feat: add disabling of default 'everyone' group access to template (#7982)

* feat: add disabling of default 'everyone' group access to template
* add FE to disable everyone group
* require entitlement to uncheck box

site/src/api/typesGenerated.ts

@@ -179,6 +179,7 @@ export interface CreateTemplateRequest {
   readonly allow_user_autostop?: boolean
   readonly failure_ttl_ms?: number
   readonly inactivity_ttl_ms?: number
+  readonly disable_everyone_group_access: boolean
 }
 
 // From codersdk/templateversions.go

site/src/pages/CreateTemplatePage/CreateTemplateForm.stories.tsx

@@ -17,6 +17,7 @@ export default {
   component: CreateTemplateForm,
   args: {
     isSubmitting: false,
+    allowDisableEveryoneAccess: true,
   },
 } as ComponentMeta<typeof CreateTemplateForm>
 

site/src/pages/CreateTemplatePage/CreateTemplateForm.tsx

@@ -102,6 +102,7 @@ const defaultInitialValues: CreateTemplateData = {
   allow_user_cancel_workspace_jobs: false,
   allow_user_autostart: false,
   allow_user_autostop: false,
+  allow_everyone_group_access: true,
 }
 
 type GetInitialValuesParams = {
@@ -174,6 +175,7 @@ export interface CreateTemplateFormProps {
   logs?: ProvisionerJobLog[]
   allowAdvancedScheduling: boolean
   copiedTemplate?: Template
+  allowDisableEveryoneAccess: boolean
 }
 
 export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
@@ -188,6 +190,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
   jobError,
   logs,
   allowAdvancedScheduling,
+  allowDisableEveryoneAccess,
 }) => {
   const styles = useStyles()
   const form = useFormik<CreateTemplateData>({
@@ -379,44 +382,90 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
         </FormFields>
       </FormSection>
 
-      {/* Operations */}
+      {/* Permissions */}
       <FormSection
-        title="Operations"
+        title="Permissions"
         description="Regulate actions allowed on workspaces created from this template."
       >
-        <FormFields>
-          <label htmlFor="allow_user_cancel_workspace_jobs">
-            <Stack direction="row" spacing={1}>
-              <Checkbox
-                id="allow_user_cancel_workspace_jobs"
-                name="allow_user_cancel_workspace_jobs"
-                disabled={isSubmitting}
-                checked={form.values.allow_user_cancel_workspace_jobs}
-                onChange={form.handleChange}
-              />
+        <Stack direction="column">
+          <FormFields>
+            <label htmlFor="allow_user_cancel_workspace_jobs">
+              <Stack direction="row" spacing={1}>
+                <Checkbox
+                  id="allow_user_cancel_workspace_jobs"
+                  name="allow_user_cancel_workspace_jobs"
+                  disabled={isSubmitting}
+                  checked={form.values.allow_user_cancel_workspace_jobs}
+                  onChange={form.handleChange}
+                />
 
-              <Stack direction="column" spacing={0.5}>
-                <Stack
-                  direction="row"
-                  alignItems="center"
-                  spacing={0.5}
-                  className={styles.optionText}
-                >
-                  <strong>{t("form.fields.allowUsersToCancel")}</strong>
+                <Stack direction="column" spacing={0.5}>
+                  <Stack
+                    direction="row"
+                    alignItems="center"
+                    spacing={0.5}
+                    className={styles.optionText}
+                  >
+                    <strong>{t("form.fields.allowUsersToCancel")}</strong>
 
