| Field | Tracked |
|---|---|
| id | false |
| notifier_paused | true |
| Field | Tracked |
|---|---|
| callback_url | true |
| client_id_issued_at | false |
| client_secret_expires_at | true |
| client_type | true |
| client_uri | true |
| contacts | true |
| created_at | false |
| dynamically_registered | true |
| grant_types | true |
| icon | true |
| id | false |
| jwks | true |
| jwks_uri | true |
| logo_uri | true |
| name | true |
| policy_uri | true |
| redirect_uris | true |
| registration_access_token | true |
| registration_client_uri | true |
| response_types | true |
| scope | true |
| software_id | true |
| software_version | true |
| token_endpoint_auth_method | true |
| tos_uri | true |
| updated_at | false |
| Field | Tracked |
|---|---|
| app_id | false |
| created_at | false |
| display_secret | false |
| hashed_secret | false |
| id | false |
| last_used_at | false |
| secret_prefix | false |
| Field | Tracked |
|---|---|
| created_at | false |
| deleted | true |
| description | true |
| display_name | true |
| icon | true |
| id | false |
| is_default | true |
| name | true |
| shareable_workspace_owners | true |
| updated_at | true |
| Field | Tracked |
|---|---|
| created_at | false |
| default_org_member_roles | true |
| deleted | true |
| description | true |
| display_name | true |
| icon | true |
| id | false |
| is_default | true |
| name | true |
| shareable_workspace_owners | true |
| updated_at | true |
| Field | Tracked |
|---|---|
| assign_default | true |
| field | true |
| mapping | true |
| Field | Tracked |
|---|---|
| id | false |
| reconciliation_paused | true |
| Field | Tracked |
|---|---|
| field | true |
| mapping | true |
[id\|name\|display name\|icon\|description\|created at\|updated at\|default] |
-| Default | name,display name,id,default |
+| | |
+|---------|---------------------------------------------------------------------------------------------------------------------|
+| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default\|default org member roles] |
+| Default | name,display name,id,default |
Columns to display in table output.
diff --git a/docs/reference/cli/organizations_show.md b/docs/reference/cli/organizations_show.md
index 540014b468..90d5f00be1 100644
--- a/docs/reference/cli/organizations_show.md
+++ b/docs/reference/cli/organizations_show.md
@@ -41,10 +41,10 @@ Only print the organization ID.
### -c, --column
-| | |
-|---------|-------------------------------------------------------------------------------------------|
-| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default] |
-| Default | id,name,default |
+| | |
+|---------|---------------------------------------------------------------------------------------------------------------------|
+| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default\|default org member roles] |
+| Default | id,name,default |
Columns to display in table output.
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index 315f6af228..69efd2d6d7 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -340,6 +340,7 @@ var auditableResourcesTypes = map[any]map[string]Action{
"display_name": ActionTrack,
"icon": ActionTrack,
"shareable_workspace_owners": ActionTrack,
+ "default_org_member_roles": ActionTrack,
},
&database.NotificationTemplate{}: {
"id": ActionIgnore,
diff --git a/enterprise/coderd/organizations.go b/enterprise/coderd/organizations.go
index fd9f9a4af6..5593c0a8cf 100644
--- a/enterprise/coderd/organizations.go
+++ b/enterprise/coderd/organizations.go
@@ -4,6 +4,7 @@ import (
"database/sql"
"fmt"
"net/http"
+ "slices"
"strings"
"github.com/google/uuid"
@@ -16,6 +17,7 @@ import (
"github.com/coder/coder/v2/coderd/database/dbtime"
"github.com/coder/coder/v2/coderd/httpapi"
"github.com/coder/coder/v2/coderd/httpmw"
+ "github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/rbac/rolestore"
"github.com/coder/coder/v2/codersdk"
)
@@ -60,6 +62,20 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
return
}
+ // Writes to default_org_member_roles that deviate from the
+ // deployment-wide default require the minimum-implicit-member
+ // experiment. Without the experiment, every organization keeps the
+ // standard floor + organization-workspace-access elevation.
