opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add service_accounts workspace sharing mode (#23093)

Browse Source 
Introduce a three-way workspace sharing setting (none, everyone,
service_accounts) replacing the boolean workspace_sharing_disabled.
In service_accounts mode, only service account-owned workspaces can be
shared while regular members' share permissions are removed. Adds a
new organization-service-account system role with per-org permissions
reconciled alongside the existing organization-member system role.

Related to:
https://linear.app/codercom/issue/PLAT-28/feat-service-accounts-sharing-mode-and-rbac-role

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
Co-authored-by: Kayla はな <mckayla@hey.com>
This commit is contained in:
George K
2026-03-17 12:16:43 -07:00
committed by GitHub
co-authored by Steven Masley Kayla はな
parent 6b76e30321
commit 91ec0f1484
38 changed files with 1437 additions and 421 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/enterprise.md
Generated
+13 -10
View File
@@ -2851,6 +2851,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/setting
```json
{
"shareable_workspace_owners": "none",
"sharing_disabled": true,
"sharing_globally_disabled": true
}
@@ -2882,17 +2883,17 @@ curl -X PATCH http://coder-server:8080/api/v2/organizations/{organization}/setti
```json
{
"sharing_disabled": true,
"sharing_globally_disabled": true
"shareable_workspace_owners": "none",
"sharing_disabled": true
}
```
### Parameters
| Name | In | Type | Required | Description |
|----------------|------|----------------------------------------------------------------------------------|----------|----------------------------|
| `organization` | path | string(uuid) | true | Organization ID |
| `body` | body | [codersdk.WorkspaceSharingSettings](schemas.md#codersdkworkspacesharingsettings) | true | Workspace sharing settings |
| Name | In | Type | Required | Description |
|----------------|------|------------------------------------------------------------------------------------------------------------|----------|----------------------------|
| `organization` | path | string(uuid) | true | Organization ID |
| `body` | body | [codersdk.UpdateWorkspaceSharingSettingsRequest](schemas.md#codersdkupdateworkspacesharingsettingsrequest) | true | Workspace sharing settings |
### Example responses
@@ -2900,15 +2901,17 @@ curl -X PATCH http://coder-server:8080/api/v2/organizations/{organization}/setti
```json
{
"sharing_disabled": true
"shareable_workspace_owners": "none",
"sharing_disabled": true,
"sharing_globally_disabled": true
}
```
### Responses
| Status | Meaning | Description | Schema |
|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------------------------------|
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.UpdateWorkspaceSharingSettingsRequest](schemas.md#codersdkupdateworkspacesharingsettingsrequest) |
| Status | Meaning | Description | Schema |
|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------------------------|
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.WorkspaceSharingSettings](schemas.md#codersdkworkspacesharingsettings) |
To perform this operation, you must be authenticated. [Learn more](authentication.md).
docs/reference/api/schemas.md
Generated
+37 -7
View File
@@ -8011,6 +8011,20 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
| `max_token_lifetime` | integer | false | | |
| `refresh_default_duration` | integer | false | | Refresh default duration is the default lifetime for OAuth2 refresh tokens. This should generally be longer than access token lifetimes to allow refreshing after access token expiry. |
## codersdk.ShareableWorkspaceOwners
```json
"none"
```
### Properties
#### Enumerated Values
| Value(s) |
|----------------------------------------|
| `everyone`, `none`, `service_accounts` |
## codersdk.SharedWorkspaceActor
```json
@@ -9829,15 +9843,23 @@ If the schedule is empty, the user will be updated to use the default schedule.|
```json
{
"shareable_workspace_owners": "none",
"sharing_disabled": true
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|--------------------|---------|----------|--------------|-------------|
| `sharing_disabled` | boolean | false | | |
| Name | Type | Required | Restrictions | Description |
|------------------------------|------------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------------------------------------------------|
| `shareable_workspace_owners` | [codersdk.ShareableWorkspaceOwners](#codersdkshareableworkspaceowners) | false | | Shareable workspace owners controls whose workspaces can be shared within the organization. |
| `sharing_disabled` | boolean | false | | Sharing disabled is deprecated and left for backward compatibility purposes. Deprecated: use `ShareableWorkspaceOwners` instead |
#### Enumerated Values
| Property | Value(s) |
|------------------------------|----------------------------------------|
| `shareable_workspace_owners` | `everyone`, `none`, `service_accounts` |
## codersdk.UpdateWorkspaceTTLRequest
@@ -12308,6 +12330,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
```json
{
"shareable_workspace_owners": "none",
"sharing_disabled": true,
"sharing_globally_disabled": true
}
@@ -12315,10 +12338,17 @@ If the schedule is empty, the user will be updated to use the default schedule.|
### Properties
| Name | Type | Required | Restrictions | Description |
|-----------------------------|---------|----------|--------------|----------------------------------------------------------------------------------------------------------------------------|
| `sharing_disabled` | boolean | false | | |
| `sharing_globally_disabled` | boolean | false | | Sharing globally disabled is true if sharing has been disabled for this organization because of a deployment-wide setting. |
| Name | Type | Required | Restrictions | Description |
|------------------------------|------------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------------------------------------------------|
| `shareable_workspace_owners` | [codersdk.ShareableWorkspaceOwners](#codersdkshareableworkspaceowners) | false | | Shareable workspace owners controls whose workspaces can be shared within the organization. |
| `sharing_disabled` | boolean | false | | Sharing disabled is deprecated and left for backward compatibility purposes. Deprecated: use `ShareableWorkspaceOwners` instead |
| `sharing_globally_disabled` | boolean | false | | Sharing globally disabled is true if sharing has been disabled for this organization because of a deployment-wide setting. |
#### Enumerated Values
| Property | Value(s) |
|------------------------------|----------------------------------------|
| `shareable_workspace_owners` | `everyone`, `none`, `service_accounts` |
## codersdk.WorkspaceStatus