coder · jscottmiller · Jul 28, 2026 · Jul 7, 2026 · Jul 15, 2026 · Jul 15, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2955,6 +2955,13 @@ func (q *querier) GetActiveUserCount(ctx context.Context, includeSystem bool) (i
 	return q.db.GetActiveUserCount(ctx, includeSystem)
 }
 
+func (q *querier) GetActiveUsersAuthorizationRoles(ctx context.Context) ([]database.GetActiveUsersAuthorizationRolesRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetActiveUsersAuthorizationRoles(ctx)
+}
+
 func (q *querier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
 	// This is a system-only function.
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -5038,6 +5038,10 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 		dbm.EXPECT().GetActiveUserCount(gomock.Any(), false).Return(int64(0), nil).AnyTimes()
 		check.Args(false).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns(int64(0))
 	}))
+	s.Run("GetActiveUsersAuthorizationRoles", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+		dbm.EXPECT().GetActiveUsersAuthorizationRoles(gomock.Any()).Return([]database.GetActiveUsersAuthorizationRolesRow{}, nil).AnyTimes()
+		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Returns([]database.GetActiveUsersAuthorizationRolesRow{})
+	}))
 	s.Run("GetAuthorizationUserRoles", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		u := testutil.Fake(s.T(), faker, database.User{})
 		dbm.EXPECT().GetAuthorizationUserRoles(gomock.Any(), u.ID).Return(database.GetAuthorizationUserRolesRow{}, nil).AnyTimes()

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -876,6 +876,18 @@ func (r GetAuthorizationUserRolesRow) RoleNames() ([]rbac.RoleIdentifier, error)
 	return names, nil
 }
 
+func (r GetActiveUsersAuthorizationRolesRow) RoleNames() ([]rbac.RoleIdentifier, error) {
+	names := make([]rbac.RoleIdentifier, 0, len(r.Roles))
+	for _, role := range r.Roles {
+		value, err := rbac.RoleNameFromString(role)
+		if err != nil {
+			return nil, xerrors.Errorf("convert role %q: %w", role, err)
+		}
+		names = append(names, value)
+	}
+	return names, nil
+}
+
 func (k CryptoKey) ExpiresAt(keyDuration time.Duration) time.Time {
 	return k.StartsAt.Add(keyDuration).UTC()
 }

diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
@@ -17723,3 +17723,92 @@ func requireAIGatewayKeysViolation(
 		require.FailNow(t, "test case must expect a constraint error")
 	}
 }
+
+// TestGetActiveUsersAuthorizationRolesParity verifies that the bulk
+// GetActiveUsersAuthorizationRoles query returns, for every eligible
+// user, the same roles and groups as the per-user
+// GetAuthorizationUserRoles query. The two queries encode the implied
+// member roles, organization default roles, and group memberships
+// independently and must not drift.
+func TestGetActiveUsersAuthorizationRolesParity(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+	ctx := testutil.Context(t, testutil.WaitLong)
+
+	orgA := dbgen.Organization(t, db, database.Organization{})
+	orgB := dbgen.Organization(t, db, database.Organization{})
+
+	activeUser := func(seed database.User) database.User {
+		seed.Status = database.UserStatusActive
+		return dbgen.User(t, db, seed)
+	}
+	member := func(orgID uuid.UUID, user database.User, roles ...string) {
+		dbgen.OrganizationMember(t, db, database.OrganizationMember{
+			OrganizationID: orgID,
+			UserID:         user.ID,
+			Roles:          roles,
+		})
+	}
+
+	// Site-wide role, zero org memberships.
+	owner := activeUser(database.User{RBACRoles: []string{rbac.RoleOwner().Name}})
+
+	// Plain single-org member; effective roles come from the implied
+	// member role plus the org's default member roles.
+	plain := activeUser(database.User{})
+	member(orgA.ID, plain)
+
+	// Explicit org roles across two organizations.
+	multiOrg := activeUser(database.User{})
+	member(orgA.ID, multiOrg, rbac.RoleOrgAdmin())
+	member(orgB.ID, multiOrg)
+
+	// Custom org role.
+	customRole, err := db.InsertCustomRole(ctx, database.InsertCustomRoleParams{
+		Name:           "parity-role",
+		DisplayName:    "Parity Role",
+		OrganizationID: uuid.NullUUID{UUID: orgA.ID, Valid: true},
+		OrgPermissions: []database.CustomRolePermission{{
+			ResourceType: rbac.ResourceWorkspace.Type,
+			Action:       policy.ActionCreate,
+		}},
+	})
+	require.NoError(t, err)
+	custom := activeUser(database.User{})
+	member(orgA.ID, custom, customRole.Name)
+
+	// Group memberships.
+	grouped := activeUser(database.User{})
+	member(orgA.ID, grouped)
+	for range 2 {
+		group := dbgen.Group(t, db, database.Group{OrganizationID: orgA.ID})
+		dbgen.GroupMember(t, db, database.GroupMemberTable{
+			UserID:  grouped.ID,
+			GroupID: group.ID,
+		})
+	}
+
+	// Excluded from the bulk query: service accounts and non-active
+	// users.
+	sa := activeUser(database.User{IsServiceAccount: true})
+	member(orgA.ID, sa)
+	suspended := dbgen.User(t, db, database.User{Status: database.UserStatusSuspended})
+	member(orgA.ID, suspended)
+
+	rows, err := db.GetActiveUsersAuthorizationRoles(ctx)
+	require.NoError(t, err)
+
+	gotIDs := make([]uuid.UUID, 0, len(rows))
+	for _, row := range rows {
+		gotIDs = append(gotIDs, row.ID)
+	}
+	require.ElementsMatch(t, []uuid.UUID{owner.ID, plain.ID, multiOrg.ID, custom.ID, grouped.ID}, gotIDs)
+
+	for _, row := range rows {
+		single, err := db.GetAuthorizationUserRoles(ctx, row.ID)
+		require.NoError(t, err)
+		require.ElementsMatch(t, single.Roles, row.Roles, "roles diverged for user %s", row.ID)
+		require.ElementsMatch(t, single.Groups, row.Groups, "groups diverged for user %s", row.ID)
+	}
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go