-                  <HelpTooltip>
-                    <HelpTooltipText>
-                      {t("form.tooltip.allowUsersToCancel")}
-                    </HelpTooltipText>
-                  </HelpTooltip>
+                    <HelpTooltip>
+                      <HelpTooltipText>
+                        {t("form.tooltip.allowUsersToCancel")}
+                      </HelpTooltipText>
+                    </HelpTooltip>
+                  </Stack>
+                  <span className={styles.optionHelperText}>
+                    {t("form.helperText.allowUsersToCancel")}
+                  </span>
                 </Stack>
-                <span className={styles.optionHelperText}>
-                  {t("form.helperText.allowUsersToCancel")}
-                </span>
               </Stack>
-            </Stack>
-          </label>
-        </FormFields>
+            </label>
+          </FormFields>
+          <FormFields>
+            <label htmlFor="allow_everyone_group_access">
+              <Stack direction="row" spacing={1}>
+                <Checkbox
+                  id="allow_everyone_group_access"
+                  name="allow_everyone_group_access"
+                  disabled={isSubmitting || !allowDisableEveryoneAccess}
+                  checked={form.values.allow_everyone_group_access}
+                  onChange={form.handleChange}
+                />
+
+                <Stack direction="column" spacing={0.5}>
+                  <Stack
+                    direction="row"
+                    alignItems="center"
+                    spacing={0.5}
+                    className={styles.optionText}
+                  >
+                    <strong>Allow everyone to use the template</strong>
+
+                    <HelpTooltip>
+                      <HelpTooltipText>
+                        If unchecked, only users with the &apos;template
+                        admin&apos; and &apos;owner&apos; role can use this
+                        template until the permissions are updated. Navigate to{" "}
+                        <strong>
+                          Templates &gt; Select a template &gt; Settings &gt;
+                          Permissions
+                        </strong>{" "}
+                        to update permissions.
+                      </HelpTooltipText>
+                    </HelpTooltip>
+                  </Stack>
+                  <span className={styles.optionHelperText}>
+                    This setting requires an enterprise license for the&nbsp;
+                    <Link href="https://coder.com/docs/v2/latest/admin/rbac">
+                      &apos;Template RBAC&apos;
+                    </Link>{" "}
+                    feature to customize permissions.
+                  </span>
+                </Stack>
+              </Stack>
+            </label>
+          </FormFields>
+        </Stack>
       </FormSection>
 
       {/* Variables */}

site/src/pages/CreateTemplatePage/CreateTemplatePage.tsx

@@ -39,6 +39,10 @@ const CreateTemplatePage: FC = () => {
   const { entitlements } = useDashboard()
   const allowAdvancedScheduling =
     entitlements.features["advanced_template_scheduling"].enabled
+  // Requires the template RBAC feature, otherwise disabling everyone access
+  // means no one can access.
+  const allowDisableEveryoneAccess =
+    entitlements.features["template_rbac"].enabled
 
   const onCancel = () => {
     navigate(-1)
@@ -64,6 +68,7 @@ const CreateTemplatePage: FC = () => {
             <CreateTemplateForm
               copiedTemplate={state.context.copiedTemplate}
               allowAdvancedScheduling={allowAdvancedScheduling}
+              allowDisableEveryoneAccess={allowDisableEveryoneAccess}
               error={error}
               starterTemplate={starterTemplate}
               isSubmitting={state.hasTag("submitting")}

site/src/xServices/createTemplate/createTemplateXService.ts

@@ -45,6 +45,7 @@ export interface CreateTemplateData {
   allow_user_cancel_workspace_jobs: boolean
   parameter_values_by_name?: Record<string, string>
   user_variable_values?: VariableValue[]
+  allow_everyone_group_access: boolean
 }
 interface CreateTemplateContext {
   organizationId: string
@@ -457,11 +458,13 @@ export const createTemplateMachine =
             default_ttl_hours,
             max_ttl_hours,
             parameter_values_by_name,
+            allow_everyone_group_access,
             ...safeTemplateData
           } = templateData
 
           return createTemplate(organizationId, {
             ...safeTemplateData,
+            disable_everyone_group_access: !allow_everyone_group_access,
             default_ttl_ms: templateData.default_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
             max_ttl_ms: templateData.max_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
             template_version_id: version.id,