| Field | Tracked |
|---|---|
| id | false |
| notifier_paused | true |
| Field | Tracked |
|---|---|
| callback_url | true |
| client_id_issued_at | false |
| client_secret_expires_at | true |
| client_type | true |
| client_uri | true |
| contacts | true |
| created_at | false |
| dynamically_registered | true |
| grant_types | true |
| icon | true |
| id | false |
| jwks | true |
| jwks_uri | true |
| logo_uri | true |
| name | true |
| policy_uri | true |
| redirect_uris | true |
| registration_access_token | true |
| registration_client_uri | true |
| response_types | true |
| scope | true |
| software_id | true |
| software_version | true |
| token_endpoint_auth_method | true |
| tos_uri | true |
| updated_at | false |
| Field | Tracked |
|---|---|
| app_id | false |
| created_at | false |
| display_secret | false |
| hashed_secret | false |
| id | false |
| last_used_at | false |
| secret_prefix | false |
| Field | Tracked |
|---|---|
| created_at | false |
| deleted | true |
| description | true |
| display_name | true |
| icon | true |
| id | false |
| is_default | true |
| name | true |
| shareable_workspace_owners | true |
| updated_at | true |
| Field | Tracked |
|---|---|
| created_at | false |
| default_org_member_roles | true |
| deleted | true |
| description | true |
| display_name | true |
| icon | true |
| id | false |
| is_default | true |
| name | true |
| shareable_workspace_owners | true |
| updated_at | true |
| Field | Tracked |
|---|---|
| assign_default | true |
| field | true |
| mapping | true |
| Field | Tracked |
|---|---|
| id | false |
| reconciliation_paused | true |
| Field | Tracked |
|---|---|
| field | true |
| mapping | true |
[id\|name\|display name\|icon\|description\|created at\|updated at\|default] |
-| Default | name,display name,id,default |
+| | |
+|---------|---------------------------------------------------------------------------------------------------------------------|
+| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default\|default org member roles] |
+| Default | name,display name,id,default |
Columns to display in table output.
diff --git a/docs/reference/cli/organizations_show.md b/docs/reference/cli/organizations_show.md
index 540014b4680..90d5f00be1f 100644
--- a/docs/reference/cli/organizations_show.md
+++ b/docs/reference/cli/organizations_show.md
@@ -41,10 +41,10 @@ Only print the organization ID.
### -c, --column
-| | |
-|---------|-------------------------------------------------------------------------------------------|
-| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default] |
-| Default | id,name,default |
+| | |
+|---------|---------------------------------------------------------------------------------------------------------------------|
+| Type | [id\|name\|display name\|icon\|description\|created at\|updated at\|default\|default org member roles] |
+| Default | id,name,default |
Columns to display in table output.
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index 6ae2afd92ca..08d64c67d62 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -341,6 +341,7 @@ var auditableResourcesTypes = map[any]map[string]Action{
"display_name": ActionTrack,
"icon": ActionTrack,
"shareable_workspace_owners": ActionTrack,
+ "default_org_member_roles": ActionTrack,
},
&database.NotificationTemplate{}: {
"id": ActionIgnore,
diff --git a/enterprise/coderd/organizations.go b/enterprise/coderd/organizations.go
index fd9f9a4af6f..a63e7228232 100644
--- a/enterprise/coderd/organizations.go
+++ b/enterprise/coderd/organizations.go
@@ -4,6 +4,7 @@ import (
"database/sql"
"fmt"
"net/http"
+ "slices"
"strings"
"github.com/google/uuid"
@@ -16,6 +17,7 @@ import (
"github.com/coder/coder/v2/coderd/database/dbtime"
"github.com/coder/coder/v2/coderd/httpapi"
"github.com/coder/coder/v2/coderd/httpmw"
+ "github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/rbac/rolestore"
"github.com/coder/coder/v2/codersdk"
)
@@ -60,6 +62,39 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
return
}
+ // Deviations from rbac.DefaultOrgMemberRoles require the
+ // minimum-implicit-member experiment.
