feat: customisable workspace role permissions (#345)

* feat: setup schema for workspace roles * chore: regen migration * feat: add publicId to workspace roles * feat: setup default permissions * feat: add repo funcs * feat: setup basic router interactions * feat: add card permissions * feat: assert permissions for lists * feat: assert board permissions * feat: assert permission for remaining routes * feat: add permissions page to settings * feat: enable updating member roles * feat: order members by role and createdAt * feat: allow editing individual permissions * feat: reset role defaults * feat: clear all permission overrides * feat: allow users to delete entities they have created * feat: set roleId when inviting new members * feat: disable UI elements if user does not have permissions * feat: allow admins to assign the admin role to other users * feat: allow delete:list as default * refactor: centre permissions modal * chore: translations
2026-02-01 21:17:18 +00:00
parent 5f2d409773
commit 7f5a1ab513
83 changed files with 10568 additions and 1442 deletions
--- a/packages/db/src/repository/board.repo.ts
+++ b/packages/db/src/repository/board.repo.ts
@@ -518,6 +518,7 @@ export const getWithListIdsByPublicId = (
    columns: {
      id: true,
      workspaceId: true,
+      createdBy: true,
    },
    with: {
      lists: {
@@ -671,6 +672,7 @@ export const getWorkspaceAndBoardIdByBoardPublicId = async (
    columns: {
      id: true,
      workspaceId: true,
+      createdBy: true,
    },
    where: eq(boards.publicId, boardPublicId),
  });
--- a/packages/db/src/repository/card.repo.ts
+++ b/packages/db/src/repository/card.repo.ts
@@ -424,6 +424,7 @@ export const getWithListAndMembersByPublicId = async (
      title: true,
      description: true,
      dueDate: true,
+      createdBy: true,
    },
    with: {
      labels: {
@@ -938,7 +939,7 @@ export const getWorkspaceAndCardIdByCardPublicId = async (
  cardPublicId: string,
 ) => {
  const result = await db.query.cards.findFirst({
-    columns: { id: true },
+    columns: { id: true, createdBy: true },
    where: and(eq(cards.publicId, cardPublicId), isNull(cards.deletedAt)),
    with: {
      list: {
@@ -958,6 +959,7 @@ export const getWorkspaceAndCardIdByCardPublicId = async (
  return result
    ? {
        id: result.id,
+        createdBy: result.createdBy,
        workspaceId: result.list.board.workspaceId,
        workspaceVisibility: result.list.board.visibility,
      }
--- a/packages/db/src/repository/list.repo.ts
+++ b/packages/db/src/repository/list.repo.ts
@@ -419,7 +419,7 @@ export const getWorkspaceAndListIdByListPublicId = async (
  listPublicId: string,
 ) => {
  const result = await db.query.lists.findFirst({
-    columns: { id: true },
+    columns: { id: true, createdBy: true },
    where: and(eq(lists.publicId, listPublicId), isNull(lists.deletedAt)),
    with: {
      board: {
@@ -431,6 +431,10 @@ export const getWorkspaceAndListIdByListPublicId = async (
  });

  return result
-    ? { id: result.id, workspaceId: result.board.workspaceId }
+    ? {
+        id: result.id,
+        createdBy: result.createdBy,
+        workspaceId: result.board.workspaceId,
+      }
    : null;
 };
--- a/packages/db/src/repository/member.repo.ts
+++ b/packages/db/src/repository/member.repo.ts
@@ -27,6 +27,7 @@ export const create = async (
    workspaceId: number;
    createdBy: string;
    role: MemberRole;
+    roleId?: number | null;
    status: MemberStatus;
  },
 ) => {
@@ -39,6 +40,7 @@ export const create = async (
      workspaceId: memberInput.workspaceId,
      createdBy: memberInput.createdBy,
      role: memberInput.role,
+      roleId: memberInput.roleId ?? null,
      status: memberInput.status,
