Add default org and project-level no access roles

backend/src/ee/controllers/v1/roleController.ts

@@ -15,6 +15,7 @@ import {
   adminProjectPermissions,
   getAuthDataProjectPermissions,
   memberProjectPermissions,
+  noAccessProjectPermissions,
   viewerProjectPermission
 } from "../../services/ProjectRoleService";
 import {
@@ -22,7 +23,8 @@ import {
   OrgPermissionSubjects,
   adminPermissions,
   getUserOrgPermissions,
-  memberPermissions
+  memberPermissions,
+  noAccessPermissions
 } from "../../services/RoleService";
 import { BadRequestError } from "../../../utils/errors";
 import { Role } from "../../models";
@@ -195,6 +197,13 @@ export const getRoles = async (req: Request, res: Response) => {
       description: "Complete administration access over the organization",
       permissions: isOrgRole ? adminPermissions.rules : adminProjectPermissions.rules
     },
+    {
+      _id: "no-access",
+      name: "No Access",
+      slug: "no-access",
+      description: "No access to any resources in the organization",
+      permissions: isOrgRole ? noAccessPermissions.rules : noAccessProjectPermissions.rules
+    },
     {
       _id: "member",
       name: isOrgRole ? "Member" : "Developer",

backend/src/ee/controllers/v3/machineIdentityController.ts

@@ -25,7 +25,7 @@ import { BadRequestError, ForbiddenRequestError, ResourceNotFoundError, Unauthor
 import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
 import { EEAuditLogService, EELicenseService } from "../../services";
 import { getAuthSecret } from "../../../config";
-import { ADMIN, AuthTokenType, CUSTOM, MEMBER } from "../../../variables";
+import { ADMIN, AuthTokenType, CUSTOM, MEMBER, NO_ACCESS } from "../../../variables";
 import {
     OrgPermissionActions,
     OrgPermissionSubjects
@@ -143,7 +143,7 @@ export const createMachineIdentity = async (req: Request, res: Response) => {
             isRefreshTokenRotationEnabled
         }
     } = await validateRequest(reqValidator.CreateMachineIdentityV3, req);
-    
+
     const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
     
     ForbiddenError.from(permission).throwUnlessCan(
@@ -161,7 +161,7 @@ export const createMachineIdentity = async (req: Request, res: Response) => {
     const organization = await Organization.findById(organizationId);
     if (!organization) throw BadRequestError({ message: `Organization with id ${organizationId} not found` });
 
-    const isCustomRole = ![ADMIN, MEMBER].includes(role);
+    const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
     
     let customRole;
     if (isCustomRole) {
@@ -298,7 +298,7 @@ export const updateMachineIdentity = async (req: Request, res: Response) => {
 
     let customRole;
     if (role) {
-        const isCustomRole = ![ADMIN, MEMBER].includes(role);
+        const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
         if (isCustomRole) {
             customRole = await Role.findOne({
                 slug: role,

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         secretVersioning: true,
         pitRecovery: false,
         ipAllowlisting: false,
-        rbac: false,
+        rbac: true,
         customRateLimits: false,
         customAlerts: false,
         auditLogs: false,

backend/src/ee/services/ProjectRoleService.ts

@@ -18,7 +18,7 @@ import {
   Membership,
   ServiceTokenData
 } from "../../models";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
 import { checkIPAgainstBlocklist } from "../../utils/ip";
 import { BadRequestError } from "../../utils/errors";
 
@@ -262,6 +262,13 @@ const buildViewerPermission = () => {
 
 export const viewerProjectPermission = buildViewerPermission();
 
+const buildNoAccessProjectPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessProjectPermissions = buildNoAccessProjectPermission();
+
 /**
  * Return permissions for user/service pertaining to workspace with id [workspaceId]
  * 
@@ -275,7 +282,7 @@ export const getAuthDataProjectPermissions = async ({
   authData: AuthData;
   workspaceId: Types.ObjectId;
 }) => {
-  let role: "admin" | "member" | "viewer" | "custom";
+  let role: "admin" | "member" | "viewer" | "no-access" | "custom";
   let customRole;
   
   switch (authData.actor.type) {
@@ -338,6 +345,8 @@ export const getAuthDataProjectPermissions = async ({
       return { permission: memberProjectPermissions };
     case VIEWER:
       return { permission: viewerProjectPermission };
+    case NO_ACCESS:
+      return { permission: noAccessProjectPermissions };
     case CUSTOM: {
       if (!customRole) throw UnauthorizedRequestError();
       return { 
@@ -353,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({
 }
 
 export const getRolePermissions = async (role: string, workspaceId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const workspaceRole = await Role.findOne({
       slug: role,
@@ -375,6 +384,8 @@ export const getRolePermissions = async (role: string, workspaceId: string) => {
       return memberProjectPermissions;
     case VIEWER:
       return viewerProjectPermission;
+    case NO_ACCESS:
+      return noAccessProjectPermissions;
     default:
       throw BadRequestError({ message: "Role not found" });
   }

backend/src/ee/services/RoleService.ts

@@ -3,7 +3,7 @@ import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@ca
 import { MembershipOrg } from "../../models";
 import { IRole, Role } from "../models";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
 
 export enum OrgPermissionActions {
@@ -116,6 +116,13 @@ const buildMemberPermission = () => {
 
 export const memberPermissions = buildMemberPermission();
 
+const buildNoAccessPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessPermissions = buildNoAccessPermission();
+
 export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   // TODO(akhilmhdh): speed this up by pulling from cache later
   
@@ -136,6 +143,8 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   if (membership.role === ADMIN) return { permission: adminPermissions, membership };
 
   if (membership.role === MEMBER) return { permission: memberPermissions, membership };
+  
+  if (membership.role === NO_ACCESS) return { permission: noAccessPermissions, membership }
 
   if (membership.role === CUSTOM) {
     const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
@@ -148,7 +157,7 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
 };
 
 export const getOrgRolePermissions = async (role: string, orgId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const orgRole = await Role.findOne({
       slug: role,
@@ -168,6 +177,8 @@ export const getOrgRolePermissions = async (role: string, orgId: string) => {
       return adminPermissions;
     case MEMBER:
       return memberPermissions;
+    case NO_ACCESS:
+      return noAccessPermissions;
     default:
       throw BadRequestError({ message: "User org role not found" });
   }