chore(scripts/rules.go): broaden scope of testingWithOwnerUser linter (#10548)

* Updated testingWithOwnerUser ruleguard rule to detect:
  a) Passing client from coderdenttest.New() to clitest.SetupConfig() similar to what already exists for AGPL code
  b) Usage of any method of the owner client from coderdenttest.New() - all usages of the owner client must be justified with a `//nolint:gocritic` comment.
* Fixed resulting linter complaints.
* Added new coderdtest helpers CreateGroup and UpdateTemplateMeta.
* Modified check_enterprise_import.sh to ignore scripts/rules.go.

enterprise/cli/features_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/pty/ptytest"
@@ -18,9 +19,10 @@ func TestFeaturesList(t *testing.T) {
 	t.Parallel()
 	t.Run("Table", func(t *testing.T) {
 		t.Parallel()
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 		inv, conf := newCLI(t, "features", "list")
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 		pty := ptytest.New(t).Attach(inv)
 		clitest.Start(t, inv)
 		pty.ExpectMatch("user_limit")
@@ -29,9 +31,10 @@ func TestFeaturesList(t *testing.T) {
 	t.Run("JSON", func(t *testing.T) {
 		t.Parallel()
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 		inv, conf := newCLI(t, "features", "list", "-o", "json")
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 		doneChan := make(chan struct{})
 
 		buf := bytes.NewBuffer(nil)

enterprise/cli/groupcreate_test.go

@@ -10,6 +10,8 @@ import (
 
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
@@ -22,11 +24,12 @@ func TestCreateGroup(t *testing.T) {
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
 		var (
 			groupName = "test"
@@ -40,7 +43,7 @@ func TestCreateGroup(t *testing.T) {
 
 		pty := ptytest.New(t)
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
 		err := inv.Run()
 		require.NoError(t, err)

enterprise/cli/groupdelete_test.go

@@ -10,11 +10,12 @@ import (
 
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
 	"github.com/coder/coder/v2/pty/ptytest"
-	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupDelete(t *testing.T) {
@@ -28,12 +29,9 @@ func TestGroupDelete(t *testing.T) {
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
-		ctx := testutil.Context(t, testutil.WaitLong)
-		group, err := client.CreateGroup(ctx, admin.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "alpha",
-		})
-		require.NoError(t, err)
+		group := coderdtest.CreateGroup(t, client, admin.OrganizationID, "alpha")
 
 		inv, conf := newCLI(t,
 			"groups", "delete", group.Name,
@@ -42,9 +40,9 @@ func TestGroupDelete(t *testing.T) {
 		pty := ptytest.New(t)
 
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
-		err = inv.Run()
+		err := inv.Run()
 		require.NoError(t, err)
 
 		pty.ExpectMatch(fmt.Sprintf("Successfully deleted group %s", pretty.Sprint(cliui.DefaultStyles.Keyword, group.Name)))
@@ -53,18 +51,19 @@ func TestGroupDelete(t *testing.T) {
 	t.Run("NoArg", func(t *testing.T) {
 		t.Parallel()
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
 		inv, conf := newCLI(
 			t,
 			"groups", "delete",
 		)
 
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
 		err := inv.Run()
 		require.Error(t, err)

enterprise/cli/groupedit_test.go

@@ -11,11 +11,11 @@ import (
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
 	"github.com/coder/coder/v2/pty/ptytest"
-	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupEdit(t *testing.T) {
@@ -29,23 +29,13 @@ func TestGroupEdit(t *testing.T) {
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
-		ctx := testutil.Context(t, testutil.WaitLong)
 		_, user1 := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 		_, user2 := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 		_, user3 := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 
-		group, err := client.CreateGroup(ctx, admin.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "alpha",
-		})
-		require.NoError(t, err)
-
-		// We use the sdk here as opposed to the CLI since adding this user
-		// is considered setup. They will be removed in the proper CLI test.
-		group, err = client.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
-			AddUsers: []string{user3.ID.String()},
-		})
-		require.NoError(t, err)
+		group := coderdtest.CreateGroup(t, client, admin.OrganizationID, "alpha", user3)
 
 		expectedName := "beta"
 
@@ -62,9 +52,9 @@ func TestGroupEdit(t *testing.T) {
 		pty := ptytest.New(t)
 
