diff --git a/packages/shared/src/authz/policies/dashboard/canDelete.ts b/packages/shared/src/authz/policies/dashboard/canDelete.ts index cb17788db..b962582bf 100644 --- a/packages/shared/src/authz/policies/dashboard/canDelete.ts +++ b/packages/shared/src/authz/policies/dashboard/canDelete.ts @@ -18,9 +18,12 @@ import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js' import { Roles } from '../../../core/constants.js' import { hasEditorSeat } from '../../checks/workspaceSeat.js' import { isDashboardOwner } from '../../checks/dashboards.js' +import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js' type PolicyLoaderKeys = | typeof AuthCheckContextLoaderKeys.getEnv + | typeof AuthCheckContextLoaderKeys.getServerRole + | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole @@ -57,6 +60,11 @@ export const canDeleteDashboardPolicy: AuthPolicy< )({ workspaceId }) if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error) + const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({ + userId + }) + if (hasAdminAccess.isOk && hasAdminAccess.value) return ok() + const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({ userId: userId!, workspaceId diff --git a/packages/shared/src/authz/policies/dashboard/canEdit.ts b/packages/shared/src/authz/policies/dashboard/canEdit.ts index f928dce49..05482a810 100644 --- a/packages/shared/src/authz/policies/dashboard/canEdit.ts +++ b/packages/shared/src/authz/policies/dashboard/canEdit.ts @@ -16,9 +16,12 @@ import { import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js' import { Roles } from '../../../core/constants.js' import { hasEditorSeat } from '../../checks/workspaceSeat.js' +import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js' type PolicyLoaderKeys = | typeof AuthCheckContextLoaderKeys.getEnv + | typeof AuthCheckContextLoaderKeys.getServerRole + | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole @@ -54,6 +57,11 @@ export const canEditDashboardPolicy: AuthPolicy< )({ workspaceId }) if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error) + const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({ + userId + }) + if (hasAdminAccess.isOk && hasAdminAccess.value) return ok() + const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({ userId: userId!, workspaceId, diff --git a/packages/shared/src/authz/policies/dashboard/canRead.ts b/packages/shared/src/authz/policies/dashboard/canRead.ts index 022d1e45f..63217b974 100644 --- a/packages/shared/src/authz/policies/dashboard/canRead.ts +++ b/packages/shared/src/authz/policies/dashboard/canRead.ts @@ -17,11 +17,15 @@ import { } from '../../fragments/dashboards.js' import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js' import { Roles } from '../../../core/constants.js' -import { ensureMinimumServerRoleFragment } from '../../fragments/server.js' +import { + checkIfAdminOverrideEnabledFragment, + ensureMinimumServerRoleFragment +} from '../../fragments/server.js' type PolicyLoaderKeys = | typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole + | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspacePlan @@ -63,6 +67,11 @@ export const canReadDashboardPolicy: AuthPolicy< )({ workspaceId }) if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error) + const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({ + userId + }) + if (hasAdminAccess.isOk && hasAdminAccess.value) return ok() + const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({ userId: userId!, workspaceId, diff --git a/packages/shared/src/authz/policies/workspace/canCreateDashboards.ts b/packages/shared/src/authz/policies/workspace/canCreateDashboards.ts index 004579046..73aa4045b 100644 --- a/packages/shared/src/authz/policies/workspace/canCreateDashboards.ts +++ b/packages/shared/src/authz/policies/workspace/canCreateDashboards.ts @@ -15,9 +15,12 @@ import { import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js' import { Roles } from '../../../core/constants.js' import { hasEditorSeat } from '../../checks/workspaceSeat.js' +import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js' type PolicyLoaderKeys = | typeof AuthCheckContextLoaderKeys.getEnv + | typeof AuthCheckContextLoaderKeys.getServerRole + | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat @@ -46,6 +49,11 @@ export const canCreateDashboardsPolicy: AuthPolicy< )({ workspaceId }) if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error) + const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({ + userId + }) + if (hasAdminAccess.isOk && hasAdminAccess.value) return ok() + const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({ userId: userId!, workspaceId,