feat(enterprise/coderd): allow system users to be added to groups #18341
Conversation
…tem user so that they can configure quotas
There was a problem hiding this comment.
I'm wondering about this approach. Do we need to add IncludeSystem: true to all these queries just to support the prebuilds system user?
This means someone will need to manually create a group for the prebuilds user and assign it a quota, right?
Wouldn't it be more robust to automatically create a group for the prebuilds system user with a default quota, and allow users to override it if needed? That way, we avoid having to include system users in these queries and reduce the risk of system users leaking into user-facing features.
| -- Filter by system type | ||
| AND CASE | ||
| WHEN @include_system::bool THEN TRUE | ||
| ELSE | ||
| is_system = false | ||
| END |
There was a problem hiding this comment.
nit for readability:
| -- Filter by system type | |
| AND CASE | |
| WHEN @include_system::bool THEN TRUE | |
| ELSE | |
| is_system = false | |
| END | |
| -- Conditionally include system users based on @include_system flag | |
| AND (@include_system OR is_system = false) |
|
The prebuilds user has already leaked into user facing features. Administrators search for prebuilds by specifying the prebuilds user on the workspace list page. For consistency and clarity, I think we should embrace listing and showing the prebuilds user. I like the idea of automatically creating a prebuilds group, but we'll need to decide what a sensible default quota would be if there is such a value that makes sense. |
It’s true that the prebuilds user is already exposed in some user-facing features, like showing prebuilt workspaces, but that might not be the ideal approach 😕 The issue isn’t just about the prebuilds user, it extends to listing all current and future system users.
We already have a precedent with the coder/coderd/database/queries/groups.sql Lines 102 to 109 in 0cdcf89 We could apply the same pattern here: automatically create the prebuilds group with a default quota of 0, and clearly document this behavior along with instructions on how users can update the quota if needed. |
WalkthroughThis change updates the logic for retrieving organization and group members to consistently include system users, such as the prebuilds system user, by default. It introduces a new boolean parameter to control this behavior in both SQL queries and Go code, and updates related tests to expect the presence of system users in member lists. Changes
Sequence Diagram(s)sequenceDiagram
participant API
participant MembersService
participant Database
API->>MembersService: Request organization/group members
MembersService->>Database: Query members (IncludeSystem: true)
Database-->>MembersService: Return all members (including system users)
MembersService-->>API: Return member list with system users
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (7)
🧰 Additional context used📓 Path-based instructions (4)coderd/database/queries/*.sql📄 CodeRabbit Inference Engine (.cursorrules)
Files:
**/*_test.go📄 CodeRabbit Inference Engine (.cursorrules)
Files:
**/*.go📄 CodeRabbit Inference Engine (.cursorrules)
Files:
enterprise/**/*📄 CodeRabbit Inference Engine (.cursorrules)
Files:
🧠 Learnings (6)coderd/database/queries/organizationmembers.sql (1)Learnt from: CR coderd/members_test.go (7)Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: ThomasK33 enterprise/coderd/groups_test.go (3)Learnt from: CR Learnt from: CR Learnt from: CR coderd/members.go (1)Learnt from: CR enterprise/coderd/roles_test.go (6)Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: CR Learnt from: ThomasK33 enterprise/coderd/groups.go (3)Learnt from: CR Learnt from: CR Learnt from: CR 🔇 Additional comments (19)
✨ Finishing Touches
🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
closes #18274
This pull request makes system users visible in various group related queries so that they can be added to groups. This allows system user quotas to be configured. System users are still ignored in certain queries, such as when license seat consumption is determined.
Summary by CodeRabbit