Add default org and project-level no access roles

backend/src/controllers/v2/organizationsController.ts

@@ -15,7 +15,7 @@ import {
 } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS } from "../../variables";
 import * as reqValidator from "../../validation/organization";
 import { validateRequest } from "../../helpers/validation";
 import {
@@ -153,7 +153,7 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
     OrgPermissionSubjects.Member
   );
 
-  const isCustomRole = ![ADMIN, MEMBER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const orgRole = await Role.findOne({ 
       slug: role, 

backend/src/controllers/v2/workspaceController.ts

@@ -30,7 +30,7 @@ import {
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError, ForbiddenRequestError, ResourceNotFoundError } from "../../utils/errors";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
 
 interface V2PushSecret {
   type: string; // personal or shared
@@ -556,7 +556,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
 
   let customRole;
   if (role) {
-    const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+    const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
     if (isCustomRole) {
       customRole = await Role.findOne({
         slug: role,
@@ -632,7 +632,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
 
   let customRole;
   if (role) {
-    const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+    const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
     if (isCustomRole) {
       customRole = await Role.findOne({
         slug: role,

backend/src/ee/controllers/v1/roleController.ts

@@ -15,6 +15,7 @@ import {
   adminProjectPermissions,
   getAuthDataProjectPermissions,
   memberProjectPermissions,
+  noAccessProjectPermissions,
   viewerProjectPermission
 } from "../../services/ProjectRoleService";
 import {
@@ -22,7 +23,8 @@ import {
   OrgPermissionSubjects,
   adminPermissions,
   getUserOrgPermissions,
-  memberPermissions
+  memberPermissions,
+  noAccessPermissions
 } from "../../services/RoleService";
 import { BadRequestError } from "../../../utils/errors";
 import { Role } from "../../models";
@@ -195,6 +197,13 @@ export const getRoles = async (req: Request, res: Response) => {
       description: "Complete administration access over the organization",
       permissions: isOrgRole ? adminPermissions.rules : adminProjectPermissions.rules
     },
+    {
+      _id: "no-access",
+      name: "No Access",
+      slug: "no-access",
+      description: "No access to any resources in the organization",
+      permissions: isOrgRole ? noAccessPermissions.rules : noAccessProjectPermissions.rules
+    },
     {
       _id: "member",
       name: isOrgRole ? "Member" : "Developer",

backend/src/ee/controllers/v3/machineIdentityController.ts

@@ -25,7 +25,7 @@ import { BadRequestError, ForbiddenRequestError, ResourceNotFoundError, Unauthor
 import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
 import { EEAuditLogService, EELicenseService } from "../../services";
 import { getAuthSecret } from "../../../config";
-import { ADMIN, AuthTokenType, CUSTOM, MEMBER } from "../../../variables";
+import { ADMIN, AuthTokenType, CUSTOM, MEMBER, NO_ACCESS } from "../../../variables";
 import {
     OrgPermissionActions,
     OrgPermissionSubjects
@@ -161,7 +161,7 @@ export const createMachineIdentity = async (req: Request, res: Response) => {
     const organization = await Organization.findById(organizationId);
     if (!organization) throw BadRequestError({ message: `Organization with id ${organizationId} not found` });
 
-    const isCustomRole = ![ADMIN, MEMBER].includes(role);
+    const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
     
     let customRole;
     if (isCustomRole) {
@@ -298,7 +298,7 @@ export const updateMachineIdentity = async (req: Request, res: Response) => {
 
     let customRole;
     if (role) {
-        const isCustomRole = ![ADMIN, MEMBER].includes(role);
+        const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
         if (isCustomRole) {
             customRole = await Role.findOne({
                 slug: role,

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         secretVersioning: true,
         pitRecovery: false,
         ipAllowlisting: false,
-        rbac: false,
+        rbac: true,
         customRateLimits: false,
         customAlerts: false,
         auditLogs: false,

backend/src/ee/services/ProjectRoleService.ts

@@ -18,7 +18,7 @@ import {
   Membership,
   ServiceTokenData
 } from "../../models";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
 import { checkIPAgainstBlocklist } from "../../utils/ip";
 import { BadRequestError } from "../../utils/errors";
 
