Thanks to visit codestin.com
Credit goes to github.com

Skip to content

feat(coderd): gate org-member workspace elevation behind experiment - #26027

Merged
Emyrk merged 1 commit into
mainfrom
gateway-accounts/floor-shrink-org-member
Jun 5, 2026
Merged

feat(coderd): gate org-member workspace elevation behind experiment#26027
Emyrk merged 1 commit into
mainfrom
gateway-accounts/floor-shrink-org-member

Conversation

@Emyrk

@Emyrk Emyrk commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Refs #25936. Stacks on #26003.

Gates the workspace-ops elevation on organization-member and organization-service-account behind the minimum-implicit-member experiment.

  • Experiment OFF: behavior unchanged. Both roles carry elevation + floor.
  • Experiment ON: both roles carry only the floor. The elevation lives exclusively on organization-workspace-access.
  • Read once at startup. Flip the experiment, then restart coderd.
  • Unlocks the user-facing change: removing organization-workspace-access from an org's default_org_member_roles actually removes workspace access from that org's members.
Implementation notes
  • New RoleOptions.MinimumImplicitMember mirrored into a package-level atomic.Bool in coderd/rbac/object.go (same pattern as workspaceACLDisabled / chatACLDisabled). OrgMemberPermissions and OrgServiceAccountPermissions are called from rolestore without access to api instance state, so the global is the existing escape hatch.
  • ReloadBuiltinRoles stores the value. OrgMemberPermissions and OrgServiceAccountPermissions read it via MinimumImplicitMember().
  • coderd.New reads the experiment via experiments.Enabled(codersdk.ExperimentMinimumImplicitMember) and passes it through. ReadExperiments(...) moved up so it's available before the ReloadBuiltinRoles call.
  • The conditional around ReloadBuiltinRoles widened to include the experiment, otherwise the option would never reach the rbac package on deployments that have no Disable* flags set.

Coder Agents on behalf of @Emyrk.

@Emyrk Graphite App

Emyrk commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

This was referenced Jun 3, 2026
Merged
Merged
Merged
@Emyrk Emyrk mentioned this pull request Jun 3, 2026
Merged
@Emyrk Emyrk changed the title feat(coderd/rbac): floor-shrink organization-member under experiment feat(coderd): gate org-member workspace elevation behind experiment Jun 3, 2026
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from 2bb6939 to c91e381 Compare June 3, 2026 17:13
@Emyrk Emyrk mentioned this pull request Jun 3, 2026
Merged
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from c91e381 to d1ee7c9 Compare June 3, 2026 20:48
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch 2 times, most recently from 3bf0cd9 to 4347bf4 Compare June 3, 2026 21:09
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from d1ee7c9 to 7813b1a Compare June 3, 2026 21:09
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from 4347bf4 to e4356f7 Compare June 3, 2026 21:23
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch 2 times, most recently from 210be86 to 34ec9ef Compare June 3, 2026 21:43
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch 2 times, most recently from 00b5c1f to 0988f35 Compare June 3, 2026 21:56
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch 2 times, most recently from 8e1cf4c to d46be0c Compare June 3, 2026 22:14
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from 0988f35 to 27102b3 Compare June 3, 2026 22:14
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from d46be0c to 0e1c45b Compare June 3, 2026 22:20
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch 2 times, most recently from e3705f7 to 6c14675 Compare June 3, 2026 22:29
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from 0e1c45b to b78d140 Compare June 3, 2026 22:29
@Emyrk
Emyrk marked this pull request as ready for review June 3, 2026 23:03
@Emyrk
Emyrk requested a review from geokat June 4, 2026 14:43
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from b78d140 to 900ff1c Compare June 5, 2026 14:19
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from 6c14675 to 5f27760 Compare June 5, 2026 14:19
Emyrk added a commit that referenced this pull request Jun 5, 2026
@Emyrk
refactor: extract organization-workspace-access role (#25929)
bec2115 
<!-- Authored by Coder Agents on behalf of @Emyrk. -->

Refs
[PLAT-217](https://linear.app/codercom/issue/PLAT-217/rfc-for-gateway-accounts).

Extracts an `organization-workspace-access` role so workspace elevation
can be split off the organization-member floor without changing
behavior.

