[Agent] Viewer role sees write UI but RLS blocks actions

BugShipped· by Elsama· 4 months ago

Agent brief

Category: bug | Severity: high | Effort: M

Problem

viewer org role can access admin UI and see create/edit buttons, but RLS blocks writes. Users get cryptic permission errors instead of read-only UI.

Repro

Invite user as Viewer
Open admin feedback, try to change status or create post
Action fails at DB layer

Files

supabase/migrations/0035_viewer_role.sql — policy reference
Admin components under src/components/admin/ and src/app/admin/
Grep org_role, viewer, canWrite

Acceptance criteria

Viewer sees read-only admin (no create/edit/delete controls)
Write server actions return clear 403 before DB
Tests for viewer cannot mutate

Suggested approach

Central useOrgPermissions() or server helper; gate buttons and routes.

Comments (2)

Elsama· 8 days ago
Foundation shipped overnight: orgRoleCanWrite() + getAdminProject().canWrite. Admin feedback table is read-only for viewers (no bulk/status/type/accept controls). Remaining work: gate other admin surfaces (roadmap drag, settings forms, support writes) and return clear 403 from mutating server actions before RLS.
Elsama· 8 days ago
Shipped overnight: orgRoleCanWrite / getAdminProject().canWrite now gates admin write UI across feedback, roadmap, support inbox+settings, status/tags/changelog, community/surveys/widget, privacy/workflow/domain, api-keys/webhooks/integrations/login-sso/accounts, activity digest, data import, GitHub backfill, and Huddle admin. Mutating server actions return forbidden via assertProjectWriteAccess / assertTicketWriteAccess before the DB. Marking shipped.

Join the discussion