Moved to#8650

What this does

Removes the rbac permission for users to read all other users on the site.

Closes#5002

Changes

Permission Changes

• ResourceTypeUser now owned byuser_id of itself.
• member couldread all Users -->member can read only themselves

Open issues to resolve

• All templates fetch the creator name. This is no longer able to be read.
  

  coder/coderd/templates.go

  Lines 682 to 692 in04a2cae

  	funcgetCreatedByNamesByTemplateIDs(ctx context.Context,db database.Store,templates []database.Template) (map[string]string,error) {
  	creators:=make(map[string]string,len(templates))
  	for_,template:=rangetemplates {
  	creator,err:=db.GetUserByID(ctx,template.CreatedBy)
  	iferr!=nil {
  	returnmap[string]string{},err
  	}
  	creators[template.ID.String()]=creator.Username
  	}
  	returncreators,nil
  	}

  • Solution: Bothcreated_by andcreator_username is now omitted if the user cannot view the creator. Meaning they can see templates created by themselves. Admins can still view all users.

• User counts are still being read

  • Solution: ImplementGetUsers with sql filter rather than filtering the returned list. Now all counts are counts of the readable users for any given caller.

• Group members still return all users

• If you grant a memberadmin on a template, they can see the permissions page. This page has a list of users/groups that can use/admin the template. Should this page show users they cannot read?