+ if req.DefaultOrgMemberRoles != nil &&
+ !slices.Equal(*req.DefaultOrgMemberRoles, rbac.DefaultOrgMemberRoles()) &&
+ !api.AGPL.Experiments.Enabled(codersdk.ExperimentMinimumImplicitMember) {
+ httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
+ Message: "Changing default organization roles is not enabled on this deployment.",
+ Detail: fmt.Sprintf("Setting default_org_member_roles to anything other than %v requires the %q experiment.", rbac.DefaultOrgMemberRoles(), codersdk.ExperimentMinimumImplicitMember),
+ })
+ return
+ }
+
+ // default_org_member_roles currently accepts built-in role names only.
+ // Custom (DB-stored) roles are intentionally rejected here so the
+ // caller cannot land a malformed name that would break role expansion
+ // for every member of the org. A future change can extend this to
+ // custom org roles by routing through canAssignRoles in dbauthz.
+ if req.DefaultOrgMemberRoles != nil {
+ for _, name := range *req.DefaultOrgMemberRoles {
+ if _, err := rbac.RoleByName(rbac.RoleIdentifier{Name: name, OrganizationID: organization.ID}); err != nil {
+ httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+ Message: "Invalid default_org_member_roles entry.",
+ Detail: fmt.Sprintf("%q is not a built-in role; default_org_member_roles currently accepts built-in role names only.", name),
+ Validations: []codersdk.ValidationError{{
+ Field: "default_org_member_roles",
+ Detail: fmt.Sprintf("%q is not a built-in role.", name),
+ }},
+ })
+ return
+ }
+ }
+ }
+
err := database.ReadModifyUpdate(api.Database, func(tx database.Store) error {
var err error
organization, err = tx.GetOrganizationByID(ctx, organization.ID)
@@ -68,12 +103,13 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
}
updateOrgParams := database.UpdateOrganizationParams{
- UpdatedAt: dbtime.Now(),
- ID: organization.ID,
- Name: organization.Name,
- DisplayName: organization.DisplayName,
- Description: organization.Description,
- Icon: organization.Icon,
+ UpdatedAt: dbtime.Now(),
+ ID: organization.ID,
+ Name: organization.Name,
+ DisplayName: organization.DisplayName,
+ Description: organization.Description,
+ Icon: organization.Icon,
+ DefaultOrgMemberRoles: organization.DefaultOrgMemberRoles,
}
if req.Name != "" {
@@ -88,6 +124,9 @@ func (api *API) patchOrganization(rw http.ResponseWriter, r *http.Request) {
if req.Icon != nil {
updateOrgParams.Icon = *req.Icon
}
+ if req.DefaultOrgMemberRoles != nil {
+ updateOrgParams.DefaultOrgMemberRoles = *req.DefaultOrgMemberRoles
+ }
organization, err = tx.UpdateOrganization(ctx, updateOrgParams)
if err != nil {
@@ -280,13 +319,14 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
}
organization, err = tx.InsertOrganization(ctx, database.InsertOrganizationParams{
- ID: organizationID,
- Name: req.Name,
- DisplayName: req.DisplayName,
- Description: req.Description,
- Icon: req.Icon,
- CreatedAt: dbtime.Now(),
- UpdatedAt: dbtime.Now(),
+ ID: organizationID,
+ Name: req.Name,
+ DisplayName: req.DisplayName,
+ Description: req.Description,
+ Icon: req.Icon,
+ CreatedAt: dbtime.Now(),
+ UpdatedAt: dbtime.Now(),
+ DefaultOrgMemberRoles: rbac.DefaultOrgMemberRoles(),
})
if err != nil {
return xerrors.Errorf("create organization: %w", err)
diff --git a/enterprise/coderd/organizations_test.go b/enterprise/coderd/organizations_test.go
index e7b01b0163c..97e20909896 100644
--- a/enterprise/coderd/organizations_test.go
+++ b/enterprise/coderd/organizations_test.go
@@ -9,6 +9,7 @@ import (
"github.com/coder/coder/v2/cli/clitest"
"github.com/coder/coder/v2/coderd/coderdtest"
+ "github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/util/ptr"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
@@ -448,6 +449,107 @@ func TestPatchOrganizationsByUser(t *testing.T) {
})
require.ErrorContains(t, err, "Multiple Organizations is a Premium feature")
})
+
+ t.Run("DefaultOrgMemberRoles", func(t *testing.T) {
+ t.Parallel()
+
+ t.Run("EqualToDefaultAllowedWithoutExperiment", func(t *testing.T) {
+ t.Parallel()
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ // Writing exactly the deployment default is a no-op and must be allowed.
