agent.name || `Agent ${agent.id}` }}</span>
-        <span class="ml-auto">
-          <span class="hidden md:inline-block space-x-2">
-            <Badge v-if="agent.platform" :label="$t('admin.settings.agents.platform.badge')" :value="agent.platform" />
-            <Badge v-if="agent.backend" :label="$t('admin.settings.agents.backend.badge')" :value="agent.backend" />
-            <Badge v-if="agent.capacity" :label="$t('admin.settings.agents.capacity.badge')" :value="agent.capacity" />
-          </span>
-          <span class="ml-2">{{
-            agent.last_contact ? date.timeAgo(agent.last_contact * 1000) : $t('admin.settings.agents.never')
-          }}</span>
-        </span>
-        <IconButton
-          icon="edit"
-          :title="$t('admin.settings.agents.edit_agent')"
-          class="ml-2 w-8 h-8"
-          @click="editAgent(agent)"
-        />
-        <IconButton
-          icon="trash"
-          :title="$t('admin.settings.agents.delete_agent')"
-          class="ml-2 w-8 h-8 hover:text-wp-control-error-100"
-          :is-loading="isDeleting"
-          @click="deleteAgent(agent)"
-        />
-      </ListItem>
-
-      <div v-if="agents?.length === 0" class="ml-2">{{ $t('admin.settings.agents.none') }}</div>
-    </div>
-    <div v-else>
-      <form @submit.prevent="saveAgent">
-        <InputField v-slot="{ id }" :label="$t('admin.settings.agents.name.name')">
-          <TextField
-            :id="id"
-            v-model="selectedAgent.name"
-            :placeholder="$t('admin.settings.agents.name.placeholder')"
-            required
-          />
-        </InputField>
-
-        <InputField :label="$t('admin.settings.agents.no_schedule.name')">
-          <Checkbox
-            :model-value="selectedAgent.no_schedule || false"
-            :label="$t('admin.settings.agents.no_schedule.placeholder')"
-            @update:model-value="selectedAgent!.no_schedule = $event"
-          />
-        </InputField>
-
-        <template v-if="isEditingAgent">
-          <InputField v-slot="{ id }" :label="$t('admin.settings.agents.token')">
-            <TextField
-              :id="id"
-              v-model="selectedAgent.token"
-              :placeholder="$t('admin.settings.agents.token')"
-              disabled
-            />
-          </InputField>
-
-          <InputField v-slot="{ id }" :label="$t('admin.settings.agents.id')">
-            <TextField :id="id" :model-value="selectedAgent.id?.toString()" disabled />
-          </InputField>
-
-          <InputField
-            v-slot="{ id }"
-            :label="$t('admin.settings.agents.backend.backend')"
-            docs-url="docs/next/administration/backends/docker"
-          >
-            <TextField :id="id" v-model="selectedAgent.backend" disabled />
-          </InputField>
-
-          <InputField v-slot="{ id }" :label="$t('admin.settings.agents.platform.platform')">
-            <TextField :id="id" v-model="selectedAgent.platform" disabled />
-          </InputField>
-
-          <InputField
-            v-slot="{ id }"
-            :label="$t('admin.settings.agents.capacity.capacity')"
-            docs-url="docs/next/administration/agent-config#woodpecker_max_workflows"
-          >
-            <span class="text-wp-text-alt-100">{{ $t('admin.settings.agents.capacity.desc') }}</span>
-            <TextField :id="id" :model-value="selectedAgent.capacity?.toString()" disabled />
-          </InputField>
-
-          <InputField v-slot="{ id }" :label="$t('admin.settings.agents.version')">
-            <TextField :id="id" :model-value="selectedAgent.version" disabled />
-          </InputField>
-
-          <InputField v-slot="{ id }" :label="$t('admin.settings.agents.last_contact')">
-            <TextField
-              :id="id"
-              :model-value="
-                selectedAgent.last_contact
-                  ? date.timeAgo(selectedAgent.last_contact * 1000)
-                  : $t('admin.settings.agents.never')
-              "
-              disabled
-            />
-          </InputField>
-        </template>
-
-        <div class="flex gap-2">
-          <Button type="button" color="gray" :text="$t('cancel')" @click="selectedAgent = undefined" />
-          <Button
-            :is-loading="isSaving"
-            type="submit"
-            color="green"
-            :text="isEditingAgent ? $t('admin.settings.agents.save') : $t('admin.settings.agents.add')"
-          />
-        </div>
-      </form>
-    </div>
-  </Settings>
 </template>
 