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
-		err = inv.Run()
+		err := inv.Run()
 		require.NoError(t, err)
 
 		pty.ExpectMatch(fmt.Sprintf("Successfully patched group %s", pretty.Sprint(cliui.DefaultStyles.Keyword, expectedName)))
@@ -79,12 +69,8 @@ func TestGroupEdit(t *testing.T) {
 			},
 		}})
 
-		ctx := testutil.Context(t, testutil.WaitLong)
-
-		group, err := client.CreateGroup(ctx, admin.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "alpha",
-		})
-		require.NoError(t, err)
+		// Create a group with no members.
+		group := coderdtest.CreateGroup(t, client, admin.OrganizationID, "alpha")
 
 		inv, conf := newCLI(
 			t,
@@ -92,26 +78,26 @@ func TestGroupEdit(t *testing.T) {
 			"-a", "foo",
 		)
 
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // intentional usage of owner
 
-		err = inv.Run()
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "must be a valid UUID or email address")
+		err := inv.Run()
+		require.ErrorContains(t, err, "must be a valid UUID or email address")
 	})
 
 	t.Run("NoArg", func(t *testing.T) {
 		t.Parallel()
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.RoleUserAdmin())
 
 		inv, conf := newCLI(t, "groups", "edit")
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
 		err := inv.Run()
-		require.Error(t, err)
+		require.ErrorContains(t, err, "wanted 1 args but got 0")
 	})
 }

enterprise/cli/grouplist_test.go

@@ -7,11 +7,11 @@ import (
 
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
 	"github.com/coder/coder/v2/pty/ptytest"
-	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupList(t *testing.T) {
@@ -25,42 +25,25 @@ func TestGroupList(t *testing.T) {
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
-		ctx := testutil.Context(t, testutil.WaitLong)
 		_, user1 := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 		_, user2 := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 
 		// We intentionally create the first group as beta so that we
 		// can assert that things are being sorted by name intentionally
 		// and not by chance (or some other parameter like created_at).
-		group1, err := client.CreateGroup(ctx, admin.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "beta",
-		})
-		require.NoError(t, err)
-
-		group2, err := client.CreateGroup(ctx, admin.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "alpha",
-		})
-		require.NoError(t, err)
-
-		_, err = client.PatchGroup(ctx, group1.ID, codersdk.PatchGroupRequest{
-			AddUsers: []string{user1.ID.String()},
-		})
-		require.NoError(t, err)
-
-		_, err = client.PatchGroup(ctx, group2.ID, codersdk.PatchGroupRequest{
-			AddUsers: []string{user2.ID.String()},
-		})
-		require.NoError(t, err)
+		group1 := coderdtest.CreateGroup(t, client, admin.OrganizationID, "beta", user1)
+		group2 := coderdtest.CreateGroup(t, client, admin.OrganizationID, "alpha", user2)
 
 		inv, conf := newCLI(t, "groups", "list")
 
 		pty := ptytest.New(t)
 
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
-		err = inv.Run()
+		err := inv.Run()
 		require.NoError(t, err)
 
 		matches := []string{
@@ -77,25 +60,26 @@ func TestGroupList(t *testing.T) {
 	t.Run("Everyone", func(t *testing.T) {
 		t.Parallel()
 
-		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleUserAdmin())
 
 		inv, conf := newCLI(t, "groups", "list")
 
 		pty := ptytest.New(t)
 
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, anotherClient, conf)
 
 		err := inv.Run()
 		require.NoError(t, err)
 
 		matches := []string{
 			"NAME", "ORGANIZATION ID", "MEMBERS", " AVATAR URL",
-			"Everyone", user.OrganizationID.String(), coderdtest.FirstUserParams.Email, "",
+			"Everyone", admin.OrganizationID.String(), coderdtest.FirstUserParams.Email, "",
 		}
 
 		for _, match := range matches {

enterprise/cli/licenses_test.go

@@ -122,7 +122,7 @@ func TestLicensesAddReal(t *testing.T) {
 			t,
 			"licenses", "add", "-l", fakeLicenseJWT,
 		)
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // requires owner
 
 		waiter := clitest.StartWithWaiter(t, inv)
 		var coderError *codersdk.Error
@@ -180,7 +180,7 @@ func TestLicensesListReal(t *testing.T) {
 		inv.Stdout = stdout
 		stderr := new(bytes.Buffer)
 		inv.Stderr = stderr
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // requires owner
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 		errC := make(chan error)
@@ -216,7 +216,7 @@ func TestLicensesDeleteReal(t *testing.T) {
 		inv, conf := newCLI(
 			t,
 			"licenses", "delete", "1")
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // requires owner
 