+ if req.DefaultOrgMemberRoles != nil &&
+ !slices.Equal(*req.DefaultOrgMemberRoles, rbac.DefaultOrgMemberRoles) &&
+ !api.AGPL.Experiments.Enabled(codersdk.ExperimentMinimumImplicitMember) {
+ httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
+ Message: "Gateway Accounts are not enabled on this deployment.",
+ Detail: fmt.Sprintf("Setting default_org_member_roles to anything other than %v requires the %q experiment.", rbac.DefaultOrgMemberRoles, codersdk.ExperimentMinimumImplicitMember),
+ })
+ return
+ }
+
err := database.ReadModifyUpdate(api.Database, func(tx database.Store) error {
var err error
organization, err = tx.GetOrganizationByID(ctx, organization.ID)
@@ -68,12 +84,13 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
}
updateOrgParams := database.UpdateOrganizationParams{
- UpdatedAt: dbtime.Now(),
- ID: organization.ID,
- Name: organization.Name,
- DisplayName: organization.DisplayName,
- Description: organization.Description,
- Icon: organization.Icon,
+ UpdatedAt: dbtime.Now(),
+ ID: organization.ID,
+ Name: organization.Name,
+ DisplayName: organization.DisplayName,
+ Description: organization.Description,
+ Icon: organization.Icon,
+ DefaultOrgMemberRoles: organization.DefaultOrgMemberRoles,
}
if req.Name != "" {
@@ -88,6 +105,9 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
if req.Icon != nil {
updateOrgParams.Icon = *req.Icon
}
+ if req.DefaultOrgMemberRoles != nil {
+ updateOrgParams.DefaultOrgMemberRoles = *req.DefaultOrgMemberRoles
+ }
organization, err = tx.UpdateOrganization(ctx, updateOrgParams)
if err != nil {
@@ -280,13 +300,14 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
}
organization, err = tx.InsertOrganization(ctx, database.InsertOrganizationParams{
- ID: organizationID,
- Name: req.Name,
- DisplayName: req.DisplayName,
- Description: req.Description,
- Icon: req.Icon,
- CreatedAt: dbtime.Now(),
- UpdatedAt: dbtime.Now(),
+ ID: organizationID,
+ Name: req.Name,
+ DisplayName: req.DisplayName,
+ Description: req.Description,
+ Icon: req.Icon,
+ CreatedAt: dbtime.Now(),
+ UpdatedAt: dbtime.Now(),
+ DefaultOrgMemberRoles: rbac.DefaultOrgMemberRoles,
})
if err != nil {
return xerrors.Errorf("create organization: %w", err)
diff --git a/enterprise/coderd/organizations_test.go b/enterprise/coderd/organizations_test.go
index e7b01b0163..532b054ce6 100644
--- a/enterprise/coderd/organizations_test.go
+++ b/enterprise/coderd/organizations_test.go
@@ -9,6 +9,7 @@ import (
"github.com/coder/coder/v2/cli/clitest"
"github.com/coder/coder/v2/coderd/coderdtest"
+ "github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/util/ptr"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
@@ -448,6 +449,75 @@ func TestPatchOrganizationsByUser(t *testing.T) {
})
require.ErrorContains(t, err, "Multiple Organizations is a Premium feature")
})
+
+ t.Run("DefaultOrgMemberRoles", func(t *testing.T) {
+ t.Parallel()
+
+ t.Run("EqualToDefaultAllowedWithoutExperiment", func(t *testing.T) {
+ t.Parallel()
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ // Writing exactly the deployment default is a no-op and must be allowed.
+ updated, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref(rbac.DefaultOrgMemberRoles),
+ })
+ require.NoError(t, err)
+ require.Equal(t, rbac.DefaultOrgMemberRoles, updated.DefaultOrgMemberRoles)
+ })
+
+ t.Run("DeviationRejectedWithoutExperiment", func(t *testing.T) {
+ t.Parallel()
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ // Empty array represents a Gateway Accounts organization. Without
+ // the experiment, this must be rejected.
+ _, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref([]string{}),
+ })
+ var apiErr *codersdk.Error
+ require.ErrorAs(t, err, &apiErr)
+ require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+ require.Contains(t, apiErr.Message, "Gateway Accounts are not enabled")
+ })
+
+ t.Run("DeviationAllowedWithExperiment", func(t *testing.T) {
+ t.Parallel()
+ dv := coderdtest.DeploymentValues(t)
+ dv.Experiments = []string{string(codersdk.ExperimentMinimumImplicitMember)}
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ Options: &coderdtest.Options{DeploymentValues: dv},
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ updated, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref([]string{}),
+ })
+ require.NoError(t, err)
+ require.Empty(t, updated.DefaultOrgMemberRoles)
+ })
+ })
}
func TestPostOrganizationsByUser(t *testing.T) {
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index b6d0b79cea..1dd1708ab0 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4358,6 +4358,7 @@ export type Experiment =
| "auto-fill-parameters"
| "example"
| "mcp-server-http"
+ | "minimum-implicit-member"
| "notifications"
| "oauth2"
| "workspace-build-updates"
@@ -4367,6 +4368,7 @@ export const Experiments: Experiment[] = [
"auto-fill-parameters",
"example",
"mcp-server-http",
+ "minimum-implicit-member",
"notifications",
"oauth2",
"workspace-build-updates",
@@ -6062,6 +6064,12 @@ export interface Organization extends MinimalOrganization {
readonly created_at: string;
readonly updated_at: string;
readonly is_default: boolean;
+ /**
+ * DefaultOrgMemberRoles are unioned into every member's effective
+ * roles at request time. Changes propagate to all members on the
+ * next request.
+ */
+ readonly default_org_member_roles: readonly string[];
}
// From codersdk/organizations.go
@@ -8807,6 +8815,11 @@ export interface UpdateOrganizationRequest {
readonly display_name?: string;
readonly description?: string;
readonly icon?: string;
+ /**
+ * DefaultOrgMemberRoles, when non-nil, replaces the org's default
+ * member roles.
+ */
+ readonly default_org_member_roles?: string[];
}
// From codersdk/users.go