 <script lang="ts" setup>
-import { cloneDeep } from 'lodash';
+import AgentManager from '~/components/agent/AgentManager.vue';
-import { computed, ref } from 'vue';
-import { useI18n } from 'vue-i18n';
-
-import Badge from '~/components/atomic/Badge.vue';
-import Button from '~/components/atomic/Button.vue';
-import IconButton from '~/components/atomic/IconButton.vue';
-import ListItem from '~/components/atomic/ListItem.vue';
-import Checkbox from '~/components/form/Checkbox.vue';
-import InputField from '~/components/form/InputField.vue';
-import TextField from '~/components/form/TextField.vue';
-import Settings from '~/components/layout/Settings.vue';
 import useApiClient from '~/compositions/useApiClient';
-import { useAsyncAction } from '~/compositions/useAsyncAction';
-import { useDate } from '~/compositions/useDate';
-import useNotifications from '~/compositions/useNotifications';
-import { usePagination } from '~/compositions/usePaginate';
 import type { Agent } from '~/lib/api/types';
 
 const apiClient = useApiClient();
-const notifications = useNotifications();
-const date = useDate();
-const { t } = useI18n();
 
-const selectedAgent = ref<Partial<Agent>>();
+const loadAgents = (page: number) => apiClient.getAgents({ page });
-const isEditingAgent = computed(() => !!selectedAgent.value?.id);
+const createAgent = (agent: Partial<Agent>) => apiClient.createAgent(agent);
-
+const updateAgent = (agent: Agent) => apiClient.updateAgent(agent);
-async function loadAgents(page: number): Promise<Agent[] | null> {
+const deleteAgent = (agent: Agent) => apiClient.deleteAgent(agent);
-  return apiClient.getAgents({ page });
-}
-
-const { resetPage, data: agents } = usePagination(loadAgents, () => !selectedAgent.value);
-
-const { doSubmit: saveAgent, isLoading: isSaving } = useAsyncAction(async () => {
-  if (!selectedAgent.value) {
-    throw new Error("Unexpected: Can't get agent");
-  }
-
-  if (isEditingAgent.value) {
-    await apiClient.updateAgent(selectedAgent.value);
-    selectedAgent.value = undefined;
-  } else {
-    selectedAgent.value = await apiClient.createAgent(selectedAgent.value);
-  }
-  notifications.notify({
-    title: isEditingAgent.value ? t('admin.settings.agents.saved') : t('admin.settings.agents.created'),
-    type: 'success',
-  });
-  resetPage();
-});
-
-const { doSubmit: deleteAgent, isLoading: isDeleting } = useAsyncAction(async (_agent: Agent) => {
-  // eslint-disable-next-line no-alert
-  if (!confirm(t('admin.settings.agents.delete_confirm'))) {
-    return;
-  }
-
-  await apiClient.deleteAgent(_agent);
-  notifications.notify({ title: t('admin.settings.agents.deleted'), type: 'success' });
-  resetPage();
-});
-
-function editAgent(agent: Agent) {
-  selectedAgent.value = cloneDeep(agent);
-}
-
-function showAddAgent() {
-  selectedAgent.value = cloneDeep({ name: '' });
-}
 </script>

web/src/components/admin/settings/AdminQueueTab.vue

@@ -110,7 +110,12 @@ const tasks = computed(() => {
     _tasks.push(...queueInfo.value.waiting_on_deps.map((task) => ({ ...task, status: 'waiting_on_deps' })));
   }
 
-  return _tasks.sort((a, b) => a.id - b.id);
+  return _tasks
+    .map((task) => ({
+      ...task,
+      labels: Object.fromEntries(Object.entries(task.labels).filter(([key]) => key !== 'org-id')),
+    }))
+    .toSorted((a, b) => a.id - b.id);
 });
 
