feat: add service_accounts workspace sharing mode (#23093)

Introduce a three-way workspace sharing setting (none, everyone,
service_accounts) replacing the boolean workspace_sharing_disabled.
In service_accounts mode, only service account-owned workspaces can be
shared while regular members' share permissions are removed. Adds a
new organization-service-account system role with per-org permissions
reconciled alongside the existing organization-member system role.

Related to:
https://linear.app/codercom/issue/PLAT-28/feat-service-accounts-sharing-mode-and-rbac-role

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
Co-authored-by: Kayla はな <mckayla@hey.com>

enterprise/coderd/workspacesharing.go

@@ -1,7 +1,9 @@
 package coderd
 
 import (
+	"fmt"
 	"net/http"
+	"strings"
 
 	"golang.org/x/xerrors"
 
@@ -14,6 +16,7 @@ import (
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/coderd/rbac/rolestore"
+	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 )
 
@@ -34,10 +37,16 @@ func (api *API) workspaceSharingSettings(rw http.ResponseWriter, r *http.Request
 		return
 	}
 
+	disabled := org.ShareableWorkspaceOwners == database.ShareableWorkspaceOwnersNone
 	globallyDisabled := bool(api.DeploymentValues.DisableWorkspaceSharing)
+	owners := codersdk.ShareableWorkspaceOwners(org.ShareableWorkspaceOwners)
+	if globallyDisabled {
+		owners = codersdk.ShareableWorkspaceOwnersNone
+	}
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceSharingSettings{
-		SharingGloballyDisabled: globallyDisabled,
-		SharingDisabled:         org.WorkspaceSharingDisabled || globallyDisabled,
+		SharingGloballyDisabled:  globallyDisabled,
+		SharingDisabled:          disabled || globallyDisabled,
+		ShareableWorkspaceOwners: owners,
 	})
 }
 
@@ -48,8 +57,8 @@ func (api *API) workspaceSharingSettings(rw http.ResponseWriter, r *http.Request
 // @Accept json
 // @Tags Enterprise
 // @Param organization path string true "Organization ID" format(uuid)
-// @Param request body codersdk.WorkspaceSharingSettings true "Workspace sharing settings"
-// @Success 200 {object} codersdk.UpdateWorkspaceSharingSettingsRequest
+// @Param request body codersdk.UpdateWorkspaceSharingSettingsRequest true "Workspace sharing settings"
+// @Success 200 {object} codersdk.WorkspaceSharingSettings
 // @Router /organizations/{organization}/settings/workspace-sharing [patch]
 func (api *API) patchWorkspaceSharingSettings(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
@@ -70,19 +79,44 @@ func (api *API) patchWorkspaceSharingSettings(rw http.ResponseWriter, r *http.Re
 		return
 	}
 
-	var req codersdk.WorkspaceSharingSettings
+	var req codersdk.UpdateWorkspaceSharingSettingsRequest
 	if !httpapi.Read(ctx, rw, r, &req) {
 		return
 	}
 
+	// Resolve the effective enum value. Prefer the new field; fall
+	// back to the deprecated boolean for older clients (e.g
+	// tf-provider-coderd v0.0.16)
+	allowedOwners := req.ShareableWorkspaceOwners
+	if allowedOwners == "" {
+		if req.SharingDisabled {
+			allowedOwners = codersdk.ShareableWorkspaceOwnersNone
+		} else {
+			allowedOwners = codersdk.ShareableWorkspaceOwnersEveryone
+		}
+	}
+
+	if !database.ShareableWorkspaceOwners(allowedOwners).Valid() {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Invalid shareable workspace owners value.",
+			Validations: []codersdk.ValidationError{{
+				Field: "shareable_workspace_owners",
+				Detail: fmt.Sprintf("invalid value %q, must be one of [%s]",
+					allowedOwners,
+					strings.Join(slice.ToStrings(database.AllShareableWorkspaceOwnersValues()), ", ")),
+			}},
+		})
+		return
+	}
+
 	err := api.Database.InTx(func(tx database.Store) error {
 		//nolint:gocritic // System context required to look up and reconcile the
-		// organization-member system role; callers only need `organization:update`
+		// system roles; callers only need `organization:update`
 		sysCtx := dbauthz.AsSystemRestricted(ctx)
 
