mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Michael Suchacz
45f2eb48cc
## Summary - restore the `agents-access` data cleanup migration as `000587` (renumbered from `000585`; main advanced past that number) - revert the temporary RBAC tolerance for retired role names now that the migration strips stale grants - make the migration test discover its predecessor dynamically, since this branch does not carry main's `000585`/`000586` ## Stack context Stacked on #28186, which retires the `agents-access` role but intentionally ships without a migration so it can be backported across diverged migration numbers. This layer completes the retirement on main: it cleans up stale role grants in `users.rbac_roles`, `organization_members.roles`, and `organizations.default_org_member_roles`, then reverts the interim leniency (role expansion dropping legacy names, assignment validation ignoring them) that existed only to keep the migration-less base safe. `rbac.ReservedRoleName` still reserves the retired name so custom roles cannot shadow it on rollback. Do not backport this PR alongside the base PR. ## Rollback note The down migration restores effective access broadly because it cannot reconstruct which users previously held the removed role. ## Validation - `go build ./coderd/... ./enterprise/...` - full `coderd/database/migrations`, `coderd/rbac/...`, and `coderd/database/dbauthz` suites - targeted members tests in `coderd` - repository pre-commit checks (`lint/go`, `lint/ts`, etc.) > Mux created this pull request on Mike's behalf.
12 lines
391 B
SQL
12 lines
391 B
SQL
UPDATE users
|
|
SET rbac_roles = array_remove(rbac_roles, 'agents-access')
|
|
WHERE 'agents-access' = ANY(rbac_roles);
|
|
|
|
UPDATE organization_members
|
|
SET roles = array_remove(roles, 'agents-access')
|
|
WHERE 'agents-access' = ANY(roles);
|
|
|
|
UPDATE organizations
|
|
SET default_org_member_roles = array_remove(default_org_member_roles, 'agents-access')
|
|
WHERE 'agents-access' = ANY(default_org_member_roles);
|