    })
    .returning({
@@ -55,6 +57,12 @@ export const getByPublicId = async (db: dbClient, publicId: string) => {
  });
 };

+export const getById = async (db: dbClient, memberId: number) => {
+  return db.query.workspaceMembers.findFirst({
+    where: eq(workspaceMembers.id, memberId),
+  });
+};
+
 export const getByEmailAndStatus = async (
  db: dbClient,
  email: string,
@@ -133,3 +141,28 @@ export const pauseAllMembers = async (db: dbClient, workspaceId: number) => {
      ),
    );
 };
+
+export const updateRole = async (
+  db: dbClient,
+  args: {
+    memberId: number;
+    role: MemberRole;
+    roleId: number | null;
+  },
+) => {
+  const [result] = await db
+    .update(workspaceMembers)
+    .set({
+      role: args.role,
+      roleId: args.roleId,
+      updatedAt: new Date(),
+    })
+    .where(eq(workspaceMembers.id, args.memberId))
+    .returning({
+      id: workspaceMembers.id,
+      publicId: workspaceMembers.publicId,
+      role: workspaceMembers.role,
+    });
+
+  return result;
+};
--- a/packages/db/src/repository/permission.repo.ts
+++ b/packages/db/src/repository/permission.repo.ts
@@ -0,0 +1,494 @@
+import { and, eq, isNull, inArray } from "drizzle-orm";
+
+import type { dbClient } from "@kan/db/client";
+import {
+  workspaceMemberPermissions,
+  workspaceMembers,
+  workspaceRolePermissions,
+  workspaceRoles,
+} from "@kan/db/schema";
+import type { Permission, Role } from "@kan/shared";
+import { generateUID, getDefaultPermissions } from "@kan/shared";
+
+/**
+ * Get permissions by role ID
+ */
+export const getPermissionsByRoleId = async (
+  db: dbClient,
+  roleId: number,
+): Promise<Permission[]> => {
+  const permissions = await db
+    .select({ permission: workspaceRolePermissions.permission })
+    .from(workspaceRolePermissions)
+    .where(
+      and(
+        eq(workspaceRolePermissions.workspaceRoleId, roleId),
+        eq(workspaceRolePermissions.granted, true),
+      ),
+    );
+
+  return permissions.map((p) => p.permission as Permission);
+};
+
+/**
+ * Get role by workspace ID and name
+ */
+export const getRoleByWorkspaceIdAndName = async (
+  db: dbClient,
+  workspaceId: number,
+  name: string,
+) => {
+  const [role] = await db
+    .select()
+    .from(workspaceRoles)
+    .where(
+      and(
+        eq(workspaceRoles.workspaceId, workspaceId),
+        eq(workspaceRoles.name, name),
+      ),
+    )
+    .limit(1);
+
+  return role;
+};
+
+/**
+ * Get role by workspace ID and publicId
+ */
+export const getRoleByWorkspaceIdAndPublicId = async (
+  db: dbClient,
+  workspaceId: number,
+  rolePublicId: string,
+) => {
+  const [role] = await db
+    .select()
+    .from(workspaceRoles)
+    .where(
+      and(
+        eq(workspaceRoles.workspaceId, workspaceId),
+        eq(workspaceRoles.publicId, rolePublicId),
+      ),
+    )
+    .limit(1);
+
+  return role;
+};
+
+/**
+ * Get all custom permission overrides for a workspace member
+ */
+export const getMemberPermissionOverrides = async (
+  db: dbClient,
+  workspaceMemberId: number,
+) => {
+  return db
+    .select()
+    .from(workspaceMemberPermissions)
+    .where(eq(workspaceMemberPermissions.workspaceMemberId, workspaceMemberId));
+};
+
+/**
+ * Get a single permission override for a member
+ */
+export const getMemberPermissionOverride = async (
+  db: dbClient,
+  workspaceMemberId: number,
+  permission: string,
+) => {
+  const [override] = await db
+    .select()
+    .from(workspaceMemberPermissions)
+    .where(
+      and(
+        eq(workspaceMemberPermissions.workspaceMemberId, workspaceMemberId),
+        eq(workspaceMemberPermissions.permission, permission),
+      ),
+    )
+    .limit(1);
+
+  return override;
