From de9122d4567da9395f20f5f1a476cf6ff2dda119 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 11:42:16 +0100
Subject: [PATCH 01/55] include organization owner id in Organization type

---
 packages/services/api/src/shared/entities.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/services/api/src/shared/entities.ts b/packages/services/api/src/shared/entities.ts
index f61f85abda..b10488ad88 100644
--- a/packages/services/api/src/shared/entities.ts
+++ b/packages/services/api/src/shared/entities.ts
@@ -192,6 +192,7 @@ export interface Organization {
     appDeployments: boolean;
   };
   zendeskId: string | null;
+  /** ID of the user that owns the organization */
   ownerId: string;
 }
 

From 905d21a2750bf8c96a502deccdf5f73192339788 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 11:44:47 +0100
Subject: [PATCH 02/55] feat: database migration

---
 packages/migrations/src/run-pg-migrations.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/migrations/src/run-pg-migrations.ts b/packages/migrations/src/run-pg-migrations.ts
index bcb8af6edb..7d1303047b 100644
--- a/packages/migrations/src/run-pg-migrations.ts
+++ b/packages/migrations/src/run-pg-migrations.ts
@@ -155,5 +155,6 @@ export const runPGMigrations = async (args: { slonik: DatabasePool; runTo?: stri
       await import('./actions/2025.01.09T00-00-00.legacy-member-scopes'),
       await import('./actions/2025.01.10T00.00.00.breaking-changes-request-count'),
       await import('./actions/2025.01.13T10-08-00.default-role'),
+      await import('./actions/2025.01.30T00-00-00.granular-member-role-permissions'),
     ],
   });

From 022a52776f5a62899ad6026e7f9ee2efb5affa70 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 13:30:44 +0100
Subject: [PATCH 03/55] transform legacy permissions to new format

---
 .../api/src/modules/auth/lib/authz.ts         | 165 +++++--
 .../modules/auth/lib/supertokens-strategy.ts  | 307 ++++++-------
 .../auth/providers/organization-members.ts    | 421 ++++++++++++++++++
 packages/services/server/src/index.ts         |   2 +
 4 files changed, 700 insertions(+), 195 deletions(-)
 create mode 100644 packages/services/api/src/modules/auth/providers/organization-members.ts

diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index cf762bbb23..c109a6c816 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -1,4 +1,5 @@
 import stringify from 'fast-json-stable-stringify';
+import { z } from 'zod';
 import { FastifyReply, FastifyRequest } from '@hive/service-common';
 import type { User } from '../../../shared/entities';
 import { AccessError } from '../../../shared/errors';
@@ -273,7 +274,7 @@ function isResourceIdMatch(
   return true;
 }
 
-function defaultOrgIdentity(args: { organizationId: string }) {
+export function defaultOrgIdentity(args: { organizationId: string }) {
   return [`organization/${args.organizationId}`];
 }
 
@@ -313,55 +314,135 @@ function schemaCheckOrPublishIdentity(
   return ids;
 }
 
+/** Typed Object.fromEntries */
+function objectFromEntries<$Key extends string, $Value>(
+  entries: Array<[$Key, $Value]>,
+): Record<$Key, $Value> {
+  return Object.fromEntries(entries) as Record<$Key, $Value>;
+}
+
+function objectEntries<$Key extends string, $Value>(
+  object: Record<$Key, $Value>,
+): Array<[$Key, $Value]> {
+  return Object.entries(object) as Array<[$Key, $Value]>;
+}
+
 /**
  * Object map containing all possible actions
- * and resource identifier builder functions required for checking whether an action can be performed.
  *
  * Used within the `Session.assertPerformAction` function for a fully type-safe experience.
  * If you are adding new permissions to the existing system.
  * This is the place to do so.
  */
+const permissionGroups = {
+  organization: [
+    z.literal('organization:describe'),
+    z.literal('organization:modifySlug'),
+    z.literal('organization:delete'),
+    z.literal('gitHubIntegration:modify'),
+    z.literal('slackIntegration:modify'),
+    z.literal('oidc:modify'),
+    z.literal('support:manageTickets'),
+    z.literal('billing:describe'),
+    z.literal('billing:update'),
+    z.literal('member:describe'),
+    z.literal('member:assignRole'),
+    z.literal('member:modifyRole'),
+    z.literal('member:removeMember'),
+    z.literal('member:manageInvites'),
+    z.literal('project:create'),
+    z.literal('schemaLinting:modifyOrganizationRules'),
+    z.literal('auditLog:export'),
+  ],
+  project: [
+    z.literal('project:describe'),
+    z.literal('project:delete'),
+    z.literal('project:modifySettings'),
+    z.literal('alert:modify'),
+    z.literal('schemaLinting:modifyProjectRules'),
+    z.literal('target:create'),
+  ],
+  target: [
+    z.literal('targetAccessToken:modify'),
+    z.literal('cdnAccessToken:modify'),
+    z.literal('target:delete'),
+    z.literal('target:modifySettings'),
+    z.literal('laboratory:describe'),
+    z.literal('laboratory:modify'),
+    z.literal('laboratory:modifyPreflightScript'),
+    z.literal('appDeployment:describe'),
+    z.literal('schema:loadFromRegistry'),
+    z.literal('schema:compose'),
+  ],
+  service: [
+    z.literal('schemaCheck:create'),
+    z.literal('schemaCheck:approve'),
+    z.literal('schemaVersion:publish'),
+    z.literal('schemaVersion:deleteService'),
+  ],
+  appDeployment: [
+    z.literal('appDeployment:create'),
+    z.literal('appDeployment:publish'),
+    z.literal('appDeployment:retire'),
+  ],
+} as const;
+
+export const PermissionGroupsModel = z.object({
+  organization: z.set(z.union(permissionGroups.organization)),
+  project: z.set(z.union(permissionGroups.project)),
+  target: z.set(z.union(permissionGroups.target)),
+  service: z.set(z.union(permissionGroups.service)),
+  appDeployment: z.set(z.union(permissionGroups.appDeployment)),
+});
+
+export type PermissionGroups = z.TypeOf<typeof PermissionGroupsModel>;
+
+export const AllPermissionsModel = z.union([
+  ...permissionGroups.organization,
+  ...permissionGroups.project,
+  ...permissionGroups.target,
+  ...permissionGroups.service,
+  ...permissionGroups.appDeployment,
+]);
+
+const lookupMap = new Map<
+  z.TypeOf<typeof AllPermissionsModel>,
+  'organization' | 'project' | 'target' | 'service' | 'appDeployment'
+>();
+
+for (const [key, permissions] of objectEntries(permissionGroups)) {
+  for (const permission of permissions) {
+    lookupMap.set(permission.value, key);
+  }
+}
+
+/** Get the permission group for a specific permissions */
+export function getPermissionGroup(
+  permission: z.TypeOf<typeof AllPermissionsModel>,
+): 'organization' | 'project' | 'target' | 'service' | 'appDeployment' {
+  const group = lookupMap.get(permission);
+
+  if (group === undefined) {
+    throw new Error(`Could not find group for permission '${permission}'.`);
+  }
+
+  return group;
+}
+
 const actionDefinitions = {
-  'organization:describe': defaultOrgIdentity,
-  'organization:modifySlug': defaultOrgIdentity,
-  'organization:delete': defaultOrgIdentity,
-  'gitHubIntegration:modify': defaultOrgIdentity,
-  'slackIntegration:modify': defaultOrgIdentity,
-  'oidc:modify': defaultOrgIdentity,
-  'support:manageTickets': defaultOrgIdentity,
-  'billing:describe': defaultOrgIdentity,
-  'billing:update': defaultOrgIdentity,
-  'targetAccessToken:modify': defaultTargetIdentity,
-  'cdnAccessToken:modify': defaultTargetIdentity,
-  'member:describe': defaultOrgIdentity,
-  'member:assignRole': defaultOrgIdentity,
-  'member:modifyRole': defaultOrgIdentity,
-  'member:removeMember': defaultOrgIdentity,
-  'member:manageInvites': defaultOrgIdentity,
-  'project:create': defaultOrgIdentity,
-  'project:describe': defaultProjectIdentity,
-  'project:delete': defaultProjectIdentity,
-  'project:modifySettings': defaultProjectIdentity,
-  'alert:modify': defaultProjectIdentity,
-  'schemaLinting:modifyOrganizationRules': defaultOrgIdentity,
-  'schemaLinting:modifyProjectRules': defaultProjectIdentity,
-  'target:create': defaultProjectIdentity,
-  'target:delete': defaultTargetIdentity,
-  'target:modifySettings': defaultTargetIdentity,
-  'laboratory:describe': defaultTargetIdentity,
-  'laboratory:modify': defaultTargetIdentity,
-  'laboratory:modifyPreflightScript': defaultTargetIdentity,
-  'appDeployment:describe': defaultTargetIdentity,
-  'appDeployment:create': defaultAppDeploymentIdentity,
-  'appDeployment:publish': defaultAppDeploymentIdentity,
-  'appDeployment:retire': defaultAppDeploymentIdentity,
-  'schemaCheck:create': schemaCheckOrPublishIdentity,
-  'schemaCheck:approve': schemaCheckOrPublishIdentity,
-  'schemaVersion:publish': schemaCheckOrPublishIdentity,
-  'schemaVersion:deleteService': schemaCheckOrPublishIdentity,
-  'schema:loadFromRegistry': defaultTargetIdentity,
-  'schema:compose': defaultTargetIdentity,
-  'auditLog:export': defaultOrgIdentity,
+  ...objectFromEntries(permissionGroups['organization'].map(t => [t.value, defaultOrgIdentity])),
+  ...objectFromEntries(
+    permissionGroups['project'].map(t => [t.value, defaultProjectIdentity] as const),
+  ),
+  ...objectFromEntries(
+    permissionGroups['target'].map(t => [t.value, defaultTargetIdentity] as const),
+  ),
+  ...objectFromEntries(
+    permissionGroups['service'].map(t => [t.value, schemaCheckOrPublishIdentity] as const),
+  ),
+  ...objectFromEntries(
+    permissionGroups['appDeployment'].map(t => [t.value, defaultAppDeploymentIdentity] as const),
+  ),
 } satisfies ActionDefinitionMap;
 
 type ActionDefinitionMap = {
diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index 19d6cd1ed2..1a75bdc345 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -8,22 +8,23 @@ import { isUUID } from '../../../shared/is-uuid';
 import { Logger } from '../../shared/providers/logger';
 import type { Storage } from '../../shared/providers/storage';
 import {
-  OrganizationAccessScope,
-  ProjectAccessScope,
-  TargetAccessScope,
-} from '../providers/scopes';
+  OrganizationMembers,
+  OrganizationMembershipRoleAssignment,
+} from '../providers/organization-members';
 import { AuthNStrategy, AuthorizationPolicyStatement, Session } from './authz';
 
 export class SuperTokensCookieBasedSession extends Session {
   public superTokensUserId: string;
+  private organizationMembers: OrganizationMembers;
   private storage: Storage;
 
   constructor(
     args: { superTokensUserId: string; email: string },
-    deps: { storage: Storage; logger: Logger },
+    deps: { organizationMembers: OrganizationMembers; storage: Storage; logger: Logger },
   ) {
     super({ logger: deps.logger });
     this.superTokensUserId = args.superTokensUserId;
+    this.organizationMembers = deps.organizationMembers;
     this.storage = deps.storage;
   }
 
@@ -32,17 +33,51 @@ export class SuperTokensCookieBasedSession extends Session {
   ): Promise<Array<AuthorizationPolicyStatement>> {
     const user = await this.getViewer();
 
+    this.logger.debug(
+      'Loading policy statements for organization. (userId=%s, organizationId=%s)',
+      user.id,
+      organizationId,
+    );
+
     if (!isUUID(organizationId)) {
+      this.logger.debug(
+        'Invalid organization ID provided. (userId=%s, organizationId=%s)',
+        user.id,
+        organizationId,
+      );
+
       return [];
     }
 
-    const member = await this.storage.getOrganizationMember({
+    this.logger.debug(
+      'Load organization membership for user. (userId=%s, organizationId=%s)',
+      user.id,
       organizationId,
+    );
+    const organization = await this.storage.getOrganization({ organizationId });
+    const organizationMembership = await this.organizationMembers.findOrganizationMembership({
+      organization,
       userId: user.id,
     });
 
+    if (!organizationMembership) {
+      this.logger.debug(
+        'No membership found, resolve empty policy statements. (userId=%s, organizationId=%s)',
+        user.id,
+        organizationId,
+      );
+
+      return [];
+    }
+
     // owner of organization should have full right to do anything.
-    if (member?.isOwner) {
+    if (organizationMembership?.isAdmin) {
+      this.logger.debug(
+        'User is organization owner, resolve admin access policy. (userId=%s, organizationId=%s)',
+        user.id,
+        organizationId,
+      );
+
       return [
         {
           action: '*',
@@ -52,11 +87,18 @@ export class SuperTokensCookieBasedSession extends Session {
       ];
     }
 
-    if (Array.isArray(member?.scopes)) {
-      return transformOrganizationMemberLegacyScopes({ organizationId, scopes: member.scopes });
-    }
+    this.logger.debug(
+      'Translate organization role assignments to policy statements. (userId=%s, organizationId=%s)',
+      user.id,
+      organizationId,
+    );
 
-    return [];
+    const policyStatements = this.translateAssignedRolesToAuthorizationPolicyStatements(
+      organizationId,
+      organizationMembership.assignedRoles,
+    );
+
+    return policyStatements;
   }
 
   public async getViewer(): Promise<User> {
@@ -74,15 +116,114 @@ export class SuperTokensCookieBasedSession extends Session {
   public isViewer() {
     return true;
   }
+
+  private translateAssignedRolesToAuthorizationPolicyStatements(
+    organizationId: string,
+    organizationMembershipRoleAssignments: Array<OrganizationMembershipRoleAssignment>,
+  ): Array<AuthorizationPolicyStatement> {
+    const policyStatements: Array<AuthorizationPolicyStatement> = [];
+
+    const orgResourceId = `hrn:${organizationId}:organization/${organizationId}`;
+
+    for (const assignedRole of organizationMembershipRoleAssignments) {
+      /**
+       * Currently, we have the following hierarchy
+       *
+       *        organization
+       *             v
+       *           project
+       *             v
+       *           target
+       *          v      v
+       * app deployment  service
+       *
+       * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
+       */
+
+      let parentResource: Array<string> = [orgResourceId];
+
+      if (assignedRole.role.permissions.organization.size) {
+        policyStatements.push({
+          action: Array.from(assignedRole.role.permissions.organization),
+          effect: 'allow',
+          resource: parentResource,
+        });
+      }
+
+      if (assignedRole.role.permissions.project.size) {
+        if (Array.isArray(assignedRole.resources.project)) {
+          parentResource = assignedRole.resources.project.map(
+            uuid => `hrn:${organizationId}:project/${uuid}`,
+          );
+        }
+
+        policyStatements.push({
+          action: Array.from(assignedRole.role.permissions.project),
+          effect: 'allow',
+          resource: parentResource,
+        });
+      }
+
+      if (assignedRole.role.permissions.target.size) {
+        if (Array.isArray(assignedRole.resources.target)) {
+          parentResource = assignedRole.resources.target.map(
+            uuid => `hrn:${organizationId}:target/${uuid}`,
+          );
+        }
+
+        policyStatements.push({
+          action: Array.from(assignedRole.role.permissions.target),
+          effect: 'allow',
+          resource: parentResource,
+        });
+      }
+
+      if (assignedRole.role.permissions.service.size) {
+        policyStatements.push({
+          action: Array.from(assignedRole.role.permissions.service),
+          effect: 'allow',
+          resource:
+            assignedRole.resources.service === '*'
+              ? parentResource
+              : assignedRole.resources.service.map(
+                  ([targetId, serviceName]) =>
+                    `hrn:${organizationId}:target/${targetId}/service/${serviceName}`,
+                ),
+        });
+      }
+
+      if (assignedRole.role.permissions.appDeployment.size) {
+        policyStatements.push({
+          action: Array.from(assignedRole.role.permissions.appDeployment),
+          effect: 'allow',
+          resource:
+            assignedRole.resources.appDeployment === '*'
+              ? parentResource
+              : assignedRole.resources.appDeployment.map(
+                  ([targetId, serviceName]) =>
+                    `hrn:${organizationId}:target/${targetId}/appDeployment/${serviceName}`,
+                ),
+        });
+      }
+    }
+
+    return policyStatements;
+  }
 }
 
 export class SuperTokensUserAuthNStrategy extends AuthNStrategy<SuperTokensCookieBasedSession> {
   private logger: ServiceLogger;
+  private organizationMembers: OrganizationMembers;
   private storage: Storage;
 
-  constructor(deps: { logger: ServiceLogger; storage: Storage }) {
+  constructor(deps: {
+    logger: ServiceLogger;
+    storage: Storage;
+    organizationMembers: OrganizationMembers;
+  }) {
     super();
     this.logger = deps.logger.child({ module: 'SuperTokensUserAuthNStrategy' });
+    this.organizationMembers = deps.organizationMembers;
     this.storage = deps.storage;
   }
 
@@ -173,6 +314,7 @@ export class SuperTokensUserAuthNStrategy extends AuthNStrategy<SuperTokensCooki
       },
       {
         storage: this.storage,
+        organizationMembers: this.organizationMembers,
         logger: args.req.log,
       },
     );
@@ -184,144 +326,3 @@ const SuperTokenAccessTokenModel = zod.object({
   superTokensUserId: zod.string(),
   email: zod.string(),
 });
-
-function transformOrganizationMemberLegacyScopes(args: {
-  organizationId: string;
-  scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>;
-}) {
-  const policies: Array<AuthorizationPolicyStatement> = [];
-  for (const scope of args.scopes) {
-    switch (scope) {
-      case OrganizationAccessScope.READ: {
-        policies.push({
-          effect: 'allow',
-          action: [
-            'support:manageTickets',
-            'project:create',
-            'project:describe',
-            'organization:describe',
-          ],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case OrganizationAccessScope.SETTINGS: {
-        policies.push({
-          effect: 'allow',
-          action: [
-            'organization:modifySlug',
-            'schemaLinting:modifyOrganizationRules',
-            'billing:describe',
-            'billing:update',
-          ],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case OrganizationAccessScope.DELETE: {
-        policies.push({
-          effect: 'allow',
-          action: ['organization:delete'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case OrganizationAccessScope.INTEGRATIONS: {
-        policies.push({
-          effect: 'allow',
-          action: ['oidc:modify', 'gitHubIntegration:modify', 'slackIntegration:modify'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case OrganizationAccessScope.MEMBERS: {
-        policies.push({
-          effect: 'allow',
-          action: [
-            'member:manageInvites',
-            'member:removeMember',
-            'member:assignRole',
-            'member:modifyRole',
-            'member:describe',
-          ],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case ProjectAccessScope.ALERTS: {
-        policies.push({
-          effect: 'allow',
-          action: ['alert:modify'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case ProjectAccessScope.READ: {
-        policies.push({
-          effect: 'allow',
-          action: ['project:describe'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case ProjectAccessScope.DELETE: {
-        policies.push({
-          effect: 'allow',
-          action: ['project:delete'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case ProjectAccessScope.SETTINGS: {
-        policies.push({
-          effect: 'allow',
-          action: ['project:delete', 'project:modifySettings', 'schemaLinting:modifyProjectRules'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case TargetAccessScope.READ: {
-        policies.push({
-          effect: 'allow',
-          action: ['appDeployment:describe', 'laboratory:describe', 'target:create'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case TargetAccessScope.REGISTRY_WRITE: {
-        policies.push({
-          effect: 'allow',
-          action: ['schemaCheck:approve', 'laboratory:modify'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case TargetAccessScope.TOKENS_WRITE: {
-        policies.push({
-          effect: 'allow',
-          action: ['targetAccessToken:modify', 'cdnAccessToken:modify'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case TargetAccessScope.SETTINGS: {
-        policies.push({
-          effect: 'allow',
-          action: ['target:modifySettings', 'laboratory:modifyPreflightScript'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-      case TargetAccessScope.DELETE: {
-        policies.push({
-          effect: 'allow',
-          action: ['target:delete'],
-          resource: [`hrn:${args.organizationId}:organization/${args.organizationId}`],
-        });
-        break;
-      }
-    }
-  }
-
-  return policies;
-}
diff --git a/packages/services/api/src/modules/auth/providers/organization-members.ts b/packages/services/api/src/modules/auth/providers/organization-members.ts
new file mode 100644
index 0000000000..f3c41c4a39
--- /dev/null
+++ b/packages/services/api/src/modules/auth/providers/organization-members.ts
@@ -0,0 +1,421 @@
+import { Inject, Injectable, Scope } from 'graphql-modules';
+import { sql, type DatabasePool } from 'slonik';
+import { z } from 'zod';
+import { Organization } from '../../../shared/entities';
+import { batchBy } from '../../../shared/helpers';
+import { isUUID } from '../../../shared/is-uuid';
+import { Logger } from '../../shared/providers/logger';
+import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
+import {
+  AllPermissionsModel,
+  getPermissionGroup,
+  PermissionGroups,
+  PermissionGroupsModel,
+} from '../lib/authz';
+import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from './scopes';
+
+const RawOrganizationMembershipModel = z.object({
+  userId: z.string(),
+  /** Legacy scopes on membership, way of assigning permissions before the introduction of roles */
+  legacyScopes: z
+    .array(z.string())
+    .transform(
+      value => value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
+    )
+    .nullable(),
+  /** Legacy role id, way of assigning permissions via a role before the introduction of assigning multiple roles */
+  legacyRoleId: z.string().nullable(),
+});
+
+const RawMemberRoleModel = z.intersection(
+  z.object({
+    id: z.string(),
+    description: z.string(),
+    isLocked: z.boolean(),
+  }),
+  z.union([
+    z.object({
+      legacyScopes: z
+        .array(z.string())
+        .transform(
+          value => value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
+        ),
+      permissions: z.null(),
+    }),
+    z.object({
+      legacyScopes: z.null(),
+      permissions: z.array(AllPermissionsModel).transform(rawPermissions => {
+        const permissions = {
+          organization: new Set(),
+          project: new Set(),
+          target: new Set(),
+          service: new Set(),
+          appDeployment: new Set(),
+        };
+
+        for (const permission of rawPermissions) {
+          permissions[getPermissionGroup(permission)].add(permission);
+        }
+
+        return PermissionGroupsModel.parse(permissions);
+      }),
+    }),
+  ]),
+);
+
+const UUIDResourceAssignmentModel = z.union([z.literal('*'), z.array(z.string().uuid())]);
+
+/**
+ * String in the form `targetId/serviceName`
+ * Example: `f81ce726-2abf-4653-bf4c-d8436cde255a/users`
+ */
+const ServiceResourceAssignmentStringModel = z
+  .string()
+  .refine(value => {
+    const [targetId, serviceName = ''] = value.split('/');
+    if (isUUID(targetId) === false || serviceName === '') {
+      return false;
+    }
+    return true;
+  }, 'Invalid service resource assignment')
+  .transform(value => value.split('/') as [targetId: string, serviceName: string]);
+
+const ServiceResourceAssignmentModel = z.union([
+  z.literal('*'),
+  z.array(ServiceResourceAssignmentStringModel),
+]);
+
+const ResourceAssignmentGroupModel = z.object({
+  /** Resources assigned to a 'projects' permission group */
+  project: UUIDResourceAssignmentModel,
+  /** Resources assigned to a 'targets' permission group */
+  target: UUIDResourceAssignmentModel,
+  /** Resources assigned to a 'service' permission group */
+  service: ServiceResourceAssignmentModel,
+  /** Resources assigned to a 'appDeployment' permission group */
+  appDeployment: ServiceResourceAssignmentModel,
+});
+
+type ResourceAssignmentGroup = z.TypeOf<typeof ResourceAssignmentGroupModel>;
+
+type MemberRoleType = {
+  id: string;
+  description: string;
+  isLocked: boolean;
+  permissions: PermissionGroups;
+};
+
+export type OrganizationMembershipRoleAssignment = {
+  role: MemberRoleType;
+  resources: ResourceAssignmentGroup;
+};
+
+type OrganizationMembership = {
+  organizationId: string;
+  isAdmin: boolean;
+  userId: string;
+  assignedRoles: Array<OrganizationMembershipRoleAssignment>;
+  /**
+   * legacy role assigned to this membership.
+   * Note: The role is already resolved to a "OrganizationMembershipRoleAssignment" within the assignedRoles property.
+   **/
+  legacyRoleId: string | null;
+  /**
+   * Legacy scope assigned to this membership.
+   * Note: They are already resolved to a "OrganizationMembershipRoleAssignment" within the assignedRoles property.
+   **/
+  legacyScopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope> | null;
+};
+
+@Injectable({
+  scope: Scope.Operation,
+})
+export class OrganizationMembers {
+  private logger: Logger;
+
+  constructor(
+    @Inject(PG_POOL_CONFIG) private pool: DatabasePool,
+    logger: Logger,
+  ) {
+    this.logger = logger.child({
+      source: 'OrganizationMembers',
+    });
+  }
+
+  private async findOrganizationMembersById(organizationId: string, userIds: Array<string>) {
+    const query = sql`
+    SELECT
+      "om"."user_id" AS "userId"
+      , "om"."role_id" AS "legacyRoleId"
+      , "om"."scopes" AS "legacyScopes"
+    FROM
+      "organization_member" AS "om"
+    WHERE
+      "om"."organization_id" = ${organizationId}
+      AND "om"."user_id" = ANY(${sql.array(userIds, 'uuid')})
+  `;
+
+    const result = await this.pool.any<unknown>(query);
+    return result.map(row => RawOrganizationMembershipModel.parse(row));
+  }
+
+  /** Find member roles by their ID */
+  private async findMemberRolesByIds(roleIds: Array<string>) {
+    this.logger.debug('Find organization membership roles. (roleIds=%o)', roleIds);
+
+    const query = sql`
+      SELECT
+        "id"
+        , "name"
+        , "description"
+        , "locked" AS "isLocked"
+        , "scopes" AS "legacyScopes"
+        , "permissions"
+      FROM
+        "organization_member_roles"
+      WHERE
+        "id" = ANY(${sql.array(roleIds, 'uuid')})
+    `;
+
+    const result = await this.pool.any<unknown>(query);
+
+    const rowsById = new Map<string, MemberRoleType>();
+
+    for (const row of result) {
+      const record = RawMemberRoleModel.parse(row);
+
+      rowsById.set(record.id, {
+        id: record.id,
+        isLocked: record.isLocked,
+        description: record.description,
+        permissions:
+          record.permissions ??
+          transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes),
+      });
+    }
+    return rowsById;
+  }
+
+  /**
+   * Batched loader function for a organization membership.
+   *
+   * Handles legacy scopes and role assignments and automatically transforms
+   * them into resource based role assignments.
+   */
+  findOrganizationMembership = batchBy(
+    (args: { organization: Organization; userId: string }) => args.organization.id,
+    async args => {
+      const organization = args[0].organization;
+      const userIds = args.map(arg => arg.userId);
+
+      this.logger.debug(
+        'Find organization membership for users. (organizationId=%s, userIds=%o)',
+        organization.id,
+        userIds,
+      );
+
+      const organizationMembers = await this.findOrganizationMembersById(organization.id, userIds);
+      const mapping = new Map<string, OrganizationMembership>();
+
+      // Roles that are assigned using the legacy "single role" way
+      const pendingLegacyRoleLookups = new Set<string>();
+      const pendingLegacyRoleMembershipAssignments: Array<{
+        legacyRoleId: string;
+        assignedRoles: OrganizationMembership['assignedRoles'];
+      }> = [];
+
+      // Users whose role assignments need to be loaded as they are not using any legacy roles
+      // const pendingRoleRoleAssignmentLookupUsersIds = new Set<OrganizationMembership>();
+
+      for (const record of organizationMembers) {
+        const organizationMembership: OrganizationMembership = {
+          organizationId: organization.id,
+          userId: record.userId,
+          isAdmin: organization.ownerId === record.userId,
+          assignedRoles: [],
+          legacyRoleId: record.legacyRoleId,
+          legacyScopes: record.legacyScopes,
+        };
+        mapping.set(record.userId, organizationMembership);
+
+        if (record.legacyRoleId) {
+          // legacy "single assigned role"
+          pendingLegacyRoleLookups.add(record.legacyRoleId);
+          pendingLegacyRoleMembershipAssignments.push({
+            legacyRoleId: record.legacyRoleId,
+            assignedRoles: organizationMembership.assignedRoles,
+          });
+        } else if (record.legacyScopes !== null) {
+          // legacy "scopes" on organization member -> migration wizard has not been used
+
+          // In this case we translate the legacy scopes to a single permission group on the "organization"
+          // resource typ. Then assign the users organization to the group, so it has the same behavior as previously.
+          organizationMembership.assignedRoles.push({
+            role: {
+              id: 'legacy-scope-role',
+              description: 'This role has been automatically generated from the assigned scopes.',
+              isLocked: true,
+              permissions: transformOrganizationMemberLegacyScopesIntoPermissionGroup(
+                record.legacyScopes,
+              ),
+            },
+            // allow all permissions for all resources within the organization.
+            resources: {
+              project: '*',
+              target: '*',
+              service: '*',
+              appDeployment: '*',
+            },
+          });
+        }
+        // else {
+        //   // normal role assignment lookup
+        //   pendingRoleRoleAssignmentLookupUsersIds.add(organizationMembership);
+        // }
+      }
+
+      if (pendingLegacyRoleLookups.size) {
+        // This handles the legacy "single" role assignments
+        // We load the roles and then attach them to the already loaded membership role
+        const roleIds = Array.from(pendingLegacyRoleLookups);
+
+        this.logger.debug('Lookup legacy role assignments. (roleIds=%o)', roleIds);
+
+        const memberRolesById = await this.findMemberRolesByIds(roleIds);
+
+        for (const record of pendingLegacyRoleMembershipAssignments) {
+          const membershipRole = memberRolesById.get(record.legacyRoleId);
+          if (!membershipRole) {
+            continue;
+          }
+          record.assignedRoles.push({
+            resources: {
+              project: '*',
+              target: '*',
+              service: '*',
+              appDeployment: '*',
+            },
+            role: membershipRole,
+          });
+        }
+      }
+
+      //   if (pendingRoleRoleAssignmentLookupUsersIds.size) {
+      //     const usersIds = Array.from(pendingRoleRoleAssignmentLookupUsersIds).map(
+      //       membership => membership.userId,
+      //     );
+      //     this.logger.debug(
+      //       'Lookup role assignments within organization for users. (organizationId=%s, userIds=%o)',
+      //       organization.id,
+      //       usersIds,
+      //     );
+
+      //     const roleAssignments = await this.findRoleAssignmentsForUsersInOrganization(
+      //       organization.id,
+      //       usersIds,
+      //     );
+
+      //     for (const membership of pendingRoleRoleAssignmentLookupUsersIds) {
+      //       membership.assignedRoles.push(...(roleAssignments.get(membership.userId) ?? []));
+      //     }
+      //   }
+
+      return userIds.map(async userId => mapping.get(userId) ?? null);
+    },
+  );
+}
+
+function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
+  scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
+): z.TypeOf<typeof PermissionGroupsModel> {
+  const permissions: z.TypeOf<typeof PermissionGroupsModel> = {
+    organization: new Set(),
+    project: new Set(),
+    target: new Set(),
+    service: new Set(),
+    appDeployment: new Set(),
+  };
+  for (const scope of scopes) {
+    switch (scope) {
+      case OrganizationAccessScope.READ: {
+        permissions.organization.add('organization:describe');
+        permissions.organization.add('support:manageTickets');
+        permissions.organization.add('project:create');
+        permissions.project.add('project:describe');
+        break;
+      }
+      case OrganizationAccessScope.SETTINGS: {
+        permissions.organization.add('organization:modifySlug');
+        permissions.organization.add('schemaLinting:modifyOrganizationRules');
+        permissions.organization.add('billing:describe');
+        permissions.organization.add('billing:update');
+        permissions.organization.add('auditLog:export');
+        break;
+      }
+      case OrganizationAccessScope.DELETE: {
+        permissions.organization.add('organization:delete');
+        break;
+      }
+      case OrganizationAccessScope.INTEGRATIONS: {
+        permissions.organization.add('oidc:modify');
+        permissions.organization.add('gitHubIntegration:modify');
+        permissions.organization.add('slackIntegration:modify');
+
+        break;
+      }
+      case OrganizationAccessScope.MEMBERS: {
+        permissions.organization.add('member:manageInvites');
+        permissions.organization.add('member:removeMember');
+        permissions.organization.add('member:assignRole');
+        permissions.organization.add('member:modifyRole');
+        permissions.organization.add('member:describe');
+        break;
+      }
+      case ProjectAccessScope.ALERTS: {
+        permissions.project.add('alert:modify');
+        break;
+      }
+      case ProjectAccessScope.READ: {
+        permissions.project.add('project:describe');
+        break;
+      }
+      case ProjectAccessScope.DELETE: {
+        permissions.project.add('project:delete');
+        break;
+      }
+      case ProjectAccessScope.SETTINGS: {
+        permissions.project.add('project:delete');
+        permissions.project.add('project:modifySettings');
+        permissions.project.add('schemaLinting:modifyProjectRules');
+        break;
+      }
+      case TargetAccessScope.READ: {
+        permissions.project.add('target:create');
+        permissions.target.add('appDeployment:describe');
+        permissions.target.add('laboratory:describe');
+        break;
+      }
+      case TargetAccessScope.REGISTRY_WRITE: {
+        permissions.target.add('laboratory:modify');
+        permissions.service.add('schemaCheck:approve');
+        break;
+      }
+      case TargetAccessScope.TOKENS_WRITE: {
+        permissions.target.add('targetAccessToken:modify');
+        permissions.target.add('cdnAccessToken:modify');
+        break;
+      }
+      case TargetAccessScope.SETTINGS: {
+        permissions.target.add('target:modifySettings');
+        permissions.target.add('laboratory:modifyPreflightScript');
+        break;
+      }
+      case TargetAccessScope.DELETE: {
+        permissions.target.add('target:delete');
+        break;
+      }
+    }
+  }
+
+  return permissions;
+}
diff --git a/packages/services/server/src/index.ts b/packages/services/server/src/index.ts
index b4e6627314..bd0c51889a 100644
--- a/packages/services/server/src/index.ts
+++ b/packages/services/server/src/index.ts
@@ -12,6 +12,7 @@ import { createRedisEventTarget } from '@graphql-yoga/redis-event-target';
 import 'reflect-metadata';
 import { hostname } from 'os';
 import { createPubSub } from 'graphql-yoga';
+import { OrganizationMembers } from 'packages/services/api/src/modules/auth/providers/organization-members';
 import { z } from 'zod';
 import formDataPlugin from '@fastify/formbody';
 import { createRegistry, createTaskRunner, CryptoProvider, LogFn, Logger } from '@hive/api';
@@ -401,6 +402,7 @@ export async function main() {
         new SuperTokensUserAuthNStrategy({
           logger: server.log,
           storage,
+          organizationMembers: new OrganizationMembers(storage.pool, server.log),
         }),
         new TargetAccessTokenStrategy({
           logger: server.log,