@@ -262,6 +262,13 @@ const buildViewerPermission = () => {
 
 export const viewerProjectPermission = buildViewerPermission();
 
+const buildNoAccessProjectPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessProjectPermissions = buildNoAccessProjectPermission();
+
 /**
  * Return permissions for user/service pertaining to workspace with id [workspaceId]
  * 
@@ -275,7 +282,7 @@ export const getAuthDataProjectPermissions = async ({
   authData: AuthData;
   workspaceId: Types.ObjectId;
 }) => {
-  let role: "admin" | "member" | "viewer" | "custom";
+  let role: "admin" | "member" | "viewer" | "no-access" | "custom";
   let customRole;
   
   switch (authData.actor.type) {
@@ -338,6 +345,8 @@ export const getAuthDataProjectPermissions = async ({
       return { permission: memberProjectPermissions };
     case VIEWER:
       return { permission: viewerProjectPermission };
+    case NO_ACCESS:
+      return { permission: noAccessProjectPermissions };
     case CUSTOM: {
       if (!customRole) throw UnauthorizedRequestError();
       return { 
@@ -353,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({
 }
 
 export const getRolePermissions = async (role: string, workspaceId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const workspaceRole = await Role.findOne({
       slug: role,
@@ -375,6 +384,8 @@ export const getRolePermissions = async (role: string, workspaceId: string) => {
       return memberProjectPermissions;
     case VIEWER:
       return viewerProjectPermission;
+    case NO_ACCESS:
+      return noAccessProjectPermissions;
     default:
       throw BadRequestError({ message: "Role not found" });
   }

backend/src/ee/services/RoleService.ts

@@ -3,7 +3,7 @@ import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@ca
 import { MembershipOrg } from "../../models";
 import { IRole, Role } from "../models";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
 
 export enum OrgPermissionActions {
@@ -116,6 +116,13 @@ const buildMemberPermission = () => {
 
 export const memberPermissions = buildMemberPermission();
 
+const buildNoAccessPermission = () => {
+  const { build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  return build({ conditionsMatcher });
+}
+
+export const noAccessPermissions = buildNoAccessPermission();
+
 export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   // TODO(akhilmhdh): speed this up by pulling from cache later
   
@@ -137,6 +144,8 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
 
   if (membership.role === MEMBER) return { permission: memberPermissions, membership };
   
+  if (membership.role === NO_ACCESS) return { permission: noAccessPermissions, membership }
+
   if (membership.role === CUSTOM) {
     const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
       conditionsMatcher
@@ -148,7 +157,7 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
 };
 
 export const getOrgRolePermissions = async (role: string, orgId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const orgRole = await Role.findOne({
       slug: role,
@@ -168,6 +177,8 @@ export const getOrgRolePermissions = async (role: string, orgId: string) => {
       return adminPermissions;
     case MEMBER:
       return memberPermissions;
+    case NO_ACCESS:
+      return noAccessPermissions;
     default:
       throw BadRequestError({ message: "User org role not found" });
   }

backend/src/helpers/membership.ts

@@ -17,7 +17,7 @@ export const validateMembership = async ({
 }: {
   userId: Types.ObjectId | string;
   workspaceId: Types.ObjectId | string;
-  acceptedRoles?: Array<"admin" | "member" | "custom" | "viewer">;
+  acceptedRoles?: Array<"admin" | "member" | "custom" | "viewer" | "no-access">;
 }) => {
   const membership = await Membership.findOne({
     user: userId,

backend/src/helpers/membershipOrg.ts

@@ -18,7 +18,7 @@ export const validateMembershipOrg = async ({
 }: {
   userId: Types.ObjectId;
   organizationId: Types.ObjectId;
-  acceptedRoles?: Array<"owner" | "admin" | "member" | "custom">;
+  acceptedRoles?: Array<"owner" | "admin" | "member" | "custom" | "no-access">;
   acceptedStatuses?: Array<"invited" | "accepted">;
 }) => {
   const membershipOrg = await MembershipOrg.findOne({

backend/src/models/machineMembership.ts

@@ -1,11 +1,11 @@
 import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../variables";
 
 export interface IMachineMembership {
   _id: Types.ObjectId;
   machineIdentity: Types.ObjectId;
   workspace: Types.ObjectId;
-  role: "admin" | "member" | "viewer" | "custom";
+  role: "admin" | "member" | "viewer" | "no-access" | "custom";
   customRole: Types.ObjectId;
 }
 
