feat(webapp): enforce RBAC permissions on run, prompt, member, and billing routes#3948

Merged

matt-aitken merged 35 commits into

mainfrom

feature/tri-10644-rbac-developer-enforcement

Jun 18, 2026

Commits on Jun 17, 2026

feat(webapp): add permission-gating primitives
matt-aitken
committed

Commits on Jun 18, 2026

fix(webapp): enforce write:runs on single-run cancel and replay actions
matt-aitken
committed
Remove the Create role UI for now
matt-aitken
committed
fix(webapp): enforce write:runs on bulk action create and abort
matt-aitken
committed
fix(webapp): gate run-detail Replay and Cancel buttons on write:runs
matt-aitken
committed
fix(webapp): make RBAC role assignment on invite accept non-fatal
matt-aitken
committed
fix(webapp): enforce write:prompts / update:prompts on prompt detail route + UI
matt-aitken
committed
fix(webapp): enforce manage:members on invite/resend/revoke routes + UI
matt-aitken
committed
fix(webapp): enforce manage:billing on billing/plan/portal routes
matt-aitken
committed
fix(webapp): gate TaskRunsTable row menu + runs-index/errors bulk controls on write:runs
matt-aitken
committed
chore(webapp): add server-changes note for RBAC route permission enforcement
matt-aitken
committed
fix(webapp): restore manage:billing enforcement on billing + billing-alerts routes
matt-aitken
committed
fix(webapp): enforce write:deployments on rollback/promote/cancel routes + UI
matt-aitken
committed
fix(webapp): enforce write:github on the GitHub integration route
matt-aitken
committed
fix(webapp): gate GitHub integration UI + install entry on write:github
matt-aitken
committed
fix(webapp): enforce write:vercel on Vercel integration routes + UI
matt-aitken
committed
fix(webapp): disable seat purchase without manage:billing
matt-aitken
committed
feat(webapp): gate API keys page on env-tier read access
matt-aitken
committed
fix(webapp): show a permission panel instead of redirecting on gated pages
matt-aitken
committed
feat(webapp): roles page full-height sticky table + current role + env chips
matt-aitken
committed
feat(webapp): enforce env var permissions on the dashboard
matt-aitken
committed
feat(webapp): enforce env var permissions on the API routes
matt-aitken
committed
docs(webapp): drop tracker reference from invite role comment
matt-aitken
committed
feat(webapp): enforce env-tier access on environment credential endpoints
matt-aitken
committed
chore(webapp): add server-changes note for RBAC permission enforcement
matt-aitken
committed
fix(webapp): show a permission panel on the integrations page for restricted roles
matt-aitken
committed
refactor(webapp): render permission-denied via an error boundary
matt-aitken
committed
refactor(webapp): render the permission panel via the route error boundary
matt-aitken
committed
Super admin redirects
matt-aitken
committed
fix(webapp): harden RBAC org scoping and write-tier gating
matt-aitken
committed
fix(webapp): surface promote/rollback action errors on the form
matt-aitken
committed
fix(webapp): fail closed when a scoped authorization check has no org scope
matt-aitken
committed
chore(webapp): collapse RBAC server-changes note and reword comments
matt-aitken
committed
fix(webapp): close two RBAC scope gaps from review
matt-aitken
committed
fix(webapp): scope member removal and run replay to the caller org
matt-aitken
committed