Cian Johnston 3ce82bb885 feat: add chat-access site-wide role to gate chat creation (#23724) ...

- Add `chat-access` built-in role granting chat CRUD at User scope
- Exclude `ResourceChat` from member, org member, and org service
account `allPermsExcept` calls
- Allow system, owner, and user-admin to assign the new role
- Migration auto-assigns role to users who have ever created a chat
- Update RBAC test matrix: `memberMe` denied, `chatAccessUser` allowed

**Breaking change**: Members without `chat-access` lose chat creation
ability. Migration covers existing chat creators. Members who have never
created a chat do not get this role automatically applied.

> 🤖 This PR was created by a Coder Agent and reviewed by me.

2026-03-31 10:07:21 +01:00

..

agentapi

fix(coderd/agentapi): trim whitespace from workspace agent metadata values (#23709)

2026-03-27 15:08:47 +00:00

agentmetrics

…

aibridge

feat: extract, log, and strip aibridgeproxy request ID header in aibridged (#23731)

2026-03-30 15:21:30 +01:00

aiseats

feat: track ai seat usage (#22682)

2026-03-16 12:36:26 -05:00

apidoc

feat: implement <ClientFilter /> to AI Bridge request logs (#22694)

2026-03-27 17:18:28 -04:00

apikey

fix: initialize API key LastUsed to Unix epoch instead of zero time (#22327)

2026-03-02 16:02:01 +01:00

appearance

…

audit

chore: add audit log entry when ai seat is consumed (#22683)

2026-03-16 15:30:25 -05:00

autobuild

fix: use "idle timeout" as task auto-pause reason (#22287)

2026-02-24 16:45:56 +00:00

awsidentity

…

azureidentity

chore: update azure certs (#21265)

2025-12-15 13:44:44 -09:00

boundaryusage

fix: make boundary usage telemetry collection atomic (#21907)

2026-02-06 09:52:17 -07:00

cachecompress

fix(site): avoid duplicating bin download headers (#22981)

2026-03-13 00:22:55 +11:00

coderdtest

feat: add filtering by service account (#23468)

2026-03-24 10:13:25 -08:00

connectionlog

…

cryptokeys

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

database

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

feat: add head_branch to pull request diff status (#23076)

2026-03-14 17:24:19 +00:00

files

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

healthcheck

refactor: replace AsSystemRestricted with narrower actors (#23712)

2026-03-27 15:08:30 +00:00

httpapi

fix: prioritize context cancellation in WebSocket sendEvent (#23756)

2026-03-29 20:11:30 -04:00

httpmw

refactor: replace AsSystemRestricted with narrower actors (#23712)

2026-03-27 15:08:30 +00:00

idpsync

test: remove unnecessary dbauthz.AsSystemRestricted calls in tests (#22663)

2026-03-05 20:29:49 +00:00

jobreaper

refactor: extract test helpers in coderd/jobreaper to reduce duplication (#23001)

2026-03-19 21:51:26 +00:00

jwtutils

…

mcp

feat: expose MCP tool annotations for tool grouping (#23195)

2026-03-18 10:21:45 +00:00

metricscache

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

notifications

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

oauth2provider

refactor: replace AsSystemRestricted with narrower actors (#23712)

2026-03-27 15:08:30 +00:00

oauthpki

…

portsharing

…

pproflabel

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

prebuilds

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

prometheusmetrics

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

refactor: replace AsSystemRestricted with narrower actors (#23712)

2026-03-27 15:08:30 +00:00

provisionerkey

…

proxyhealth

…

pubsub

perf(coderd/x/chatd): add process-wide config cache for hot DB queries (#23272)

2026-03-26 18:04:53 +11:00

rbac

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

render

…

runtimeconfig

…

schedule

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

searchquery

feat: implement <ClientFilter /> to AI Bridge request logs (#22694)

2026-03-27 17:18:28 -04:00

taskname

fix(coderd): strip markdown code fences from Anthropic task name responses (#23024)

2026-03-13 17:35:26 +00:00

telemetry

feat: add telemetry for task lifecycle events (#21922)

2026-02-24 17:04:42 +00:00

testdata

feat: add flag to disable template insights (#20940)

2025-12-14 03:00:03 +00:00

tracing

fix: StatusWriter Unwrap and process output error recovery (#23383)

2026-03-20 20:00:55 +00:00

updatecheck

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

usage

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

userpassword

…

util

fix(coderd): actually wire the chat template allowlist into tools (#23626)

2026-03-25 22:15:27 +00:00

webpush

perf(coderd): reduce duplicated reads in push and webpush paths (#23115)

2026-03-17 13:50:47 +11:00

workspaceapps

chore: switch agent gone response from 502 to 404 (#23090)

2026-03-25 09:57:28 -04:00

workspacestats

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

wsbuilder

fix: mark presets as validation_failed to prevent endless prebuild retries (#22085)

2026-02-27 14:26:48 +00:00

wspubsub

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

x

fix: stabilize flaky chatd subscribe/promote queued tests (#23816)

2026-03-30 18:23:47 +00:00

activitybump_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

aitasks_internal_test.go

fix: set codersdk.Task current_state during task initialization (#20692)

2025-11-17 13:24:12 +00:00

aitasks_test.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

aitasks.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

apikey_scopes_validation_test.go

…

apikey_test.go

fix(coderd): use dbtime.Now() instead of time.Now() in test assertions against DB timestamps (#22685)

2026-03-06 09:14:11 +00:00

apikey.go

feat(coderd): filter expired API tokens server-side (#22263)