From 05b12ec13875ad83e3d670bca81677965f468896 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 14:31:03 +0100
Subject: [PATCH 04/55] rename some things

---
 .../api/src/modules/auth/lib/authz.ts         | 94 ++++++++++++-------
 .../auth/providers/organization-members.ts    | 32 ++-----
 2 files changed, 68 insertions(+), 58 deletions(-)

diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index c109a6c816..617857d962 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -334,7 +334,7 @@ function objectEntries<$Key extends string, $Value>(
  * If you are adding new permissions to the existing system.
  * This is the place to do so.
  */
-const permissionGroups = {
+const permissionsByLevel = {
   organization: [
     z.literal('organization:describe'),
     z.literal('organization:modifySlug'),
@@ -387,40 +387,44 @@ const permissionGroups = {
   ],
 } as const;
 
-export const PermissionGroupsModel = z.object({
-  organization: z.set(z.union(permissionGroups.organization)),
-  project: z.set(z.union(permissionGroups.project)),
-  target: z.set(z.union(permissionGroups.target)),
-  service: z.set(z.union(permissionGroups.service)),
-  appDeployment: z.set(z.union(permissionGroups.appDeployment)),
+export const PermissionsPerResourceLevelAssignmentModel = z.object({
+  organization: z.set(z.union(permissionsByLevel.organization)),
+  project: z.set(z.union(permissionsByLevel.project)),
+  target: z.set(z.union(permissionsByLevel.target)),
+  service: z.set(z.union(permissionsByLevel.service)),
+  appDeployment: z.set(z.union(permissionsByLevel.appDeployment)),
 });
 
-export type PermissionGroups = z.TypeOf<typeof PermissionGroupsModel>;
+export type PermissionsPerResourceLevelAssignment = z.TypeOf<
+  typeof PermissionsPerResourceLevelAssignmentModel
+>;
 
-export const AllPermissionsModel = z.union([
-  ...permissionGroups.organization,
-  ...permissionGroups.project,
-  ...permissionGroups.target,
-  ...permissionGroups.service,
-  ...permissionGroups.appDeployment,
+type ResourceLevels = keyof PermissionsPerResourceLevelAssignment;
+
+export const PermissionsModel = z.union([
+  ...permissionsByLevel.organization,
+  ...permissionsByLevel.project,
+  ...permissionsByLevel.target,
+  ...permissionsByLevel.service,
+  ...permissionsByLevel.appDeployment,
 ]);
 
-const lookupMap = new Map<
-  z.TypeOf<typeof AllPermissionsModel>,
-  'organization' | 'project' | 'target' | 'service' | 'appDeployment'
+type Permissions = z.TypeOf<typeof PermissionsModel>;
+
+const permissionResourceLevelLookupMap = new Map<
+  z.TypeOf<typeof PermissionsModel>,
+  ResourceLevels
 >();
 
-for (const [key, permissions] of objectEntries(permissionGroups)) {
+for (const [key, permissions] of objectEntries(permissionsByLevel)) {
   for (const permission of permissions) {
-    lookupMap.set(permission.value, key);
+    permissionResourceLevelLookupMap.set(permission.value, key);
   }
 }
 
 /** Get the permission group for a specific permissions */
-export function getPermissionGroup(
-  permission: z.TypeOf<typeof AllPermissionsModel>,
-): 'organization' | 'project' | 'target' | 'service' | 'appDeployment' {
-  const group = lookupMap.get(permission);
+function getPermissionGroup(permission: Permissions): ResourceLevels {
+  const group = permissionResourceLevelLookupMap.get(permission);
 
   if (group === undefined) {
     throw new Error(`Could not find group for permission '${permission}'.`);
@@ -429,26 +433,44 @@ export function getPermissionGroup(
   return group;
 }
 
+/**
+ * Transforms a flat permission array into an object that groups the permissions per resource level.
+ */
+export function permissionsToPermissionsPerResourceLevelAssignment(
+  permissions: Array<Permissions>,
+): PermissionsPerResourceLevelAssignment {
+  const assignment: PermissionsPerResourceLevelAssignment = {
+    organization: new Set(),
+    project: new Set(),
+    target: new Set(),
+    service: new Set(),
+    appDeployment: new Set(),
+  };
+
+  for (const permission of permissions) {
+    const group = getPermissionGroup(permission);
+    (assignment[group] as Set<Permissions>).add(permission);
+  }
+
+  return assignment;
+}
+
+type ActionDefinitionMap = {
+  [key: `${string}:${string}`]: (args: any) => Array<string>;
+};
+
 const actionDefinitions = {
-  ...objectFromEntries(permissionGroups['organization'].map(t => [t.value, defaultOrgIdentity])),
+  ...objectFromEntries(permissionsByLevel['organization'].map(t => [t.value, defaultOrgIdentity])),
+  ...objectFromEntries(permissionsByLevel['project'].map(t => [t.value, defaultProjectIdentity])),
+  ...objectFromEntries(permissionsByLevel['target'].map(t => [t.value, defaultTargetIdentity])),
   ...objectFromEntries(
-    permissionGroups['project'].map(t => [t.value, defaultProjectIdentity] as const),
+    permissionsByLevel['service'].map(t => [t.value, schemaCheckOrPublishIdentity]),
   ),
   ...objectFromEntries(
-    permissionGroups['target'].map(t => [t.value, defaultTargetIdentity] as const),
-  ),
-  ...objectFromEntries(
-    permissionGroups['service'].map(t => [t.value, schemaCheckOrPublishIdentity] as const),
-  ),
-  ...objectFromEntries(
-    permissionGroups['appDeployment'].map(t => [t.value, defaultAppDeploymentIdentity] as const),
+    permissionsByLevel['appDeployment'].map(t => [t.value, defaultAppDeploymentIdentity]),
   ),
 } satisfies ActionDefinitionMap;
 
-type ActionDefinitionMap = {
-  [key: `${string}:${string}`]: (args: any) => Array<string>;
-};
-
 type Actions = keyof typeof actionDefinitions;
 
 type ActionStrings = Actions | '*';
diff --git a/packages/services/api/src/modules/auth/providers/organization-members.ts b/packages/services/api/src/modules/auth/providers/organization-members.ts
index f3c41c4a39..5ece2ebdb1 100644
--- a/packages/services/api/src/modules/auth/providers/organization-members.ts
+++ b/packages/services/api/src/modules/auth/providers/organization-members.ts
@@ -7,10 +7,10 @@ import { isUUID } from '../../../shared/is-uuid';
 import { Logger } from '../../shared/providers/logger';
 import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
 import {
-  AllPermissionsModel,
-  getPermissionGroup,
-  PermissionGroups,
-  PermissionGroupsModel,
+  PermissionsModel,
+  PermissionsPerResourceLevelAssignment,
+  PermissionsPerResourceLevelAssignmentModel,
+  permissionsToPermissionsPerResourceLevelAssignment,
 } from '../lib/authz';
 import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from './scopes';
 
@@ -44,21 +44,9 @@ const RawMemberRoleModel = z.intersection(
     }),
     z.object({
       legacyScopes: z.null(),
-      permissions: z.array(AllPermissionsModel).transform(rawPermissions => {
-        const permissions = {
-          organization: new Set(),
-          project: new Set(),
-          target: new Set(),
-          service: new Set(),
-          appDeployment: new Set(),
-        };
-
-        for (const permission of rawPermissions) {
-          permissions[getPermissionGroup(permission)].add(permission);
-        }
-
-        return PermissionGroupsModel.parse(permissions);
-      }),
+      permissions: z
+        .array(PermissionsModel)
+        .transform(permissions => permissionsToPermissionsPerResourceLevelAssignment(permissions)),
     }),
   ]),
 );
@@ -102,7 +90,7 @@ type MemberRoleType = {
   id: string;
   description: string;
   isLocked: boolean;
-  permissions: PermissionGroups;
+  permissions: PermissionsPerResourceLevelAssignment;
 };
 
 export type OrganizationMembershipRoleAssignment = {
@@ -327,8 +315,8 @@ export class OrganizationMembers {
 
 function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
   scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
-): z.TypeOf<typeof PermissionGroupsModel> {
-  const permissions: z.TypeOf<typeof PermissionGroupsModel> = {
+): z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> {
+  const permissions: z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> = {
     organization: new Set(),
     project: new Set(),
     target: new Set(),

From edb7fd1c74301746511a006ccf65282c42a581ad Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 14:32:53 +0100
Subject: [PATCH 05/55] remove export

---
 packages/services/api/src/modules/auth/lib/authz.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index 617857d962..70eebc95fd 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -274,7 +274,7 @@ function isResourceIdMatch(
   return true;
 }
 
-export function defaultOrgIdentity(args: { organizationId: string }) {
+function defaultOrgIdentity(args: { organizationId: string }) {
   return [`organization/${args.organizationId}`];
 }
 

From b42ae1e7396f2e2cbda59c0fd850c2c918df056c Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 16:03:41 +0100
Subject: [PATCH 06/55] move business logic for hierarchy resolution to the
 organization members module

---
 .../modules/auth/lib/supertokens-strategy.ts  | 104 ++++++-----
 .../auth/providers/organization-members.ts    | 165 ++++++++++++++++--
 2 files changed, 210 insertions(+), 59 deletions(-)

diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index 1a75bdc345..18afb0cfda 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -10,6 +10,7 @@ import type { Storage } from '../../shared/providers/storage';
 import {
   OrganizationMembers,
   OrganizationMembershipRoleAssignment,
+  ResourceAssignment,
 } from '../providers/organization-members';
 import { AuthNStrategy, AuthorizationPolicyStatement, Session } from './authz';
 
@@ -117,64 +118,79 @@ export class SuperTokensCookieBasedSession extends Session {
     return true;
   }
 
+  private toResourceIdentifier(organizationId: string, resource: ResourceAssignment): string;
+  private toResourceIdentifier(
+    organizationId: string,
+    resource: ResourceAssignment | Array<ResourceAssignment>,
+  ): Array<string>;
+  private toResourceIdentifier(
+    organizationId: string,
+    resource: ResourceAssignment | Array<ResourceAssignment>,
+  ): string | Array<string> {
+    if (Array.isArray(resource)) {
+      return resource.map(resource => this.toResourceIdentifier(organizationId, resource));
+    }
+
+    if (resource.type === 'organization') {
+      return `hrn:${organizationId}:organization/${resource.organizationId}`;
+    }
+
+    if (resource.type === 'project') {
+      return `hrn:${organizationId}:project/${resource.projectId}`;
+    }
+
+    if (resource.type === 'target') {
+      return `hrn:${organizationId}:project/${resource.targetId}`;
+    }
+
+    if (resource.type === 'service') {
+      return `hrn:${organizationId}:target/${resource.targetId}/service/${resource.serviceName}`;
+    }
+
+    if (resource.type === 'appDeployment') {
+      return `hrn:${organizationId}:target/${resource.targetId}/appDeployment/${resource.appDeploymentName}`;
+    }
+
+    throw new Error('never');
+  }
+
   private translateAssignedRolesToAuthorizationPolicyStatements(
     organizationId: string,
     organizationMembershipRoleAssignments: Array<OrganizationMembershipRoleAssignment>,
   ): Array<AuthorizationPolicyStatement> {
     const policyStatements: Array<AuthorizationPolicyStatement> = [];
 
-    const orgResourceId = `hrn:${organizationId}:organization/${organizationId}`;
-
     for (const assignedRole of organizationMembershipRoleAssignments) {
-      /**
-       * Currently, we have the following hierarchy
-       *
-       *        organization
-       *             v
-       *           project
-       *             v
-       *           target
-       *          v      v
-       * app deployment  service
-       *
-       * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
-       */
-
-      let parentResource: Array<string> = [orgResourceId];
-
       if (assignedRole.role.permissions.organization.size) {
         policyStatements.push({
           action: Array.from(assignedRole.role.permissions.organization),
           effect: 'allow',
-          resource: parentResource,
+          resource: this.toResourceIdentifier(
+            organizationId,
+            assignedRole.resolvedResources.organization,
+          ),
         });
       }
 
       if (assignedRole.role.permissions.project.size) {
-        if (Array.isArray(assignedRole.resources.project)) {
-          parentResource = assignedRole.resources.project.map(
-            uuid => `hrn:${organizationId}:project/${uuid}`,
-          );
-        }
-
         policyStatements.push({
           action: Array.from(assignedRole.role.permissions.project),
           effect: 'allow',
-          resource: parentResource,
+          resource: this.toResourceIdentifier(
+            organizationId,
+            assignedRole.resolvedResources.project,
+          ),
         });
       }
 
       if (assignedRole.role.permissions.target.size) {
-        if (Array.isArray(assignedRole.resources.target)) {
-          parentResource = assignedRole.resources.target.map(
-            uuid => `hrn:${organizationId}:target/${uuid}`,
-          );
-        }
-
         policyStatements.push({
           action: Array.from(assignedRole.role.permissions.target),
           effect: 'allow',
-          resource: parentResource,
+          resource: this.toResourceIdentifier(
+            organizationId,
+            assignedRole.resolvedResources.target,
+          ),
         });
       }
 
@@ -182,13 +198,10 @@ export class SuperTokensCookieBasedSession extends Session {
         policyStatements.push({
           action: Array.from(assignedRole.role.permissions.service),
           effect: 'allow',
-          resource:
-            assignedRole.resources.service === '*'
-              ? parentResource
-              : assignedRole.resources.service.map(
-                  ([targetId, serviceName]) =>
-                    `hrn:${organizationId}:target/${targetId}/service/${serviceName}`,
-                ),
+          resource: this.toResourceIdentifier(
+            organizationId,
+            assignedRole.resolvedResources.service,
+          ),
         });
       }
 
@@ -196,13 +209,10 @@ export class SuperTokensCookieBasedSession extends Session {
         policyStatements.push({
           action: Array.from(assignedRole.role.permissions.appDeployment),
           effect: 'allow',
-          resource:
-            assignedRole.resources.appDeployment === '*'
-              ? parentResource
-              : assignedRole.resources.appDeployment.map(
-                  ([targetId, serviceName]) =>
-                    `hrn:${organizationId}:target/${targetId}/appDeployment/${serviceName}`,
-                ),
+          resource: this.toResourceIdentifier(
+            organizationId,
+            assignedRole.resolvedResources.appDeployment,
+          ),
         });
       }
     }
diff --git a/packages/services/api/src/modules/auth/providers/organization-members.ts b/packages/services/api/src/modules/auth/providers/organization-members.ts
index 5ece2ebdb1..e10b014ad5 100644
--- a/packages/services/api/src/modules/auth/providers/organization-members.ts
+++ b/packages/services/api/src/modules/auth/providers/organization-members.ts
@@ -84,6 +84,9 @@ const ResourceAssignmentGroupModel = z.object({
   appDeployment: ServiceResourceAssignmentModel,
 });
 
+/**
+ * Resource assignments as stored within the database.
+ */
 type ResourceAssignmentGroup = z.TypeOf<typeof ResourceAssignmentGroupModel>;
 
 type MemberRoleType = {
@@ -95,7 +98,14 @@ type MemberRoleType = {
 
 export type OrganizationMembershipRoleAssignment = {
   role: MemberRoleType;
+  /**
+   * Resource assignments as stored within the database.
+   */
   resources: ResourceAssignmentGroup;
+  /**
+   * Actual resolved resource groups
+   */
+  resolvedResources: ResolvedResourceAssignments;
 };
 
 type OrganizationMembership = {
@@ -238,6 +248,13 @@ export class OrganizationMembers {
 
           // In this case we translate the legacy scopes to a single permission group on the "organization"
           // resource typ. Then assign the users organization to the group, so it has the same behavior as previously.
+          const resources: ResourceAssignmentGroup = {
+            project: '*',
+            target: '*',
+            service: '*',
+            appDeployment: '*',
+          };
+
           organizationMembership.assignedRoles.push({
             role: {
               id: 'legacy-scope-role',
@@ -248,12 +265,11 @@ export class OrganizationMembers {
               ),
             },
             // allow all permissions for all resources within the organization.
-            resources: {
-              project: '*',
-              target: '*',
-              service: '*',
-              appDeployment: '*',
-            },
+            resources,
+            resolvedResources: resolveResourceAssignment({
+              organizationId: organization.id,
+              groups: resources,
+            }),
           });
         }
         // else {
@@ -276,13 +292,18 @@ export class OrganizationMembers {
           if (!membershipRole) {
             continue;
           }
+          const resources: ResourceAssignmentGroup = {
+            project: '*',
+            target: '*',
+            service: '*',
+            appDeployment: '*',
+          };
           record.assignedRoles.push({
-            resources: {
-              project: '*',
-              target: '*',
-              service: '*',
-              appDeployment: '*',
-            },
+            resources,
+            resolvedResources: resolveResourceAssignment({
+              organizationId: organization.id,
+              groups: resources,
+            }),
             role: membershipRole,
           });
         }
@@ -407,3 +428,123 @@ function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
 
   return permissions;
 }
+
+type OrganizationAssignment = {
+  type: 'organization';
+  organizationId: string;
+};
+
+type ProjectAssignment = {
+  type: 'project';
+  projectId: string;
+};
+
+type TargetAssignment = {
+  type: 'target';
+  targetId: string;
+};
+
+type ServiceAssignment = {
+  type: 'service';
+  targetId: string;
+  serviceName: string;
+};
+
+type AppDeploymentAssignment = {
+  type: 'appDeployment';
+  targetId: string;
+  appDeploymentName: string;
+};
+
+export type ResourceAssignment =
+  | OrganizationAssignment
+  | ProjectAssignment
+  | TargetAssignment
+  | ServiceAssignment
+  | AppDeploymentAssignment;
+
+type ResolvedResourceAssignments = {
+  organization: OrganizationAssignment;
+  project: OrganizationAssignment | Array<ProjectAssignment>;
+  target: OrganizationAssignment | Array<ProjectAssignment> | Array<TargetAssignment>;
+  service:
+    | OrganizationAssignment
+    | Array<ProjectAssignment>
+    | Array<TargetAssignment>
+    | Array<ServiceAssignment>;
+  appDeployment:
+    | OrganizationAssignment
+    | Array<ProjectAssignment>
+    | Array<TargetAssignment>
+    | Array<AppDeploymentAssignment>;
+};
+
+/**
+ * This function resolves the "stored-in-database", user configuration to the actual resolved structure
+ * Currently, we have the following hierarchy
+ *
+ *        organization
+ *             v
+ *           project
+ *             v
+ *           target
+ *          v      v
+ * app deployment  service
+ *
+ * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
+ */
+function resolveResourceAssignment(args: {
+  organizationId: string;
+  groups: ResourceAssignmentGroup;
+}): ResolvedResourceAssignments {
+  const organization: OrganizationAssignment = {
+    type: 'organization',
+    organizationId: args.organizationId,
+  };
+
+  let project: ResolvedResourceAssignments['project'] = organization;
+
+  if (args.groups.project !== '*') {
+    project = args.groups.project.map(projectId => ({
+      type: 'project',
+      projectId,
+    }));
+  }
+
+  let target: ResolvedResourceAssignments['target'] = project;
+
+  if (args.groups.target !== '*') {
+    target = args.groups.target.map(targetId => ({
+      type: 'target',
+      targetId,
+    }));
+  }
+
+  let service: ResolvedResourceAssignments['service'] = target;
+
+  if (args.groups.service !== '*') {
+    service = args.groups.service.map(([targetId, serviceName]) => ({
+      type: 'service',
+      targetId,
+      serviceName,
+    }));
+  }
+
+  let appDeployment: ResolvedResourceAssignments['appDeployment'] = target;
+
+  if (args.groups.service !== '*') {
+    appDeployment = args.groups.service.map(([targetId, appDeploymentName]) => ({
+      type: 'appDeployment',
+      targetId,
+      appDeploymentName,
+    }));
+  }
+
+  return {
+    organization,
+    project,
+    target,
+    service,
+    appDeployment,
+  };
+}

From e3ce5d32ff402d8e80045cca27aca49d01864157 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 30 Dec 2024 16:20:34 +0100
Subject: [PATCH 07/55] fix import

---
 packages/services/api/src/index.ts                     |  1 +
 .../src/modules/auth/providers/organization-members.ts |  2 +-
 packages/services/server/src/index.ts                  | 10 ++++++++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/packages/services/api/src/index.ts b/packages/services/api/src/index.ts
index 0d11764899..591d8b52f7 100644
--- a/packages/services/api/src/index.ts
+++ b/packages/services/api/src/index.ts
@@ -37,3 +37,4 @@ export {
   ProjectAccessScope,
   TargetAccessScope,
 } from './__generated__/types';
+export { OrganizationMembers } from './modules/auth/providers/organization-members';
diff --git a/packages/services/api/src/modules/auth/providers/organization-members.ts b/packages/services/api/src/modules/auth/providers/organization-members.ts
index e10b014ad5..c981f4c0a0 100644
--- a/packages/services/api/src/modules/auth/providers/organization-members.ts
+++ b/packages/services/api/src/modules/auth/providers/organization-members.ts
@@ -103,7 +103,7 @@ export type OrganizationMembershipRoleAssignment = {
    */
   resources: ResourceAssignmentGroup;
   /**
-   * Actual resolved resource groups
+   * Resolved resource groups, used for runtime permission checks.
    */
   resolvedResources: ResolvedResourceAssignments;
 };
diff --git a/packages/services/server/src/index.ts b/packages/services/server/src/index.ts
index bd0c51889a..9d31d6847f 100644
--- a/packages/services/server/src/index.ts
+++ b/packages/services/server/src/index.ts
@@ -12,10 +12,16 @@ import { createRedisEventTarget } from '@graphql-yoga/redis-event-target';
 import 'reflect-metadata';
 import { hostname } from 'os';
 import { createPubSub } from 'graphql-yoga';
-import { OrganizationMembers } from 'packages/services/api/src/modules/auth/providers/organization-members';
 import { z } from 'zod';
 import formDataPlugin from '@fastify/formbody';
-import { createRegistry, createTaskRunner, CryptoProvider, LogFn, Logger } from '@hive/api';
+import {
+  createRegistry,
+  createTaskRunner,
+  CryptoProvider,
+  LogFn,
+  Logger,
+  OrganizationMembers,
+} from '@hive/api';
 import { HivePubSub } from '@hive/api/src/modules/shared/providers/pub-sub';
 import { createRedisClient } from '@hive/api/src/modules/shared/providers/redis';
 import { createArtifactRequestHandler } from '@hive/cdn-script/artifact-handler';

From 1ba564e25d9de3df4fefaaa1f097bf3a86ecb4e3 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Thu, 2 Jan 2025 11:03:10 +0100
Subject: [PATCH 08/55] expose membership permissions via GraphQL API

---
 .../api/src/modules/auth/lib/authz.ts         |  20 +-
 .../lib/organization-member-permissions.ts    | 311 ++++++++++++++++++
 .../modules/auth/module.graphql.mappers.ts    |   3 +
 .../api/src/modules/auth/module.graphql.ts    |  29 ++
 .../modules/auth/resolvers/Organization.ts    |  21 ++
 .../src/modules/auth/resolvers/Permission.ts  |  21 ++
 .../modules/auth/resolvers/PermissionGroup.ts |  14 +
 7 files changed, 413 insertions(+), 6 deletions(-)
 create mode 100644 packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
 create mode 100644 packages/services/api/src/modules/auth/resolvers/Organization.ts
 create mode 100644 packages/services/api/src/modules/auth/resolvers/Permission.ts
 create mode 100644 packages/services/api/src/modules/auth/resolvers/PermissionGroup.ts

diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index 70eebc95fd..78c6ed22b1 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -387,6 +387,14 @@ const permissionsByLevel = {
   ],
 } as const;
 
+export const allPermissions = [
+  ...permissionsByLevel.organization.map(v => v.value),
+  ...permissionsByLevel.project.map(v => v.value),
+  ...permissionsByLevel.target.map(v => v.value),
+  ...permissionsByLevel.service.map(v => v.value),
+  ...permissionsByLevel.appDeployment.map(v => v.value),
+] as const;
+
 export const PermissionsPerResourceLevelAssignmentModel = z.object({
   organization: z.set(z.union(permissionsByLevel.organization)),
   project: z.set(z.union(permissionsByLevel.project)),
@@ -399,7 +407,7 @@ export type PermissionsPerResourceLevelAssignment = z.TypeOf<
   typeof PermissionsPerResourceLevelAssignmentModel
 >;
 
-type ResourceLevels = keyof PermissionsPerResourceLevelAssignment;
+export type ResourceLevel = keyof PermissionsPerResourceLevelAssignment;
 
 export const PermissionsModel = z.union([
   ...permissionsByLevel.organization,
@@ -409,11 +417,11 @@ export const PermissionsModel = z.union([
   ...permissionsByLevel.appDeployment,
 ]);
 
-type Permissions = z.TypeOf<typeof PermissionsModel>;
+export type Permission = z.TypeOf<typeof PermissionsModel>;
 
 const permissionResourceLevelLookupMap = new Map<
   z.TypeOf<typeof PermissionsModel>,
-  ResourceLevels
+  ResourceLevel
 >();
 
 for (const [key, permissions] of objectEntries(permissionsByLevel)) {
@@ -423,7 +431,7 @@ for (const [key, permissions] of objectEntries(permissionsByLevel)) {
 }
 
