feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

Migrated the built-in organization-member role to DB storage so it can be customized per org.

Closes https://github.com/coder/internal/issues/1073 (part 1)
This commit is contained in:
George K
2026-01-12 18:19:19 -08:00
committed by GitHub
parent 2b448c7178
commit cc2efe9e1f
46 changed files with 1845 additions and 438 deletions
+3 -3
View File
@@ -221,7 +221,7 @@ func TestSharingStatus(t *testing.T) {
group, err := createGroupWithMembers(ctx, client, orgOwner.OrganizationID, "new-group", []uuid.UUID{orgMember.ID})
require.NoError(t, err)
err = client.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
err = workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
GroupRoles: map[string]codersdk.WorkspaceRole{
group.ID.String(): codersdk.WorkspaceRoleUse,
},
@@ -284,7 +284,7 @@ func TestSharingRemove(t *testing.T) {
require.NoError(t, err)
// Share the workspace with a user to later remove
err = client.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
err = workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
GroupRoles: map[string]codersdk.WorkspaceRole{
group1.ID.String(): codersdk.WorkspaceRoleUse,
group2.ID.String(): codersdk.WorkspaceRoleUse,
@@ -357,7 +357,7 @@ func TestSharingRemove(t *testing.T) {
require.NoError(t, err)
// Share the workspace with a user to later remove
err = client.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
err = workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
GroupRoles: map[string]codersdk.WorkspaceRole{
group1.ID.String(): codersdk.WorkspaceRoleUse,
group2.ID.String(): codersdk.WorkspaceRoleUse,