From 573132198e854c08820eabc12a26477bc48a0bed Mon Sep 17 00:00:00 2001
From: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
Date: Wed, 15 Oct 2025 22:04:43 +0100
Subject: [PATCH] Fix pbac being enabled when a team has ANY features (#24494)

---
 .../settings/(settings-layout)/layout.tsx     | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx
index 87496b1e5a..b106939634 100644
--- a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx
+++ b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx
@@ -53,16 +53,23 @@ export default async function SettingsLayoutAppDir(props: SettingsLayoutProps) {
   // For now we only grab organization features but it would be nice to fetch these on the server side for specific team feature flags
   if (orgId) {
     const isOrgAdminOrOwner = checkAdminOrOwner(session.user.org?.role);
-    const [features, rolePermissions, organizationPermissions] = await Promise.all([
-      getTeamFeatures(orgId),
-      getCachedResourcePermissions(userId, orgId, Resource.Role),
-      getCachedResourcePermissions(userId, orgId, Resource.Organization),
-    ]);
+    const features = await getTeamFeatures(orgId);
 
     if (features) {
       teamFeatures = {
         [orgId]: features,
       };
+    }
+
+    // Check if PBAC feature is enabled
+    const isPbacEnabled = features?.pbac === true;
+
+    if (isPbacEnabled) {
+      // Only fetch and apply PBAC permissions if the feature is enabled
+      const [rolePermissions, organizationPermissions] = await Promise.all([
+        getCachedResourcePermissions(userId, orgId, Resource.Role),
+        getCachedResourcePermissions(userId, orgId, Resource.Organization),
+      ]);
 
       // Check if user has permission to read roles
       const roleActions = PermissionMapper.toActionMap(rolePermissions, Resource.Role);
@@ -71,7 +78,8 @@ export default async function SettingsLayoutAppDir(props: SettingsLayoutProps) {
       canViewOrganizationBilling = orgActions[CustomAction.ManageBilling] ?? isOrgAdminOrOwner;
       canUpdateOrganization = orgActions[CrudAction.Update] ?? isOrgAdminOrOwner;
     } else {
-      canViewRoles = false;
+      // Fall back to legacy permissions when PBAC is not enabled or features not loaded
+      canViewRoles = features ? isOrgAdminOrOwner : false;
       canViewOrganizationBilling = isOrgAdminOrOwner;
       canUpdateOrganization = isOrgAdminOrOwner;
     }