+ //nolint:gocritic // Only owners can update organization settings.
+ updated, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref(rbac.DefaultOrgMemberRoles()),
+ })
+ require.NoError(t, err)
+ require.Equal(t, rbac.DefaultOrgMemberRoles(), updated.DefaultOrgMemberRoles)
+ })
+
+ t.Run("DeviationRejectedWithoutExperiment", func(t *testing.T) {
+ t.Parallel()
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ // Empty array represents a Gateway Accounts organization. Without
+ // the experiment, this must be rejected.
+ //nolint:gocritic // Only owners can update organization settings.
+ _, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref([]string{}),
+ })
+ var apiErr *codersdk.Error
+ require.ErrorAs(t, err, &apiErr)
+ require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+ require.Contains(t, apiErr.Message, "Changing default organization roles is not enabled")
+ })
+
+ t.Run("DeviationAllowedWithExperiment", func(t *testing.T) {
+ t.Parallel()
+ dv := coderdtest.DeploymentValues(t)
+ dv.Experiments = []string{string(codersdk.ExperimentMinimumImplicitMember)}
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ Options: &coderdtest.Options{DeploymentValues: dv},
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ //nolint:gocritic // Only owners can update organization settings.
+ updated, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref([]string{}),
+ })
+ require.NoError(t, err)
+ require.Empty(t, updated.DefaultOrgMemberRoles)
+ })
+
+ t.Run("NonBuiltInRoleRejected", func(t *testing.T) {
+ t.Parallel()
+ dv := coderdtest.DeploymentValues(t)
+ dv.Experiments = []string{string(codersdk.ExperimentMinimumImplicitMember)}
+ client, _ := coderdenttest.New(t, &coderdenttest.Options{
+ Options: &coderdtest.Options{DeploymentValues: dv},
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureMultipleOrganizations: 1,
+ },
+ },
+ })
+ ctx := testutil.Context(t, testutil.WaitMedium)
+ o := coderdenttest.CreateOrganization(t, client, coderdenttest.CreateOrganizationOptions{})
+
+ // A name that does not resolve via rbac.RoleByName (no such
+ // built-in role) must be rejected. This blocks both custom roles
+ // and malformed names like "foo:bar" that would otherwise break
+ // RoleNameFromString downstream.
+ //nolint:gocritic // Only owners can update organization settings.
+ _, err := client.UpdateOrganization(ctx, o.ID.String(), codersdk.UpdateOrganizationRequest{
+ DefaultOrgMemberRoles: ptr.Ref([]string{"not-a-built-in-role"}),
+ })
+ var apiErr *codersdk.Error
+ require.ErrorAs(t, err, &apiErr)
+ require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
+ require.Contains(t, apiErr.Message, "Invalid default_org_member_roles entry")
+ })
+ })
}
func TestPostOrganizationsByUser(t *testing.T) {
diff --git a/site/src/api/queries/organizations.test.ts b/site/src/api/queries/organizations.test.ts
index 704004db6ec..c2e5a1241bb 100644
--- a/site/src/api/queries/organizations.test.ts
+++ b/site/src/api/queries/organizations.test.ts
@@ -20,6 +20,7 @@ const MockOrg1: Organization = {
created_at: "",
updated_at: "",
is_default: true,
+ default_org_member_roles: ["organization-workspace-access"],
};
const MockOrg2: Organization = {
@@ -31,6 +32,7 @@ const MockOrg2: Organization = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
};
const templateCreateCheck: AuthorizationCheck = {
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index a07ff74c874..b19bfe47700 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4393,6 +4393,7 @@ export type Experiment =
| "auto-fill-parameters"
| "example"
| "mcp-server-http"
+ | "minimum-implicit-member"
| "nats_pubsub"
| "notifications"
| "oauth2"
@@ -4403,6 +4404,7 @@ export const Experiments: Experiment[] = [
"auto-fill-parameters",
"example",
"mcp-server-http",
+ "minimum-implicit-member",
"nats_pubsub",
"notifications",
"oauth2",
@@ -6099,6 +6101,12 @@ export interface Organization extends MinimalOrganization {
readonly created_at: string;
readonly updated_at: string;
readonly is_default: boolean;
+ /**
+ * DefaultOrgMemberRoles are unioned into every member's effective
+ * roles at request time. Changes propagate to all members on the
+ * next request.
