Coder Login module

[bpmct]

A discussion dedicated to the Coder Login module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	20 / 20	N/A	7 / 10	81 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The module has a single required input (agent_id). The README shows one usage example (module "coder-login" { … }) but provides no explanation of what the resulting CODER_SESSION_TOKEN and CODER_URL env vars accomplish, no guidance on when to use the module, and no alternative configurations. Half credit for a present but bare-bones example.
Visual preview	5	5	README embeds ; image verified to exist (56.0 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module's only input is agent_id (a non-sensitive string). The session token is obtained via data.coder_workspace_owner.me.session_token (a Coder data source), not a user-supplied variable. No sensitive inputs exist to mark, and the README example contains no inline secrets.
Non-hardcoded auth path	4	4	Auth is handled entirely through Coder's native data.coder_workspace_owner.me.session_token lookup. No raw keys are pasted into templates; the token is resolved at plan/apply time by the Coder provider.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads or installs nothing. It only creates coder_env resources and reads Coder data sources. No tool binary is fetched.
Bring-your-own binary	10	N/A	No download or install step exists.
Egress transparency	3	N/A	No external endpoints are contacted beyond the Coder API (provider data sources). No install-time or runtime egress to enumerate.
Runs without sudo	2	N/A	Module contains no scripts (.sh, .py, etc.). It is purely Terraform HCL with data and coder_env resources.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	agent_id has type = string and a clear description. No validation block is present (e.g., a non-empty or regex check). No default, which is appropriate for a required ID. Half credit for missing validation.
Test coverage	4	4	main.tftest.hcl contains two run blocks: one asserting env-var names and agent IDs, one using override_data to mock data sources and verify values propagate. main.test.ts runs testRequiredVariables for the TypeScript side. Business logic is covered in HCL; the TS test complements it.

Overall — 81 / 100

Raw 38 / 47 → round(38 / 47 × 100) = 81

Track: Utility (auth helper; no AI agent, no IDE). Restricted-Environment Readiness excluded entirely (20 pts) because the module downloads, installs, and scripts nothing.

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.