feat: allow auditors to read template insights (#10860)

- Adds a template_insights pseudo-resource
- Grants auditor and template admin roles read access on template_insights
- Updates existing RBAC checks to check for read template_insights, falling back to template update permissions where necessary
- Updates TemplateLayout to show Insights tab if can read template_insights or can update template

site/src/api/typesGenerated.ts

@@ -1882,6 +1882,7 @@ export type RBACResource =
   | "replicas"
   | "system"
   | "template"
+  | "template_insights"
   | "user"
   | "user_data"
   | "workspace"
@@ -1905,6 +1906,7 @@ export const RBACResources: RBACResource[] = [
   "replicas",
   "system",
   "template",
+  "template_insights",
   "user",
   "user_data",
   "workspace",

site/src/pages/TemplatePage/TemplateLayout.tsx

@@ -24,6 +24,12 @@ const templatePermissions = (
     },
     action: "update",
   },
+  canReadInsights: {
+    object: {
+      resource_type: "template_insights",
+    },
+    action: "read",
+  },
 });
 
 const fetchTemplate = async (orgId: string, templateName: string) => {
@@ -68,7 +74,10 @@ export const TemplateLayout: FC<{ children?: JSX.Element }> = ({
     queryKey: ["template", templateName],
     queryFn: () => fetchTemplate(orgId, templateName),
   });
-  const shouldShowInsights = data?.permissions?.canUpdateTemplate;
+  // Auditors should also be able to view insights, but do not automatically
+  // have permission to update templates. Need both checks.
+  const shouldShowInsights =
+    data?.permissions?.canUpdateTemplate || data?.permissions?.canReadInsights;
 
   if (error) {
     return (