Mar 25, 2025 · Mar 12, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025
diff --git a/cli/server.go b/cli/server.go

 if defaultEligibleNotSet {
 // nolint:gocritic // User count requires system privileges
 userCount, err := db.GetUserCount(dbauthz.AsSystemRestricted(ctx))
 userCount, err := db.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)
 if err != nil {
 return nil, xerrors.Errorf("get user count: %w", err)
 }
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return update(q.log, q.auth, fetch, q.db.ActivityBumpWorkspace)(ctx, arg)
 }

 func (q *querier) AllUserIDs(ctx context.Context) ([]uuid.UUID, error) {
 func (q *querier) AllUserIDs(ctx context.Context, includeSystem bool) ([]uuid.UUID, error) {
 // Although this technically only reads users, only system-related functions should be
 // allowed to call this.
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 }
 return q.db.AllUserIDs(ctx)
 return q.db.AllUserIDs(ctx, includeSystem)
 }

 func (q *querier) ArchiveUnusedTemplateVersions(ctx context.Context, arg database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {

 func (q *querier) DeleteOrganizationMember(ctx context.Context, arg database.DeleteOrganizationMemberParams) error {
 return deleteQ[database.OrganizationMember](q.log, q.auth, func(ctx context.Context, arg database.DeleteOrganizationMemberParams) (database.OrganizationMember, error) {
 member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams(arg)))
 member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
 OrganizationID: arg.OrganizationID,
 UserID:         arg.UserID,
 IncludeSystem:  false,
 }))
 if err != nil {
 return database.OrganizationMember{}, err
 }
 return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetAPIKeysLastUsedAfter)(ctx, lastUsed)
 }

 func (q *querier) GetActiveUserCount(ctx context.Context) (int64, error) {
 func (q *querier) GetActiveUserCount(ctx context.Context, includeSystem bool) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return 0, err
 }
 return q.db.GetActiveUserCount(ctx)
 return q.db.GetActiveUserCount(ctx, includeSystem)
 }

 func (q *querier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
 return fetch(q.log, q.auth, q.db.GetGroupByOrgAndName)(ctx, arg)
 }

 func (q *querier) GetGroupMembers(ctx context.Context) ([]database.GroupMember, error) {
 func (q *querier) GetGroupMembers(ctx context.Context, includeSystem bool) ([]database.GroupMember, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 }
 return q.db.GetGroupMembers(ctx)
 return q.db.GetGroupMembers(ctx, includeSystem)
 }

 func (q *querier) GetGroupMembersByGroupID(ctx context.Context,id uuid.UUID) ([]database.GroupMember, error) {
 return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetGroupMembersByGroupID)(ctx,id)
 func (q *querier) GetGroupMembersByGroupID(ctx context.Context,arg database.GetGroupMembersByGroupIDParams) ([]database.GroupMember, error) {
 return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetGroupMembersByGroupID)(ctx,arg)
 }

 func (q *querier) GetGroupMembersCountByGroupID(ctx context.Context,groupID uuid.UUID) (int64, error) {
 if _, err := q.GetGroupByID(ctx,groupID); err != nil { // AuthZ check
 func (q *querier) GetGroupMembersCountByGroupID(ctx context.Context,arg database.GetGroupMembersCountByGroupIDParams) (int64, error) {
 if _, err := q.GetGroupByID(ctx,arg.GroupID); err != nil { // AuthZ check
 return 0, err
 }
 memberCount, err := q.db.GetGroupMembersCountByGroupID(ctx,groupID)
 memberCount, err := q.db.GetGroupMembersCountByGroupID(ctx,arg)
 if err != nil {
 return 0, err
 }
 return fetch(q.log, q.auth, q.db.GetUserByID)(ctx, id)
 }

 func (q *querier) GetUserCount(ctx context.Context) (int64, error) {
 func (q *querier) GetUserCount(ctx context.Context, includeSystem bool) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return 0, err
 }
 return q.db.GetUserCount(ctx)
 return q.db.GetUserCount(ctx, includeSystem)
 }

