mirror of
https://github.com/coder/coder.git
synced 2026-10-31 02:43:21 +08:00
Susana Ferreira
ab6601086a
## Problem A user without `group:update` (e.g. the `Coder Agents User` role) could open the group settings page by direct URL and edit the budget. Saving then failed with a misleading error: > Failed to add or remove non-existent group member — execute transaction: update group by ID: unauthorized: rbac: forbidden. The authorization failure was misclassified as a missing group member, and the settings page was not gated on the required permission. ## Changes - Return the standard vague 404 for authorization failures in the group PATCH handler, so the response is accurate and does not leak resource existence. - Use a generic message for the remaining 400 branch, since it covers various transaction failures rather than only member add/remove. - Gate the group settings page on `group:update`. The settings tab is already hidden without the permission, but the page was reachable by direct URL and rendered an editable form that always failed on save. It now shows the standard permission dialog. Fixes [AIGOV-603](https://linear.app/codercom/issue/AIGOV-603/hide-group-budget-controls-without-permission). > [!NOTE] > Generated by Coder Agents, reviewed by @ssncferreira.