 /** Get the permission group for a specific permissions */
-function getPermissionGroup(permission: Permissions): ResourceLevels {
+export function getPermissionGroup(permission: Permission): ResourceLevel {
   const group = permissionResourceLevelLookupMap.get(permission);
 
   if (group === undefined) {
@@ -437,7 +445,7 @@ function getPermissionGroup(permission: Permissions): ResourceLevels {
  * Transforms a flat permission array into an object that groups the permissions per resource level.
  */
 export function permissionsToPermissionsPerResourceLevelAssignment(
-  permissions: Array<Permissions>,
+  permissions: Array<Permission>,
 ): PermissionsPerResourceLevelAssignment {
   const assignment: PermissionsPerResourceLevelAssignment = {
     organization: new Set(),
@@ -449,7 +457,7 @@ export function permissionsToPermissionsPerResourceLevelAssignment(
 
   for (const permission of permissions) {
     const group = getPermissionGroup(permission);
-    (assignment[group] as Set<Permissions>).add(permission);
+    (assignment[group] as Set<Permission>).add(permission);
   }
 
   return assignment;
diff --git a/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts b/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
new file mode 100644
index 0000000000..64149bb0d4
--- /dev/null
+++ b/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
@@ -0,0 +1,311 @@
+import { allPermissions, Permission } from './authz';
+
+export type PermissionRecord = {
+  id: Permission;
+  title: string;
+  description: string;
+  dependsOn?: Permission;
+  readOnly?: true;
+};
+
+export type PermissionGroup = {
+  id: string;
+  title: string;
+  permissions: Array<PermissionRecord>;
+};
+
+export const allPermissionGroups: Array<PermissionGroup> = [
+  {
+    id: 'organization',
+    title: 'Organization',
+    permissions: [
+      {
+        id: 'organization:describe',
+        title: 'View organization',
+        description: 'Member can see the organization. Permission can not be modified.',
+        readOnly: true,
+      },
+      {
+        id: 'support:manageTickets',
+        title: 'Access support tickets',
+        description: 'Member can access, create and reply to support tickets.',
+      },
+      {
+        id: 'organization:modifySlug',
+        title: 'Update organization slug',
+        description: 'Member can modify the organization slug.',
+      },
+      {
+        id: 'auditLog:export',
+        title: 'Export audit log',
+        description: 'Member can access and export the audit log.',
+      },
+      {
+        id: 'organization:delete',
+        title: 'Delete organization',
+        description: 'Member can delete the Organization.',
+      },
+    ],
+  },
+  {
+    id: 'members',
+    title: 'Members',
+    permissions: [
+      {
+        id: 'member:describe',
+        title: 'View members',
+        description: 'Member can access the organization member overview.',
+      },
+      {
+        id: 'member:assignRole',
+        title: 'Assign member role',
+        description: 'Member can assign roles to users.',
+        dependsOn: 'member:describe',
+      },
+      {
+        id: 'member:modifyRole',
+        title: 'Modify member role',
+        description: 'Member can modify, create and delete roles.',
+        dependsOn: 'member:describe',
+      },
+      {
+        id: 'member:removeMember',
+        title: 'Remove member',
+        description: 'Member can remove users from the organization.',
+        dependsOn: 'member:describe',
+      },
+      {
+        id: 'member:manageInvites',
+        title: 'Manage invites',
+        description: 'Member can invite users via email and modify or delete pending invites.',
+        dependsOn: 'member:describe',
+      },
+    ],
+  },
+  {
+    id: 'billing',
+    title: 'Billing',
+    permissions: [
+      {
+        id: 'billing:describe',
+        title: 'View billing',
+        description: 'Member can view the billing information.',
+      },
+      {
+        id: 'billing:update',
+        title: 'Update billing',
+        description: 'Member can change the organization plan.',
+        dependsOn: 'billing:describe',
+      },
+    ],
+  },
+  {
+    id: 'oidc',
+    title: 'OpenID Connect',
+    permissions: [
+      {
+        id: 'oidc:modify',
+        title: 'Manage OpenID Connect integration',
+        description: 'Member can connect, modify, and remove an OIDC provider to the connection.',
+      },
+    ],
+  },
+  {
+    id: 'github',
+    title: 'GitHub Integration',
+    permissions: [
+      {
+        id: 'gitHubIntegration:modify',
+        title: 'Manage GitHub integration',
+        description:
+          'Member can connect, modify, and remove access for the GitHub integration and repository access.',
+      },
+    ],
+  },
+  {
+    id: 'slack',
+    title: 'Slack Integration',
+    permissions: [
+      {
+        id: 'slackIntegration:modify',
+        title: 'Manage Slack integration',
+        description:
+          'Member can connect, modify, and remove access for the Slack integration and repository access.',
+      },
+    ],
+  },
+  {
+    id: 'project',
+    title: 'Project',
+    permissions: [
+      {
+        id: 'project:create',
+        title: 'Create project',
+        description: 'Member can create new projects.',
+      },
+      {
+        id: 'project:describe',
+        title: 'View project',
+        description: 'Member can access the specified projects.',
+      },
+      {
+        id: 'project:delete',
+        title: 'Delete project',
+        description: 'Member can access the specified projects.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'project:modifySettings',
+        title: 'Modify Settings',
+        description: 'Member can access the specified projects.',
+        dependsOn: 'project:describe',
+      },
+    ],
+  },
+  {
+    id: 'schema-linting',
+    title: 'Schema Linting',
+    permissions: [
+      {
+        id: 'schemaLinting:modifyOrganizationRules',
+        title: 'Manage organization level schema linting',
+        description: 'Member can view and modify the organization schema linting rules.',
+      },
+      {
+        id: 'schemaLinting:modifyProjectRules',
+        title: 'Manage project level schema linting',
+        description: 'Member can view and modify the projects schema linting rules.',
+        dependsOn: 'project:describe',
+      },
+    ],
+  },
+  {
+    id: 'target',
+    title: 'Target',
+    permissions: [
+      {
+        id: 'target:create',
+        title: 'Create target',
+        description: 'Member can create new projects.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'target:delete',
+        title: 'Delete target',
+        description: 'Member can access the specified projects.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'target:modifySettings',
+        title: 'Modify settings',
+        description: 'Member can access the specified projects.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'alert:modify',
+        title: 'Modify alerts',
+        description: 'Can create alerts for schema versions.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'schemaVersion:approve',
+        title: 'Approve schema version (legacy)',
+        description: 'Can approve schema versions on projects using the legacy registry model.',
+      },
+      {
+        id: 'targetAccessToken:modify',
+        title: 'Manage registry access tokens',
+        description: 'Allow managing access tokens for CLI and Usage Reporting.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'cdnAccessToken:modify',
+        title: 'Manage CDN access tokens',
+        description: 'Allow managing access tokens for the CDN.',
+        dependsOn: 'project:describe',
+      },
+    ],
+  },
+  {
+    id: 'laboratory',
+    title: 'Laboratory',
+    permissions: [
+      {
+        id: 'laboratory:describe',
+        title: 'View laboratory',
+        description: 'Member can access the laboratory, view and execute GraphQL documents.',
+        dependsOn: 'project:describe',
+      },
+      {
+        id: 'laboratory:modify',
+        title: 'Modify laboratory',
+        description:
+          'Member can create, delete and update collections and documents in the laboratory.',
+        dependsOn: 'laboratory:describe',
+      },
+      {
+        id: 'laboratory:modifyPreflightScript',
+        title: 'Modify the laboratory preflight script',
+        description: 'Member can update the laboratory preflight script.',
+        dependsOn: 'laboratory:describe',
+      },
+    ],
+  },
+  {
+    id: 'app-deployments',
+    title: 'App Deployments',
+    permissions: [
+      {
+        id: 'appDeployment:describe',
+        title: 'View app deployments',
+        description: 'Member can view app deployments.',
+        dependsOn: 'project:describe',
+      },
+    ],
+  },
+  {
+    id: 'schema-checks',
+    title: 'Schema Checks',
+    permissions: [
+      {
+        id: 'schemaCheck:approve',
+        title: 'Approve schema check',
+        description: 'Member can approve failed schema checks.',
+        dependsOn: 'project:describe',
+      },
+    ],
+  },
+] as const;
+
+function assertAllRulesAreAssigned(excluded: Array<Permission>) {
+  const p = new Set(allPermissions);
+  for (const item of excluded) {
+    p.delete(item);
+  }
+
+  for (const group of allPermissionGroups) {
+    for (const per of group.permissions) {
+      p.delete(per.id);
+    }
+  }
+
+  if (p.size) {
+    throw new Error('The following permissions are not assigned: \n' + Array.from(p).join(`\n`));
+  }
+}
+
+/**
+ * This seems like the easiest way to make sure that all the permissions we have are
+ * assignable and exposed via our API.
+ */
+assertAllRulesAreAssigned([
+  /** These are CLI only actions for now. */
+  'schema:loadFromRegistry',
+  'schema:compose',
+  'schemaCheck:create',
+  'schemaVersion:publish',
+  'schemaVersion:deleteService',
+  'appDeployment:create',
+  'appDeployment:publish',
+  'appDeployment:retire',
+]);
diff --git a/packages/services/api/src/modules/auth/module.graphql.mappers.ts b/packages/services/api/src/modules/auth/module.graphql.mappers.ts
index 9520d4e635..3ed4eec01e 100644
--- a/packages/services/api/src/modules/auth/module.graphql.mappers.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.mappers.ts
@@ -1,4 +1,5 @@
 import type { Member, User } from '../../shared/entities';
+import { PermissionGroup, PermissionRecord } from './lib/organization-member-permissions';
 import type { OrganizationAccessScope } from './providers/organization-access';
 import type { ProjectAccessScope } from './providers/project-access';
 import type { TargetAccessScope } from './providers/target-access';
@@ -10,3 +11,5 @@ export type UserConnectionMapper = readonly User[];
 export type MemberConnectionMapper = readonly Member[];
 export type MemberMapper = Member;
 export type UserMapper = User;
+export type PermissionGroupMapper = PermissionGroup;
+export type PermissionMapper = PermissionRecord;
diff --git a/packages/services/api/src/modules/auth/module.graphql.ts b/packages/services/api/src/modules/auth/module.graphql.ts
index 239db6ba17..a651f3133b 100644
--- a/packages/services/api/src/modules/auth/module.graphql.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.ts
@@ -110,4 +110,33 @@ export default gql`
     TOKENS_READ
     TOKENS_WRITE
   }
+
+  enum PermissionLevel {
+    organization
+    project
+    target
+    service
+    appDeployment
+  }
+
+  type Permission {
+    id: ID!
+    title: String!
+    description: String!
+    level: PermissionLevel!
+    dependsOnId: ID
+  }
+
+  type PermissionGroup {
+    id: ID!
+    title: String!
+    permissions: [Permission!]!
+  }
+
+  extend type Organization {
+    """
+    List of available permission groups that can be assigned to users.
+    """
+    availableMemberPermissionGroups: [PermissionGroup!]!
+  }
 `;
diff --git a/packages/services/api/src/modules/auth/resolvers/Organization.ts b/packages/services/api/src/modules/auth/resolvers/Organization.ts
new file mode 100644
index 0000000000..af78014f17
--- /dev/null
+++ b/packages/services/api/src/modules/auth/resolvers/Organization.ts
@@ -0,0 +1,21 @@
+import { allPermissionGroups } from '../lib/organization-member-permissions';
+import type { OrganizationResolvers } from './../../../__generated__/types';
+
+/*
+ * Note: This object type is generated because "OrganizationMapper" is declared. This is to ensure runtime safety.
+ *
+ * When a mapper is used, it is possible to hit runtime errors in some scenarios:
+ * - given a field name, the schema type's field type does not match mapper's field type
+ * - or a schema type's field does not exist in the mapper's fields
+ *
+ * If you want to skip this file generation, remove the mapper or update the pattern in the `resolverGeneration.object` config.
+ */
+export const Organization: Pick<
+  OrganizationResolvers,
+  'availableMemberPermissionGroups' | '__isTypeOf'
+> = {
+  /* Implement Organization resolver logic here */
+  availableMemberPermissionGroups: async (_parent, _arg, _ctx) => {
+    return allPermissionGroups;
+  },
+};
diff --git a/packages/services/api/src/modules/auth/resolvers/Permission.ts b/packages/services/api/src/modules/auth/resolvers/Permission.ts
new file mode 100644
index 0000000000..b8b6c29879
--- /dev/null
+++ b/packages/services/api/src/modules/auth/resolvers/Permission.ts
@@ -0,0 +1,21 @@
+import { getPermissionGroup } from '../lib/authz';
+import type { PermissionResolvers } from './../../../__generated__/types';
+
+/*
+ * Note: This object type is generated because "PermissionMapper" is declared. This is to ensure runtime safety.
+ *
+ * When a mapper is used, it is possible to hit runtime errors in some scenarios:
+ * - given a field name, the schema type's field type does not match mapper's field type
+ * - or a schema type's field does not exist in the mapper's fields
+ *
+ * If you want to skip this file generation, remove the mapper or update the pattern in the `resolverGeneration.object` config.
+ */
+export const Permission: PermissionResolvers = {
+  dependsOnId: async (parent, _arg, _ctx) => {
+    /* Permission.dependsOnId resolver is required because Permission.dependsOnId exists but PermissionMapper.dependsOnId does not */
+    return parent.dependsOn ?? null;
+  },
+  level: async (parent, _arg, _ctx) => {
+    return getPermissionGroup(parent.id);
+  },
+};
diff --git a/packages/services/api/src/modules/auth/resolvers/PermissionGroup.ts b/packages/services/api/src/modules/auth/resolvers/PermissionGroup.ts
new file mode 100644
index 0000000000..4486f36f03
--- /dev/null
+++ b/packages/services/api/src/modules/auth/resolvers/PermissionGroup.ts
@@ -0,0 +1,14 @@
+import type { PermissionGroupResolvers } from './../../../__generated__/types';
+
+/*
+ * Note: This object type is generated because "PermissionGroupMapper" is declared. This is to ensure runtime safety.
+ *
+ * When a mapper is used, it is possible to hit runtime errors in some scenarios:
+ * - given a field name, the schema type's field type does not match mapper's field type
+ * - or a schema type's field does not exist in the mapper's fields
+ *
+ * If you want to skip this file generation, remove the mapper or update the pattern in the `resolverGeneration.object` config.
+ */
+export const PermissionGroup: PermissionGroupResolvers = {
+  /* Implement PermissionGroup resolver logic here */
+};

From 8a046df5e55fbab4ffffb7c9d965f563b13c366a Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 3 Jan 2025 13:21:49 +0100
Subject: [PATCH 09/55] feat: permission picker and viewer

---
 .../lib/organization-member-permissions.ts    |   4 +-
 .../api/src/modules/auth/module.graphql.ts    |   1 +
 .../src/modules/auth/resolvers/Permission.ts  |  12 +-
 .../members/permission-selector.tsx           | 227 ++++++++++
 .../members/selected-permission-overview.tsx  | 181 ++++++++
 .../app/src/pages/organization-members.tsx    |   1 +
 .../stories/permission-selector.stories.tsx   |  53 +++
 .../selected-permission-overview.stories.tsx  |  55 +++
 packages/web/app/src/stories/utils.ts         | 388 ++++++++++++++++++
 9 files changed, 915 insertions(+), 7 deletions(-)
 create mode 100644 packages/web/app/src/components/organization/members/permission-selector.tsx
 create mode 100644 packages/web/app/src/components/organization/members/selected-permission-overview.tsx
 create mode 100644 packages/web/app/src/stories/permission-selector.stories.tsx
 create mode 100644 packages/web/app/src/stories/selected-permission-overview.stories.tsx
 create mode 100644 packages/web/app/src/stories/utils.ts

diff --git a/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts b/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
index 64149bb0d4..101d781cca 100644
--- a/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
@@ -5,7 +5,7 @@ export type PermissionRecord = {
   title: string;
   description: string;
   dependsOn?: Permission;
-  readOnly?: true;
+  isReadyOnly?: true;
 };
 
 export type PermissionGroup = {
@@ -23,7 +23,7 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         id: 'organization:describe',
         title: 'View organization',
         description: 'Member can see the organization. Permission can not be modified.',
-        readOnly: true,
+        isReadyOnly: true,
       },
       {
         id: 'support:manageTickets',
diff --git a/packages/services/api/src/modules/auth/module.graphql.ts b/packages/services/api/src/modules/auth/module.graphql.ts
index a651f3133b..6ad050a05d 100644
--- a/packages/services/api/src/modules/auth/module.graphql.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.ts
@@ -125,6 +125,7 @@ export default gql`
     description: String!
     level: PermissionLevel!
     dependsOnId: ID
+    isReadOnly: Boolean!
   }
 
   type PermissionGroup {
diff --git a/packages/services/api/src/modules/auth/resolvers/Permission.ts b/packages/services/api/src/modules/auth/resolvers/Permission.ts
index b8b6c29879..ebad4c0c39 100644
--- a/packages/services/api/src/modules/auth/resolvers/Permission.ts
+++ b/packages/services/api/src/modules/auth/resolvers/Permission.ts
@@ -11,11 +11,13 @@ import type { PermissionResolvers } from './../../../__generated__/types';
  * If you want to skip this file generation, remove the mapper or update the pattern in the `resolverGeneration.object` config.
  */
 export const Permission: PermissionResolvers = {
-  dependsOnId: async (parent, _arg, _ctx) => {
-    /* Permission.dependsOnId resolver is required because Permission.dependsOnId exists but PermissionMapper.dependsOnId does not */
-    return parent.dependsOn ?? null;
+  dependsOnId: async (permission, _arg, _ctx) => {
+    return permission.dependsOn ?? null;
   },
-  level: async (parent, _arg, _ctx) => {
-    return getPermissionGroup(parent.id);
+  isReadOnly: (permission, _arg, _ctx) => {
+    return permission.isReadyOnly ?? false;
+  },
+  level: async (permission, _arg, _ctx) => {
+    return getPermissionGroup(permission.id);
   },
 };
diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
new file mode 100644
index 0000000000..feefe18ec6
--- /dev/null
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -0,0 +1,227 @@
+import { useMemo, useRef, useState } from 'react';
+import { InfoIcon } from 'lucide-react';
+import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+} from '@/components/ui/accordion';
+import { Button } from '@/components/ui/button';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
+import { FragmentType, graphql, useFragment } from '@/gql';
+import { cn } from '@/lib/utils';
+import { ResultOf } from '@graphql-typed-document-node/core';
+
+export const PermissionSelector_OrganizationFragment = graphql(`
+  fragment PermissionSelector_OrganizationFragment on Organization {
+    id
+    availableMemberPermissionGroups {
+      id
+      title
+      permissions {
+        id
+        dependsOnId
+        description
+        level
+        title
+        isReadOnly
+      }
+    }
+  }
+`);
+
+type AvailableMembershipPermissions = ResultOf<
+  typeof PermissionSelector_OrganizationFragment
+>['availableMemberPermissionGroups'];
+
+type MembershipPermissionGroup = AvailableMembershipPermissions[number];
+
+export type PermissionSelectorProps = {
+  organization: FragmentType<typeof PermissionSelector_OrganizationFragment>;
+  selectedPermissionIds: ReadonlySet<string>;
+  onSelectedPermissionsChange: (selectedPermissionIds: ReadonlySet<string>) => void;
+};
+
+export function PermissionSelector(props: PermissionSelectorProps) {
+  const organization = useFragment(PermissionSelector_OrganizationFragment, props.organization);
+  const [filteredGroups, permissionGroupMapping] = useMemo(() => {
+    const filteredGroups: Array<
+      MembershipPermissionGroup & {
+        selectedPermissionCount: number;
+      }
+    > = [];
+    const permissionGroupMapping = new Map<string, string>();
+
+    for (const group of organization.availableMemberPermissionGroups) {
+      let selectedPermissionCount = 0;
+
+      for (const permission of group.permissions) {
+        if (props.selectedPermissionIds.has(permission.id)) {
+          selectedPermissionCount++;
+        }
+      }
+
+      filteredGroups.push({
+        ...group,
+        selectedPermissionCount,
+      });
+    }
+
+    return [filteredGroups, permissionGroupMapping] as const;
+  }, [organization.availableMemberPermissionGroups]);
+
+  const permissionRefs = useRef(new Map<string, HTMLElement>());
+  const [focusedPermission, setFocusedPermission] = useState(null as string | null);
+  const [openAccordions, setOpenAccordions] = useState([] as Array<string>);
+
+  return (
+    <Accordion
+      type="multiple"
+      className="w-full"
+      value={openAccordions}
+      onValueChange={values => setOpenAccordions(values)}
+    >
+      {filteredGroups.map(group => {
+        const dependencyGraph = new Map<string, Array<string>>();
+        for (const permission of group.permissions) {
+          if (!permission.dependsOnId) {
+            continue;
+          }
+          let arr = dependencyGraph.get(permission.dependsOnId);
+          if (!arr) {
+            arr = [];
+            dependencyGraph.set(permission.dependsOnId, arr);
+          }
+          arr.push(permission.id);
+        }
+
+        return (
+          <AccordionItem value={group.title} key={group.title}>
+            <AccordionTrigger className="w-full" key={group.title}>
+              {group.title}{' '}
+              <span className="ml-auto mr-0">
+                {group.selectedPermissionCount > 0 && (
+                  <span className="mr-1 inline-block text-sm">
+                    {group.selectedPermissionCount} selected
+                  </span>
+                )}
+              </span>
+            </AccordionTrigger>
+            <AccordionContent className="pl-2 pt-1" forceMount>
+              {group.permissions.map(permission => {
+                const needsDependency =
+                  !!permission.dependsOnId &&
+                  !props.selectedPermissionIds.has(permission.dependsOnId);
+
+                return (
+                  <div
+                    className={cn(
+                      'flex flex-row items-center justify-between space-x-4 border-orange-500 pb-2 text-sm',
+                      focusedPermission === permission.id && '-m-[1px] border',
+                    )}
+                    key={permission.id}
+                    data-permission-id={permission.id}
+                    ref={ref => {
+                      if (ref) {
+                        permissionRefs.current.set(permission.id, ref);
+                      }
+                    }}
+                  >
+                    <div className={cn(needsDependency && 'opacity-30')}>
+                      <div className="font-semibold text-white">{permission.title}</div>
+                      <div className="text-xs text-gray-400">{permission.description}</div>
+                    </div>
+                    {!!permission.dependsOnId &&
+                      permissionGroupMapping.has(permission.dependsOnId) && (
+                        <div className="flex grow justify-end">
+                          <TooltipProvider>
+                            <Tooltip>
+                              <TooltipTrigger>
+                                <InfoIcon />
+                              </TooltipTrigger>
+                              <TooltipContent>
+                                <p>
+                                  This permission depends on another permission.{' '}
+                                  <Button
+                                    variant="orangeLink"
+                                    onClick={() => {
+                                      const dependencyPermission = permission.dependsOnId;
+                                      if (!dependencyPermission) {
+                                        return;
+                                      }
+                                      const element =
+                                        permissionRefs.current.get(dependencyPermission);
+
+                                      if (!element) {
+                                        return;
+                                      }
+                                      setOpenAccordions(values => {
+                                        const groupName =
+                                          permissionGroupMapping.get(dependencyPermission);
+
+                                        if (groupName && values.includes(groupName) === false) {
+                                          return [...values, groupName];
+                                        }
+                                        return values;
+                                      });
+                                      setFocusedPermission(dependencyPermission);
+                                      element.scrollIntoView({ behavior: 'smooth' });
+                                    }}
+                                  >
+                                    View permission.
+                                  </Button>
+                                </p>
+                              </TooltipContent>
+                            </Tooltip>
+                          </TooltipProvider>
+                        </div>
+                      )}
+                    <Select
+                      disabled={permission.isReadOnly || needsDependency}
+                      value={
+                        permission.isReadOnly || props.selectedPermissionIds.has(permission.id)
+                          ? 'allow'
+                          : 'not-selected'
+                      }
+                      onValueChange={value => {
+                        const dependents = dependencyGraph.get(permission.id) ?? [];
+                        if (value === 'allow') {
+                          props.onSelectedPermissionsChange(
+                            new Set([...props.selectedPermissionIds, permission.id]),
+                          );
+                        } else if (value === 'not-selected') {
+                          const selectedPermissionIds = new Set(props.selectedPermissionIds);
+                          selectedPermissionIds.delete(permission.id);
+                          for (const dependent of dependents) {
+                            selectedPermissionIds.delete(dependent);
+                          }
+                          props.onSelectedPermissionsChange(selectedPermissionIds);
+                        }
+                        setFocusedPermission(null);
+                      }}
+                    >
+                      <SelectTrigger className="w-[150px] shrink-0">
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="not-selected">Not Selected</SelectItem>
+                        <SelectItem value="allow">Allow</SelectItem>
+                      </SelectContent>
+                    </Select>
+                  </div>
+                );
+              })}
+            </AccordionContent>
+          </AccordionItem>
+        );
+      })}
+    </Accordion>
+  );
+}
diff --git a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
new file mode 100644
index 0000000000..73c339ca88
--- /dev/null
+++ b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
@@ -0,0 +1,181 @@
+import { useMemo } from 'react';
+import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+} from '@/components/ui/accordion';
+import { CheckIcon, XIcon } from '@/components/ui/icon';
+import { FragmentType, graphql, useFragment } from '@/gql';
+import { PermissionLevel } from '@/gql/graphql';
+import { ResultOf } from '@graphql-typed-document-node/core';
+
+export const SelectedPermissionOverview_MemberPermissionGroupsFragment = graphql(`
+  fragment SelectedPermissionOverview_MemberPermissionGroupsFragment on Organization {
+    availableMemberPermissionGroups {
+      id
+      title
+      permissions {
+        id
+        dependsOnId
+        description
+        level
+        title
+      }
+    }
+  }
+`);
+
+export type SelectedPermissionOverviewProps = {
+  organization: FragmentType<typeof SelectedPermissionOverview_MemberPermissionGroupsFragment>;
+  activePermissionIds: Array<string>;
+  showOnlyAllowedPermissions: boolean;
+};
+
+export function SelectedPermissionOverview(props: SelectedPermissionOverviewProps) {
+  const organization = useFragment(
+    SelectedPermissionOverview_MemberPermissionGroupsFragment,
+    props.organization,
+  );
+  const activePermissionIds = useMemo<ReadonlySet<string>>(
+    () => new Set(props.activePermissionIds),
+    [props.activePermissionIds],
+  );
+
+  // TODO: maybe these should also be sent from the API, so it is the full source of truth
+  return [
+    {
+      level: PermissionLevel.Organization,
+      title: 'Organization',
+    },
+    {
+      level: PermissionLevel.Project,
+      title: 'Project',
+    },
+    {
+      level: PermissionLevel.Target,
+      title: 'Target',
+    },
+    {
+      level: PermissionLevel.Service,
+      title: 'Service',
+    },
+    {
+      level: PermissionLevel.AppDeployment,
+      title: 'App Deployment',
+    },
+  ].map(group => (
+    <PermissionLevelGroup
+      key={group.level}
+      permissionLevel={group.level}
+      title={group.title}
+      activePermissionIds={activePermissionIds}
+      memberPermissionGroups={organization.availableMemberPermissionGroups}
+      showOnlyAllowedPermissions={props.showOnlyAllowedPermissions}
+    />
+  ));
+}
+
+type AvailableMembershipPermissions = ResultOf<
+  typeof SelectedPermissionOverview_MemberPermissionGroupsFragment
+>['availableMemberPermissionGroups'];
+
+type MembershipPermissionGroup = AvailableMembershipPermissions[number];
+
+function PermissionLevelGroup(props: {
+  title: string;
+  permissionLevel: PermissionLevel;
+  memberPermissionGroups: AvailableMembershipPermissions;
+  activePermissionIds: ReadonlySet<string>;
+  /** whether only allowed permissions should be shown */
+  showOnlyAllowedPermissions: boolean;
+}) {
+  const [filteredGroups, totalAllowedCount] = useMemo(() => {
+    let totalAllowedCount = 0;
+    const filteredGroups: Array<
+      MembershipPermissionGroup & {
+        totalAllowedCount: number;
+      }
+    > = [];
+    for (const group of props.memberPermissionGroups) {
+      let groupTotalAllowedCount = 0;
+
+      const filteredPermissions = group.permissions.filter(permission => {
+        if (permission.level !== props.permissionLevel) {
+          return false;
+        }
+
+        if (props.activePermissionIds.has(permission.id)) {
+          totalAllowedCount++;
+          groupTotalAllowedCount++;
+        }
+
+        return true;
+      });
+
+      if (filteredPermissions.length === 0) {
+        continue;
+      }
+
+      filteredGroups.push({
+        ...group,
+        permissions: filteredPermissions,
+        totalAllowedCount: groupTotalAllowedCount,
+      });
+    }
+
+    return [filteredGroups, totalAllowedCount];
+  }, [props.permissionLevel, props.activePermissionIds, props.memberPermissionGroups]);
+
+  if (totalAllowedCount === 0 && props.showOnlyAllowedPermissions) {
+    // hide group fully if no permissions are selected
+    return null;
+  }
+
+  return (
+    <Accordion
+      type="single"
+      defaultValue={totalAllowedCount > 0 ? props.title : undefined}
+      collapsible
+    >
+      <AccordionItem value={props.title}>
+        <AccordionTrigger className="w-full">
+          {props.title}
+          <span className="ml-auto mr-2">{totalAllowedCount} allowed</span>
+        </AccordionTrigger>
+        <AccordionContent className="ml-1 flex max-w-[800px] flex-wrap items-start overflow-x-scroll">
+          {filteredGroups.map(group =>
+            props.showOnlyAllowedPermissions && group.totalAllowedCount === 0 ? null : (
+              <div className="w-[50%] min-w-[400px] pb-4 pr-12" key={group.id}>
+                <table key={group.title} className="w-full">
+                  <tr>
+                    <th className="pb-2 text-left">{group.title}</th>
+                  </tr>
+                  {group.permissions.map(permission =>
+                    props.showOnlyAllowedPermissions &&
+                    props.activePermissionIds.has(permission.id) === false ? null : (
+                      <tr key={permission.id}>
+                        <td>{permission.title}</td>
+                        <td className="ml-2 text-right">
+                          {props.activePermissionIds.has(permission.id) ? (
+                            <span className="text-green-500">
+                              <CheckIcon className="inline size-4" /> Allowed
+                            </span>
+                          ) : (
+                            <span>
+                              <XIcon className="inline size-4" /> Deny
+                            </span>
+                          )}
+                        </td>
+                      </tr>
+                    ),
+                  )}
+                </table>
+              </div>
+            ),
+          )}
+        </AccordionContent>
+      </AccordionItem>
+    </Accordion>
+  );
+}
diff --git a/packages/web/app/src/pages/organization-members.tsx b/packages/web/app/src/pages/organization-members.tsx
index bb4eb437bf..f01b7a3d24 100644
--- a/packages/web/app/src/pages/organization-members.tsx
+++ b/packages/web/app/src/pages/organization-members.tsx
@@ -17,6 +17,7 @@ const OrganizationMembersPage_OrganizationFragment = graphql(`
     ...OrganizationInvitations_OrganizationFragment
     ...OrganizationMemberRoles_OrganizationFragment
     ...OrganizationMembers_OrganizationFragment
+    ...SelectedPermissionOverview_MemberPermissionGroupsFragment
     viewerCanManageInvitations
     viewerCanManageRoles
   }
diff --git a/packages/web/app/src/stories/permission-selector.stories.tsx b/packages/web/app/src/stories/permission-selector.stories.tsx
new file mode 100644
index 0000000000..6a7d44bf1a
--- /dev/null
+++ b/packages/web/app/src/stories/permission-selector.stories.tsx
@@ -0,0 +1,53 @@
+import { useState } from 'react';
+import { makeFragmentData } from '@/gql';
+import { Meta, StoryObj } from '@storybook/react';
+import {
+  PermissionSelector,
+  PermissionSelector_OrganizationFragment,
+  PermissionSelectorProps,
+} from '../components/organization/members/permission-selector';
+import { availableMemberPermissionGroups } from './utils';
+
+const meta: Meta<typeof PermissionSelector> = {
+  title: 'Permission Selector',
+  component: PermissionSelector,
+};
+
+export default meta;
+
+type Story = StoryObj<typeof PermissionSelector>;
+
+const defaultProps: Omit<
+  PermissionSelectorProps,
+  'selectedPermissionIds' | 'onSelectedPermissionsChange'
+> = {
+  organization: makeFragmentData(
+    {
+      __typename: 'Organization',
+      id: 'foo',
+      availableMemberPermissionGroups: availableMemberPermissionGroups as any,
+    },
+    PermissionSelector_OrganizationFragment,
+  ),
+};
+
+function Template(args: PermissionSelectorProps) {
+  const [selectedPermissionIds, setSelectedPermissionIds] = useState(() => new Set<string>());
+
+  return (
+    <PermissionSelector
+      {...defaultProps}
+      {...args}
+      selectedPermissionIds={selectedPermissionIds}
+      onSelectedPermissionsChange={set => {
+        setSelectedPermissionIds(new Set(set));
+      }}
+    />
+  );
+}
+
+export const Default: Story = {
+  name: 'Default',
+  render: Template,
+  args: {},
+};
diff --git a/packages/web/app/src/stories/selected-permission-overview.stories.tsx b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
new file mode 100644
index 0000000000..690a76ab43
--- /dev/null
+++ b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
@@ -0,0 +1,55 @@
+import { makeFragmentData } from '@/gql';
+import { Meta, StoryObj } from '@storybook/react';
+import {
+  SelectedPermissionOverview,
+  SelectedPermissionOverview_MemberPermissionGroupsFragment,
+  SelectedPermissionOverviewProps,
+} from '../components/organization/members/selected-permission-overview';
+import { availableMemberPermissionGroups } from './utils';
+
+const meta: Meta<typeof SelectedPermissionOverview> = {
+  title: 'Selected Permission Overview',
+  component: SelectedPermissionOverview,
+};
+
+export default meta;
+type Story = StoryObj<typeof SelectedPermissionOverview>;
+
+const defaultProps: SelectedPermissionOverviewProps = {
+  organization: makeFragmentData(
+    {
+      __typename: 'Organization',
+      availableMemberPermissionGroups: availableMemberPermissionGroups as any,
+    },
+    SelectedPermissionOverview_MemberPermissionGroupsFragment,
+  ),
+  activePermissionIds: [],
+  showOnlyAllowedPermissions: false,
+};
+
+function Template(args: SelectedPermissionOverviewProps) {
+  return <SelectedPermissionOverview {...defaultProps} {...args} />;
+}
+
+export const Default: Story = {
+  name: 'Default',
+  render: Template,
+  args: {
+    activePermissionIds: [],
+    showOnlyAllowedPermissions: false,
+  },
+};
+
+export const OnlyAllowedPermissions: Story = {
+  name: 'OnlyAllowedPermissions',
+  render: Template,
+  args: {
+    activePermissionIds: [
+      'organization:describe',
+      'billing:describe',
+      'billing:update',
+      'project:describe',
+    ],
+    showOnlyAllowedPermissions: true,
+  },
+};
diff --git a/packages/web/app/src/stories/utils.ts b/packages/web/app/src/stories/utils.ts
new file mode 100644
index 0000000000..eafc348411
--- /dev/null
+++ b/packages/web/app/src/stories/utils.ts
@@ -0,0 +1,388 @@
+import { Organization, PermissionLevel } from '@/gql/graphql';
+
+export const availableMemberPermissionGroups: Organization['availableMemberPermissionGroups'] = [
+  {
+    __typename: 'PermissionGroup',
+    id: 'organization',
+    title: 'Organization',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: true,
+        id: 'organization:describe',
+        dependsOnId: null,
+        description: 'Member can see the organization. Permission can not be modified.',
+        level: PermissionLevel.Organization,
+        title: 'View organization',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'support:manageTickets',
+        dependsOnId: null,
+        description: 'Member can access, create and reply to support tickets.',
+        level: PermissionLevel.Organization,
+        title: 'Access support tickets',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'organization:modifySlug',
+        dependsOnId: null,
+        description: 'Member can modify the organization slug.',
+        level: PermissionLevel.Organization,
+        title: 'Update organization slug',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'auditLog:export',
+        dependsOnId: null,
+        description: 'Member can access and export the audit log.',
+        level: PermissionLevel.Organization,
+        title: 'Export audit log',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'organization:delete',
+        dependsOnId: null,
+        description: 'Member can delete the Organization.',
+        level: PermissionLevel.Organization,
+        title: 'Delete organization',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'members',
+    title: 'Members',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'member:describe',
+        dependsOnId: null,
+        description: 'Member can access the organization member overview.',
+        level: PermissionLevel.Organization,
+        title: 'View members',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'member:assignRole',
+        dependsOnId: 'member:describe',
+        description: 'Member can assign roles to users.',
+        level: PermissionLevel.Organization,
+        title: 'Assign member role',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'member:modifyRole',
+        dependsOnId: 'member:describe',
+        description: 'Member can modify, create and delete roles.',
+        level: PermissionLevel.Organization,
+        title: 'Modify member role',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'member:removeMember',
+        dependsOnId: 'member:describe',
+        description: 'Member can remove users from the organization.',
+        level: PermissionLevel.Organization,
+        title: 'Remove member',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'member:manageInvites',
+        dependsOnId: 'member:describe',
+        description: 'Member can invite users via email and modify or delete pending invites.',
+        level: PermissionLevel.Organization,
+        title: 'Manage invites',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'billing',
+    title: 'Billing',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'billing:describe',
+        dependsOnId: null,
+        description: 'Member can view the billing information.',
+        level: PermissionLevel.Organization,
+        title: 'View billing',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'billing:update',
+        dependsOnId: 'billing:describe',
+        description: 'Member can change the organization plan.',
+        level: PermissionLevel.Organization,
+        title: 'Update billing',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'oidc',
+    title: 'OpenID Connect',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'oidc:modify',
+        dependsOnId: null,
+        description: 'Member can connect, modify, and remove an OIDC provider to the connection.',
+        level: PermissionLevel.Organization,
+        title: 'Manage OpenID Connect integration',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'github',
+    title: 'GitHub Integration',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'gitHubIntegration:modify',
+        dependsOnId: null,
+        description:
+          'Member can connect, modify, and remove access for the GitHub integration and repository access.',
+        level: PermissionLevel.Organization,
+        title: 'Manage GitHub integration',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'slack',
+    title: 'Slack Integration',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'slackIntegration:modify',
+        dependsOnId: null,
+        description:
+          'Member can connect, modify, and remove access for the Slack integration and repository access.',
+        level: PermissionLevel.Organization,
+        title: 'Manage Slack integration',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'project',
+    title: 'Project',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'project:create',
+        dependsOnId: null,
+        description: 'Member can create new projects.',
+        level: PermissionLevel.Organization,
+        title: 'Create project',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'project:describe',
+        dependsOnId: null,
+        description: 'Member can access the specified projects.',
+        level: PermissionLevel.Project,
+        title: 'View project',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'project:delete',
+        dependsOnId: 'project:describe',
+        description: 'Member can access the specified projects.',
+        level: PermissionLevel.Project,
+        title: 'Delete project',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'project:modifySettings',
+        dependsOnId: 'project:describe',
+        description: 'Member can access the specified projects.',
+        level: PermissionLevel.Project,
+        title: 'Modify Settings',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'schema-linting',
+    title: 'Schema Linting',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'schemaLinting:modifyOrganizationRules',
+        dependsOnId: null,
+        description: 'Member can view and modify the organization schema linting rules.',
+        level: PermissionLevel.Organization,
+        title: 'Manage organization level schema linting',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'schemaLinting:modifyProjectRules',
+        dependsOnId: 'project:describe',
+        description: 'Member can view and modify the projects schema linting rules.',
+        level: PermissionLevel.Project,
+        title: 'Manage project level schema linting',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'target',
+    title: 'Target',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'target:create',
+        dependsOnId: 'project:describe',
+        description: 'Member can create new projects.',
+        level: PermissionLevel.Project,
+        title: 'Create target',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'target:delete',
+        dependsOnId: 'project:describe',
+        description: 'Member can access the specified projects.',
+        level: PermissionLevel.Target,
+        title: 'Delete target',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'target:modifySettings',
+        dependsOnId: 'project:describe',
+        description: 'Member can access the specified projects.',
+        level: PermissionLevel.Target,
+        title: 'Modify settings',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'alert:modify',
+        dependsOnId: 'project:describe',
+        description: 'Can create alerts for schema versions.',
+        level: PermissionLevel.Project,
+        title: 'Modify alerts',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'schemaVersion:approve',
+        dependsOnId: null,
+        description: 'Can approve schema versions on projects using the legacy registry model.',
+        level: PermissionLevel.Target,
+        title: 'Approve schema version (legacy)',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'targetAccessToken:modify',
+        dependsOnId: 'project:describe',
+        description: 'Allow managing access tokens for CLI and Usage Reporting.',
+        level: PermissionLevel.Target,
+        title: 'Manage registry access tokens',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'cdnAccessToken:modify',
+        dependsOnId: 'project:describe',
+        description: 'Allow managing access tokens for the CDN.',
+        level: PermissionLevel.Target,
+        title: 'Manage CDN access tokens',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'laboratory',
+    title: 'Laboratory',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'laboratory:describe',
+        dependsOnId: 'project:describe',
+        description: 'Member can access the laboratory, view and execute GraphQL documents.',
+        level: PermissionLevel.Target,
+        title: 'View laboratory',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'laboratory:modify',
+        dependsOnId: 'laboratory:describe',
+        description:
+          'Member can create, delete and update collections and documents in the laboratory.',
+        level: PermissionLevel.Target,
+        title: 'Modify laboratory',
+      },
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'laboratory:modifyPreflightScript',
+        dependsOnId: 'laboratory:describe',
+        description: 'Member can update the laboratory preflight script.',
+        level: PermissionLevel.Target,
+        title: 'Modify the laboratory preflight script',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'app-deployments',
+    title: 'App Deployments',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'appDeployment:describe',
+        dependsOnId: 'project:describe',
+        description: 'Member can view app deployments.',
+        level: PermissionLevel.Target,
+        title: 'View app deployments',
+      },
+    ],
+  },
+  {
+    __typename: 'PermissionGroup',
+    id: 'schema-checks',
+    title: 'Schema Checks',
+    permissions: [
+      {
+        __typename: 'Permission',
+        isReadOnly: false,
+        id: 'schemaCheck:approve',
+        dependsOnId: 'project:describe',
+        description: 'Member can approve failed schema checks.',
+        level: PermissionLevel.Service,
+        title: 'Approve schema check',
+      },
+    ],
+  },
+];

From 422f62b5e737c6ca4740ac531e77ef747f66ed26 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 3 Jan 2025 14:34:46 +0100
Subject: [PATCH 10/55] fix hints

---
 .../members/permission-selector.tsx           | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index feefe18ec6..959a9112f1 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -51,13 +51,14 @@ export type PermissionSelectorProps = {
 
 export function PermissionSelector(props: PermissionSelectorProps) {
   const organization = useFragment(PermissionSelector_OrganizationFragment, props.organization);
-  const [filteredGroups, permissionGroupMapping] = useMemo(() => {
+  const [groups, permissionToGroupTitleMapping, dependencyGraph] = useMemo(() => {
     const filteredGroups: Array<
       MembershipPermissionGroup & {
         selectedPermissionCount: number;
       }
     > = [];
-    const permissionGroupMapping = new Map<string, string>();
+    const permissionToGroupTitleMapping = new Map<string, string>();
+    const dependencyGraph = new Map<string, Array<string>>();
 
     for (const group of organization.availableMemberPermissionGroups) {
       let selectedPermissionCount = 0;
@@ -66,6 +67,16 @@ export function PermissionSelector(props: PermissionSelectorProps) {
         if (props.selectedPermissionIds.has(permission.id)) {
           selectedPermissionCount++;
         }
+
+        if (permission.dependsOnId) {
+          let arr = dependencyGraph.get(permission.dependsOnId);
+          if (!arr) {
+            arr = [];
+            dependencyGraph.set(permission.dependsOnId, arr);
+          }
+          arr.push(permission.id);
+        }
+        permissionToGroupTitleMapping.set(permission.id, group.title);
       }
 
       filteredGroups.push({
@@ -74,7 +85,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
       });
     }
 
-    return [filteredGroups, permissionGroupMapping] as const;
+    return [filteredGroups, permissionToGroupTitleMapping, dependencyGraph] as const;
   }, [organization.availableMemberPermissionGroups]);
 
   const permissionRefs = useRef(new Map<string, HTMLElement>());
@@ -88,20 +99,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
       value={openAccordions}
       onValueChange={values => setOpenAccordions(values)}
     >
-      {filteredGroups.map(group => {
-        const dependencyGraph = new Map<string, Array<string>>();
-        for (const permission of group.permissions) {
-          if (!permission.dependsOnId) {
-            continue;
-          }
-          let arr = dependencyGraph.get(permission.dependsOnId);
-          if (!arr) {
-            arr = [];
-            dependencyGraph.set(permission.dependsOnId, arr);
-          }
-          arr.push(permission.id);
-        }
-
+      {groups.map(group => {
         return (
           <AccordionItem value={group.title} key={group.title}>
             <AccordionTrigger className="w-full" key={group.title}>
@@ -139,7 +137,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                       <div className="text-xs text-gray-400">{permission.description}</div>
                     </div>
                     {!!permission.dependsOnId &&
-                      permissionGroupMapping.has(permission.dependsOnId) && (
+                      permissionToGroupTitleMapping.has(permission.dependsOnId) && (
                         <div className="flex grow justify-end">
                           <TooltipProvider>
                             <Tooltip>
@@ -164,7 +162,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                                       }
                                       setOpenAccordions(values => {
                                         const groupName =
-                                          permissionGroupMapping.get(dependencyPermission);
+                                          permissionToGroupTitleMapping.get(dependencyPermission);
 
                                         if (groupName && values.includes(groupName) === false) {
                                           return [...values, groupName];

From ec66b1790110726dff0f94cc5a131d98663dc089 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 3 Jan 2025 14:34:54 +0100
Subject: [PATCH 11/55] db types brr

---
 packages/services/storage/src/db/types.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/services/storage/src/db/types.ts b/packages/services/storage/src/db/types.ts
index deb2a52f97..9102b23e57 100644
--- a/packages/services/storage/src/db/types.ts
+++ b/packages/services/storage/src/db/types.ts
@@ -191,7 +191,8 @@ export interface organization_member_roles {
   locked: boolean;
   name: string;
   organization_id: string;
-  scopes: Array<string>;
+  permissions: Array<string> | null;
+  scopes: Array<string> | null;
 }
 
 export interface organizations {

From 0ab8aee0a9dd1f2174d3d1b91d4a16af56b3eb49 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 10 Jan 2025 17:01:50 +0100
Subject: [PATCH 12/55] wip

---
 codegen.mts                                   |  24 +-
 ...-00-00.granular-member-role-permissions.ts |  11 +
 packages/services/api/src/index.ts            |   3 +-
 .../modules/auth/lib/supertokens-strategy.ts  | 103 ++--
 .../modules/auth/module.graphql.mappers.ts    |   9 +-
 .../api/src/modules/auth/module.graphql.ts    |  21 -
 .../auth/providers/organization-members.ts    | 550 ------------------
 .../api/src/modules/auth/resolvers/Member.ts  |  32 -
 .../modules/auth/resolvers/Organization.ts    |  21 -
 .../api/src/modules/organization/index.ts     |   4 +-
 .../lib/organization-member-permissions.ts    |  45 +-
 .../organization/module.graphql.mappers.ts    |   5 +-
 .../modules/organization/module.graphql.ts    |  34 +-
 .../providers/organization-manager.ts         | 414 +++++--------
 .../providers/organization-member-roles.ts    | 316 ++++++++++
 .../providers/organization-members.ts         | 363 ++++++++++++
 .../modules/organization/resolvers/Member.ts  |  30 +-
 .../resolvers/MemberConnection.ts             |   2 +-
 .../organization/resolvers/MemberRole.ts      |  85 +--
 .../resolvers/Mutation/assignMemberRole.ts    |   5 +-
 .../resolvers/Mutation/createMemberRole.ts    |  29 +-
 .../resolvers/Mutation/updateMemberRole.ts    |  30 +-
 .../organization/resolvers/Organization.ts    |  40 +-
 .../resolvers/OrganizationInvitation.ts       |   8 +
 .../src/modules/shared/providers/storage.ts   |  30 -
 .../support/providers/support-manager.ts      |  24 +-
 .../modules/token/providers/token-manager.ts  |  34 +-
 packages/services/api/src/shared/entities.ts  |  25 +-
 packages/services/server/src/index.ts         |   7 +-
 packages/services/storage/src/index.ts        | 114 +---
 .../src/components/layouts/organization.tsx   |   3 -
 .../components/organization/Permissions.tsx   | 201 -------
 .../components/organization/members/list.tsx  |  71 +--
 .../components/organization/members/roles.tsx | 439 ++++++--------
 .../members/selected-permission-overview.tsx  |  19 +-
 .../target/settings/registry-access-token.tsx |   2 +-
 .../web/app/src/lib/access/organization.ts    |  56 --
 packages/web/app/src/lib/access/project.ts    |  59 --
 packages/web/app/src/lib/access/target.ts     |  24 -
 .../use-operation-collections-plugin.tsx      |   9 -
 .../app/src/pages/organization-members.tsx    |   2 +-
 packages/web/app/src/pages/project-policy.tsx |   4 -
 .../web/app/src/pages/project-settings.tsx    |   4 -
 .../web/app/src/pages/target-settings.tsx     |  69 +--
 packages/web/app/src/pages/target.tsx         |  22 +-
 .../selected-permission-overview.stories.tsx  |   4 +-
 46 files changed, 1299 insertions(+), 2107 deletions(-)
 create mode 100644 packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
 delete mode 100644 packages/services/api/src/modules/auth/providers/organization-members.ts
 delete mode 100644 packages/services/api/src/modules/auth/resolvers/Member.ts
 delete mode 100644 packages/services/api/src/modules/auth/resolvers/Organization.ts
 rename packages/services/api/src/modules/{auth => organization}/lib/organization-member-permissions.ts (87%)
 create mode 100644 packages/services/api/src/modules/organization/providers/organization-member-roles.ts
 create mode 100644 packages/services/api/src/modules/organization/providers/organization-members.ts
 rename packages/services/api/src/modules/{auth => organization}/resolvers/MemberConnection.ts (90%)
 delete mode 100644 packages/web/app/src/lib/access/organization.ts
 delete mode 100644 packages/web/app/src/lib/access/project.ts
 delete mode 100644 packages/web/app/src/lib/access/target.ts

diff --git a/codegen.mts b/codegen.mts
index ae23bb9ff7..0f0e796ed4 100644
--- a/codegen.mts
+++ b/codegen.mts
@@ -102,18 +102,18 @@ const config: CodegenConfig = {
       plugins: ['typescript', 'typescript-operations'],
     },
     // Integration tests
-    './integration-tests/testkit/gql/': {
-      documents: ['./integration-tests/(testkit|tests)/**/*.ts'],
-      preset: 'client',
-      plugins: [],
-      config: {
-        scalars: {
-          DateTime: 'string',
-          Date: 'string',
-          SafeInt: 'number',
-        },
-      },
-    },
+    // './integration-tests/testkit/gql/': {
+    //   documents: ['./integration-tests/(testkit|tests)/**/*.ts'],
+    //   preset: 'client',
+    //   plugins: [],
+    //   config: {
+    //     scalars: {
+    //       DateTime: 'string',
+    //       Date: 'string',
+    //       SafeInt: 'number',
+    //     },
+    //   },
+    // },
   },
 };
 
diff --git a/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts b/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
new file mode 100644
index 0000000000..8e1e01fe8d
--- /dev/null
+++ b/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
@@ -0,0 +1,11 @@
+import { type MigrationExecutor } from '../pg-migrator';
+
+export default {
+  name: '2025-01-30T00-00-00.granular-member-role-permissions.ts',
+  run: ({ sql }) => sql`
+    ALTER TABLE "organization_member_roles"
+      ALTER "scopes" DROP NOT NULL
+      , ADD COLUMN "permissions" text[]
+    ;
+  `,
+} satisfies MigrationExecutor;
diff --git a/packages/services/api/src/index.ts b/packages/services/api/src/index.ts
index 591d8b52f7..96e0591a70 100644
--- a/packages/services/api/src/index.ts
+++ b/packages/services/api/src/index.ts
@@ -37,4 +37,5 @@ export {
   ProjectAccessScope,
   TargetAccessScope,
 } from './__generated__/types';
-export { OrganizationMembers } from './modules/auth/providers/organization-members';
+export { OrganizationMembers } from './modules/organization/providers/organization-members';
+export { OrganizationMemberRoles } from './modules/organization/providers/organization-member-roles';
diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index 18afb0cfda..5d624ca28f 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -5,13 +5,13 @@ import { captureException } from '@sentry/node';
 import type { User } from '../../../shared/entities';
 import { AccessError, HiveError } from '../../../shared/errors';
 import { isUUID } from '../../../shared/is-uuid';
-import { Logger } from '../../shared/providers/logger';
-import type { Storage } from '../../shared/providers/storage';
 import {
   OrganizationMembers,
   OrganizationMembershipRoleAssignment,
   ResourceAssignment,
-} from '../providers/organization-members';
+} from '../../organization/providers/organization-members';
+import { Logger } from '../../shared/providers/logger';
+import type { Storage } from '../../shared/providers/storage';
 import { AuthNStrategy, AuthorizationPolicyStatement, Session } from './authz';
 
 export class SuperTokensCookieBasedSession extends Session {
@@ -72,7 +72,7 @@ export class SuperTokensCookieBasedSession extends Session {
     }
 
     // owner of organization should have full right to do anything.
-    if (organizationMembership?.isAdmin) {
+    if (organizationMembership?.isOwner) {
       this.logger.debug(
         'User is organization owner, resolve admin access policy. (userId=%s, organizationId=%s)',
         user.id,
@@ -96,7 +96,7 @@ export class SuperTokensCookieBasedSession extends Session {
 
     const policyStatements = this.translateAssignedRolesToAuthorizationPolicyStatements(
       organizationId,
-      organizationMembership.assignedRoles,
+      organizationMembership.assignedRole,
     );
 
     return policyStatements;
@@ -156,65 +156,54 @@ export class SuperTokensCookieBasedSession extends Session {
 
   private translateAssignedRolesToAuthorizationPolicyStatements(
     organizationId: string,
-    organizationMembershipRoleAssignments: Array<OrganizationMembershipRoleAssignment>,
+    assignedRole: OrganizationMembershipRoleAssignment,
   ): Array<AuthorizationPolicyStatement> {
     const policyStatements: Array<AuthorizationPolicyStatement> = [];
 
-    for (const assignedRole of organizationMembershipRoleAssignments) {
-      if (assignedRole.role.permissions.organization.size) {
-        policyStatements.push({
-          action: Array.from(assignedRole.role.permissions.organization),
-          effect: 'allow',
-          resource: this.toResourceIdentifier(
-            organizationId,
-            assignedRole.resolvedResources.organization,
-          ),
-        });
-      }
+    if (assignedRole.role.permissions.organization.size) {
+      policyStatements.push({
+        action: Array.from(assignedRole.role.permissions.organization),
+        effect: 'allow',
+        resource: this.toResourceIdentifier(
+          organizationId,
+          assignedRole.resolvedResources.organization,
+        ),
+      });
+    }
 
-      if (assignedRole.role.permissions.project.size) {
-        policyStatements.push({
-          action: Array.from(assignedRole.role.permissions.project),
-          effect: 'allow',
-          resource: this.toResourceIdentifier(
-            organizationId,
-            assignedRole.resolvedResources.project,
-          ),
-        });
-      }
+    if (assignedRole.role.permissions.project.size) {
+      policyStatements.push({
+        action: Array.from(assignedRole.role.permissions.project),
+        effect: 'allow',
+        resource: this.toResourceIdentifier(organizationId, assignedRole.resolvedResources.project),
+      });
+    }
 
-      if (assignedRole.role.permissions.target.size) {
-        policyStatements.push({
-          action: Array.from(assignedRole.role.permissions.target),
-          effect: 'allow',
-          resource: this.toResourceIdentifier(
-            organizationId,
-            assignedRole.resolvedResources.target,
-          ),
-        });
-      }
+    if (assignedRole.role.permissions.target.size) {
+      policyStatements.push({
+        action: Array.from(assignedRole.role.permissions.target),
+        effect: 'allow',
+        resource: this.toResourceIdentifier(organizationId, assignedRole.resolvedResources.target),
+      });
+    }
 
-      if (assignedRole.role.permissions.service.size) {
-        policyStatements.push({
-          action: Array.from(assignedRole.role.permissions.service),
-          effect: 'allow',
-          resource: this.toResourceIdentifier(
-            organizationId,
-            assignedRole.resolvedResources.service,
-          ),
-        });
-      }
+    if (assignedRole.role.permissions.service.size) {
+      policyStatements.push({
+        action: Array.from(assignedRole.role.permissions.service),
+        effect: 'allow',
+        resource: this.toResourceIdentifier(organizationId, assignedRole.resolvedResources.service),
+      });
+    }
 
-      if (assignedRole.role.permissions.appDeployment.size) {
-        policyStatements.push({
-          action: Array.from(assignedRole.role.permissions.appDeployment),
-          effect: 'allow',
-          resource: this.toResourceIdentifier(
-            organizationId,
-            assignedRole.resolvedResources.appDeployment,
-          ),
-        });
-      }
+    if (assignedRole.role.permissions.appDeployment.size) {
+      policyStatements.push({
+        action: Array.from(assignedRole.role.permissions.appDeployment),
+        effect: 'allow',
+        resource: this.toResourceIdentifier(
+          organizationId,
+          assignedRole.resolvedResources.appDeployment,
+        ),
+      });
     }
 
     return policyStatements;
diff --git a/packages/services/api/src/modules/auth/module.graphql.mappers.ts b/packages/services/api/src/modules/auth/module.graphql.mappers.ts
index 3ed4eec01e..9374cdb7dc 100644
--- a/packages/services/api/src/modules/auth/module.graphql.mappers.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.mappers.ts
@@ -1,5 +1,8 @@
-import type { Member, User } from '../../shared/entities';
-import { PermissionGroup, PermissionRecord } from './lib/organization-member-permissions';
+import type { User } from '../../shared/entities';
+import {
+  PermissionGroup,
+  PermissionRecord,
+} from '../organization/lib/organization-member-permissions';
 import type { OrganizationAccessScope } from './providers/organization-access';
 import type { ProjectAccessScope } from './providers/project-access';
 import type { TargetAccessScope } from './providers/target-access';
@@ -8,8 +11,6 @@ export type OrganizationAccessScopeMapper = OrganizationAccessScope;
 export type ProjectAccessScopeMapper = ProjectAccessScope;
 export type TargetAccessScopeMapper = TargetAccessScope;
 export type UserConnectionMapper = readonly User[];
-export type MemberConnectionMapper = readonly Member[];
-export type MemberMapper = Member;
 export type UserMapper = User;
 export type PermissionGroupMapper = PermissionGroup;
 export type PermissionMapper = PermissionRecord;
diff --git a/packages/services/api/src/modules/auth/module.graphql.ts b/packages/services/api/src/modules/auth/module.graphql.ts
index 6ad050a05d..e6f069e5aa 100644
--- a/packages/services/api/src/modules/auth/module.graphql.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.ts
@@ -57,20 +57,6 @@ export default gql`
     total: Int!
   }
 
-  type Member {
-    id: ID!
-    user: User!
-    isOwner: Boolean!
-    organizationAccessScopes: [OrganizationAccessScope!]!
-    projectAccessScopes: [ProjectAccessScope!]!
-    targetAccessScopes: [TargetAccessScope!]!
-  }
-
-  type MemberConnection {
-    nodes: [Member!]!
-    total: Int!
-  }
-
   enum AuthProvider {
     GOOGLE
     GITHUB
@@ -133,11 +119,4 @@ export default gql`
     title: String!
     permissions: [Permission!]!
   }
-
-  extend type Organization {
-    """
-    List of available permission groups that can be assigned to users.
-    """
-    availableMemberPermissionGroups: [PermissionGroup!]!
-  }
 `;
diff --git a/packages/services/api/src/modules/auth/providers/organization-members.ts b/packages/services/api/src/modules/auth/providers/organization-members.ts
deleted file mode 100644
index c981f4c0a0..0000000000
--- a/packages/services/api/src/modules/auth/providers/organization-members.ts
+++ /dev/null
@@ -1,550 +0,0 @@
-import { Inject, Injectable, Scope } from 'graphql-modules';
-import { sql, type DatabasePool } from 'slonik';
-import { z } from 'zod';
-import { Organization } from '../../../shared/entities';
-import { batchBy } from '../../../shared/helpers';
-import { isUUID } from '../../../shared/is-uuid';
-import { Logger } from '../../shared/providers/logger';
-import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
-import {
-  PermissionsModel,
-  PermissionsPerResourceLevelAssignment,
-  PermissionsPerResourceLevelAssignmentModel,
-  permissionsToPermissionsPerResourceLevelAssignment,
-} from '../lib/authz';
-import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from './scopes';
-
-const RawOrganizationMembershipModel = z.object({
-  userId: z.string(),
-  /** Legacy scopes on membership, way of assigning permissions before the introduction of roles */
-  legacyScopes: z
-    .array(z.string())
-    .transform(
-      value => value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
-    )
-    .nullable(),
-  /** Legacy role id, way of assigning permissions via a role before the introduction of assigning multiple roles */
-  legacyRoleId: z.string().nullable(),
-});
-
-const RawMemberRoleModel = z.intersection(
-  z.object({
-    id: z.string(),
-    description: z.string(),
-    isLocked: z.boolean(),
-  }),
-  z.union([
-    z.object({
-      legacyScopes: z
-        .array(z.string())
-        .transform(
-          value => value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
-        ),
-      permissions: z.null(),
-    }),
-    z.object({
-      legacyScopes: z.null(),
-      permissions: z
-        .array(PermissionsModel)
-        .transform(permissions => permissionsToPermissionsPerResourceLevelAssignment(permissions)),
-    }),
-  ]),
-);
-
-const UUIDResourceAssignmentModel = z.union([z.literal('*'), z.array(z.string().uuid())]);
-
-/**
- * String in the form `targetId/serviceName`
- * Example: `f81ce726-2abf-4653-bf4c-d8436cde255a/users`
- */
-const ServiceResourceAssignmentStringModel = z
-  .string()
-  .refine(value => {
-    const [targetId, serviceName = ''] = value.split('/');
-    if (isUUID(targetId) === false || serviceName === '') {
-      return false;
-    }
-    return true;
-  }, 'Invalid service resource assignment')
-  .transform(value => value.split('/') as [targetId: string, serviceName: string]);
-
-const ServiceResourceAssignmentModel = z.union([
-  z.literal('*'),
-  z.array(ServiceResourceAssignmentStringModel),
-]);
-
-const ResourceAssignmentGroupModel = z.object({
-  /** Resources assigned to a 'projects' permission group */
-  project: UUIDResourceAssignmentModel,
-  /** Resources assigned to a 'targets' permission group */
-  target: UUIDResourceAssignmentModel,
-  /** Resources assigned to a 'service' permission group */
-  service: ServiceResourceAssignmentModel,
-  /** Resources assigned to a 'appDeployment' permission group */
-  appDeployment: ServiceResourceAssignmentModel,
-});
-
-/**
- * Resource assignments as stored within the database.
- */
-type ResourceAssignmentGroup = z.TypeOf<typeof ResourceAssignmentGroupModel>;
-
-type MemberRoleType = {
-  id: string;
-  description: string;
-  isLocked: boolean;
-  permissions: PermissionsPerResourceLevelAssignment;
-};
-
-export type OrganizationMembershipRoleAssignment = {
-  role: MemberRoleType;
-  /**
-   * Resource assignments as stored within the database.
-   */
-  resources: ResourceAssignmentGroup;
-  /**
-   * Resolved resource groups, used for runtime permission checks.
-   */
-  resolvedResources: ResolvedResourceAssignments;
-};
-
-type OrganizationMembership = {
-  organizationId: string;
-  isAdmin: boolean;
-  userId: string;
-  assignedRoles: Array<OrganizationMembershipRoleAssignment>;
-  /**
-   * legacy role assigned to this membership.
-   * Note: The role is already resolved to a "OrganizationMembershipRoleAssignment" within the assignedRoles property.
-   **/
-  legacyRoleId: string | null;
-  /**
-   * Legacy scope assigned to this membership.
-   * Note: They are already resolved to a "OrganizationMembershipRoleAssignment" within the assignedRoles property.
-   **/
-  legacyScopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope> | null;
-};
-
-@Injectable({
-  scope: Scope.Operation,
-})
-export class OrganizationMembers {
-  private logger: Logger;
-
-  constructor(
-    @Inject(PG_POOL_CONFIG) private pool: DatabasePool,
-    logger: Logger,
-  ) {
-    this.logger = logger.child({
-      source: 'OrganizationMembers',
-    });
-  }
-
-  private async findOrganizationMembersById(organizationId: string, userIds: Array<string>) {
-    const query = sql`
-    SELECT
-      "om"."user_id" AS "userId"
-      , "om"."role_id" AS "legacyRoleId"
-      , "om"."scopes" AS "legacyScopes"
-    FROM
-      "organization_member" AS "om"
-    WHERE
-      "om"."organization_id" = ${organizationId}
-      AND "om"."user_id" = ANY(${sql.array(userIds, 'uuid')})
-  `;
-
-    const result = await this.pool.any<unknown>(query);
-    return result.map(row => RawOrganizationMembershipModel.parse(row));
-  }
-
-  /** Find member roles by their ID */
-  private async findMemberRolesByIds(roleIds: Array<string>) {
-    this.logger.debug('Find organization membership roles. (roleIds=%o)', roleIds);
-
-    const query = sql`
-      SELECT
-        "id"
-        , "name"
-        , "description"
-        , "locked" AS "isLocked"
-        , "scopes" AS "legacyScopes"
-        , "permissions"
-      FROM
-        "organization_member_roles"
-      WHERE
-        "id" = ANY(${sql.array(roleIds, 'uuid')})
-    `;
-
-    const result = await this.pool.any<unknown>(query);
-
-    const rowsById = new Map<string, MemberRoleType>();
-
-    for (const row of result) {
-      const record = RawMemberRoleModel.parse(row);
-
-      rowsById.set(record.id, {
-        id: record.id,
-        isLocked: record.isLocked,
-        description: record.description,
-        permissions:
-          record.permissions ??
-          transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes),
-      });
-    }
-    return rowsById;
-  }
-
-  /**
-   * Batched loader function for a organization membership.
-   *
-   * Handles legacy scopes and role assignments and automatically transforms
-   * them into resource based role assignments.
-   */
-  findOrganizationMembership = batchBy(
-    (args: { organization: Organization; userId: string }) => args.organization.id,
-    async args => {
-      const organization = args[0].organization;
-      const userIds = args.map(arg => arg.userId);
-
-      this.logger.debug(
-        'Find organization membership for users. (organizationId=%s, userIds=%o)',
-        organization.id,
-        userIds,
-      );
-
-      const organizationMembers = await this.findOrganizationMembersById(organization.id, userIds);
-      const mapping = new Map<string, OrganizationMembership>();
-
-      // Roles that are assigned using the legacy "single role" way
-      const pendingLegacyRoleLookups = new Set<string>();
-      const pendingLegacyRoleMembershipAssignments: Array<{
-        legacyRoleId: string;
-        assignedRoles: OrganizationMembership['assignedRoles'];
-      }> = [];
-
-      // Users whose role assignments need to be loaded as they are not using any legacy roles
-      // const pendingRoleRoleAssignmentLookupUsersIds = new Set<OrganizationMembership>();
-
-      for (const record of organizationMembers) {
-        const organizationMembership: OrganizationMembership = {
-          organizationId: organization.id,
-          userId: record.userId,
-          isAdmin: organization.ownerId === record.userId,
-          assignedRoles: [],
-          legacyRoleId: record.legacyRoleId,
-          legacyScopes: record.legacyScopes,
-        };
-        mapping.set(record.userId, organizationMembership);
-
-        if (record.legacyRoleId) {
-          // legacy "single assigned role"
-          pendingLegacyRoleLookups.add(record.legacyRoleId);
-          pendingLegacyRoleMembershipAssignments.push({
-            legacyRoleId: record.legacyRoleId,
-            assignedRoles: organizationMembership.assignedRoles,
-          });
-        } else if (record.legacyScopes !== null) {
-          // legacy "scopes" on organization member -> migration wizard has not been used
-
-          // In this case we translate the legacy scopes to a single permission group on the "organization"
-          // resource typ. Then assign the users organization to the group, so it has the same behavior as previously.
-          const resources: ResourceAssignmentGroup = {
-            project: '*',
-            target: '*',
-            service: '*',
-            appDeployment: '*',
-          };
-
-          organizationMembership.assignedRoles.push({
-            role: {
-              id: 'legacy-scope-role',
-              description: 'This role has been automatically generated from the assigned scopes.',
-              isLocked: true,
-              permissions: transformOrganizationMemberLegacyScopesIntoPermissionGroup(
-                record.legacyScopes,
-              ),
-            },
-            // allow all permissions for all resources within the organization.
-            resources,
-            resolvedResources: resolveResourceAssignment({
-              organizationId: organization.id,
-              groups: resources,
-            }),
-          });
-        }
-        // else {
-        //   // normal role assignment lookup
-        //   pendingRoleRoleAssignmentLookupUsersIds.add(organizationMembership);
-        // }
-      }
-
-      if (pendingLegacyRoleLookups.size) {
-        // This handles the legacy "single" role assignments
-        // We load the roles and then attach them to the already loaded membership role
-        const roleIds = Array.from(pendingLegacyRoleLookups);
-
-        this.logger.debug('Lookup legacy role assignments. (roleIds=%o)', roleIds);
-
-        const memberRolesById = await this.findMemberRolesByIds(roleIds);
-
-        for (const record of pendingLegacyRoleMembershipAssignments) {
-          const membershipRole = memberRolesById.get(record.legacyRoleId);
-          if (!membershipRole) {
-            continue;
-          }
-          const resources: ResourceAssignmentGroup = {
-            project: '*',
-            target: '*',
-            service: '*',
-            appDeployment: '*',
-          };
-          record.assignedRoles.push({
-            resources,
-            resolvedResources: resolveResourceAssignment({
-              organizationId: organization.id,
-              groups: resources,
-            }),
-            role: membershipRole,
-          });
-        }
-      }
-
-      //   if (pendingRoleRoleAssignmentLookupUsersIds.size) {
-      //     const usersIds = Array.from(pendingRoleRoleAssignmentLookupUsersIds).map(
-      //       membership => membership.userId,
-      //     );
-      //     this.logger.debug(
-      //       'Lookup role assignments within organization for users. (organizationId=%s, userIds=%o)',
-      //       organization.id,
-      //       usersIds,
-      //     );
-
-      //     const roleAssignments = await this.findRoleAssignmentsForUsersInOrganization(
-      //       organization.id,
-      //       usersIds,
-      //     );
-
-      //     for (const membership of pendingRoleRoleAssignmentLookupUsersIds) {
-      //       membership.assignedRoles.push(...(roleAssignments.get(membership.userId) ?? []));
-      //     }
-      //   }
-
-      return userIds.map(async userId => mapping.get(userId) ?? null);
-    },
-  );
-}
-
-function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
-  scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
-): z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> {
-  const permissions: z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> = {
-    organization: new Set(),
-    project: new Set(),
-    target: new Set(),
-    service: new Set(),
-    appDeployment: new Set(),
-  };
-  for (const scope of scopes) {
-    switch (scope) {
-      case OrganizationAccessScope.READ: {
-        permissions.organization.add('organization:describe');
-        permissions.organization.add('support:manageTickets');
-        permissions.organization.add('project:create');
-        permissions.project.add('project:describe');
-        break;
-      }
-      case OrganizationAccessScope.SETTINGS: {
-        permissions.organization.add('organization:modifySlug');
-        permissions.organization.add('schemaLinting:modifyOrganizationRules');
-        permissions.organization.add('billing:describe');
-        permissions.organization.add('billing:update');
-        permissions.organization.add('auditLog:export');
-        break;
-      }
-      case OrganizationAccessScope.DELETE: {
-        permissions.organization.add('organization:delete');
-        break;
-      }
-      case OrganizationAccessScope.INTEGRATIONS: {
-        permissions.organization.add('oidc:modify');
-        permissions.organization.add('gitHubIntegration:modify');
-        permissions.organization.add('slackIntegration:modify');
-
-        break;
-      }
-      case OrganizationAccessScope.MEMBERS: {
-        permissions.organization.add('member:manageInvites');
-        permissions.organization.add('member:removeMember');
-        permissions.organization.add('member:assignRole');
-        permissions.organization.add('member:modifyRole');
-        permissions.organization.add('member:describe');
-        break;
-      }
-      case ProjectAccessScope.ALERTS: {
-        permissions.project.add('alert:modify');
-        break;
-      }
-      case ProjectAccessScope.READ: {
-        permissions.project.add('project:describe');
-        break;
-      }
-      case ProjectAccessScope.DELETE: {
-        permissions.project.add('project:delete');
-        break;
-      }
-      case ProjectAccessScope.SETTINGS: {
-        permissions.project.add('project:delete');
-        permissions.project.add('project:modifySettings');
-        permissions.project.add('schemaLinting:modifyProjectRules');
-        break;
-      }
-      case TargetAccessScope.READ: {
-        permissions.project.add('target:create');
-        permissions.target.add('appDeployment:describe');
-        permissions.target.add('laboratory:describe');
-        break;
-      }
-      case TargetAccessScope.REGISTRY_WRITE: {
-        permissions.target.add('laboratory:modify');
-        permissions.service.add('schemaCheck:approve');
-        break;
-      }
-      case TargetAccessScope.TOKENS_WRITE: {
-        permissions.target.add('targetAccessToken:modify');
-        permissions.target.add('cdnAccessToken:modify');
-        break;
-      }
-      case TargetAccessScope.SETTINGS: {
-        permissions.target.add('target:modifySettings');
-        permissions.target.add('laboratory:modifyPreflightScript');
-        break;
-      }
-      case TargetAccessScope.DELETE: {
-        permissions.target.add('target:delete');
-        break;
-      }
-    }
-  }
-
-  return permissions;
-}
-
-type OrganizationAssignment = {
-  type: 'organization';
-  organizationId: string;
-};
-
-type ProjectAssignment = {
-  type: 'project';
-  projectId: string;
-};
-
-type TargetAssignment = {
-  type: 'target';
-  targetId: string;
-};
-
-type ServiceAssignment = {
-  type: 'service';
-  targetId: string;
-  serviceName: string;
-};
-
-type AppDeploymentAssignment = {
-  type: 'appDeployment';
-  targetId: string;
-  appDeploymentName: string;
-};
-
-export type ResourceAssignment =
-  | OrganizationAssignment
-  | ProjectAssignment
-  | TargetAssignment
-  | ServiceAssignment
-  | AppDeploymentAssignment;
-
-type ResolvedResourceAssignments = {
-  organization: OrganizationAssignment;
-  project: OrganizationAssignment | Array<ProjectAssignment>;
-  target: OrganizationAssignment | Array<ProjectAssignment> | Array<TargetAssignment>;
-  service:
-    | OrganizationAssignment
-    | Array<ProjectAssignment>
-    | Array<TargetAssignment>
-    | Array<ServiceAssignment>;
-  appDeployment:
-    | OrganizationAssignment
-    | Array<ProjectAssignment>
-    | Array<TargetAssignment>
-    | Array<AppDeploymentAssignment>;
-};
-
-/**
- * This function resolves the "stored-in-database", user configuration to the actual resolved structure
- * Currently, we have the following hierarchy
- *
- *        organization
- *             v
- *           project
- *             v
- *           target
- *          v      v
- * app deployment  service
- *
- * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
- */
-function resolveResourceAssignment(args: {
-  organizationId: string;
-  groups: ResourceAssignmentGroup;
-}): ResolvedResourceAssignments {
-  const organization: OrganizationAssignment = {
-    type: 'organization',
-    organizationId: args.organizationId,
-  };
-
-  let project: ResolvedResourceAssignments['project'] = organization;
-
-  if (args.groups.project !== '*') {
-    project = args.groups.project.map(projectId => ({
-      type: 'project',
-      projectId,
-    }));
-  }
-
-  let target: ResolvedResourceAssignments['target'] = project;
-
-  if (args.groups.target !== '*') {
-    target = args.groups.target.map(targetId => ({
-      type: 'target',
-      targetId,
-    }));
-  }
-
-  let service: ResolvedResourceAssignments['service'] = target;
-
-  if (args.groups.service !== '*') {
-    service = args.groups.service.map(([targetId, serviceName]) => ({
-      type: 'service',
-      targetId,
-      serviceName,
-    }));
-  }
-
-  let appDeployment: ResolvedResourceAssignments['appDeployment'] = target;
-
-  if (args.groups.service !== '*') {
-    appDeployment = args.groups.service.map(([targetId, appDeploymentName]) => ({
-      type: 'appDeployment',
-      targetId,
-      appDeploymentName,
-    }));
-  }
-
-  return {
-    organization,
-    project,
-    target,
-    service,
-    appDeployment,
-  };
-}
diff --git a/packages/services/api/src/modules/auth/resolvers/Member.ts b/packages/services/api/src/modules/auth/resolvers/Member.ts
deleted file mode 100644
index 5d0b4920be..0000000000
--- a/packages/services/api/src/modules/auth/resolvers/Member.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { AuthManager } from '../providers/auth-manager';
-import type { MemberResolvers } from './../../../__generated__/types';
-
-export const Member: Pick<
-  MemberResolvers,
-  | 'id'
-  | 'isOwner'
-  | 'organizationAccessScopes'
-  | 'projectAccessScopes'
-  | 'targetAccessScopes'
-  | 'user'
-  | '__isTypeOf'
-> = {
-  organizationAccessScopes: (member, _, { injector }) => {
-    return injector.get(AuthManager).getMemberOrganizationScopes({
-      userId: member.user.id,
-      organizationId: member.organization,
-    });
-  },
-  projectAccessScopes: (member, _, { injector }) => {
-    return injector.get(AuthManager).getMemberProjectScopes({
-      userId: member.user.id,
-      organizationId: member.organization,
-    });
-  },
-  targetAccessScopes: (member, _, { injector }) => {
-    return injector.get(AuthManager).getMemberTargetScopes({
-      userId: member.user.id,
-      organizationId: member.organization,
-    });
-  },
-};
diff --git a/packages/services/api/src/modules/auth/resolvers/Organization.ts b/packages/services/api/src/modules/auth/resolvers/Organization.ts
deleted file mode 100644
index af78014f17..0000000000
--- a/packages/services/api/src/modules/auth/resolvers/Organization.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { allPermissionGroups } from '../lib/organization-member-permissions';
-import type { OrganizationResolvers } from './../../../__generated__/types';
-
-/*
- * Note: This object type is generated because "OrganizationMapper" is declared. This is to ensure runtime safety.
- *
- * When a mapper is used, it is possible to hit runtime errors in some scenarios:
- * - given a field name, the schema type's field type does not match mapper's field type
- * - or a schema type's field does not exist in the mapper's fields
- *
- * If you want to skip this file generation, remove the mapper or update the pattern in the `resolverGeneration.object` config.
- */
-export const Organization: Pick<
-  OrganizationResolvers,
-  'availableMemberPermissionGroups' | '__isTypeOf'
-> = {
-  /* Implement Organization resolver logic here */
-  availableMemberPermissionGroups: async (_parent, _arg, _ctx) => {
-    return allPermissionGroups;
-  },
-};
diff --git a/packages/services/api/src/modules/organization/index.ts b/packages/services/api/src/modules/organization/index.ts
index 0c5936e9ea..37db80f104 100644
--- a/packages/services/api/src/modules/organization/index.ts
+++ b/packages/services/api/src/modules/organization/index.ts
@@ -1,5 +1,7 @@
 import { createModule } from 'graphql-modules';
 import { OrganizationManager } from './providers/organization-manager';
+import { OrganizationMemberRoles } from './providers/organization-member-roles';
+import { OrganizationMembers } from './providers/organization-members';
 import { resolvers } from './resolvers.generated';
 import typeDefs from './module.graphql';
 
@@ -8,5 +10,5 @@ export const organizationModule = createModule({
   dirname: __dirname,
   typeDefs,
   resolvers,
-  providers: [OrganizationManager],
+  providers: [OrganizationManager, OrganizationMemberRoles, OrganizationMembers],
 });
diff --git a/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
similarity index 87%
rename from packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
rename to packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index 101d781cca..b7caf4b599 100644
--- a/packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -1,4 +1,4 @@
-import { allPermissions, Permission } from './authz';
+import { allPermissions, Permission } from '../../auth/lib/authz';
 
 export type PermissionRecord = {
   id: Permission;
@@ -278,19 +278,22 @@ export const allPermissionGroups: Array<PermissionGroup> = [
 ] as const;
 
 function assertAllRulesAreAssigned(excluded: Array<Permission>) {
-  const p = new Set(allPermissions);
+  const permissionsToCheck = new Set(allPermissions);
+
   for (const item of excluded) {
-    p.delete(item);
+    permissionsToCheck.delete(item);
   }
 
   for (const group of allPermissionGroups) {
-    for (const per of group.permissions) {
-      p.delete(per.id);
+    for (const permission of group.permissions) {
+      permissionsToCheck.delete(permission.id);
     }
   }
 
-  if (p.size) {
-    throw new Error('The following permissions are not assigned: \n' + Array.from(p).join(`\n`));
+  if (permissionsToCheck.size) {
+    throw new Error(
+      'The following permissions are not assigned: \n' + Array.from(permissionsToCheck).join(`\n`),
+    );
   }
 }
 
@@ -309,3 +312,31 @@ assertAllRulesAreAssigned([
   'appDeployment:publish',
   'appDeployment:retire',
 ]);
+
+/**
+ * List of permissions that are assignable
+ */
+export const permissions = (() => {
+  const assignable = new Set<Permission>();
+  const readOnly = new Set<Permission>();
+  for (const group of allPermissionGroups) {
+    for (const permission of group.permissions) {
+      if (permission.isReadyOnly === true) {
+        readOnly.add(permission.id);
+        continue;
+      }
+      assignable.add(permission.id);
+    }
+  }
+
+  return {
+    /**
+     * List of permissions that are assignable by the user (these should be stored in the database)
+     */
+    assignable: assignable as ReadonlySet<Permission>,
+    /**
+     * List of permissions that are assigned by default (these do not need to be stored in the database)
+     */
+    default: readOnly as ReadonlySet<Permission>,
+  };
+})();
diff --git a/packages/services/api/src/modules/organization/module.graphql.mappers.ts b/packages/services/api/src/modules/organization/module.graphql.mappers.ts
index 9c5f17c0f0..4701b0b37a 100644
--- a/packages/services/api/src/modules/organization/module.graphql.mappers.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.mappers.ts
@@ -2,11 +2,14 @@ import type {
   Organization,
   OrganizationGetStarted,
   OrganizationInvitation,
-  OrganizationMemberRole,
 } from '../../shared/entities';
+import { OrganizationMemberRole } from './providers/organization-member-roles';
+import { OrganizationMembership } from './providers/organization-members';
 
 export type OrganizationConnectionMapper = readonly Organization[];
 export type OrganizationMapper = Organization;
 export type MemberRoleMapper = OrganizationMemberRole;
 export type OrganizationGetStartedMapper = OrganizationGetStarted;
 export type OrganizationInvitationMapper = OrganizationInvitation;
+export type MemberConnectionMapper = readonly OrganizationMembership[];
+export type MemberMapper = OrganizationMembership;
diff --git a/packages/services/api/src/modules/organization/module.graphql.ts b/packages/services/api/src/modules/organization/module.graphql.ts
index 429f1356c4..6025930e28 100644
--- a/packages/services/api/src/modules/organization/module.graphql.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.ts
@@ -240,6 +240,10 @@ export default gql`
     The organization's audit logs. This field is only available to members with the Admin role.
     """
     viewerCanExportAuditLogs: Boolean!
+    """
+    List of available permission groups that can be assigned to users.
+    """
+    availableMemberPermissionGroups: [PermissionGroup!]!
   }
 
   type OrganizationConnection {
@@ -303,7 +307,6 @@ export default gql`
   extend type Member {
     canLeaveOrganization: Boolean!
     role: MemberRole!
-    isAdmin: Boolean!
     """
     Whether the viewer can remove this member from the organization.
     """
@@ -318,9 +321,6 @@ export default gql`
     Whether the role is a built-in role. Built-in roles cannot be deleted or modified.
     """
     locked: Boolean!
-    organizationAccessScopes: [OrganizationAccessScope!]!
-    projectAccessScopes: [ProjectAccessScope!]!
-    targetAccessScopes: [TargetAccessScope!]!
     """
     Whether the role can be deleted (based on current user's permissions)
     """
@@ -333,16 +333,21 @@ export default gql`
     Whether the role can be used to invite new members (based on current user's permissions)
     """
     canInvite: Boolean!
+    """
+    Amount of users within the organization that have this role assigned.
+    """
     membersCount: Int!
+    """
+    List of permissions attached to this member role.
+    """
+    permissions: [String!]!
   }
 
   input CreateMemberRoleInput {
     organizationSlug: String!
     name: String!
     description: String!
-    organizationAccessScopes: [OrganizationAccessScope!]!
-    projectAccessScopes: [ProjectAccessScope!]!
-    targetAccessScopes: [TargetAccessScope!]!
+    selectedPermissions: [String!]!
   }
 
   type CreateMemberRoleOk {
@@ -375,9 +380,7 @@ export default gql`
     roleId: ID!
     name: String!
     description: String!
-    organizationAccessScopes: [OrganizationAccessScope!]!
-    projectAccessScopes: [ProjectAccessScope!]!
-    targetAccessScopes: [TargetAccessScope!]!
+    selectedPermissions: [String!]!
   }
 
   type UpdateMemberRoleOk {
@@ -448,4 +451,15 @@ export default gql`
     ok: AssignMemberRoleOk
     error: AssignMemberRoleError
   }
+
+  type Member {
+    id: ID!
+    user: User!
+    isOwner: Boolean!
+  }
+
+  type MemberConnection {
+    nodes: [Member!]!
+    total: Int!
+  }
 `;
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index e4fa779aa0..35b6ba210f 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { Inject, Injectable, Scope } from 'graphql-modules';
-import { Organization, OrganizationMemberRole } from '../../../shared/entities';
+import { Organization } from '../../../shared/entities';
 import { HiveError } from '../../../shared/errors';
 import { cache, share } from '../../../shared/helpers';
 import { AuditLogRecorder } from '../../audit-logs/providers/audit-log-recorder';
@@ -18,34 +18,14 @@ import type { OrganizationSelector } from '../../shared/providers/storage';
 import { Storage } from '../../shared/providers/storage';
 import { WEB_APP_URL } from '../../shared/providers/tokens';
 import { TokenStorage } from '../../token/providers/token-storage';
+import { createOrUpdateMemberRoleInputSchema } from '../validation';
 import {
   organizationAdminScopes,
   organizationViewerScopes,
   reservedOrganizationSlugs,
 } from './organization-config';
-
-function ensureReadAccess(
-  scopes: readonly (OrganizationAccessScope | ProjectAccessScope | TargetAccessScope)[],
-) {
-  const newScopes: (OrganizationAccessScope | ProjectAccessScope | TargetAccessScope)[] = [
-    ...scopes,
-  ];
-
-  if (!scopes.includes(OrganizationAccessScope.READ)) {
-    newScopes.push(OrganizationAccessScope.READ);
-  }
-
-  if (!scopes.includes(ProjectAccessScope.READ)) {
-    newScopes.push(ProjectAccessScope.READ);
-  }
-
-  if (!scopes.includes(TargetAccessScope.READ)) {
-    newScopes.push(TargetAccessScope.READ);
-  }
-
-  // Remove duplicates
-  return newScopes.filter((scope, i, all) => all.indexOf(scope) === i);
-}
+import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
+import { OrganizationMembers } from './organization-members';
 
 /**
  * Responsible for auth checks.
@@ -68,6 +48,8 @@ export class OrganizationManager {
     private billingProvider: BillingProvider,
     private oidcIntegrationProvider: OIDCIntegrationsProvider,
     private emails: Emails,
+    private organizationMemberRoles: OrganizationMemberRoles,
+    private organizationMembers: OrganizationMembers,
     @Inject(WEB_APP_URL) private appBaseUrl: string,
     private idTranslator: IdTranslator,
   ) {
@@ -271,7 +253,13 @@ export class OrganizationManager {
   }
 
   async getOrganizationMember(selector: OrganizationSelector & { userId: string }) {
-    const member = await this.storage.getOrganizationMember(selector);
+    const organization = await this.storage.getOrganization({
+      organizationId: selector.organizationId,
+    });
+    const member = await this.organizationMembers.findOrganizationMembership({
+      organization,
+      userId: selector.userId,
+    });
 
     if (!member) {
       throw new HiveError('Member not found');
@@ -549,21 +537,16 @@ export class OrganizationManager {
     }
 
     const role = input.role
-      ? await this.storage.getOrganizationMemberRole({
-          organizationId: organization.id,
-          roleId: input.role,
-        })
-      : await this.storage.getViewerOrganizationMemberRole({
-          organizationId: organization.id,
-        });
+      ? await this.organizationMemberRoles.findMemberRoleById(input.role)
+      : await this.organizationMemberRoles.findViewerRoleByOrganizationId(input.organization);
+
     if (!role) {
       throw new HiveError(`Role not found`);
     }
 
     // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes = role.scopes.filter(
-      scope => !currentUserAccessScopes.includes(scope),
-    );
+    const currentUserMissingScopes =
+      role.legacyScopes?.filter(scope => !currentUserAccessScopes.includes(scope)) ?? [];
 
     if (currentUserMissingScopes.length > 0) {
       this.logger.debug(`Logged user scopes: %s`, currentUserAccessScopes.join(','));
@@ -909,57 +892,48 @@ export class OrganizationManager {
   }
 
   async createMemberRole(input: {
-    organizationId: string;
+    organizationSlug: string;
     name: string;
     description: string;
-    organizationAccessScopes: readonly OrganizationAccessScope[];
-    projectAccessScopes: readonly ProjectAccessScope[];
-    targetAccessScopes: readonly TargetAccessScope[];
+    permissions: ReadonlyArray<string>;
   }) {
+    const organizationId = await this.idTranslator.translateOrganizationId(input);
+
     await this.session.assertPerformAction({
       action: 'member:modifyRole',
-      organizationId: input.organizationId,
+      organizationId,
       params: {
-        organizationId: input.organizationId,
+        organizationId,
       },
     });
 
-    const scopes = ensureReadAccess([
-      ...input.organizationAccessScopes,
-      ...input.projectAccessScopes,
-      ...input.targetAccessScopes,
-    ]);
-
-    const currentUser = await this.session.getViewer();
-    const currentUserAsMember = await this.getOrganizationMember({
-      organizationId: input.organizationId,
-      userId: currentUser.id,
+    const inputValidation = createOrUpdateMemberRoleInputSchema.safeParse({
+      name: input.name,
+      description: input.description,
+      // TODO: validate permissions
     });
 
-    // Ensure user has access to all scopes in the role
-    const currentMemberMissingScopes = scopes.filter(
-      scope => !currentUserAsMember.scopes.includes(scope),
-    );
-
-    if (currentMemberMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserAsMember.scopes.join(', '));
-      this.logger.debug(`Missing scopes: %s`, currentMemberMissingScopes.join(', '));
+    if (!inputValidation.success) {
       return {
         error: {
-          message: `Missing access to some of the selected scopes`,
+          message: 'Please check your input.',
+          inputErrors: {
+            name: inputValidation.error.formErrors.fieldErrors.name?.[0],
+            description: inputValidation.error.formErrors.fieldErrors.description?.[0],
+          },
         },
       };
     }
 
     const roleName = input.name.trim();
 
-    const nameExists = await this.storage.hasOrganizationMemberRoleName({
-      organizationId: input.organizationId,
+    const foundRole = await this.organizationMemberRoles.findRoleByOrganizationIdAndName(
+      organizationId,
       roleName,
-    });
+    );
 
     // Ensure name is unique in the organization
-    if (nameExists) {
+    if (foundRole) {
       const msg = 'Role name already exists. Please choose a different name.';
 
       return {
@@ -972,16 +946,16 @@ export class OrganizationManager {
       };
     }
 
-    const role = await this.storage.createOrganizationMemberRole({
-      organizationId: input.organizationId,
+    const role = await this.organizationMemberRoles.createOrganizationMemberRole({
+      organizationId,
       name: roleName,
       description: input.description,
-      scopes,
+      permissions: input.permissions,
     });
 
     await this.auditLog.record({
       eventType: 'ROLE_CREATED',
-      organizationId: input.organizationId,
+      organizationId,
       metadata: {
         roleId: role.id,
         roleName: role.name,
@@ -991,7 +965,7 @@ export class OrganizationManager {
     return {
       ok: {
         updatedOrganization: await this.storage.getOrganization({
-          organizationId: input.organizationId,
+          organizationId,
         }),
         createdRole: role,
       },
@@ -1007,10 +981,7 @@ export class OrganizationManager {
       },
     });
 
-    const role = await this.storage.getOrganizationMemberRole({
-      organizationId: input.organizationId,
-      roleId: input.roleId,
-    });
+    const role = await this.organizationMemberRoles.findMemberRoleById(input.roleId);
 
     if (!role) {
       return {
@@ -1020,13 +991,7 @@ export class OrganizationManager {
       };
     }
 
-    const currentUser = await this.session.getViewer();
-    const currentUserAsMember = await this.getOrganizationMember({
-      organizationId: input.organizationId,
-      userId: currentUser.id,
-    });
-
-    const accessCheckResult = await this.canDeleteRole(role, currentUserAsMember.scopes);
+    const accessCheckResult = await this.canDeleteRole(role);
 
     if (!accessCheckResult.ok) {
       return {
@@ -1060,36 +1025,32 @@ export class OrganizationManager {
     };
   }
 
-  async assignMemberRole(input: { organizationId: string; userId: string; roleId: string }) {
+  async assignMemberRole(input: { organizationSlug: string; userId: string; roleId: string }) {
+    const organizationId = await this.idTranslator.translateOrganizationId(input);
+
     await this.session.assertPerformAction({
       action: 'member:assignRole',
-      organizationId: input.organizationId,
+      organizationId,
       params: {
-        organizationId: input.organizationId,
+        organizationId,
       },
     });
 
+    const organization = await this.storage.getOrganization({
+      organizationId,
+    });
+
     // Ensure selected member is part of the organization
-    const member = await this.storage.getOrganizationMember({
-      organizationId: input.organizationId,
+    const previousMembership = await this.organizationMembers.findOrganizationMembership({
+      organization,
       userId: input.userId,
     });
 
-    if (!member) {
+    if (!previousMembership) {
       throw new Error(`Member is not part of the organization`);
     }
 
-    const currentUser = await this.session.getViewer();
-    const [currentUserAsMember, newRole] = await Promise.all([
-      this.getOrganizationMember({
-        organizationId: input.organizationId,
-        userId: currentUser.id,
-      }),
-      this.storage.getOrganizationMemberRole({
-        organizationId: input.organizationId,
-        roleId: input.roleId,
-      }),
-    ]);
+    const newRole = await this.organizationMemberRoles.findMemberRoleById(input.roleId);
 
     if (!newRole) {
       return {
@@ -1099,58 +1060,9 @@ export class OrganizationManager {
       };
     }
 
-    // Ensure user has access to all scopes in the new role
-    const currentUserMissingScopesInNewRole = newRole.scopes.filter(
-      scope => !currentUserAsMember.scopes.includes(scope),
-    );
-    if (currentUserMissingScopesInNewRole.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserAsMember.scopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingScopesInNewRole.join(', '));
-
-      return {
-        error: {
-          message: `Missing access to some of the scopes of the new role`,
-        },
-      };
-    }
-
-    // Ensure user has access to all scopes in the old role
-    const currentUserMissingScopesInOldRole = member.scopes.filter(
-      scope => !currentUserAsMember.scopes.includes(scope),
-    );
-
-    if (currentUserMissingScopesInOldRole.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserAsMember.scopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingScopesInOldRole.join(', '));
-
-      return {
-        error: {
-          message: `Missing access to some of the scopes of the existing role`,
-        },
-      };
-    }
-
-    const memberMissingScopesInNewRole = member.scopes.filter(
-      scope => !newRole.scopes.includes(scope),
-    );
-
-    // Ensure new role has at least the same access scopes as the old role, to avoid downgrading members
-    if (memberMissingScopesInNewRole.length > 0) {
-      // Admin role is an exception, admin can downgrade members
-      if (!this.isAdminRole(currentUserAsMember.role)) {
-        this.logger.debug(`New role scopes: %s`, newRole.scopes.join(', '));
-        this.logger.debug(`Old role scopes: %s`, member.scopes.join(', '));
-        return {
-          error: {
-            message: `Cannot downgrade member to a role with less access scopes`,
-          },
-        };
-      }
-    }
-
     // Assign the role to the member
     await this.storage.assignOrganizationMemberRole({
-      organizationId: input.organizationId,
+      organizationId,
       userId: input.userId,
       roleId: input.roleId,
     });
@@ -1159,22 +1071,35 @@ export class OrganizationManager {
     this.authManager.resetAccessCache();
     this.session.reset();
 
+    const previousMemberRole = previousMembership.assignedRole.role ?? null;
+    const updatedMembership = await this.organizationMembers.findOrganizationMembership({
+      organization,
+      userId: input.userId,
+    });
+
+    if (!updatedMembership) {
+      throw new Error('Somethign went wrong.');
+    }
+
     const result = {
-      updatedMember: await this.getOrganizationMember({
-        organizationId: input.organizationId,
-        userId: input.userId,
-      }),
-      previousMemberRole: member.role,
+      updatedMember: updatedMembership,
+      previousMemberRole,
     };
 
