add database.WorkspaceACL type

coder · aslilac · Jul 30, 2025 · Jul 29, 2025 · Jul 29, 2025 · Jul 29, 2025
commit a20cd4f78de5d502fbf12f1aaf6d8bd66feb6e2f
diff --git a/coderd/database/dbgen/dbgen_test.go b/coderd/database/dbgen/dbgen_test.go
@@ -168,6 +168,8 @@ func TestGenerator(t *testing.T) {
 			DeletingAt:        w.DeletingAt,
 			AutomaticUpdates:  w.AutomaticUpdates,
 			Favorite:          w.Favorite,
+			GroupACL:          database.WorkspaceACL{},
+			UserACL:           database.WorkspaceACL{},
 		}
 		require.Equal(t, exp, table)
 	})

diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
@@ -73,6 +73,18 @@ sql:
           - column: "template_usage_stats.app_usage_mins"
             go_type:
               type: "StringMapOfInt"
+          - column: "workspaces.user_acl"
+            go_type:
+              type: "WorkspaceACL"
+          - column: "workspaces.group_acl"
+            go_type:
+              type: "WorkspaceACL"
+          - column: "workspaces_expanded.user_acl"
+            go_type:
+              type: "WorkspaceACL"
+          - column: "workspaces_expanded.group_acl"
+            go_type:
+              type: "WorkspaceACL"
           - column: "notification_templates.actions"
             go_type:
               type: "[]byte"

diff --git a/coderd/database/types.go b/coderd/database/types.go
@@ -77,6 +77,28 @@ func (t TemplateACL) Value() (driver.Value, error) {
 	return json.Marshal(t)
 }
 
+type WorkspaceACL map[string]WorkspaceACLEntry
+
+func (t *WorkspaceACL) Scan(src interface{}) error {
+	switch v := src.(type) {
+	case string:
+		return json.Unmarshal([]byte(v), &t)
+	case []byte, json.RawMessage:
+		//nolint
+		return json.Unmarshal(v.([]byte), &t)
+	}
+
+	return xerrors.Errorf("unexpected type %T", src)
+}
+
+func (t WorkspaceACL) Value() (driver.Value, error) {
+	return json.Marshal(t)
+}
+
+type WorkspaceACLEntry struct {
+	Permissions []policy.Action `json:"permissions"`
+}
+
 type ExternalAuthProvider struct {
 	ID       string `json:"id"`
 	Optional bool   `json:"optional,omitempty"`

@@ -60,9 +60,9 @@ func (ACLMappingVar) UseAs() sqltypes.Node { return ACLMappingVar{} }
 
 func (g ACLMappingVar) ConvertVariable(rego ast.Ref) (sqltypes.Node, bool) {
 	// "left" will be a map of group names to actions in rego.
-	//	{
-	//	 "all_users": ["read"]
-	//	}
+	// {
+	//   "all_users": ["read"]
+	// }
 	left, err := sqltypes.RegoVarPath(g.StructPath, rego)
 	if err != nil {
 		return nil, false