feat: get and update group IdP Sync settings (#14647)

---------

Co-authored-by: Steven Masley <stevenmasley@gmail.com>

coderd/rbac/object_gen.go

@@ -102,6 +102,14 @@ var (
 		Type: "group_member",
 	}
 
+	// ResourceIdpsyncSettings
+	// Valid Actions
+	//  - "ActionRead" :: read IdP sync settings
+	//  - "ActionUpdate" :: update IdP sync settings
+	ResourceIdpsyncSettings = Object{
+		Type: "idpsync_settings",
+	}
+
 	// ResourceLicense
 	// Valid Actions
 	//  - "ActionCreate" :: create a license
@@ -297,6 +305,7 @@ func AllResources() []Objecter {
 		ResourceFile,
 		ResourceGroup,
 		ResourceGroupMember,
+		ResourceIdpsyncSettings,
 		ResourceLicense,
 		ResourceNotificationPreference,
 		ResourceNotificationTemplate,

coderd/rbac/policy/policy.go

@@ -274,4 +274,11 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionUpdate: actDef("update notification preferences"),
 		},
 	},
+	// idpsync_settings should always be org scoped
+	"idpsync_settings": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead:   actDef("read IdP sync settings"),
+			ActionUpdate: actDef("update IdP sync settings"),
+		},
+	},
 }

coderd/rbac/roles_test.go

@@ -705,6 +705,20 @@ func TestRolePermissions(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name:     "IDPSyncSettings",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
+			Resource: rbac.ResourceIdpsyncSettings.InOrg(orgID),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner, orgAdmin},
+				false: {
+					orgMemberMe, otherOrgAdmin,
+					memberMe, userAdmin, templateAdmin,
+					orgAuditor, orgUserAdmin, orgTemplateAdmin,
+					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
+				},
+			},
+		},
 	}
 
 	// We expect every permission to be tested above.