Paradaux
Issues

PAR-184

0

Configurable RBAC: per-workspace roles + permissions with admin/contributor/viewer defaults

DoneHighUnassignedTesksFeature

Child of PAR-182. Expands RBAC from a fixed enum to a configurable model (product direction).

Requirement

  • Roles are configurable per workspace beyond the built-in owner.
  • New workspaces are seeded with sane defaults: admin / contributor / viewer (admin = full manage incl. members/settings; contributor = create/update issues; viewer = read-only).
  • Owner is effectively an admin who cannot be removed or demoted by another admin (only transferable). Last-owner guard.

Model (proposed)

  • New tables: role (tenant-scoped: id, name, is_system, is_owner) and role_permission (role_id → permission key). Permission keys: e.g. issue.read/create/update/delete, member.manage, settings.manage, team.manage, role.manage, release.manage, integration.manage.
  • Migrate tenant_member.role (enum text) → tenant_member.role_id FK; backfill owner→owner role, member→contributor, viewer→viewer.
  • Seed default role set on workspace creation (WorkspaceAdminService seed path, alongside seedStates).

Enforcement is split out into sibling issues (API/MCP/UI). This issue is the model + defaults + migration only.

Depends on / pairs with the enforcement children. Replaces the hard-coded unions in tesks-ui/lib/roles.ts.

Resources

Comments

tesks · Jun 15, 2026, 8:04 PM

Done on develop (commit 25680a9). Migration V19__rbac_roles.sql adds role + role_permission (tenant-scoped) and role_id on tenant_member and api_key. Seeds four system roles per workspace — owner/admin/contributor/viewer — with fine-grained grants; backfills existing members (owner→owner, member→contributor, viewer→viewer) and existing API keys → admin. New workspaces seed the same set via WorkspaceAdminService.seedRoles (creator → owner). Owner role is is_owner (immutable, only role with issue.destroy + workspace.manage). Verified by the RBAC test suite (100 tests green).

tesks · Jun 16, 2026, 8:10 PM

Verified LIVE. V19 creates role+role_permission, seeds owner/admin/contributor/viewer for all existing workspaces + grants, adds & backfills tenant_member.role_id. Owner immutability + last-owner guard in WorkspaceAdminService.setMemberRole/removeMember (via PermissionService.actorIsOwner); custom role CRUD gated on role.manage. Acceptance met.

Activity

  • tesks changed status to Status → Done
  • tesks commented
  • ParadauxIO linked a commit — Commit 061dba7 — Add custom role CRUD (role.manage) for configurable workspace roles (PAR-184)
  • ParadauxIO linked a commit — Commit 25680a9 — Add configurable per-workspace RBAC + enforce it on the admin surface (PAR-184, PAR-185)
  • tesks commented
  • tesks changed status to Status → Pending Release
  • tesks created the issue