mirror of
https://github.com/coder/coder.git
synced 2026-10-31 02:43:21 +08:00
Michael Suchacz
45f2eb48cc
## Summary - restore the `agents-access` data cleanup migration as `000587` (renumbered from `000585`; main advanced past that number) - revert the temporary RBAC tolerance for retired role names now that the migration strips stale grants - make the migration test discover its predecessor dynamically, since this branch does not carry main's `000585`/`000586` ## Stack context Stacked on #28186, which retires the `agents-access` role but intentionally ships without a migration so it can be backported across diverged migration numbers. This layer completes the retirement on main: it cleans up stale role grants in `users.rbac_roles`, `organization_members.roles`, and `organizations.default_org_member_roles`, then reverts the interim leniency (role expansion dropping legacy names, assignment validation ignoring them) that existed only to keep the migration-less base safe. `rbac.ReservedRoleName` still reserves the retired name so custom roles cannot shadow it on rollback. Do not backport this PR alongside the base PR. ## Rollback note The down migration restores effective access broadly because it cannot reconstruct which users previously held the removed role. ## Validation - `go build ./coderd/... ./enterprise/...` - full `coderd/database/migrations`, `coderd/rbac/...`, and `coderd/database/dbauthz` suites - targeted members tests in `coderd` - repository pre-commit checks (`lint/go`, `lint/ts`, etc.) > Mux created this pull request on Mike's behalf.
14 lines
595 B
SQL
14 lines
595 B
SQL
-- Older binaries need agents-access unless another role grants chat access.
|
|
-- Exact prior grants cannot be reconstructed, so restore the role to all
|
|
-- current non-service-account memberships.
|
|
UPDATE organization_members om
|
|
SET roles = array_append(om.roles, 'agents-access')
|
|
FROM users u
|
|
WHERE u.id = om.user_id
|
|
AND NOT u.is_service_account
|
|
AND NOT ('agents-access' = ANY(om.roles));
|
|
|
|
-- Defaults are not restored: older binaries union default_org_member_roles
|
|
-- into service-account memberships too. Pre-upgrade explicit service-account
|
|
-- grants stay lost; an admin can re-grant them.
|