 		var coderError *codersdk.Error
 		clitest.StartWithWaiter(t, inv).RequireAs(&coderError)

enterprise/cli/provisionerdaemons_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
@@ -37,20 +38,43 @@ func TestProvisionerDaemon_PSK(t *testing.T) {
 
 func TestProvisionerDaemon_SessionToken(t *testing.T) {
 	t.Parallel()
-
-	client, _ := coderdenttest.New(t, &coderdenttest.Options{
-		ProvisionerDaemonPSK: "provisionersftw",
-		LicenseOptions: &coderdenttest.LicenseOptions{
-			Features: license.Features{
-				codersdk.FeatureExternalProvisionerDaemons: 1,
+	t.Run("ScopeUser", func(t *testing.T) {
+		t.Parallel()
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{
+			ProvisionerDaemonPSK: "provisionersftw",
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
 			},
-		},
+		})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		inv, conf := newCLI(t, "provisionerd", "start", "--tag", "scope=user")
+		clitest.SetupConfig(t, anotherClient, conf)
+		pty := ptytest.New(t).Attach(inv)
+		ctx, cancel := context.WithTimeout(inv.Context(), testutil.WaitLong)
+		defer cancel()
+		clitest.Start(t, inv)
+		pty.ExpectMatchContext(ctx, "starting provisioner daemon")
+	})
+
+	t.Run("ScopeOrg", func(t *testing.T) {
+		t.Parallel()
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{
+			ProvisionerDaemonPSK: "provisionersftw",
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
+			},
+		})
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		inv, conf := newCLI(t, "provisionerd", "start", "--tag", "scope=organization")
+		clitest.SetupConfig(t, anotherClient, conf)
+		pty := ptytest.New(t).Attach(inv)
+		ctx, cancel := context.WithTimeout(inv.Context(), testutil.WaitLong)
+		defer cancel()
+		clitest.Start(t, inv)
+		pty.ExpectMatchContext(ctx, "starting provisioner daemon")
 	})
-	inv, conf := newCLI(t, "provisionerd", "start")
-	clitest.SetupConfig(t, client, conf)
-	pty := ptytest.New(t).Attach(inv)
-	ctx, cancel := context.WithTimeout(inv.Context(), testutil.WaitLong)
-	defer cancel()
-	clitest.Start(t, inv)
-	pty.ExpectMatchContext(ctx, "starting provisioner daemon")
 }

enterprise/cli/root_test.go

@@ -47,7 +47,7 @@ func TestCheckWarnings(t *testing.T) {
 
 		var buf bytes.Buffer
 		inv.Stderr = &buf
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // owners should see this
 
 		err := inv.Run()
 		require.NoError(t, err)

enterprise/cli/start_test.go

@@ -37,50 +37,37 @@ func TestStart(t *testing.T) {
 				},
 			},
 		})
+		templateAdminClient, templateAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
 		// Create an initial version.
-		oldVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil)
+		oldVersion := coderdtest.CreateTemplateVersion(t, templateAdminClient, owner.OrganizationID, nil)
 		// Create a template that mandates the promoted version.
 		// This should be enforced for everyone except template admins.
-		template := coderdtest.CreateTemplate(t, ownerClient, owner.OrganizationID, oldVersion.ID)
-		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, oldVersion.ID)
+		template := coderdtest.CreateTemplate(t, templateAdminClient, owner.OrganizationID, oldVersion.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, templateAdminClient, oldVersion.ID)
 		require.Equal(t, oldVersion.ID, template.ActiveVersionID)
-		template, err := ownerClient.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+		template = coderdtest.UpdateTemplateMeta(t, templateAdminClient, template.ID, codersdk.UpdateTemplateMeta{
 			RequireActiveVersion: true,
 		})
-		require.NoError(t, err)
 		require.True(t, template.RequireActiveVersion)
 
 		// Create a new version that we will promote.
-		activeVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+		activeVersion := coderdtest.CreateTemplateVersion(t, templateAdminClient, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
 			ctvr.TemplateID = template.ID
 		})
-		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, activeVersion.ID)
-		err = ownerClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
-			ID: activeVersion.ID,
-		})
-		require.NoError(t, err)
-		err = ownerClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+		coderdtest.AwaitTemplateVersionJobCompleted(t, templateAdminClient, activeVersion.ID)
+		err := templateAdminClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
 			ID: activeVersion.ID,
 		})
 		require.NoError(t, err)
 
