This is ready for review but I'm leaving this as a draft because it depends on #1265.

There's one issue I need to fix: currently, only privileged users can list Silo users. I imagine we'll want to make all users able to list users.

There's one issue I need to fix: currently, only privileged users can list Silo users. I imagine we'll want to make all users able to list users.

Not sure. Any authenticated user? Feels wrong, but I can't think of a good reason why. Are you thinking because anyone can create a project, and therefore be an admin on that project, and then they have to list user to assign roles? Can anyone create a project?

It's possible today to have (useful) users that cannot create Projects. They could potentially have full control over Projects that were shared with them.

But I feel like "name" and "id" information about all users in the same Silo is both reasonable and probably expected. Without this, you couldn't even see who else has access to the same thing that you have access to.

Without this, you couldn't even see who else has access to the same thing that you have access to.

Yeah, that makes sense. Wasn't sure whether this is expected. In the GitHub web UI I can't see this on a private repo for which I'm not an admin because they block access to the whole settings view. But it turns out you can still get the list of collaborators from the API:

gh api /repos/oxidecomputer/<repo>/collaborators | jq '.[] | { login, permissions }'

I wonder if there's a distinction to be made between listing users on a particular resource and enumerating all users?

I wonder if there's a distinction to be made between listing users on a particular resource and enumerating all users?

It's possible but tricky. I imagine we'll eventually add a /users/$uuid endpoint for looking up a specific user. It's not really feasible for that to check whether you and the requested user share any resources in common. We could provide that information when you list the policy (and not if you request the same user explicitly). It'd be a little inconsistent but maybe pragmatic.

It seems surprising to me that people would want to put two people in the same Silo that couldn't know about each other. Wouldn't you use different Silos for that? But if we're not sure, we can raise this with product.

I was picturing something more at the endpoint level, like you can't get anything out of /users unless you have the right permissions, and then on the /<resource>/policy endpoint the check is simply whether you have read access to the resource. But I agree that it adds a lot of complication for dubious value. Listing users if you are in the silo seems reasonable. We can think about restricting it later if it comes up.

Okay, this version lets all users see all users in their own Silo. I added this endpoint to the allowlist of things without authz test coverage because the test doesn't currently support endpoints that are totally public for all authenticated users. I will file a new ticket for this though because we have a couple of them now.

Edit: #1277.