refactor(coderd): restore agents-access cleanup migration by ibetitsmike · Pull Request #28587 · coder/coder

ibetitsmike · 2026-08-25T17:38:14Z

Summary

restore the agents-access data cleanup migration as 000587 (renumbered from 000585; main advanced past that number)
revert the temporary RBAC tolerance for retired role names now that the migration strips stale grants
make the migration test discover its predecessor dynamically, since this branch does not carry main's 000585/000586

Stack context

Stacked on #28186, which retires the agents-access role but intentionally ships without a migration so it can be backported across diverged migration numbers. This layer completes the retirement on main: it cleans up stale role grants in users.rbac_roles, organization_members.roles, and organizations.default_org_member_roles, then reverts the interim leniency (role expansion dropping legacy names, assignment validation ignoring them) that existed only to keep the migration-less base safe. rbac.ReservedRoleName still reserves the retired name so custom roles cannot shadow it on rollback. Do not backport this PR alongside the base PR.

Rollback note

The down migration restores effective access broadly because it cannot reconstruct which users previously held the removed role.

Validation

go build ./coderd/... ./enterprise/...
full coderd/database/migrations, coderd/rbac/..., and coderd/database/dbauthz suites
targeted members tests in coderd
repository pre-commit checks (lint/go, lint/ts, etc.)

Mux created this pull request on Mike's behalf.

…mber test

…Agents access control

…urrent Coder Agents copy

Keep this PR migration-free so it backports cleanly across diverged migration numbers. Stale agents-access grants may now linger in role arrays and org default role lists, so treat retired role names as grants of nothing: role expansion drops them and assignment validation ignores them. A follow-up PR will clean up the stale data.

Reinstate the data cleanup that the base PR dropped to stay backportable, renumbered to 000587 because main advanced past 585. With stale grants migrated away, revert the temporary RBAC tolerance for retired role names: role expansion is strict again and assignment validation no longer filters legacy names. The migration test steps to the highest existing version below the target because this branch does not contain migrations 585 and 586 from main.

linear-code · 2026-08-25T17:38:17Z

CODAGT-554

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b722a80a34

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

# Conflicts: # docs/ai-coder/agents/getting-started.md

ibetitsmike · 2026-08-25T20:39:10Z

@codex review

…esponses

…on-neutral

…-default' into HEAD # Conflicts: # coderd/members_test.go

ibetitsmike · 2026-08-25T21:12:06Z

@codex review

…ce per line

…ment listings Also renames IsLegacyRoleName to IsRetiredRoleName so the helpers are named for behavior rather than history.

…sion claim

…-default' into HEAD # Conflicts: # coderd/database/db2sdk/db2sdk.go # coderd/database/dbauthz/dbauthz.go # coderd/members.go # coderd/members_test.go # coderd/rbac/roles.go # coderd/rbac/roles_test.go # coderd/rbac/rolestore/rolestore.go # coderd/rbac/rolestore/rolestore_test.go

ibetitsmike · 2026-08-25T21:50:42Z

@codex review

…s deletable

…-default' into HEAD # Conflicts: # coderd/members_test.go

ibetitsmike · 2026-08-25T22:21:50Z

@codex review

ibetitsmike · 2026-08-25T22:36:00Z

@codex review

ibetitsmike · 2026-08-26T11:31:58Z

@codex review

chatgpt-codex-connector · 2026-08-26T11:36:12Z

💡 Codex Review

coder/coderd/roles.go

Lines 103 to 104 in 86b3eef

    
           for _, role := range customRoles { 
        
           	canAssign := rbac.CanAssignRole(actorRoles, rbac.CustomSiteRole())

Keep retired custom roles out of assignment flows

On deployments where a custom role named agents-access predates the reservation, migration 587 leaves its custom_roles row intact, but removing this filter makes the role appear assignable again. The corresponding changes in canAssignRoles and rolestore.Expand then validate it as a custom role and activate its stored permissions after assignment, resurrecting a role that is intended to remain available only for deletion. Continue excluding retired names from assignment and expansion even after cleaning existing grants.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…s-access-cleanup # Conflicts: # coderd/rbac/roles.go

ibetitsmike · 2026-08-26T11:53:09Z

Posted by Xum, acting on Mike's behalf.

