Skip to content

chore: make RBAC default - #4780

Merged
tgmendes merged 11 commits into
mainfrom
feat/rbac-default
Aug 6, 2026
Merged

chore: make RBAC default#4780
tgmendes merged 11 commits into
mainfrom
feat/rbac-default

Conversation

@tgmendes

@tgmendes tgmendes commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Summary

  • remove the organization-level RBAC feature flag, status endpoints, and dashboard controls
  • enforce RBAC by default for authenticated organizations
  • seed built-in grants for newly created organizations and assign the first user the admin role
  • seed system-role grants during WorkOS organization reconciliation
  • simplify shared authorization infrastructure and regenerate affected clients

Rollout note

A one-time application backfill must be completed for existing organizations before this change is deployed. The backfill should seed the canonical admin and member grants and ensure existing organization members have appropriate role assignments. The backfill is intentionally not included in this PR.

@changeset-bot

changeset-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 9c2a497

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
server Patch
dashboard Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@tgmendes
tgmendes marked this pull request as ready for review July 31, 2026 15:51
@tgmendes
tgmendes requested review from a team as code owners July 31, 2026 15:51

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 128 files

Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic

Comment thread server/internal/auth/identity/identity.go Outdated
Comment thread server/internal/testenv/testcontainers.go
Comment thread .mise-tasks/seed.mts
Comment thread server/internal/authz/provisioner.go

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 131 files

Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic

Comment thread server/internal/authz/provisioner.go Outdated

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 10 files (changes from recent commits).

Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic

Comment thread server/internal/testenv/postgresql.go

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 6 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic

Comment thread server/internal/authz/provisioner.go
@tgmendes
tgmendes added this pull request to the merge queue Aug 6, 2026
Merged via the queue into main with commit 817174d Aug 6, 2026
44 checks passed
@tgmendes
tgmendes deleted the feat/rbac-default branch August 6, 2026 11:46
@github-actions github-actions Bot locked and limited conversation to collaborators Aug 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants