chore: push GetUsers authorization filter to SQL (#8497)

* feat: push GetUsers filter to SQL
* Remove GetAuthorizedUserFilter
* Remove GetFilteredUserCount
* remove GetUsersWithCount

coderd/rbac/regosql/compile_test.go

@@ -242,6 +242,26 @@ neq(input.object.owner, "");
 				p("false")),
 			VariableConverter: regosql.TemplateConverter(),
 		},
+		{
+			Name: "UserNoOrgOwner",
+			Queries: []string{
+				`input.object.org_owner != ""`,
+			},
+			ExpectedSQL:       p("'' != ''"),
+			VariableConverter: regosql.UserConverter(),
+		},
+		{
+			Name: "UserOwnsSelf",
+			Queries: []string{
+				`"10d03e62-7703-4df5-a358-4f76577d4e2f" = input.object.owner;
+				input.object.owner != "";
+				input.object.org_owner = ""`,
+			},
+			VariableConverter: regosql.UserConverter(),
+			ExpectedSQL: p(
+				p("'10d03e62-7703-4df5-a358-4f76577d4e2f' = ''") + " AND " + p("'' != ''") + " AND " + p("'' = ''"),
+			),
+		},
 	}
 
 	for _, tc := range testCases {

coderd/rbac/regosql/configs.go

@@ -36,6 +36,23 @@ func TemplateConverter() *sqltypes.VariableConverter {
 	return matcher
 }
 
+func UserConverter() *sqltypes.VariableConverter {
+	matcher := sqltypes.NewVariableConverter().RegisterMatcher(
+		resourceIDMatcher(),
+		// Users are never owned by an organization, so always return the empty string
+		// for the org owner.
+		sqltypes.StringVarMatcher("''", []string{"input", "object", "org_owner"}),
+		// Users never have an owner, and are only owned site wide.
+		sqltypes.StringVarMatcher("''", []string{"input", "object", "owner"}),
+	)
+	matcher.RegisterMatcher(
+		// No ACLs on the user type
+		sqltypes.AlwaysFalse(groupACLMatcher(matcher)),
+		sqltypes.AlwaysFalse(userACLMatcher(matcher)),
+	)
+	return matcher
+}
+
 // NoACLConverter should be used when the target SQL table does not contain
 // group or user ACL columns.
 func NoACLConverter() *sqltypes.VariableConverter {