add the RBAC ResourceGroupMember and add it to relevant roles

coder · Emyrk · Aug 13, 2024 · Aug 6, 2024 · Aug 6, 2024 · Aug 6, 2024
commit 13ca3a9290e5b97efeff147a2b110217818a48f9
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
@@ -149,6 +149,11 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionUpdate: actDef("update a group"),
 		},
 	},
+	"group_member": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead: actDef("read group members"),
+		},
+	},
 	"file": {
 		Actions: map[Action]ActionDefinition{
 			ActionCreate: actDef("create a file"),

diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -301,10 +301,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		Site: Permissions(map[string][]policy.Action{
 			// Should be able to read all template details, even in orgs they
 			// are not in.
-			ResourceTemplate.Type: {policy.ActionRead, policy.ActionViewInsights},
-			ResourceAuditLog.Type: {policy.ActionRead},
-			ResourceUser.Type:     {policy.ActionRead},
-			ResourceGroup.Type:    {policy.ActionRead},
+			ResourceTemplate.Type:    {policy.ActionRead, policy.ActionViewInsights},
+			ResourceAuditLog.Type:    {policy.ActionRead},
+			ResourceUser.Type:        {policy.ActionRead},
+			ResourceGroup.Type:       {policy.ActionRead},
+			ResourceGroupMember.Type: {policy.ActionRead},
 			// Allow auditors to query deployment stats and insights.
 			ResourceDeploymentStats.Type:  {policy.ActionRead},
 			ResourceDeploymentConfig.Type: {policy.ActionRead},
@@ -329,6 +330,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceOrganization.Type: {policy.ActionRead},
 			ResourceUser.Type:         {policy.ActionRead},
 			ResourceGroup.Type:        {policy.ActionRead},
+			ResourceGroupMember.Type:  {policy.ActionRead},
 			// Org roles are not really used yet, so grant the perm at the site level.
 			ResourceOrganizationMember.Type: {policy.ActionRead},
 		}),
@@ -351,6 +353,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			// Full perms to manage org members
 			ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 			ResourceGroup.Type:              {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
+			ResourceGroupMember.Type:        {policy.ActionRead},
 		}),
 		Org:  map[string][]Permission{},
 		User: []Permission{},
@@ -461,6 +464,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 						ResourceAssignOrgRole.Type:      {policy.ActionAssign, policy.ActionDelete, policy.ActionRead},
 						ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 						ResourceGroup.Type:              ResourceGroup.AvailableActions(),
+						ResourceGroupMember.Type:        ResourceGroupMember.AvailableActions(),
 					}),
 				},
 				User: []Permission{},
@@ -480,6 +484,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 						// Assigning template perms requires this permission.
 						ResourceOrganizationMember.Type: {policy.ActionRead},
 						ResourceGroup.Type:              {policy.ActionRead},
+						ResourceGroupMember.Type:        {policy.ActionRead},
 					}),
 				},
 				User: []Permission{},

diff --git a/codersdk/rbacresources_gen.go b/codersdk/rbacresources_gen.go
diff --git a/site/src/api/rbacresources_gen.ts b/site/src/api/rbacresources_gen.ts
@@ -50,6 +50,9 @@ export const RBACResourceActions: Partial<
     read: "read groups",
     update: "update a group",
   },
+  group_member: {
+    read: "read group members",
+  },
   license: {
     create: "create a license",
     delete: "delete license",

diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts