Add default org and project-level no access roles

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         secretVersioning: true,
         pitRecovery: false,
         ipAllowlisting: false,
-        rbac: false,
+        rbac: true,
         customRateLimits: false,
         customAlerts: false,
         auditLogs: false,

backend/src/ee/services/ProjectRoleService.ts

@@ -18,7 +18,7 @@ import {
   Membership,
   ServiceTokenData
 } from "../../models";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
 import { checkIPAgainstBlocklist } from "../../utils/ip";
 import { BadRequestError } from "../../utils/errors";
 
@@ -262,6 +262,13 @@ const buildViewerPermission = () => {
 
 export const viewerProjectPermission = buildViewerPermission();
 
+const buildNoAccessProjectPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessProjectPermissions = buildNoAccessProjectPermission();
+
 /**
  * Return permissions for user/service pertaining to workspace with id [workspaceId]
  * 
@@ -275,7 +282,7 @@ export const getAuthDataProjectPermissions = async ({
   authData: AuthData;
   workspaceId: Types.ObjectId;
 }) => {
-  let role: "admin" | "member" | "viewer" | "custom";
+  let role: "admin" | "member" | "viewer" | "no-access" | "custom";
   let customRole;
   
   switch (authData.actor.type) {
@@ -338,6 +345,8 @@ export const getAuthDataProjectPermissions = async ({
       return { permission: memberProjectPermissions };
     case VIEWER:
       return { permission: viewerProjectPermission };
+    case NO_ACCESS:
+      return { permission: noAccessProjectPermissions };
     case CUSTOM: {
       if (!customRole) throw UnauthorizedRequestError();
       return { 
@@ -353,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({
 }
 
 export const getRolePermissions = async (role: string, workspaceId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const workspaceRole = await Role.findOne({
       slug: role,
@@ -375,6 +384,8 @@ export const getRolePermissions = async (role: string, workspaceId: string) => {
       return memberProjectPermissions;
     case VIEWER:
       return viewerProjectPermission;
+    case NO_ACCESS:
+      return noAccessProjectPermissions;
     default:
       throw BadRequestError({ message: "Role not found" });
   }

backend/src/ee/services/RoleService.ts

@@ -3,7 +3,7 @@ import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@ca
 import { MembershipOrg } from "../../models";
 import { IRole, Role } from "../models";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
 
 export enum OrgPermissionActions {
@@ -116,6 +116,13 @@ const buildMemberPermission = () => {
 
 export const memberPermissions = buildMemberPermission();
 
+const buildNoAccessPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessPermissions = buildNoAccessPermission();
+
 export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   // TODO(akhilmhdh): speed this up by pulling from cache later
   
@@ -136,6 +143,8 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   if (membership.role === ADMIN) return { permission: adminPermissions, membership };
 
   if (membership.role === MEMBER) return { permission: memberPermissions, membership };
+  
+  if (membership.role === NO_ACCESS) return { permission: noAccessPermissions, membership }
 
   if (membership.role === CUSTOM) {
     const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
@@ -148,7 +157,7 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
 };
 
 export const getOrgRolePermissions = async (role: string, orgId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const orgRole = await Role.findOne({
       slug: role,
@@ -168,6 +177,8 @@ export const getOrgRolePermissions = async (role: string, orgId: string) => {
       return adminPermissions;
     case MEMBER:
       return memberPermissions;
+    case NO_ACCESS:
+      return noAccessPermissions;
     default:
       throw BadRequestError({ message: "User org role not found" });
   }