Unified role-based access control (RBAC)

[annikaschmid]

This issue is linked on our public roadmap, users can leave feedback and feature requests in the comments.

We currently have some features that allow users to set who can view and edit certain parts of PostHog, but such features don't exist for every product.

We are considering overhauling our RBAC functionality, bringing it to every PostHog product, and unify the functionality across each product.

If you like this idea, please leave a 👍 or ❤️ reaction on this post to vote for it -- your votes and feedback help us prioritize what to work on next!

And if you have any feedback, please leave a comment. Thanks!

Work in progress: #20864
RFC (internal link): https://github.com/PostHog/product-internal/pull/577

RFC (internal link): https://github.com/PostHog/product-internal/pull/666

Steps:

• first PR renaming and moving files: feat: rbac initial set up #25745
• add models: feat: add access control model #26076
• add middleware and mixins: feat: rbac middleware #26159 / feat: rbac middleware #26347
• misc types prepping: chore: type updates for rbac #26647
• add initial UI and logic behind a feature flag: feat: rbac client side code #26694
• improve access control UI: feat: better access control object ui #27175
• access denied UI: feat: add access denied UI #27335
• misc access level checks and fixed: chore: fixes to objects/queryset perm checks + type updates #27330
• update organization role abilities to be more restrictive: feat: update organization member abilities #27232
• client side UI for no access and no edit access for resources: feat: client side access control (WIP) #27174
• client side UI for no access and no edit access for projects, teams, environments
• default access levels for projects and resources

Fixes:

• Revert due to a few issues: revert: rbac middleware (#26159) #26343
• Personal API changes related to RBAC issue: chore: add a check for current team in personal api key auth #26390, revert: add check for current team in personal api key (#26390) #26438, feat: personal api key api access for @current #26519
• Improvements to having no org/project: fix: check for the organization id #26515