feat: Implement allow_list for scopes for resource specific permissions (#5769)

* feat: Implement allow_list for scopes for resource specific permissions

Feature that adds an allow_list for scopes to specify particular resources.
This enables workspace agent tokens to use the same RBAC system as users.

- Add ID to compileSQL matchers
* Plumb through WithID on rbac objects
* Rename Scope -> ScopeName
* Update input.json with scope allow_list

Co-authored-by: Cian Johnston <cian@coder.com>

enterprise/coderd/coderdenttest/coderdenttest_test.go

@@ -44,7 +44,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	groupObj := rbac.ResourceGroup.InOrg(admin.OrganizationID)
+	groupObj := rbac.ResourceGroup.WithID(group.ID).InOrg(admin.OrganizationID)
 	a := coderdtest.NewAuthTester(ctx, t, client, api.AGPL, admin)
 	a.URLParams["licenses/{id}"] = fmt.Sprintf("licenses/%d", lic.ID)
 	a.URLParams["groups/{group}"] = fmt.Sprintf("groups/%s", group.ID.String())
@@ -94,10 +94,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
 	assertRoute["GET:/api/v2/organizations/{organization}/provisionerdaemons"] = coderdtest.RouteCheck{
 		AssertAction: rbac.ActionRead,
 		AssertObject: rbac.ResourceProvisionerDaemon,
-	}
-	assertRoute["GET:/api/v2/organizations/{organization}/provisionerdaemons"] = coderdtest.RouteCheck{
-		AssertAction: rbac.ActionRead,
-		AssertObject: rbac.ResourceProvisionerDaemon,
+		StatusCode:   http.StatusOK,
 	}
 	assertRoute["GET:/api/v2/groups/{group}"] = coderdtest.RouteCheck{
 		AssertAction: rbac.ActionRead,

enterprise/coderd/provisionerdaemons.go

@@ -55,11 +55,6 @@ func (api *API) provisionerDaemonsEnabledMW(next http.Handler) http.Handler {
 // @Router /organizations/{organization}/provisionerdaemons [get]
 func (api *API) provisionerDaemons(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	org := httpmw.OrganizationParam(r)
-	if !api.Authorize(r, rbac.ActionRead, rbac.ResourceProvisionerDaemon.InOrg(org.ID)) {
-		httpapi.Forbidden(rw)
-		return
-	}
 	daemons, err := api.Database.GetProvisionerDaemons(ctx)
 	if errors.Is(err, sql.ErrNoRows) {
 		err = nil

enterprise/coderd/workspacequota.go

@@ -110,7 +110,7 @@ func (c *committer) CommitQuota(
 func (api *API) workspaceQuota(rw http.ResponseWriter, r *http.Request) {
 	user := httpmw.UserParam(r)
 
-	if !api.AGPL.Authorize(r, rbac.ActionRead, rbac.ResourceUser) {
+	if !api.AGPL.Authorize(r, rbac.ActionRead, user) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}