 func (q *querier) GetUserLatencyInsights(ctx context.Context, arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow, error) {
 member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
 OrganizationID: arg.OrgID,
 UserID:         arg.UserID,
 IncludeSystem:  false,
 }))
 if err != nil {
 return database.OrganizationMember{}, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 g := dbgen.Group(s.T(), db, database.Group{})
 u := dbgen.User(s.T(), db, database.User{})
 gm := dbgen.GroupMember(s.T(), db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
 check.Args(g.ID).Asserts(gm, policy.ActionRead)
 check.Args(database.GetGroupMembersByGroupIDParams{
 GroupID:       g.ID,
 IncludeSystem: false,
 }).Asserts(gm, policy.ActionRead)
 }))
 s.Run("GetGroupMembersCountByGroupID", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 g := dbgen.Group(s.T(), db, database.Group{})
 check.Args(g.ID).Asserts(g, policy.ActionRead)
 check.Args(database.GetGroupMembersCountByGroupIDParams{
 GroupID:       g.ID,
 IncludeSystem: false,
 }).Asserts(g, policy.ActionRead)
 }))
 s.Run("GetGroupMembers", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 g := dbgen.Group(s.T(), db, database.Group{})
 u := dbgen.User(s.T(), db, database.User{})
 dbgen.GroupMember(s.T(), db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
 check.Asserts(rbac.ResourceSystem, policy.ActionRead)
 check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead)
 }))
 s.Run("System/GetGroups", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 s.Run("AllUserIDs", s.Subtest(func(db database.Store, check *expects) {
 a := dbgen.User(s.T(), db, database.User{})
 b := dbgen.User(s.T(), db, database.User{})
 check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(slice.New(a.ID, b.ID))
 check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(slice.New(a.ID, b.ID))
 }))
 s.Run("CustomRoles", s.Subtest(func(db database.Store, check *expects) {
 check.Args(database.CustomRolesParams{}).Asserts(rbac.ResourceAssignRole, policy.ActionRead).Returns([]database.CustomRole{})
 check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead)
 }))
 s.Run("GetActiveUserCount", s.Subtest(func(db database.Store, check *expects) {
 check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
 check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
 }))
 s.Run("GetUnexpiredLicenses", s.Subtest(func(db database.Store, check *expects) {
 check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead)
 check.Args(time.Now().Add(time.Hour*-1)).Asserts(rbac.ResourceSystem, policy.ActionRead)
 }))
 s.Run("GetUserCount", s.Subtest(func(db database.Store, check *expects) {
 check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
 check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
 }))
 s.Run("GetTemplates", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
diff --git a/coderd/database/dbauthz/groupsauth_test.go b/coderd/database/dbauthz/groupsauth_test.go
 require.Error(t, err, "group read")
 }

 members, err := db.GetGroupMembersByGroupID(actorCtx, group.ID)
 members, err := db.GetGroupMembersByGroupID(actorCtx, database.GetGroupMembersByGroupIDParams{
 GroupID:       group.ID,
 IncludeSystem: false,
 })
 if tc.ReadMembers {
 require.NoError(t, err, "member read")
 require.Len(t, members, tc.MembersExpected, "member count found does not match")
diff --git a/coderd/database/dbgen/dbgen_test.go b/coderd/database/dbgen/dbgen_test.go
 gm := dbgen.GroupMember(t, db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
 exp := []database.GroupMember{gm}

 require.Equal(t, exp, must(db.GetGroupMembersByGroupID(context.Background(), g.ID)))
 require.Equal(t, exp, must(db.GetGroupMembersByGroupID(context.Background(), database.GetGroupMembersByGroupIDParams{
 GroupID:       g.ID,
 IncludeSystem: false,
 })))
 })

 t.Run("Organization", func(t *testing.T) {
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 "golang.org/x/xerrors"

 "github.com/coder/coder/v2/coderd/notifications/types"
 "github.com/coder/coder/v2/coderd/prebuilds"

 "github.com/coder/coder/v2/coderd/database"
 "github.com/coder/coder/v2/coderd/database/dbtime"
 panic(xerrors.Errorf("failed to create psk provisioner key: %w", err))
 }

 q.mutex.Lock()
 // We can't insert this user using the interface, because it's a system user.
 q.data.users = append(q.data.users, database.User{
 ID:             prebuilds.SystemUserID,
 Email:          "prebuilds@coder.com",
 Username:       "prebuilds",
 CreatedAt:      dbtime.Now(),
 UpdatedAt:      dbtime.Now(),
 Status:         "active",
 LoginType:      "none",
 HashedPassword: []byte{},
 IsSystem:       true,
 Deleted:        false,
 })
 q.mutex.Unlock()

