Merge branch 'master' into group-type-project

ee/api/feature_flag_role_access.py

@@ -1,10 +1,10 @@
 from rest_framework import exceptions, mixins, serializers, viewsets
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
-from ee.api.role import RoleSerializer
+from ee.api.rbac.role import RoleSerializer
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.api.feature_flag import FeatureFlagSerializer
 from posthog.api.routing import TeamAndOrgViewSetMixin
 from posthog.models import FeatureFlag

ee/api/organization_resource_access.py → ee/api/rbac/organization_resource_access.py

@@ -1,7 +1,7 @@
 from rest_framework import mixins, serializers, viewsets
 
-from ee.api.role import RolePermissions
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.api.rbac.role import RolePermissions
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.api.routing import TeamAndOrgViewSetMixin
 
 

ee/api/role.py → ee/api/rbac/role.py

@@ -5,8 +5,8 @@
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.api.organization_member import OrganizationMemberSerializer
 from posthog.api.routing import TeamAndOrgViewSetMixin
 from posthog.api.shared import UserBasicSerializer

ee/api/test/test_feature_flag.py

@@ -1,6 +1,6 @@
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.models.feature_flag import FeatureFlag
 from posthog.models.organization import OrganizationMembership
 

ee/api/test/test_feature_flag_role_access.py

@@ -2,8 +2,8 @@
 
 from ee.api.test.base import APILicensedTest
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.models.feature_flag import FeatureFlag
 from posthog.models.organization import OrganizationMembership
 from posthog.models.user import User

ee/api/test/test_organization_resource_access.py

@@ -2,7 +2,7 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.models.organization import Organization, OrganizationMembership
 from posthog.test.base import QueryMatchingTest, snapshot_postgres_queries, FuzzyInt
 

ee/api/test/test_role.py

@@ -2,8 +2,8 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.models.organization import Organization, OrganizationMembership
 
 

ee/api/test/test_role_membership.py

@@ -1,7 +1,7 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.models.organization import Organization, OrganizationMembership
 from posthog.models.user import User
 

ee/models/__init__.py

@@ -5,7 +5,7 @@
 from .hook import Hook
 from .license import License
 from .property_definition import EnterprisePropertyDefinition
-from .role import Role, RoleMembership
+from .rbac.role import Role, RoleMembership
 
 __all__ = [
     "EnterpriseEventDefinition",

ee/models/organization_resource_access.py → ee/models/rbac/organization_resource_access.py

@@ -2,6 +2,8 @@
 
 from posthog.models.organization import Organization
 
+# NOTE: This will be deprecated in favour of the AccessControl model
+
 
 class OrganizationResourceAccess(models.Model):
     class AccessLevel(models.IntegerChoices):

ee/models/role.py → ee/models/rbac/role.py

@@ -1,6 +1,6 @@
 from django.db import models
 
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.models.utils import UUIDModel
 
 

ee/urls.py

@@ -6,6 +6,7 @@
 from django.urls.conf import path
 
 from ee.api import integration
+from .api.rbac import organization_resource_access, role
 
 from .api import (
     authentication,
@@ -15,8 +16,6 @@
     feature_flag_role_access,
     hooks,
     license,
-    organization_resource_access,
-    role,
     sentry_stats,
     subscription,
 )
@@ -49,6 +48,7 @@ def extend_api_router() -> None:
         "organization_role_memberships",
         ["organization_id", "role_id"],
     )
+    # Start: routes to be deprecated
     project_feature_flags_router.register(
         r"role_access",
         feature_flag_role_access.FeatureFlagRoleAccessViewSet,
@@ -61,6 +61,7 @@ def extend_api_router() -> None:
         "organization_resource_access",
         ["organization_id"],
     )
+    # End: routes to be deprecated
     register_grandfathered_environment_nested_viewset(r"hooks", hooks.HookViewSet, "environment_hooks", ["team_id"])
     register_grandfathered_environment_nested_viewset(
         r"explicit_members",

frontend/src/lib/constants.tsx

@@ -220,6 +220,7 @@ export const FEATURE_FLAGS = {
     LEGACY_ACTION_WEBHOOKS: 'legacy-action-webhooks', // owner: @mariusandra #team-cdp
     SESSION_REPLAY_URL_TRIGGER: 'session-replay-url-trigger', // owner: @richard-better #team-replay
     REPLAY_TEMPLATES: 'replay-templates', // owner: @raquelmsmith #team-replay
+    ROLE_BASED_ACCESS_CONTROL: 'role-based-access-control', // owner: @zach
     EXPERIMENTS_HOLDOUTS: 'experiments-holdouts', // owner: @jurajmajerik #team-experiments
     MESSAGING: 'messaging', // owner @mariusandra #team-cdp
     SESSION_REPLAY_URL_BLOCKLIST: 'session-replay-url-blocklist', // owner: @richard-better #team-replay

frontend/src/scenes/data-warehouse/new/sourceWizardLogic.tsx

@@ -6,6 +6,7 @@ import api from 'lib/api'
 import posthog from 'posthog-js'
 import { preflightLogic } from 'scenes/PreflightCheck/preflightLogic'
 import { Scene } from 'scenes/sceneTypes'
+import { teamLogic } from 'scenes/teamLogic'
 import { urls } from 'scenes/urls'
 
