add

Emyrk · Emyrk · commit 628f466bfc04 · 2023-10-30T15:43:48.000-05:00
diff --git a/coderd/database/spice/policy/playground/relationships/relationships.go b/coderd/database/spice/policy/playground/relationships/relationships.go
@@ -59,9 +59,6 @@ func GenerateRelationships() {
 	teamTechnical := Team("technical").Platform(platform).
 		Parent(teamEngineering)
 
-	// Nest some teams
-	// TODO: This is currently unsupported
-
 	// Assign groups to teams
 	teamCompany.MemberGroup(groupEveryone).
 		// Cost control groups can edit workspaces & delete them
@@ -96,6 +93,28 @@ func GenerateRelationships() {
 		CanViewBy(steven, ammar, kyle).
 		CannotViewBy(camilla, jon)
 
+	// The workspace can be edited by cost control group via teamCompany
+	stevenWorkspace.
+		CanEditBy(dean).
+		// But cloud cost cannot exec into the workspace.
+		CannotSshBy(dean)
+
 	// Validations enumerate who can do the given action.
 	stevenWorkspace.ValidateView().ValidateSsh().ValidateEdit()
 }
+
+// createWorkspace
+//   - actor: The user creating the workspace. This user will be assigned as the owner.
+//   - team: The team the workspace is being created for.
+//   - template: The template version the workspace is being created from.
+//   - provisioner: (in prod this might be tags??) The provisioner to provision the workspace.
+//
+// Creating a workspace is the process of a Team creating a workspace and assigning
+// a user permissions.
+// Perm checks:
+//   - Can a user create a workspace for a given team?
+//   - Can the team provision the workspace with the template?
+//   - Can the team use the selected provisioner to provision the workspace? (TODO, rethink this)
+func testCreateWorkspace(actor *ObjUser, team *ObjTeam, version *ObjTemplate_version, provisioner *ObjProvisioner) {
+
+}
diff --git a/coderd/database/spice/policy/schema.zed b/coderd/database/spice/policy/schema.zed
@@ -22,7 +22,9 @@ definition team {
 	// are passed through the team level.
 	relation platform: platform
 
-	// parent allows nesting teams
+	// parent allows nesting teams. Nested teams inherit the permissions from
+    // their parents. So if a user has permissions in a parent team, they have the same
+    // permissions in the child.
 	relation parent: team
 
 	// Teams have their own roles for user's to interact with team resources.
diff --git a/coderd/database/spice/schema.zed b/coderd/database/spice/schema.zed
