Garrett Delfosse e8d6016807 fix: allow users with workspace:create for any owner to list users (#21947) ...

## Summary

Custom roles that can create workspaces on behalf of other users need to
be able to list users to populate the owner dropdown in the workspace
creation UI. Previously, this required a separate `user:read`
permission, causing the dropdown to fail for custom roles.

## Changes

- Modified `GetUsers` in `dbauthz` to check if the user can create
workspaces for any owner (`workspace:create` with `owner_id: *`)
- If the user has this permission, they can list all users without
needing explicit `user:read` permission
- Added tests to verify the new behavior

## Testing

- Updated mock tests to assert the new authorization check
- Added integration tests for both positive and negative cases

Fixes #18203

2026-02-19 13:04:53 -05:00

..

agentapi

fix: avoid re-using AuthInstanceID for sub agents (#22196)

2026-02-19 16:56:29 +00:00

agentmetrics

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

aibridge

feat: use coder specific header for aibridge authentication from AI proxy (#21590)

2026-01-21 19:06:19 +00:00

apidoc

fix: allow users with workspace:create for any owner to list users (#21947)

2026-02-19 13:04:53 -05:00

apikey

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

appearance

…

audit

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

autobuild

feat: notify on task auto pause, manual pause and manual resume (#22050)

2026-02-18 16:30:16 +00:00

awsidentity

…

azureidentity

chore: update azure certs (#21265)

2025-12-15 13:44:44 -09:00

boundaryusage

fix: make boundary usage telemetry collection atomic (#21907)

2026-02-06 09:52:17 -07:00

cachecompress

feat: add cachecompress package to compress static files for HTTP (#21915)

2026-02-06 10:12:58 +04:00

coderdtest

feat: add provisioner job queue wait time histogram and jobs enqueued counter (#21869)

2026-02-12 13:40:47 -08:00

connectionlog

fix: avoid connection logging crashes in agent (#20307)

2025-10-16 01:56:43 +11:00

cryptokeys

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

database

fix: avoid re-using AuthInstanceID for sub agents (#22196)

2026-02-19 16:56:29 +00:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

files

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

healthcheck

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

httpapi

fix(coderd/oauth2provider): support client_secret_basic client auth (#21793)

2026-02-02 16:01:33 +01:00

httpmw

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

idpsync

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

jobreaper

chore(coderd/database/dbfake): add support for provisioner job timestamp control (#21944)

2026-02-06 09:44:40 +00:00

jwtutils

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

mcp

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

metricscache

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

notifications

feat: notify on task auto pause, manual pause and manual resume (#22050)

2026-02-18 16:30:16 +00:00

oauth2provider

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

oauthpki

fix(coderd): support string type for oidc response's expires_in json property (#20152)

2025-10-15 17:37:37 +00:00

portsharing

…

pproflabel

chore: add usage tracking package (#19095)

2025-08-16 01:31:00 +10:00

prebuilds

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

prometheusmetrics

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

fix: avoid re-using AuthInstanceID for sub agents (#22196)

2026-02-19 16:56:29 +00:00

provisionerkey

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

proxyhealth

feat: add csp headers for embedded apps (#18374)

2025-06-17 09:00:32 -08:00

pubsub

feat(coderd): add inbox notifications endpoints (#16889)

2025-03-18 00:02:47 +01:00

rbac

fix: allow users with workspace:create for any owner to list users (#21947)

2026-02-19 13:04:53 -05:00

render

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

runtimeconfig

chore(coderd/runtimeconfig): remove dbmem from tests (#18790)

2025-07-08 14:31:05 +00:00

schedule

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

searchquery

feat: add client column to aibridge_interceptions table (#21839)

2026-02-17 15:43:02 +01:00

taskname

fix: replace moby/moby namesgenerator with internal implementation (#21377)

2026-01-09 15:40:26 -07:00

telemetry

feat: add client column to aibridge_interceptions table (#21839)

2026-02-17 15:43:02 +01:00

testdata

feat: add flag to disable template insights (#20940)

2025-12-14 03:00:03 +00:00

tracing

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

updatecheck

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

usage

chore: add unknown usage event type error (#19436)

2025-08-22 16:32:35 +10:00

userpassword

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

util

feat: archive modules in size order until limit is hit (#21773)

2026-02-02 09:03:18 -06:00

webpush

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaceapps

fix(coderd/workspaceapps): prefer app session cookie over Authorization (#22041)

2026-02-11 23:18:49 +11:00

workspacestats

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

wsbuilder

feat: add provisioner job queue wait time histogram and jobs enqueued counter (#21869)

2026-02-12 13:40:47 -08:00

wspubsub

feat: add app status tracking to the backend (#17163)

2025-03-31 10:55:44 -04:00

activitybump_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

aitasks_internal_test.go

fix: set codersdk.Task current_state during task initialization (#20692)

2025-11-17 13:24:12 +00:00

aitasks_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

aitasks.go

feat: notify on task auto pause, manual pause and manual resume (#22050)

2026-02-18 16:30:16 +00:00

apikey_scopes_validation_test.go

feat: add multi-scope support to API keys (#19917)

2025-09-26 11:56:34 +02:00

apikey_test.go

feat(cli)!: expire tokens by default (#21783)

2026-02-17 13:16:46 +00:00

apikey.go

feat(cli)!: expire tokens by default (#21783)

2026-02-17 13:16:46 +00:00

apiroot.go

…

audit_internal_test.go

…

audit_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

audit.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

authorize_test.go

feat: add an organization member permission level (#19953)