+ */
+ readonly default_org_member_roles: readonly string[];
}
// From codersdk/organizations.go
@@ -8844,6 +8852,11 @@ export interface UpdateOrganizationRequest {
readonly display_name?: string;
readonly description?: string;
readonly icon?: string;
+ /**
+ * DefaultOrgMemberRoles, when non-nil, replaces the org's default
+ * member roles.
+ */
+ readonly default_org_member_roles?: string[];
}
// From codersdk/users.go
diff --git a/site/src/modules/management/OrganizationSidebarView.stories.tsx b/site/src/modules/management/OrganizationSidebarView.stories.tsx
index 24423c38638..446400f8980 100644
--- a/site/src/modules/management/OrganizationSidebarView.stories.tsx
+++ b/site/src/modules/management/OrganizationSidebarView.stories.tsx
@@ -67,6 +67,7 @@ export const OverflowDropdown: Story = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "my-organization-4-id",
@@ -77,6 +78,7 @@ export const OverflowDropdown: Story = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "my-organization-5-id",
@@ -87,6 +89,7 @@ export const OverflowDropdown: Story = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "my-organization-6-id",
@@ -97,6 +100,7 @@ export const OverflowDropdown: Story = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "my-organization-7-id",
@@ -107,6 +111,7 @@ export const OverflowDropdown: Story = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
],
},
diff --git a/site/src/pages/AgentsPage/components/ChatElements/CompactOrgSelector.stories.tsx b/site/src/pages/AgentsPage/components/ChatElements/CompactOrgSelector.stories.tsx
index 8c75d4a72d5..c41aa03886d 100644
--- a/site/src/pages/AgentsPage/components/ChatElements/CompactOrgSelector.stories.tsx
+++ b/site/src/pages/AgentsPage/components/ChatElements/CompactOrgSelector.stories.tsx
@@ -13,6 +13,7 @@ const mockOrgs: Organization[] = [
created_at: "2024-01-01T00:00:00Z",
updated_at: "2024-06-01T00:00:00Z",
is_default: true,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "org-acme",
@@ -23,6 +24,7 @@ const mockOrgs: Organization[] = [
created_at: "2024-02-01T00:00:00Z",
updated_at: "2024-06-01T00:00:00Z",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
{
id: "org-globex",
@@ -33,6 +35,7 @@ const mockOrgs: Organization[] = [
created_at: "2024-03-01T00:00:00Z",
updated_at: "2024-06-01T00:00:00Z",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
},
];
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index f85f3d47538..2972fc97d44 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -21,6 +21,7 @@ export const MockOrganization: TypesGen.Organization = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
};
export const MockDefaultOrganization: TypesGen.Organization = {
@@ -37,6 +38,7 @@ export const MockOrganization2: TypesGen.Organization = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
};
export const MockOrganization3: TypesGen.Organization = {
@@ -49,6 +51,7 @@ export const MockOrganization3: TypesGen.Organization = {
created_at: "",
updated_at: "",
is_default: false,
+ default_org_member_roles: ["organization-workspace-access"],
};
export const MockTemplateDAUResponse: TypesGen.DAUsResponse = {