* fix: always check team.parentID even if no membership
* refactor permission handling in create event type handler
* remove hasMembership
---------
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
* feat: add Webhook resource to PBAC system with permission enforcement
- Add Webhook resource to PBAC permission registry with CRUD actions
- Implement PBAC permission checks in webhook handlers (create, edit, delete)
- Add webhook permission translations to common.json
- Use PermissionCheckService with fallback roles [ADMIN, OWNER] for team webhooks
- Maintain backward compatibility when PBAC is disabled
- Follow same pattern as workflow PBAC implementation from PR #22845
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: implement PBAC permission filtering in webhook list handler
- Add PermissionCheckService to filter team webhooks by webhook.read permission
- Only show webhooks from teams where user has proper permissions
- Maintain backward compatibility with fallback to all team memberships
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add migration for default roles
* new forUserMethod
* update webhook repository
* fix UI showing/hiding webhooks for webhoo.create teams
* WIP pbac procedure migratoin + tests
* add more roles to get fallback
* permissions in cmponents instead of readOnly
* passPermissions to list item
* push instant events logic
* Git merge
* wip teamId accessable refactor
* fix delete handler
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix members page crash with pbac feature flag
* invite member to org backend
* update org permissions
* feat: org profile update settings
* org general page
* remove redudant me call
* privacy page
* add attributes to pbac
* dync + sso on organization permissions
* add tests for resource-permission util
* pass permissions to attributes\
* restore invite members
* update org update and attribute backends
* fix type errors
* fix orgId
* fix types attempt two
* fix types attempt two
* fix type error
* show/hide team event types based on eventType.read permission
* fix dupe string in i18n
* fix tests
* fix team-dsync
* update session to use profile
* use profile metadata to get orgRolew
* fix dsync
* fix typing
* Event type create pbac check
* fix the readonly permission check. WIP
* refactor getUserEventTypes
* fix test
* add generate util for update
* update router to use new generator function for pbac procedures
* update transform utils
* fix members being able to update on UI
* fix allSettled
* fix fallback permissions
* fix permission logic
* fix compare memebrship type error
* fix unit test error
* fix manage test error
* fix nested permissions
* filter based on canView permission in getUserEventGroups
* Update packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix tests
* fix tests
* feat: Adding workflow permission checks inside of eventTypes (#23038)
* add permission checks for workflows
* wip getall active workflows
* check eventType.update permission on activiating workflow on event type
* pass permissions to context and use context in client
* remove local parsePermissionString and use registery
* Use new scoped function
* default scope to orgs
* use object values for workflow permissions
* fix type errors
* Fix permission traversal + fix all state caluclation
* fix eventType group to use permissions.canRead
* fix: update failing PBAC unit tests and resolve ESLint warnings
- Fix getUserEventGroups test: MEMBER role should not have update permissions in fallback scenario
- Fix EventTypeGroupFilter test: add missing canRead property to mock permissions map
- Replace 'as any' type assertions with proper 'as unknown as' type assertions to resolve ESLint warnings
Both tests now pass and align with PBAC permission model where MEMBER role has read-only access to event types.
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add pbac to _heavy router
* Merge main
* restore versions
* Parallelizable members query
* fix nits
* fix create
* Restore lock file
* Fix import from merge artifact
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* PBAC on team members page + org members page to use specific permissions with fallbacks
* Implement checks on edit sheet fetch to check for permisisons
* WIP permission fixes
* fix tests
* WIP
* fix edit mode perms
* fix remove and list view permissions
* fix add
* feat: add pbac permissions for impersonation (#23035)
* registery + migration + i18n
* UI for can impersonate
* impersonation backend
* remove permission from db query
* add missing prisma import
* add resend invitation and edit mode checks for delete/changeRole
* fix canChangeRole
* canChangeRole gate
* fix permission logic
* fix depends on
* push migration
* fix migration
* fix scoped advanced permissions
* use listMembers instead of invite proxy
* remove isOrgAdmin check to rely on pbac
* wait for session to load before navigating
* use event-types testId to ensure session loaded
* use profile page instead of eventTypes
* use correct roles
* fix wait for session
* correct orgs private isFallBackRoles
* set a timeout on waiting for session
* remove adminOrOwner check since its in fallpack
---------
Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
* Revert "fix: remove fallback permssions on organization Id. (#22769)"
This reverts commit 30061c0d58.
