Apr 7, 2025 · Mar 12, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go

 "cdr.dev/slog"

 "github.com/coder/coder/v2/coderd/prebuilds"
 "github.com/coder/coder/v2/coderd/rbac/policy"
 "github.com/coder/coder/v2/coderd/rbac/rolestore"

 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()

 subjectPrebuildsOrchestrator = rbac.Subject{
 FriendlyName: "Prebuilds Orchestrator",
 ID:           prebuilds.OwnerID.String(),
 Roles: rbac.Roles([]rbac.Role{
 {
 Identifier:  rbac.RoleIdentifier{Name: "prebuilds-orchestrator"},
 DisplayName: "Coder",
 Site: rbac.Permissions(map[string][]policy.Action{
 // May use template, read template-related info, & insert template-related resources (preset prebuilds).
 rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionUse},
 // May CRUD workspaces, and start/stop them.
 rbac.ResourceWorkspace.Type: {
 policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
 policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
 },
 }),
 },
 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()
 )

 // AsProvisionerd returns a context with an actor that has permissions required
 return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
 }

 // AsPrebuildsOrchestrator returns a context with an actor that has permissions
 // to read orchestrator workspace prebuilds.
 func AsPrebuildsOrchestrator(ctx context.Context) context.Context {
 return context.WithValue(ctx, authContextKey{}, subjectPrebuildsOrchestrator)
 }

 var AsRemoveActor = rbac.Subject{
 ID: "remove-actor",
 }
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000301_system_user.down.sql b/coderd/database/migrations/000301_system_user.down.sql
 -- Remove system user from organizations
 DELETE FROM organization_members
 WHERE user_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0';

 -- Drop triggers first
 DROP TRIGGER IF EXISTS prevent_system_user_updates ON users;
 DROP TRIGGER IF EXISTS prevent_system_user_deletions ON users;

 -- Drop function
 DROP FUNCTION IF EXISTS prevent_system_user_changes();

 -- Delete system user
 DELETE FROM users
 WHERE id = 'c42fdf75-3097-471c-8c33-fb52454d81c0';

 -- Drop index
 DROP INDEX IF EXISTS user_is_system_idx;

 -- Drop column
 ALTER TABLE users DROP COLUMN IF EXISTS is_system;
diff --git a/coderd/database/migrations/000301_system_user.up.sql b/coderd/database/migrations/000301_system_user.up.sql
 ALTER TABLE users
 ADD COLUMN is_system bool DEFAULT false;

 CREATE INDEX user_is_system_idx ON users USING btree (is_system);

 COMMENT ON COLUMN users.is_system IS 'Determines if a user is a system user, and therefore cannot login or perform normal actions';

 -- TODO: tried using "none" for login type, but the migration produced this error: 'unsafe use of new value "none" of enum type login_type'
 --   -> not sure why though? it exists on the login_type enum.
 INSERT INTO users (id, email, username, name, created_at, updated_at, status, rbac_roles, hashed_password, is_system, login_type)
 VALUES ('c42fdf75-3097-471c-8c33-fb52454d81c0', 'prebuilds@system', 'prebuilds', 'Prebuilds Owner', now(), now(),
 'active', '{}', 'none', true, 'password'::login_type);

 -- Create function to check system user modifications
 CREATE OR REPLACE FUNCTION prevent_system_user_changes()
 RETURNS TRIGGER AS
 $$
 BEGIN
 IF OLD.is_system = true THEN
 RAISE EXCEPTION 'Cannot modify or delete system users';
 END IF;
 RETURN OLD;
 END;
 $$ LANGUAGE plpgsql;

 -- Create trigger to prevent updates to system users
 CREATE TRIGGER prevent_system_user_updates
 BEFORE UPDATE ON users
 FOR EACH ROW
 WHEN (OLD.is_system = true)
 EXECUTE FUNCTION prevent_system_user_changes();

 -- Create trigger to prevent deletion of system users
 CREATE TRIGGER prevent_system_user_deletions
 BEFORE DELETE ON users
 FOR EACH ROW
 WHEN (OLD.is_system = true)
 EXECUTE FUNCTION prevent_system_user_changes();

 -- TODO: do we *want* to use the default org here? how do we handle multi-org?
 WITH default_org AS (SELECT id
 FROM organizations
 WHERE is_default = true
 LIMIT 1)
 INSERT
 INTO organization_members (organization_id, user_id, created_at, updated_at)
 SELECT default_org.id,
   'c42fdf75-3097-471c-8c33-fb52454d81c0', -- The system user responsible for prebuilds.
   NOW(),
   NOW()
 FROM default_org;
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
 AvatarURL:      r.AvatarURL,
 Deleted:        r.Deleted,
 LastSeenAt:     r.LastSeenAt,
 IsSystem:       r.IsSystem,
 }
 }

diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
 &i.GithubComUserID,
 &i.HashedOneTimePasscode,
 &i.OneTimePasscodeExpiresAt,
 &i.IsSystem,
 &i.Count,
 ); err != nil {
 return nil, err
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -18,6 +18,7 @@ import (