 return q
 }

 Deleted:        u.Deleted,
 LastSeenAt:     u.LastSeenAt,
 Count:          count,
 IsSystem:       u.IsSystem,
 }
 }

 return sql.ErrNoRows
 }

 func (q *FakeQuerier) AllUserIDs(_ context.Context) ([]uuid.UUID, error) {
 // nolint:revive // It's not a control flag, it's a filter.
 func (q *FakeQuerier) AllUserIDs(_ context.Context, includeSystem bool) ([]uuid.UUID, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 userIDs := make([]uuid.UUID, 0, len(q.users))
 for idx := range q.users {
 if !includeSystem && q.users[idx].IsSystem {
 continue
 }

 userIDs = append(userIDs, q.users[idx].ID)
 }
 return userIDs, nil
 return apiKeys, nil
 }

 func (q *FakeQuerier) GetActiveUserCount(_ context.Context) (int64, error) {
 // nolint:revive // It's not a control flag, it's a filter.
 func (q *FakeQuerier) GetActiveUserCount(_ context.Context, includeSystem bool) (int64, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 active := int64(0)
 for _, u := range q.users {
 if !includeSystem && u.IsSystem {
 continue
 }

 if u.Status == database.UserStatusActive && !u.Deleted {
 active++
 }
 return database.Group{}, sql.ErrNoRows
 }

 func (q *FakeQuerier) GetGroupMembers(ctx context.Context) ([]database.GroupMember, error) {
 //nolint:revive // It's not a control flag, its a filter
 func (q *FakeQuerier) GetGroupMembers(ctx context.Context, includeSystem bool) ([]database.GroupMember, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 members := make([]database.GroupMemberTable, 0, len(q.groupMembers))
 members = append(members, q.groupMembers...)
 for _, org := range q.organizations {
 for _, user := range q.users {
 if !includeSystem && user.IsSystem {
 continue
 }
 members = append(members, database.GroupMemberTable{
 UserID:  user.ID,
 GroupID: org.ID,
 return groupMembers, nil
 }

 func (q *FakeQuerier) GetGroupMembersByGroupID(ctx context.Context,id uuid.UUID) ([]database.GroupMember, error) {
 func (q *FakeQuerier) GetGroupMembersByGroupID(ctx context.Context,arg database.GetGroupMembersByGroupIDParams) ([]database.GroupMember, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 if q.isEveryoneGroup(id) {
 return q.getEveryoneGroupMembersNoLock(ctx,id), nil
 if q.isEveryoneGroup(arg.GroupID) {
 return q.getEveryoneGroupMembersNoLock(ctx,arg.GroupID), nil
 }

 var groupMembers []database.GroupMember
 for _, member := range q.groupMembers {
 if member.GroupID ==id {
 if member.GroupID ==arg.GroupID {
 groupMember, err := q.getGroupMemberNoLock(ctx, member.UserID, member.GroupID)
 if errors.Is(err, errUserDeleted) {
 continue
 return groupMembers, nil
 }

 func (q *FakeQuerier) GetGroupMembersCountByGroupID(ctx context.Context,groupID uuid.UUID) (int64, error) {
 users, err := q.GetGroupMembersByGroupID(ctx,groupID)
 func (q *FakeQuerier) GetGroupMembersCountByGroupID(ctx context.Context,arg database.GetGroupMembersCountByGroupIDParams) (int64, error) {
 users, err := q.GetGroupMembersByGroupID(ctx,database.GetGroupMembersByGroupIDParams(arg))
 if err != nil {
 return 0, err
 }
 return q.getUserByIDNoLock(id)
 }

 func (q *FakeQuerier) GetUserCount(_ context.Context) (int64, error) {
 // nolint:revive // It's not a control flag, it's a filter.
 func (q *FakeQuerier) GetUserCount(_ context.Context, includeSystem bool) (int64, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 existing := int64(0)
 for _, u := range q.users {
 if !includeSystem && u.IsSystem {
 continue
 }
 if !u.Deleted {
 existing++
 }
 users = usersFilteredByLastSeen
 }

 if !params.IncludeSystem {
 users = slices.DeleteFunc(users, func(u database.User) bool {
 return u.IsSystem
 })
 }

