Mar 2, 2025 · Feb 3, 2025
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
 })
 }

 roles, err := s.Database.GetAuthorizationUserRoles(ctx, owner.ID)
 if err != nil {
 return nil, failJob(fmt.Sprintf("get owner authorization roles: %s", err))
 }
 ownerRbacRoles := []*sdkproto.Role{}
 for _, role := range roles.Roles {
 if s.OrganizationID == uuid.Nil {
 ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: ""})
 continue
 }
 ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: s.OrganizationID.String()})
 }

 protoJob.Type = &proto.AcquiredJob_WorkspaceBuild_{
 WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
 WorkspaceBuildId:      workspaceBuild.ID.String(),
 WorkspaceOwnerSshPrivateKey:   ownerSSHPrivateKey,
 WorkspaceBuildId:              workspaceBuild.ID.String(),
 WorkspaceOwnerLoginType:       string(owner.LoginType),
 WorkspaceOwnerRbacRoles:       ownerRbacRoles,
 },
 LogLevel: input.LogLevel,
 },
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
 WorkspaceOwnerSshPrivateKey:   sshKey.PrivateKey,
 WorkspaceBuildId:              build.ID.String(),
 WorkspaceOwnerLoginType:       string(user.LoginType),
 WorkspaceOwnerRbacRoles:       []*sdkproto.Role{{Name: "member", OrgId: pd.OrganizationID.String()}},
 },
 },
 })
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
 return nil, xerrors.Errorf("marshal owner groups: %w", err)
 }

 ownerRbacRoles, err := json.Marshal(metadata.GetWorkspaceOwnerRbacRoles())
 if err != nil {
 return nil, xerrors.Errorf("marshal owner rbac roles: %w", err)
 }

 env = append(env,
 "CODER_AGENT_URL="+metadata.GetCoderUrl(),
 "CODER_WORKSPACE_TRANSITION="+strings.ToLower(metadata.GetWorkspaceTransition().String()),
 "CODER_WORKSPACE_OWNER_SSH_PUBLIC_KEY="+metadata.GetWorkspaceOwnerSshPublicKey(),
 "CODER_WORKSPACE_OWNER_SSH_PRIVATE_KEY="+metadata.GetWorkspaceOwnerSshPrivateKey(),
 "CODER_WORKSPACE_OWNER_LOGIN_TYPE="+metadata.GetWorkspaceOwnerLoginType(),
 "CODER_WORKSPACE_OWNER_RBAC_ROLES="+string(ownerRbacRoles),
 "CODER_WORKSPACE_ID="+metadata.GetWorkspaceId(),
 "CODER_WORKSPACE_OWNER_ID="+metadata.GetWorkspaceOwnerId(),
 "CODER_WORKSPACE_OWNER_SESSION_TOKEN="+metadata.GetWorkspaceOwnerSessionToken(),
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
 }},
 },
 },
 {
 Name:       "workspace-owner-rbac-roles",
 SkipReason: "field will be added in provider version 2.2.0",
 Files: map[string]string{
 "main.tf": `terraform {
 required_providers {
  coder = {
 source  = "coder/coder"
 version = "2.2.0"
  }
 }
 }

 resource "null_resource" "example" {}
 data "coder_workspace_owner" "me" {}
 resource "coder_metadata" "example" {
 resource_id = null_resource.example.id
 item {
 key = "rbac_roles_name"
 value = data.coder_workspace_owner.me.rbac_roles[0].name
 }
 item {
 key = "rbac_roles_org_id"
 value = data.coder_workspace_owner.me.rbac_roles[0].org_id
 }
 }
 `,
 },
 Request: &proto.PlanRequest{
 Metadata: &proto.Metadata{
 WorkspaceOwnerRbacRoles: []*proto.Role{{Name: "member", OrgId: ""}},
 },
 },
 Response: &proto.PlanComplete{
 Resources: []*proto.Resource{{
 Name: "example",
 Type: "null_resource",
 Metadata: []*proto.Resource_Metadata{{
 Key:   "rbac_roles_name",
 Value: "member",
 }, {
 Key:   "rbac_roles_org_id",
 Value: "",
 }},
 }},
 },
 },
 }

 for _, testCase := range testCases {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -594,6 +594,19 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
		})
		}

