May 14, 2025 · May 14, 2025 · May 14, 2025 · May 14, 2025 · May 14, 2025 · May 14, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 // Provisionerd creates workspaces resources monitor
 rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionCreate},
 rbac.ResourceWorkspaceAgentDevcontainers.Type:   {policy.ActionCreate},
 // Provisionerd creates workspace agents
 rbac.ResourceWorkspaceAgent.Type: {policy.ActionCreate},
 }),
 Org:  map[string][]rbac.Permission{},
 User: []rbac.Permission{},
 rbac.ResourceUser.Type:                   rbac.ResourceUser.AvailableActions(),
 rbac.ResourceWorkspaceDormant.Type:       {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},
 rbac.ResourceWorkspace.Type:              {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionSSH},
 rbac.ResourceWorkspaceAgent.Type:         {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},
 rbac.ResourceWorkspaceProxy.Type:         {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
 rbac.ResourceDeploymentConfig.Type:       {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
 rbac.ResourceNotificationMessage.Type:    {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 // GetWorkspaceAgentsByResourceIDs
 // The workspace/job is already fetched.
 func (q *querier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgent, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgent); err != nil {
 return nil, err
 }
 return q.db.GetWorkspaceAgentsByResourceIDs(ctx, ids)
 }

 func (q *querier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, createdAt time.Time) ([]database.WorkspaceAgent, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgent); err != nil {
 return nil, err
 }
 return q.db.GetWorkspaceAgentsCreatedAfter(ctx, createdAt)
 }

 func (q *querier) InsertWorkspaceAgent(ctx context.Context, arg database.InsertWorkspaceAgentParams) (database.WorkspaceAgent, error) {
 if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
 if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgent); err != nil {
 return database.WorkspaceAgent{}, err
 }
 return q.db.InsertWorkspaceAgent(ctx, arg)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 s.Run("GetWorkspaceAgentsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 _ = dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{CreatedAt: time.Now().Add(-time.Hour)})
 check.Args(time.Now()).Asserts(rbac.ResourceSystem, policy.ActionRead)
 check.Args(time.Now()).Asserts(rbac.ResourceWorkspaceAgent, policy.ActionRead)
 }))
 s.Run("GetWorkspaceAppsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
 agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
 check.Args([]uuid.UUID{res.ID}).
 Asserts(rbac.ResourceSystem, policy.ActionRead).
 Asserts(rbac.ResourceWorkspaceAgent, policy.ActionRead).
 Returns([]database.WorkspaceAgent{agt})
 }))
 s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
 check.Args(database.InsertWorkspaceAgentParams{
 ID:   uuid.New(),
 Name: "dev",
 }).Asserts(rbac.ResourceSystem, policy.ActionCreate)
 }).Asserts(rbac.ResourceWorkspaceAgent, policy.ActionCreate)
 }))
 s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
 ActionCreate: actDef("create workspace agent devcontainers"),
 },
 },
 "workspace_agent": {
 Actions: map[Action]ActionDefinition{
 ActionRead:   actDef("read workspace agent"),
 ActionDelete: actDef("delete workspace agent"),
 ActionCreate: actDef("create workspace agent"),
 },
 },
 }
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
 },
 },
 },
 {
 Name:     "WorkspaceAgent",
 Actions:  []policy.Action{policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
 Resource: rbac.ResourceWorkspaceAgent,
 AuthorizeMap: map[bool][]hasAuthSubjects{
 true: {owner},
 false: {
 memberMe, orgMemberMe, otherOrgMember,
 orgAdmin, otherOrgAdmin,
 orgAuditor, otherOrgAuditor,
 templateAdmin, orgTemplateAdmin, otherOrgTemplateAdmin,
 userAdmin, orgUserAdmin, otherOrgUserAdmin,
 },
 },
 },
 // Members may read their own chats.
 {
 Name:     "CreateReadUpdateDeleteMyChats",
diff --git a/codersdk/rbacresources_gen.go b/codersdk/rbacresources_gen.go
diff --git a/docs/reference/api/members.md b/docs/reference/api/members.md
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/site/src/api/rbacresourcesGenerated.ts b/site/src/api/rbacresourcesGenerated.ts
 stop: "allows stopping a workspace",
 update: "edit workspace settings (scheduling, permissions, parameters)",
 },
 workspace_agent: {
 create: "create workspace agent",
 delete: "delete workspace agent",
 read: "read workspace agent",
 },
 workspace_agent_devcontainers: {
 create: "create workspace agent devcontainers",
 },
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
Original file line number	Diff line number	Diff line change
Expand Up		@@ -188,6 +188,8 @@ var (
		// Provisionerd creates workspaces resources monitor
		rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionCreate},
		rbac.ResourceWorkspaceAgentDevcontainers.Type: {policy.ActionCreate},
		// Provisionerd creates workspace agents
		rbac.ResourceWorkspaceAgent.Type: {policy.ActionCreate},
		}),
		Org: map[string][]rbac.Permission{},
		User: []rbac.Permission{},
Expand DownExpand Up		@@ -339,6 +341,7 @@ var (
		rbac.ResourceUser.Type: rbac.ResourceUser.AvailableActions(),
		rbac.ResourceWorkspaceDormant.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},
		rbac.ResourceWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionSSH},
		rbac.ResourceWorkspaceAgent.Type: {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},
		rbac.ResourceWorkspaceProxy.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
		rbac.ResourceDeploymentConfig.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
		rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
Expand DownExpand Up		@@ -3014,14 +3017,14 @@ func (q *querier) GetWorkspaceAgentUsageStatsAndLabels(ctx context.Context, crea
		// GetWorkspaceAgentsByResourceIDs
		// The workspace/job is already fetched.
		func (q *querier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgent, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgent); err != nil {
Copy link Member johnstcnMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I think this needs to be scoped by who ultimately "owns" the workspace agent (which is generally the owner of the associated workspace). Can a member read an owner's workspace agent? Can a member read another owner's workspace agent? Copy link ContributorAuthor DanielleMaywoodMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. You're absolutely right. As is, the change is status quo over the previous implementation but ultimately it would make more sense to make itbetter. Thanks 👍 johnstcn reacted with heart emoji
		return nil, err
		}
		return q.db.GetWorkspaceAgentsByResourceIDs(ctx, ids)
		}

