merge + final tweaks

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -23,6 +23,7 @@ import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-poli
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
+import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "../project-user-additional-privilege/project-user-additional-privilege-types";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
@@ -340,17 +341,7 @@ export const accessApprovalRequestServiceFactory = ({
       });
     }
 
-    if (
-      !policy.allowedSelfApprovals &&
-      actorId === accessApprovalRequest.requestedByUserId &&
-      policy.enforcementLevel !== EnforcementLevel.Soft
-    ) {
-      throw new BadRequestError({
-        message: "Failed to review access approval request. Users are not authorized to review their own request."
-      });
-    }
-
-    const { membership, hasRole } = await permissionService.getProjectPermission({
+    const { membership, hasRole, permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: accessApprovalRequest.projectId,
@@ -363,6 +354,19 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not a member of this project" });
     }
 
+    if (
+      !policy.allowedSelfApprovals &&
+      actorId === accessApprovalRequest.requestedByUserId &&
+      !(
+        policy.enforcementLevel === EnforcementLevel.Soft &&
+        permission.can(ProjectPermissionApprovalActions.AllowAccessBypass, ProjectPermissionSub.SecretApproval)
+      )
+    ) {
+      throw new BadRequestError({
+        message: "Failed to review access approval request. Users are not authorized to review their own request."
+      });
+    }
+
     if (
       !hasRole(ProjectMembershipRole.Admin) &&
       accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user

backend/src/ee/services/license/license-fns.ts

@@ -18,33 +18,33 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   environmentsUsed: 0,
   identityLimit: null,
   identitiesUsed: 0,
-  dynamicSecret: true,
+  dynamicSecret: false,
   secretVersioning: true,
-  pitRecovery: true,
-  ipAllowlisting: true,
-  rbac: true,
-  githubOrgSync: true,
+  pitRecovery: false,
+  ipAllowlisting: false,
+  rbac: false,
+  githubOrgSync: false,
   customRateLimits: false,
-  customAlerts: true,
-  secretAccessInsights: true,
-  auditLogs: true,
-  auditLogsRetentionDays: 3,
-  auditLogStreams: true,
+  customAlerts: false,
+  secretAccessInsights: false,
+  auditLogs: false,
+  auditLogsRetentionDays: 0,
+  auditLogStreams: false,
   auditLogStreamLimit: 3,
-  samlSSO: true,
-  hsm: true,
-  oidcSSO: true,
-  scim: true,
-  ldap: true,
-  groups: true,
+  samlSSO: false,
+  hsm: false,
+  oidcSSO: false,
+  scim: false,
+  ldap: false,
+  groups: false,
   status: null,
   trial_end: null,
   has_used_trial: true,
-  secretApproval: true,
-  secretRotation: true,
-  caCrl: true,
-  instanceUserManagement: true,
-  externalKms: true,
+  secretApproval: false,
+  secretRotation: false,
+  caCrl: false,
+  instanceUserManagement: false,
+  externalKms: false,
   rateLimits: {
     readLimit: 60,
     writeLimit: 200,
@@ -52,10 +52,10 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   },
   pkiEst: true,
   enforceMfa: true,
-  projectTemplates: true,
-  kmip: true,
-  gateway: true,
-  sshHostGroups: true
+  projectTemplates: false,
+  kmip: false,
+  gateway: false,
+  sshHostGroups: false
 });
 
 export const setupLicenseRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => {

backend/src/ee/services/permission/default-roles.ts

@@ -61,7 +61,8 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionApprovalActions.Edit,
       ProjectPermissionApprovalActions.Create,
       ProjectPermissionApprovalActions.Delete,
-      ProjectPermissionApprovalActions.AllowChangeBypass
+      ProjectPermissionApprovalActions.AllowChangeBypass,
+      ProjectPermissionApprovalActions.AllowAccessBypass
     ],
     ProjectPermissionSub.SecretApproval
   );

backend/src/ee/services/permission/project-permission.ts

@@ -39,7 +39,8 @@ export enum ProjectPermissionApprovalActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  AllowChangeBypass = "allow-change-bypass"
+  AllowChangeBypass = "allow-change-bypass",
+  AllowAccessBypass = "allow-access-bypass"
 }
 
 export enum ProjectPermissionCmekActions {