From b763b72b53e3af6df36f0ea2316668c04f92b489 Mon Sep 17 00:00:00 2001
From: Kerem Kacel <keremkacel@gmail.com>
Date: Sun, 22 Mar 2026 10:06:03 -0400
Subject: [PATCH] feat: add user:read scope (#23348)

Enables [23270](https://github.com/coder/coder/discussions/23270).

Makes it possible for admin users to create API tokens scoped for
reading users' data.
---
 coderd/rbac/scopes_catalog.go               | 3 ++-
 coderd/rbac/scopes_catalog_internal_test.go | 1 +
 codersdk/apikey_scopes_gen.go               | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/coderd/rbac/scopes_catalog.go b/coderd/rbac/scopes_catalog.go
index 7f6b538bd5..116f432655 100644
--- a/coderd/rbac/scopes_catalog.go
+++ b/coderd/rbac/scopes_catalog.go
@@ -40,7 +40,8 @@ var externalLowLevel = map[ScopeName]struct{}{
 	"file:create": {},
 	"file:*":      {},
 
-	// Users (personal profile only)
+	// Users
+	"user:read":            {},
 	"user:read_personal":   {},
 	"user:update_personal": {},
 	"user.*":               {},
diff --git a/coderd/rbac/scopes_catalog_internal_test.go b/coderd/rbac/scopes_catalog_internal_test.go
index 37de001fae..31ae90a985 100644
--- a/coderd/rbac/scopes_catalog_internal_test.go
+++ b/coderd/rbac/scopes_catalog_internal_test.go
@@ -62,6 +62,7 @@ func TestIsExternalScope(t *testing.T) {
 	require.True(t, IsExternalScope("template:use"))
 	require.True(t, IsExternalScope("workspace:*"))
 	require.True(t, IsExternalScope("coder:workspaces.create"))
+	require.True(t, IsExternalScope("user:read"))
 	require.False(t, IsExternalScope("debug_info:read")) // internal-only
 	require.False(t, IsExternalScope("unknown:read"))
 }
diff --git a/codersdk/apikey_scopes_gen.go b/codersdk/apikey_scopes_gen.go
index 2e04689564..53dab5bd28 100644
--- a/codersdk/apikey_scopes_gen.go
+++ b/codersdk/apikey_scopes_gen.go
@@ -247,6 +247,7 @@ var PublicAPIKeyScopes = []APIKeyScope{
 	APIKeyScopeTemplateRead,
 	APIKeyScopeTemplateUpdate,
 	APIKeyScopeTemplateUse,
+	APIKeyScopeUserRead,
 	APIKeyScopeUserReadPersonal,
 	APIKeyScopeUserUpdatePersonal,
 	APIKeyScopeUserSecretAll,