feat(pbac): add FeatureOptIn resource to permission registry (#26761)

* feat(pbac): add Feature resource to permission registry

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat(pbac): add migration for Feature resource permissions

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat(pbac): add English translations for Feature resource

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat(pbac): update Feature resource for opt-in/opt-out control (read and update only)

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat(pbac): rename Feature to FeatureOptIn resource

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat(pbac): simplify update description text

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/web/public/static/locales/en/common.json

@@ -3786,7 +3786,7 @@
   "pbac_desc_view_routing_forms": "View routing forms",
   "pbac_desc_update_routing_forms": "Update routing forms",
   "pbac_desc_delete_routing_forms": "Delete routing forms",
-  "pbac_opt_in_title": "Enable Roles & Permissions for your organization",
+  "pbac_opt_in_title":"Enable Roles & Permissions for your organization",
   "pbac_opt_in_description": "Take control of your organization with customizable roles and granular permissions for your team members.",
   "pbac_opt_in_custom_roles_title": "Custom roles",
   "pbac_opt_in_custom_roles_desc": "Create custom roles tailored to your organization's unique workflow",
@@ -4284,5 +4284,8 @@
   "audit_logs_permission_check_error": "An error occurred while checking permissions.",
   "account_already_exists_please_login": "An account with this email already exists. Please log in to accept the invitation.",
   "unverified_email_oauth_error": "Please verify your email address before signing in with Google or SAML. Sign in with your password to resend the verification email.",
-  "ADD_NEW_STRINGS_ABOVE_THIS_LINE_TO_PREVENT_MERGE_CONFLICTS": "↑↑↑↑↑↑↑↑↑↑↑↑↑ Add your new strings above here ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑"
+  "pbac_resource_feature_opt_in": "Feature Opt-In",
+  "pbac_desc_view_feature_opt_in": "View feature opt-in settings",
+  "pbac_desc_update_feature_opt_in": "Manage feature opt-in settings",
+  "ADD_NEW_STRINGS_ABOVE_THIS_LINE_TO_PREVENT_MERGE_CONFLICTS":"↑↑↑↑↑↑↑↑↑↑↑↑↑ Add your new strings above here ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑"
 }

packages/features/pbac/domain/types/permission-registry.ts

@@ -13,6 +13,7 @@ export enum Resource {
   Availability = "availability",
   OutOfOffice = "ooo",
   Watchlist = "watchlist",
+  FeatureOptIn = "featureOptIn",
 }
 
 export enum CrudAction {
@@ -768,4 +769,22 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       dependsOn: ["watchlist.read"],
     },
   },
+  [Resource.FeatureOptIn]: {
+    _resource: {
+      i18nKey: "pbac_resource_feature_opt_in",
+    },
+    [CrudAction.Read]: {
+      description: "View feature opt-in settings",
+      category: "featureOptIn",
+      i18nKey: "pbac_action_read",
+      descriptionI18nKey: "pbac_desc_view_feature_opt_in",
+    },
+    [CrudAction.Update]: {
+      description: "Manage feature opt-in settings",
+      category: "featureOptIn",
+      i18nKey: "pbac_action_update",
+      descriptionI18nKey: "pbac_desc_update_feature_opt_in",
+      dependsOn: ["featureOptIn.read"],
+    },
+  },
 };

packages/prisma/migrations/20260112170655_pbac_add_feature_permissions/migration.sql

@@ -0,0 +1,18 @@
+INSERT INTO "RolePermission" (id, "roleId", resource, action, "createdAt")
+SELECT
+  gen_random_uuid(), 'admin_role', resource, action, NOW()
+FROM (
+  VALUES
+    ('featureOptIn', 'read'),
+    ('featureOptIn', 'update')
+) AS permissions(resource, action)
+ON CONFLICT ("roleId", resource, action) DO NOTHING;
+
+INSERT INTO "RolePermission" (id, "roleId", resource, action, "createdAt")
+SELECT
+  gen_random_uuid(), 'member_role', resource, action, NOW()
+FROM (
+  VALUES
+    ('featureOptIn', 'read')
+) AS permissions(resource, action)
+ON CONFLICT ("roleId", resource, action) DO NOTHING;