Moved to #8650

What this does

Removes the rbac permission for users to read all other users on the site.

Closes #5002

Changes

Permission Changes

• ResourceTypeUser now owned by user_id of itself.
• member could read all Users --> member can read only themselves

Open issues to resolve

• All templates fetch the creator name. This is no longer able to be read.
  

  coder/coderd/templates.go

  Lines 682 to 692 in 04a2cae

  	func getCreatedByNamesByTemplateIDs(ctx context.Context, db database.Store, templates []database.Template) (map[string]string, error) {
  	creators := make(map[string]string, len(templates))
  	for _, template := range templates {
  	creator, err := db.GetUserByID(ctx, template.CreatedBy)
  	if err != nil {
  	return map[string]string{}, err
  	}
  	creators[template.ID.String()] = creator.Username
  	}
  	return creators, nil
  	}

  • Solution: Both created_by and creator_username is now omitted if the user cannot view the creator. Meaning they can see templates created by themselves. Admins can still view all users.

• User counts are still being read

  • Solution: Implement GetUsers with sql filter rather than filtering the returned list. Now all counts are counts of the readable users for any given caller.

• Group members still return all users

• If you grant a member admin on a template, they can see the permissions page. This page has a list of users/groups that can use/admin the template. Should this page show users they cannot read?