remove * and remove site-wide perms for secrets

Author: evgeniy-scherbina

coderd/rbac/roles.go

@@ -270,7 +270,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		Site: append(
 			// Workspace dormancy and workspace are omitted.
 			// Workspace is specifically handled based on the opts.NoOwnerWorkspaceExec
-			allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceWorkspace),
+			allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceWorkspace, ResourceUserSecret),
 			// This adds back in the Workspace permissions.
 			Permissions(map[string][]policy.Action{
 				ResourceWorkspace.Type:        ownerWorkspaceActions,

coderd/rbac/scopes.go

@@ -53,7 +53,6 @@ func WorkspaceAgentScope(params WorkspaceAgentScopeParams) Scope {
 			params.TemplateID.String(),
 			params.VersionID.String(),
 			params.OwnerID.String(),
-			"*",
 		},
 	}
 }