-		templateAdminClient, templateAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
 		templateACLAdminClient, templateACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
 		templateGroupACLAdminClient, templateGroupACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
 		memberClient, member := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
 
 		// Create a group so we can also test group template admin ownership.
-		group, err := ownerClient.CreateGroup(ctx, owner.OrganizationID, codersdk.CreateGroupRequest{
-			Name: "test",
-		})
-		require.NoError(t, err)
-
 		// Add the user who gains template admin via group membership.
-		group, err = ownerClient.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
-			AddUsers: []string{templateGroupACLAdmin.ID.String()},
-		})
-		require.NoError(t, err)
+		group := coderdtest.CreateGroup(t, ownerClient, owner.OrganizationID, "test", templateGroupACLAdmin)
 
 		// Update the template for both users and groups.
 		err = ownerClient.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{

enterprise/cli/templatecreate_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
@@ -37,6 +38,7 @@ func TestTemplateCreate(t *testing.T) {
 				IncludeProvisionerDaemon: true,
 			},
 		})
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.RoleTemplateAdmin())
 
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
@@ -51,13 +53,13 @@ func TestTemplateCreate(t *testing.T) {
 			"-y",
 		)
 
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, templateAdmin, conf)
 
 		err := inv.Run()
 		require.NoError(t, err)
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
-		template, err := client.TemplateByName(ctx, user.OrganizationID, "new")
+		template, err := templateAdmin.TemplateByName(ctx, user.OrganizationID, "new")
 		require.NoError(t, err)
 		require.True(t, template.RequireActiveVersion)
 	})
@@ -70,7 +72,7 @@ func TestTemplateCreate(t *testing.T) {
 			string(codersdk.ExperimentTemplateUpdatePolicies),
 		}
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+		client, admin := coderdenttest.New(t, &coderdenttest.Options{
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{},
 			},
@@ -79,6 +81,7 @@ func TestTemplateCreate(t *testing.T) {
 				IncludeProvisionerDaemon: true,
 			},
 		})
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleTemplateAdmin())
 
 		inv, conf := newCLI(t, "templates",
 			"create", "new",
@@ -86,7 +89,7 @@ func TestTemplateCreate(t *testing.T) {
 			"-y",
 		)
 
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, templateAdmin, conf)
 
 		err := inv.Run()
 		require.Error(t, err)

enterprise/cli/templateedit_test.go

@@ -77,6 +77,7 @@ func TestTemplateEdit(t *testing.T) {
 				IncludeProvisionerDaemon: true,
 			},
 		})
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
 		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
 		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
@@ -89,7 +90,7 @@ func TestTemplateEdit(t *testing.T) {
 			"-y",
 		)
 
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, templateAdmin, conf)
 
 		err := inv.Run()
 		require.Error(t, err)

enterprise/cli/workspaceproxy_test.go

@@ -53,7 +53,7 @@ func Test_ProxyCRUD(t *testing.T) {
 
 		pty := ptytest.New(t)
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // create wsproxy requires owner
 
 		err := inv.WithContext(ctx).Run()
 		require.NoError(t, err)
@@ -72,14 +72,14 @@ func Test_ProxyCRUD(t *testing.T) {
 
 		pty = ptytest.New(t)
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // requires owner
 
 		err = inv.WithContext(ctx).Run()
 		require.NoError(t, err)
 		pty.ExpectMatch(expectedName)
 
 		// Also check via the api
-		proxies, err := client.WorkspaceProxies(ctx)
+		proxies, err := client.WorkspaceProxies(ctx) //nolint:gocritic // requires owner
 		require.NoError(t, err, "failed to get workspace proxies")
 		// Include primary
 		require.Len(t, proxies.Regions, 2, "expected 1 proxy")
@@ -128,12 +128,12 @@ func Test_ProxyCRUD(t *testing.T) {
 
 		pty := ptytest.New(t)
 		inv.Stdout = pty.Output()
-		clitest.SetupConfig(t, client, conf)
+		clitest.SetupConfig(t, client, conf) //nolint:gocritic // requires owner
 
 		err = inv.WithContext(ctx).Run()
 		require.NoError(t, err)
 
-		proxies, err := client.WorkspaceProxies(ctx)
+		proxies, err := client.WorkspaceProxies(ctx) //nolint:gocritic // requires owner
 		require.NoError(t, err, "failed to get workspace proxies")
 		require.Len(t, proxies.Regions, 1, "expected only primary proxy")
 	})