 async function loadQueueInfo() {

web/src/components/agent/AgentForm.vue

@@ -0,0 +1,104 @@
+<template>
+  <form @submit.prevent="$emit('save')">
+    <InputField v-slot="{ id }" :label="$t('admin.settings.agents.name.name')">
+      <TextField :id="id" v-model="agent.name" :placeholder="$t('admin.settings.agents.name.placeholder')" required />
+    </InputField>
+
+    <InputField :label="$t('admin.settings.agents.no_schedule.name')">
+      <Checkbox
+        :model-value="agent.no_schedule || false"
+        :label="$t('admin.settings.agents.no_schedule.placeholder')"
+        @update:model-value="updateAgent({ no_schedule: $event })"
+      />
+    </InputField>
+
+    <template v-if="isEditingAgent">
+      <InputField v-slot="{ id }" :label="$t('admin.settings.agents.token')">
+        <TextField :id="id" v-model="agent.token" :placeholder="$t('admin.settings.agents.token')" disabled />
+      </InputField>
+
+      <InputField v-slot="{ id }" :label="$t('admin.settings.agents.id')">
+        <TextField :id="id" :model-value="agent.id?.toString()" disabled />
+      </InputField>
+
+      <InputField
+        v-slot="{ id }"
+        :label="$t('admin.settings.agents.backend.backend')"
+        docs-url="docs/next/administration/backends/docker"
+      >
+        <TextField :id="id" v-model="agent.backend" disabled />
+      </InputField>
+
+      <InputField v-slot="{ id }" :label="$t('admin.settings.agents.platform.platform')">
+        <TextField :id="id" v-model="agent.platform" disabled />
+      </InputField>
+
+      <InputField
+        v-slot="{ id }"
+        :label="$t('admin.settings.agents.capacity.capacity')"
+        docs-url="docs/next/administration/agent-config#woodpecker_max_workflows"
+      >
+        <span class="text-wp-text-alt-100">{{ $t('admin.settings.agents.capacity.desc') }}</span>
+        <TextField :id="id" :model-value="agent.capacity?.toString()" disabled />
+      </InputField>
+
+      <InputField v-slot="{ id }" :label="$t('admin.settings.agents.version')">
+        <TextField :id="id" :model-value="agent.version" disabled />
+      </InputField>
+
+      <InputField v-slot="{ id }" :label="$t('admin.settings.agents.last_contact')">
+        <TextField
+          :id="id"
+          :model-value="
+            agent.last_contact ? date.timeAgo(agent.last_contact * 1000) : $t('admin.settings.agents.never')
+          "
+          disabled
+        />
+      </InputField>
+    </template>
+
+    <div class="flex gap-2">
+      <Button type="button" color="gray" :text="$t('cancel')" @click="$emit('cancel')" />
+      <Button
+        :is-loading="isSaving"
+        type="submit"
+        color="green"
+        :text="isEditingAgent ? $t('admin.settings.agents.save') : $t('admin.settings.agents.add')"
+      />
+    </div>
+  </form>
+</template>
+
+<script lang="ts" setup>
+import { computed } from 'vue';
+
+import Button from '~/components/atomic/Button.vue';
+import Checkbox from '~/components/form/Checkbox.vue';
+import InputField from '~/components/form/InputField.vue';
+import TextField from '~/components/form/TextField.vue';
+import { useDate } from '~/compositions/useDate';
+import type { Agent } from '~/lib/api/types';
+
+const props = defineProps<{
+  modelValue: Partial<Agent>;
+  isEditingAgent: boolean;
+  isSaving: boolean;
+}>();
+
+const emit = defineEmits<{
+  (e: 'update:modelValue', value: Partial<Agent>): void;
+  (e: 'save'): void;
+  (e: 'cancel'): void;
+}>();
+
+const date = useDate();
+
+const agent = computed({
+  get: () => props.modelValue,
+  set: (value) => emit('update:modelValue', value),
+});
+
+function updateAgent(newValues: Partial<Agent>) {
+  emit('update:modelValue', { ...agent.value, ...newValues });
+}
+</script>

