The /users/{user}/roles handler in coderd/users.go (around the userRoles function, originally at line 1729) returns roles directly from OrganizationMembers.Roles plus user.RBACRoles. It does not include implicit roles: the floor organization-member (or organization-service-account for service accounts), nor the org's organizations.default_org_member_roles.
A TODO: Replace this with "GetAuthorizationUserRoles" already sits on the call site. Switching to GetAuthorizationUserRoles would surface the same effective role set the authz layer sees, including:
This becomes more important as Gateway Accounts (#25936) ships. Deployments using the minimum-implicit-member experiment can configure non-default default_org_member_roles per org, and admin UIs displaying a user's roles should reflect the implicit set so admins can reason about the effective grants.
The similar display path in coderd/members.go (organization-members listing converter) has the same limitation and could be addressed in the same change.
Refs #25936.
Coder Agents on behalf of @Emyrk.
The
/users/{user}/roleshandler incoderd/users.go(around theuserRolesfunction, originally at line 1729) returns roles directly fromOrganizationMembers.Rolesplususer.RBACRoles. It does not include implicit roles: the floororganization-member(ororganization-service-accountfor service accounts), nor the org'sorganizations.default_org_member_roles.A
TODO: Replace this with "GetAuthorizationUserRoles"already sits on the call site. Switching toGetAuthorizationUserRoleswould surface the same effective role set the authz layer sees, including:organization-member/organization-service-accountrole per orgdefault_org_member_roles(the Gateway Accounts mechanism added in feat: configurable default org member roles #25994)This becomes more important as Gateway Accounts (#25936) ships. Deployments using the
minimum-implicit-memberexperiment can configure non-defaultdefault_org_member_rolesper org, and admin UIs displaying a user's roles should reflect the implicit set so admins can reason about the effective grants.The similar display path in
coderd/members.go(organization-members listing converter) has the same limitation and could be addressed in the same change.Refs #25936.
Coder Agents on behalf of @Emyrk.