feat: Add rbac to templateversion+orgmember endpoints (#1713)

coderd/rbac/object.go

@@ -22,6 +22,10 @@ var (
 		Type: "workspace",
 	}
 
+	// ResourceTemplate CRUD. Org owner only.
+	//	create/delete = Make or delete a new template
+	//	update = Update the template, make new template versions
+	//	read = read the template and all versions associated
 	ResourceTemplate = Object{
 		Type: "template",
 	}
@@ -41,6 +45,7 @@ var (
 	// ResourceRoleAssignment might be expanded later to allow more granular permissions
 	// to modifying roles. For now, this covers all possible roles, so having this permission
 	// allows granting/deleting **ALL** roles.
+	// Never has an owner or org.
 	//	create  = Assign roles
 	//	update  = ??
 	//	read	= View available roles to assign
@@ -49,6 +54,11 @@ var (
 		Type: "assign_role",
 	}
 
+	// ResourceOrgRoleAssignment is just like ResourceRoleAssignment but for organization roles.
+	ResourceOrgRoleAssignment = Object{
+		Type: "assign_org_role",
+	}
+
 	// ResourceAPIKey is owned by a user.
 	//	create  = Create a new api key for user
 	//	update  = ??