coder
diff --git a/‎coderd/database/dbauthz/dbauthz.go
+2 b/‎coderd/database/dbauthz/dbauthz.go
+2
diff --git a/‎coderd/database/migrations/000237_notification_preferences.down.sql renamed to ‎coderd/database/migrations/000238_notification_preferences.down.sql b/‎coderd/database/migrations/000237_notification_preferences.down.sql renamed to ‎coderd/database/migrations/000238_notification_preferences.down.sql
diff --git a/‎coderd/database/migrations/000237_notification_preferences.up.sql renamed to ‎coderd/database/migrations/000238_notification_preferences.up.sql
-4 b/‎coderd/database/migrations/000237_notification_preferences.up.sql renamed to ‎coderd/database/migrations/000238_notification_preferences.up.sql
-4
diff --git a/‎coderd/database/migrations/testdata/fixtures/000237_notifications_preferences.up.sql renamed to ‎coderd/database/migrations/testdata/fixtures/000238_notifications_preferences.up.sql b/‎coderd/database/migrations/testdata/fixtures/000237_notifications_preferences.up.sql renamed to ‎coderd/database/migrations/testdata/fixtures/000238_notifications_preferences.up.sql
diff --git a/‎coderd/rbac/roles_test.go
+3-34 b/‎coderd/rbac/roles_test.go
+3-34
@@ -1483,6 +1483,8 @@ func (q *querier) GetNotificationTemplateByID(ctx context.Context, id uuid.UUID)
 
 func (q *querier) GetNotificationTemplatesByKind(ctx context.Context, kind database.NotificationTemplateKind) ([]database.NotificationTemplate, error) {
 	// TODO: restrict 'system' kind to admins only?
+	// All notification templates share the same rbac.Object, so there is no need
+	// to authorize them individually. If this passes, all notification templates can be read.
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceNotificationTemplate); err != nil {
 		return nil, err
 	}
 
@@ -8,10 +8,6 @@ CREATE TABLE notification_preferences
 	PRIMARY KEY (user_id, notification_template_id)
 );
 
--- Ensure we cannot insert multiple entries for the same user/template combination.
-ALTER TABLE notification_preferences
-	ADD CONSTRAINT unique_user_notification_template UNIQUE (user_id, notification_template_id);
-
 -- Add a new type (to be expanded upon later) which specifies the kind of notification template.
 CREATE TYPE notification_template_kind AS ENUM (
 	'system'
 
@@ -627,12 +627,12 @@ func TestRolePermissions(t *testing.T) {
 			// Members may not access other members' preferences
 			Name:     "NotificationPreferencesOtherUser",
 			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
-			Resource: rbac.ResourceNotificationPreference.InOrg(orgID).WithOwner(uuid.NewString()), // some other user
+			Resource: rbac.ResourceNotificationPreference.WithOwner(uuid.NewString()), // some other user
 			AuthorizeMap: map[bool][]hasAuthSubjects{
-				true: {orgAdmin, owner},
+				true: {owner},
 				false: {
 					memberMe, templateAdmin, orgUserAdmin, userAdmin,
-					orgAuditor, orgTemplateAdmin,
+					orgAdmin, orgAuditor, orgTemplateAdmin,
 					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
 					otherOrgAdmin, orgMemberMe,
 				},
@@ -678,37 +678,6 @@ func TestRolePermissions(t *testing.T) {
 				},
 			},
 		},
-		{
-			// Notification preferences are currently not organization-scoped
-			// Any owner/admin across any organization may access any users' preferences
-			// Members may access their own preferences
-			Name:     "NotificationPreferencesAnyOrg",
-			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
-			Resource: rbac.ResourceNotificationPreference.AnyOrganization().WithOwner(currentUser.String()),
-			AuthorizeMap: map[bool][]hasAuthSubjects{
-				true: {orgMemberMe, orgAdmin, otherOrgAdmin, owner},
-				false: {
-					memberMe, templateAdmin, otherOrgUserAdmin, userAdmin, orgUserAdmin,
-					orgAuditor, orgTemplateAdmin,
-					otherOrgMember, otherOrgAuditor, otherOrgTemplateAdmin,
-				},
-			},
-		},
-		{
-			// Notification templates are currently not organization-scoped
-			// Any owner/admin across any organization may access notification templates
-			Name:     "NotificationTemplateAnyOrg",
-			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
-			Resource: rbac.ResourceNotificationPreference.AnyOrganization(),
-			AuthorizeMap: map[bool][]hasAuthSubjects{
-				true: {orgAdmin, otherOrgAdmin, owner},
-				false: {
-					orgMemberMe, memberMe, templateAdmin, orgUserAdmin, userAdmin,
-					orgAuditor, orgTemplateAdmin,
-					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
-				},
-			},
-		},
 	}
 
 	// We expect every permission to be tested above.
Original file line number	Diff line number	Diff line change
`@@ -1483,6 +1483,8 @@ func (q *querier) GetNotificationTemplateByID(ctx context.Context, id uuid.UUID)`
`1483`	`1483`
`1484`	`1484`	`func (q *querier) GetNotificationTemplatesByKind(ctx context.Context, kind database.NotificationTemplateKind) ([]database.NotificationTemplate, error) {`
`1485`	`1485`	`// TODO: restrict 'system' kind to admins only?`
	`1486`	`+ // All notification templates share the same rbac.Object, so there is no need`
	`1487`	`+ // to authorize them individually. If this passes, all notification templates can be read.`
`1486`	`1488`	`if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceNotificationTemplate); err != nil {`
`1487`	`1489`	`return nil, err`
`1488`	`1490`	`}`