chore: only send org roles for the org the workspace is in

Emyrk · Emyrk · commit feec988a070b · 2025-04-17T15:06:33.000-05:00
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
@@ -603,6 +603,10 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 		roles, err := allUserRoles.RoleNames()
 		if err == nil {
 			for _, role := range roles {
+				if role.OrganizationID != uuid.Nil && role.OrganizationID != s.OrganizationID {
+					continue // Only include site wide and org specific roles
+				}
+
 				orgID := role.OrganizationID.String()
 				if role.OrganizationID == uuid.Nil {
 					orgID = ""
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -211,6 +211,14 @@ func TestAcquireJob(t *testing.T) {
 					Roles:          []string{rbac.RoleOrgAuditor()},
 				})
 
+				// Add extra erronous roles
+				secondOrg := dbgen.Organization(t, db, database.Organization{})
+				dbgen.OrganizationMember(t, db, database.OrganizationMember{
+					UserID:         user.ID,
+					OrganizationID: secondOrg.ID,
+					Roles:          []string{rbac.RoleOrgAuditor()},
+				})
+
 				link := dbgen.UserLink(t, db, database.UserLink{
 					LoginType:        database.LoginTypeOIDC,
 					UserID:           user.ID,