Removes the manage permission concept and fallback logic to simplify
permission checking back to direct role-based checks.
* remove manage from workflows
* fix type error and remove manage from components
* fix: apply PBAC to routing form CRUD
* apply permission checks to the UI
* moving prisma call to repository [WIP]
* rename repository and fix type error
* update implementation
* fix formMutation handler
* remove unused import
* revert some rename
* add RolePermission for 'routingForm'
* Revert "revert some rename"
This reverts commit 0ef3114c0d27b821271b36296de531654b37749f.
* clean up PrismaRoutingFormRepository
* fix unit test
* remove no longer necessary code
* fix type definition
* explicit permission handling
* do not disable un-editable routing form
* fix: correct property name from readonly to readOnly in ListLinkItem
- Fix TypeScript error in routing forms component
- Change readonly={readOnly} to readOnly={readOnly} to match component interface
- Resolves type check failure in CI
Co-Authored-By: hariom@cal.com <hariombalhara@gmail.com>
---------
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* add fallback to service
* fix: org memebership fallback
* remove log
* remove log
* add merge test case
* add test for no parentId on team for getResources
* migration plus feature flag
* show navigation route + inital roles migration
* add a check permission use case to take in the feature flags for a team
* bulk update script
* inital frontend work for displaying roles
* move to a more "anemic domain models" approach
* update test to match new DDD strutcture
* fix tests
* update transaction call back types to include trx
* align fe types after transaction to DDD
* move away from usecases to a more domain tailored approach
* get permissions per resource and map them to domain permission string
* update permision logic
* correctly get the logic for *.* permissions on owner
* wip sheet logic for ssr
* role list
* use nuqs for sheet parsing on handle change
* fox
* improve hook usage
* enable PBAC router
* delete modal etc
* i18n and inital rough layout of roles + permisions creating
* add color to migrations
* add colors and new method to tests
* move hooks out of infra into client with provider
* move hooks out of infra into client with provider
* memo features and ensure render once
* remove comment
* seed color
* use role colours
* match i18n
* add custom color picker to edit/create form
* fix advanced mode toggle
* more work on adv permission group
* update migrations
* abstract lots of core form logic to a custom hook
* improve UX for selecting all and toggling all
* improve code quality and use domain mappers in role repositoryu
* call server action to revalidate cache
* call invalidate cache on delete
* fix re-render + improves update logic wip
* fix txn for assinging role to member
* wip on assigning users custom roles
* fix repo
* update logic for checking if users can update roles
* remove member from permission check
* check users permission and assign roles
* move to factory approach
* move default rolesIDs to constant
* add facuted values to table
* display custom role in table
* fix type error
* fix role filter
* check pbac feature flag to see what column to filter on
* push repo mocks and other mocks to fix unit tests
* fix and add test for empty permissions when creating a role
* pass updates to repo so we actually update roles
* fix types
* fix types
* restore lock changes
* fix role service test for new updates section
* fix updated at types
* update mocks to use feature repository mock
* remove roletype from db in model
* prevent multiple queries
* fix typeof in role model
* fix and migrate i18n to one registery
* fix and update i18n to be in registery
* fix type error + fall back in service instead of repo for BL
* more type errors
* update members faceted values to bennys refactor
* fix types
* remove the _resource from type conditionally
* fix managment factory types to expose PBAC enbaled obol
* narrow down types
* wip fix for types
* more fix types
* cast role
* fix tests
* attempt of fixing _resoucre key access type
* attempt of fixing _resoucre key access type
* seperate migraations to batches
* add invalidate time to team features
* restore router to main
* push main lock
* Update packages/features/pbac/domain/types/permission-registry.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/features/pbac/domain/mappers/PermissionMapper.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250527091330_add_color_to_pbac_role/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250617070118_update_memberships_one_time/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix mapped type
* restore migration
* skip _resource
* use partical
* fix type errors in tests and hooks
* Simplified the role field in the editSchema to use z.nativeEnum(MembershipRole)
* fix type errors for editsheet
* fix type errors for editsheet
* Apply suggestion from comment 2151515295
* remove footer since we dont have docs yet
* add i18n
* lock all toggle chevron
* use prisma
* tidy up old manage permission
* fix i18n
* remove can manage from role permission check
* auto select read
* address benny feedback
* fix type
* fix type
* update function name due to merge
* fix types
* update tests to match new membership method from merge
* address cubic feedback
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
sean-brydonandMorgan