@@ -22,7 +22,7 @@ const machineMembershipSchema = new Schema<IMachineMembership>(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, VIEWER, CUSTOM],
+      enum: [ADMIN, MEMBER, VIEWER, CUSTOM, NO_ACCESS],
       required: true
     },
     customRole: {

backend/src/models/machineMembershipOrg.ts

@@ -1,11 +1,11 @@
 import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER } from "../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../variables";
 
 export interface IMachineMembershipOrg {
   _id: Types.ObjectId;
   machineIdentity: Types.ObjectId;
   organization: Types.ObjectId;
-  role: "admin" | "member" | "viewer" | "custom";
+  role: "admin" | "member" | "viewer" | "no-access" | "custom";
   customRole: Types.ObjectId;
 }
 
@@ -21,7 +21,7 @@ const machineMembershipOrgSchema = new Schema<IMachineMembershipOrg>(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, CUSTOM],
+      enum: [ADMIN, MEMBER, NO_ACCESS, CUSTOM],
       required: true
     },
     customRole: {

backend/src/models/membership.ts

@@ -1,5 +1,5 @@
 import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../variables";
+import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../variables";
 
 export interface IMembershipPermission {
   environmentSlug: string;
@@ -11,7 +11,7 @@ export interface IMembership {
   user: Types.ObjectId;
   inviteEmail?: string;
   workspace: Types.ObjectId;
-  role: "admin" | "member" | "viewer" | "custom";
+  role: "admin" | "member" | "viewer" | "no-access" | "custom";
   customRole: Types.ObjectId;
   deniedPermissions: IMembershipPermission[];
 }
@@ -44,7 +44,7 @@ const membershipSchema = new Schema<IMembership>(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, VIEWER, CUSTOM],
+      enum: [ADMIN, MEMBER, VIEWER, NO_ACCESS, CUSTOM],
       required: true
     },
     customRole: {

backend/src/models/membershipOrg.ts

@@ -1,12 +1,12 @@
 import { Document, Schema, Types, model } from "mongoose";
-import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER } from "../variables";
+import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER, NO_ACCESS } from "../variables";
 
 export interface IMembershipOrg extends Document {
   _id: Types.ObjectId;
   user: Types.ObjectId;
   inviteEmail: string;
   organization: Types.ObjectId;
-  role: "owner" | "admin" | "member" | "custom";
+  role: "owner" | "admin" | "member" | "no-access" | "custom";
   customRole: Types.ObjectId;
   status: "invited" | "accepted";
 }
@@ -26,7 +26,7 @@ const membershipOrgSchema = new Schema(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, CUSTOM],
+      enum: [ADMIN, MEMBER, NO_ACCESS, CUSTOM],
       required: true
     },
     status: {

backend/src/variables/organization.ts

@@ -3,6 +3,7 @@ export const OWNER = "owner"; // depreciated
 export const ADMIN = "admin";
 export const MEMBER = "member";
 export const VIEWER = "viewer";
+export const NO_ACCESS = "no-access";
 export const CUSTOM = "custom";
 
 // membership statuses

frontend/src/hooks/api/machineIdentities/types.ts

@@ -28,7 +28,7 @@ export type MachineMembershipOrg = {
     _id: string;
     machineIdentity: MachineIdentity;
     organization: string;
-    role: "admin" | "member" | "viewer" | "custom";
+    role: "admin" | "member" | "viewer" | "no-access" | "custom";
     customRole?: TRole<string>;
     createdAt: string;
     updatedAt: string;
@@ -38,7 +38,7 @@ export type MachineMembership = {
     _id: string;
     machineIdentity: MachineIdentity;
     organization: string;
-    role: "admin" | "member" | "viewer" | "custom";
+    role: "admin" | "member" | "viewer" | "no-access" | "custom";
     customRole?: TRole<string>;
     createdAt: string;
     updatedAt: string;

