fix(api): validate API responses at the boundary

[EhabY]

Summary

Fixes #1050

The SDK casts 2xx bodies to the generated TypeScript types with no runtime check, so a proxy error page, a non-Coder service, or a partial body flowed in as valid and crashed far from the cause — e.g. user?.roles.some(...) in deploymentManager.ts throwing Cannot read properties of undefined.

Responses are now validated at the HTTP call and fail with an error naming the URL and endpoint.

What changed

• src/api/responseValidation.ts — parseApiResponse + InvalidApiResponseError (the Zod failure kept as cause), the schemas, and VALIDATED_RESPONSES mapping each SDK method to its schema. Schemas are looseObjects listing only fields the extension reads; a field is required only if every supported deployment sends it, so unknown fields pass through untouched and newer ones must be .optional().
• src/api/coderApi.ts — wrapWithValidation iterates that map in the constructor. Also reimplements waitForBuild: the SDK polls inside a voided IIFE that swallows errors, so a validation failure would hang callers forever.
• src/oauth/validation.ts plus metadataClient.ts, authorizer.ts, sessionManager.ts — same treatment for the endpoints hit before a session exists (metadata, client registration, token exchange and refresh). validateRequiredEndpoints folded into the schema via .min(1). Errors blame the endpoint's own origin, which may differ from the deployment.

Behavior change

• A roles-less /api/v2/users/me now fails login with a clear error instead of silently treating the user as non-owner.
• A malformed build response rejects waitForBuild instead of hanging "Stopping workspace for update..." forever.

Notes

• Wrapping is by reassignment: SDK Api methods are arrow-function instance properties, so super.getAuthenticatedUser() does not compile (ts(2855)) and override fields would depend on declaration order.
• No axios response interceptor — URL-to-schema matching is brittle with path params, and non-AxiosError rejections would confuse isApiError handling.
• Every required field was verified present in codersdk at v0.25.0, the floor featureSet.ts declares. The three collection fields we require (resources, roles, ssh_config_options) are built with make(...) upstream, so they serialize as []/{} rather than Go's null.

Testing

Table-driven: one case per schema pinning the minimal body an old deployment sends, one per validated method for pass and reject, and a guard that fails when a method joins VALIDATED_RESPONSES without a test case. pnpm test (2416 tests), typecheck, and lint all green.

---

Generated by Coder Agents on behalf of @EhabY

[jeremyruppel]

zod ftw! one type nit but otherwise this looks fantastic. nice one!