feat: allow auditors to read template insights (#10860)

- Adds a template_insights pseudo-resource
- Grants auditor and template admin roles read access on template_insights
- Updates existing RBAC checks to check for read template_insights, falling back to template update permissions where necessary
- Updates TemplateLayout to show Insights tab if can read template_insights or can update template

coderd/rbac/object.go

@@ -193,6 +193,11 @@ var (
 	ResourceTailnetCoordinator = Object{
 		Type: "tailnet_coordinator",
 	}
+
+	// ResourceTemplateInsights is a pseudo-resource for reading template insights data.
+	ResourceTemplateInsights = Object{
+		Type: "template_insights",
+	}
 )
 
 // ResourceUserObject is a helper function to create a user object for authz checks.

coderd/rbac/object_gen.go

@@ -20,6 +20,7 @@ func AllResources() []Object {
 		ResourceSystem,
 		ResourceTailnetCoordinator,
 		ResourceTemplate,
+		ResourceTemplateInsights,
 		ResourceUser,
 		ResourceUserData,
 		ResourceWildcard,

coderd/rbac/roles.go

@@ -165,10 +165,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		Site: Permissions(map[string][]Action{
 			// Should be able to read all template details, even in orgs they
 			// are not in.
-			ResourceTemplate.Type: {ActionRead},
-			ResourceAuditLog.Type: {ActionRead},
-			ResourceUser.Type:     {ActionRead},
-			ResourceGroup.Type:    {ActionRead},
+			ResourceTemplate.Type:         {ActionRead},
+			ResourceTemplateInsights.Type: {ActionRead},
+			ResourceAuditLog.Type:         {ActionRead},
+			ResourceUser.Type:             {ActionRead},
+			ResourceGroup.Type:            {ActionRead},
 			// Allow auditors to query deployment stats and insights.
 			ResourceDeploymentStats.Type:  {ActionRead},
 			ResourceDeploymentValues.Type: {ActionRead},
@@ -195,6 +196,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceGroup.Type:        {ActionRead},
 			// Org roles are not really used yet, so grant the perm at the site level.
 			ResourceOrganizationMember.Type: {ActionRead},
+			// Template admins can read all template insights data
+			ResourceTemplateInsights.Type: {ActionRead},
 		}),
 		Org:  map[string][]Permission{},
 		User: []Permission{},