coder
diff --git a/‎coderd/database/spice/policy/playground/relationships/generate.sh
Lines changed: 6 additions & 1 deletion b/‎coderd/database/spice/policy/playground/relationships/generate.sh
Lines changed: 6 additions & 1 deletion
diff --git a/‎coderd/database/spice/policy/playground/relationships/manualobjects.go
Lines changed: 8 additions & 2 deletions b/‎coderd/database/spice/policy/playground/relationships/manualobjects.go
Lines changed: 8 additions & 2 deletions
@@ -1 +1,6 @@
-go run ./generate/main.go > objects_tmp.go && mv objects_tmp.go objects.go
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+export SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+cd "$SCRIPT_DIR" && go run ./generate/main.go > objects_tmp.go && mv objects_tmp.go objects.go
@@ -147,8 +147,11 @@ func AllRelationsToStrings() string {
 	return strings.Join(allStrings, "\n")
 }
 
-func WorkspaceWithDeps(id string) *ObjWorkspace {
-	workspace := Workspace(id)
+func WorkspaceWithDeps(id string, team *ObjTeam, template *ObjTemplate) *ObjWorkspace {
+	// Building a workspace means the team needs access to the template + provisioner
+	template.CanUseBy(team) // This should be a perm check
+
+	workspace := Workspace(id).Owner(team)
 	build := Workspace_build(fmt.Sprintf("%s/build", id)).
 		Workspace(workspace)
 	agent := Workspace_agent(fmt.Sprintf("%s/agent", id)).
@@ -158,6 +161,9 @@ func WorkspaceWithDeps(id string) *ObjWorkspace {
 	resources := Workspace_resources(fmt.Sprintf("%s/resources", id)).
 		Workspace(workspace)
 
+	// Add the template + provisioner relations
+	template.Workspace(workspace)
+
 	var _, _, _, _ = build, agent, app, resources
 	return workspace
 }