Addressed in b33e339 (the branch is also restacked onto main now that #28186 merged):

Kept every assignment/expansion exclusion from feat: enable Coder Agents for organization members #28186: the assignable-roles filter in coderd/roles.go, the retired-name skips in rbac.rolesByNames and rolestore.Expand, and the dbauthz rejections of explicit retired-name grants and newly added org defaults. A pre-reservation custom_roles row named agents-access therefore cannot be offered, granted, expanded, or re-created; it remains deletable only.
Narrowed this PR's revert to response-side filtering (members.go, users.go, db2sdk.go) and the stale-data integration test, since migration 000587 removes the stored grants and defaults those filters existed to hide.
Updated the coderd/rbac/roles.go comments to document the resurrection-guard rationale now that the cleanup migration exists.

ibetitsmike · 2026-08-26T11:53:10Z

@codex review

chatgpt-codex-connector · 2026-08-26T11:55:52Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: b33e3394d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike added 8 commits August 25, 2026 11:05

feat: enable Coder Agents for organization members

3ff9069

fix(coderd): promote queued message from a terminal chat status in me…

3c49c50

…mber test

fix: keep RoleAgentsAccess as a deprecated compatibility alias

9460577

docs(docs/ai-coder/agents): document model access lists as the Coder …

f0548ea

…Agents access control

refactor(coderd/rbac): track retired role names in a legacy set

dca5c57

fix(site/src/pages/AgentsPage): align settings story assertion with c…

478dc27

…urrent Coder Agents copy

github-actions Bot assigned ibetitsmike Aug 25, 2026

ibetitsmike marked this pull request as ready for review August 25, 2026 17:38

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread coderd/rbac/roles.go

ibetitsmike closed this Aug 25, 2026

ibetitsmike reopened this Aug 25, 2026

github-actions Bot locked and limited conversation to collaborators Aug 25, 2026

Merge remote-tracking branch 'origin/main' into HEAD

f5291e2

# Conflicts: # docs/ai-coder/agents/getting-started.md

ibetitsmike added 3 commits August 25, 2026 21:04

fix(coderd): drop retired role names in rolestore expansion and API r…

cbdad54

…esponses

fix(site/src/pages/AgentsPage): make chat access denied copy permissi…

e6f8311

…on-neutral

Merge remote-tracking branch 'origin/mike/codagt-554-enable-agents-by…

2cc13b4

…-default' into HEAD # Conflicts: # coderd/members_test.go

ibetitsmike added 5 commits August 25, 2026 21:14

docs(docs/ai-coder/agents): reflow prerequisites bullet to one senten…

861c378

…ce per line

fix(coderd): reject explicit grants of retired role names

73e1352

fix(coderd): extend retired-role rejection to org defaults and assign…

6889238

…ment listings Also renames IsLegacyRoleName to IsRetiredRoleName so the helpers are named for behavior rather than history.

docs(docs/ai-coder/agents): exclude service accounts from chat permis…

af0ab29

…sion claim

ibetitsmike added 3 commits August 25, 2026 21:54

fix(coderd): hide retired role names from the user-roles response

e1e6f9f

fix: hide retired roles in user payloads and keep retired custom role…

f429c4c

…s deletable

Merge remote-tracking branch 'origin/mike/codagt-554-enable-agents-by…

86b3eef

…-default' into HEAD # Conflicts: # coderd/members_test.go

coder unlocked this conversation Aug 26, 2026

ThomasK33 approved these changes Aug 26, 2026

View reviewed changes

Base automatically changed from mike/codagt-554-enable-agents-by-default to main August 26, 2026 11:33

ibetitsmike requested a review from DanielleMaywood as a code owner August 26, 2026 11:33

ibetitsmike added 2 commits August 26, 2026 11:44

Merge remote-tracking branch 'origin/main' into mike/codagt-554-agent…

8f07c6a

…s-access-cleanup # Conflicts: # coderd/rbac/roles.go

refactor(coderd): drop stale retired-role response filtering

b33e339

ibetitsmike merged commit 45f2eb4 into main Aug 26, 2026
28 checks passed

ibetitsmike deleted the mike/codagt-554-agents-access-cleanup branch August 26, 2026 13:29

github-actions Bot locked and limited conversation to collaborators Aug 26, 2026

Navigation Menu

Uh oh!

refactor(coderd): restore agents-access cleanup migration - #28587

refactor(coderd): restore agents-access cleanup migration#28587
ibetitsmike merged 22 commits into
mainfrom
mike/codagt-554-agents-access-cleanup

ibetitsmike commented Aug 25, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Aug 25, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 26, 2026

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ibetitsmike commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack context

Rollback note

Validation

Uh oh!

linear-code Bot commented Aug 25, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 25, 2026

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 26, 2026

💡 Codex Review

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

ibetitsmike commented Aug 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ibetitsmike commented Aug 25, 2026 •

edited

Loading