+    const user = await this.storage.getUserById({ id: previousMembership.userId });
+
+    if (!user) {
+      throw new Error('User not found.');
+    }
+
     if (result) {
       await this.auditLog.record({
         eventType: 'ROLE_ASSIGNED',
-        organizationId: input.organizationId,
+        organizationId,
         metadata: {
-          previousMemberRole: member.role ? member.role.name : null,
+          previousMemberRole: previousMemberRole ? previousMemberRole.name : null,
           roleId: newRole.id,
-          updatedMember: member.user.email,
+          updatedMember: user.email,
           userIdAssigned: input.userId,
         },
       });
@@ -1186,66 +1111,56 @@ export class OrganizationManager {
   }
 
   async updateMemberRole(input: {
-    organizationId: string;
+    organizationSlug: string;
     roleId: string;
     name: string;
     description: string;
-    organizationAccessScopes: readonly OrganizationAccessScope[];
-    projectAccessScopes: readonly ProjectAccessScope[];
-    targetAccessScopes: readonly TargetAccessScope[];
+    permissions: readonly string[];
   }) {
+    const organizationId = await this.idTranslator.translateOrganizationId(input);
     await this.session.assertPerformAction({
       action: 'member:modifyRole',
-      organizationId: input.organizationId,
+      organizationId,
       params: {
-        organizationId: input.organizationId,
+        organizationId,
       },
     });
-    const currentUser = await this.session.getViewer();
-    const [role, currentUserAsMember] = await Promise.all([
-      this.storage.getOrganizationMemberRole({
-        organizationId: input.organizationId,
-        roleId: input.roleId,
-      }),
-      this.getOrganizationMember({
-        organizationId: input.organizationId,
-        userId: currentUser.id,
-      }),
-    ]);
 
-    if (!role) {
+    const inputValidation = createOrUpdateMemberRoleInputSchema.safeParse({
+      name: input.name,
+      description: input.description,
+    });
+
+    if (!inputValidation.success) {
       return {
         error: {
-          message: 'Role not found',
+          message: 'Please check your input.',
+          inputErrors: {
+            name: inputValidation.error.formErrors.fieldErrors.name?.[0],
+            description: inputValidation.error.formErrors.fieldErrors.description?.[0],
+          },
         },
       };
     }
 
-    const newScopes = ensureReadAccess([
-      ...input.organizationAccessScopes,
-      ...input.projectAccessScopes,
-      ...input.targetAccessScopes,
-    ]);
-
-    const accessCheckResult = this.canUpdateRole(role, currentUserAsMember.scopes);
+    const role = await this.organizationMemberRoles.findMemberRoleById(input.roleId);
 
-    if (!accessCheckResult.ok) {
+    if (!role) {
       return {
         error: {
-          message: accessCheckResult.message,
+          message: 'Role not found',
         },
       };
     }
 
     // Ensure name is unique in the organization
     const roleName = input.name.trim();
-    const nameExists = await this.storage.hasOrganizationMemberRoleName({
-      organizationId: input.organizationId,
+    const foundRole = await this.organizationMemberRoles.findRoleByOrganizationIdAndName(
+      organizationId,
       roleName,
-      excludeRoleId: input.roleId,
-    });
+    );
 
-    if (nameExists) {
+    if (foundRole && foundRole.id === input.roleId) {
       const msg = 'Role name already exists. Please choose a different name.';
 
       return {
@@ -1258,50 +1173,13 @@ export class OrganizationManager {
       };
     }
 
-    const existingRoleScopes = role.scopes;
-    const hasAssignedMembers = role.membersCount > 0;
-
-    // Ensure user has access to all new scopes in the role
-    const currentUserMissingAccessInNewRole = newScopes.filter(
-      scope => !currentUserAsMember.scopes.includes(scope),
-    );
-
-    if (currentUserMissingAccessInNewRole.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserAsMember.scopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingAccessInNewRole.join(', '));
-
-      return {
-        error: {
-          message: `Missing access to some of the selected scopes`,
-        },
-      };
-    }
-
-    const missingOldRoleScopesInNewRole = existingRoleScopes.filter(
-      scope => !newScopes.includes(scope),
-    );
-
-    // Ensure new role has at least the same access scopes as the old role, to avoid downgrading members
-    if (hasAssignedMembers && missingOldRoleScopesInNewRole.length > 0) {
-      // Admin role is an exception, admin can downgrade members
-      if (!this.isAdminRole(currentUserAsMember.role)) {
-        this.logger.debug(`New role scopes: %s`, newScopes.join(', '));
-        this.logger.debug(`Old role scopes: %s`, existingRoleScopes.join(', '));
-        return {
-          error: {
-            message: `Cannot downgrade member to a role with less access scopes`,
-          },
-        };
-      }
-    }
-
     // Update the role
-    const updatedRole = await this.storage.updateOrganizationMemberRole({
-      organizationId: input.organizationId,
+    const updatedRole = await this.organizationMemberRoles.updateOrganizationMemberRole({
+      organizationId,
       roleId: input.roleId,
       name: roleName,
       description: input.description,
-      scopes: newScopes,
+      permissions: input.permissions,
     });
 
     // Access cache is stale by now
@@ -1310,17 +1188,18 @@ export class OrganizationManager {
 
     await this.auditLog.record({
       eventType: 'ROLE_UPDATED',
-      organizationId: input.organizationId,
+      organizationId,
       metadata: {
         roleId: updatedRole.id,
         roleName: updatedRole.name,
         updatedFields: JSON.stringify({
           name: roleName,
           description: input.description,
-          scopes: newScopes,
+          permissions: input.permissions,
         }),
       },
     });
+
     return {
       ok: {
         updatedRole,
@@ -1337,24 +1216,25 @@ export class OrganizationManager {
       },
     });
 
-    return this.storage.getOrganizationMemberRoles({
-      organizationId: selector.organizationId,
-    });
+    return this.organizationMemberRoles.getMemberRolesForOrganizationId(selector.organizationId);
   }
 
   async getMemberRole(selector: { organizationId: string; roleId: string }) {
+    const role = await this.organizationMemberRoles.findMemberRoleById(selector.roleId);
+
+    if (!role) {
+      return null;
+    }
+
     await this.session.assertPerformAction({
       action: 'member:describe',
-      organizationId: selector.organizationId,
+      organizationId: role.organizationId,
       params: {
-        organizationId: selector.organizationId,
+        organizationId: role.organizationId,
       },
     });
 
-    return this.storage.getOrganizationMemberRole({
-      organizationId: selector.organizationId,
-      roleId: selector.roleId,
-    });
+    return role;
   }
 
   async getViewerMemberRole(selector: { organizationId: string }) {
@@ -1366,19 +1246,10 @@ export class OrganizationManager {
       },
     });
 
-    return this.storage.getViewerOrganizationMemberRole({
-      organizationId: selector.organizationId,
-    });
+    return this.organizationMemberRoles.findViewerRoleByOrganizationId(selector.organizationId);
   }
 
-  async canDeleteRole(
-    role: OrganizationMemberRole,
-    currentUserScopes: readonly (
-      | OrganizationAccessScope
-      | ProjectAccessScope
-      | TargetAccessScope
-    )[],
-  ): Promise<
+  async canDeleteRole(role: OrganizationMemberRole): Promise<
     | {
         ok: false;
         message: string;
@@ -1388,26 +1259,24 @@ export class OrganizationManager {
       }
   > {
     // Ensure role is not locked (can't be deleted)
-    if (role.locked) {
+    if (role.isLocked) {
       return {
         ok: false,
         message: `Cannot delete a built-in role`,
       };
     }
     // Ensure role has no members
-    let membersCount: number | undefined = role.membersCount;
+    let membersCount: number | null = role.membersCount;
 
     if (typeof membersCount !== 'number') {
-      const freshRole = await this.storage.getOrganizationMemberRole({
-        organizationId: role.organizationId,
-        roleId: role.id,
-      });
+      const freshRole = await this.organizationMemberRoles.findMemberRoleById(role.id);
 
       if (!freshRole) {
         throw new Error('Role not found');
       }
 
-      membersCount = freshRole.membersCount;
+      // TODO: check this
+      membersCount = freshRole.membersCount ?? 0;
     }
 
     if (membersCount > 0) {
@@ -1417,21 +1286,6 @@ export class OrganizationManager {
       };
     }
 
-    // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes = role.scopes.filter(
-      scope => !currentUserScopes.includes(scope),
-    );
-
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserScopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingScopes.join(', '));
-
-      return {
-        ok: false,
-        message: `Missing access to some of the scopes of the role`,
-      };
-    }
-
     return {
       ok: true,
     };
@@ -1453,7 +1307,7 @@ export class OrganizationManager {
         ok: true;
       } {
     // Ensure role is not locked (can't be updated)
-    if (role.locked) {
+    if (role.isLocked) {
       return {
         ok: false,
         message: `Cannot update a built-in role`,
@@ -1461,9 +1315,8 @@ export class OrganizationManager {
     }
 
     // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes = role.scopes.filter(
-      scope => !currentUserScopes.includes(scope),
-    );
+    const currentUserMissingScopes =
+      role.legacyScopes?.filter(scope => !currentUserScopes.includes(scope)) ?? [];
 
     if (currentUserMissingScopes.length > 0) {
       this.logger.debug(`Logged user scopes: %s`, currentUserScopes.join(', '));
@@ -1496,9 +1349,8 @@ export class OrganizationManager {
         ok: true;
       } {
     // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes = role.scopes.filter(
-      scope => !currentUserScopes.includes(scope),
-    );
+    const currentUserMissingScopes =
+      role.legacyScopes?.filter(scope => !currentUserScopes.includes(scope)) ?? [];
 
     if (currentUserMissingScopes.length > 0) {
       this.logger.debug(`Logged user scopes: %s`, currentUserScopes.join(', '));
@@ -1514,8 +1366,4 @@ export class OrganizationManager {
       ok: true,
     };
   }
-
-  isAdminRole(role: { name: string; locked: boolean } | null) {
-    return role?.name === 'Admin' && role.locked === true;
-  }
 }
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
new file mode 100644
index 0000000000..8f5a0dc2fd
--- /dev/null
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -0,0 +1,316 @@
+import { Inject, Injectable, Scope } from 'graphql-modules';
+import { sql, type DatabasePool } from 'slonik';
+import { z } from 'zod';
+import { batch } from '../../../shared/helpers';
+import {
+  Permission,
+  PermissionsModel,
+  PermissionsPerResourceLevelAssignmentModel,
+  permissionsToPermissionsPerResourceLevelAssignment,
+} from '../../auth/lib/authz';
+import {
+  OrganizationAccessScope,
+  ProjectAccessScope,
+  TargetAccessScope,
+} from '../../auth/providers/scopes';
+import { Logger } from '../../shared/providers/logger';
+import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
+import * as OrganizationMemberPermissions from '../lib/organization-member-permissions';
+
+// function omit<T extends object, K extends keyof T>(obj: T, key: K): Omit<T, K> {
+//   const { [key]: _, ...rest } = obj;
+//   return rest;
+// }
+
+const MemberRoleModel = z
+  .intersection(
+    z.object({
+      id: z.string(),
+      name: z.string(),
+      description: z.string(),
+      isLocked: z.boolean(),
+      organizationId: z.string(),
+      membersCount: z.number(),
+    }),
+    z.union([
+      z.object({
+        legacyScopes: z
+          .array(z.string())
+          .transform(
+            value =>
+              value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
+          ),
+        permissions: z.null(),
+      }),
+      z.object({
+        legacyScopes: z.null(),
+        permissions: z.array(PermissionsModel),
+      }),
+    ]),
+  )
+  .transform(record => ({
+    // TODO: omit "legacyScopes" property
+    ...record,
+    permissions: record.permissions
+      ? permissionsToPermissionsPerResourceLevelAssignment([
+          ...OrganizationMemberPermissions.permissions.default,
+          ...record.permissions,
+        ])
+      : transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes),
+  }));
+
+export type OrganizationMemberRole = z.TypeOf<typeof MemberRoleModel>;
+
+@Injectable({
+  scope: Scope.Operation,
+  global: true,
+})
+export class OrganizationMemberRoles {
+  private logger: Logger;
+
+  constructor(
+    @Inject(PG_POOL_CONFIG) private pool: DatabasePool,
+    logger: Logger,
+  ) {
+    this.logger = logger.child({
+      source: 'OrganizationMemberRoles',
+    });
+  }
+
+  async getMemberRolesForOrganizationId(organizationId: string) {
+    const query = sql`
+      SELECT
+        ${organizationMemberRoleFields}
+      FROM
+        "organization_member_roles"
+      WHERE
+        "organization_id" = ${organizationId}
+    `;
+
+    const records = await this.pool.any<unknown>(query);
+
+    return records.map(row => MemberRoleModel.parse(row));
+  }
+
+  /** Find member roles by their ID */
+  async findMemberRolesByIds(roleIds: Array<string>) {
+    this.logger.debug('Find organization membership roles. (roleIds=%o)', roleIds);
+
+    const query = sql`
+      SELECT
+        ${organizationMemberRoleFields}
+      FROM
+        "organization_member_roles"
+      WHERE
+        "id" = ANY(${sql.array(roleIds, 'uuid')})
+    `;
+
+    const result = await this.pool.any<unknown>(query);
+
+    const rowsById = new Map<string, OrganizationMemberRole>();
+
+    for (const row of result) {
+      const record = MemberRoleModel.parse(row);
+
+      rowsById.set(record.id, record);
+    }
+    return rowsById;
+  }
+
+  findMemberRoleById = batch<string, OrganizationMemberRole | null>(async roleIds => {
+    const roles = await this.findMemberRolesByIds(roleIds);
+    return roleIds.map(async roleId => roles.get(roleId) ?? null);
+  });
+
+  async findRoleByOrganizationIdAndName(organizationId: string, name: string) {
+    const result = await this.pool.maybeOne<unknown>(sql`/* findViewerRoleForOrganizationId */
+      SELECT
+        ${organizationMemberRoleFields}
+      FROM
+        "organization_member_roles"
+      WHERE
+        "organization_id" = ${organizationId}
+        AND "name" = ${name}
+      LIMIT 1
+    `);
+
+    if (result === null) {
+      return null;
+    }
+
+    return MemberRoleModel.parse(result);
+  }
+
+  async findViewerRoleByOrganizationId(organizationId: string) {
+    return this.findRoleByOrganizationIdAndName(organizationId, 'Viewer');
+  }
+
+  async createOrganizationMemberRole(args: {
+    organizationId: string;
+    name: string;
+    description: string;
+    permissions: ReadonlyArray<string>;
+  }): Promise<OrganizationMemberRole> {
+    const permissions = args.permissions.filter(permission =>
+      OrganizationMemberPermissions.permissions.assignable.has(permission as Permission),
+    );
+    const role = await this.pool.one(
+      sql`/* createOrganizationMemberRole */
+        INSERT INTO "organization_member_roles" (
+          "organization_id"
+          , "name"
+          , "description"
+          , "scopes"
+          , "permissions"
+        )
+        VALUES (
+          ${args.organizationId}
+          , ${args.name}
+          , ${args.description}
+          , NULL
+          , ${sql.array(permissions, 'text')}
+        )
+        RETURNING
+          ${organizationMemberRoleFields}
+      `,
+    );
+
+    return MemberRoleModel.parse(role);
+  }
+
+  async updateOrganizationMemberRole(args: {
+    organizationId: string;
+    roleId: string;
+    name: string;
+    permissions: ReadonlyArray<string>;
+    description: string;
+  }) {
+    const permissions = args.permissions.filter(permission =>
+      OrganizationMemberPermissions.permissions.assignable.has(permission as Permission),
+    );
+
+    const role = await this.pool.one(
+      sql`/* updateOrganizationMemberRole */
+        UPDATE
+          "organization_member_roles"
+        SET
+          "name" = ${args.name}
+          , "description" = ${args.description}
+          , "scopes" = NULL
+          , "permissions" = ${sql.array(permissions, 'text')}
+        WHERE
+          "organization_id" = ${args.organizationId} AND id = ${args.roleId}
+        RETURNING
+          ${organizationMemberRoleFields}
+      `,
+    );
+
+    return MemberRoleModel.parse(role);
+  }
+}
+
+export function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
+  scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
+): z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> {
+  const permissions = permissionsToPermissionsPerResourceLevelAssignment([
+    ...OrganizationMemberPermissions.permissions.default,
+  ]);
+  for (const scope of scopes) {
+    switch (scope) {
+      case OrganizationAccessScope.READ: {
+        permissions.organization.add('organization:describe');
+        permissions.organization.add('support:manageTickets');
+        permissions.organization.add('project:create');
+        permissions.project.add('project:describe');
+        break;
+      }
+      case OrganizationAccessScope.SETTINGS: {
+        permissions.organization.add('organization:modifySlug');
+        permissions.organization.add('schemaLinting:modifyOrganizationRules');
+        permissions.organization.add('billing:describe');
+        permissions.organization.add('billing:update');
+        permissions.organization.add('auditLog:export');
+        break;
+      }
+      case OrganizationAccessScope.DELETE: {
+        permissions.organization.add('organization:delete');
+        break;
+      }
+      case OrganizationAccessScope.INTEGRATIONS: {
+        permissions.organization.add('oidc:modify');
+        permissions.organization.add('gitHubIntegration:modify');
+        permissions.organization.add('slackIntegration:modify');
+
+        break;
+      }
+      case OrganizationAccessScope.MEMBERS: {
+        permissions.organization.add('member:manageInvites');
+        permissions.organization.add('member:removeMember');
+        permissions.organization.add('member:assignRole');
+        permissions.organization.add('member:modifyRole');
+        permissions.organization.add('member:describe');
+        break;
+      }
+      case ProjectAccessScope.ALERTS: {
+        permissions.project.add('alert:modify');
+        break;
+      }
+      case ProjectAccessScope.READ: {
+        permissions.project.add('project:describe');
+        break;
+      }
+      case ProjectAccessScope.DELETE: {
+        permissions.project.add('project:delete');
+        break;
+      }
+      case ProjectAccessScope.SETTINGS: {
+        permissions.project.add('project:delete');
+        permissions.project.add('project:modifySettings');
+        permissions.project.add('schemaLinting:modifyProjectRules');
+        break;
+      }
+      case TargetAccessScope.READ: {
+        permissions.project.add('target:create');
+        permissions.target.add('appDeployment:describe');
+        permissions.target.add('laboratory:describe');
+        break;
+      }
+      case TargetAccessScope.REGISTRY_WRITE: {
+        permissions.target.add('laboratory:modify');
+        permissions.service.add('schemaCheck:approve');
+        break;
+      }
+      case TargetAccessScope.TOKENS_WRITE: {
+        permissions.target.add('targetAccessToken:modify');
+        permissions.target.add('cdnAccessToken:modify');
+        break;
+      }
+      case TargetAccessScope.SETTINGS: {
+        permissions.target.add('target:modifySettings');
+        permissions.target.add('laboratory:modifyPreflightScript');
+        break;
+      }
+      case TargetAccessScope.DELETE: {
+        permissions.target.add('target:delete');
+        break;
+      }
+    }
+  }
+
+  return permissions;
+}
+
+const organizationMemberRoleFields = sql`
+  "organization_member_roles"."id"
+  , "organization_member_roles"."name"
+  , "organization_member_roles"."description"
+  , "organization_member_roles"."locked" AS "isLocked"
+  , "organization_member_roles"."scopes" AS "legacyScopes"
+  , "organization_member_roles"."permissions"
+  , "organization_member_roles"."organization_id" AS "organizationId"
+  , (
+    SELECT COUNT(*)
+    FROM "organization_member" AS "om"
+    WHERE "om"."role_id" = "organization_member_roles"."id"
+  ) AS "membersCount"
+`;
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
new file mode 100644
index 0000000000..de995c072c
--- /dev/null
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -0,0 +1,363 @@
+import { Inject, Injectable, Scope } from 'graphql-modules';
+import { sql, type DatabasePool } from 'slonik';
+import { z } from 'zod';
+import { Organization } from '../../../shared/entities';
+import { batchBy } from '../../../shared/helpers';
+import { isUUID } from '../../../shared/is-uuid';
+import { Logger } from '../../shared/providers/logger';
+import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
+import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
+
+const RawOrganizationMembershipModel = z.object({
+  userId: z.string(),
+  roleId: z.string(),
+  connectedToZendesk: z
+    .boolean()
+    .nullable()
+    .transform(value => value ?? false),
+});
+
+const UUIDResourceAssignmentModel = z.union([z.literal('*'), z.array(z.string().uuid())]);
+
+/**
+ * String in the form `targetId/serviceName`
+ * Example: `f81ce726-2abf-4653-bf4c-d8436cde255a/users`
+ */
+const ServiceResourceAssignmentStringModel = z
+  .string()
+  .refine(value => {
+    const [targetId, serviceName = ''] = value.split('/');
+    if (isUUID(targetId) === false || serviceName === '') {
+      return false;
+    }
+    return true;
+  }, 'Invalid service resource assignment')
+  .transform(value => value.split('/') as [targetId: string, serviceName: string]);
+
+const ServiceResourceAssignmentModel = z.union([
+  z.literal('*'),
+  z.array(ServiceResourceAssignmentStringModel),
+]);
+
+const ResourceAssignmentGroupModel = z.object({
+  /** Resources assigned to a 'projects' permission group */
+  project: UUIDResourceAssignmentModel,
+  /** Resources assigned to a 'targets' permission group */
+  target: UUIDResourceAssignmentModel,
+  /** Resources assigned to a 'service' permission group */
+  service: ServiceResourceAssignmentModel,
+  /** Resources assigned to a 'appDeployment' permission group */
+  appDeployment: ServiceResourceAssignmentModel,
+});
+
+/**
+ * Resource assignments as stored within the database.
+ */
+type ResourceAssignmentGroup = z.TypeOf<typeof ResourceAssignmentGroupModel>;
+
+export type OrganizationMembershipRoleAssignment = {
+  role: OrganizationMemberRole;
+  /**
+   * Resource assignments as stored within the database.
+   */
+  resources: ResourceAssignmentGroup;
+  /**
+   * Resolved resource groups, used for runtime permission checks.
+   */
+  resolvedResources: ResolvedResourceAssignments;
+};
+
+export type OrganizationMembership = {
+  organizationId: string;
+  isOwner: boolean;
+  userId: string;
+  assignedRole: OrganizationMembershipRoleAssignment;
+  connectedToZendesk: boolean;
+};
+
+@Injectable({
+  scope: Scope.Operation,
+  global: true,
+})
+export class OrganizationMembers {
+  private logger: Logger;
+
+  constructor(
+    @Inject(PG_POOL_CONFIG) private pool: DatabasePool,
+    private organizationMemberRoles: OrganizationMemberRoles,
+    logger: Logger,
+  ) {
+    this.logger = logger.child({
+      source: 'OrganizationMembers',
+    });
+  }
+
+  private async findOrganizationMembers(
+    organizationId: string,
+    userIds: Array<string> | null = null,
+  ) {
+    const query = sql`
+    SELECT
+      "om"."user_id" AS "userId"
+      , "om"."role_id" AS "legacyRoleId"
+      , "om"."scopes" AS "legacyScopes"
+      , "om"."connected_to_zendesk" AS "connectedToZendesk"
+    FROM
+      "organization_member" AS "om"
+    WHERE
+      "om"."organization_id" = ${organizationId}
+      ${userIds ? sql`AND "om"."user_id" = ANY(${sql.array(userIds, 'uuid')})` : sql``}
+  `;
+
+    const result = await this.pool.any<unknown>(query);
+    return result.map(row => RawOrganizationMembershipModel.parse(row));
+  }
+
+  /**
+   * Handles legacy scopes and role assignments and automatically transforms
+   * them into resource based role assignments.
+   */
+  private async resolveMemberships(
+    organization: Organization,
+    organizationMembers: Array<z.TypeOf<typeof RawOrganizationMembershipModel>>,
+  ) {
+    const organizationMembershipByUserId = new Map</* userId */ string, OrganizationMembership>();
+
+    // Roles that are assigned using the legacy "single role" way
+    const roleLookups = new Set<string>();
+
+    for (const record of organizationMembers) {
+      roleLookups.add(record.roleId);
+    }
+
+    if (roleLookups.size) {
+      // This handles the legacy "single" role assignments
+      // We load the roles and then attach them to the already loaded membership role
+      const roleIds = Array.from(roleLookups);
+
+      this.logger.debug('Lookup role assignments. (roleIds=%o)', roleIds);
+
+      const memberRolesById = await this.organizationMemberRoles.findMemberRolesByIds(roleIds);
+
+      for (const record of organizationMembers) {
+        const membershipRole = memberRolesById.get(record.roleId);
+        if (!membershipRole) {
+          throw new Error('Could not resolve role.');
+        }
+
+        // TODO: see if membership has resource assignments
+        const resources: ResourceAssignmentGroup = {
+          project: '*',
+          target: '*',
+          service: '*',
+          appDeployment: '*',
+        };
+
+        organizationMembershipByUserId.set(record.userId, {
+          organizationId: organization.id,
+          userId: record.userId,
+          isOwner: organization.ownerId === record.userId,
+          connectedToZendesk: record.connectedToZendesk,
+          assignedRole: {
+            resources,
+            resolvedResources: resolveResourceAssignment({
+              organizationId: organization.id,
+              groups: resources,
+            }),
+            role: membershipRole,
+          },
+        });
+      }
+    }
+
+    return organizationMembershipByUserId;
+  }
+
+  async findOrganizationMembersForOrganization(organization: Organization) {
+    this.logger.debug(
+      'Find organization members for organization. (organizationId=%s)',
+      organization.id,
+    );
+    const organizationMembers = await this.findOrganizationMembers(organization.id);
+    const mapping = await this.resolveMemberships(organization, organizationMembers);
+
+    return organizationMembers.map(record => {
+      const member = mapping.get(record.userId);
+      if (!member) {
+        throw new Error('Could not find member.');
+      }
+      return member;
+    });
+  }
+
+  /**
+   * Batched loader function for a organization membership.
+   */
+  findOrganizationMembership = batchBy(
+    (args: { organization: Organization; userId: string }) => args.organization.id,
+    async args => {
+      const organization = args[0].organization;
+      const userIds = args.map(arg => arg.userId);
+
+      this.logger.debug(
+        'Find organization membership for users. (organizationId=%s, userIds=%o)',
+        organization.id,
+        userIds,
+      );
+
+      const organizationMembers = await this.findOrganizationMembers(organization.id, userIds);
+      const mapping = await this.resolveMemberships(organization, organizationMembers);
+
+      return userIds.map(async userId => mapping.get(userId) ?? null);
+    },
+  );
+
+  findOrganizationOwner(organization: Organization) {
+    return this.findOrganizationMembership({
+      organization,
+      userId: organization.ownerId,
+    });
+  }
+
+  /**
+   * Find the organization members that have no role assigned and use the legacy scopes.
+   */
+  async findOrganizationMembersWithoutAssignedRole(organization: Organization) {
+    const query = sql`
+      SELECT
+        "om"."user_id" AS "userId"
+        , "om"."role_id" AS "legacyRoleId"
+        , "om"."connected_to_zendesk" AS "connectedToZendesk"
+      FROM
+        "organization_member" AS "om"
+      WHERE
+        "om"."organization_id" = ${organization.id}
+        AND "om"."role_id" IS NULL
+    `;
+
+    const records = await this.pool.any<unknown>(query);
+    const organizationMembers = records.map(row => RawOrganizationMembershipModel.parse(row));
+    const mapping = await this.resolveMemberships(organization, organizationMembers);
+    return Array.from(mapping.values());
+  }
+}
+
+type OrganizationAssignment = {
+  type: 'organization';
+  organizationId: string;
+};
+
+type ProjectAssignment = {
+  type: 'project';
+  projectId: string;
+};
+
+type TargetAssignment = {
+  type: 'target';
+  targetId: string;
+};
+
+type ServiceAssignment = {
+  type: 'service';
+  targetId: string;
+  serviceName: string;
+};
+
+type AppDeploymentAssignment = {
+  type: 'appDeployment';
+  targetId: string;
+  appDeploymentName: string;
+};
+
+export type ResourceAssignment =
+  | OrganizationAssignment
+  | ProjectAssignment
+  | TargetAssignment
+  | ServiceAssignment
+  | AppDeploymentAssignment;
+
+type ResolvedResourceAssignments = {
+  organization: OrganizationAssignment;
+  project: OrganizationAssignment | Array<ProjectAssignment>;
+  target: OrganizationAssignment | Array<ProjectAssignment> | Array<TargetAssignment>;
+  service:
+    | OrganizationAssignment
+    | Array<ProjectAssignment>
+    | Array<TargetAssignment>
+    | Array<ServiceAssignment>;
+  appDeployment:
+    | OrganizationAssignment
+    | Array<ProjectAssignment>
+    | Array<TargetAssignment>
+    | Array<AppDeploymentAssignment>;
+};
+
+/**
+ * This function resolves the "stored-in-database", user configuration to the actual resolved structure
+ * Currently, we have the following hierarchy
+ *
+ *        organization
+ *             v
+ *           project
+ *             v
+ *           target
+ *          v      v
+ * app deployment  service
+ *
+ * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
+ */
+function resolveResourceAssignment(args: {
+  organizationId: string;
+  groups: ResourceAssignmentGroup;
+}): ResolvedResourceAssignments {
+  const organization: OrganizationAssignment = {
+    type: 'organization',
+    organizationId: args.organizationId,
+  };
+
+  let project: ResolvedResourceAssignments['project'] = organization;
+
+  if (args.groups.project !== '*') {
+    project = args.groups.project.map(projectId => ({
+      type: 'project',
+      projectId,
+    }));
+  }
+
+  let target: ResolvedResourceAssignments['target'] = project;
+
+  if (args.groups.target !== '*') {
+    target = args.groups.target.map(targetId => ({
+      type: 'target',
+      targetId,
+    }));
+  }
+
+  let service: ResolvedResourceAssignments['service'] = target;
+
+  if (args.groups.service !== '*') {
+    service = args.groups.service.map(([targetId, serviceName]) => ({
+      type: 'service',
+      targetId,
+      serviceName,
+    }));
+  }
+
+  let appDeployment: ResolvedResourceAssignments['appDeployment'] = target;
+
+  if (args.groups.service !== '*') {
+    appDeployment = args.groups.service.map(([targetId, appDeploymentName]) => ({
+      type: 'appDeployment',
+      targetId,
+      appDeploymentName,
+    }));
+  }
+
+  return {
+    organization,
+    project,
+    target,
+    service,
+    appDeployment,
+  };
+}
diff --git a/packages/services/api/src/modules/organization/resolvers/Member.ts b/packages/services/api/src/modules/organization/resolvers/Member.ts
index 9e450fd00d..fad2a3ba14 100644
--- a/packages/services/api/src/modules/organization/resolvers/Member.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Member.ts
@@ -1,21 +1,16 @@
+import { Storage } from '../../shared/providers/storage';
 import { OrganizationManager } from '../providers/organization-manager';
 import type { MemberResolvers } from './../../../__generated__/types';
 
