Skip to content

feat: enable Coder Agents for organization members #28186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ibetitsmike merged 16 commits into from
Aug 26, 2026
Merged

feat: enable Coder Agents for organization members #28186

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
3ff9069
feat: enable Coder Agents for organization members
ibetitsmike Aug 14, 2026
3c49c50
fix(coderd): promote queued message from a terminal chat status in me…
ibetitsmike Aug 25, 2026
9460577
fix: keep RoleAgentsAccess as a deprecated compatibility alias
ibetitsmike Aug 25, 2026
f0548ea
docs(docs/ai-coder/agents): document model access lists as the Coder …
ibetitsmike Aug 25, 2026
dca5c57
refactor(coderd/rbac): track retired role names in a legacy set
ibetitsmike Aug 25, 2026
478dc27
fix(site/src/pages/AgentsPage): align settings story assertion with c…
ibetitsmike Aug 25, 2026
7e1a2c6
refactor(coderd): drop agents-access cleanup migration
ibetitsmike Aug 25, 2026
f5291e2
Merge remote-tracking branch 'origin/main' into HEAD
ibetitsmike Aug 25, 2026
cbdad54
fix(coderd): drop retired role names in rolestore expansion and API r…
ibetitsmike Aug 25, 2026
e6f8311
fix(site/src/pages/AgentsPage): make chat access denied copy permissi…
ibetitsmike Aug 25, 2026
861c378
docs(docs/ai-coder/agents): reflow prerequisites bullet to one senten…
ibetitsmike Aug 25, 2026
73e1352
fix(coderd): reject explicit grants of retired role names
ibetitsmike Aug 25, 2026
6889238
fix(coderd): extend retired-role rejection to org defaults and assign…
ibetitsmike Aug 25, 2026
af0ab29
docs(docs/ai-coder/agents): exclude service accounts from chat permis…
ibetitsmike Aug 25, 2026
e1e6f9f
fix(coderd): hide retired role names from the user-roles response
ibetitsmike Aug 25, 2026
f429c4c
fix: hide retired roles in user payloads and keep retired custom role…
ibetitsmike Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions coderd/database/dbauthz/dbauthz.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1413,6 +1413,13 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID uuid.UUID, added, re
grantedRoles := make([]rbac.RoleIdentifier, 0, len(added)+len(removed))
grantedRoles = append(grantedRoles, added...)
grantedRoles = append(grantedRoles, removed...)
// Retired role names may linger in stored role arrays and org default
// role lists until a data cleanup migration lands. They expand to no
// permissions and cannot be re-created as custom roles, so granting or
// revoking them needs no per-role validation.
grantedRoles = slices.DeleteFunc(grantedRoles, func(r rbac.RoleIdentifier) bool {
return rbac.IsLegacyRoleName(r.Name)
})
Comment thread
ibetitsmike marked this conversation as resolved.
Comment thread
ibetitsmike marked this conversation as resolved.
customRoles := make([]rbac.RoleIdentifier, 0)
// Validate that the roles being assigned are valid.
for _, r := range grantedRoles {
Expand Down
12 changes: 3 additions & 9 deletions coderd/database/querier_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1465,8 +1465,8 @@ func TestGetAuthorizedChats(t *testing.T) {

org := dbgen.Organization(t, db, database.Organization{})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: owner.ID, OrganizationID: org.ID})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: member.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: secondMember.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: member.ID, OrganizationID: org.ID})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: secondMember.ID, OrganizationID: org.ID})

// Create FK dependencies: a chat provider and model config.
_ = dbgen.ChatProvider(t, db, database.ChatProvider{
Expand Down Expand Up @@ -1653,7 +1653,7 @@ func TestGetAuthorizedChats(t *testing.T) {
// Use a dedicated user for pagination to avoid interference
// with the other parallel subtests.
paginationUser := dbgen.User(t, db, database.User{})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: paginationUser.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: paginationUser.ID, OrganizationID: org.ID})
for i := range 7 {
dbgen.Chat(t, db, database.Chat{
OrganizationID: org.ID,
Expand Down Expand Up @@ -1727,12 +1727,10 @@ func TestGetAuthorizedChatsACLSharing(t *testing.T) {
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: owner.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: recipient.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})

dbgen.ChatProvider(t, db, database.ChatProvider{Provider: "openai", DisplayName: "OpenAI"})
Expand Down Expand Up @@ -1845,12 +1843,10 @@ func TestGetAuthorizedChatsACLSharingGroupACL(t *testing.T) {
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: owner.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: recipient.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})
group := dbgen.Group(t, db, database.Group{OrganizationID: org.ID})
dbgen.GroupMember(t, db, database.GroupMemberTable{UserID: recipient.ID, GroupID: group.ID})
Expand Down Expand Up @@ -1949,12 +1945,10 @@ func TestGetAuthorizedChatsByChatFileIDACLSharing(t *testing.T) {
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: owner.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: recipient.ID,
OrganizationID: org.ID,
Roles: []string{rbac.RoleAgentsAccess()},
})

dbgen.ChatProvider(t, db, database.ChatProvider{Provider: "openai", DisplayName: "OpenAI"})
Expand Down
4 changes: 2 additions & 2 deletions coderd/exp_chats_acl_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -463,7 +463,7 @@ func TestListChatsSharedScope(t *testing.T) {
client, db := newChatClientWithDatabase(t)
firstUser := coderdtest.CreateFirstUser(t, client.Client)
modelConfig := createChatModel(t, client)
viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID, rbac.ScopedRoleAgentsAccess(firstUser.OrganizationID))
viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID)
viewerClientExp := codersdk.NewExperimentalClient(viewerClient)
sharedChat := dbgen.Chat(t, db, database.Chat{
OrganizationID: firstUser.OrganizationID,
Expand Down Expand Up @@ -562,7 +562,7 @@ func TestChatSharingDisabled(t *testing.T) {
})
firstUser := coderdtest.CreateFirstUser(t, client.Client)
modelConfig := createChatModel(t, client)
viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID, rbac.ScopedRoleAgentsAccess(firstUser.OrganizationID))
viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID)
viewerClientExp := codersdk.NewExperimentalClient(viewerClient)

chat := dbgen.Chat(t, store, database.Chat{
Expand Down
3 changes: 1 addition & 2 deletions coderd/exp_chats_model_config_list_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,13 +189,12 @@ func TestChatModelConfigListReadContracts(t *testing.T) {
seesDenied bool
}{
{
name: "AgentsAccess",
name: "Member",
client: func(t *testing.T, _ context.Context) *codersdk.ExperimentalClient {
rawClient, _ := coderdtest.CreateAnotherUser(
t,
client.Client,
defaultOrg.ID,
rbac.ScopedRoleAgentsAccess(defaultOrg.ID),
)
return codersdk.NewExperimentalClient(rawClient)
},
Expand Down
Loading
Loading