merge

ee/api/feature_flag_role_access.py

@@ -1,10 +1,10 @@
 from rest_framework import exceptions, mixins, serializers, viewsets
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
-from ee.api.role import RoleSerializer
+from ee.api.rbac.role import RoleSerializer
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.api.feature_flag import FeatureFlagSerializer
 from posthog.api.routing import TeamAndOrgViewSetMixin
 from posthog.models import FeatureFlag

ee/api/organization_resource_access.py → ee/api/rbac/organization_resource_access.py

@@ -1,7 +1,7 @@
 from rest_framework import mixins, serializers, viewsets
 
-from ee.api.role import RolePermissions
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.api.rbac.role import RolePermissions
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.api.routing import TeamAndOrgViewSetMixin
 
 

ee/api/role.py → ee/api/rbac/role.py

@@ -5,8 +5,8 @@
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.api.organization_member import OrganizationMemberSerializer
 from posthog.api.routing import TeamAndOrgViewSetMixin
 from posthog.api.shared import UserBasicSerializer

ee/api/test/test_feature_flag.py

@@ -1,6 +1,6 @@
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.models.feature_flag import FeatureFlag
 from posthog.models.organization import OrganizationMembership
 

ee/api/test/test_feature_flag_role_access.py

@@ -2,8 +2,8 @@
 
 from ee.api.test.base import APILicensedTest
 from ee.models.feature_flag_role_access import FeatureFlagRoleAccess
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.models.feature_flag import FeatureFlag
 from posthog.models.organization import OrganizationMembership
 from posthog.models.user import User

ee/api/test/test_organization_resource_access.py

@@ -2,7 +2,7 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.models.organization import Organization, OrganizationMembership
 from posthog.test.base import QueryMatchingTest, snapshot_postgres_queries, FuzzyInt
 

ee/api/test/test_role.py

@@ -2,8 +2,8 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.organization_resource_access import OrganizationResourceAccess
-from ee.models.role import Role
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.role import Role
 from posthog.models.organization import Organization, OrganizationMembership
 
 

ee/api/test/test_role_membership.py

@@ -1,7 +1,7 @@
 from rest_framework import status
 
 from ee.api.test.base import APILicensedTest
-from ee.models.role import Role, RoleMembership
+from ee.models.rbac.role import Role, RoleMembership
 from posthog.models.organization import Organization, OrganizationMembership
 from posthog.models.user import User
 

ee/clickhouse/views/experiments.py

@@ -191,6 +191,7 @@ class Meta:
             "created_by",
             "created_at",
             "updated_at",
+            "metrics",
         ]
         read_only_fields = [
             "id",

ee/models/__init__.py

@@ -5,7 +5,7 @@
 from .hook import Hook
 from .license import License
 from .property_definition import EnterprisePropertyDefinition
-from .role import Role, RoleMembership
+from .rbac.role import Role, RoleMembership
 
 __all__ = [
     "EnterpriseEventDefinition",

ee/models/organization_resource_access.py → ee/models/rbac/organization_resource_access.py

@@ -2,6 +2,8 @@
 
 from posthog.models.organization import Organization
 
+# NOTE: This will be deprecated in favour of the AccessControl model
+
 
 class OrganizationResourceAccess(models.Model):
     class AccessLevel(models.IntegerChoices):

ee/models/role.py → ee/models/rbac/role.py

@@ -1,6 +1,6 @@
 from django.db import models
 
-from ee.models.organization_resource_access import OrganizationResourceAccess
+from ee.models.rbac.organization_resource_access import OrganizationResourceAccess
 from posthog.models.utils import UUIDModel
 
 

ee/urls.py

@@ -6,6 +6,7 @@
 from django.urls.conf import path
 
 from ee.api import integration
+from .api.rbac import organization_resource_access, role
 
 from .api import (
     authentication,
@@ -15,8 +16,6 @@
     feature_flag_role_access,
     hooks,
     license,
-    organization_resource_access,
-    role,
     sentry_stats,
     subscription,
 )
@@ -49,6 +48,7 @@ def extend_api_router() -> None:
         "organization_role_memberships",
         ["organization_id", "role_id"],
     )
+    # Start: routes to be deprecated
     project_feature_flags_router.register(
         r"role_access",
         feature_flag_role_access.FeatureFlagRoleAccessViewSet,
@@ -61,6 +61,7 @@ def extend_api_router() -> None:
         "organization_resource_access",
         ["organization_id"],
     )
+    # End: routes to be deprecated
     register_grandfathered_environment_nested_viewset(r"hooks", hooks.HookViewSet, "environment_hooks", ["team_id"])
     register_grandfathered_environment_nested_viewset(
         r"explicit_members",