-export const Member: Pick<
-  MemberResolvers,
-  'canLeaveOrganization' | 'isAdmin' | 'role' | 'viewerCanRemove' | '__isTypeOf'
-> = {
+export const Member: MemberResolvers = {
   canLeaveOrganization: async (member, _, { injector }) => {
     const { result } = await injector.get(OrganizationManager).canLeaveOrganization({
-      organizationId: member.organization,
-      userId: member.user.id,
+      organizationId: member.organizationId,
+      userId: member.userId,
     });
 
     return result;
   },
-  isAdmin: (member, _, { injector }) => {
-    return member.isOwner || injector.get(OrganizationManager).isAdminRole(member.role);
-  },
   viewerCanRemove: async (member, _arg, { session }) => {
     if (member.isOwner) {
       return false;
@@ -23,10 +18,23 @@ export const Member: Pick<
 
     return await session.canPerformAction({
       action: 'member:removeMember',
-      organizationId: member.organization,
+      organizationId: member.organizationId,
       params: {
-        organizationId: member.organization,
+        organizationId: member.organizationId,
       },
     });
   },
+  role: (member, _arg, _ctx) => {
+    return member.assignedRole.role;
+  },
+  id: async (member, _arg, _ctx) => {
+    return member.userId;
+  },
+  user: async (member, _arg, { injector }) => {
+    const user = await injector.get(Storage).getUserById({ id: member.userId });
+    if (!user) {
+      throw new Error('User not found.');
+    }
+    return user;
+  },
 };
diff --git a/packages/services/api/src/modules/auth/resolvers/MemberConnection.ts b/packages/services/api/src/modules/organization/resolvers/MemberConnection.ts
similarity index 90%
rename from packages/services/api/src/modules/auth/resolvers/MemberConnection.ts
rename to packages/services/api/src/modules/organization/resolvers/MemberConnection.ts
index 91f3e1cd7f..56d1a370b4 100644
--- a/packages/services/api/src/modules/auth/resolvers/MemberConnection.ts
+++ b/packages/services/api/src/modules/organization/resolvers/MemberConnection.ts
@@ -1,5 +1,5 @@
+import type { MemberConnectionResolvers, ResolversTypes } from '../../../__generated__/types';
 import { createConnection } from '../../../shared/schema';
-import type { MemberConnectionResolvers, ResolversTypes } from './../../../__generated__/types';
 
 const connection = createConnection<ResolversTypes['Member']>();
 
diff --git a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
index f988985252..2e94a09983 100644
--- a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
@@ -1,77 +1,50 @@
 import { Session } from '../../auth/lib/authz';
-import { isOrganizationScope } from '../../auth/providers/organization-access';
-import { isProjectScope } from '../../auth/providers/project-access';
-import { isTargetScope } from '../../auth/providers/target-access';
-import { OrganizationManager } from '../providers/organization-manager';
 import type { MemberRoleResolvers } from './../../../__generated__/types';
 
 export const MemberRole: MemberRoleResolvers = {
-  organizationAccessScopes: role => {
-    return role.scopes.filter(isOrganizationScope);
-  },
-  projectAccessScopes: role => {
-    return role.scopes.filter(isProjectScope);
-  },
-  targetAccessScopes: role => {
-    return role.scopes.filter(isTargetScope);
-  },
-  membersCount: async (role, _, { injector }) => {
-    if (role.membersCount) {
-      return role.membersCount;
-    }
-
-    return injector
-      .get(OrganizationManager)
-      .getMemberRole({
-        organizationId: role.organizationId,
-        roleId: role.id,
-      })
-      .then(r => r?.membersCount ?? 0);
-  },
   canDelete: async (role, _, { injector }) => {
-    if (role.locked) {
+    if (role.isLocked) {
       return false;
     }
-
-    const currentUser = await injector.get(Session).getViewer();
-    const currentUserAsMember = await injector.get(OrganizationManager).getOrganizationMember({
+    return await injector.get(Session).canPerformAction({
+      action: 'member:modifyRole',
       organizationId: role.organizationId,
-      userId: currentUser.id,
+      params: {
+        organizationId: role.organizationId,
+      },
     });
-
-    const result = await injector
-      .get(OrganizationManager)
-      .canDeleteRole(role, currentUserAsMember.scopes);
-
-    return result.ok;
   },
   canUpdate: async (role, _, { injector }) => {
-    if (role.locked) {
+    if (role.isLocked) {
       return false;
     }
-    const currentUser = await injector.get(Session).getViewer();
-    const currentUserAsMember = await injector.get(OrganizationManager).getOrganizationMember({
+    return await injector.get(Session).canPerformAction({
+      action: 'member:modifyRole',
       organizationId: role.organizationId,
-      userId: currentUser.id,
+      params: {
+        organizationId: role.organizationId,
+      },
     });
-
-    const result = injector
-      .get(OrganizationManager)
-      .canUpdateRole(role, currentUserAsMember.scopes);
-
-    return result.ok;
   },
   canInvite: async (role, _, { injector }) => {
-    const currentUser = await injector.get(Session).getViewer();
-    const currentUserAsMember = await injector.get(OrganizationManager).getOrganizationMember({
+    return await injector.get(Session).canPerformAction({
+      action: 'member:manageInvites',
       organizationId: role.organizationId,
-      userId: currentUser.id,
+      params: {
+        organizationId: role.organizationId,
+      },
     });
-
-    const result = injector
-      .get(OrganizationManager)
-      .canInviteRole(role, currentUserAsMember.scopes);
-
-    return result.ok;
+  },
+  locked: async (role, _arg, _ctx) => {
+    return role.isLocked;
+  },
+  permissions: (role, _arg, _ctx) => {
+    return [
+      ...role.permissions.organization,
+      ...role.permissions.project,
+      ...role.permissions.target,
+      ...role.permissions.service,
+      ...role.permissions.appDeployment,
+    ];
   },
 };
diff --git a/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts b/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
index 5c63e6f8c4..1ea7417ea4 100644
--- a/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
@@ -1,4 +1,3 @@
-import { IdTranslator } from '../../../shared/providers/id-translator';
 import { OrganizationManager } from '../../providers/organization-manager';
 import type { MutationResolvers } from './../../../../__generated__/types';
 
@@ -7,10 +6,8 @@ export const assignMemberRole: NonNullable<MutationResolvers['assignMemberRole']
   { input },
   { injector },
 ) => {
-  const organizationId = await injector.get(IdTranslator).translateOrganizationId(input);
-
   return injector.get(OrganizationManager).assignMemberRole({
-    organizationId,
+    organizationSlug: input.organizationSlug,
     userId: input.userId,
     roleId: input.roleId,
   });
diff --git a/packages/services/api/src/modules/organization/resolvers/Mutation/createMemberRole.ts b/packages/services/api/src/modules/organization/resolvers/Mutation/createMemberRole.ts
index c8c481abaf..f35219273a 100644
--- a/packages/services/api/src/modules/organization/resolvers/Mutation/createMemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Mutation/createMemberRole.ts
@@ -1,6 +1,4 @@
-import { IdTranslator } from '../../../shared/providers/id-translator';
 import { OrganizationManager } from '../../providers/organization-manager';
-import { createOrUpdateMemberRoleInputSchema } from '../../validation';
 import type { MutationResolvers } from './../../../../__generated__/types';
 
 export const createMemberRole: NonNullable<MutationResolvers['createMemberRole']> = async (
@@ -8,31 +6,10 @@ export const createMemberRole: NonNullable<MutationResolvers['createMemberRole']
   { input },
   { injector },
 ) => {
-  const inputValidation = createOrUpdateMemberRoleInputSchema.safeParse({
+  return await injector.get(OrganizationManager).createMemberRole({
+    organizationSlug: input.organizationSlug,
     name: input.name,
     description: input.description,
-  });
-
-  if (!inputValidation.success) {
-    return {
-      error: {
-        message: 'Please check your input.',
-        inputErrors: {
-          name: inputValidation.error.formErrors.fieldErrors.name?.[0],
-          description: inputValidation.error.formErrors.fieldErrors.description?.[0],
-        },
-      },
-    };
-  }
-
-  const organizationId = await injector.get(IdTranslator).translateOrganizationId(input);
-
-  return injector.get(OrganizationManager).createMemberRole({
-    organizationId,
-    name: inputValidation.data.name,
-    description: inputValidation.data.description,
-    organizationAccessScopes: input.organizationAccessScopes,
-    projectAccessScopes: input.projectAccessScopes,
-    targetAccessScopes: input.targetAccessScopes,
+    permissions: input.selectedPermissions,
   });
 };
diff --git a/packages/services/api/src/modules/organization/resolvers/Mutation/updateMemberRole.ts b/packages/services/api/src/modules/organization/resolvers/Mutation/updateMemberRole.ts
index ed206463f8..6f641e1ca8 100644
--- a/packages/services/api/src/modules/organization/resolvers/Mutation/updateMemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Mutation/updateMemberRole.ts
@@ -1,6 +1,4 @@
-import { IdTranslator } from '../../../shared/providers/id-translator';
 import { OrganizationManager } from '../../providers/organization-manager';
-import { createOrUpdateMemberRoleInputSchema } from '../../validation';
 import type { MutationResolvers } from './../../../../__generated__/types';
 
 export const updateMemberRole: NonNullable<MutationResolvers['updateMemberRole']> = async (
@@ -8,31 +6,11 @@ export const updateMemberRole: NonNullable<MutationResolvers['updateMemberRole']
   { input },
   { injector },
 ) => {
-  const inputValidation = createOrUpdateMemberRoleInputSchema.safeParse({
-    name: input.name,
-    description: input.description,
-  });
-
-  if (!inputValidation.success) {
-    return {
-      error: {
-        message: 'Please check your input.',
-        inputErrors: {
-          name: inputValidation.error.formErrors.fieldErrors.name?.[0],
-          description: inputValidation.error.formErrors.fieldErrors.description?.[0],
-        },
-      },
-    };
-  }
-  const organizationId = await injector.get(IdTranslator).translateOrganizationId(input);
-
   return injector.get(OrganizationManager).updateMemberRole({
-    organizationId,
+    organizationSlug: input.organizationSlug,
     roleId: input.roleId,
-    name: inputValidation.data.name,
-    description: inputValidation.data.description,
-    organizationAccessScopes: input.organizationAccessScopes,
-    projectAccessScopes: input.projectAccessScopes,
-    targetAccessScopes: input.targetAccessScopes,
+    name: input.name,
+    description: input.description,
+    permissions: input.selectedPermissions,
   });
 };
diff --git a/packages/services/api/src/modules/organization/resolvers/Organization.ts b/packages/services/api/src/modules/organization/resolvers/Organization.ts
index 87d8dd6741..f449df39de 100644
--- a/packages/services/api/src/modules/organization/resolvers/Organization.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Organization.ts
@@ -1,9 +1,13 @@
 import { Session } from '../../auth/lib/authz';
+import { allPermissionGroups } from '../lib/organization-member-permissions';
 import { OrganizationManager } from '../providers/organization-manager';
+import { OrganizationMemberRoles } from '../providers/organization-member-roles';
+import { OrganizationMembers } from '../providers/organization-members';
 import type { OrganizationResolvers } from './../../../__generated__/types';
 
 export const Organization: Pick<
   OrganizationResolvers,
+  | 'availableMemberPermissionGroups'
   | 'cleanId'
   | 'getStarted'
   | 'id'
@@ -28,23 +32,30 @@ export const Organization: Pick<
   __isTypeOf: organization => {
     return !!organization.id;
   },
-  owner: (organization, _, { injector }) => {
-    return injector
-      .get(OrganizationManager)
-      .getOrganizationOwner({ organizationId: organization.id });
+  owner: async (organization, _, { injector }) => {
+    const owner = await injector.get(OrganizationMembers).findOrganizationOwner(organization);
+    if (!owner) {
+      throw new Error('Not found.');
+    }
+
+    return owner;
   },
   me: async (organization, _, { injector }) => {
     const me = await injector.get(Session).getViewer();
-    const members = await injector
-      .get(OrganizationManager)
-      .getOrganizationMembers({ organizationId: organization.id });
 
-    return members.find(m => m.id === me.id)!;
+    const member = await injector.get(OrganizationMembers).findOrganizationMembership({
+      organization,
+      userId: me.id,
+    });
+
+    if (!member) {
+      throw new Error('Could not find member.');
+    }
+
+    return member;
   },
   members: (organization, _, { injector }) => {
-    return injector
-      .get(OrganizationManager)
-      .getOrganizationMembers({ organizationId: organization.id });
+    return injector.get(OrganizationMembers).findOrganizationMembersForOrganization(organization);
   },
   invitations: async (organization, _, { injector }) => {
     const invitations = await injector.get(OrganizationManager).getInvitations({
@@ -57,9 +68,7 @@ export const Organization: Pick<
     };
   },
   memberRoles: (organization, _, { injector }) => {
-    return injector.get(OrganizationManager).getMemberRoles({
-      organizationId: organization.id,
-    });
+    return injector.get(OrganizationMemberRoles).getMemberRolesForOrganizationId(organization.id);
   },
   cleanId: organization => organization.slug,
   viewerCanDelete: async (organization, _arg, { session }) => {
@@ -173,4 +182,7 @@ export const Organization: Pick<
       },
     });
   },
+  availableMemberPermissionGroups: () => {
+    return allPermissionGroups;
+  },
 };
diff --git a/packages/services/api/src/modules/organization/resolvers/OrganizationInvitation.ts b/packages/services/api/src/modules/organization/resolvers/OrganizationInvitation.ts
index 6054e715d4..9b83668b70 100644
--- a/packages/services/api/src/modules/organization/resolvers/OrganizationInvitation.ts
+++ b/packages/services/api/src/modules/organization/resolvers/OrganizationInvitation.ts
@@ -1,3 +1,4 @@
+import { OrganizationMemberRoles } from '../providers/organization-member-roles';
 import type { OrganizationInvitationResolvers } from './../../../__generated__/types';
 
 export const OrganizationInvitation: OrganizationInvitationResolvers = {
@@ -12,4 +13,11 @@ export const OrganizationInvitation: OrganizationInvitationResolvers = {
   expiresAt: invitation => {
     return invitation.expires_at;
   },
+  role: async (invitation, _arg, { injector }) => {
+    const role = await injector.get(OrganizationMemberRoles).findMemberRoleById(invitation.roleId);
+    if (!role) {
+      throw new Error('Not found.');
+    }
+    return role;
+  },
 };
diff --git a/packages/services/api/src/modules/shared/providers/storage.ts b/packages/services/api/src/modules/shared/providers/storage.ts
index c57f242e9c..1b4d145bf1 100644
--- a/packages/services/api/src/modules/shared/providers/storage.ts
+++ b/packages/services/api/src/modules/shared/providers/storage.ts
@@ -24,7 +24,6 @@ import type {
   Organization,
   OrganizationBilling,
   OrganizationInvitation,
-  OrganizationMemberRole,
   PaginatedDocumentCollectionOperations,
   PaginatedDocumentCollections,
   Project,
@@ -198,35 +197,6 @@ export interface Storage {
 
   deleteOrganizationMember(_: OrganizationSelector & { userId: string }): Promise<void>;
 
-  hasOrganizationMemberRoleName(_: {
-    organizationId: string;
-    roleName: string;
-    excludeRoleId?: string;
-  }): Promise<boolean>;
-  getOrganizationMemberRoles(_: {
-    organizationId: string;
-  }): Promise<ReadonlyArray<OrganizationMemberRole>>;
-  getViewerOrganizationMemberRole(_: { organizationId: string }): Promise<OrganizationMemberRole>;
-  getAdminOrganizationMemberRole(_: { organizationId: string }): Promise<OrganizationMemberRole>;
-  getOrganizationMemberRole(_: { organizationId: string; roleId: string }): Promise<
-    | (OrganizationMemberRole & {
-        membersCount: number;
-      })
-    | null
-  >;
-  createOrganizationMemberRole(_: {
-    organizationId: string;
-    name: string;
-    description: string;
-    scopes: ReadonlyArray<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>;
-  }): Promise<OrganizationMemberRole>;
-  updateOrganizationMemberRole(_: {
-    organizationId: string;
-    roleId: string;
-    name: string;
-    description: string;
-    scopes: ReadonlyArray<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>;
-  }): Promise<OrganizationMemberRole>;
   assignOrganizationMemberRole(_: {
     organizationId: string;
     roleId: string;
diff --git a/packages/services/api/src/modules/support/providers/support-manager.ts b/packages/services/api/src/modules/support/providers/support-manager.ts
index 53b3068bff..cc96d9ba48 100644
--- a/packages/services/api/src/modules/support/providers/support-manager.ts
+++ b/packages/services/api/src/modules/support/providers/support-manager.ts
@@ -196,19 +196,25 @@ export class SupportManager {
     organizationId: string;
   }): Promise<string> {
     const organizationZendeskId = await this.ensureZendeskOrganizationId(input.organizationId);
-    const userAsMember = await this.organizationManager.getOrganizationMember({
+    const membership = await this.organizationManager.getOrganizationMember({
       organizationId: input.organizationId,
       userId: input.userId,
     });
 
-    if (!userAsMember.user.zendeskId) {
+    const user = await this.storage.getUserById({ id: membership.userId });
+
+    if (!user) {
+      throw new Error('Missing user.');
+    }
+
+    if (!user.zendeskId) {
       this.logger.info(
         'Attempt to find user via Zendesk API. (organizationID: %s, userId: %s)',
         input.organizationId,
         input.userId,
       );
 
-      const email = userAsMember.user.email;
+      const email = user.email;
 
       // Before attempting to create the user we need to check whether an user with that email might already exist.
       let userZendeskId = await this.httpClient
@@ -275,9 +281,9 @@ export class SupportManager {
             },
             json: {
               user: {
-                name: userAsMember.user.fullName,
+                name: user.fullName,
                 email,
-                external_id: userAsMember.user.id,
+                external_id: user.id,
                 identities: [
                   {
                     type: 'foreign',
@@ -303,10 +309,10 @@ export class SupportManager {
         userId: input.userId,
         zendeskId: String(userZendeskId),
       });
-      userAsMember.user.zendeskId = String(userZendeskId);
+      user.zendeskId = String(userZendeskId);
     }
 
-    if (!userAsMember.connectedToZendesk) {
+    if (!membership.connectedToZendesk) {
       this.logger.info(
         'Connecting user to zendesk organization (organization: %s, user: %s)',
         input.organizationId,
@@ -328,7 +334,7 @@ export class SupportManager {
           },
           json: {
             organization_membership: {
-              user_id: parseInt(userAsMember.user.zendeskId, 10),
+              user_id: parseInt(user.zendeskId, 10),
               organization_id: parseInt(organizationZendeskId, 10),
             },
           },
@@ -340,7 +346,7 @@ export class SupportManager {
       });
     }
 
-    return userAsMember.user.zendeskId;
+    return user.zendeskId;
   }
 
   async getUsers(ids: number[]) {
diff --git a/packages/services/api/src/modules/token/providers/token-manager.ts b/packages/services/api/src/modules/token/providers/token-manager.ts
index d98689b863..037354f970 100644
--- a/packages/services/api/src/modules/token/providers/token-manager.ts
+++ b/packages/services/api/src/modules/token/providers/token-manager.ts
@@ -2,12 +2,13 @@ import { Injectable, Scope } from 'graphql-modules';
 import { maskToken } from '@hive/service-common';
 import type { Token } from '../../../shared/entities';
 import { HiveError } from '../../../shared/errors';
-import { diffArrays, pushIfMissing } from '../../../shared/helpers';
+import { pushIfMissing } from '../../../shared/helpers';
 import { AuditLogRecorder } from '../../audit-logs/providers/audit-log-recorder';
 import { Session } from '../../auth/lib/authz';
 import { OrganizationAccessScope } from '../../auth/providers/organization-access';
 import { ProjectAccessScope } from '../../auth/providers/project-access';
 import { TargetAccessScope } from '../../auth/providers/target-access';
+import { OrganizationMembers } from '../../organization/providers/organization-members';
 import { Logger } from '../../shared/providers/logger';
 import { Storage, TargetSelector } from '../../shared/providers/storage';
 import type { CreateTokenResult } from './token-storage';
@@ -35,6 +36,7 @@ export class TokenManager {
     private session: Session,
     private tokenStorage: TokenStorage,
     private storage: Storage,
+    private organizationMembers: OrganizationMembers,
     private auditLog: AuditLogRecorder,
     logger: Logger,
   ) {
@@ -56,9 +58,13 @@ export class TokenManager {
 
     const scopes = [...input.organizationScopes, ...input.projectScopes, ...input.targetScopes];
 
-    const currentUser = await this.session.getViewer();
-    const currentMember = await this.storage.getOrganizationMember({
+    const organization = await this.storage.getOrganization({
       organizationId: input.organizationId,
+    });
+
+    const currentUser = await this.session.getViewer();
+    const currentMember = await this.organizationMembers.findOrganizationMembership({
+      organization,
       userId: currentUser.id,
     });
 
@@ -66,20 +72,20 @@ export class TokenManager {
       throw new HiveError('User is not a member of the organization');
     }
 
-    const newScopes = [...input.organizationScopes, ...input.projectScopes, ...input.targetScopes];
+    // const newScopes = [...input.organizationScopes, ...input.projectScopes, ...input.targetScopes];
 
-    // See what scopes were removed or added
-    const modifiedScopes = diffArrays(currentMember.scopes, newScopes);
+    // // See what scopes were removed or added
+    // const modifiedScopes = diffArrays(currentMember.scopes, newScopes);
 
-    // Check if the current user has rights to set these scopes.
-    const currentUserMissingScopes = modifiedScopes.filter(
-      scope => !currentMember.scopes.includes(scope),
-    );
+    // // Check if the current user has rights to set these scopes.
+    // const currentUserMissingScopes = modifiedScopes.filter(
+    //   scope => !currentMember.scopes.includes(scope),
+    // );
 
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %o`, currentMember.scopes);
-      throw new HiveError(`No access to the scopes: ${currentUserMissingScopes.join(', ')}`);
-    }
+    // if (currentUserMissingScopes.length > 0) {
+    //   this.logger.debug(`Logged user scopes: %o`, currentMember.scopes);
+    //   throw new HiveError(`No access to the scopes: ${currentUserMissingScopes.join(', ')}`);
+    // }
 
     pushIfMissing(scopes, TargetAccessScope.READ);
     pushIfMissing(scopes, ProjectAccessScope.READ);
diff --git a/packages/services/api/src/shared/entities.ts b/packages/services/api/src/shared/entities.ts
index b10488ad88..0b4d31de8a 100644
--- a/packages/services/api/src/shared/entities.ts
+++ b/packages/services/api/src/shared/entities.ts
@@ -202,7 +202,7 @@ export interface OrganizationInvitation {
   email: string;
   created_at: string;
   expires_at: string;
-  role: OrganizationMemberRole;
+  roleId: string;
 }
 
 export interface OrganizationBilling {
@@ -444,26 +444,3 @@ export type SchemaPolicy = {
 };
 
 export type SchemaPolicyAvailableRuleObject = AvailableRulesResponse[0];
-
-export const OrganizationMemberRoleModel = z
-  .object({
-    id: z.string(),
-    organization_id: z.string(),
-    name: z.string(),
-    description: z.string(),
-    locked: z.boolean(),
-    scopes: z.array(z.string()),
-    members_count: z.number().optional(),
-  })
-  .transform(role => ({
-    id: role.id,
-    // Why? When using organizationId alias for a column, the column name is converted to organizationid
-    organizationId: role.organization_id,
-    membersCount: role.members_count,
-    name: role.name,
-    description: role.description,
-    locked: role.locked,
-    // Cast string to an array of enum
-    scopes: role.scopes as (OrganizationAccessScope | ProjectAccessScope | TargetAccessScope)[],
-  }));
-export type OrganizationMemberRole = z.infer<typeof OrganizationMemberRoleModel>;
diff --git a/packages/services/server/src/index.ts b/packages/services/server/src/index.ts
index 9d31d6847f..23ddd43dfe 100644
--- a/packages/services/server/src/index.ts
+++ b/packages/services/server/src/index.ts
@@ -20,6 +20,7 @@ import {
   CryptoProvider,
   LogFn,
   Logger,
+  OrganizationMemberRoles,
   OrganizationMembers,
 } from '@hive/api';
 import { HivePubSub } from '@hive/api/src/modules/shared/providers/pub-sub';
@@ -408,7 +409,11 @@ export async function main() {
         new SuperTokensUserAuthNStrategy({
           logger: server.log,
           storage,
-          organizationMembers: new OrganizationMembers(storage.pool, server.log),
+          organizationMembers: new OrganizationMembers(
+            storage.pool,
+            new OrganizationMemberRoles(storage.pool, server.log),
+            server.log,
+          ),
         }),
         new TargetAccessTokenStrategy({
           logger: server.log,
diff --git a/packages/services/storage/src/index.ts b/packages/services/storage/src/index.ts
index 9c99228a07..f30cccb3f0 100644
--- a/packages/services/storage/src/index.ts
+++ b/packages/services/storage/src/index.ts
@@ -25,7 +25,6 @@ import { context, SpanKind, SpanStatusCode, trace } from '@hive/service-common';
 import type { SchemaCoordinatesDiffResult } from '../../api/src/modules/schema/providers/inspector';
 import {
   createSDLHash,
-  OrganizationMemberRoleModel,
   ProjectType,
   type CDNAccessToken,
   type OIDCIntegration,
@@ -227,7 +226,7 @@ export async function createStorage(
       code: invitation.code,
       created_at: invitation.created_at as any,
       expires_at: invitation.expires_at as any,
-      role: OrganizationMemberRoleModel.parse(invitation.role),
+      roleId: invitation.role.id,
     };
   }
 
@@ -525,15 +524,18 @@ export async function createStorage(
       },
       connection: Connection,
     ) {
-      const result = await connection.one(sql`/* getOrganizationMemberRoleByName */
+      const roleId = await connection.oneFirst<string>(sql`/* getOrganizationMemberRoleByName */
         SELECT
-          id, name, description, scopes, locked, organization_id
-        FROM organization_member_roles
-        WHERE organization_id = ${args.organizationId} AND name = ${args.roleName}
+          "id"
+        FROM
+          "organization_member_roles"
+        WHERE
+          "organization_id" = ${args.organizationId}
+          AND "name" = ${args.roleName}
         LIMIT 1
       `);
 
-      return OrganizationMemberRoleModel.parse(result);
+      return roleId;
     },
   };
 
@@ -965,72 +967,6 @@ export async function createStorage(
         return Promise.resolve(null);
       });
     }),
-    getAdminOrganizationMemberRole({ organizationId }) {
-      return shared.getOrganizationMemberRoleByName(
-        {
-          organizationId,
-          roleName: 'Admin',
-        },
-        pool,
-      );
-    },
-    getViewerOrganizationMemberRole({ organizationId }) {
-      return shared.getOrganizationMemberRoleByName(
-        {
-          organizationId,
-          roleName: 'Viewer',
-        },
-        pool,
-      );
-    },
-    async getOrganizationMemberRoles(selector) {
-      const results = await pool.many(sql`/* getOrganizationMemberRoles */
-        SELECT
-          id, name, description, scopes, locked, organization_id
-        FROM organization_member_roles
-        WHERE organization_id = ${selector.organizationId}
-        ORDER BY array_length(scopes, 1) DESC, name ASC
-      `);
-
-      return results.map(role => OrganizationMemberRoleModel.parse(role));
-    },
-    async getOrganizationMemberRole(selector) {
-      const result = await pool.maybeOne<{
-        members_count: number;
-      }>(sql`/* getOrganizationMemberRole */
-        SELECT
-          id, name, description, scopes, locked, organization_id,
-          (
-            SELECT count(*)
-            FROM organization_member
-            WHERE role_id = ${selector.roleId} AND organization_id = ${selector.organizationId}
-          ) AS members_count
-        FROM organization_member_roles
-        WHERE organization_id = ${selector.organizationId} AND id = ${selector.roleId}
-        LIMIT 1
-      `);
-
-      if (!result) {
-        return null;
-      }
-
-      return {
-        ...OrganizationMemberRoleModel.parse(result),
-        membersCount: result.members_count,
-      };
-    },
-    hasOrganizationMemberRoleName({ organizationId, roleName, excludeRoleId }) {
-      return pool.exists(sql`/* hasOrganizationMemberRoleName */
-        SELECT 1
-        FROM organization_member_roles
-        WHERE
-          organization_id = ${organizationId}
-          AND
-          name = ${roleName}
-          ${excludeRoleId ? sql`AND id != ${excludeRoleId}` : sql``}
-        LIMIT 1
-      `);
-    },
     getOrganizationInvitations: batch(async selectors => {
       const organizations = selectors.map(s => s.organizationId);
       const allInvitations = await pool.query<
@@ -1305,7 +1241,7 @@ export async function createStorage(
           return;
         }
 
-        const adminRole = await shared.getOrganizationMemberRoleByName(
+        const adminRoleId = await shared.getOrganizationMemberRoleByName(
           {
             organizationId: organization,
             roleName: 'Admin',
@@ -1316,7 +1252,7 @@ export async function createStorage(
         // set admin role
         await tsx.query(sql`/* setAdminRole */
           UPDATE organization_member
-          SET role_id = ${adminRole.id}
+          SET role_id = ${adminRoleId}
           WHERE organization_id = ${organization} AND user_id = ${user}
         `);
 
@@ -1341,34 +1277,6 @@ export async function createStorage(
         `,
       );
     },
-    async createOrganizationMemberRole({ organizationId, name, scopes, description }) {
-      const role = await pool.one(
-        sql`/* createOrganizationMemberRole */
-          INSERT INTO organization_member_roles
-          (organization_id, name, description, scopes)
-          VALUES
-          (${organizationId}, ${name}, ${description}, ${sql.array(scopes, 'text')})
-          RETURNING *
-        `,
-      );
-
-      return OrganizationMemberRoleModel.parse(role);
-    },
-    async updateOrganizationMemberRole({ organizationId, roleId, name, scopes, description }) {
-      const role = await pool.one(
-        sql`/* updateOrganizationMemberRole */
-          UPDATE organization_member_roles
-          SET
-            name = ${name},
-            description = ${description},
-            scopes = ${sql.array(scopes, 'text')}
-          WHERE organization_id = ${organizationId} AND id = ${roleId}
-          RETURNING *
-        `,
-      );
-
-      return OrganizationMemberRoleModel.parse(role);
-    },
     async assignOrganizationMemberRole({ userId, organizationId, roleId }) {
       await pool.query(
         sql`/* assignOrganizationMemberRole */
diff --git a/packages/web/app/src/components/layouts/organization.tsx b/packages/web/app/src/components/layouts/organization.tsx
index 1ae0a56a0f..461b11a1c0 100644
--- a/packages/web/app/src/components/layouts/organization.tsx
+++ b/packages/web/app/src/components/layouts/organization.tsx
@@ -60,9 +60,6 @@ const OrganizationLayout_OrganizationFragment = graphql(`
     viewerCanDescribeBilling
     viewerCanAccessSettings
     viewerCanSeeMembers
-    me {
-      ...CanAccessOrganization_MemberFragment
-    }
     ...ProPlanBilling_OrganizationFragment
     ...RateLimitWarn_OrganizationFragment
   }
diff --git a/packages/web/app/src/components/organization/Permissions.tsx b/packages/web/app/src/components/organization/Permissions.tsx
index 69a34c61bd..97fcb5b4a1 100644
--- a/packages/web/app/src/components/organization/Permissions.tsx
+++ b/packages/web/app/src/components/organization/Permissions.tsx
@@ -1,4 +1,3 @@
-import { memo, ReactElement, useCallback, useEffect, useState } from 'react';
 import clsx from 'clsx';
 import {
   Select,
@@ -7,27 +6,11 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select';
-import { TabsContent } from '@/components/ui/tabs';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
-import { FragmentType, graphql, useFragment } from '@/gql';
 import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from '@/gql/graphql';
 import { NoAccess, Scope } from '@/lib/access/common';
-import { canAccessOrganization } from '@/lib/access/organization';
-import { canAccessProject } from '@/lib/access/project';
-import { canAccessTarget } from '@/lib/access/target';
 import { truthy } from '@/utils';
 
