## What does this PR do?
This PR implements attributes PBAC - router checks + UI
## Visual Demo (For contributors especially)
A visual demonstration is strongly recommended, for both the original and new change **(video / image - any one)**.
#### Video Demo (if applicable):
- Show screen recordings of the issue or feature.
- Demonstrate how to reproduce the issue, the behavior before and after the change.
#### Image Demo (if applicable):
- Add side-by-side screenshots of the original and updated change.
- Highlight any significant change(s).
## Mandatory Tasks (DO NOT REMOVE)
- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
## How should this be tested?
Enable PBAC on an org
Create a custom role -> advanced -> organizations -> "editUser"
Assign it to a user
impersonate user
test they have access to all things attributes
remove permissions
check they dont have permissions.
## Checklist
<!-- Remove bullet points below that don't apply to you -->
- I haven't read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- My code doesn't follow the style guidelines of this project
- I haven't commented my code, particularly in hard-to-understand areas
- I haven't checked if my changes generate no new warnings
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a new PBAC “editUsers” permission and read gating for Attributes, updating the UI and backend so users can view and edit attributes only when allowed.
- **New Features**
- Added CustomAction.EditUsers to the permission registry for organization-scoped attribute editing.
- Settings computes canViewAttributes and shows the Attributes tab only when allowed.
- Members page fetches Attributes permissions and exposes canViewAttributes and canEditAttributesForUser to the UI.
- User Edit Sheet hides attributes without read permission and shows attribute editing and the bulk “Mass Assign Attributes” action only with editUsers; other user edits depend on changeMemberRole.
- Attributes TRPC router gates create/edit/delete/toggle via PBAC and requires organization.attributes.editUsers for assign/bulk-assign; added a helper to create PBAC-aware procedures.
- **Migration**
- Run the new Prisma migration to seed the admin role with editUsers.
- If using custom roles, grant Edit Users under Attributes as needed.
<sup>Written for commit 856aa2e8e1521fc22cd71cb0fa6d720036efe8a2. Summary will update automatically on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
* chore: refactor config files to prevent migration tool errors
* refactor: upgrade with the tailwind migration tool
* chore: restore pre-commit command + mc
* refactor(wip): update dependencies and migrate to Tailwind CSS v4 (mainly web)
* chore: resolve Tailwind v4 migration conflicts from merging main
* chore: remove unused Tailwind packages from config and update dependencies for v4 migration
* chore: uncomment Tailwind CSS utility classes in globals.css
* fix: resolve token conflicts between calcom and coss ui
* fix: textarea scrollbar
* Fix CUI-16
* fix: added @tailwindcss/forms plugin and cleaned up CSS classes in various components to remove unnecessary dark mode styles
* fix: selects and inputs of different sizes
* fix: remove unnecessary leading-20 class from modal titles in various components
* fix: update Checkbox component styles to remove unnecessary border on checked state
* fix: clean up styles in RequiresConfirmationController, Checkbox, and Radio components to enhance consistency
* fix: update button and filter component styles to remove unnecessary rounded classes for consistency
* fix: calendar
* fix: update KBarSearch
* fix: refine styles in Empty and Checkbox components for improved consistency
* Fix focus state email input
* fix: update button hover and active states to use 'not-disabled' instead of 'enabled'
* fix: line-height issues
* fix: update class name for muted background in BookingListItem component
* fix: sidebar spacing
* chore: update class names to use new Tailwind CSS color utilities
* fix embed
* chore: upgrade Tailwind CSS to version 4.1.16 and update related dependencies
* Map css variables and add a playground test for heavy css customization
* suggestion for coss-ui
* refactor: update CSS variable usage and clean up styles
- Replace instances of `--cal-brand-color` with `--cal-brand` in embed-related HTML files.
- Remove the now-unnecessary `addAppCssVars` function from the embed core.
- Import theme tokens in the embed core styles for better consistency.
- Clean up whitespace and formatting in CSS files for improved readability.
- Add a comment in `tokens.css` regarding its usage in both embed and webapp contexts.