+};
+
+/**
+ * Get effective permissions for a workspace member
+ * Combines role template (from DB) with custom overrides
+ */
+export const getMemberEffectivePermissions = async (
+  db: dbClient,
+  workspaceMemberId: number,
+  roleId: number | null,
+  roleName: string,
+): Promise<Permission[]> => {
+  let roleDefaults: Set<Permission>;
+
+  // Try to get role permissions from database first
+  if (roleId) {
+    const dbPermissions = await getPermissionsByRoleId(db, roleId);
+    roleDefaults = new Set<Permission>(dbPermissions);
+  } else {
+    // Fallback to code-based defaults if roleId not set
+    const codeDefaults = getDefaultPermissions(roleName as Role);
+    roleDefaults = new Set<Permission>([...codeDefaults]);
+  }
+
+  // Get custom overrides
+  const overrides = await getMemberPermissionOverrides(db, workspaceMemberId);
+
+  // Apply overrides
+  for (const override of overrides) {
+    if (override.granted) {
+      roleDefaults.add(override.permission as Permission);
+    } else {
+      roleDefaults.delete(override.permission as Permission);
+    }
+  }
+
+  return Array.from(roleDefaults);
+};
+
+/**
+ * Check if a member has a specific permission
+ */
+export const memberHasPermission = async (
+  db: dbClient,
+  workspaceMemberId: number,
+  roleId: number | null,
+  roleName: string,
+  permission: Permission,
+): Promise<boolean> => {
+  let hasRoleDefault: boolean;
+
+  // Check role permission from database first
+  if (roleId) {
+    const dbPermissions = await getPermissionsByRoleId(db, roleId);
+    hasRoleDefault = dbPermissions.includes(permission);
+  } else {
+    // Fallback to code-based defaults
+    const codeDefaults = getDefaultPermissions(roleName as Role);
+    hasRoleDefault = codeDefaults.includes(permission);
+  }
+
+  // Check for override
+  const [override] = await db
+    .select()
+    .from(workspaceMemberPermissions)
+    .where(
+      and(
+        eq(workspaceMemberPermissions.workspaceMemberId, workspaceMemberId),
+        eq(workspaceMemberPermissions.permission, permission),
+      ),
+    )
+    .limit(1);
+
+  // Override takes precedence
+  if (override) {
+    return override.granted;
+  }
+
+  return hasRoleDefault;
+};
+
+/**
+ * Grant a permission to a member
+ */
+export const grantPermission = async (
+  db: dbClient,
+  workspaceMemberId: number,
+  permission: Permission,
+) => {
+  const [result] = await db
+    .insert(workspaceMemberPermissions)
+    .values({
+      workspaceMemberId,
+      permission,
+      granted: true,
+    })
+    .onConflictDoUpdate({
+      target: [
+        workspaceMemberPermissions.workspaceMemberId,
+        workspaceMemberPermissions.permission,
+      ],
+      set: {
+        granted: true,
+        updatedAt: new Date(),
+      },
+    })
+    .returning();
+
+  return result;
+};
+
+/**
+ * Revoke a permission from a member
+ */
+export const revokePermission = async (
+  db: dbClient,
+  workspaceMemberId: number,
+  permission: Permission,
+) => {
+  const [result] = await db
+    .insert(workspaceMemberPermissions)
+    .values({
+      workspaceMemberId,
+      permission,
+      granted: false,
+    })
+    .onConflictDoUpdate({
+      target: [
+        workspaceMemberPermissions.workspaceMemberId,
+        workspaceMemberPermissions.permission,
+      ],
+      set: {
+        granted: false,
+        updatedAt: new Date(),
+      },
+    })
+    .returning();
+
+  return result;
+};
+
+/**
+ * Clear all permission overrides for a workspace member
+ */
+export const clearMemberPermissionOverrides = async (
+  db: dbClient,
+  workspaceMemberId: number,
+) => {
+  await db
+    .delete(workspaceMemberPermissions)
