feat: notify users on template deprecation

DanielleMaywood · DanielleMaywood · commit ea30af86b1ad · 2024-10-23T13:02:40.000Z
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2339,6 +2339,16 @@ func (q *querier) GetUsersByIDs(ctx context.Context, ids []uuid.UUID) ([]databas
 	return q.db.GetUsersByIDs(ctx, ids)
 }
 
+func (q *querier) GetUsersWithAccessToTemplateByID(ctx context.Context, id uuid.UUID) ([]uuid.UUID, error) {
+	// Ensure we have permission to access this template.
+	_, err := q.GetTemplateByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+
+	return q.db.GetUsersWithAccessToTemplateByID(ctx, id)
+}
+
 func (q *querier) GetWorkspaceAgentAndLatestBuildByAuthToken(ctx context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndLatestBuildByAuthTokenRow, error) {
 	// This is a system function
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -1131,6 +1131,10 @@ func (s *MethodTestSuite) TestUser() {
 			Asserts(a, policy.ActionRead, b, policy.ActionRead).
 			Returns(slice.New(a, b))
 	}))
+	s.Run("GetUsersWithAccessToTemplateByID", s.Subtest(func(db database.Store, check *expects) {
+		a := dbgen.Template(s.T(), db, database.Template{})
+		check.Args(a.ID).Asserts(a, policy.ActionRead)
+	}))
 	s.Run("GetUsers", s.Subtest(func(db database.Store, check *expects) {
 		dbgen.User(s.T(), db, database.User{Username: "GetUsers-a-user"})
 		dbgen.User(s.T(), db, database.User{Username: "GetUsers-b-user"})
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
@@ -5669,6 +5669,33 @@ func (q *FakeQuerier) GetUsersByIDs(_ context.Context, ids []uuid.UUID) ([]datab
 	return users, nil
 }
 
+func (q *FakeQuerier) GetUsersWithAccessToTemplateByID(ctx context.Context, id uuid.UUID) ([]uuid.UUID, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	groups := make(map[string]bool, 0)
+	for _, template := range q.templates {
+		if template.ID != id {
+			continue
+		}
+
+		for group := range template.GroupACL {
+			groups[group] = true
+		}
+	}
+
+	users := make([]uuid.UUID, 0)
+	for _, member := range q.organizationMembers {
+		if _, ok := groups[member.OrganizationID.String()]; !ok {
+			continue
+		}
+
+		users = append(users, member.UserID)
+	}
+
+	return users, nil
+}
+
 func (q *FakeQuerier) GetWorkspaceAgentAndLatestBuildByAuthToken(_ context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndLatestBuildByAuthTokenRow, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()
diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/migrations/000269_template_deprecation_notification.down.sql b/coderd/database/migrations/000269_template_deprecation_notification.down.sql
@@ -0,0 +1 @@
+DELETE FROM notification_templates WHERE id = 'f40fae84-55a2-42cd-99fa-b41c1ca64894';
diff --git a/coderd/database/migrations/000269_template_deprecation_notification.up.sql b/coderd/database/migrations/000269_template_deprecation_notification.up.sql
@@ -0,0 +1,13 @@
+INSERT INTO notification_templates
+	(id, name, title_template, body_template, "group", actions)
+VALUES (
+	'f40fae84-55a2-42cd-99fa-b41c1ca64894',
+	'Template Deprecated',
+	E'Template **{{.Labels.template}}** has been deprecated',
+    E'Hello {{.UserName}},\n\n'||
+		E'The template **{{.Labels.template}}** has been deprecated with the following message:\n\n' ||
+		E'**{{.Labels.message}}**\n\n' ||
+		E'New workspaces may not be created from this template. Existing workspaces will continue to function normally.',
+    'Template Events',
+	'[]'::jsonb
+);
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/templates.sql b/coderd/database/queries/templates.sql
@@ -199,3 +199,18 @@ SET
 WHERE
 	id = $1
 ;
+
+-- name: GetUsersWithAccessToTemplateByID :many
+SELECT
+	user_id
+FROM
+	organization_members
+WHERE
+	organization_members.organization_id::text IN (
+		SELECT
+			jsonb_object_keys(group_acl)
+		FROM
+			templates
+		WHERE templates.id = $1
+	)
+;
diff --git a/coderd/notifications/events.go b/coderd/notifications/events.go
@@ -30,7 +30,8 @@ var (
 
 // Template-related events.
 var (
-	TemplateTemplateDeleted = uuid.MustParse("29a09665-2a4c-403f-9648-54301670e7be")
+	TemplateTemplateDeleted    = uuid.MustParse("29a09665-2a4c-403f-9648-54301670e7be")
+	TemplateTemplateDeprecated = uuid.MustParse("f40fae84-55a2-42cd-99fa-b41c1ca64894")
 
 	TemplateWorkspaceBuildsFailedReport = uuid.MustParse("34a20db2-e9cc-4a93-b0e4-8569699d7a00")
 )
diff --git a/coderd/templates.go b/coderd/templates.go
@@ -845,6 +845,12 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if template.Deprecated != updated.Deprecated && updated.Deprecated != "" {
+		if err := api.notifyUsersOfTemplateDeprecation(ctx, updated); err != nil {
+			api.Logger.Error(ctx, "failed to notify users of template deprecation", slog.Error(err))
+		}
+	}
+
 	if updated.UpdatedAt.IsZero() {
 		aReq.New = template
 		rw.WriteHeader(http.StatusNotModified)
@@ -855,6 +861,34 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, api.convertTemplate(updated))
 }
 
+func (api *API) notifyUsersOfTemplateDeprecation(ctx context.Context, template database.Template) error {
+	users, err := api.Database.GetUsersWithAccessToTemplateByID(ctx, template.ID)
+	if err != nil {
+		return xerrors.Errorf("get users with access to template by id: %w", err)
+	}
+
+	errs := []error{}
+
+	for _, userID := range users {
+		_, err = api.NotificationsEnqueuer.Enqueue(
+			//nolint:gocritic // We need the system auth context to be able to send the deprecation notification.
+			dbauthz.AsSystemRestricted(ctx),
+			userID,
+			notifications.TemplateTemplateDeprecated,
+			map[string]string{
+				"template": template.Name,
+				"message":  template.Deprecated,
+			},
+			"notify-users-of-template-deprecation",
+		)
+		if err != nil {
+			errs = append(errs, xerrors.Errorf("enqueue notification: %w", err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
 // @Summary Get template DAUs by ID
 // @ID get-template-daus-by-id
 // @Security CoderSessionToken

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+DELETE FROM notification_templates WHERE id = 'f40fae84-55a2-42cd-99fa-b41c1ca64894';`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,8 @@ var (`
`30`	`30`
`31`	`31`	`// Template-related events.`
`32`	`32`	`var (`
`33`		`- TemplateTemplateDeleted = uuid.MustParse("29a09665-2a4c-403f-9648-54301670e7be")`
	`33`	`+ TemplateTemplateDeleted = uuid.MustParse("29a09665-2a4c-403f-9648-54301670e7be")`
	`34`	`+ TemplateTemplateDeprecated = uuid.MustParse("f40fae84-55a2-42cd-99fa-b41c1ca64894")`
`34`	`35`
`35`	`36`	`TemplateWorkspaceBuildsFailedReport = uuid.MustParse("34a20db2-e9cc-4a93-b0e4-8569699d7a00")`
`36`	`37`	`)`