fix(coderd): mark deleted MCP server configs in audit logs

ibetitsmike · Aug 19, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 8, 2026 · Aug 8, 2026
commit 0a32b24f87da0ab5ce4127a8664ef698daa19eaf
diff --git a/coderd/audit.go b/coderd/audit.go
@@ -501,6 +501,18 @@ func (api *API) auditLogIsResourceDeleted(ctx context.Context, alog database.Get
 			api.Logger.Error(ctx, "unable to fetch chat", slog.Error(err))
 		}
 		return false
+	case database.ResourceTypeMCPServerConfig:
+		// MCP server configs are hard-deleted, so a 404 means deleted.
+		_, err := api.Database.GetMCPServerConfigByID(ctx, alog.AuditLog.ResourceID)
+		if xerrors.Is(err, sql.ErrNoRows) {
+			return true
+		}
+		// Config reads are org-scoped, so an auditor can lack read on
+		// the config's organization. That is not worth logging.
+		if err != nil && !dbauthz.IsNotAuthorizedError(err) {
+			api.Logger.Error(ctx, "unable to fetch mcp server config", slog.Error(err))
+		}
+		return false
 	case database.ResourceTypeUserSecret:
 		_, err := api.Database.GetUserSecretByID(ctx, alog.AuditLog.ResourceID)
 		if xerrors.Is(err, sql.ErrNoRows) {

diff --git a/coderd/mcp_test.go b/coderd/mcp_test.go
@@ -361,6 +361,44 @@ func TestMCPServerConfigsAudit(t *testing.T) {
 		require.EqualValues(t, http.StatusNoContent, logs[0].StatusCode)
 	})
 
+	t.Run("DeletedResourceMarked", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		client, _ := newAuditedMCPClient(t)
+		firstUser := coderdtest.CreateFirstUser(t, client)
+		config := createMCPServerConfig(t, client, firstUser.OrganizationID, "audit-is-deleted", true)
+		deletedID := uuid.New()
+
+		err := client.CreateTestAuditLog(ctx, codersdk.CreateTestAuditLogRequest{
+			OrganizationID: firstUser.OrganizationID,
+			Action:         codersdk.AuditActionWrite,
+			ResourceType:   codersdk.ResourceTypeMCPServerConfig,
+			ResourceID:     config.ID,
+		})
+		require.NoError(t, err)
+		err = client.CreateTestAuditLog(ctx, codersdk.CreateTestAuditLogRequest{
+			OrganizationID: firstUser.OrganizationID,
+			Action:         codersdk.AuditActionDelete,
+			ResourceType:   codersdk.ResourceTypeMCPServerConfig,
+			ResourceID:     deletedID,
+		})
+		require.NoError(t, err)
+
+		logs, err := client.AuditLogs(ctx, codersdk.AuditLogsRequest{
+			Pagination: codersdk.Pagination{Limit: 25},
+		})
+		require.NoError(t, err)
+		byResourceID := make(map[uuid.UUID]codersdk.AuditLog, len(logs.AuditLogs))
+		for _, alog := range logs.AuditLogs {
+			byResourceID[alog.ResourceID] = alog
+		}
+		require.Contains(t, byResourceID, config.ID)
+		require.False(t, byResourceID[config.ID].IsDeleted)
+		require.Contains(t, byResourceID, deletedID)
+		require.True(t, byResourceID[deletedID].IsDeleted)
+	})
+
 	t.Run("WriteDeniedAudited", func(t *testing.T) {
 		t.Parallel()