feat: scope allow_list to include resource_type (#19748)

This feature allows the `allow_list` in the scopes to specify the `type`

coderd/rbac/scopes.go

@@ -45,14 +45,15 @@ func WorkspaceAgentScope(params WorkspaceAgentScopeParams) Scope {
 		// incase we change the behavior of the allowlist. The allowlist is new
 		// and evolving.
 		Role: scope.Role,
-		// This prevents the agent from being able to access any other resource.
-		// Include the list of IDs of anything that is required for the
-		// agent to function.
-		AllowIDList: []string{
-			params.WorkspaceID.String(),
-			params.TemplateID.String(),
-			params.VersionID.String(),
-			params.OwnerID.String(),
+
+		// Limit the agent to only be able to access the singular workspace and
+		// the template/version it was created from. Add additional resources here
+		// as needed, but do not add more workspace or template resource ids.
+		AllowIDList: []AllowListElement{
+			{Type: ResourceWorkspace.Type, ID: params.WorkspaceID.String()},
+			{Type: ResourceTemplate.Type, ID: params.TemplateID.String()},
+			{Type: ResourceTemplate.Type, ID: params.VersionID.String()},
+			{Type: ResourceUser.Type, ID: params.OwnerID.String()},
 		},
 	}
 }
@@ -77,7 +78,7 @@ var builtinScopes = map[ScopeName]Scope{
 			Org:  map[string][]Permission{},
 			User: []Permission{},
 		},
-		AllowIDList: []string{policy.WildcardSymbol},
+		AllowIDList: []AllowListElement{AllowListAll()},
 	},
 
 	ScopeApplicationConnect: {
@@ -90,7 +91,7 @@ var builtinScopes = map[ScopeName]Scope{
 			Org:  map[string][]Permission{},
 			User: []Permission{},
 		},
-		AllowIDList: []string{policy.WildcardSymbol},
+		AllowIDList: []AllowListElement{AllowListAll()},
 	},
 
 	ScopeNoUserData: {
@@ -101,7 +102,7 @@ var builtinScopes = map[ScopeName]Scope{
 			Org:         map[string][]Permission{},
 			User:        []Permission{},
 		},
-		AllowIDList: []string{policy.WildcardSymbol},
+		AllowIDList: []AllowListElement{AllowListAll()},
 	},
 }
 
@@ -129,7 +130,17 @@ func (name ScopeName) Name() RoleIdentifier {
 // AllowIDList. Eg: 'AllowIDList: []string{WildcardSymbol}'
 type Scope struct {
 	Role
-	AllowIDList []string `json:"allow_list"`
+	AllowIDList []AllowListElement `json:"allow_list"`
+}
+
+type AllowListElement struct {
+	// ID must be a string to allow for the wildcard symbol.
+	ID   string `json:"id"`
+	Type string `json:"type"`
+}
+
+func AllowListAll() AllowListElement {
+	return AllowListElement{ID: policy.WildcardSymbol, Type: policy.WildcardSymbol}
 }
 
 func (s Scope) Expand() (Scope, error) {