fix(enterprise/coderd): skip org membership check for prebuilds user on group patch

johnstcn · johnstcn · commit d48e08e9d2ab · 2025-06-23T09:19:02.000+01:00
diff --git a/enterprise/coderd/groups.go b/enterprise/coderd/groups.go
@@ -14,6 +14,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/db2sdk"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/prebuilds"
 	"github.com/coder/coder/v2/codersdk"
 )
 
@@ -171,6 +172,12 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 			})
 			return
 		}
+		// Skip membership checks for the prebuilds user. There is a valid use case
+		// for adding the prebuilds user to a single group: in order to set a quota
+		// allowance specifically for prebuilds.
+		if id == prebuilds.SystemUserID.String() {
+			continue
+		}
 		_, err := database.ExpectOne(api.Database.OrganizationMembers(ctx, database.OrganizationMembersParams{
 			OrganizationID: group.OrganizationID,
 			UserID:         uuid.MustParse(id),
diff --git a/enterprise/coderd/groups_test.go b/enterprise/coderd/groups_test.go
@@ -463,6 +463,32 @@ func TestPatchGroup(t *testing.T) {
 		require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
 	})
 
+	// For quotas to work with prebuilds, it's currently required to add the
+	// prebuilds user into a group with a quota allowance.
+	// See: docs/admin/templates/extending-templates/prebuilt-workspaces.md
+	t.Run("PrebuildsUser", func(t *testing.T) {
+		t.Parallel()
+
+		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureTemplateRBAC: 1,
+			},
+		}})
+		userAdminClient, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.RoleUserAdmin())
+		ctx := testutil.Context(t, testutil.WaitLong)
+		group, err := userAdminClient.CreateGroup(ctx, user.OrganizationID, codersdk.CreateGroupRequest{
+			Name:           "prebuilds",
+			QuotaAllowance: 123,
+		})
+		require.NoError(t, err)
+
+		group, err = userAdminClient.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
+			Name:     "prebuilds",
+			AddUsers: []string{prebuilds.SystemUserID.String()},
+		})
+		require.NoError(t, err)
+	})
+
 	t.Run("Everyone", func(t *testing.T) {
 		t.Parallel()
 		t.Run("NoUpdateName", func(t *testing.T) {