 if params.GithubComUserID != 0 {
 usersFilteredByGithubComUserID := make([]database.User, 0, len(users))
 for i, user := range users {
 Status:         status,
 RBACRoles:      arg.RBACRoles,
 LoginType:      arg.LoginType,
 IsSystem:       false,
 }
 q.users = append(q.users, user)
 sort.Slice(q.users, func(i, j int) bool {

 var updated []database.UpdateInactiveUsersToDormantRow
 for index, user := range q.users {
 if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter) {
 if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter)&& !user.IsSystem{
 q.users[index].Status = database.UserStatusDormant
 q.users[index].UpdatedAt = params.UpdatedAt
 updated = append(updated, database.UpdateInactiveUsersToDormantRow{
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1894,7 +1894,7 @@ func getGithubOAuth2ConfigParams(ctx context.Context, db database.Store, vals *c

		if defaultEligibleNotSet {
		// nolint:gocritic // User count requires system privileges
		userCount, err := db.GetUserCount(dbauthz.AsSystemRestricted(ctx))
		userCount, err := db.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)
		if err != nil {
		return nil, xerrors.Errorf("get user count: %w", err)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1057,13 +1057,13 @@ func (q *querier) ActivityBumpWorkspace(ctx context.Context, arg database.Activi
		return update(q.log, q.auth, fetch, q.db.ActivityBumpWorkspace)(ctx, arg)
		}

		func (q *querier) AllUserIDs(ctx context.Context) ([]uuid.UUID, error) {
		func (q *querier) AllUserIDs(ctx context.Context, includeSystem bool) ([]uuid.UUID, error) {
		// Although this technically only reads users, only system-related functions should be
		// allowed to call this.
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
		}
		return q.db.AllUserIDs(ctx)
		return q.db.AllUserIDs(ctx, includeSystem)
		}

		func (q *querier) ArchiveUnusedTemplateVersions(ctx context.Context, arg database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
Expand DownExpand Up		@@ -1316,7 +1316,11 @@ func (q *querier) DeleteOldWorkspaceAgentStats(ctx context.Context) error {

		func (q *querier) DeleteOrganizationMember(ctx context.Context, arg database.DeleteOrganizationMemberParams) error {
		return deleteQ[database.OrganizationMember](q.log, q.auth, func(ctx context.Context, arg database.DeleteOrganizationMemberParams) (database.OrganizationMember, error) {
		member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams(arg)))
		member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
		OrganizationID: arg.OrganizationID,
		UserID: arg.UserID,
		IncludeSystem: false,
		}))
		if err != nil {
		return database.OrganizationMember{}, err
		}
Expand DownExpand Up		@@ -1502,11 +1506,11 @@ func (q *querier) GetAPIKeysLastUsedAfter(ctx context.Context, lastUsed time.Tim
		return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetAPIKeysLastUsedAfter)(ctx, lastUsed)
		}

		func (q *querier) GetActiveUserCount(ctx context.Context) (int64, error) {
		func (q *querier) GetActiveUserCount(ctx context.Context, includeSystem bool) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return 0, err
		}
		return q.db.GetActiveUserCount(ctx)
		return q.db.GetActiveUserCount(ctx, includeSystem)
		}

		func (q *querier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
Expand DownExpand Up		@@ -1737,22 +1741,22 @@ func (q *querier) GetGroupByOrgAndName(ctx context.Context, arg database.GetGrou
		return fetch(q.log, q.auth, q.db.GetGroupByOrgAndName)(ctx, arg)
		}

		func (q *querier) GetGroupMembers(ctx context.Context) ([]database.GroupMember, error) {
		func (q *querier) GetGroupMembers(ctx context.Context, includeSystem bool) ([]database.GroupMember, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
		}
		return q.db.GetGroupMembers(ctx)
		return q.db.GetGroupMembers(ctx, includeSystem)
		}

		func (q *querier) GetGroupMembersByGroupID(ctx context.Context,id uuid.UUID) ([]database.GroupMember, error) {
		return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetGroupMembersByGroupID)(ctx,id)
		func (q *querier) GetGroupMembersByGroupID(ctx context.Context,arg database.GetGroupMembersByGroupIDParams) ([]database.GroupMember, error) {
		return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetGroupMembersByGroupID)(ctx,arg)
		}

