feat: Add initial AuthzQuerier implementation (#5919)

feat: Add initial AuthzQuerier implementation
- Adds package database/dbauthz that adds a database.Store implementation where each method goes through AuthZ checks
- Implements all database.Store methods on AuthzQuerier
- Updates and fixes unit tests where required
- Updates coderd initialization to use AuthzQuerier if codersdk.ExperimentAuthzQuerier is enabled

coderd/rbac/scopes.go

@@ -3,6 +3,8 @@ package rbac
 import (
 	"fmt"
 
+	"github.com/google/uuid"
+
 	"golang.org/x/xerrors"
 )
 
@@ -41,6 +43,29 @@ func (s Scope) Name() string {
 	return s.Role.Name
 }
 
+// WorkspaceAgentScope returns a scope that is the same as ScopeAll but can only
+// affect resources in the allow list. Only a scope is returned as the roles
+// should come from the workspace owner.
+func WorkspaceAgentScope(workspaceID, ownerID uuid.UUID) Scope {
+	allScope, err := ScopeAll.Expand()
+	if err != nil {
+		panic("failed to expand scope all, this should never happen")
+	}
+	return Scope{
+		// TODO: We want to limit the role too to be extra safe.
+		// Even though the allowlist blocks anything else, it is still good
+		// incase we change the behavior of the allowlist. The allowlist is new
+		// and evolving.
+		Role: allScope.Role,
+		// This prevents the agent from being able to access any other resource.
+		AllowIDList: []string{
+			workspaceID.String(),
+			ownerID.String(),
+			// TODO: Might want to include the template the workspace uses too?
+		},
+	}
+}
+
 const (
 	ScopeAll                ScopeName = "all"
 	ScopeApplicationConnect ScopeName = "application_connect"