From 47805643f74b4e04e6b1e7329707fb7d23361ca0 Mon Sep 17 00:00:00 2001 From: Jon Ayers Date: Wed, 12 Oct 2022 14:33:03 -0500 Subject: [PATCH] fix: allow user admins to manage groups (#4498) --- coderd/rbac/builtin.go | 1 + coderd/rbac/builtin_test.go | 9 +++++++++ docs/admin/users.md | 2 +- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/coderd/rbac/builtin.go b/coderd/rbac/builtin.go index 2fb4e6f251..964eec3a73 100644 --- a/coderd/rbac/builtin.go +++ b/coderd/rbac/builtin.go @@ -127,6 +127,7 @@ var ( ResourceUser.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete}, // Full perms to manage org members ResourceOrganizationMember.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete}, + ResourceGroup.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete}, }), } }, diff --git a/coderd/rbac/builtin_test.go b/coderd/rbac/builtin_test.go index 5c744d0d25..fc959b26f6 100644 --- a/coderd/rbac/builtin_test.go +++ b/coderd/rbac/builtin_test.go @@ -369,6 +369,15 @@ func TestRolePermissions(t *testing.T) { false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin}, }, }, + { + Name: "Groups", + Actions: []rbac.Action{rbac.ActionRead}, + Resource: rbac.ResourceGroup.InOrg(orgID), + AuthorizeMap: map[bool][]authSubject{ + true: {owner, orgAdmin, userAdmin, orgMemberMe}, + false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin}, + }, + }, } for _, c := range testCases { diff --git a/docs/admin/users.md b/docs/admin/users.md index 78344c5fab..fb354ceda2 100644 --- a/docs/admin/users.md +++ b/docs/admin/users.md @@ -9,7 +9,7 @@ Coder offers these user roles in the community edition: | | User Admin | Template Admin | Owner | | ------------------------------------------ | ---------- | -------------- | ----- | | Add and remove Users | ✅ | | ✅ | -| Manage groups (enterprise) | | | | +| Manage groups (enterprise) | ✅ | | ✅ | | Change User roles | | | ✅ | | Manage **ALL** Templates | | ✅ | ✅ | | View, update and delete **ALL** Workspaces | | ✅ | ✅ |