web/src/components/agent/AgentList.vue

@@ -0,0 +1,67 @@
+<template>
+  <div v-if="!props.loading" class="space-y-4 text-wp-text-100">
+    <ListItem
+      v-for="agent in props.agents"
+      :key="agent.id"
+      class="items-center !bg-wp-background-200 !dark:bg-wp-background-100"
+    >
+      <span>{{ agent.name || `Agent ${agent.id}` }}</span>
+      <span class="ml-auto">
+        <span class="hidden md:inline-block space-x-2">
+          <Badge
+            v-if="props.isAdmin === true && agent.org_id !== -1"
+            :label="$t('admin.settings.agents.org.badge')"
+            :value="agent.org_id"
+          />
+          <Badge v-if="agent.platform" :label="$t('admin.settings.agents.platform.badge')" :value="agent.platform" />
+          <Badge v-if="agent.backend" :label="$t('admin.settings.agents.backend.badge')" :value="agent.backend" />
+          <Badge v-if="agent.capacity" :label="$t('admin.settings.agents.capacity.badge')" :value="agent.capacity" />
+        </span>
+        <span class="ml-2">{{
+          agent.last_contact ? date.timeAgo(agent.last_contact * 1000) : $t('admin.settings.agents.never')
+        }}</span>
+      </span>
+      <IconButton
+        icon="edit"
+        :title="$t('admin.settings.agents.edit_agent')"
+        class="ml-2 w-8 h-8"
+        @click="$emit('edit', agent)"
+      />
+      <IconButton
+        icon="trash"
+        :title="$t('admin.settings.agents.delete_agent')"
+        class="ml-2 w-8 h-8 hover:text-wp-control-error-100"
+        :is-loading="props.isDeleting"
+        @click="$emit('delete', agent)"
+      />
+    </ListItem>
+
+    <div v-if="props.agents?.length === 0" class="ml-2">{{ $t('admin.settings.agents.none') }}</div>
+  </div>
+  <div v-else class="flex justify-center">
+    <Icon name="loading" class="animate-spin" />
+  </div>
+</template>
+
+<script lang="ts" setup>
+import Badge from '~/components/atomic/Badge.vue';
+import Icon from '~/components/atomic/Icon.vue';
+import IconButton from '~/components/atomic/IconButton.vue';
+import ListItem from '~/components/atomic/ListItem.vue';
+import { useDate } from '~/compositions/useDate';
+import type { Agent } from '~/lib/api/types';
+
+const props = defineProps<{
+  agents: Agent[];
+  isDeleting: boolean;
+  loading: boolean;
+  isAdmin?: boolean;
+}>();
+
+defineEmits<{
+  (e: 'edit', agent: Agent): void;
+  (e: 'delete', agent: Agent): void;
+}>();
+
+const date = useDate();
+</script>

web/src/components/agent/AgentManager.vue

@@ -0,0 +1,101 @@
+<template>
+  <Settings :title="$t('admin.settings.agents.agents')" :desc="desc">
+    <template #titleActions>
+      <Button
+        v-if="selectedAgent"
+        :text="$t('admin.settings.agents.show')"
+        start-icon="back"
+        @click="selectedAgent = undefined"
+      />
+      <Button v-else :text="$t('admin.settings.agents.add')" start-icon="plus" @click="showAddAgent" />
+    </template>
+
+    <AgentList
+      v-if="!selectedAgent"
+      :loading="loading"
+      :agents="agents"
+      :is-deleting="isDeleting"
+      :is-admin="isAdmin"
+      @edit="editAgent"
+      @delete="deleteAgent"
+    />
+    <AgentForm
+      v-else
+      v-model="selectedAgent"
+      :is-editing-agent="isEditingAgent"
+      :is-saving="isSaving"
+      @save="saveAgent"
+      @cancel="selectedAgent = undefined"
+    />
+  </Settings>
+</template>
+
+<script lang="ts" setup>
+import { cloneDeep } from 'lodash';
+import { computed, ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+
+import Button from '~/components/atomic/Button.vue';
+import Settings from '~/components/layout/Settings.vue';
+import { useAsyncAction } from '~/compositions/useAsyncAction';
+import useNotifications from '~/compositions/useNotifications';
+import { usePagination } from '~/compositions/usePaginate';
+import type { Agent } from '~/lib/api/types';
+
+import AgentForm from './AgentForm.vue';
+import AgentList from './AgentList.vue';
+
+const props = defineProps<{
+  desc: string;
+  loadAgents: (page: number) => Promise<Agent[] | null>;
+  createAgent: (agent: Partial<Agent>) => Promise<Agent>;
+  updateAgent: (agent: Agent) => Promise<Agent | void>;
+  deleteAgent: (agent: Agent) => Promise<unknown>;
+  isAdmin?: boolean;
+}>();
+
+const notifications = useNotifications();
+const { t } = useI18n();
+
+const selectedAgent = ref<Partial<Agent>>();
+const isEditingAgent = computed(() => !!selectedAgent.value?.id);
+
+const { resetPage, data: agents, loading } = usePagination(props.loadAgents);
+
+const { doSubmit: saveAgent, isLoading: isSaving } = useAsyncAction(async () => {
+  if (!selectedAgent.value) {
+    throw new Error("Unexpected: Can't get agent");
+  }
+
+  if (isEditingAgent.value) {
+    await props.updateAgent(selectedAgent.value as Agent);
+    selectedAgent.value = undefined;
+  } else {
+    selectedAgent.value = await props.createAgent(selectedAgent.value);
+  }
+  notifications.notify({
+    title: isEditingAgent.value ? t('admin.settings.agents.saved') : t('admin.settings.agents.created'),
+    type: 'success',
+  });
+  resetPage();
+});
+
+const { doSubmit: deleteAgent, isLoading: isDeleting } = useAsyncAction(async (_agent: Agent) => {
+  // eslint-disable-next-line no-alert
+  if (!confirm(t('admin.settings.agents.delete_confirm'))) {
+    return;
+  }
+
+  await props.deleteAgent(_agent);
+  notifications.notify({ title: t('admin.settings.agents.deleted'), type: 'success' });
+  resetPage();
+});
+
+function editAgent(agent: Agent) {
+  selectedAgent.value = cloneDeep(agent);
+}
+
+function showAddAgent() {
+  selectedAgent.value = { name: '' };
+}
+</script>

