feat: add disabling of default 'everyone' group access to template (#7982)

* feat: add disabling of default 'everyone' group access to template
* add FE to disable everyone group
* require entitlement to uncheck box

cli/templatecreate.go

@@ -28,6 +28,7 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 		provisionerTags []string
 		variablesFile   string
 		variables       []string
+		disableEveryone bool
 		defaultTTL      time.Duration
 		failureTTL      time.Duration
 		inactivityTTL   time.Duration
@@ -121,11 +122,12 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 			}
 
 			createReq := codersdk.CreateTemplateRequest{
-				Name:                templateName,
-				VersionID:           job.ID,
-				DefaultTTLMillis:    ptr.Ref(defaultTTL.Milliseconds()),
-				FailureTTLMillis:    ptr.Ref(failureTTL.Milliseconds()),
-				InactivityTTLMillis: ptr.Ref(inactivityTTL.Milliseconds()),
+				Name:                       templateName,
+				VersionID:                  job.ID,
+				DefaultTTLMillis:           ptr.Ref(defaultTTL.Milliseconds()),
+				FailureTTLMillis:           ptr.Ref(failureTTL.Milliseconds()),
+				InactivityTTLMillis:        ptr.Ref(inactivityTTL.Milliseconds()),
+				DisableEveryoneGroupAccess: disableEveryone,
 			}
 
 			_, err = client.CreateTemplate(inv.Context(), organization.ID, createReq)
@@ -144,6 +146,12 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 		},
 	}
 	cmd.Options = clibase.OptionSet{
+		{
+			Flag: "private",
+			Description: "Disable the default behavior of granting template access to the 'everyone' group. " +
+				"The template permissions must be updated to allow non-admin users to use this template.",
+			Value: clibase.BoolOf(&disableEveryone),
+		},
 		{
 			Flag:        "variables-file",
 			Description: "Specify a file path with values for Terraform-managed variables.",

cli/testdata/coder_templates_create_--help.golden

@@ -17,6 +17,11 @@ Create a template from the current directory or as specified by flag
           Specify an inactivity TTL for workspaces created from this template.
           This licensed feature's default is 0h (off).
 
+      --private bool
+          Disable the default behavior of granting template access to the
+          'everyone' group. The template permissions must be updated to allow
+          non-admin users to use this template.
+
       --provisioner-tag string-array
           Specify a set of tags to target provisioner daemons.