chore: add provisioner key crud apis (#13857)

coderd/rbac/object_gen.go

@@ -161,6 +161,15 @@ var (
 		Type: "provisioner_daemon",
 	}
 
+	// ResourceProvisionerKeys
+	// Valid Actions
+	//  - "ActionCreate" :: create a provisioner key
+	//  - "ActionDelete" :: delete a provisioner key
+	//  - "ActionRead" :: read provisioner keys
+	ResourceProvisionerKeys = Object{
+		Type: "provisioner_keys",
+	}
+
 	// ResourceReplicas
 	// Valid Actions
 	//  - "ActionRead" :: read replicas
@@ -269,6 +278,7 @@ func AllResources() []Objecter {
 		ResourceOrganization,
 		ResourceOrganizationMember,
 		ResourceProvisionerDaemon,
+		ResourceProvisionerKeys,
 		ResourceReplicas,
 		ResourceSystem,
 		ResourceTailnetCoordinator,

coderd/rbac/policy/policy.go

@@ -160,6 +160,13 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionDelete: actDef("delete a provisioner daemon"),
 		},
 	},
+	"provisioner_keys": {
+		Actions: map[Action]ActionDefinition{
+			ActionCreate: actDef("create a provisioner key"),
+			ActionRead:   actDef("read provisioner keys"),
+			ActionDelete: actDef("delete a provisioner key"),
+		},
+	},
 	"organization": {
 		Actions: map[Action]ActionDefinition{
 			ActionCreate: actDef("create an organization"),

coderd/rbac/roles_test.go

@@ -488,6 +488,15 @@ func TestRolePermissions(t *testing.T) {
 				false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
 			},
 		},
+		{
+			Name:     "ProvisionerKeys",
+			Actions:  []policy.Action{policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
+			Resource: rbac.ResourceProvisionerKeys.InOrg(orgID),
+			AuthorizeMap: map[bool][]authSubject{
+				true:  {owner, orgAdmin},
+				false: {otherOrgAdmin, otherOrgMember, memberMe, orgMemberMe, userAdmin, templateAdmin},
+			},
+		},
 		{
 			Name:     "System",
 			Actions:  crud,