web/src/components/org/settings/OrgAgentsTab.vue

@@ -0,0 +1,28 @@
+<template>
+  <AgentManager
+    :desc="$t('org.settings.agents.desc')"
+    :load-agents="loadAgents"
+    :create-agent="createAgent"
+    :update-agent="updateAgent"
+    :delete-agent="deleteAgent"
+  />
+</template>
+
+<script lang="ts" setup>
+import { inject, type Ref } from 'vue';
+
+import AgentManager from '~/components/agent/AgentManager.vue';
+import useApiClient from '~/compositions/useApiClient';
+import type { Agent, Org } from '~/lib/api/types';
+
+const apiClient = useApiClient();
+const org = inject<Ref<Org>>('org');
+if (org === undefined) {
+  throw new Error('Unexpected: "org" should be provided at this place');
+}
+
+const loadAgents = (page: number) => apiClient.getOrgAgents(org.value.id, { page });
+const createAgent = (agent: Partial<Agent>) => apiClient.createOrgAgent(org.value.id, agent);
+const updateAgent = (agent: Agent) => apiClient.updateOrgAgent(org.value.id, agent.id, agent);
+const deleteAgent = (agent: Agent) => apiClient.deleteOrgAgent(org.value.id, agent.id);
+</script>

web/src/components/user/UserAgentsTab.vue

@@ -0,0 +1,28 @@
+<template>
+  <AgentManager
+    :desc="$t('user.settings.agents.desc')"
+    :load-agents="loadAgents"
+    :create-agent="createAgent"
+    :update-agent="updateAgent"
+    :delete-agent="deleteAgent"
+  />
+</template>
+
+<script lang="ts" setup>
+import AgentManager from '~/components/agent/AgentManager.vue';
+import useApiClient from '~/compositions/useApiClient';
+import useAuthentication from '~/compositions/useAuthentication';
+import type { Agent } from '~/lib/api/types';
+
+const apiClient = useApiClient();
+const { user } = useAuthentication();
+
+if (!user) {
+  throw new Error('Unexpected: User should be authenticated');
+}
+
+const loadAgents = (page: number) => apiClient.getOrgAgents(user.org_id, { page });
+const createAgent = (agent: Partial<Agent>) => apiClient.createOrgAgent(user.org_id, agent);
+const updateAgent = (agent: Agent) => apiClient.updateOrgAgent(user.org_id, agent.id, agent);
+const deleteAgent = (agent: Agent) => apiClient.deleteOrgAgent(user.org_id, agent.id);
+</script>

web/src/lib/api/index.ts

@@ -318,14 +318,31 @@ export default class WoodpeckerClient extends ApiClient {
     return this._post('/api/agents', agent) as Promise<Agent>;
   }
 
