feat: add has_rbac feature flag

Author: kaposke

packages/database/lib/migrations/20260413155700_plans_add_has_rbac.cjs

@@ -0,0 +1,25 @@
+exports.config = { transaction: false };
+
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.up = async function (knex) {
+    await knex.raw(`ALTER TABLE "plans" ADD COLUMN IF NOT EXISTS "has_rbac" bool NOT NULL DEFAULT 'false'`);
+    // Backfill growth+ plans, while grandfathering accounts that already use RBAC.
+    await knex.raw(`
+        UPDATE "plans" AS p
+        SET "has_rbac" = true
+        WHERE p."name" IN ('growth', 'growth-v2', 'enterprise')
+            OR EXISTS (
+                SELECT 1
+                FROM "_nango_users" AS u
+                WHERE u."account_id" = p."account_id"
+                    AND u."role" <> 'administrator'
+            )
+    `);
+};
+
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.down = async function () {};

packages/shared/lib/seeders/plan.seeder.ts

@@ -33,6 +33,7 @@ export function getTestPlan(override?: Partial<DBPlan>): DBPlan {
         auto_idle: true,
         has_webhooks_script: false,
         has_webhooks_forward: false,
+        has_rbac: false,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: false,
         can_disable_connect_ui_watermark: false,

packages/shared/lib/services/plans/definitions.ts

@@ -25,6 +25,7 @@ export const freePlan: PlanDefinition = {
         monthly_active_records_max: 5000,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: false,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: false,
         can_disable_connect_ui_watermark: false,
@@ -66,6 +67,7 @@ export const starterV1Plan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: false,
         has_webhooks_forward: false,
+        has_rbac: false,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: false,
         can_disable_connect_ui_watermark: false
@@ -104,6 +106,7 @@ export const growthV1Plan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: true,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: true,
         can_disable_connect_ui_watermark: true
@@ -169,6 +172,7 @@ export const enterprisePlan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: true,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: true,
         can_disable_connect_ui_watermark: true
@@ -207,6 +211,7 @@ export const starterLegacyPlan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: false,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: false,
         can_disable_connect_ui_watermark: false
@@ -244,6 +249,7 @@ export const scaleLegacyPlan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: true,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: false,
         can_disable_connect_ui_watermark: false
@@ -281,6 +287,7 @@ export const growthLegacyPlan: PlanDefinition = {
         trial_expired: null,
         has_webhooks_script: true,
         has_webhooks_forward: true,
+        has_rbac: true,
         can_override_docs_connect_url: false,
         can_customize_connect_ui_theme: true,
         can_disable_connect_ui_watermark: true

packages/shared/lib/services/plans/plans.ts

@@ -226,6 +226,7 @@ export function mergeFlags({ currentPlan, newPlanDefinition }: { currentPlan: DB
             case 'has_otel':
             case 'has_webhooks_script':
             case 'has_webhooks_forward':
+            case 'has_rbac':
             case 'can_disable_connect_ui_watermark':
             case 'can_override_docs_connect_url':
             case 'can_customize_connect_ui_theme': {

packages/shared/lib/services/plans/plans.unit.test.ts

@@ -103,6 +103,7 @@ function makePlan({ code, flagOverrides }: { code: DBPlan['name']; flagOverrides
         has_otel: false,
         has_webhooks_forward: false,
         has_webhooks_script: false,
+        has_rbac: false,
         can_customize_connect_ui_theme: false,
         can_override_docs_connect_url: false,
         can_disable_connect_ui_watermark: false,

packages/types/lib/plans/db.ts

@@ -126,6 +126,13 @@ export interface DBPlan extends Timestamps {
      */
     has_webhooks_forward: boolean;
 
+    /**
+     * Enable role-based access control (non-administrator roles)
+     * When false, all users/invites must be 'administrator'
+     * @default false
+     */
+    has_rbac: boolean;
+
     /**
      * Enable or disable the ability to override the docs connect url from the connect session
      * @default false