like this right?

coder · aslilac · Apr 17, 2025 · Apr 15, 2025 · Apr 15, 2025 · Apr 15, 2025
commit 35ac954a9193d291635b7ab0db18219abcce198f
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 			// The idea is to return an empty [], so that the coder CLI won't get blocked accidentally.
 			r.Get("/schema", templateVersionSchemaDeprecated)
 			r.Get("/parameters", templateVersionParametersDeprecated)
-			r.Group(func(r chi.Router) {
-				r.Use(httpmw.RequireExperiment(api.Experiments, codersdk.ExperimentDynamicParameters))
-				r.Get("/dynamic-parameters", api.templateVersionDynamicParameters)
-			})
 			r.Get("/rich-parameters", api.templateVersionRichParameters)
 			r.Get("/external-auth", api.templateVersionExternalAuth)
 			r.Get("/variables", api.templateVersionVariables)
@@ -1169,6 +1165,17 @@ func New(options *Options) *API {
 						// organization member. This endpoint should match the authz story of
 						// postWorkspacesByOrganization
 						r.Post("/workspaces", api.postUserWorkspaces)
+
+						// Similarly to creating a workspace, evaluating parameters for a
+						// new workspace should also match the authz story of
+						// postWorkspacesByOrganization
+						r.Route("/templateversions/{templateversion}", func(r chi.Router) {
+							r.Use(
+								httpmw.ExtractTemplateVersionParam(options.Database),
+								httpmw.RequireExperiment(api.Experiments, codersdk.ExperimentDynamicParameters),
+							)
+							r.Get("/parameters", api.templateVersionDynamicParameters)
+						})
 					})
 
 					r.Group(func(r chi.Router) {

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2102,6 +2102,13 @@ func (q *querier) GetOrganizationIDsByMemberIDs(ctx context.Context, ids []uuid.
 	return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetOrganizationIDsByMemberIDs)(ctx, ids)
 }
 
+func (q *querier) GetOrganizationMemberRoles(ctx context.Context, params database.GetOrganizationMemberRolesParams) ([]string, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOrganizationMember.InOrg(params.OrganizationID)); err != nil {
+		return nil, err
+	}
+	return q.db.GetOrganizationMemberRoles(ctx, params)
+}
+
 func (q *querier) GetOrganizationResourceCountByID(ctx context.Context, organizationID uuid.UUID) (database.GetOrganizationResourceCountByIDRow, error) {
 	// Can read org members
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOrganizationMember.InOrg(organizationID)); err != nil {

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -874,6 +874,13 @@ func (s *MethodTestSuite) TestOrganization() {
 		check.Args([]uuid.UUID{ma.UserID, mb.UserID}).
 			Asserts(rbac.ResourceUserObject(ma.UserID), policy.ActionRead, rbac.ResourceUserObject(mb.UserID), policy.ActionRead).OutOfOrder()
 	}))
+	s.Run("GetOrganizationMemberRoles", s.Subtest(func(db database.Store, check *expects) {
+		o := dbgen.Organization(s.T(), db, database.Organization{})
+		u := dbgen.User(s.T(), db, database.User{})
+		_ = dbgen.OrganizationMember(s.T(), db, database.OrganizationMember{OrganizationID: o.ID, UserID: u.ID})
+		check.Args(database.GetOrganizationMemberRolesParams{OrganizationID: o.ID, UserID: u.ID}).
+			Asserts(rbac.ResourceOrganizationMember.InOrg(o.ID), policy.ActionRead)
+	}))
 	s.Run("GetOrganizations", s.Subtest(func(db database.Store, check *expects) {
 		def, _ := db.GetDefaultOrganization(context.Background())
 		a := dbgen.Organization(s.T(), db, database.Organization{})

diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
@@ -4094,6 +4094,16 @@ func (q *FakeQuerier) GetOrganizationIDsByMemberIDs(_ context.Context, ids []uui
 	return getOrganizationIDsByMemberIDRows, nil
 }
 
+func (q *FakeQuerier) GetOrganizationMemberRoles(ctx context.Context, params database.GetOrganizationMemberRolesParams) ([]string, error) {
+	for _, it := range q.organizationMembers {
+		if it.UserID == params.UserID && it.OrganizationID == params.OrganizationID {
+			return it.Roles, nil
+		}
+	}
+
+	return nil, sql.ErrNoRows
+}
+
 func (q *FakeQuerier) GetOrganizationResourceCountByID(_ context.Context, organizationID uuid.UUID) (database.GetOrganizationResourceCountByIDRow, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/organizationmembers.sql b/coderd/database/queries/organizationmembers.sql
@@ -95,3 +95,12 @@ ORDER BY
 LIMIT
 	-- A null limit means "no limit", so 0 means return all
 	NULLIF(@limit_opt :: int, 0);
+
+-- name: GetOrganizationMemberRoles :one
+SELECT
+	roles
+FROM
+	organization_members
+WHERE
+	user_id = @user_id
+	AND organization_id = @organization_id;