You’re viewing Paradaux’s public workspaceSign in to vote Get taskl.ie for your team

PAR-184

Loading issues

PAR-184 · Configurable RBAC: per-workspace roles + permissions with… · Paradaux · taskl.ie

PAR-184

Configurable RBAC: per-workspace roles + permissions with admin/contributor/viewer defaults

Child of PAR-182. Expands RBAC from a fixed enum to a configurable model (product direction).

Requirement

Roles are configurable per workspace beyond the built-in owner.
New workspaces are seeded with sane defaults: admin / contributor / viewer (admin = full manage incl. members/settings; contributor = create/update issues; viewer = read-only).
Owner is effectively an admin who cannot be removed or demoted by another admin (only transferable). Last-owner guard.

Model (proposed)

New tables: role (tenant-scoped: id, name, is_system, is_owner) and role_permission (role_id → permission key). Permission keys: e.g. issue.read/create/update/delete, member.manage, settings.manage, team.manage, role.manage, release.manage, integration.manage.
Migrate tenant_member.role (enum text) → tenant_member.role_id FK; backfill owner→owner role, member→contributor, viewer→viewer.
Seed default role set on workspace creation (WorkspaceAdminService seed path, alongside seedStates).

Enforcement is split out into sibling issues (API/MCP/UI). This issue is the model + defaults + migration only.

Depends on / pairs with the enforcement children. Replaces the hard-coded unions in tesks-ui/lib/roles.ts.

Activity

tesks created the issue Jun 15
tesks set status to Pending Release Jun 15
tesksJun 15
Done on develop (commit 25680a9). Migration V19__rbac_roles.sql adds role + role_permission (tenant-scoped) and role_id on tenant_member and api_key. Seeds four system roles per workspace — owner/admin/contributor/viewer — with fine-grained grants; backfills existing members (owner→owner, member→contributor, viewer→viewer) and existing API keys → admin. New workspaces seed the same set via WorkspaceAdminService.seedRoles (creator → owner). Owner role is is_owner (immutable, only role with issue.destroy + workspace.manage). Verified by the RBAC test suite (100 tests green).
ParadauxIO linked a commit: Commit 25680a9 — Add configurable per-workspace RBAC + enforce it on the admin surface (PAR-184, PAR-185) Jun 16
ParadauxIO linked a commit: Commit 061dba7 — Add custom role CRUD (role.manage) for configurable workspace roles (PAR-184) Jun 16
tesksJun 16
Verified LIVE. V19 creates role+role_permission, seeds owner/admin/contributor/viewer for all existing workspaces + grants, adds & backfills tenant_member.role_id. Owner immutability + last-owner guard in WorkspaceAdminService.setMemberRole/removeMember (via PermissionService.actorIsOwner); custom role CRUD gated on role.manage. Acceptance met.
tesks set status to Done Jun 16
ParadauxIO linked a commit: Commit 25680a9 — Add configurable per-workspace RBAC + enforce it on the admin surface (PAR-184, PAR-185) Oct 13
ParadauxIO linked a commit: Commit 061dba7 — Add custom role CRUD (role.manage) for configurable workspace roles (PAR-184) Oct 13

Workspace permission required to comment

Comments and reactions require workspace permission. Ask a workspace owner or admin for access. You can sign in to vote.