		func (q *querier) GetGroupMembersCountByGroupID(ctx context.Context,groupID uuid.UUID) (int64, error) {
		if _, err := q.GetGroupByID(ctx,groupID); err != nil { // AuthZ check
		func (q *querier) GetGroupMembersCountByGroupID(ctx context.Context,arg database.GetGroupMembersCountByGroupIDParams) (int64, error) {
		if _, err := q.GetGroupByID(ctx,arg.GroupID); err != nil { // AuthZ check
		return 0, err
		}
		memberCount, err := q.db.GetGroupMembersCountByGroupID(ctx,groupID)
		memberCount, err := q.db.GetGroupMembersCountByGroupID(ctx,arg)
		if err != nil {
		return 0, err
		}
Expand DownExpand Up		@@ -2530,11 +2534,11 @@ func (q *querier) GetUserByID(ctx context.Context, id uuid.UUID) (database.User,
		return fetch(q.log, q.auth, q.db.GetUserByID)(ctx, id)
		}

		func (q *querier) GetUserCount(ctx context.Context) (int64, error) {
		func (q *querier) GetUserCount(ctx context.Context, includeSystem bool) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return 0, err
		}
		return q.db.GetUserCount(ctx)
		return q.db.GetUserCount(ctx, includeSystem)
		}

		func (q *querier) GetUserLatencyInsights(ctx context.Context, arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow, error) {
Expand DownExpand Up		@@ -3778,6 +3782,7 @@ func (q *querier) UpdateMemberRoles(ctx context.Context, arg database.UpdateMemb
		member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
		OrganizationID: arg.OrgID,
		UserID: arg.UserID,
		IncludeSystem: false,
		}))
		if err != nil {
		return database.OrganizationMember{}, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -387,19 +387,25 @@ func (s *MethodTestSuite) TestGroup() {
		g := dbgen.Group(s.T(), db, database.Group{})
		u := dbgen.User(s.T(), db, database.User{})
		gm := dbgen.GroupMember(s.T(), db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
		check.Args(g.ID).Asserts(gm, policy.ActionRead)
		check.Args(database.GetGroupMembersByGroupIDParams{
		GroupID: g.ID,
		IncludeSystem: false,
		}).Asserts(gm, policy.ActionRead)
		}))
		s.Run("GetGroupMembersCountByGroupID", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
		g := dbgen.Group(s.T(), db, database.Group{})
		check.Args(g.ID).Asserts(g, policy.ActionRead)
		check.Args(database.GetGroupMembersCountByGroupIDParams{
		GroupID: g.ID,
		IncludeSystem: false,
		}).Asserts(g, policy.ActionRead)
		}))
		s.Run("GetGroupMembers", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
		g := dbgen.Group(s.T(), db, database.Group{})
		u := dbgen.User(s.T(), db, database.User{})
		dbgen.GroupMember(s.T(), db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
		check.Asserts(rbac.ResourceSystem, policy.ActionRead)
		check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead)
		}))
		s.Run("System/GetGroups", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -1681,7 +1687,7 @@ func (s *MethodTestSuite) TestUser() {
		s.Run("AllUserIDs", s.Subtest(func(db database.Store, check *expects) {
		a := dbgen.User(s.T(), db, database.User{})
		b := dbgen.User(s.T(), db, database.User{})
		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(slice.New(a.ID, b.ID))
		check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(slice.New(a.ID, b.ID))
		}))
		s.Run("CustomRoles", s.Subtest(func(db database.Store, check *expects) {
		check.Args(database.CustomRolesParams{}).Asserts(rbac.ResourceAssignRole, policy.ActionRead).Returns([]database.CustomRole{})
Expand DownExpand Up		@@ -3696,7 +3702,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead)
		}))
		s.Run("GetActiveUserCount", s.Subtest(func(db database.Store, check *expects) {
		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
		check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
		}))
		s.Run("GetUnexpiredLicenses", s.Subtest(func(db database.Store, check *expects) {
		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead)
Expand DownExpand Up		@@ -3739,7 +3745,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		check.Args(time.Now().Add(time.Hour*-1)).Asserts(rbac.ResourceSystem, policy.ActionRead)
		}))
		s.Run("GetUserCount", s.Subtest(func(db database.Store, check *expects) {
		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
		check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
		}))
		s.Run("GetTemplates", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -147,7 +147,10 @@ func TestGroupsAuth(t *testing.T) {
		require.Error(t, err, "group read")
		}

