a few more permissions fixes

coder · aslilac · Feb 19, 2025 · Feb 5, 2025 · Feb 5, 2025 · Feb 7, 2025
commit 5f6b24820546bf2a9ceda424aad52bb1e82ac25c
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -324,11 +324,10 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			// CRUD to provisioner daemons for now.
 			ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 			// Needs to read all organizations since
-			ResourceOrganization.Type: {policy.ActionRead},
-			ResourceUser.Type:         {policy.ActionRead},
-			ResourceGroup.Type:        {policy.ActionRead},
-			ResourceGroupMember.Type:  {policy.ActionRead},
-			// Org roles are not really used yet, so grant the perm at the site level.
+			ResourceUser.Type:               {policy.ActionRead},
+			ResourceGroup.Type:              {policy.ActionRead},
+			ResourceGroupMember.Type:        {policy.ActionRead},
+			ResourceOrganization.Type:       {policy.ActionRead},
 			ResourceOrganizationMember.Type: {policy.ActionRead},
 		}),
 		Org:  map[string][]Permission{},
@@ -347,10 +346,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete,
 				policy.ActionUpdatePersonal, policy.ActionReadPersonal,
 			},
+			ResourceGroup.Type:        {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
+			ResourceGroupMember.Type:  {policy.ActionRead},
+			ResourceOrganization.Type: {policy.ActionRead},
 			// Full perms to manage org members
 			ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
-			ResourceGroup.Type:              {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
-			ResourceGroupMember.Type:        {policy.ActionRead},
 			// Manage org membership based on OIDC claims
 			ResourceIdpsyncSettings.Type: {policy.ActionRead, policy.ActionUpdate},
 		}),

diff --git a/site/src/modules/management/OrganizationSettingsLayout.tsx b/site/src/modules/management/OrganizationSettingsLayout.tsx
@@ -19,6 +19,8 @@ import {
 	type OrganizationPermissions,
 	canViewOrganization,
 } from "./organizationPermissions";
+import { Paywall } from "components/Paywall/Paywall";
+import { docs } from "utils/docs";
 
 export const OrganizationSettingsContext = createContext<
 	OrganizationSettingsValue | undefined
@@ -46,7 +48,7 @@ export const useOrganizationSettings = (): OrganizationSettingsValue => {
 };
 
 const OrganizationSettingsLayout: FC = () => {
-	const { organizations } = useDashboard();
+	const { organizations, showOrganizations } = useDashboard();
 	const { organization: orgName } = useParams() as {
 		organization?: string;
 	};
@@ -123,7 +125,15 @@ const OrganizationSettingsLayout: FC = () => {
 				<hr className="h-px border-none bg-border" />
 				<div className="px-10 max-w-screen-2xl">
 					<Suspense fallback={<Loader />}>
-						<Outlet />
+						{showOrganizations ? (
+							<Outlet />
+						) : (
+							<Paywall
+								message="Organizations"
+								description="Organizations can be used to segment and isolate resources inside a Coder deployment. You need a Premium license to use this feature."
+								documentationLink={docs("/admin/users/organizations")}
+							/>
+						)}
 					</Suspense>
 				</div>
 			</div>

diff --git a/site/src/modules/management/OrganizationSidebarView.tsx b/site/src/modules/management/OrganizationSidebarView.tsx
@@ -191,7 +191,7 @@ const OrganizationSettingsNavigation: FC<
 						Roles
 					</SettingsSidebarNavItem>
 				)}
-				{orgPermissions.viewProvisioners && (
+				{orgPermissions.viewProvisionerJobs && (
 					<SettingsSidebarNavItem
 						href={urlForSubpage(organization.name, "provisioners")}
 					>

diff --git a/site/src/modules/management/organizationPermissions.tsx b/site/src/modules/management/organizationPermissions.tsx
@@ -80,6 +80,13 @@ export const organizationPermissionChecks = (organizationId: string) =>
 			},
 			action: "read",
 		},
+		viewProvisionerJobs: {
+			object: {
+				resource_type: "provisioner_jobs",
+				organization_id: organizationId,
+			},
+			action: "read",
+		},
 		viewIdpSyncSettings: {
 			object: {
 				resource_type: "idpsync_settings",

diff --git a/site/src/pages/OrganizationSettingsPage/ProvisionersPage/ProvisionersPage.tsx b/site/src/pages/OrganizationSettingsPage/ProvisionersPage/ProvisionersPage.tsx
@@ -9,13 +9,13 @@ import { ProvisionerDaemonsPage } from "./ProvisionerDaemonsPage";
 import { ProvisionerJobsPage } from "./ProvisionerJobsPage";
 
 const ProvisionersPage: FC = () => {
-	const { organization } = useOrganizationSettings();
+	const { organization, organizationPermissions } = useOrganizationSettings();
 	const tab = useSearchParamsKey({
 		key: "tab",
 		defaultValue: "jobs",
 	});
 
-	if (!organization) {
+	if (!organization || !organizationPermissions?.viewProvisionerJobs) {
 		return (
 			<>
 				<Helmet>

diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
@@ -2855,6 +2855,7 @@ export const MockOrganizationPermissions: OrganizationPermissions = {
 	createOrgRoles: true,
 	assignOrgRoles: true,
 	viewProvisioners: true,
+	viewProvisionerJobs: true,
 	viewIdpSyncSettings: true,
 	editIdpSyncSettings: true,
 };
@@ -2870,6 +2871,7 @@ export const MockNoOrganizationPermissions: OrganizationPermissions = {
 	createOrgRoles: false,
 	assignOrgRoles: false,
 	viewProvisioners: false,
+	viewProvisionerJobs: false,
 	viewIdpSyncSettings: false,
 	editIdpSyncSettings: false,
 };