feat: cancel stuck pending jobs (#17803)

Closes: #16488

coderd/rbac/authz.go

@@ -65,7 +65,7 @@ const (
 	SubjectTypeUser                         SubjectType = "user"
 	SubjectTypeProvisionerd                 SubjectType = "provisionerd"
 	SubjectTypeAutostart                    SubjectType = "autostart"
-	SubjectTypeHangDetector                 SubjectType = "hang_detector"
+	SubjectTypeJobReaper                    SubjectType = "job_reaper"
 	SubjectTypeResourceMonitor              SubjectType = "resource_monitor"
 	SubjectTypeCryptoKeyRotator             SubjectType = "crypto_key_rotator"
 	SubjectTypeCryptoKeyReader              SubjectType = "crypto_key_reader"

coderd/rbac/object_gen.go

@@ -234,7 +234,9 @@ var (
 
 	// ResourceProvisionerJobs
 	// Valid Actions
+	//  - "ActionCreate" :: create provisioner jobs
 	//  - "ActionRead" :: read provisioner jobs
+	//  - "ActionUpdate" :: update provisioner jobs
 	ResourceProvisionerJobs = Object{
 		Type: "provisioner_jobs",
 	}

coderd/rbac/policy/policy.go

@@ -182,7 +182,9 @@ var RBACPermissions = map[string]PermissionDefinition{
 	},
 	"provisioner_jobs": {
 		Actions: map[Action]ActionDefinition{
-			ActionRead: actDef("read provisioner jobs"),
+			ActionRead:   actDef("read provisioner jobs"),
+			ActionUpdate: actDef("update provisioner jobs"),
+			ActionCreate: actDef("create provisioner jobs"),
 		},
 	},
 	"organization": {

coderd/rbac/roles.go

@@ -503,7 +503,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 						// the ability to create templates and provisioners has
 						// a lot of overlap.
 						ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
-						ResourceProvisionerJobs.Type:   {policy.ActionRead},
+						ResourceProvisionerJobs.Type:   {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
 					}),
 				},
 				User: []Permission{},

coderd/rbac/roles_test.go

@@ -580,7 +580,7 @@ func TestRolePermissions(t *testing.T) {
 		},
 		{
 			Name:     "ProvisionerJobs",
-			Actions:  []policy.Action{policy.ActionRead},
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
 			Resource: rbac.ResourceProvisionerJobs.InOrg(orgID),
 			AuthorizeMap: map[bool][]hasAuthSubjects{
 				true:  {owner, orgTemplateAdmin, orgAdmin},