		members, err := db.GetGroupMembersByGroupID(actorCtx, group.ID)
		members, err := db.GetGroupMembersByGroupID(actorCtx, database.GetGroupMembersByGroupIDParams{
		GroupID: group.ID,
		IncludeSystem: false,
		})
		if tc.ReadMembers {
		require.NoError(t, err, "member read")
		require.Len(t, members, tc.MembersExpected, "member count found does not match")
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -105,7 +105,10 @@ func TestGenerator(t *testing.T) {
		gm := dbgen.GroupMember(t, db, database.GroupMemberTable{GroupID: g.ID, UserID: u.ID})
		exp := []database.GroupMember{gm}

		require.Equal(t, exp, must(db.GetGroupMembersByGroupID(context.Background(), g.ID)))
		require.Equal(t, exp, must(db.GetGroupMembersByGroupID(context.Background(), database.GetGroupMembersByGroupIDParams{
		GroupID: g.ID,
		IncludeSystem: false,
		})))
		})

		t.Run("Organization", func(t *testing.T) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -23,6 +23,7 @@ import (
		"golang.org/x/xerrors"

		"github.com/coder/coder/v2/coderd/notifications/types"
		"github.com/coder/coder/v2/coderd/prebuilds"

		"github.com/coder/coder/v2/coderd/database"
		"github.com/coder/coder/v2/coderd/database/dbtime"
Expand DownExpand Up		@@ -154,6 +155,22 @@ func New() database.Store {
		panic(xerrors.Errorf("failed to create psk provisioner key: %w", err))
		}

		q.mutex.Lock()
		// We can't insert this user using the interface, because it's a system user.
		q.data.users = append(q.data.users, database.User{
		ID: prebuilds.SystemUserID,
		Email: "prebuilds@coder.com",
		Username: "prebuilds",
		CreatedAt: dbtime.Now(),
		UpdatedAt: dbtime.Now(),
		Status: "active",
		LoginType: "none",
		HashedPassword: []byte{},
		IsSystem: true,
		Deleted: false,
		})
		q.mutex.Unlock()

		return q
		}

Expand DownExpand Up		@@ -442,6 +459,7 @@ func convertUsers(users []database.User, count int64) []database.GetUsersRow {
		Deleted: u.Deleted,
		LastSeenAt: u.LastSeenAt,
		Count: count,
		IsSystem: u.IsSystem,
		}
		}

Expand DownExpand Up		@@ -1554,11 +1572,16 @@ func (q *FakeQuerier) ActivityBumpWorkspace(ctx context.Context, arg database.Ac
		return sql.ErrNoRows
		}

		func (q *FakeQuerier) AllUserIDs(_ context.Context) ([]uuid.UUID, error) {
		// nolint:revive // It's not a control flag, it's a filter.
		func (q *FakeQuerier) AllUserIDs(_ context.Context, includeSystem bool) ([]uuid.UUID, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
		userIDs := make([]uuid.UUID, 0, len(q.users))
		for idx := range q.users {
		if !includeSystem && q.users[idx].IsSystem {
		continue
		}

		userIDs = append(userIDs, q.users[idx].ID)
		}
		return userIDs, nil
Expand DownExpand Up		@@ -2649,12 +2672,17 @@ func (q *FakeQuerier) GetAPIKeysLastUsedAfter(_ context.Context, after time.Time
		return apiKeys, nil
		}

		func (q *FakeQuerier) GetActiveUserCount(_ context.Context) (int64, error) {
		// nolint:revive // It's not a control flag, it's a filter.
		func (q *FakeQuerier) GetActiveUserCount(_ context.Context, includeSystem bool) (int64, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		active := int64(0)
		for _, u := range q.users {
		if !includeSystem && u.IsSystem {
		continue
		}

		if u.Status == database.UserStatusActive && !u.Deleted {
		active++
		}
Expand DownExpand Up		@@ -3390,14 +3418,18 @@ func (q *FakeQuerier) GetGroupByOrgAndName(_ context.Context, arg database.GetGr
		return database.Group{}, sql.ErrNoRows
		}

