GeezerVison

Part of CODAGT-1341.

Adds the read side of the organization skills API: GET /api/experimental/organizations/{organization}/skills and GET .../skills/{skillName}. Like the personal skill routes, they are not gated by an experiment or a license. The list calls ListOrganizationSkillMetadataByOrganizationID with the caller's own permissions, so org admins, the site owner and org auditors see every skill, while members see only skills shared with them through the group or user ACL. Disabled skills are listed with enabled: false, and clients filter them. Callers outside the organization get 404 from the organization parameter middleware.

GET .../{skillName} uses the new httpmw.ExtractOrganizationSkillParam(db, auth, actions...), modeled on ExtractMCPServerConfigParam. It reads the skill by organization and name without permission checks, then returns 404 unless the caller can perform at least one of the listed actions on Skill.RBACObject(), so a missing skill and a denied one look the same. GET admits only read, so a key scoped to organization_skill:update or organization_skill:delete without read gets 404. The SDK adds OrganizationSkills and OrganizationSkillByName, and db2sdk adds OrganizationSkillMetadataList. Create, update, delete and audit come in the next layer.

Testing

• New coderd/organizationskills_test.go TestOrganizationSkillAccess, with skills seeded through dbgen.OrganizationSkill:
  • a member reads a skill shared with Everyone;
  • a user-ACL grant is visible only to that user;
  • an org auditor can list and get;
  • a member of another organization gets 404;
  • an API key scoped to organization_skill:read can list and get, while WriteScopedAPIKeyCannotRead keys scoped to update or delete get 404 (fails on the old route).
• Red-green: making the middleware allow every caller fails the user-ACL case, and so does running the list query with system permissions.
• Ran the coderd tests, TestEnterpriseEndpointsDocumented, golangci-lint on the touched packages, and the pre-commit hook.

Review record

• Remote UAT round 6 through Coder Agents: PASS on the final stack tip afdd4a9f954 (chat); its low notes are in docs(docs/ai-coder/agents): document organization skills #30604.
• Parent review kept GET accepting read, update, or delete, as ExtractMCPServerConfigParam does on the MCP routes; Codex round 1 limited it to read (7d70608), so update or delete scoped keys can't read content through GET.
• Test audit: dropped a subtest that cleared the Everyone grant with raw SQL and checked that a member loses access. UserACLGrantsOnlyThatUser already covers a member without a grant, and the ACL routes layer tests revoking the grant through the API.

This stack adds organization skills to Coder Agents: admins publish a skill once per organization, share it with groups or members, and chats in that organization load it next to personal and workspace skills.
Stack, bottom to top: #30584, #30585, #30586, #30587, #30588, #30589, #30590, #30591, #30592, #30593, #30594, #30595, #30596, #30597, #30598, #30599, #30600, #30601, #30602, #30603, #30604.

Xum opened this PR on behalf of @ibetitsmike.