feat: add "updated" search param to workspaces (#11714)

* feat: add "updated" search param to workspaces
* rego -> sql needs to specify which <table>.organization_id

coderd/rbac/authz.go

@@ -611,6 +611,12 @@ func ConfigWithoutACL() regosql.ConvertConfig {
 	}
 }
 
+func ConfigWorkspaces() regosql.ConvertConfig {
+	return regosql.ConvertConfig{
+		VariableConverter: regosql.WorkspaceConverter(),
+	}
+}
+
 func Compile(cfg regosql.ConvertConfig, pa *PartialAuthorizer) (AuthorizeFilter, error) {
 	root, err := regosql.ConvertRegoAst(cfg, pa.partialQueries)
 	if err != nil {

coderd/rbac/regosql/configs.go

@@ -53,6 +53,20 @@ func UserConverter() *sqltypes.VariableConverter {
 	return matcher
 }
 
+func WorkspaceConverter() *sqltypes.VariableConverter {
+	matcher := sqltypes.NewVariableConverter().RegisterMatcher(
+		resourceIDMatcher(),
+		sqltypes.StringVarMatcher("workspaces.organization_id :: text", []string{"input", "object", "org_owner"}),
+		userOwnerMatcher(),
+	)
+	matcher.RegisterMatcher(
+		sqltypes.AlwaysFalse(groupACLMatcher(matcher)),
+		sqltypes.AlwaysFalse(userACLMatcher(matcher)),
+	)
+
+	return matcher
+}
+
 // NoACLConverter should be used when the target SQL table does not contain
 // group or user ACL columns.
 func NoACLConverter() *sqltypes.VariableConverter {