+    .where(eq(workspaceMemberPermissions.workspaceMemberId, workspaceMemberId));
+};
+
+/**
+ * Clear all permission overrides for all members in a workspace
+ */
+export const clearAllMemberPermissionOverridesForWorkspace = async (
+  db: dbClient,
+  workspaceId: number,
+) => {
+  const memberIds = await db
+    .select({ id: workspaceMembers.id })
+    .from(workspaceMembers)
+    .where(
+      and(
+        eq(workspaceMembers.workspaceId, workspaceId),
+        isNull(workspaceMembers.deletedAt),
+      ),
+    );
+
+  if (memberIds.length === 0) return;
+
+  const ids = memberIds.map((m) => m.id);
+
+  await db
+    .delete(workspaceMemberPermissions)
+    .where(inArray(workspaceMemberPermissions.workspaceMemberId, ids));
+};
+
+/**
+ * Get member with their role by userId and workspaceId
+ */
+export const getMemberWithRole = async (
+  db: dbClient,
+  userId: string,
+  workspaceId: number,
+) => {
+  const [member] = await db
+    .select({
+      id: workspaceMembers.id,
+      publicId: workspaceMembers.publicId,
+      role: workspaceMembers.role,
+      roleId: workspaceMembers.roleId,
+    })
+    .from(workspaceMembers)
+    .where(
+      and(
+        eq(workspaceMembers.userId, userId),
+        eq(workspaceMembers.workspaceId, workspaceId),
+        isNull(workspaceMembers.deletedAt),
+      ),
+    )
+    .limit(1);
+
+  return member;
+};
+
+/**
+ * Check if user has permission in workspace
+ */
+export const userHasPermissionInWorkspace = async (
+  db: dbClient,
+  userId: string,
+  workspaceId: number,
+  permission: Permission,
+): Promise<boolean> => {
+  const member = await getMemberWithRole(db, userId, workspaceId);
+
+  if (!member) {
+    return false;
+  }
+
+  return memberHasPermission(
+    db,
+    member.id,
+    member.roleId,
+    member.role,
+    permission,
+  );
+};
+
+/**
+ * Get all permissions for a user in a workspace
+ */
+export const getUserPermissionsInWorkspace = async (
+  db: dbClient,
+  userId: string,
+  workspaceId: number,
+): Promise<{
+  permissions: Permission[];
+  role: string;
+  roleId: number | null;
+} | null> => {
+  const member = await getMemberWithRole(db, userId, workspaceId);
+
+  if (!member) {
+    return null;
+  }
+
+  const permissions = await getMemberEffectivePermissions(
+    db,
+    member.id,
+    member.roleId,
+    member.role,
+  );
+
+  return {
+    permissions,
+    role: member.role,
+    roleId: member.roleId,
+  };
+};
+
+/**
+ * Create a role for a workspace
+ */
+export const createRole = async (
+  db: dbClient,
+  args: {
+    workspaceId: number;
+    name: string;
+    description: string;
+    hierarchyLevel: number;
+    isSystem: boolean;
+    permissions: Permission[];
+  },
+) => {
+  const [role] = await db
+    .insert(workspaceRoles)
+    .values({
+      publicId: generateUID(),
+      workspaceId: args.workspaceId,
+      name: args.name,
+      description: args.description,
+      hierarchyLevel: args.hierarchyLevel,
+      isSystem: args.isSystem,
+    })
+    .returning({
+      id: workspaceRoles.id,
+      name: workspaceRoles.name,
+      publicId: workspaceRoles.publicId,
+    });
+
+  if (role && args.permissions.length > 0) {
+    await db.insert(workspaceRolePermissions).values(
+      args.permissions.map((perm) => ({
+        workspaceRoleId: role.id,
+        permission: perm,
+        granted: true,
+      })),
+    );
+  }
+
+  return role;
+};
+
+/**
+ * Grant a permission to a role
+ */
+export const grantRolePermission = async (
+  db: dbClient,
+  roleId: number,
+  permission: Permission,
+) => {
+  const [result] = await db
+    .insert(workspaceRolePermissions)
+    .values({
+      workspaceRoleId: roleId,
+      permission,
+      granted: true,
+    })