2026-02-24 15:27:03 +00:00

apiroot.go

…

audit_internal_test.go

…

audit_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

audit.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

authorize_test.go

…

authorize.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

client_test.go

…

coderd_internal_test.go

…

coderd_test.go

chore: switch agent gone response from 502 to 404 (#23090)

2026-03-25 09:57:28 -04:00

coderd.go

feat: add manual chat title regeneration (#23633)

2026-03-27 01:47:19 +01:00

csp.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

debug_test.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

debug.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

deployment_test.go

…

deployment.go

…

deprecated.go

…

exp_chats_test.go

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

exp_chats.go

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

experiments_test.go

…

experiments.go

…

externalauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

externalauth.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

files_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

files.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

gitsshkey.go

…

inboxnotifications_internal_test.go

…

inboxnotifications_test.go

…

inboxnotifications.go

fix(coderd): ensure inbox WebSocket is closed when client disconnects (#21652)

2026-01-26 09:24:45 +00:00

initscript_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

initscript.go

…

insights_internal_test.go

…

insights_test.go

fix(coderd): fix flaky TestGetUserStatusCounts timezone boundary (#22639)

2026-03-04 18:01:56 -08:00

insights.go

fix: user status change chart accommodates DST (#22191)

2026-03-04 12:54:39 +02:00

latencycheck.go

…

mcp_http.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

mcp_test.go

fix(coderd): use path-aware discovery for MCP OAuth2 metadata (RFC 9728, RFC 8414) (#23520)

2026-03-25 14:35:55 -04:00

mcp.go

feat: add model_intent option to MCP server configs (#23717)

2026-03-27 14:23:25 +00:00

members_test.go

feat: add filtering by service account (#23468)

2026-03-24 10:13:25 -08:00

members.go

feat: display the AI add-on column in the UI on the Users and Organization Members tables (#23291)

2026-03-26 10:36:40 +00:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

oauth2_error_compliance_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_metadata_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_validation_test.go

test: share coderdtest instances in OAuth2 validation tests (#23455)

2026-03-23 21:03:34 +00:00

oauth2_security_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_test.go

fix(coderd): use dbtime.Now() instead of time.Now() in test assertions against DB timestamps (#22685)

2026-03-06 09:14:11 +00:00

oauth2.go

…

organizations_test.go

…

organizations.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

pagination_test.go

…

pagination.go

…

parameters_test.go

feat: archive modules in size order until limit is hit (#21773)

2026-02-02 09:03:18 -06:00

parameters.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

…

provisionerdaemons_test.go

…

provisionerdaemons.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

provisionerjobs_internal_test.go

…

provisionerjobs_test.go

test: reduce unnecessary sleep durations in tests (#22552)

2026-03-03 10:19:00 -05:00

provisionerjobs.go

ci: bump the github-actions group across 1 directory with 9 updates (#23345)

2026-03-20 02:59:50 +00:00

roles_test.go

…

roles.go

feat: add chat-access site-wide role to gate chat creation (#23724)

2026-03-31 10:07:21 +01:00

scopes_catalog_api_test.go

…

scopes_catalog.go

…

tailnet_test.go

…

tailnet.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templates_test.go

fix(coderd): allow template deletion when only prebuild workspaces remain (#23417)

2026-03-25 09:43:06 +02:00

templates.go

fix(coderd): allow template deletion when only prebuild workspaces remain (#23417)

2026-03-25 09:43:06 +02:00

templateversions_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

templateversions.go

feat: validate prebuild presets using dynamic parameter validation (#21858)

2026-03-03 16:50:18 +00:00

updatecheck_test.go

…

updatecheck.go

…

userauth_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

userauth.go

refactor: replace sort.Strings with slices.Sort (#23457)

2026-03-23 23:19:23 +02:00

users_test.go

test: assert on user id, not entire user (#23632)

2026-03-25 19:09:25 +00:00

users.go

feat: display the AI add-on column in the UI on the Users and Organization Members tables (#23291)

2026-03-26 10:36:40 +00:00

webpush_test.go

perf(coderd): reduce duplicated reads in push and webpush paths (#23115)

2026-03-17 13:50:47 +11:00

webpush.go

perf(coderd): reduce duplicated reads in push and webpush paths (#23115)

2026-03-17 13:50:47 +11:00

workspaceagentportshare_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

workspaceagentportshare.go

…

workspaceagents_internal_test.go

refactor: consolidate chat streaming endpoints under /stream (#23248)

2026-03-18 18:04:42 +00:00

workspaceagents_test.go

fix(coderd): use dbtime.Now() for tailnet telemetry timestamps (#22861)

2026-03-09 20:37:05 +00:00

workspaceagents.go

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

workspaceagentsrpc_internal_test.go

test: use not before in TestAgentConnectionMonitor_* (#21332)

2025-12-22 10:21:39 +04:00

workspaceagentsrpc_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

workspaceagentsrpc.go

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

workspaceapps_test.go

…

workspaceapps.go

…

workspacebuilds_test.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

workspacebuilds.go

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

workspaceproxies_test.go

…

workspaceproxies.go

feat: add MCP server configuration backend for chats (#23227)

2026-03-19 14:07:36 +00:00

workspaceresourceauth_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

workspaceresourceauth.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaces_scoped_test.go

chore: add permissions to coder:workspace.* scopes for functionality (#23515)

2026-03-25 13:46:58 -05:00

workspaces_test.go

test: remove classic params from ephemeral params test (#23302)

2026-03-19 11:32:36 -05:00

workspaces.go

fix: limit calls to GetWorkspaceAgentByID in agentapi (#23015)

2026-03-20 15:42:05 -05:00

workspaceupdates_test.go

…

workspaceupdates.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00