feat: add template RBAC/groups (#4235)

coderd/database/modelmethods.go

@@ -1,9 +1,65 @@
 package database
 
 import (
+	"encoding/json"
+	"fmt"
+
 	"github.com/coder/coder/coderd/rbac"
 )
 
+const AllUsersGroup = "Everyone"
+
+// TemplateACL is a map of user_ids to permissions.
+type TemplateACL map[string][]rbac.Action
+
+func (t Template) UserACL() TemplateACL {
+	var acl TemplateACL
+	if len(t.userACL) == 0 {
+		return acl
+	}
+
+	err := json.Unmarshal(t.userACL, &acl)
+	if err != nil {
+		panic(fmt.Sprintf("failed to unmarshal template.userACL: %v", err.Error()))
+	}
+
+	return acl
+}
+
+func (t Template) GroupACL() TemplateACL {
+	var acl TemplateACL
+	if len(t.groupACL) == 0 {
+		return acl
+	}
+
+	err := json.Unmarshal(t.groupACL, &acl)
+	if err != nil {
+		panic(fmt.Sprintf("failed to unmarshal template.userACL: %v", err.Error()))
+	}
+
+	return acl
+}
+
+func (t Template) SetGroupACL(acl TemplateACL) Template {
+	raw, err := json.Marshal(acl)
+	if err != nil {
+		panic(fmt.Sprintf("marshal user acl: %v", err))
+	}
+
+	t.groupACL = raw
+	return t
+}
+
+func (t Template) SetUserACL(acl TemplateACL) Template {
+	raw, err := json.Marshal(acl)
+	if err != nil {
+		panic(fmt.Sprintf("marshal user acl: %v", err))
+	}
+
+	t.userACL = raw
+	return t
+}
+
 func (s APIKeyScope) ToRBAC() rbac.Scope {
 	switch s {
 	case APIKeyScopeAll:
@@ -16,12 +72,19 @@ func (s APIKeyScope) ToRBAC() rbac.Scope {
 }
 
 func (t Template) RBACObject() rbac.Object {
-	return rbac.ResourceTemplate.InOrg(t.OrganizationID)
+	obj := rbac.ResourceTemplate
+	return obj.InOrg(t.OrganizationID).
+		WithACLUserList(t.UserACL()).
+		WithGroupACL(t.GroupACL())
 }
 
-func (t TemplateVersion) RBACObject() rbac.Object {
+func (TemplateVersion) RBACObject(template Template) rbac.Object {
 	// Just use the parent template resource for controlling versions
-	return rbac.ResourceTemplate.InOrg(t.OrganizationID)
+	return template.RBACObject()
+}
+
+func (g Group) RBACObject() rbac.Object {
+	return rbac.ResourceGroup.InOrg(g.OrganizationID)
 }
 
 func (w Workspace) RBACObject() rbac.Object {