feat: add notification preferences database & audit support (#14100)

coderd/rbac/object_gen.go

@@ -102,6 +102,22 @@ var (
 		Type: "license",
 	}
 
+	// ResourceNotificationPreference
+	// Valid Actions
+	//  - "ActionRead" :: read notification preferences
+	//  - "ActionUpdate" :: update notification preferences
+	ResourceNotificationPreference = Object{
+		Type: "notification_preference",
+	}
+
+	// ResourceNotificationTemplate
+	// Valid Actions
+	//  - "ActionRead" :: read notification templates
+	//  - "ActionUpdate" :: update notification templates
+	ResourceNotificationTemplate = Object{
+		Type: "notification_template",
+	}
+
 	// ResourceOauth2App
 	// Valid Actions
 	//  - "ActionCreate" :: make an OAuth2 app.
@@ -272,6 +288,8 @@ func AllResources() []Objecter {
 		ResourceFile,
 		ResourceGroup,
 		ResourceLicense,
+		ResourceNotificationPreference,
+		ResourceNotificationTemplate,
 		ResourceOauth2App,
 		ResourceOauth2AppCodeToken,
 		ResourceOauth2AppSecret,

coderd/rbac/policy/policy.go

@@ -255,4 +255,16 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionDelete: actDef(""),
 		},
 	},
+	"notification_template": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead:   actDef("read notification templates"),
+			ActionUpdate: actDef("update notification templates"),
+		},
+	},
+	"notification_preference": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead:   actDef("read notification preferences"),
+			ActionUpdate: actDef("update notification preferences"),
+		},
+	},
 }

coderd/rbac/roles_test.go

@@ -590,6 +590,54 @@ func TestRolePermissions(t *testing.T) {
 				false: {},
 			},
 		},
+		{
+			// Any owner/admin across may access any users' preferences
+			// Members may not access other members' preferences
+			Name:     "NotificationPreferencesOwn",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
+			Resource: rbac.ResourceNotificationPreference.WithOwner(currentUser.String()),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {memberMe, orgMemberMe, owner},
+				false: {
+					userAdmin, orgUserAdmin, templateAdmin,
+					orgAuditor, orgTemplateAdmin,
+					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
+					orgAdmin, otherOrgAdmin,
+				},
+			},
+		},
+		{
+			// Any owner/admin may access notification templates
+			Name:     "NotificationTemplates",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
+			Resource: rbac.ResourceNotificationTemplate,
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner},
+				false: {
+					memberMe, orgMemberMe, userAdmin, orgUserAdmin, templateAdmin,
+					orgAuditor, orgTemplateAdmin,
+					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
+					orgAdmin, otherOrgAdmin,
+				},
+			},
+		},
+		{
+			// Notification preferences are currently not organization-scoped
+			// Any owner/admin may access any users' preferences
+			// Members may not access other members' preferences
+			Name:     "NotificationPreferencesOtherUser",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
+			Resource: rbac.ResourceNotificationPreference.WithOwner(uuid.NewString()), // some other user
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner},
+				false: {
+					memberMe, templateAdmin, orgUserAdmin, userAdmin,
+					orgAdmin, orgAuditor, orgTemplateAdmin,
+					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
+					otherOrgAdmin, orgMemberMe,
+				},
+			},
+		},
 		// AnyOrganization tests
 		{
 			Name:     "CreateOrgMember",