prebuilds now support non-default organizations in manual testing. un…

…it tests to follow
coder · SasSwart · Jun 4, 2025 · May 22, 2025 · May 23, 2025 · May 23, 2025
commit 920436bfaa618bc7f62f04c72f73a812ce954de1
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -390,6 +390,18 @@ var (
 						policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
 						policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
 					},
+					// Should be able to add the prebuilds system user as a member to any organization that needs prebuilds.
+					rbac.ResourceOrganizationMember.Type: {
+						policy.ActionCreate,
+					},
+					// Needs to be able to assign roles to the system user in order to make it a member of an organization.
+					rbac.ResourceAssignOrgRole.Type: {
+						policy.ActionAssign,
+					},
+					// Needs to be able to read users to determine which organizations the prebuild system user is a member of.
+					rbac.ResourceUser.Type: {
+						policy.ActionRead,
+					},
 				}),
 			},
 		}),

diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -33,6 +33,8 @@ const (
 	orgUserAdmin            string = "organization-user-admin"
 	orgTemplateAdmin        string = "organization-template-admin"
 	orgWorkspaceCreationBan string = "organization-workspace-creation-ban"
+
+	prebuildsOrchestrator string = "prebuilds-orchestrator"
 )
 
 func init() {
@@ -599,6 +601,9 @@ var assignRoles = map[string]map[string]bool{
 	orgUserAdmin: {
 		orgMember: true,
 	},
+	prebuildsOrchestrator: {
+		orgMember: true,
+	},
 }
 
 // ExpandableRoles is any type that can be expanded into a []Role. This is implemented

diff --git a/enterprise/coderd/prebuilds/membership.go b/enterprise/coderd/prebuilds/membership.go
@@ -28,26 +28,30 @@ type StoreMembershipReconciler struct {
 //
 // This method does not have an opinion on transaction or lock management. These responsibilities are left to the caller.
 func (s StoreMembershipReconciler) ReconcileAll(ctx context.Context) error {
-	systemUserMemberships, err := s.store.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
-		UserID: s.userID,
-	})
+	membershipsByUserID, err := s.store.GetOrganizationIDsByMemberIDs(ctx, []uuid.UUID{s.userID})
 	if err != nil {
 		return xerrors.Errorf("determine prebuild organization membership: %w", err)
 	}
 
+	systemUserMemberships := []uuid.UUID{}
+	if len(membershipsByUserID) == 1 {
+		systemUserMemberships = membershipsByUserID[0].OrganizationIDs
+	}
+	addedMemberships := []uuid.UUID{}
+
 	var membershipInsertionErrors error
 	for _, preset := range s.snapshot.Presets {
 		systemUserNeedsMembership := true
-		for _, systemUserMembership := range systemUserMemberships {
-			if systemUserMembership.ID == preset.OrganizationID {
+		for _, systemUserMembership := range append(systemUserMemberships, addedMemberships...) {
+			if systemUserMembership == preset.OrganizationID {
 				systemUserNeedsMembership = false
 				break
 			}
 		}
 		if systemUserNeedsMembership {
 			_, err = s.store.InsertOrganizationMember(ctx, database.InsertOrganizationMemberParams{
 				OrganizationID: preset.OrganizationID,
-				UserID:         prebuilds.SystemUserID,
+				UserID:         s.userID,
 				CreatedAt:      s.clock.Now(),
 				UpdatedAt:      s.clock.Now(),
 				Roles:          []string{
@@ -56,7 +60,9 @@ func (s StoreMembershipReconciler) ReconcileAll(ctx context.Context) error {
 			})
 			if err != nil {
 				membershipInsertionErrors = errors.Join(membershipInsertionErrors, xerrors.Errorf("insert membership for prebuilt workspaces: %w", err))
+				continue
 			}
+			addedMemberships = append(addedMemberships, preset.OrganizationID)
 		}
 	}
 	return membershipInsertionErrors

diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go
@@ -251,8 +251,8 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
 
 	logger.Debug(ctx, "starting reconciliation")
 
-	err := c.WithReconciliationLock(ctx, logger, func(ctx context.Context, db database.Store) error {
-		snapshot, err := c.SnapshotState(ctx, db)
+	err := c.WithReconciliationLock(ctx, logger, func(ctx context.Context, _ database.Store) error {
+		snapshot, err := c.SnapshotState(ctx, c.store)
 		if err != nil {
 			return xerrors.Errorf("determine current snapshot: %w", err)
 		}
@@ -261,15 +261,17 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
 			return nil
 		}
 
+		// nolint:gocritic // ReconcilePreset needs Prebuilds Orchestrator permissions.
+		prebuildsMembershipCtx := dbauthz.AsPrebuildsOrchestrator(ctx)
 		membershipReconciler := StoreMembershipReconciler{
-			store:    db,
+			store:    c.store,
 			clock:    c.clock,
 			snapshot: snapshot,
 			userID:   prebuilds.SystemUserID,
 		}
-		err = membershipReconciler.ReconcileAll(ctx)
+		err = membershipReconcil
6B1B
er.ReconcileAll(prebuildsMembershipCtx)
 		if err != nil {
-			logger.Warn(ctx, "reconciling prebuild membership", slog.Error(err))
+			logger.Warn(ctx, "reconcile prebuild membership", slog.Error(err))
 			return nil
 		}