* Handle within tokens.css instead of fixing coss-ui
* Remove initial, not needed. Also, remove tailwind.config.js as tailwidn scans the html automaically
* fix: examples app breaking
* fix: modal not resizing correctly
* feat: upgrade atoms to tailwind v4
* fix: atoms build breaking
* fix: atoms build breaking
* chore: upgrate examples/base to tailwind 4
* chore: update globals.css
* fix: add missing scheduler css variables
* fix: PlatformAdditionalCalendarSelector
* chore: update global styles
* chore: update tailwindcss and postcss dependencies to stable versions
* chore: remove unneeded class
* fix: dialog and toast animation
* fix: replace flex-shrink-0 with shrink-0 for consistent styling in various components
* fix: dialog modal for Apple connect
* add margin in SaveFilterSegmentButton
* Fix radix button nested states
* add cursor pointer to buttons but keep dsabled state
* Fix commandK selectors and adds cursor pointer
* Fix teams filter
* fix - round checkboxes
* fix filter checkbox
* fix select indicator's margin
* command group font size
* style: fix badge and tooltip radius
* chore: remove unneeded files
* Delete PR_REVIEW_MANAGED_EVENT_REASSIGNMENT.md
* remove ui-playground leftover
* fix: add missing react phone input styles in atoms
* Delete managed-event-reassignment-flow-and-architecture.mermaid
* fix: inter font not loading
* Add theme to skeleton container so that it can support dark mode
* fix: create custom stack-y-* utilities post tw4 upgrade
* fix: typo
* fix: atoms stack class + remove unused css file
* fix default radius valiue
* fix space-y in embed
* fix skeleton background
* Hardcode radius values to match production
* fix border in embed
* add missing externalThemeClass
* feat: create a custom stack-y-* utility
* fix: add stack utility to atom global css
* fix: Skeleton loader class modalbox
* Add stack-y utility in embed
* fix: add missing stack utilities in atoms globals.css
* update yarn.lock
* add popover portla
* update
---------
Co-authored-by: Sean Brydon <sean@cal.com>
Co-authored-by: Hariom Balhara <hariombalhara@gmail.com>
Co-authored-by: Ryukemeister <sahalrajiv6900@gmail.com>
Co-authored-by: cal.com <morgan@cal.com>
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: Anik Dhabal Babu <adhabal2002@gmail.com>
2025-11-25 17:32:28 -03:00
sean-brydonGitHubsean@cal.com <Sean@brydon.io>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* migration plus feature flag
* show navigation route + inital roles migration
* add a check permission use case to take in the feature flags for a team
* bulk update script
* inital frontend work for displaying roles
* move to a more "anemic domain models" approach
* update test to match new DDD strutcture
* fix tests
* update transaction call back types to include trx
* align fe types after transaction to DDD
* move away from usecases to a more domain tailored approach
* get permissions per resource and map them to domain permission string
* update permision logic
* correctly get the logic for *.* permissions on owner
* wip sheet logic for ssr
* role list
* use nuqs for sheet parsing on handle change
* fox
* improve hook usage
* enable PBAC router
* delete modal etc
* i18n and inital rough layout of roles + permisions creating
* add color to migrations
* add colors and new method to tests
* move hooks out of infra into client with provider
* move hooks out of infra into client with provider
* memo features and ensure render once
* remove comment
* seed color
* use role colours
* match i18n
* add custom color picker to edit/create form
* fix advanced mode toggle
* more work on adv permission group
* update migrations
* abstract lots of core form logic to a custom hook
* improve UX for selecting all and toggling all
* improve code quality and use domain mappers in role repositoryu
* call server action to revalidate cache
* call invalidate cache on delete
* fix re-render + improves update logic wip
* fix txn for assinging role to member
* wip on assigning users custom roles
* fix repo
* update logic for checking if users can update roles
* remove member from permission check
* check users permission and assign roles
* move to factory approach
* move default rolesIDs to constant
* add facuted values to table
* display custom role in table
* fix type error
* fix role filter
* check pbac feature flag to see what column to filter on
* push repo mocks and other mocks to fix unit tests
* fix and add test for empty permissions when creating a role
* pass updates to repo so we actually update roles
* fix types
* fix types
* restore lock changes
* fix role service test for new updates section
* fix updated at types
* update mocks to use feature repository mock
* remove roletype from db in model
* prevent multiple queries
* fix typeof in role model
* fix and migrate i18n to one registery
* fix and update i18n to be in registery
* fix type error + fall back in service instead of repo for BL
* more type errors
* update members faceted values to bennys refactor
* fix types
* remove the _resource from type conditionally
