mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
Cian Johnston
b5a625549e
The agents-access role previously granted chat permissions at user
scope, but chats are org-scoped objects. Rego skips user-level perms
when org_owner is set, making the grants invisible. Handler-level
band-aids used synthetic non-org-scoped objects as a workaround.
- Migrates agents-access from users.rbac_roles (site-level) to
organization_members.roles (org-scoped) via DB migration
- Redefines agents-access as a predefined org-scoped builtin role
alongside organization-admin, organization-auditor, etc., with
Member permissions granting chat create/read/update
- Excludes ResourceChat from OrgMemberPermissions so org membership
alone no longer grants chat access
- Fixes handler Authorize checks to use org-scoped objects with
semantically correct actions (ActionUpdate for message/tool operations)
- Grants org admins the ability to assign agents-access
Closes #24250
Fixes CODAGT-174
Note: this does not update the "Usage" endpoints. Tracked by CODAGT-161.
> 🤖
17 lines
562 B
SQL
17 lines
562 B
SQL
-- Transition 'agents-access' from a site-wide role to a per-org role.
|
|
|
|
-- For every user who has 'agents-access' in users.rbac_roles,
|
|
-- grant the org-scoped role in each org they belong to.
|
|
UPDATE organization_members
|
|
SET roles = array_append(roles, 'agents-access')
|
|
WHERE user_id IN (
|
|
SELECT id FROM users
|
|
WHERE 'agents-access' = ANY(rbac_roles)
|
|
)
|
|
AND NOT ('agents-access' = ANY(roles));
|
|
|
|
-- Remove 'agents-access' from site-level roles.
|
|
UPDATE users
|
|
SET rbac_roles = array_remove(rbac_roles, 'agents-access')
|
|
WHERE 'agents-access' = ANY(rbac_roles);
|