2025-10-27 17:14:16 -06:00

authorize.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

client_test.go

…

coderd_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

coderd_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

coderd.go

fix: allow users with workspace:create for any owner to list users (#21947)

2026-02-19 13:04:53 -05:00

csp.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

debug_test.go

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

debug.go

chore: improve healthcheck timeout message (#21520)

2026-01-15 16:37:05 +00:00

deployment_test.go

…

deployment.go

chore: remove chats experiment (#18535)

2025-06-25 13:03:32 +00:00

deprecated.go

…

experiments_test.go

chore: revert dynamic params as a safe experiment (#17510)

2025-04-22 16:21:15 +00:00

experiments.go

fix: do not warn on valid known experiments (#18514)

2025-06-24 09:14:41 +01:00

externalauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

externalauth.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

files_test.go

ci: improve 'tfail in goroutine' ruleguard rule (#19682)

2025-09-04 14:28:29 +10:00

files.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

gitsshkey.go

feat: add API key scope to restrict access to user data (#17692)

2025-05-15 15:32:52 +01:00

inboxnotifications_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

inboxnotifications_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

inboxnotifications.go

fix(coderd): ensure inbox WebSocket is closed when client disconnects (#21652)

2026-01-26 09:24:45 +00:00

initscript_test.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

initscript.go

feat(coderd): add support for external agents to API's and provisioner (#19286)

2025-08-19 10:41:33 +02:00

insights_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

insights_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

insights.go

chore: update golang to 1.24.1 (#17035)

2025-03-26 01:56:39 -05:00

latencycheck.go

…

mcp_http.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

members_test.go

feat: add endpoint to fetch singular org member (#21732)

2026-02-03 12:48:25 -06:00

members.go

feat: add endpoint to fetch singular org member (#21732)

2026-02-03 12:48:25 -06:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

oauth2_error_compliance_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_validation_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_security_test.go

feat: implement OAuth2 dynamic client registration (RFC 7591/7592) (#18645)

2025-07-03 18:33:47 +02:00

oauth2_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2.go

feat: implement oauth2 RFC 7009 token revocation endpoint (#20362)

2025-10-22 15:18:42 -05:00

organizations_test.go

…

organizations.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

pagination_test.go

feat: add connectionlogs API (#18628)

2025-07-15 14:55:34 +10:00

pagination.go

feat: add connectionlogs API (#18628)

2025-07-15 14:55:34 +10:00

parameters_test.go

feat: archive modules in size order until limit is hit (#21773)

2026-02-02 09:03:18 -06:00

parameters.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

feat: support icon and description in preset (#18977)

2025-07-28 15:02:26 +01:00

provisionerdaemons_test.go

feat: add filtering options to provisioners list (#19378)

2025-08-21 16:03:34 -04:00

provisionerdaemons.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

provisionerjobs_internal_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

provisionerjobs_test.go

chore: fix api param name (#20172)

2025-10-06 13:58:37 +02:00

provisionerjobs.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

roles_test.go

…

roles.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

scopes_catalog_api_test.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

scopes_catalog.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

tailnet_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

tailnet.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templates_test.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templates.go

fix: hide "Create Workspace" button for deleted templates (#22092)

2026-02-13 19:44:50 -05:00

templateversions_test.go

test: template import should never complete, use Plan over apply (#21895)

2026-02-03 10:16:53 -06:00

templateversions.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

updatecheck_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

updatecheck.go

…

userauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

userauth.go

fix: replace moby/moby namesgenerator with internal implementation (#21377)

2026-01-09 15:40:26 -07:00

users_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

users.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902)

2026-02-03 17:52:07 +00:00

webpush_test.go

feat(coderd): add webpush package (#17091)

2025-03-27 10:03:53 +00:00

webpush.go

feat(coderd): add webpush package (#17091)

2025-03-27 10:03:53 +00:00

workspaceagentportshare_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

workspaceagentportshare.go

docs: fix swagger documentation for DELETE port share endpoint (#18426)

2025-06-18 14:07:53 +00:00

workspaceagents_internal_test.go

perf: reduce number of queries made by /api/v2/workspaceagents/{id} (#21522)

2026-01-19 12:36:33 +00:00

workspaceagents_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

workspaceagents.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

workspaceagentsrpc_internal_test.go

test: use not before in TestAgentConnectionMonitor_* (#21332)

2025-12-22 10:21:39 +04:00

workspaceagentsrpc_test.go

fix(coderd): add role param to agent RPC to prevent false connectivity (#22052)

2026-02-18 09:44:06 +01:00

workspaceagentsrpc.go

fix(coderd): add role param to agent RPC to prevent false connectivity (#22052)

2026-02-18 09:44:06 +01:00

workspaceapps_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

workspaceapps.go

feat: add multi-scope support to API keys (#19917)

2025-09-26 11:56:34 +02:00

workspacebuilds_test.go

feat: add link for viewing raw build logs in workspace and template build jobs (#21727)

2026-02-03 09:45:23 +00:00

workspacebuilds.go

feat: add provisioner job queue wait time histogram and jobs enqueued counter (#21869)

2026-02-12 13:40:47 -08:00

workspaceproxies_test.go

…

workspaceproxies.go

…

workspaceresourceauth_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

workspaceresourceauth.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

workspaces_test.go

fix: allow users with workspace:create for any owner to list users (#21947)

2026-02-19 13:04:53 -05:00

workspaces.go

fix: allow users with workspace:create for any owner to list users (#21947)

2026-02-19 13:04:53 -05:00

workspaceupdates_test.go

chore: update testutil chan helpers (#17408)

2025-04-16 10:37:09 -06:00

workspaceupdates.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00