fix(coderd): drop retired role names in rolestore expansion and API r…

…esponses
ibetitsmike · Aug 26, 2026 · Aug 14, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
commit cbdad541b41d934694fe76569c72b4af1bd0f923
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
@@ -919,11 +919,14 @@ func Organization(organization database.Organization) codersdk.Organization {
 			DisplayName: organization.DisplayName,
 			Icon:        organization.Icon,
 		},
-		Description:           organization.Description,
-		CreatedAt:             organization.CreatedAt,
-		UpdatedAt:             organization.UpdatedAt,
-		IsDefault:             organization.IsDefault,
-		DefaultOrgMemberRoles: organization.DefaultOrgMemberRoles,
+		Description: organization.Description,
+		CreatedAt:   organization.CreatedAt,
+		UpdatedAt:   organization.UpdatedAt,
+		IsDefault:   organization.IsDefault,
+		// Stored default role lists may retain retired built-in role names
+		// until a cleanup migration lands. Hide them so settings forms do
+		// not display or resubmit them.
+		DefaultOrgMemberRoles: slices.DeleteFunc(slices.Clone(organization.DefaultOrgMemberRoles), rbac.IsLegacyRoleName),
 	}
 }
 

diff --git a/coderd/members.go b/coderd/members.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"fmt"
 	"net/http"
+	"slices"
 
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
@@ -510,12 +511,17 @@ func convertOrganizationMembers(ctx context.Context, db database.Store, mems []d
 	roleLookup := make([]database.NameOrganizationPair, 0)
 
 	for _, m := range mems {
+		// Stored role arrays may retain retired built-in role names until a
+		// cleanup migration lands. They grant nothing, so hide them from
+		// responses to keep role editors from displaying or resubmitting
+		// them.
+		activeRoles := slices.DeleteFunc(slices.Clone(m.Roles), rbac.IsLegacyRoleName)
 		converted = append(converted, codersdk.OrganizationMember{
 			UserID:         m.UserID,
 			OrganizationID: m.OrganizationID,
 			CreatedAt:      m.CreatedAt,
 			UpdatedAt:      m.UpdatedAt,
-			Roles: slice.List(m.Roles, func(r string) codersdk.SlimRole {
+			Roles: slice.List(activeRoles, func(r string) codersdk.SlimRole {
 				// If it is a built-in role, no lookups are needed.
 				rbacRole, err := rbac.RoleByName(rbac.RoleIdentifier{Name: r, OrganizationID: m.OrganizationID})
 				if err == nil {

diff --git a/coderd/members_test.go b/coderd/members_test.go
@@ -98,6 +98,24 @@ func TestMembersWithLegacyRole(t *testing.T) {
 	// org's default member roles. The stale default must not fail it.
 	coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
+	// Membership responses hide the stale grant so role editors do not
+	// display or resubmit it.
+	members, err := client.OrganizationMembers(ctx, owner.OrganizationID)
+	require.NoError(t, err)
+	for _, m := range members {
+		if m.UserID != member.ID {
+			continue
+		}
+		for _, role := range m.Roles {
+			require.NotEqual(t, "agents-access", role.Name)
+		}
+	}
+
+	// Organization responses hide the stale default role the same way.
+	orgResp, err := client.Organization(ctx, owner.OrganizationID)
+	require.NoError(t, err)
+	require.NotContains(t, orgResp.DefaultOrgMemberRoles, "agents-access")
+
 	// Restore the defaults so the stale grant is no longer implied and the
 	// next update must validate its removal.
 	updateOrg.DefaultOrgMemberRoles = org.DefaultOrgMemberRoles

diff --git a/coderd/rbac/rolestore/rolestore.go b/coderd/rbac/rolestore/rolestore.go
@@ -82,6 +82,14 @@ func Expand(ctx context.Context, db database.Store, names []rbac.RoleIdentifier)
 	roles := make([]rbac.Role, 0, len(names))
 
 	for _, name := range names {
+		if rbac.IsLegacyRoleName(name.Name) {
+			// Retired built-in role names may linger in stored role arrays
+			// until a cleanup migration lands. They grant nothing and stay
+			// reserved, so skip them instead of falling through to the
+			// custom-role lookup, which could resurrect an unrelated
+			// pre-reservation custom role with the same name.
+			continue
+		}
 		// Remove any built in roles
 		expanded, err := rbac.RoleByName(name)
 		if err == nil {

diff --git a/coderd/rbac/rolestore/rolestore_test.go b/coderd/rbac/rolestore/rolestore_test.go
@@ -46,6 +46,30 @@ func TestExpandCustomRoleRoles(t *testing.T) {
 	require.Len(t, roles, 1, "role found")
 }
 
+func TestExpandLegacyRoleName(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+
+	org := dbgen.Organization(t, db, database.Organization{})
+
+	// Simulate a custom role that took the name before it became a
+	// reserved built-in role name. Expanding a stored grant of the
+	// retired name must not resurrect the custom role.
+	dbgen.CustomRole(t, db, database.CustomRole{
+		Name: "agents-access",
+		OrganizationID: uuid.NullUUID{
+			UUID:  org.ID,
+			Valid: true,
+		},
+	})
+
+	ctx := testutil.Context(t, testutil.WaitShort)
+	roles, err := rolestore.Expand(ctx, db, []rbac.RoleIdentifier{{Name: "agents-access", OrganizationID: org.ID}})
+	require.NoError(t, err)
+	require.Empty(t, roles, "retired role names expand to nothing")
+}
+
 func TestPrefetchCustomRoles(t *testing.T) {
 	t.Parallel()