feat(enterprise): implement organization "disable workspace sharing" option (#21376)

Adds a per-organization setting to disable workspace sharing. When enabled,
all existing workspace ACLs in the organization are cleared and the workspace
ACL mutation API endpoints return `403 Forbidden`.

This complements the existing site-wide `--disable-workspace-sharing` flag by
providing more granular control at the organization level.

Closes https://github.com/coder/internal/issues/1073 (part 2)

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

enterprise/coderd/coderd.go

@@ -361,6 +361,14 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 
 				r.Get("/idpsync/available-fields", api.organizationIDPSyncClaimFields)
 				r.Get("/idpsync/field-values", api.organizationIDPSyncClaimFieldValues)
+
+				r.Route("/workspace-sharing", func(r chi.Router) {
+					r.Use(
+						httpmw.RequireExperiment(api.AGPL.Experiments, codersdk.ExperimentWorkspaceSharing),
+					)
+					r.Get("/", api.workspaceSharingSettings)
+					r.Patch("/", api.patchWorkspaceSharingSettings)
+				})
 			})
 		})
 

enterprise/coderd/workspacesharing.go

@@ -0,0 +1,141 @@
+package coderd
+
+import (
+	"net/http"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
+	"github.com/coder/coder/v2/coderd/rbac/rolestore"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// @Summary Get workspace sharing settings for organization
+// @ID get-workspace-sharing-settings-for-organization
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Param organization path string true "Organization ID" format(uuid)
+// @Success 200 {object} codersdk.WorkspaceSharingSettings
+// @Router /organizations/{organization}/settings/workspace-sharing [get]
+func (api *API) workspaceSharingSettings(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	org := httpmw.OrganizationParam(r)
+
+	if !api.Authorize(r, policy.ActionRead, org) {
+		httpapi.Forbidden(rw)
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceSharingSettings{
+		SharingDisabled: org.WorkspaceSharingDisabled,
+	})
+}
+
+// @Summary Update workspace sharing settings for organization
+// @ID update-workspace-sharing-settings-for-organization
+// @Security CoderSessionToken
+// @Produce json
+// @Accept json
+// @Tags Enterprise
+// @Param organization path string true "Organization ID" format(uuid)
+// @Param request body codersdk.WorkspaceSharingSettings true "Workspace sharing settings"
+// @Success 200 {object} codersdk.WorkspaceSharingSettings
+// @Router /organizations/{organization}/settings/workspace-sharing [patch]
+func (api *API) patchWorkspaceSharingSettings(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	org := httpmw.OrganizationParam(r)
+	auditor := *api.AGPL.Auditor.Load()
+	aReq, commitAudit := audit.InitRequest[database.Organization](rw, &audit.RequestParams{
+		Audit:          auditor,
+		Log:            api.Logger,
+		Request:        r,
+		Action:         database.AuditActionWrite,
+		OrganizationID: org.ID,
+	})
+	aReq.Old = org
+	defer commitAudit()
+
+	if !api.Authorize(r, policy.ActionUpdate, org) {
+		httpapi.Forbidden(rw)
+		return
+	}
+
+	var req codersdk.WorkspaceSharingSettings
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	err := api.Database.InTx(func(tx database.Store) error {
+		//nolint:gocritic // System context required to look up and reconcile the
+		// organization-member system role; callers only need `organization:update`
+		sysCtx := dbauthz.AsSystemRestricted(ctx)
+
+		// Serialize organization workspace-sharing updates with system role
+		// reconciliation across coderd instances (e.g. during rolling restarts).
+		// This prevents conflicting writes to the organization-member system role.
+		// TODO(geokat): Consider finer-grained locks as we add more system roles.
+		err := tx.AcquireLock(ctx, database.LockIDReconcileSystemRoles)
+		if err != nil {
+			return xerrors.Errorf("acquire system roles reconciliation lock: %w", err)
+		}
+
+		org, err = tx.UpdateOrganizationWorkspaceSharingSettings(ctx, database.UpdateOrganizationWorkspaceSharingSettingsParams{
+			ID:                       org.ID,
+			WorkspaceSharingDisabled: req.SharingDisabled,
+			UpdatedAt:                dbtime.Now(),
+		})
+		if err != nil {
+			return xerrors.Errorf("update organization workspace sharing settings: %w", err)
+		}
+
+		role, err := database.ExpectOne(tx.CustomRoles(sysCtx, database.CustomRolesParams{
+			LookupRoles: []database.NameOrganizationPair{
+				{
+					Name:           rbac.RoleOrgMember(),
+					OrganizationID: org.ID,
+				},
+			},
+			// Satisfy linter that requires all fields to be set.
+			OrganizationID:     org.ID,
+			ExcludeOrgRoles:    false,
+			IncludeSystemRoles: true,
+		}))
+		if err != nil {
+			return xerrors.Errorf("get organization-member role: %w", err)
+		}
+
+		_, _, err = rolestore.ReconcileOrgMemberRole(sysCtx, tx, role, req.SharingDisabled)
+		if err != nil {
+			return xerrors.Errorf("reconcile organization-member role: %w", err)
+		}
+
+		if req.SharingDisabled {
+			err = tx.DeleteWorkspaceACLsByOrganization(sysCtx, org.ID)
+			if err != nil {
+				return xerrors.Errorf("delete workspace ACLs by organization: %w", err)
+			}
+		}
+
+		return nil
+	}, nil)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error updating workspace sharing settings.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	aReq.New = org
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceSharingSettings{
+		SharingDisabled: org.WorkspaceSharingDisabled,
+	})
+}

