Jun 4, 2025 · May 22, 2025 · May 23, 2025 · May 23, 2025 · May 27, 2025 · May 27, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
 policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
 },
 // Should be able to add the prebuilds system user as a member to any organization that needs prebuilds.
 rbac.ResourceOrganizationMember.Type: {
 policy.ActionCreate,
 },
 // Needs to be able to assign roles to the system user in order to make it a member of an organization.
 rbac.ResourceAssignOrgRole.Type: {
 policy.ActionAssign,
 },
 // Needs to be able to read users to determine which organizations the prebuild system user is a member of.
 rbac.ResourceUser.Type: {
 policy.ActionRead,
 },
 rbac.ResourceOrganization.Type: {
 policy.ActionRead,
 },
 }),
 },
 }),
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
 orgUserAdmin            string = "organization-user-admin"
 orgTemplateAdmin        string = "organization-template-admin"
 orgWorkspaceCreationBan string = "organization-workspace-creation-ban"

 prebuildsOrchestrator string = "prebuilds-orchestrator"
 )

 func init() {
 orgUserAdmin: {
 orgMember: true,
 },
 prebuildsOrchestrator: {
 orgMember: true,
 },
 }

 // ExpandableRoles is any type that can be expanded into a []Role. This is implemented
Original file line number	Diff line number	Diff line change
Expand Up		@@ -412,6 +412,21 @@ var (
		policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
		policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
		},
		// Should be able to add the prebuilds system user as a member to any organization that needs prebuilds.
		rbac.ResourceOrganizationMember.Type: {
		policy.ActionCreate,
		},
Comment on lines +416 to +418 Copy link Member EmyrkMay 23, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I think you also need read here to`determine which organizations the prebuild system user is a member of.`
		// Needs to be able to assign roles to the system user in order to make it a member of an organization.
		rbac.ResourceAssignOrgRole.Type: {
		policy.ActionAssign,
		},
		// Needs to be able to read users to determine which organizations the prebuild system user is a member of.
		rbac.ResourceUser.Type: {
		policy.ActionRead,
		},
		rbac.ResourceOrganization.Type: {
		policy.ActionRead,
		},
		}),
		},
		}),
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -33,6 +33,8 @@ const (
		orgUserAdmin string = "organization-user-admin"
		orgTemplateAdmin string = "organization-template-admin"
		orgWorkspaceCreationBan string = "organization-workspace-creation-ban"

		prebuildsOrchestrator string = "prebuilds-orchestrator"
		)

		func init() {
Expand DownExpand Up		@@ -599,6 +601,9 @@ var assignRoles = map[string]map[string]bool{
		orgUserAdmin: {
		orgMember: true,
		},
		prebuildsOrchestrator: {
SasSwart marked this conversation as resolved. Show resolvedHide resolved
		orgMember: true,
		},
		}

		// ExpandableRoles is any type that can be expanded into a []Role. This is implemented
Expand Down