		func (q *FakeQuerier) GetGroupMembers(ctx context.Context) ([]database.GroupMember, error) {
		//nolint:revive // It's not a control flag, its a filter
		func (q *FakeQuerier) GetGroupMembers(ctx context.Context, includeSystem bool) ([]database.GroupMember, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		members := make([]database.GroupMemberTable, 0, len(q.groupMembers))
		members = append(members, q.groupMembers...)
		for _, org := range q.organizations {
		for _, user := range q.users {
		if !includeSystem && user.IsSystem {
		continue
		}
		members = append(members, database.GroupMemberTable{
		UserID: user.ID,
		GroupID: org.ID,
Expand All		@@ -3420,17 +3452,17 @@ func (q *FakeQuerier) GetGroupMembers(ctx context.Context) ([]database.GroupMemb
		return groupMembers, nil
		}

		func (q *FakeQuerier) GetGroupMembersByGroupID(ctx context.Context,id uuid.UUID) ([]database.GroupMember, error) {
		func (q *FakeQuerier) GetGroupMembersByGroupID(ctx context.Context,arg database.GetGroupMembersByGroupIDParams) ([]database.GroupMember, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		if q.isEveryoneGroup(id) {
		return q.getEveryoneGroupMembersNoLock(ctx,id), nil
		if q.isEveryoneGroup(arg.GroupID) {
		return q.getEveryoneGroupMembersNoLock(ctx,arg.GroupID), nil
		}

		var groupMembers []database.GroupMember
		for _, member := range q.groupMembers {
		if member.GroupID ==id {
		if member.GroupID ==arg.GroupID {
		groupMember, err := q.getGroupMemberNoLock(ctx, member.UserID, member.GroupID)
		if errors.Is(err, errUserDeleted) {
		continue
Expand All		@@ -3445,8 +3477,8 @@ func (q *FakeQuerier) GetGroupMembersByGroupID(ctx context.Context, id uuid.UUID
		return groupMembers, nil
		}

		func (q *FakeQuerier) GetGroupMembersCountByGroupID(ctx context.Context,groupID uuid.UUID) (int64, error) {
		users, err := q.GetGroupMembersByGroupID(ctx,groupID)
		func (q *FakeQuerier) GetGroupMembersCountByGroupID(ctx context.Context,arg database.GetGroupMembersCountByGroupIDParams) (int64, error) {
		users, err := q.GetGroupMembersByGroupID(ctx,database.GetGroupMembersByGroupIDParams(arg))
		if err != nil {
		return 0, err
		}
Expand DownExpand Up		@@ -6223,12 +6255,16 @@ func (q *FakeQuerier) GetUserByID(_ context.Context, id uuid.UUID) (database.Use
		return q.getUserByIDNoLock(id)
		}

		func (q *FakeQuerier) GetUserCount(_ context.Context) (int64, error) {
		// nolint:revive // It's not a control flag, it's a filter.
		func (q *FakeQuerier) GetUserCount(_ context.Context, includeSystem bool) (int64, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		existing := int64(0)
		for _, u := range q.users {
		if !includeSystem && u.IsSystem {
		continue
		}
		if !u.Deleted {
		existing++
		}
Expand DownExpand Up		@@ -6580,6 +6616,12 @@ func (q *FakeQuerier) GetUsers(_ context.Context, params database.GetUsersParams
		users = usersFilteredByLastSeen
		}

		if !params.IncludeSystem {
		users = slices.DeleteFunc(users, func(u database.User) bool {
		return u.IsSystem
		})
		}

		if params.GithubComUserID != 0 {
		usersFilteredByGithubComUserID := make([]database.User, 0, len(users))
		for i, user := range users {
Expand DownExpand Up		@@ -8933,6 +8975,7 @@ func (q *FakeQuerier) InsertUser(_ context.Context, arg database.InsertUserParam
		Status: status,
		RBACRoles: arg.RBACRoles,
		LoginType: arg.LoginType,
		IsSystem: false,
		}
		q.users = append(q.users, user)
		sort.Slice(q.users, func(i, j int) bool {
Expand DownExpand Up		@@ -10091,7 +10134,7 @@ func (q *FakeQuerier) UpdateInactiveUsersToDormant(_ context.Context, params dat

		var updated []database.UpdateInactiveUsersToDormantRow
		for index, user := range q.users {
		if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter) {
		if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter)&& !user.IsSystem{
		q.users[index].Status = database.UserStatusDormant
		q.users[index].UpdatedAt = params.UpdatedAt
		updated = append(updated, database.UpdateInactiveUsersToDormantRow{
Expand Down