add groupacl

coder · f0ssel · Dec 20, 2023 · Dec 20, 2023 · Dec 20, 2023 · Dec 20, 2023
commit 06618d7613702c71be12a28da16716341bb325bf
diff --git a/cli/templatepush.go b/cli/templatepush.go
@@ -321,7 +321,7 @@ func (r *RootCmd) templatePush() *clibase.Cmd {
 				}
 				req := codersdk.UpdateTemplateMeta{
 					RequireActiveVersion:           requireActiveVersion,
-					DisableEveryone:                disableEveryone,
+					DisableEveryoneGroupAccess:     disableEveryone,
 					DefaultTTLMillis:               defaultTTL.Milliseconds(),
 					FailureTTLMillis:               failureTTL.Milliseconds(),
 					TimeTilDormantMillis:           dormancyThreshold.Milliseconds(),

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/templates.sql b/coderd/database/queries/templates.sql
@@ -115,7 +115,8 @@ SET
 	name = $4,
 	icon = $5,
 	display_name = $6,
-	allow_user_cancel_workspace_jobs = $7
+	allow_user_cancel_workspace_jobs = $7,
+	group_acl = $8
 WHERE
 	id = $1
 ;

diff --git a/coderd/templates.go b/coderd/templates.go
@@ -667,6 +667,11 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			name = template.Name
 		}
 
+		groupACL := template.GroupACL
+		if req.DisableEveryoneGroupAccess {
+			groupACL = database.TemplateACL{}
+		}
+
 		var err error
 		err = tx.UpdateTemplateMetaByID(ctx, database.UpdateTemplateMetaByIDParams{
 			ID:                           template.ID,
@@ -676,6 +681,7 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			Description:                  req.Description,
 			Icon:                         req.Icon,
 			AllowUserCancelWorkspaceJobs: req.AllowUserCancelWorkspaceJobs,
+			GroupACL:                     groupACL,
 		})
 		if err != nil {
 			return xerrors.Errorf("update template metadata: %w", err)

diff --git a/codersdk/templates.go b/codersdk/templates.go
@@ -241,6 +241,12 @@ type UpdateTemplateMeta struct {
 	// If passed an empty string, will remove the deprecated message, making
 	// the template usable for new workspaces again.
 	DeprecationMessage *string `json:"deprecation_message"`
+	// DisableEveryoneGroupAccess allows optionally disabling the default
+	// behavior of granting the 'everyone' group access to use the template.
+	// If this is set to true, the template will not be available to all users,
+	// and must be explicitly granted to users or groups in the permissions settings
+	// of the template.
+	DisableEveryoneGroupAccess bool `json:"disable_everyone_group_access"`
 }
 
 type TemplateExample struct {

diff --git a/docs/cli/templates_push.md b/docs/cli/templates_push.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts