feat(enterprise/coderd): allow system users to be added to groups #18341
Conversation
…tem user so that they can configure quotas
There was a problem hiding this comment.
I'm wondering about this approach. Do we need to add IncludeSystem: true to all these queries just to support the prebuilds system user?
This means someone will need to manually create a group for the prebuilds user and assign it a quota, right?
Wouldn't it be more robust to automatically create a group for the prebuilds system user with a default quota, and allow users to override it if needed? That way, we avoid having to include system users in these queries and reduce the risk of system users leaking into user-facing features.
| -- Filter by system type | ||
| AND CASE | ||
| WHEN @include_system::bool THEN TRUE | ||
| ELSE | ||
| is_system = false | ||
| END |
There was a problem hiding this comment.
nit for readability:
| -- Filter by system type | |
| AND CASE | |
| WHEN @include_system::bool THEN TRUE | |
| ELSE | |
| is_system = false | |
| END | |
| -- Conditionally include system users based on @include_system flag | |
| AND (@include_system OR is_system = false) |
|
The prebuilds user has already leaked into user facing features. Administrators search for prebuilds by specifying the prebuilds user on the workspace list page. For consistency and clarity, I think we should embrace listing and showing the prebuilds user. I like the idea of automatically creating a prebuilds group, but we'll need to decide what a sensible default quota would be if there is such a value that makes sense. |
It’s true that the prebuilds user is already exposed in some user-facing features, like showing prebuilt workspaces, but that might not be the ideal approach 😕 The issue isn’t just about the prebuilds user, it extends to listing all current and future system users.
We already have a precedent with the coder/coderd/database/queries/groups.sql Lines 102 to 109 in 0cdcf89 We could apply the same pattern here: automatically create the prebuilds group with a default quota of 0, and clearly document this behavior along with instructions on how users can update the quota if needed. |
closes #18274
This pull request makes system users visible in various group related queries so that they can be added to groups. This allows system user quotas to be configured. System users are still ignored in certain queries, such as when license seat consumption is determined.