		"cdr.dev/slog"

		"github.com/coder/coder/v2/coderd/prebuilds"
		"github.com/coder/coder/v2/coderd/rbac/policy"
		"github.com/coder/coder/v2/coderd/rbac/rolestore"

Expand DownExpand Up		@@ -358,6 +359,27 @@ var (
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()

		subjectPrebuildsOrchestrator = rbac.Subject{
		FriendlyName: "Prebuilds Orchestrator",
		ID: prebuilds.OwnerID.String(),
		Roles: rbac.Roles([]rbac.Role{
		{
		Identifier: rbac.RoleIdentifier{Name: "prebuilds-orchestrator"},
		DisplayName: "Coder",
		Site: rbac.Permissions(map[string][]policy.Action{
		// May use template, read template-related info, & insert template-related resources (preset prebuilds).
		rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionUse},
		// May CRUD workspaces, and start/stop them.
		rbac.ResourceWorkspace.Type: {
		policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
		policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
		},
		}),
		},
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()
		)

		// AsProvisionerd returns a context with an actor that has permissions required
Expand DownExpand Up		@@ -412,6 +434,12 @@ func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
		}

		// AsPrebuildsOrchestrator returns a context with an actor that has permissions
		// to read orchestrator workspace prebuilds.
		func AsPrebuildsOrchestrator(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectPrebuildsOrchestrator)
		}

		var AsRemoveActor = rbac.Subject{
		ID: "remove-actor",
		}
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,20 @@
		-- Remove system user from organizations
		DELETE FROM organization_members
		WHERE user_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0';

		-- Drop triggers first
		DROP TRIGGER IF EXISTS prevent_system_user_updates ON users;
		DROP TRIGGER IF EXISTS prevent_system_user_deletions ON users;

		-- Drop function
		DROP FUNCTION IF EXISTS prevent_system_user_changes();

		-- Delete system user
		DELETE FROM users
		WHERE id = 'c42fdf75-3097-471c-8c33-fb52454d81c0';

		-- Drop index
		DROP INDEX IF EXISTS user_is_system_idx;

		-- Drop column
		ALTER TABLE users DROP COLUMN IF EXISTS is_system;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,51 @@
		ALTER TABLE users
		ADD COLUMN is_system bool DEFAULT false;

		CREATE INDEX user_is_system_idx ON users USING btree (is_system);

		COMMENT ON COLUMN users.is_system IS 'Determines if a user is a system user, and therefore cannot login or perform normal actions';

		-- TODO: tried using "none" for login type, but the migration produced this error: 'unsafe use of new value "none" of enum type login_type'
		-- -> not sure why though? it exists on the login_type enum.
		INSERT INTO users (id, email, username, name, created_at, updated_at, status, rbac_roles, hashed_password, is_system, login_type)
		VALUES ('c42fdf75-3097-471c-8c33-fb52454d81c0', 'prebuilds@system', 'prebuilds', 'Prebuilds Owner', now(), now(),
		'active', '{}', 'none', true, 'password'::login_type);

		-- Create function to check system user modifications
		CREATE OR REPLACE FUNCTION prevent_system_user_changes()
		RETURNS TRIGGER AS
		$$
		BEGIN
		IF OLD.is_system = true THEN
		RAISE EXCEPTION 'Cannot modify or delete system users';
		END IF;
		RETURN OLD;
		END;
		$$ LANGUAGE plpgsql;

		-- Create trigger to prevent updates to system users
		CREATE TRIGGER prevent_system_user_updates
		BEFORE UPDATE ON users
		FOR EACH ROW
		WHEN (OLD.is_system = true)
		EXECUTE FUNCTION prevent_system_user_changes();

		-- Create trigger to prevent deletion of system users
		CREATE TRIGGER prevent_system_user_deletions
		BEFORE DELETE ON users
		FOR EACH ROW
		WHEN (OLD.is_system = true)
		EXECUTE FUNCTION prevent_system_user_changes();

		-- TODO: do we want to use the default org here? how do we handle multi-org?
		WITH default_org AS (SELECT id
		FROM organizations
		WHERE is_default = true
		LIMIT 1)
		INSERT
		INTO organization_members (organization_id, user_id, created_at, updated_at)
		SELECT default_org.id,
		'c42fdf75-3097-471c-8c33-fb52454d81c0', -- The system user responsible for prebuilds.
		NOW(),
		NOW()
		FROM default_org;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -423,6 +423,7 @@ func ConvertUserRows(rows []GetUsersRow) []User {
		AvatarURL: r.AvatarURL,
		Deleted: r.Deleted,
		LastSeenAt: r.LastSeenAt,
		IsSystem: r.IsSystem,
		}
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -421,6 +421,7 @@ func (q *sqlQuerier) GetAuthorizedUsers(ctx context.Context, arg GetUsersParams,
		&i.GithubComUserID,
		&i.HashedOneTimePasscode,
		&i.OneTimePasscodeExpiresAt,
		&i.IsSystem,
		&i.Count,
		); err != nil {
		return nil, err
Expand Down