 import {
@@ -16,6 +17,7 @@ import {
     manualLinkSources,
     ManualLinkSourceType,
     PipelineTab,
+    ProductKey,
     SourceConfig,
     SourceFieldConfig,
 } from '~/types'
@@ -731,6 +733,8 @@ export const sourceWizardLogic = kea<sourceWizardLogicType>([
             ['resetTable', 'createTableSuccess'],
             dataWarehouseSettingsLogic,
             ['loadSources'],
+            teamLogic,
+            ['addProductIntent'],
         ],
     }),
     reducers({
@@ -1129,6 +1133,9 @@ export const sourceWizardLogic = kea<sourceWizardLogicType>([
         setManualLinkingProvider: () => {
             actions.onNext()
         },
+        selectConnector: () => {
+            actions.addProductIntent({ product_type: ProductKey.DATA_WAREHOUSE, intent_context: 'selected connector' })
+        },
     })),
     urlToAction(({ actions }) => ({
         '/data-warehouse/:kind/redirect': ({ kind = '' }, searchParams) => {

frontend/src/scenes/pipeline/hogfunctions/filters/HogFunctionFilters.tsx

@@ -161,6 +161,10 @@ export function HogFunctionFilters(): JSX.Element {
                                     value: '{person.id}',
                                     label: 'Run once per person per interval',
                                 },
+                                {
+                                    value: '{concat(person.id, event.event)}',
+                                    label: 'Run once per person per event per interval',
+                                },
                             ]}
                             value={value?.hash ?? null}
                             onChange={(val) =>

frontend/src/scenes/settings/user/personalAPIKeysLogic.tsx

@@ -9,7 +9,7 @@ import { lemonToast } from 'lib/lemon-ui/LemonToast/LemonToast'
 import { urls } from 'scenes/urls'
 import { userLogic } from 'scenes/userLogic'
 
-import { OrganizationBasicType, PersonalAPIKeyType, TeamBasicType } from '~/types'
+import { APIScopeObject, OrganizationBasicType, PersonalAPIKeyType, TeamBasicType } from '~/types'
 
 import type { personalAPIKeysLogicType } from './personalAPIKeysLogicType'
 
@@ -32,7 +32,7 @@ export const API_KEY_SCOPE_PRESETS = [
 ]
 
 export type APIScope = {
-    key: string
+    key: APIScopeObject
     info?: string | JSX.Element
     disabledActions?: ('read' | 'write')[]
     disabledWhenProjectScoped?: boolean

frontend/src/scenes/teamActivityDescriber.tsx

@@ -347,6 +347,7 @@ const teamActionsMapping: Record<
     updated_at: () => null,
     uuid: () => null,
     live_events_token: () => null,
+    product_intents: () => null,
 }
 
 function nameAndLink(logItem?: ActivityLogItem): JSX.Element {

frontend/src/scenes/teamLogic.tsx

@@ -145,13 +145,14 @@ export const teamLogic = kea<teamLogicType>([
                 resetToken: async () => await api.update(`api/environments/${values.currentTeamId}/reset_token`, {}),
                 addProductIntent: async ({
                     product_type,
+                    intent_context,
                 }: {
                     product_type: ProductKey
                     intent_context?: string | null
                 }) =>
                     await api.update(`api/environments/${values.currentTeamId}/add_product_intent`, {
                         product_type,
-                        intent_context: null,
+                        intent_context: intent_context ?? undefined,
                     }),
                 recordProductIntentOnboardingComplete: async ({ product_type }: { product_type: ProductKey }) =>
                     await api.update(`api/environments/${values.currentTeamId}/complete_product_onboarding`, {

frontend/src/types.ts

@@ -545,6 +545,13 @@ export interface TeamType extends TeamBasicType {
     extra_settings?: Record<string, string | number | boolean | undefined>
     modifiers?: HogQLQueryModifiers
     default_modifiers?: HogQLQueryModifiers
+    product_intents?: ProductIntentType[]
+}
+
+export interface ProductIntentType {
+    product_type: string
+    created_at: string
+    onboarding_completed_at?: string
 }
 
 // This type would be more correct without `Partial<TeamType>`, but it's only used in the shared dashboard/insight
@@ -3814,6 +3821,37 @@ export interface RoleMemberType {
     user_uuid: string
 }
 
+export type APIScopeObject =
+    | 'action'
+    | 'activity_log'
+    | 'annotation'
+    | 'batch_export'
+    | 'cohort'
+    | 'dashboard'
+    | 'dashboard_template'
+    | 'early_access_feature'
+    | 'event_definition'
+    | 'experiment'
+    | 'export'
+    | 'feature_flag'
+    | 'group'
+    | 'insight'
+    | 'query'
+    | 'notebook'
+    | 'organization'
+    | 'organization_member'
+    | 'person'
+    | 'plugin'
+    | 'project'
+    | 'property_definition'
+    | 'session_recording'
+    | 'session_recording_playlist'
+    | 'sharing_configuration'
+    | 'subscription'
+    | 'survey'
+    | 'user'
+    | 'webhook'
+
 export interface OrganizationResourcePermissionType {
     id: string
     resource: Resource