+    .onConflictDoUpdate({
+      target: [
+        workspaceRolePermissions.workspaceRoleId,
+        workspaceRolePermissions.permission,
+      ],
+      set: {
+        granted: true,
+      },
+    })
+    .returning();
+
+  return result;
+};
+
+/**
+ * Revoke a permission from a role
+ */
+export const revokeRolePermission = async (
+  db: dbClient,
+  roleId: number,
+  permission: Permission,
+) => {
+  const [result] = await db
+    .insert(workspaceRolePermissions)
+    .values({
+      workspaceRoleId: roleId,
+      permission,
+      granted: false,
+    })
+    .onConflictDoUpdate({
+      target: [
+        workspaceRolePermissions.workspaceRoleId,
+        workspaceRolePermissions.permission,
+      ],
+      set: {
+        granted: false,
+      },
+    })
+    .returning();
+
+  return result;
+};
+
+/**
+ * Get all roles for a workspace
+ */
+export const getRolesByWorkspaceId = async (
+  db: dbClient,
+  workspaceId: number,
+) => {
+  return db
+    .select({
+      id: workspaceRoles.id,
+      publicId: workspaceRoles.publicId,
+      name: workspaceRoles.name,
+      description: workspaceRoles.description,
+      hierarchyLevel: workspaceRoles.hierarchyLevel,
+      isSystem: workspaceRoles.isSystem,
+    })
+    .from(workspaceRoles)
+    .where(eq(workspaceRoles.workspaceId, workspaceId));
+};
+
+
--- a/packages/db/src/repository/workspace.repo.ts
+++ b/packages/db/src/repository/workspace.repo.ts
@@ -18,7 +18,33 @@ import {
  workspaceMembers,
  workspaces,
 } from "@kan/db/schema";
-import { generateUID } from "@kan/shared/utils";
+import type { Permission, Role } from "@kan/shared";
+import { generateUID, getDefaultPermissions } from "@kan/shared";
+
+import * as permissionRepo from "./permission.repo";
+
+// System role definitions
+const SYSTEM_ROLES: {
+  name: Role;
+  description: string;
+  hierarchyLevel: number;
+}[] = [
+  {
+    name: "admin",
+    description: "Full access to all workspace features",
+    hierarchyLevel: 100,
+  },
+  {
+    name: "member",
+    description: "Standard member with create and edit permissions",
+    hierarchyLevel: 50,
+  },
+  {
+    name: "guest",
+    description: "View-only access",
+    hierarchyLevel: 10,
+  },
+];

 export const getCount = async (db: dbClient) => {
  const result = await db
@@ -57,6 +83,22 @@ export const create = async (
    });

  if (workspace) {
+    // Create system roles for the workspace
+    let adminRoleId: number | null = null;
+    for (const roleData of SYSTEM_ROLES) {
+      const role = await permissionRepo.createRole(db, {
+        workspaceId: workspace.id,
+        name: roleData.name,
+        description: roleData.description,
+        hierarchyLevel: roleData.hierarchyLevel,
+        isSystem: true,
+        permissions: [...getDefaultPermissions(roleData.name)] as Permission[],
+      });
+      if (roleData.name === "admin" && role) {
+        adminRoleId = role.id;
+      }
+    }
+
    await db.insert(workspaceMembers).values({
      publicId: generateUID(),
      userId: workspaceInput.createdBy,
@@ -64,6 +106,7 @@ export const create = async (
      workspaceId: workspace.id,
      createdBy: workspaceInput.createdBy,
      role: "admin",
+      roleId: adminRoleId,
      status: "active",
    });
  }
@@ -151,8 +194,13 @@ export const getByPublicIdWithMembers = (
          email: true,
          role: true,
          status: true,
+          createdAt: true,
        },
        where: isNull(workspaceMembers.deletedAt),
+        orderBy: (member, { desc }) => [
+          desc(sql`CASE WHEN ${member.role} = 'admin' THEN 1 ELSE 0 END`),
+          desc(member.createdAt),
+        ],
        with: {
          user: {
            columns: {