- New role holds the workspace-side resources currently granted by
`organization-member`.
- The `MinimumImplicitMember` floor preserves the existing behavior
until #26027 shrinks it.
- Prebuilds orchestrator inserts memberships via
`dbauthz.AsSystemRestricted` and no longer needs `OrganizationMember` or
`AssignOrgRole` grants.

<details><summary>Agent context</summary>

- `coderd/rbac/roles.go`: `OrgWorkspaceAccessMemberPerms()` grants
`Workspace`, `WorkspaceDormant`, `File` (Create+Read),
`ProvisionerDaemon` (Create+Read), and `Task`. Deliberate omissions
(`Template`, `Group`, `WorkspaceProxy`, etc.) are documented inline.
- `coderd/rbac/roles_test.go`: `orgWorkspaceAccessUser` is added to
`requiredSubjects`. `UserProvisionerDaemons` is split into
`UserProvisionerDaemonsCreate` and `UserProvisionerDaemonsUpdateDelete`
because the new role grants Create+Read only and the test framework
requires uniform pass/fail per case.
- `codersdk/rbacroles.go`: exposes `RoleOrganizationWorkspaceAccess`.
- `enterprise/coderd/prebuilds/membership.go`:
`InsertOrganizationMember` runs under `dbauthz.AsSystemRestricted`. The
orchestrator never acts with the elevation role; the membership row only
exists so prebuilt workspaces have a valid owner.
- `coderd/database/dbauthz/dbauthz.go`: drops the now-dead
`OrganizationMember` and `AssignOrgRole` permissions from the
prebuilds-orchestrator role and the orchestrator's entry in
`assignRoles`.

</details>

---

<sub>Coder Agents on behalf of @Emyrk.</sub>
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from 900ff1c to 9154d41 Compare June 5, 2026 15:32
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from 5f27760 to bca7a5d Compare June 5, 2026 15:32
@Emyrk Emyrk mentioned this pull request Jun 5, 2026
Merged
geokat
geokat reviewed Jun 5, 2026
View reviewed changes
Comment thread coderd/coderd.go
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from bca7a5d to c76dc3f Compare June 5, 2026 18:59
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from 9154d41 to fb90875 Compare June 5, 2026 18:59
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch from c76dc3f to 71515b0 Compare June 5, 2026 19:20
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from fb90875 to d265c34 Compare June 5, 2026 19:20
@Emyrk
Emyrk force-pushed the gateway-accounts/test-subject-default-roles branch 2 times, most recently from 8f093d5 to 92e48cc Compare June 5, 2026 19:34
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from d265c34 to 4c0ab67 Compare June 5, 2026 19:34
@Emyrk
Emyrk changed the base branch from gateway-accounts/test-subject-default-roles to graphite-base/26027 June 5, 2026 20:01
@Emyrk
Emyrk force-pushed the graphite-base/26027 branch from 92e48cc to 8a5e04e Compare June 5, 2026 20:01
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from 4c0ab67 to bb1bdc0 Compare June 5, 2026 20:01
@graphite-app
graphite-app Bot changed the base branch from graphite-base/26027 to main June 5, 2026 20:02
@Emyrk
feat(coderd): gate org-member workspace elevation behind experiment
5c49c19 
Adds RoleOptions.MinimumImplicitMember. When the
minimum-implicit-member experiment is on, OrgMemberPermissions and
OrgServiceAccountPermissions omit the workspace-ops elevation
(OrgWorkspaceAccessMemberPerms). Members of the org then only have
the floor unless granted organization-workspace-access via
default_org_member_roles or direct assignment.

Read once at startup from coderd.New. Flip the experiment, then
restart coderd.

Refs #25936.
@Emyrk
Emyrk force-pushed the gateway-accounts/floor-shrink-org-member branch from bb1bdc0 to 5c49c19 Compare June 5, 2026 20:02
@Emyrk
Emyrk merged commit f17f839 into main Jun 5, 2026
25 checks passed
@Emyrk
Emyrk deleted the gateway-accounts/floor-shrink-org-member branch June 5, 2026 20:31
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@geokat geokat geokat approved these changes

Assignees

@Emyrk Emyrk

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Emyrk @geokat