Hide /users page for regular users

Emyrk · Emyrk · commit 4545d1a6ee77 · 2023-07-25T10:22:31.000-04:00
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -145,8 +145,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		Name:        member,
 		DisplayName: "",
 		Site: Permissions(map[string][]Action{
-			// All users can read all other users and know they exist.
-			ResourceUser.Type:           {ActionRead},
 			ResourceRoleAssignment.Type: {ActionRead},
 			// All users can see the provisioner daemons.
 			ResourceProvisionerDaemon.Type: {ActionRead},
diff --git a/site/src/components/Navbar/Navbar.tsx b/site/src/components/Navbar/Navbar.tsx
@@ -16,6 +16,7 @@ export const Navbar: FC = () => {
   const canViewAuditLog =
     featureVisibility["audit_log"] && Boolean(permissions.viewAuditLog)
   const canViewDeployment = Boolean(permissions.viewDeploymentValues)
+  const canViewAllUsers = Boolean(permissions.readAllUsers)
   const onSignOut = () => authSend("SIGN_OUT")
   const proxyContextValue = useProxy()
   const dashboard = useDashboard()
@@ -29,6 +30,7 @@ export const Navbar: FC = () => {
       onSignOut={onSignOut}
       canViewAuditLog={canViewAuditLog}
       canViewDeployment={canViewDeployment}
+      canViewAllUsers={canViewAllUsers}
       proxyContextValue={
         dashboard.experiments.includes("moons") ? proxyContextValue : undefined
       }
diff --git a/site/src/components/Navbar/NavbarView.test.tsx b/site/src/components/Navbar/NavbarView.test.tsx
@@ -48,6 +48,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const workspacesLink = await screen.findByText(navLanguage.workspaces)
@@ -62,6 +63,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const templatesLink = await screen.findByText(navLanguage.templates)
@@ -76,6 +78,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const userLink = await screen.findByText(navLanguage.users)
@@ -98,6 +101,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
 
@@ -115,6 +119,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const auditLink = await screen.findByText(navLanguage.audit)
@@ -129,6 +134,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog={false}
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const auditLink = screen.queryByText(navLanguage.audit)
@@ -143,6 +149,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog
         canViewDeployment
+        canViewAllUsers
       />,
     )
     const auditLink = await screen.findByText(navLanguage.deployment)
@@ -159,6 +166,7 @@ describe("NavbarView", () => {
         onSignOut={noop}
         canViewAuditLog={false}
         canViewDeployment={false}
+        canViewAllUsers
       />,
     )
     const auditLink = screen.queryByText(navLanguage.deployment)
diff --git a/site/src/components/Navbar/NavbarView.tsx b/site/src/components/Navbar/NavbarView.tsx
@@ -36,6 +36,7 @@ export interface NavbarViewProps {
   onSignOut: () => void
   canViewAuditLog: boolean
   canViewDeployment: boolean
+  canViewAllUsers: boolean
   proxyContextValue?: ProxyContextValue
 }
 
@@ -52,8 +53,9 @@ const NavItems: React.FC<
     className?: string
     canViewAuditLog: boolean
     canViewDeployment: boolean
+    canViewAllUsers: boolean
   }>
-> = ({ className, canViewAuditLog, canViewDeployment }) => {
+> = ({ className, canViewAuditLog, canViewDeployment, canViewAllUsers }) => {
   const styles = useStyles()
   const location = useLocation()
 
@@ -75,11 +77,13 @@ const NavItems: React.FC<
           {Language.templates}
         </NavLink>
       </ListItem>
-      <ListItem button className={styles.item}>
-        <NavLink className={styles.link} to={USERS_LINK}>
-          {Language.users}
-        </NavLink>
-      </ListItem>
+      {canViewAllUsers && (
+        <ListItem button className={styles.item}>
+          <NavLink className={styles.link} to={USERS_LINK}>
+            {Language.users}
+          </NavLink>
+        </ListItem>
+      )}
       {canViewAuditLog && (
         <ListItem button className={styles.item}>
           <NavLink className={styles.link} to="/audit">
@@ -105,6 +109,7 @@ export const NavbarView: FC<NavbarViewProps> = ({
   onSignOut,
   canViewAuditLog,
   canViewDeployment,
+  canViewAllUsers,
   proxyContextValue,
 }) => {
   const styles = useStyles()
@@ -142,6 +147,7 @@ export const NavbarView: FC<NavbarViewProps> = ({
             <NavItems
               canViewAuditLog={canViewAuditLog}
               canViewDeployment={canViewDeployment}
+              canViewAllUsers={canViewAllUsers}
             />
           </div>
         </Drawer>
@@ -158,6 +164,7 @@ export const NavbarView: FC<NavbarViewProps> = ({
           className={styles.desktopNavItems}
           canViewAuditLog={canViewAuditLog}
           canViewDeployment={canViewDeployment}
+          canViewAllUsers={canViewAllUsers}
         />
 
         <Box