enterprise/coderd/workspacesharing_test.go

@@ -0,0 +1,287 @@
+package coderd_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbfake"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestWorkspaceSharingSettings(t *testing.T) {
+	t.Parallel()
+
+	t.Run("DisabledDefaultsFalse", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, first := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+		})
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		memberClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
+		settings, err := memberClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
+		require.NoError(t, err)
+		require.False(t, settings.SharingDisabled)
+	})
+
+	t.Run("DisabledTogglePersists", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, first := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+		})
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.ScopedRoleOrgAdmin(first.OrganizationID))
+		settings, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: true,
+		})
+		require.NoError(t, err)
+		require.True(t, settings.SharingDisabled)
+
+		settings, err = orgAdminClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
+		require.NoError(t, err)
+		require.True(t, settings.SharingDisabled)
+
+		settings, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: false,
+		})
+		require.NoError(t, err)
+		require.False(t, settings.SharingDisabled)
+	})
+
+	t.Run("UpdateAuthz", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, first := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+		})
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		memberClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
+		_, err := memberClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: true,
+		})
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+	})
+
+	t.Run("AuditLog", func(t *testing.T) {
+		t.Parallel()
+
+		auditor := audit.NewMock()
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, first := coderdenttest.New(t, &coderdenttest.Options{
+			AuditLogging: true,
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+				Auditor:          auditor,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAuditLog: 1,
+				},
+			},
+		})
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.ScopedRoleOrgAdmin(first.OrganizationID))
+		auditor.ResetLogs()
+		_, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: true,
+		})
+		require.NoError(t, err)
+
+		require.Len(t, auditor.AuditLogs(), 1)
+		alog := auditor.AuditLogs()[0]
+		require.Equal(t, database.AuditActionWrite, alog.Action)
+		require.Equal(t, database.ResourceTypeOrganization, alog.ResourceType)
+		require.Equal(t, first.OrganizationID, alog.ResourceID)
+	})
+
+	t.Run("ExperimentDisabled", func(t *testing.T) {
+		t.Parallel()
+
+		// Note: NOT setting the experiment flag.
+		client, first := coderdenttest.New(t, &coderdenttest.Options{})
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		memberClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
+		_, err := memberClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+		require.Contains(t, apiErr.Message, "requires enabling")
+		require.Contains(t, apiErr.Message, "workspace-sharing")
+	})
+}
+
+func TestWorkspaceSharingDisabled(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ACLEndpointsForbidden", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+		})
+
+		workspaceOwnerClient, workspaceOwner := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		ws := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+			OwnerID:        workspaceOwner.ID,
