feat: enable Coder Agents for organization members - #28186
Conversation
Docs previewCheck off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0ff6615d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| SET default_org_member_roles = array_append(default_org_member_roles, 'agents-access') | ||
| WHERE NOT ('agents-access' = ANY(default_org_member_roles)); |
There was a problem hiding this comment.
When this migration is rolled back, adding agents-access to default_org_member_roles grants it to service accounts as well, because GetAuthorizationUserRoles unions organization defaults into every membership, including accounts receiving the separate organization-service-account role. This defeats the new explicit omission of chat permissions for service accounts and gives machine credentials Coder Agents access after a production rollback. Restore the role only on regular users' membership rows, rather than making it an organization default.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
make genmake lintgit diff --checkRollback note
The down migration restores effective access broadly because it cannot reconstruct which users previously held the removed role.