 		// Serialize organization workspace-sharing updates with system role
 		// reconciliation across coderd instances (e.g. during rolling restarts).
-		// This prevents conflicting writes to the organization-member system role.
+		// This prevents conflicting writes to the system roles.
 		// TODO(geokat): Consider finer-grained locks as we add more system roles.
 		err := tx.AcquireLock(ctx, database.LockIDReconcileSystemRoles)
 		if err != nil {
@@ -91,38 +125,54 @@ func (api *API) patchWorkspaceSharingSettings(rw http.ResponseWriter, r *http.Re
 
 		org, err = tx.UpdateOrganizationWorkspaceSharingSettings(ctx, database.UpdateOrganizationWorkspaceSharingSettingsParams{
 			ID:                       org.ID,
-			WorkspaceSharingDisabled: req.SharingDisabled,
+			ShareableWorkspaceOwners: database.ShareableWorkspaceOwners(allowedOwners),
 			UpdatedAt:                dbtime.Now(),
 		})
 		if err != nil {
-			return xerrors.Errorf("update organization workspace sharing settings: %w", err)
+			return xerrors.Errorf("update workspace sharing settings for organization %s: %w",
+				org.ID, err)
 		}
 
-		role, err := database.ExpectOne(tx.CustomRoles(sysCtx, database.CustomRolesParams{
+		roles, err := tx.CustomRoles(sysCtx, database.CustomRolesParams{
 			LookupRoles: []database.NameOrganizationPair{
 				{
 					Name:           rbac.RoleOrgMember(),
 					OrganizationID: org.ID,
 				},
+				{
+					Name:           rbac.RoleOrgServiceAccount(),
+					OrganizationID: org.ID,
+				},
 			},
 			// Satisfy linter that requires all fields to be set.
 			OrganizationID:     org.ID,
 			ExcludeOrgRoles:    false,
 			IncludeSystemRoles: true,
-		}))
-		if err != nil {
-			return xerrors.Errorf("get organization-member role: %w", err)
+		})
+		if err != nil || len(roles) != 2 {
+			return xerrors.Errorf("get member and service-account roles for organization %s: %w",
+				org.ID, err)
 		}
 
-		_, _, err = rolestore.ReconcileOrgMemberRole(sysCtx, tx, role, req.SharingDisabled)
-		if err != nil {
-			return xerrors.Errorf("reconcile organization-member role: %w", err)
-		}
-
-		if req.SharingDisabled {
-			err = tx.DeleteWorkspaceACLsByOrganization(sysCtx, org.ID)
+		for _, role := range roles {
+			_, _, err = rolestore.ReconcileSystemRole(sysCtx, tx, role, org)
 			if err != nil {
-				return xerrors.Errorf("delete workspace ACLs by organization: %w", err)
+				return xerrors.Errorf("reconcile %s role for organization %s: %w",
+					role.Name, org.ID, err)
+			}
+		}
+
+		// If sharing is not enabled, delete workspace ACLs to prevent
+		// ongoing shared use. In "service_accounts" mode, preserve
+		// ACLs on SA workspaces.
+		if org.ShareableWorkspaceOwners != database.ShareableWorkspaceOwnersEveryone {
+			err = tx.DeleteWorkspaceACLsByOrganization(sysCtx, database.DeleteWorkspaceACLsByOrganizationParams{
+				OrganizationID:         org.ID,
+				ExcludeServiceAccounts: org.ShareableWorkspaceOwners == database.ShareableWorkspaceOwnersServiceAccounts,
+			})
+			if err != nil {
+				return xerrors.Errorf("delete workspace ACLs for organization %s: %w",
+					org.ID, err)
 			}
 		}
 
@@ -138,6 +188,7 @@ func (api *API) patchWorkspaceSharingSettings(rw http.ResponseWriter, r *http.Re
 
 	aReq.New = org
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceSharingSettings{
-		SharingDisabled: org.WorkspaceSharingDisabled,
+		SharingDisabled:          org.ShareableWorkspaceOwners == database.ShareableWorkspaceOwnersNone,
+		ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwners(org.ShareableWorkspaceOwners),
 	})
 }