-  async updateAgent(agent: Partial<Agent>): Promise<unknown> {
+  async updateAgent(agent: Partial<Agent>): Promise<Agent> {
-    return this._patch(`/api/agents/${agent.id}`, agent);
+    return this._patch(`/api/agents/${agent.id}`, agent) as Promise<Agent>;
   }
 
   async deleteAgent(agent: Agent): Promise<unknown> {
     return this._delete(`/api/agents/${agent.id}`);
   }
 
+  async getOrgAgents(orgId: number, opts?: PaginationOptions): Promise<Agent[] | null> {
+    const query = encodeQueryString(opts);
+    return this._get(`/api/orgs/${orgId}/agents?${query}`) as Promise<Agent[] | null>;
+  }
+
+  async createOrgAgent(orgId: number, agent: Partial<Agent>): Promise<Agent> {
+    return this._post(`/api/orgs/${orgId}/agents`, agent) as Promise<Agent>;
+  }
+
+  async updateOrgAgent(orgId: number, agentId: number, agent: Partial<Agent>): Promise<Agent> {
+    return this._patch(`/api/orgs/${orgId}/agents/${agentId}`, agent) as Promise<Agent>;
+  }
+
+  async deleteOrgAgent(orgId: number, agentId: number): Promise<unknown> {
+    return this._delete(`/api/orgs/${orgId}/agents/${agentId}`);
+  }
+
   async getForges(opts?: PaginationOptions): Promise<Forge[] | null> {
     const query = encodeQueryString(opts);
     return this._get(`/api/forges?${query}`) as Promise<Forge[] | null>;

web/src/lib/api/types/agent.ts

@@ -1,6 +1,8 @@
 export interface Agent {
   id: number;
   name: string;
+  owner_id: number;
+  org_id: number;
   token: string;
   created: number;
   updated: number;

web/src/lib/api/types/queue.ts

@@ -1,8 +1,8 @@
 export interface Task {
   id: number;
-  labels: { [key: string]: string };
+  labels: Record<string, string>;
   dependencies: string[];
-  dep_status: { [key: string]: string };
+  dep_status: Record<string, string>;
   run_on: string[];
   agent_id: number;
 }

web/src/views/User.vue

@@ -14,6 +14,9 @@
     <Tab id="cli-and-api" :title="$t('user.settings.cli_and_api.cli_and_api')">
       <UserCLIAndAPITab />
     </Tab>
+    <Tab id="agents" :title="$t('admin.settings.agents.agents')">
+      <UserAgentsTab />
+    </Tab>
   </Scaffold>
 </template>
 
@@ -21,6 +24,7 @@
 import Button from '~/components/atomic/Button.vue';
 import Scaffold from '~/components/layout/scaffold/Scaffold.vue';
 import Tab from '~/components/layout/scaffold/Tab.vue';
+import UserAgentsTab from '~/components/user/UserAgentsTab.vue';
 import UserCLIAndAPITab from '~/components/user/UserCLIAndAPITab.vue';
 import UserGeneralTab from '~/components/user/UserGeneralTab.vue';
 import UserRegistriesTab from '~/components/user/UserRegistriesTab.vue';

web/src/views/org/OrgSettings.vue

@@ -18,6 +18,10 @@
     <Tab id="registries" :title="$t('registries.registries')">
       <OrgRegistriesTab />
     </Tab>
+
+    <Tab id="agents" :title="$t('admin.settings.agents.agents')">
+      <OrgAgentsTab />
+    </Tab>
   </Scaffold>
 </template>
 
@@ -28,6 +32,7 @@ import { useRouter } from 'vue-router';
 
 import Scaffold from '~/components/layout/scaffold/Scaffold.vue';
 import Tab from '~/components/layout/scaffold/Tab.vue';
+import OrgAgentsTab from '~/components/org/settings/OrgAgentsTab.vue';
 import OrgRegistriesTab from '~/components/org/settings/OrgRegistriesTab.vue';
 import OrgSecretsTab from '~/components/org/settings/OrgSecretsTab.vue';
 import { inject } from '~/compositions/useInjectProvide';

woodpecker-go/woodpecker/types.go

@@ -233,6 +233,7 @@ type (
 		Updated     int64  `json:"updated"`
 		Name        string `json:"name"`
 		OwnerID     int64  `json:"owner_id"`
+		OrgID       int64  `json:"org_id"`
 		Token       string `json:"token"`
 		LastContact int64  `json:"last_contact"`
 		LastWork    int64  `json:"last_work"`