		func (q *querier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, createdAt time.Time) ([]database.WorkspaceAgent, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgent); err != nil {
		return nil, err
		}
		return q.db.GetWorkspaceAgentsCreatedAfter(ctx, createdAt)
Expand DownExpand Up		@@ -3691,7 +3694,7 @@ func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorksp
		}

		func (q *querier) InsertWorkspaceAgent(ctx context.Context, arg database.InsertWorkspaceAgentParams) (database.WorkspaceAgent, error) {
		if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
		if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgent); err != nil {
Copy link Member johnstcnMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Can a member insert a workspace agent belonging to another user? Copy link ContributorAuthor DanielleMaywoodMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. This would possibly allow that, yes. I'll have a chat with@Emyrk to ensure that doesn't happen.
		return database.WorkspaceAgent{}, err
		}
		return q.db.InsertWorkspaceAgent(ctx, arg)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3870,7 +3870,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		s.Run("GetWorkspaceAgentsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
		_ = dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{CreatedAt: time.Now().Add(-time.Hour)})
		check.Args(time.Now()).Asserts(rbac.ResourceSystem, policy.ActionRead)
		check.Args(time.Now()).Asserts(rbac.ResourceWorkspaceAgent, policy.ActionRead)
		}))
		s.Run("GetWorkspaceAppsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -3972,7 +3972,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
		agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
		check.Args([]uuid.UUID{res.ID}).
		Asserts(rbac.ResourceSystem, policy.ActionRead).
		Asserts(rbac.ResourceWorkspaceAgent, policy.ActionRead).
		Returns([]database.WorkspaceAgent{agt})
		}))
		s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
Expand All		@@ -3988,7 +3988,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		check.Args(database.InsertWorkspaceAgentParams{
		ID: uuid.New(),
		Name: "dev",
		}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
		}).Asserts(rbac.ResourceWorkspaceAgent, policy.ActionCreate)
		}))
		s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -335,4 +335,11 @@ var RBACPermissions = map[string]PermissionDefinition{
		ActionCreate: actDef("create workspace agent devcontainers"),
		},
		},
		"workspace_agent": {
		Actions: map[Action]ActionDefinition{
		ActionRead: actDef("read workspace agent"),
		ActionDelete: actDef("delete workspace agent"),
Copy link Member johnstcnMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I don't think we actually ever delete workspace agents, so this istechnically not required (yet) Copy link ContributorAuthor DanielleMaywoodMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Correct, we don'tyet, although we will be in the upcoming devcontainer agents work. I'm happy to remove the`Delete` action now if that makes more sense? Copy link Member johnstcnMay 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. That's a great reason to leave it in :)
		ActionCreate: actDef("create workspace agent"),
		},
		},
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -831,6 +831,21 @@ func TestRolePermissions(t *testing.T) {
		},
		},
		},
		{
		Name: "WorkspaceAgent",
		Actions: []policy.Action{policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
		Resource: rbac.ResourceWorkspaceAgent,
		AuthorizeMap: map[bool][]hasAuthSubjects{
		true: {owner},
		false: {
		memberMe, orgMemberMe, otherOrgMember,
		orgAdmin, otherOrgAdmin,
		orgAuditor, otherOrgAuditor,
		templateAdmin, orgTemplateAdmin, otherOrgTemplateAdmin,
		userAdmin, orgUserAdmin, otherOrgUserAdmin,
		},
		},
		},
		// Members may read their own chats.
		{
		Name: "CreateReadUpdateDeleteMyChats",
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -178,6 +178,11 @@ export const RBACResourceActions: Partial<
		stop: "allows stopping a workspace",
		update: "edit workspace settings (scheduling, permissions, parameters)",
		},
		workspace_agent: {
		create: "create workspace agent",
		delete: "delete workspace agent",
		read: "read workspace agent",
		},
		workspace_agent_devcontainers: {
		create: "create workspace agent devcontainers",
		},
Expand Down