feat: add endpoint for retrieving workspace acl (#19375)

Implements `/acl [get]` for workspaces, with tests.
Blocked by experiment enablement

codersdk/templates.go

@@ -193,10 +193,13 @@ type TemplateUser struct {
 }
 
 type UpdateTemplateACL struct {
-	// UserPerms should be a mapping of user id to role. The user id must be the
-	// uuid of the user, not a username or email address.
+	// UserPerms is a mapping from valid user UUIDs to the template role they
+	// should be granted. To remove a user from the template, use "" as the role
+	// (available as a constant named codersdk.TemplateRoleDeleted)
 	UserPerms map[string]TemplateRole `json:"user_perms,omitempty" example:"<user_id>:admin,4df59e74-c027-470b-ab4d-cbba8963a5e9:use"`
-	// GroupPerms should be a mapping of group id to role.
+	// GroupPerms is a mapping from valid group UUIDs to the template role they
+	// should be granted. To remove a group from the template, use "" as the role
+	// (available as a constant named codersdk.TemplateRoleDeleted)
 	GroupPerms map[string]TemplateRole `json:"group_perms,omitempty" example:"<group_id>:admin,8bd26b20-f3e8-48be-a903-46bb920cf671:use"`
 }
 

codersdk/workspaces.go

@@ -663,11 +663,19 @@ func (c *Client) WorkspaceTimings(ctx context.Context, id uuid.UUID) (WorkspaceB
 	return timings, json.NewDecoder(res.Body).Decode(&timings)
 }
 
-type UpdateWorkspaceACL struct {
-	// Keys must be valid UUIDs. To remove a user/group from the ACL use "" as the
-	// role name (available as a constant named `codersdk.WorkspaceRoleDeleted`)
-	UserRoles  map[string]WorkspaceRole `json:"user_roles,omitempty"`
-	GroupRoles map[string]WorkspaceRole `json:"group_roles,omitempty"`
+type WorkspaceACL struct {
+	Users  []WorkspaceUser  `json:"users"`
+	Groups []WorkspaceGroup `json:"group"`
+}
+
+type WorkspaceGroup struct {
+	Group
+	Role WorkspaceRole `json:"role" enums:"admin,use"`
+}
+
+type WorkspaceUser struct {
+	MinimalUser
+	Role WorkspaceRole `json:"role" enums:"admin,use"`
 }
 
 type WorkspaceRole string
@@ -678,6 +686,30 @@ const (
 	WorkspaceRoleDeleted WorkspaceRole = ""
 )
 
+func (c *Client) WorkspaceACL(ctx context.Context, workspaceID uuid.UUID) (WorkspaceACL, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/workspaces/%s/acl", workspaceID), nil)
+	if err != nil {
+		return WorkspaceACL{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return WorkspaceACL{}, ReadBodyAsError(res)
+	}
+	var acl WorkspaceACL
+	return acl, json.NewDecoder(res.Body).Decode(&acl)
+}
+
+type UpdateWorkspaceACL struct {
+	// UserRoles is a mapping from valid user UUIDs to the workspace role they
+	// should be granted. To remove a user from the workspace, use "" as the role
+	// (available as a constant named codersdk.WorkspaceRoleDeleted)
+	UserRoles map[string]WorkspaceRole `json:"user_roles,omitempty"`
+	// GroupRoles is a mapping from valid group UUIDs to the workspace role they
+	// should be granted. To remove a group from the workspace, use "" as the role
+	// (available as a constant named codersdk.WorkspaceRoleDeleted)
+	GroupRoles map[string]WorkspaceRole `json:"group_roles,omitempty"`
+}
+
 func (c *Client) UpdateWorkspaceACL(ctx context.Context, workspaceID uuid.UUID, req UpdateWorkspaceACL) error {
 	res, err := c.Request(ctx, http.MethodPatch, fmt.Sprintf("/api/v2/workspaces/%s/acl", workspaceID), req)
 	if err != nil {