feat(policies): allow god mode admins to create dashboards (#5612)

packages/shared/src/authz/policies/dashboard/canDelete.ts

@@ -18,9 +18,12 @@ import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
 import { Roles } from '../../../core/constants.js'
 import { hasEditorSeat } from '../../checks/workspaceSeat.js'
 import { isDashboardOwner } from '../../checks/dashboards.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
 
 type PolicyLoaderKeys =
   | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
   | typeof AuthCheckContextLoaderKeys.getDashboard
   | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
   | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
@@ -57,6 +60,11 @@ export const canDeleteDashboardPolicy: AuthPolicy<
     )({ workspaceId })
     if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
 
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
     const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
       userId: userId!,
       workspaceId

packages/shared/src/authz/policies/dashboard/canEdit.ts

@@ -16,9 +16,12 @@ import {
 import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
 import { Roles } from '../../../core/constants.js'
 import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
 
 type PolicyLoaderKeys =
   | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
   | typeof AuthCheckContextLoaderKeys.getDashboard
   | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
   | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
@@ -54,6 +57,11 @@ export const canEditDashboardPolicy: AuthPolicy<
     )({ workspaceId })
     if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
 
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
     const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
       userId: userId!,
       workspaceId,

packages/shared/src/authz/policies/dashboard/canRead.ts

@@ -17,11 +17,15 @@ import {
 } from '../../fragments/dashboards.js'
 import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
 import { Roles } from '../../../core/constants.js'
-import { ensureMinimumServerRoleFragment } from '../../fragments/server.js'
+import {
+  checkIfAdminOverrideEnabledFragment,
+  ensureMinimumServerRoleFragment
+} from '../../fragments/server.js'
 
 type PolicyLoaderKeys =
   | typeof AuthCheckContextLoaderKeys.getEnv
   | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
   | typeof AuthCheckContextLoaderKeys.getDashboard
   | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
   | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
@@ -63,6 +67,11 @@ export const canReadDashboardPolicy: AuthPolicy<
     )({ workspaceId })
     if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
 
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
     const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
       userId: userId!,
       workspaceId,

packages/shared/src/authz/policies/workspace/canCreateDashboards.ts

@@ -15,9 +15,12 @@ import {
 import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
 import { Roles } from '../../../core/constants.js'
 import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
 
 type PolicyLoaderKeys =
   | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
   | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
   | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
   | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat
@@ -46,6 +49,11 @@ export const canCreateDashboardsPolicy: AuthPolicy<
     )({ workspaceId })
     if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
 
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
     const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
       userId: userId!,
       workspaceId,