chore: remove rbac psuedo resources, add custom verbs (#13276)

Removes our pseudo rbac resources like `WorkspaceApplicationConnect` in favor of additional verbs like `ssh`. This is to make more intuitive permissions for building custom roles.

The source of truth is now `policy.go`

codersdk/authorization.go

@@ -32,7 +32,7 @@ type AuthorizationCheck struct {
 	// Omitting the 'OrganizationID' could produce the incorrect value, as
 	// workspaces have both `user` and `organization` owners.
 	Object AuthorizationObject `json:"object"`
-	Action string              `json:"action" enums:"create,read,update,delete"`
+	Action RBACAction          `json:"action" enums:"create,read,update,delete"`
 }
 
 // AuthorizationObject can represent a "set" of objects, such as: all workspaces in an organization, all workspaces owned by me,

codersdk/rbacresources.go

@@ -1,77 +0,0 @@
-package codersdk
-
-type RBACResource string
-
-const (
-	ResourceWorkspace                    RBACResource = "workspace"
-	ResourceWorkspaceProxy               RBACResource = "workspace_proxy"
-	ResourceWorkspaceExecution           RBACResource = "workspace_execution"
-	ResourceWorkspaceApplicationConnect  RBACResource = "application_connect"
-	ResourceAuditLog                     RBACResource = "audit_log"
-	ResourceTemplate                     RBACResource = "template"
-	ResourceGroup                        RBACResource = "group"
-	ResourceFile                         RBACResource = "file"
-	ResourceProvisionerDaemon            RBACResource = "provisioner_daemon"
-	ResourceOrganization                 RBACResource = "organization"
-	ResourceRoleAssignment               RBACResource = "assign_role"
-	ResourceOrgRoleAssignment            RBACResource = "assign_org_role"
-	ResourceAPIKey                       RBACResource = "api_key"
-	ResourceUser                         RBACResource = "user"
-	ResourceUserData                     RBACResource = "user_data"
-	ResourceUserWorkspaceBuildParameters RBACResource = "user_workspace_build_parameters"
-	ResourceOrganizationMember           RBACResource = "organization_member"
-	ResourceLicense                      RBACResource = "license"
-	ResourceDeploymentValues             RBACResource = "deployment_config"
-	ResourceDeploymentStats              RBACResource = "deployment_stats"
-	ResourceReplicas                     RBACResource = "replicas"
-	ResourceDebugInfo                    RBACResource = "debug_info"
-	ResourceSystem                       RBACResource = "system"
-	ResourceTemplateInsights             RBACResource = "template_insights"
-)
-
-const (
-	ActionCreate = "create"
-	ActionRead   = "read"
-	ActionUpdate = "update"
-	ActionDelete = "delete"
-)
-
-var (
-	AllRBACResources = []RBACResource{
-		ResourceWorkspace,
-		ResourceWorkspaceProxy,
-		ResourceWorkspaceExecution,
-		ResourceWorkspaceApplicationConnect,
-		ResourceAuditLog,
-		ResourceTemplate,
-		ResourceGroup,
-		ResourceFile,
-		ResourceProvisionerDaemon,
-		ResourceOrganization,
-		ResourceRoleAssignment,
-		ResourceOrgRoleAssignment,
-		ResourceAPIKey,
-		ResourceUser,
-		ResourceUserData,
-		ResourceUserWorkspaceBuildParameters,
-		ResourceOrganizationMember,
-		ResourceLicense,
-		ResourceDeploymentValues,
-		ResourceDeploymentStats,
-		ResourceReplicas,
-		ResourceDebugInfo,
-		ResourceSystem,
-		ResourceTemplateInsights,
-	}
-
-	AllRBACActions = []string{
-		ActionCreate,
-		ActionRead,
-		ActionUpdate,
-		ActionDelete,
-	}
-)
-
-func (r RBACResource) String() string {
-	return string(r)
-}

codersdk/rbacresources_gen.go

@@ -0,0 +1,50 @@
+// Code generated by rbacgen/main.go. DO NOT EDIT.
+package codersdk
+
+type RBACResource string
+
+const (
+	ResourceWildcard           RBACResource = "*"
+	ResourceApiKey             RBACResource = "api_key"
+	ResourceAssignOrgRole      RBACResource = "assign_org_role"
+	ResourceAssignRole         RBACResource = "assign_role"
+	ResourceAuditLog           RBACResource = "audit_log"
+	ResourceDebugInfo          RBACResource = "debug_info"
+	ResourceDeploymentConfig   RBACResource = "deployment_config"
+	ResourceDeploymentStats    RBACResource = "deployment_stats"
+	ResourceFile               RBACResource = "file"
+	ResourceGroup              RBACResource = "group"
+	ResourceLicense            RBACResource = "license"
+	ResourceOauth2App          RBACResource = "oauth2_app"
+	ResourceOauth2AppCodeToken RBACResource = "oauth2_app_code_token"
+	ResourceOauth2AppSecret    RBACResource = "oauth2_app_secret"
+	ResourceOrganization       RBACResource = "organization"
+	ResourceOrganizationMember RBACResource = "organization_member"
+	ResourceProvisionerDaemon  RBACResource = "provisioner_daemon"
+	ResourceReplicas           RBACResource = "replicas"
+	ResourceSystem             RBACResource = "system"
+	ResourceTailnetCoordinator RBACResource = "tailnet_coordinator"
+	ResourceTemplate           RBACResource = "template"
+	ResourceUser               RBACResource = "user"
+	ResourceWorkspace          RBACResource = "workspace"
+	ResourceWorkspaceDormant   RBACResource = "workspace_dormant"
+	ResourceWorkspaceProxy     RBACResource = "workspace_proxy"
+)
+
+type RBACAction string
+
+const (
+	ActionApplicationConnect RBACAction = "application_connect"
+	ActionAssign             RBACAction = "assign"
+	ActionCreate             RBACAction = "create"
+	ActionDelete             RBACAction = "delete"
+	ActionRead               RBACAction = "read"
+	ActionReadPersonal       RBACAction = "read_personal"
+	ActionSSH                RBACAction = "ssh"
+	ActionUpdate             RBACAction = "update"
+	ActionUpdatePersonal     RBACAction = "update_personal"
+	ActionUse                RBACAction = "use"
+	ActionViewInsights       RBACAction = "view_insights"
+	ActionWorkspaceStart     RBACAction = "start"
+	ActionWorkspaceStop      RBACAction = "stop"
+)