fix(coderd/rbac): reinstate deployment-wide workspace.share permission for owner role (#21620)

The removal of that permission from the role broke valid use cases (e.g.
a site owner user creating a workspace owned by a system account and
then trying to share it with another user).

The bulk of the PR is made up of the rollbacks of the previously
introduced test updates necessitated by the removal.

Related to: https://github.com/coder/internal/issues/1285
This commit is contained in:
George K
2026-01-22 08:12:15 -08:00
committed by GitHub
parent 859099f1f2
commit d29a168785
8 changed files with 46 additions and 53 deletions
+2 -10
View File
@@ -42,16 +42,8 @@ import (
// genCtx is to give all generator functions permission if the db is a dbauthz db.
var genCtx = dbauthz.As(context.Background(), rbac.Subject{
ID: "owner",
Roles: rbac.Roles(append(
must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand()),
rbac.Role{
Identifier: rbac.RoleIdentifier{Name: "dbgen-workspace-sharer"},
Site: rbac.Permissions(map[string][]policy.Action{
rbac.ResourceWorkspace.Type: {policy.ActionShare},
}),
},
)),
ID: "owner",
Roles: rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
Groups: []string{},
Scope: rbac.ExpandableScope(rbac.ScopeAll),
})