feat: add new workspace:share action type (#20198)

Closes
[coder/internal#1012](https://github.com/coder/internal/issues/1012)

coderd/rbac/object_gen.go

@@ -356,6 +356,7 @@ var (
 	//  - "ActionDelete" :: delete workspace
 	//  - "ActionDeleteAgent" :: delete an existing workspace agent
 	//  - "ActionRead" :: read workspace data to view on the UI
+	//  - "ActionShare" :: share a workspace with other users or groups
 	//  - "ActionSSH" :: ssh into a given workspace
 	//  - "ActionWorkspaceStart" :: allows starting a workspace
 	//  - "ActionWorkspaceStop" :: allows stopping a workspace
@@ -388,6 +389,7 @@ var (
 	//  - "ActionDelete" :: delete workspace
 	//  - "ActionDeleteAgent" :: delete an existing workspace agent
 	//  - "ActionRead" :: read workspace data to view on the UI
+	//  - "ActionShare" :: share a workspace with other users or groups
 	//  - "ActionSSH" :: ssh into a given workspace
 	//  - "ActionWorkspaceStart" :: allows starting a workspace
 	//  - "ActionWorkspaceStop" :: allows stopping a workspace
@@ -465,6 +467,7 @@ func AllActions() []policy.Action {
 		policy.ActionRead,
 		policy.ActionReadPersonal,
 		policy.ActionSSH,
+		policy.ActionShare,
 		policy.ActionUnassign,
 		policy.ActionUpdate,
 		policy.ActionUpdatePersonal,

coderd/rbac/policy/policy.go

@@ -27,6 +27,8 @@ const (
 
 	ActionCreateAgent Action = "create_agent"
 	ActionDeleteAgent Action = "delete_agent"
+
+	ActionShare Action = "share"
 )
 
 type PermissionDefinition struct {
@@ -61,6 +63,9 @@ var workspaceActions = map[Action]ActionDefinition{
 
 	ActionCreateAgent: "create a new workspace agent",
 	ActionDeleteAgent: "delete an existing workspace agent",
+
+	// Sharing a workspace
+	ActionShare: "share a workspace with other users or groups",
 }
 
 var taskActions = map[Action]ActionDefinition{

coderd/rbac/roles_test.go

@@ -235,6 +235,39 @@ func TestRolePermissions(t *testing.T) {
 				false: {setOtherOrg, memberMe, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, orgAuditor, orgMemberMeBanWorkspace},
 			},
 		},
+		{
+			Name:    "ShareMyWorkspace",
+			Actions: []policy.Action{policy.ActionShare},
+			Resource: rbac.ResourceWorkspace.
+				WithID(workspaceID).
+				InOrg(orgID).
+				WithOwner(currentUser.String()),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner, orgMemberMe, orgAdmin, orgMemberMeBanWorkspace},
+				false: {
+					memberMe, setOtherOrg,
+					templateAdmin, userAdmin,
+					orgTemplateAdmin, orgUserAdmin, orgAuditor,
+				},
+			},
+		},
+		{
+			Name:    "ShareWorkspaceDormant",
+			Actions: []policy.Action{policy.ActionShare},
+			Resource: rbac.ResourceWorkspaceDormant.
+				WithID(uuid.New()).
+				InOrg(orgID).
+				WithOwner(memberMe.Actor.ID),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {},
+				false: {
+					orgMemberMe, orgAdmin, owner, setOtherOrg,
+					userAdmin, memberMe,
+					templateAdmin, orgTemplateAdmin, orgUserAdmin, orgAuditor,
+					orgMemberMeBanWorkspace,
+				},
+			},
+		},
 		{
 			Name:     "Templates",
 			Actions:  []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

coderd/rbac/scopes_constants_gen.go

@@ -127,6 +127,7 @@ const (
 	ScopeWorkspaceDelete                     ScopeName = "workspace:delete"
 	ScopeWorkspaceDeleteAgent                ScopeName = "workspace:delete_agent"
 	ScopeWorkspaceRead                       ScopeName = "workspace:read"
+	ScopeWorkspaceShare                      ScopeName = "workspace:share"
 	ScopeWorkspaceSsh                        ScopeName = "workspace:ssh"
 	ScopeWorkspaceStart                      ScopeName = "workspace:start"
 	ScopeWorkspaceStop                       ScopeName = "workspace:stop"
@@ -141,6 +142,7 @@ const (
 	ScopeWorkspaceDormantDelete              ScopeName = "workspace_dormant:delete"
 	ScopeWorkspaceDormantDeleteAgent         ScopeName = "workspace_dormant:delete_agent"
 	ScopeWorkspaceDormantRead                ScopeName = "workspace_dormant:read"
+	ScopeWorkspaceDormantShare               ScopeName = "workspace_dormant:share"
 	ScopeWorkspaceDormantSsh                 ScopeName = "workspace_dormant:ssh"
 	ScopeWorkspaceDormantStart               ScopeName = "workspace_dormant:start"
 	ScopeWorkspaceDormantStop                ScopeName = "workspace_dormant:stop"
@@ -280,6 +282,7 @@ func (e ScopeName) Valid() bool {
 		ScopeWorkspaceDelete,
 		ScopeWorkspaceDeleteAgent,
 		ScopeWorkspaceRead,
+		ScopeWorkspaceShare,
 		ScopeWorkspaceSsh,
 		ScopeWorkspaceStart,
 		ScopeWorkspaceStop,
@@ -294,6 +297,7 @@ func (e ScopeName) Valid() bool {
 		ScopeWorkspaceDormantDelete,
 		ScopeWorkspaceDormantDeleteAgent,
 		ScopeWorkspaceDormantRead,
+		ScopeWorkspaceDormantShare,
 		ScopeWorkspaceDormantSsh,
 		ScopeWorkspaceDormantStart,
 		ScopeWorkspaceDormantStop,
@@ -434,6 +438,7 @@ func AllScopeNameValues() []ScopeName {
 		ScopeWorkspaceDelete,
 		ScopeWorkspaceDeleteAgent,
 		ScopeWorkspaceRead,
+		ScopeWorkspaceShare,
 		ScopeWorkspaceSsh,
 		ScopeWorkspaceStart,
 		ScopeWorkspaceStop,
@@ -448,6 +453,7 @@ func AllScopeNameValues() []ScopeName {
 		ScopeWorkspaceDormantDelete,
 		ScopeWorkspaceDormantDeleteAgent,
 		ScopeWorkspaceDormantRead,
+		ScopeWorkspaceDormantShare,
 		ScopeWorkspaceDormantSsh,
 		ScopeWorkspaceDormantStart,
 		ScopeWorkspaceDormantStop,