feat: Implement allow_list for scopes for resource specific permissions (#5769)

* feat: Implement allow_list for scopes for resource specific permissions

Feature that adds an allow_list for scopes to specify particular resources.
This enables workspace agent tokens to use the same RBAC system as users.

- Add ID to compileSQL matchers
* Plumb through WithID on rbac objects
* Rename Scope -> ScopeName
* Update input.json with scope allow_list

Co-authored-by: Cian Johnston <cian@coder.com>

coderd/rbac/builtin_test.go

@@ -32,6 +32,11 @@ func TestRolePermissions(t *testing.T) {
 	templateAdminID := uuid.New()
 	orgID := uuid.New()
 	otherOrg := uuid.New()
+	workspaceID := uuid.New()
+	templateID := uuid.New()
+	fileID := uuid.New()
+	groupID := uuid.New()
+	apiKeyID := uuid.New()
 
 	// Subjects to user
 	memberMe := authSubject{Name: "member_me", UserID: currentUser.String(), Roles: []string{rbac.RoleMember()}}
@@ -66,7 +71,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "MyUser",
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceUser,
+			Resource: rbac.ResourceUser.WithID(currentUser),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, memberMe, orgMemberMe, orgAdmin, otherOrgMember, otherOrgAdmin, templateAdmin, userAdmin},
 				false: {},
@@ -85,7 +90,7 @@ func TestRolePermissions(t *testing.T) {
 			Name: "ReadMyWorkspaceInOrg",
 			// When creating the WithID won't be set, but it does not change the result.
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
+			Resource: rbac.ResourceWorkspace.WithID(workspaceID).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgMemberMe, orgAdmin, templateAdmin},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
@@ -95,7 +100,7 @@ func TestRolePermissions(t *testing.T) {
 			Name: "C_RDMyWorkspaceInOrg",
 			// When creating the WithID won't be set, but it does not change the result.
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
+			Resource: rbac.ResourceWorkspace.WithID(workspaceID).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgMemberMe, orgAdmin},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin, templateAdmin},
@@ -105,7 +110,7 @@ func TestRolePermissions(t *testing.T) {
 			Name: "MyWorkspaceInOrgExecution",
 			// When creating the WithID won't be set, but it does not change the result.
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceWorkspaceExecution.InOrg(orgID).WithOwner(currentUser.String()),
+			Resource: rbac.ResourceWorkspaceExecution.WithID(workspaceID).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, orgMemberMe},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
@@ -115,7 +120,7 @@ func TestRolePermissions(t *testing.T) {
 			Name: "MyWorkspaceInOrgAppConnect",
 			// When creating the WithID won't be set, but it does not change the result.
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceWorkspaceApplicationConnect.InOrg(orgID).WithOwner(currentUser.String()),
+			Resource: rbac.ResourceWorkspaceApplicationConnect.WithID(workspaceID).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, orgMemberMe},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
@@ -124,7 +129,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "Templates",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceTemplate.InOrg(orgID),
+			Resource: rbac.ResourceTemplate.WithID(templateID).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, templateAdmin},
 				false: {memberMe, orgMemberMe, otherOrgAdmin, otherOrgMember, userAdmin},
@@ -142,7 +147,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "Files",
 			Actions:  []rbac.Action{rbac.ActionCreate},
-			Resource: rbac.ResourceFile,
+			Resource: rbac.ResourceFile.WithID(fileID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, templateAdmin},
 				false: {orgMemberMe, orgAdmin, memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
@@ -151,7 +156,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "MyFile",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceFile.WithOwner(currentUser.String()),
+			Resource: rbac.ResourceFile.WithID(fileID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, memberMe, orgMemberMe, templateAdmin},
 				false: {orgAdmin, otherOrgAdmin, otherOrgMember, userAdmin},
@@ -169,7 +174,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "Organizations",
 			Actions:  []rbac.Action{rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceOrganization.InOrg(orgID),
+			Resource: rbac.ResourceOrganization.WithID(orgID).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin},
 				false: {otherOrgAdmin, otherOrgMember, memberMe, orgMemberMe, templateAdmin, userAdmin},
@@ -178,7 +183,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "ReadOrganizations",
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceOrganization.InOrg(orgID),
+			Resource: rbac.ResourceOrganization.WithID(orgID).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, orgMemberMe},
 				false: {otherOrgAdmin, otherOrgMember, memberMe, templateAdmin, userAdmin},
@@ -223,7 +228,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "APIKey",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceAPIKey.WithOwner(currentUser.String()),
+			Resource: rbac.ResourceAPIKey.WithID(apiKeyID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgMemberMe, memberMe},
 				false: {orgAdmin, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
@@ -232,7 +237,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "UserData",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceUserData.WithOwner(currentUser.String()),
+			Resource: rbac.ResourceUserData.WithID(currentUser).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgMemberMe, memberMe},
 				false: {orgAdmin, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
@@ -241,7 +246,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "ManageOrgMember",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceOrganizationMember.InOrg(orgID),
+			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, userAdmin},
 				false: {orgMemberMe, memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},
@@ -250,7 +255,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "ReadOrgMember",
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceOrganizationMember.InOrg(orgID),
+			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, orgMemberMe, userAdmin},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},
@@ -259,7 +264,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:    "AllUsersGroupACL",
 			Actions: []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceTemplate.InOrg(orgID).WithGroupACL(
+			Resource: rbac.ResourceTemplate.WithID(templateID).InOrg(orgID).WithGroupACL(
 				map[string][]rbac.Action{
 					orgID.String(): {rbac.ActionRead},
 				}),
@@ -272,7 +277,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "Groups",
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceGroup.InOrg(orgID),
+			Resource: rbac.ResourceGroup.WithID(groupID).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, userAdmin, orgMemberMe},
 				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},