frontend/src/lib/constants.tsx

@@ -220,6 +220,8 @@ export const FEATURE_FLAGS = {
     LEGACY_ACTION_WEBHOOKS: 'legacy-action-webhooks', // owner: @mariusandra #team-cdp
     SESSION_REPLAY_URL_TRIGGER: 'session-replay-url-trigger', // owner: @richard-better #team-replay
     REPLAY_TEMPLATES: 'replay-templates', // owner: @raquelmsmith #team-replay
+    EXPERIMENTS_HOGQL: 'experiments-hogql', // owner: @jurajmajerik #team-experiments
+    ROLE_BASED_ACCESS_CONTROL: 'role-based-access-control', // owner: @zach
     EXPERIMENTS_HOLDOUTS: 'experiments-holdouts', // owner: @jurajmajerik #team-experiments
     MESSAGING: 'messaging', // owner @mariusandra #team-cdp
     SESSION_REPLAY_URL_BLOCKLIST: 'session-replay-url-blocklist', // owner: @richard-better #team-replay

frontend/src/loadPostHogJS.tsx

@@ -29,16 +29,38 @@ export function loadPostHogJS(): void {
                 bootstrap: window.POSTHOG_USER_IDENTITY_WITH_FLAGS ? window.POSTHOG_USER_IDENTITY_WITH_FLAGS : {},
                 opt_in_site_apps: true,
                 api_transport: 'fetch',
-                loaded: (posthog) => {
-                    if (posthog.sessionRecording) {
-                        posthog.sessionRecording._forceAllowLocalhostNetworkCapture = true
+                loaded: (loadedInstance) => {
+                    if (loadedInstance.sessionRecording) {
+                        loadedInstance.sessionRecording._forceAllowLocalhostNetworkCapture = true
                     }
 
                     if (window.IMPERSONATED_SESSION) {
-                        posthog.opt_out_capturing()
+                        loadedInstance.sessionManager?.resetSessionId()
+                        loadedInstance.opt_out_capturing()
                     } else {
-                        posthog.opt_in_capturing()
+                        loadedInstance.opt_in_capturing()
                     }
+
+                    const Cypress = (window as any).Cypress
+
+                    if (Cypress) {
+                        Object.entries(Cypress.env()).forEach(([key, value]) => {
+                            if (key.startsWith('POSTHOG_PROPERTY_')) {
+                                loadedInstance.register_for_session({
+                                    [key.replace('POSTHOG_PROPERTY_', 'E2E_TESTING_').toLowerCase()]: value,
+                                })
+                            }
+                        })
+                    }
+
+                    // This is a helpful flag to set to automatically reset the recording session on load for testing multiple recordings
+                    const shouldResetSessionOnLoad = loadedInstance.getFeatureFlag(FEATURE_FLAGS.SESSION_RESET_ON_LOAD)
+                    if (shouldResetSessionOnLoad) {
+                        loadedInstance.sessionManager?.resetSessionId()
+                    }
+
+                    // Make sure we have access to the object in window for debugging
+                    window.posthog = loadedInstance
                 },
                 scroll_root_selector: ['main', 'html'],
                 autocapture: {
@@ -52,26 +74,6 @@ export function loadPostHogJS(): void {
                     : undefined,
             })
         )
-
-        const Cypress = (window as any).Cypress
-
-        if (Cypress) {
-            Object.entries(Cypress.env()).forEach(([key, value]) => {
-                if (key.startsWith('POSTHOG_PROPERTY_')) {
-                    posthog.register_for_session({
-                        [key.replace('POSTHOG_PROPERTY_', 'E2E_TESTING_').toLowerCase()]: value,
-                    })
-                }
-            })
-        }
-
-        // This is a helpful flag to set to automatically reset the recording session on load for testing multiple recordings
-        const shouldResetSessionOnLoad = posthog.getFeatureFlag(FEATURE_FLAGS.SESSION_RESET_ON_LOAD)
-        if (shouldResetSessionOnLoad) {
-            posthog.sessionManager?.resetSessionId()
-        }
-        // Make sure we have access to the object in window for debugging
-        window.posthog = posthog
     } else {
         posthog.init('fake token', {
             autocapture: false,