fix: allow group members to read group information (#14200)

* - allow group members to read basic Group info
- allow group members to see they are part of the group, but not see that information about other members
- add a GetGroupMembersCountByGroupID SQL query, which allows group members to see members count without revealing other information about the members
- add the group_members_expanded db view
- rewrite group member queries to use the group_members_expanded view
- add the RBAC ResourceGroupMember and add it to relevant roles
- rewrite GetGroupMembersByGroupID permission checks
- make the GroupMember type contain all user fields
- fix type issues coming from replacing User with GroupMember in group member queries
- add the MemberTotalCount field to codersdk.Group
- display `group.total_member_count` instead of `group.members.length` on the account page

coderd/database/dbauthz/groupsauth_test.go

@@ -115,18 +115,15 @@ func TestGroupsAuth(t *testing.T) {
 			Name: "GroupMember",
 			Subject: rbac.Subject{
 				ID:    users[0].ID.String(),
-				Roles: rbac.Roles(must(rbac.RoleIdentifiers{rbac.ScopedRoleOrgMember(org.ID)}.Expand())),
+				Roles: rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleMember(), rbac.ScopedRoleOrgMember(org.ID)}.Expand())),
 				Groups: []string{
-					group.Name,
+					group.ID.String(),
 				},
 				Scope: rbac.ExpandableScope(rbac.ScopeAll),
 			},
-			// TODO: currently group members cannot see their own groups.
-			//	If this is fixed, these booleans should be flipped to true.
-			ReadGroup:   false,
-			ReadMembers: false,
-			// TODO: If fixed, they should only be able to see themselves
-			// MembersExpected: 1,
+			ReadGroup:       true,
+			ReadMembers:     true,
+			MembersExpected: 1,
 		},
 		{
 			// Org admin in the incorrect organization
@@ -160,8 +157,7 @@ func TestGroupsAuth(t *testing.T) {
 				require.NoError(t, err, "member read")
 				require.Len(t, members, tc.MembersExpected, "member count found does not match")
 			} else {
-				require.Error(t, err, "member read")
-				require.True(t, dbauthz.IsNotAuthorizedError(err), "not authorized error")
+				require.Len(t, members, 0, "member count is not 0")
 			}
 		})
 	}