frontend/src/hooks/api/users/types.ts

@@ -44,7 +44,7 @@ export type OrgUser = {
   };
   inviteEmail: string;
   organization: string;
-  role: "owner" | "admin" | "member" | "custom";
+  role: "owner" | "admin" | "member" | "no-access" | "custom";
   status: "invited" | "accepted" | "verified" | "completed";
   deniedPermissions: any[];
   customRole: string;

frontend/src/views/Org/MembersPage/MembersPage.tsx

@@ -25,7 +25,14 @@ export const MembersPage = withPermission(
           <Tabs defaultValue={TabSections.Member}>
             <TabList>
               <Tab value={TabSections.Member}>People</Tab>
-              <Tab value={TabSections.MachineIdentities}>Machine Identities</Tab>
+              <Tab value={TabSections.MachineIdentities}>
+                <div className="flex items-center">
+                  <p>Machine Identities</p>
+                  <div className="ml-2 rounded-md text-yellow text-sm inline-block bg-yellow/20 px-1.5 pb-[0.03rem] pt-[0.04rem] opacity-80 hover:opacity-100 cursor-default">
+                    Beta
+                  </div>
+                </div>
+              </Tab>
               <Tab value={TabSections.Roles}>Organization Roles</Tab>
             </TabList>
             <TabPanel value={TabSections.Member}>

frontend/src/views/Org/MembersPage/components/OrgRoleTabSection/OrgRoleTable.tsx

@@ -94,7 +94,7 @@ export const OrgRoleTable = ({
               {isRolesLoading && <TableSkeleton columns={4} innerKey="org-roles" />}
               {(roles as TRole<undefined>[])?.map((role) => {
                 const { _id: id, name, slug } = role;
-                const isNonMutatable = ["owner", "admin", "member"].includes(slug);
+                const isNonMutatable = ["owner", "admin", "member", "no-access"].includes(slug);
 
                 return (
                   <Tr key={`role-list-${id}`}>

frontend/src/views/Project/MembersPage/MembersPage.tsx

@@ -30,7 +30,14 @@ export const MembersPage = withProjectPermission(
           <Tabs defaultValue={TabSections.Member}>
             <TabList>
               <Tab value={TabSections.Member}>People</Tab>
-              <Tab value={TabSections.MachineIdentities}>Machine Identities</Tab>
+              <Tab value={TabSections.MachineIdentities}>
+                <div className="flex items-center">
+                  <p>Machine Identities</p>
+                  <div className="ml-2 rounded-md text-yellow text-sm inline-block bg-yellow/20 px-1.5 pb-[0.03rem] pt-[0.04rem] opacity-80 hover:opacity-100 cursor-default">
+                    Beta
+                  </div>
+                </div>
+              </Tab>
               <Tab value={TabSections.ServiceTokens}>Service Tokens</Tab>
               <Tab value={TabSections.Roles}>Project Roles</Tab>
             </TabList>

frontend/src/views/Project/MembersPage/components/MachineIdentityTab/components/MachineIdentitySection/MachineIdentityTable.tsx

@@ -188,7 +188,7 @@ export const MachineIdentityTable = ({
                     {!isLoading && data && data?.length === 0 && (
                         <Tr>
                             <Td colSpan={7}>
-                                <EmptyState title="No machine identities have been added to this project" icon={faServer} />
+                                <EmptyState title="No MIs have been added to this project" icon={faServer} />
                             </Td>
                         </Tr>
                     )}

frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleList/ProjectRoleList.tsx

@@ -101,7 +101,7 @@ export const ProjectRoleList = ({ onSelectRole }: Props) => {
               {isRolesLoading && <TableSkeleton columns={4} innerKey="org-roles" />}
               {(roles as TRole<string>[])?.map((role) => {
                 const { _id: id, name, slug } = role;
-                const isNonMutatable = ["admin", "member", "viewer"].includes(slug);
+                const isNonMutatable = ["admin", "member", "viewer", "no-access"].includes(slug);
 
                 return (
                   <Tr key={`role-list-${id}`}>