* fix managment factory types to expose PBAC enbaled obol
* narrow down types
* wip fix for types
* more fix types
* cast role
* fix tests
* attempt of fixing _resoucre key access type
* attempt of fixing _resoucre key access type
* seperate migraations to batches
* add invalidate time to team features
* restore router to main
* push main lock
* Update packages/features/pbac/domain/types/permission-registry.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/features/pbac/domain/mappers/PermissionMapper.ts
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250527091330_add_color_to_pbac_role/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update packages/prisma/migrations/20250617070118_update_memberships_one_time/migration.sql
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/AdvancedPermissionGroup.tsx
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix mapped type
* restore migration
* skip _resource
* use partical
* fix type errors in tests and hooks
* Simplified the role field in the editSchema to use z.nativeEnum(MembershipRole)
* fix type errors for editsheet
* fix type errors for editsheet
* Apply suggestion from comment 2151515295
* remove footer since we dont have docs yet
* add i18n
* lock all toggle chevron
* use prisma
* tidy up old manage permission
* fix i18n
* remove can manage from role permission check
* auto select read
* address benny feedback
* fix type
* fix type
* update function name due to merge
* fix types
* update tests to match new membership method from merge
* address cubic feedback
---------
Co-authored-by: Eunjae Lee <hey@eunjae.dev>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* remove create button for teams from calcom ui
* migrate timezone select to features
* remove trpc from phone and storybook provider
* new-yarn.lock
* fix imports + test file for select
* fix platform timezone select to use Raw timezone select
* fix timezone type import
* use correct select in timezone-select.tsx - needs trpc version
* fix lock and remove test-utils
* fix log file
* Updated yarn.lock
* Fixed types
* Fixed tests
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
Found via `codespell -q 3 -S "*.svg,./apps/web/public/static/locales,./packages/app-store/stripepayment/lib/currencyOptions.ts,./packages/lib/freeEmailDomainCheck/freeEmailDomains.ts" -L afterall,atleast,datea,fo,incase,ist,nam,notin,optionel,perview,reccuring`
Closes#19219
* fix: shadow after email and before the primary label
* fix: autofill input shadow in impersonation view
* fix: improve spacing and layout in EditUserForm
* fix: error due to getRight
---------
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
* wip attribut weights
* edit sheet and display in table
* add shrink so badges dont split
* push changes to support weights on csv export
* fix typing issue
* type error
* fall back to 100 weight
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* WIP restored from .git cache
* fix exports
* sortable row model
* feat column visibility component
* wip filters with nuqs
* pull in unique values from table into filters
* correctly assign filters via v/f
* inital selection bar refactor
* data-table selection bar + optmistic update of delete
* dynamic link
* migrate member list table to new data-table
* total list shows filtered value > db valuie
* add filters for attributes
* type errors
* make content bigger on lg
* add mb-6 to teams user datatable to match spacing spec
* correctly render multi-badge
* fix: masss asignment optimistic UI
* fix type errors
* remove log
* fix toolbar type error
* chore: Remove debug artifact
* type errors
* Update apps/web/public/static/locales/en/common.json
* use max-w-fit
* chore: Remove unused translation now we don't specify 'mass' in assign
* perf: fix: use the onBlur event to prevent focus loss whilst the list is rerendering
* Move the data-table exports together in the main barrel, then import
* fix exports that were lost in a merge
* fix exports that were lost in a merge
* fix groupteammapping/availbilityslider
* fix overflow problems
* add scrollbar-thin class
* fix type error
* user serverside values for faceted filters
* pass filters to serverside
* filter serverside
* fix team server side filter
* add loaded x of y
* attributes icon change
* correct implementation for text/input attr optimistic
* type check fixes
* fix platform checks
* fix types again
* fix types again
* fix types again
* add use client
* add use client
* fix-types
* fix: Add missing translation in EN
* fix e2e tests via testid
* fix e2e tests via testid
* fix: Member invite popup not popping up
* Update copyInviteLink to new-member-button testid
* Hopefully fix test ids this time
* fix: Use the right buttons on the right pages
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* fix: [CAL-3374] Says Number is not Verified, but it is Verified
* clearing error only when verified
* type-checks fixed
* chore: improvement
---------
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: Udit Takkar <udit222001@gmail.com>
