fix: allow group members to read group information (#14200)

* - allow group members to read basic Group info
- allow group members to see they are part of the group, but not see that information about other members
- add a GetGroupMembersCountByGroupID SQL query, which allows group members to see members count without revealing other information about the members
- add the group_members_expanded db view
- rewrite group member queries to use the group_members_expanded view
- add the RBAC ResourceGroupMember and add it to relevant roles
- rewrite GetGroupMembersByGroupID permission checks
- make the GroupMember type contain all user fields
- fix type issues coming from replacing User with GroupMember in group member queries
- add the MemberTotalCount field to codersdk.Group
- display `group.total_member_count` instead of `group.members.length` on the account page

codersdk/groups.go

@@ -30,9 +30,13 @@ type Group struct {
 	DisplayName    string        `json:"display_name"`
 	OrganizationID uuid.UUID     `json:"organization_id" format:"uuid"`
 	Members        []ReducedUser `json:"members"`
-	AvatarURL      string        `json:"avatar_url"`
-	QuotaAllowance int           `json:"quota_allowance"`
-	Source         GroupSource   `json:"source"`
+	// How many members are in this group. Shows the total count,
+	// even if the user is not authorized to read group member details.
+	// May be greater than `len(Group.Members)`.
+	TotalMemberCount int         `json:"total_member_count"`
+	AvatarURL        string      `json:"avatar_url"`
+	QuotaAllowance   int         `json:"quota_allowance"`
+	Source           GroupSource `json:"source"`
 }
 
 func (g Group) IsEveryone() bool {

codersdk/rbacresources_gen.go

@@ -14,6 +14,7 @@ const (
 	ResourceDeploymentStats        RBACResource = "deployment_stats"
 	ResourceFile                   RBACResource = "file"
 	ResourceGroup                  RBACResource = "group"
+	ResourceGroupMember            RBACResource = "group_member"
 	ResourceLicense                RBACResource = "license"
 	ResourceNotificationPreference RBACResource = "notification_preference"
 	ResourceNotificationTemplate   RBACResource = "notification_template"
@@ -65,6 +66,7 @@ var RBACResourceActions = map[RBACResource][]RBACAction{
 	ResourceDeploymentStats:        {ActionRead},
 	ResourceFile:                   {ActionCreate, ActionRead},
 	ResourceGroup:                  {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceGroupMember:            {ActionRead},
 	ResourceLicense:                {ActionCreate, ActionDelete, ActionRead},
 	ResourceNotificationPreference: {ActionRead, ActionUpdate},
 	ResourceNotificationTemplate:   {ActionRead, ActionUpdate},