Move custom role paywall to assignment step

backend/src/controllers/v1/membershipController.ts

@@ -6,7 +6,7 @@ import { deleteMembership as deleteMember, findMembership } from "../../helpers/
 import { sendMail } from "../../helpers/nodemailer";
 import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 import { getSiteURL } from "../../config";
-import { EEAuditLogService } from "../../ee/services";
+import { EEAuditLogService, EELicenseService } from "../../ee/services";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/membership";
 import {
@@ -137,6 +137,13 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
       workspace: membershipToChangeRole.workspace
     });
     if (!wsRole) throw BadRequestError({ message: "Role not found" });
+
+    const plan = await EELicenseService.getPlan(wsRole.organization);
+
+    if (!plan.rbac) return res.status(400).send({
+      message: "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member."
+    });
+
     const membership = await Membership.findByIdAndUpdate(membershipId, {
       role: CUSTOM,
       customRole: wsRole

backend/src/controllers/v2/organizationsController.ts

@@ -15,7 +15,7 @@ import {
 } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
 import * as reqValidator from "../../validation/organization";
 import { validateRequest } from "../../helpers/validation";
 import {
@@ -23,6 +23,7 @@ import {
   OrgPermissionSubjects,
   getUserOrgPermissions
 } from "../../ee/services/RoleService";
+import { EELicenseService } from "../../ee/services";
 import { ForbiddenError } from "@casl/ability";
 
 /**
@@ -152,10 +153,22 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
     OrgPermissionSubjects.Member
   );
 
-  const isCustomRole = !["admin", "member"].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER].includes(role);
   if (isCustomRole) {
-    const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
+    const orgRole = await Role.findOne({ 
+      slug: role, 
+      isOrgRole: true,
+      organization: new Types.ObjectId(organizationId)
+    });
+
     if (!orgRole) throw BadRequestError({ message: "Role not found" });
+    
+    const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
+    
+    if (!plan.rbac) return res.status(400).send({
+      message:
+        "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member."
+    });
 
     const membership = await MembershipOrg.findByIdAndUpdate(membershipId, {
       role: CUSTOM,

backend/src/controllers/v2/workspaceController.ts

@@ -30,7 +30,7 @@ import {
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError, ForbiddenRequestError, ResourceNotFoundError } from "../../utils/errors";
-import { ADMIN, MEMBER, VIEWER } from "../../variables";
+import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 
 interface V2PushSecret {
   type: string; // personal or shared
@@ -571,7 +571,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
   machineMembership = await new MachineMembership({
     machineIdentity: machineIdentity._id,
     workspace: new Types.ObjectId(workspaceId),
-    role,
+    role: customRole ? CUSTOM : role,
     customRole
   }).save();
 

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         secretVersioning: true,
         pitRecovery: false,
         ipAllowlisting: false,
-        rbac: true,
+        rbac: false,
         customRateLimits: false,
         customAlerts: false,
         auditLogs: false,

backend/src/ee/services/ProjectRoleService.ts

@@ -385,7 +385,7 @@ export const getRolePermissions = async (role: string, workspaceId: string) => {
  * @param ability
  * @returns 
  */
- const extractPermissions = (ability: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet) => {
+ const extractPermissions = (ability: any) => {
   return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
 }
 

backend/src/ee/services/RoleService.ts

@@ -178,7 +178,7 @@ export const getOrgRolePermissions = async (role: string, orgId: string) => {
  * @param ability
  * @returns 
  */
-const extractPermissions = (ability: MongoAbility<OrgPermissionSet> | OrgPermissionSet) => {
+const extractPermissions = (ability: any) => {
   return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
 }