+			OrganizationID: owner.OrganizationID,
+		}).Do().Workspace
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
+		_, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: true,
+		})
+		require.NoError(t, err)
+
+		// Reading the ACL list remains allowed even when workspace sharing is
+		// disabled, but mutating it is forbidden.
+		_, err = workspaceOwnerClient.WorkspaceACL(ctx, ws.ID)
+		require.NoError(t, err)
+
+		// We don't allow mutating the ACL.
+		assertSharingDisabled := func(t *testing.T, err error) {
+			t.Helper()
+
+			var apiErr *codersdk.Error
+			require.ErrorAs(t, err, &apiErr)
+			require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+			require.Equal(t, "Workspace sharing is disabled for this organization.", apiErr.Message)
+		}
+
+		err = workspaceOwnerClient.UpdateWorkspaceACL(ctx, ws.ID, codersdk.UpdateWorkspaceACL{
+			UserRoles: map[string]codersdk.WorkspaceRole{
+				uuid.NewString(): codersdk.WorkspaceRoleUse,
+			},
+		})
+		assertSharingDisabled(t, err)
+
+		err = workspaceOwnerClient.DeleteWorkspaceACL(ctx, ws.ID)
+		assertSharingDisabled(t, err)
+	})
+
+	t.Run("ACLsPurged", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}
+
+		client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			},
+		})
+
+		workspaceOwnerClient, workspaceOwner := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		_, sharedUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		// Create a group to test group ACL purging.
+		group := coderdtest.CreateGroup(t, client, owner.OrganizationID, "test-group")
+
+		ws := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+			OwnerID:        workspaceOwner.ID,
+			OrganizationID: owner.OrganizationID,
+		}).Do().Workspace
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		// Set both user and group ACLs.
+		err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, ws.ID, codersdk.UpdateWorkspaceACL{
+			UserRoles: map[string]codersdk.WorkspaceRole{
+				sharedUser.ID.String(): codersdk.WorkspaceRoleUse,
+			},
+			GroupRoles: map[string]codersdk.WorkspaceRole{
+				group.ID.String(): codersdk.WorkspaceRoleUse,
+			},
+		})
+		require.NoError(t, err)
+
+		acl, err := workspaceOwnerClient.WorkspaceACL(ctx, ws.ID)
+		require.NoError(t, err)
+		require.Len(t, acl.Users, 1)
+		require.Equal(t, sharedUser.ID, acl.Users[0].ID)
+		require.Equal(t, codersdk.WorkspaceRoleUse, acl.Users[0].Role)
+		require.Len(t, acl.Groups, 1)
+		require.Equal(t, group.ID, acl.Groups[0].ID)
+		require.Equal(t, codersdk.WorkspaceRoleUse, acl.Groups[0].Role)
+
+		orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
+		_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: true,
+		})
+		require.NoError(t, err)
+
+		_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.WorkspaceSharingSettings{
+			SharingDisabled: false,
+		})
+		require.NoError(t, err)
+
+		// Verify both user and group ACLs are purged.
+		acl, err = workspaceOwnerClient.WorkspaceACL(ctx, ws.ID)
+		require.NoError(t, err)
+		require.Empty(t, acl.Users)
+		require.Empty(t, acl.Groups)
+
+		// Verify ACLs can be set again after re-enabling sharing.
+		err = workspaceOwnerClient.UpdateWorkspaceACL(ctx, ws.ID, codersdk.UpdateWorkspaceACL{
+			UserRoles: map[string]codersdk.WorkspaceRole{
+				sharedUser.ID.String(): codersdk.WorkspaceRoleUse,
+			},
+		})
+		require.NoError(t, err)
+		acl, err = workspaceOwnerClient.WorkspaceACL(ctx, ws.ID)
+		require.NoError(t, err)
+		require.Len(t, acl.Users, 1)
+		require.Equal(t, sharedUser.ID, acl.Users[0].ID)
+	})
+}