		roles, err := s.Database.GetAuthorizationUserRoles(ctx, owner.ID)
		if err != nil {
		return nil, failJob(fmt.Sprintf("get owner authorization roles: %s", err))
		}
		ownerRbacRoles := []*sdkproto.Role{}
		for _, role := range roles.Roles {
		if s.OrganizationID == uuid.Nil {
		ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: ""})
		continue
		}
		ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: s.OrganizationID.String()})
		}

		protoJob.Type = &proto.AcquiredJob_WorkspaceBuild_{
		WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
		WorkspaceBuildId: workspaceBuild.ID.String(),
Expand DownExpand Up		@@ -621,6 +634,7 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
		WorkspaceOwnerSshPrivateKey: ownerSSHPrivateKey,
		WorkspaceBuildId: workspaceBuild.ID.String(),
		WorkspaceOwnerLoginType: string(owner.LoginType),
		WorkspaceOwnerRbacRoles: ownerRbacRoles,
		},
		LogLevel: input.LogLevel,
		},
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -377,6 +377,7 @@ func TestAcquireJob(t *testing.T) {
		WorkspaceOwnerSshPrivateKey: sshKey.PrivateKey,
		WorkspaceBuildId: build.ID.String(),
		WorkspaceOwnerLoginType: string(user.LoginType),
		WorkspaceOwnerRbacRoles: []*sdkproto.Role{{Name: "member", OrgId: pd.OrganizationID.String()}},
		},
		},
		})
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -242,6 +242,11 @@ func provisionEnv(
		return nil, xerrors.Errorf("marshal owner groups: %w", err)
		}

		ownerRbacRoles, err := json.Marshal(metadata.GetWorkspaceOwnerRbacRoles())
		if err != nil {
		return nil, xerrors.Errorf("marshal owner rbac roles: %w", err)
		}

		env = append(env,
		"CODER_AGENT_URL="+metadata.GetCoderUrl(),
		"CODER_WORKSPACE_TRANSITION="+strings.ToLower(metadata.GetWorkspaceTransition().String()),
Expand All		@@ -254,6 +259,7 @@ func provisionEnv(
		"CODER_WORKSPACE_OWNER_SSH_PUBLIC_KEY="+metadata.GetWorkspaceOwnerSshPublicKey(),
		"CODER_WORKSPACE_OWNER_SSH_PRIVATE_KEY="+metadata.GetWorkspaceOwnerSshPrivateKey(),
		"CODER_WORKSPACE_OWNER_LOGIN_TYPE="+metadata.GetWorkspaceOwnerLoginType(),
		"CODER_WORKSPACE_OWNER_RBAC_ROLES="+string(ownerRbacRoles),
		"CODER_WORKSPACE_ID="+metadata.GetWorkspaceId(),
		"CODER_WORKSPACE_OWNER_ID="+metadata.GetWorkspaceOwnerId(),
		"CODER_WORKSPACE_OWNER_SESSION_TOKEN="+metadata.GetWorkspaceOwnerSessionToken(),
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -764,6 +764,53 @@ func TestProvision(t *testing.T) {
		}},
		},
		},
		{
		Name: "workspace-owner-rbac-roles",
		SkipReason: "field will be added in provider version 2.2.0",
		Files: map[string]string{
		"main.tf": `terraform {
		required_providers {
		coder = {
		source = "coder/coder"
		version = "2.2.0"
		}
		}
		}

		resource "null_resource" "example" {}
		data "coder_workspace_owner" "me" {}
		resource "coder_metadata" "example" {
		resource_id = null_resource.example.id
		item {
		key = "rbac_roles_name"
		value = data.coder_workspace_owner.me.rbac_roles[0].name
		}
		item {
		key = "rbac_roles_org_id"
		value = data.coder_workspace_owner.me.rbac_roles[0].org_id
		}
		}
		`,
		},
		Request: &proto.PlanRequest{
		Metadata: &proto.Metadata{
		WorkspaceOwnerRbacRoles: []*proto.Role{{Name: "member", OrgId: ""}},
		},
		},
		Response: &proto.PlanComplete{
		Resources: []*proto.Resource{{
		Name: "example",
		Type: "null_resource",
		Metadata: []*proto.Resource_Metadata{{
		Key: "rbac_roles_name",
		Value: "member",
		}, {
		Key: "rbac_roles_org_id",
		Value: "",
		}},
		}},
		},
		},
		}

		for _, testCase := range testCases {
Expand Down