-interface Props<T> {
-  title: string;
-  scopes: readonly Scope<T>[];
-  initialScopes: readonly T[];
-  selectedScopes: readonly T[];
-  onChange: (scopes: T[]) => void;
-  checkAccess: (scope: T) => boolean;
-  noDowngrade?: boolean;
-  disabled?: boolean;
-}
-
 function isLowerThen<T>(targetScope: T, sourceScope: T, scopesInLowerToHigherOrder: readonly T[]) {
   const sourceIndex = scopesInLowerToHigherOrder.indexOf(sourceScope);
   const targetIndex = scopesInLowerToHigherOrder.indexOf(targetScope);
@@ -35,38 +18,6 @@ function isLowerThen<T>(targetScope: T, sourceScope: T, scopesInLowerToHigherOrd
   return targetIndex < sourceIndex;
 }
 
-function matchScope<T, TDefault = string>(
-  list: readonly T[],
-  defaultValue: TDefault,
-  lowerPriority?: T,
-  higherPriority?: T,
-) {
-  let hasHigher = false;
-  let hasLower = false;
-
-  for (const item of list) {
-    if (item === higherPriority) {
-      hasHigher = true;
-    } else if (item === lowerPriority) {
-      hasLower = true;
-    }
-  }
-
-  if (hasHigher) {
-    return higherPriority;
-  }
-
-  if (hasLower) {
-    return lowerPriority;
-  }
-
-  return defaultValue;
-}
-
-function isDefined<T>(value: T | null | undefined): value is T {
-  return value !== undefined && value !== null;
-}
-
 export const PermissionScopeItem = <
   T extends OrganizationAccessScope | ProjectAccessScope | TargetAccessScope,
 >(props: {
@@ -161,155 +112,3 @@ export const PermissionScopeItem = <
     </TooltipProvider>
   );
 };
-
-function PermissionsSpaceInner(props: Props<OrganizationAccessScope>): ReactElement<any, any>;
-function PermissionsSpaceInner(props: Props<ProjectAccessScope>): ReactElement<any, any>;
-function PermissionsSpaceInner(props: Props<TargetAccessScope>): ReactElement<any, any>;
-function PermissionsSpaceInner<
-  T extends OrganizationAccessScope | ProjectAccessScope | TargetAccessScope,
->(props: Props<T>) {
-  const { title, scopes, initialScopes, selectedScopes, onChange, checkAccess, disabled } = props;
-
-  return (
-    <TabsContent value={title}>
-      {scopes.map(scope => {
-        const possibleScope = [scope.mapping['read-only'], scope.mapping['read-write']].filter(
-          isDefined,
-        );
-        const readOnlyScope = scope.mapping['read-only'];
-        const hasReadOnly = typeof readOnlyScope !== 'undefined';
-
-        return (
-          <PermissionScopeItem<T>
-            disabled={disabled}
-            scope={scope}
-            key={scope.name}
-            initialScope={matchScope(
-              initialScopes,
-              NoAccess,
-              scope.mapping['read-only'],
-              scope.mapping['read-write'],
-            )}
-            selectedScope={matchScope(
-              selectedScopes,
-              NoAccess,
-              scope.mapping['read-only'],
-              scope.mapping['read-write'],
-            )}
-            checkAccess={checkAccess}
-            possibleScope={possibleScope}
-            canManageScope={possibleScope.some(checkAccess)}
-            noDowngrade={props.noDowngrade}
-            onChange={value => {
-              if (value === NoAccess) {
-                // Remove all possible scopes
-                onChange(selectedScopes.filter(scope => !possibleScope.includes(scope)));
-                return;
-              }
-              const isReadWrite = value === scope.mapping['read-write'];
-
-              // Remove possible scopes
-              const newScopes = selectedScopes.filter(scope => !possibleScope.includes(scope));
-
-              if (isReadWrite) {
-                newScopes.push(scope.mapping['read-write']);
-
-                if (hasReadOnly) {
-                  // Include read-only as well
-                  newScopes.push(readOnlyScope);
-                }
-              } else if (readOnlyScope) {
-                // just read-only
-                newScopes.push(readOnlyScope);
-              }
-
-              props.onChange(newScopes);
-            }}
-          />
-        );
-      })}
-    </TabsContent>
-  );
-}
-
-export const PermissionsSpace = memo(
-  PermissionsSpaceInner,
-) as unknown as typeof PermissionsSpaceInner;
-
-const UsePermissionManager_OrganizationFragment = graphql(`
-  fragment UsePermissionManager_OrganizationFragment on Organization {
-    slug
-    me {
-      ...CanAccessOrganization_MemberFragment
-      ...CanAccessProject_MemberFragment
-      ...CanAccessTarget_MemberFragment
-    }
-  }
-`);
-
-const UsePermissionManager_MemberFragment = graphql(`
-  fragment UsePermissionManager_MemberFragment on Member {
-    id
-    user {
-      id
-    }
-    targetAccessScopes
-    projectAccessScopes
-    organizationAccessScopes
-  }
-`);
-
-export function usePermissionsManager({
-  passMemberScopes,
-  ...props
-}: {
-  organization: FragmentType<typeof UsePermissionManager_OrganizationFragment>;
-  member: FragmentType<typeof UsePermissionManager_MemberFragment>;
-  passMemberScopes: boolean;
-}) {
-  const member = useFragment(UsePermissionManager_MemberFragment, props.member);
-  const organization = useFragment(UsePermissionManager_OrganizationFragment, props.organization);
-
-  const [targetScopes, setTargetScopes] = useState<TargetAccessScope[]>(
-    passMemberScopes ? member.targetAccessScopes : [],
-  );
-  const [projectScopes, setProjectScopes] = useState<ProjectAccessScope[]>(
-    passMemberScopes ? member.projectAccessScopes : [],
-  );
-  const [organizationScopes, setOrganizationScopes] = useState<OrganizationAccessScope[]>(
-    passMemberScopes ? member.organizationAccessScopes : [],
-  );
-
-  useEffect(() => {
-    if (passMemberScopes) {
-      setTargetScopes(member.targetAccessScopes);
-      setProjectScopes(member.projectAccessScopes);
-      setOrganizationScopes(member.organizationAccessScopes);
-    }
-  }, [member, passMemberScopes, setTargetScopes, setProjectScopes, setOrganizationScopes]);
-
-  return {
-    // Set
-    setOrganizationScopes,
-    setProjectScopes,
-    setTargetScopes,
-    // Get
-    organizationScopes,
-    projectScopes,
-    targetScopes,
-    noneSelected: !organizationScopes.length && !projectScopes.length && !targetScopes.length,
-    // Methods
-    canAccessOrganization: useCallback(
-      (scope: OrganizationAccessScope) => canAccessOrganization(scope, organization.me),
-      [organization],
-    ),
-    canAccessProject: useCallback(
-      (scope: ProjectAccessScope) => canAccessProject(scope, organization.me),
-      [organization],
-    ),
-    canAccessTarget: useCallback(
-      (scope: TargetAccessScope) => canAccessTarget(scope, organization.me),
-      [organization],
-    ),
-  };
-}
diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index ea15bd8fd0..e7d3f17e03 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -62,13 +62,6 @@ const OrganizationMemberRoleSwitcher_OrganizationFragment = graphql(`
     id
     slug
     viewerCanAssignUserRoles
-    me {
-      id
-      isAdmin
-      organizationAccessScopes
-      projectAccessScopes
-      targetAccessScopes
-    }
     owner {
       id
     }
@@ -77,9 +70,6 @@ const OrganizationMemberRoleSwitcher_OrganizationFragment = graphql(`
       name
       description
       locked
-      organizationAccessScopes
-      projectAccessScopes
-      targetAccessScopes
     }
   }
 `);
@@ -87,9 +77,6 @@ const OrganizationMemberRoleSwitcher_OrganizationFragment = graphql(`
 const OrganizationMemberRoleSwitcher_MemberFragment = graphql(`
   fragment OrganizationMemberRoleSwitcher_MemberFragment on Member {
     id
-    organizationAccessScopes
-    projectAccessScopes
-    targetAccessScopes
     user {
       id
     }
@@ -108,11 +95,8 @@ function OrganizationMemberRoleSwitcher(props: {
     props.organization,
   );
   const member = useFragment(OrganizationMemberRoleSwitcher_MemberFragment, props.member);
-  const { me } = organization;
-  const isOwner = props.memberId === organization.owner.id;
-  const isMe = props.memberId === me.id;
   // A user can't change its own role
-  const canAssignRole = !isOwner && !isMe && organization.viewerCanAssignUserRoles;
+  const canAssignRole = organization.viewerCanAssignUserRoles;
   const roles = organization.memberRoles ?? [];
   const { toast } = useToast();
   const [assignRoleState, assignRole] = useMutation(
@@ -170,38 +154,6 @@ function OrganizationMemberRoleSwitcher(props: {
         disabled={!canAssignRole || assignRoleState.fetching}
         isRoleActive={role => {
           const isCurrentRole = role.id === props.memberRoleId;
-          const canDowngrade = me.isAdmin;
-          const hasAccessToScopesOfRole =
-            role.organizationAccessScopes.every(scope =>
-              me.organizationAccessScopes.includes(scope),
-            ) &&
-            role.projectAccessScopes.every(scope => me.projectAccessScopes.includes(scope)) &&
-            role.targetAccessScopes.every(scope => me.targetAccessScopes.includes(scope));
-          // If the new role has more or equal access scopes than the current role, we can assign it
-          const newRoleHasMoreOrEqualAccess =
-            // organization
-            role.organizationAccessScopes.length >= memberRole.organizationAccessScopes.length &&
-            role.organizationAccessScopes.every(scope =>
-              memberRole.organizationAccessScopes.includes(scope),
-            ) &&
-            // project
-            role.projectAccessScopes.length >= memberRole.projectAccessScopes.length &&
-            role.projectAccessScopes.every(scope =>
-              memberRole.projectAccessScopes.includes(scope),
-            ) &&
-            // target
-            role.targetAccessScopes.length >= memberRole.targetAccessScopes.length &&
-            role.targetAccessScopes.every(scope => memberRole.targetAccessScopes.includes(scope));
-          const canAssign =
-            (hasAccessToScopesOfRole && newRoleHasMoreOrEqualAccess) || canDowngrade;
-          //
-          // A new role can be assigned to the member if:
-          // - the member is not the owner
-          // - the member is not the current user
-          // - the current user has access to all the access scopes of the new role
-          // - the new role has more or equal access scopes than the current role (or the current user is an admin)
-          // - the new role is not the current role
-          //
 
           if (isCurrentRole) {
             return {
@@ -210,27 +162,6 @@ function OrganizationMemberRoleSwitcher(props: {
             };
           }
 
-          if (canAssign) {
-            return {
-              active: true,
-            };
-          }
-
-          if (!hasAccessToScopesOfRole) {
-            return {
-              active: false,
-              reason: 'You do not have enough access to assign this role',
-            };
-          }
-
-          if (!newRoleHasMoreOrEqualAccess) {
-            return {
-              active: false,
-              reason:
-                'The member will experience a downgrade as this role lacks certain permissions they currently possess.',
-            };
-          }
-
           return {
             active: false,
           };
diff --git a/packages/web/app/src/components/organization/members/roles.tsx b/packages/web/app/src/components/organization/members/roles.tsx
index f96fe41384..b3a17c21c3 100644
--- a/packages/web/app/src/components/organization/members/roles.tsx
+++ b/packages/web/app/src/components/organization/members/roles.tsx
@@ -3,7 +3,6 @@ import { LockIcon, MoreHorizontalIcon } from 'lucide-react';
 import { useForm } from 'react-hook-form';
 import { useMutation } from 'urql';
 import { z } from 'zod';
-import { PermissionsSpace } from '@/components/organization/Permissions';
 import {
   AlertDialog,
   AlertDialogAction,
@@ -16,6 +15,7 @@ import {
 } from '@/components/ui/alert-dialog';
 import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
+import { Checkbox } from '@/components/ui/checkbox';
 import {
   Dialog,
   DialogContent,
@@ -41,15 +41,14 @@ import {
 } from '@/components/ui/form';
 import { Input } from '@/components/ui/input';
 import { SubPageLayout, SubPageLayoutHeader } from '@/components/ui/page-content-layout';
-import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { Textarea } from '@/components/ui/textarea';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
-import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from '@/gql/graphql';
-import { scopes } from '@/lib/access/common';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { Link } from '@tanstack/react-router';
+import { PermissionSelector } from './permission-selector';
+import { SelectedPermissionOverview } from './selected-permission-overview';
 
 export const roleFormSchema = z.object({
   name: z
@@ -71,17 +70,11 @@ export const roleFormSchema = z.object({
     .trim()
     .min(2, 'Too short')
     .max(256, 'Description is too long'),
-  organizationScopes: z.array(z.string()),
-  projectScopes: z.array(z.string()),
-  targetScopes: z.array(z.string()),
+  selectedPermissions: z.array(z.string()),
 });
 
 type RoleFormValues = z.infer<typeof roleFormSchema>;
 
-function canAccessScope<T>(scope: T, currentUserScopes: readonly T[]) {
-  return currentUserScopes.includes(scope);
-}
-
 const OrganizationMemberRoleEditor_UpdateMemberRoleMutation = graphql(`
   mutation OrganizationMemberRoleEditor_UpdateMemberRoleMutation($input: UpdateMemberRoleInput!) {
     updateMemberRole(input: $input) {
@@ -102,25 +95,25 @@ const OrganizationMemberRoleEditor_UpdateMemberRoleMutation = graphql(`
   }
 `);
 
-const OrganizationMemberRoleEditor_MeFragment = graphql(`
-  fragment OrganizationMemberRoleEditor_MeFragment on Member {
+const OrganizationMemberRoleEditor_OrganizationFragment = graphql(`
+  fragment OrganizationMemberRoleEditor_OrganizationFragment on Organization {
     id
-    isAdmin
-    organizationAccessScopes
-    projectAccessScopes
-    targetAccessScopes
+    slug
+    ...PermissionSelector_OrganizationFragment
   }
 `);
 
 function OrganizationMemberRoleEditor(props: {
   mode?: 'edit' | 'read-only';
   close(): void;
-  organizationSlug: string;
-  me: FragmentType<typeof OrganizationMemberRoleEditor_MeFragment>;
   role: FragmentType<typeof OrganizationMemberRoleRow_MemberRoleFragment>;
+  organization: FragmentType<typeof OrganizationMemberRoleEditor_OrganizationFragment>;
 }) {
-  const me = useFragment(OrganizationMemberRoleEditor_MeFragment, props.me);
   const role = useFragment(OrganizationMemberRoleRow_MemberRoleFragment, props.role);
+  const organization = useFragment(
+    OrganizationMemberRoleEditor_OrganizationFragment,
+    props.organization,
+  );
   const [updateMemberRoleState, updateMemberRole] = useMutation(
     OrganizationMemberRoleEditor_UpdateMemberRoleMutation,
   );
@@ -132,70 +125,29 @@ function OrganizationMemberRoleEditor(props: {
     defaultValues: {
       name: role.name,
       description: role.description,
-      organizationScopes: [...role.organizationAccessScopes],
-      projectScopes: [...role.projectAccessScopes],
-      targetScopes: [...role.targetAccessScopes],
+      selectedPermissions: [...role.permissions],
     },
     disabled: isDisabled,
   });
 
-  const initialScopes = {
-    organization: [...role.organizationAccessScopes],
-    project: [...role.projectAccessScopes],
-    target: [...role.targetAccessScopes],
-  };
-
-  const [targetScopes, setTargetScopes] = useState<TargetAccessScope[]>([
-    ...role.targetAccessScopes,
-  ]);
-  const [projectScopes, setProjectScopes] = useState<ProjectAccessScope[]>([
-    ...role.projectAccessScopes,
-  ]);
-  const [organizationScopes, setOrganizationScopes] = useState<OrganizationAccessScope[]>([
-    ...role.organizationAccessScopes,
-  ]);
-
-  const updateTargetScopes = useCallback(
-    (scopes: TargetAccessScope[]) => {
-      setTargetScopes(scopes);
-      form.setValue('targetScopes', [...scopes]);
-    },
-    [targetScopes],
-  );
-
-  const updateProjectScopes = useCallback(
-    (scopes: ProjectAccessScope[]) => {
-      setProjectScopes(scopes);
-      form.setValue('projectScopes', [...scopes]);
-    },
-    [projectScopes],
+  const [selectedPermissions, setSelectedPermissions] = useState<ReadonlySet<string>>(
+    () => new Set(role.permissions),
   );
 
-  const updateOrganizationScopes = useCallback(
-    (scopes: OrganizationAccessScope[]) => {
-      setOrganizationScopes(scopes);
-      form.setValue('organizationScopes', [...scopes]);
-    },
-    [organizationScopes],
-  );
+  const onChangeSelectedPermissions = useCallback((permissions: ReadonlySet<string>) => {
+    setSelectedPermissions(new Set(permissions));
+    form.setValue('selectedPermissions', [...permissions]);
+  }, []);
 
   async function onSubmit(data: RoleFormValues) {
     try {
       const result = await updateMemberRole({
         input: {
-          organizationSlug: props.organizationSlug,
+          organizationSlug: organization.slug,
           roleId: role.id,
           name: data.name,
           description: data.description,
-          organizationAccessScopes: data.organizationScopes.filter(scope =>
-            Object.values(OrganizationAccessScope).includes(scope as OrganizationAccessScope),
-          ) as OrganizationAccessScope[],
-          projectAccessScopes: data.projectScopes.filter(scope =>
-            Object.values(ProjectAccessScope).includes(scope as ProjectAccessScope),
-          ) as ProjectAccessScope[],
-          targetAccessScopes: data.targetScopes.filter(scope =>
-            Object.values(TargetAccessScope).includes(scope as TargetAccessScope),
-          ) as TargetAccessScope[],
+          selectedPermissions: data.selectedPermissions,
         },
       });
 
@@ -238,30 +190,13 @@ function OrganizationMemberRoleEditor(props: {
     }
   }
 
-  const hasMembers = role.membersCount > 0;
-  const { isAdmin } = me;
-  const noDowngrade = hasMembers && !isAdmin;
-
   return (
     <Form {...form}>
       <form onSubmit={form.handleSubmit(onSubmit)}>
         <DialogContent className="max-w-[960px]">
           <DialogHeader>
             <DialogTitle>Member Role{props.mode === 'read-only' ? '' : ' Editor'}</DialogTitle>
-            <DialogDescription>
-              {isAdmin ? (
-                'As an admin, you can add or remove permissions from the role.'
-              ) : hasMembers ? (
-                <>
-                  This role is assigned to at least one member.
-                  <br />
-                  You can only add permissions to the role,{' '}
-                  <span className="font-bold">you cannot downgrade its members.</span>
-                </>
-              ) : (
-                'You can add or remove permissions from the role as it has no members.'
-              )}
-            </DialogDescription>
+            <DialogDescription>Adjust the permissions of this role.</DialogDescription>
           </DialogHeader>
           <div className="flex flex-row space-x-6">
             <div className="w-72 shrink-0 space-y-4">
@@ -293,45 +228,15 @@ function OrganizationMemberRoleEditor(props: {
               />
             </div>
             <div className="grow">
-              <div className="space-y-2">
+              <div className="flex h-[400px] flex-col space-y-2">
                 <FormLabel>Permissions</FormLabel>
-                <Tabs defaultValue="Organization" className="w-full">
-                  <TabsList className="grid w-full grid-cols-3">
-                    <TabsTrigger value="Organization">Organization</TabsTrigger>
-                    <TabsTrigger value="Projects">Projects</TabsTrigger>
-                    <TabsTrigger value="Targets">Targets</TabsTrigger>
-                  </TabsList>
-                  <PermissionsSpace
-                    disabled={isDisabled}
-                    title="Organization"
-                    scopes={scopes.organization}
-                    initialScopes={initialScopes.organization}
-                    selectedScopes={organizationScopes}
-                    onChange={updateOrganizationScopes}
-                    checkAccess={scope => canAccessScope(scope, me.organizationAccessScopes)}
-                    noDowngrade={noDowngrade}
-                  />
-                  <PermissionsSpace
-                    disabled={isDisabled}
-                    title="Projects"
-                    scopes={scopes.project}
-                    initialScopes={initialScopes.project}
-                    selectedScopes={projectScopes}
-                    onChange={updateProjectScopes}
-                    checkAccess={scope => canAccessScope(scope, me.projectAccessScopes)}
-                    noDowngrade={noDowngrade}
-                  />
-                  <PermissionsSpace
-                    disabled={isDisabled}
-                    title="Targets"
-                    scopes={scopes.target}
-                    initialScopes={initialScopes.target}
-                    selectedScopes={targetScopes}
-                    onChange={updateTargetScopes}
-                    checkAccess={scope => canAccessScope(scope, me.targetAccessScopes)}
-                    noDowngrade={noDowngrade}
+                <div className="overflow-scroll">
+                  <PermissionSelector
+                    onSelectedPermissionsChange={onChangeSelectedPermissions}
+                    organization={organization}
+                    selectedPermissionIds={selectedPermissions}
                   />
-                </Tabs>
+                </div>
               </div>
             </div>
           </div>
@@ -347,11 +252,7 @@ function OrganizationMemberRoleEditor(props: {
                   !form.formState.isValid || form.formState.isSubmitting || form.formState.disabled
                 }
               >
-                {form.formState.isSubmitting
-                  ? 'Creating...'
-                  : targetScopes.length + projectScopes.length + organizationScopes.length === 0
-                    ? 'Submit a read-only role'
-                    : 'Submit'}
+                {form.formState.isSubmitting ? 'Creating...' : 'Confirm selection'}
               </Button>
             </DialogFooter>
           )}
@@ -384,21 +285,23 @@ const OrganizationMemberRoleCreator_CreateMemberRoleMutation = graphql(`
   }
 `);
 
-const OrganizationMemberRoleCreator_MeFragment = graphql(`
-  fragment OrganizationMemberRoleCreator_MeFragment on Member {
+const OrganizationMemberRoleCreator_OrganizationFragment = graphql(`
+  fragment OrganizationMemberRoleCreator_OrganizationFragment on Organization {
     id
-    organizationAccessScopes
-    projectAccessScopes
-    targetAccessScopes
+    slug
+    ...PermissionSelector_OrganizationFragment
+    ...SelectedPermissionOverview_OrganizationFragment
   }
 `);
 
 function OrganizationMemberRoleCreator(props: {
   close(): void;
-  organizationSlug: string;
-  me: FragmentType<typeof OrganizationMemberRoleCreator_MeFragment>;
+  organization: FragmentType<typeof OrganizationMemberRoleCreator_OrganizationFragment>;
 }) {
-  const me = useFragment(OrganizationMemberRoleCreator_MeFragment, props.me);
+  const organization = useFragment(
+    OrganizationMemberRoleCreator_OrganizationFragment,
+    props.organization,
+  );
   const [createMemberRoleState, createMemberRole] = useMutation(
     OrganizationMemberRoleCreator_CreateMemberRoleMutation,
   );
@@ -409,57 +312,29 @@ function OrganizationMemberRoleCreator(props: {
     defaultValues: {
       name: '',
       description: '',
-      organizationScopes: [],
-      projectScopes: [],
-      targetScopes: [],
+      selectedPermissions: [],
     },
     disabled: createMemberRoleState.fetching,
   });
 
-  const [targetScopes, setTargetScopes] = useState<TargetAccessScope[]>([]);
-  const [projectScopes, setProjectScopes] = useState<ProjectAccessScope[]>([]);
-  const [organizationScopes, setOrganizationScopes] = useState<OrganizationAccessScope[]>([]);
+  const [selectedPermissions, setSelectedPermissions] = useState(() => new Set<string>());
 
-  const updateTargetScopes = useCallback(
-    (scopes: TargetAccessScope[]) => {
-      setTargetScopes(scopes);
-      form.setValue('targetScopes', [...scopes]);
-    },
-    [targetScopes],
-  );
-
-  const updateProjectScopes = useCallback(
-    (scopes: ProjectAccessScope[]) => {
-      setProjectScopes(scopes);
-      form.setValue('projectScopes', [...scopes]);
-    },
-    [projectScopes],
-  );
+  const onChangeSelectedPermissions = useCallback((permissions: ReadonlySet<string>) => {
+    setSelectedPermissions(new Set(permissions));
+    form.setValue('selectedPermissions', [...selectedPermissions]);
+  }, []);
 
-  const updateOrganizationScopes = useCallback(
-    (scopes: OrganizationAccessScope[]) => {
-      setOrganizationScopes(scopes);
-      form.setValue('organizationScopes', [...scopes]);
-    },
-    [organizationScopes],
-  );
+  const [showOnlyGrantedPermissions, setShowOnlyGrantedPermissions] = useState(true);
+  const [state, setState] = useState('select' as 'select' | 'confirm');
 
   async function onSubmit(data: RoleFormValues) {
     try {
       const result = await createMemberRole({
         input: {
-          organizationSlug: props.organizationSlug,
+          organizationSlug: organization.slug,
           name: data.name,
           description: data.description,
-          organizationAccessScopes: data.organizationScopes.filter(scope =>
-            Object.values(OrganizationAccessScope).includes(scope as OrganizationAccessScope),
-          ) as OrganizationAccessScope[],
-          projectAccessScopes: data.projectScopes.filter(scope =>
-            Object.values(ProjectAccessScope).includes(scope as ProjectAccessScope),
-          ) as ProjectAccessScope[],
-          targetAccessScopes: data.targetScopes.filter(scope =>
-            Object.values(TargetAccessScope).includes(scope as TargetAccessScope),
-          ) as TargetAccessScope[],
+          selectedPermissions: data.selectedPermissions,
         },
       });
 
@@ -504,7 +379,7 @@ function OrganizationMemberRoleCreator(props: {
 
   return (
     <Form {...form}>
-      <form onSubmit={form.handleSubmit(onSubmit)}>
+      <form>
         <DialogContent className="max-w-[960px]">
           <DialogHeader>
             <DialogTitle>Member Role Creator</DialogTitle>
@@ -512,89 +387,114 @@ function OrganizationMemberRoleCreator(props: {
               Create a new role that can be assigned to members of this organization.
             </DialogDescription>
           </DialogHeader>
-          <div className="flex flex-row space-x-6">
-            <div className="w-72 shrink-0 space-y-4">
-              <FormField
-                control={form.control}
-                name="name"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel>Name</FormLabel>
-                    <FormControl>
-                      <Input placeholder="Enter a name" type="text" autoComplete="off" {...field} />
-                    </FormControl>
-                    <FormMessage />
-                  </FormItem>
-                )}
-              />
-              <FormField
-                control={form.control}
-                name="description"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel>Description</FormLabel>
-                    <FormControl>
-                      <Textarea autoComplete="off" placeholder="Enter a description" {...field} />
-                    </FormControl>
-                    <FormMessage />
-                  </FormItem>
-                )}
-              />
-            </div>
-            <div className="grow">
-              <div className="space-y-2">
-                <FormLabel>Permissions</FormLabel>
-                <Tabs defaultValue="Organization" className="w-full">
-                  <TabsList className="grid w-full grid-cols-3">
-                    <TabsTrigger value="Organization">Organization</TabsTrigger>
-                    <TabsTrigger value="Projects">Projects</TabsTrigger>
-                    <TabsTrigger value="Targets">Targets</TabsTrigger>
-                  </TabsList>
-                  <PermissionsSpace
-                    title="Organization"
-                    scopes={scopes.organization}
-                    initialScopes={[]}
-                    selectedScopes={organizationScopes}
-                    onChange={updateOrganizationScopes}
-                    checkAccess={scope => canAccessScope(scope, me.organizationAccessScopes)}
-                  />
-                  <PermissionsSpace
-                    title="Projects"
-                    scopes={scopes.project}
-                    initialScopes={[]}
-                    selectedScopes={projectScopes}
-                    onChange={updateProjectScopes}
-                    checkAccess={scope => canAccessScope(scope, me.projectAccessScopes)}
-                  />
-                  <PermissionsSpace
-                    title="Targets"
-                    scopes={scopes.target}
-                    initialScopes={[]}
-                    selectedScopes={targetScopes}
-                    onChange={updateTargetScopes}
-                    checkAccess={scope => canAccessScope(scope, me.targetAccessScopes)}
-                  />
-                </Tabs>
+          {state === 'select' ? (
+            <div className="flex flex-row space-x-6">
+              <div className="w-72 shrink-0 space-y-4">
+                <FormField
+                  control={form.control}
+                  name="name"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>Name</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder="Enter a name"
+                          type="text"
+                          autoComplete="off"
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="description"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>Description</FormLabel>
+                      <FormControl>
+                        <Textarea autoComplete="off" placeholder="Enter a description" {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </div>
+              <div className="grow">
+                <div className="flex h-[400px] flex-col space-y-2">
+                  <FormLabel>Permissions</FormLabel>
+                  <div className="overflow-scroll">
+                    <PermissionSelector
+                      onSelectedPermissionsChange={onChangeSelectedPermissions}
+                      organization={organization}
+                      selectedPermissionIds={selectedPermissions}
+                    />
+                  </div>
+                </div>
               </div>
             </div>
-          </div>
+          ) : (
+            <div className="h-[400px] overflow-scroll">
+              <SelectedPermissionOverview
+                activePermissionIds={Array.from(selectedPermissions)}
+                organization={organization}
+                showOnlyAllowedPermissions={showOnlyGrantedPermissions}
+              />
+            </div>
+          )}
           <DialogFooter>
-            <Button variant="ghost" onClick={props.close}>
-              Cancel
-            </Button>
-            <Button
-              type="submit"
-              onClick={form.handleSubmit(onSubmit)}
-              disabled={
-                !form.formState.isValid || form.formState.isSubmitting || form.formState.disabled
-              }
-            >
-              {form.formState.isSubmitting
-                ? 'Creating...'
-                : targetScopes.length + projectScopes.length + organizationScopes.length === 0
-                  ? 'Submit a read-only role'
-                  : 'Submit'}
-            </Button>
+            {state === 'select' ? (
+              <>
+                <Button variant="ghost" onClick={props.close}>
+                  Cancel
+                </Button>
+                <Button
+                  type="submit"
+                  onClick={() => setState('confirm')}
+                  disabled={
+                    !form.formState.isValid ||
+                    form.formState.isSubmitting ||
+                    form.formState.disabled
+                  }
+                >
+                  Confirm selection
+                </Button>
+              </>
+            ) : (
+              <>
+                <div className="mr-2 flex items-center space-x-2">
+                  <Checkbox
+                    id="show-only-granted-permissions"
+                    checked={showOnlyGrantedPermissions}
+                    onCheckedChange={value => setShowOnlyGrantedPermissions(!!value)}
+                  />
+                  <label
+                    htmlFor="show-only-granted-permissions"
+                    className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                  >
+                    Show only granted permissions
+                  </label>
+                </div>
+                <Button variant="ghost" onClick={() => setState('select')}>
+                  Go back
+                </Button>
+                <Button
+                  type="submit"
+                  onClick={form.handleSubmit(onSubmit)}
+                  disabled={
+                    !form.formState.isValid ||
+                    form.formState.isSubmitting ||
+                    form.formState.disabled
+                  }
+                >
+                  {form.formState.isSubmitting
+                    ? 'Creating...'
+                    : `Create role "${form.getValues().name}"`}
+                </Button>
+              </>
+            )}
           </DialogFooter>
         </DialogContent>
       </form>
@@ -603,8 +503,7 @@ function OrganizationMemberRoleCreator(props: {
 }
 
 function OrganizationMemberRoleCreateButton(props: {
-  organizationSlug: string;
-  me: FragmentType<typeof OrganizationMemberRoleCreator_MeFragment>;
+  organization: FragmentType<typeof OrganizationMemberRoleCreator_OrganizationFragment>;
 }) {
   const [open, setOpen] = useState(false);
 
@@ -615,8 +514,7 @@ function OrganizationMemberRoleCreateButton(props: {
       </DialogTrigger>
       {open ? (
         <OrganizationMemberRoleCreator
-          organizationSlug={props.organizationSlug}
-          me={props.me}
+          organization={props.organization}
           close={() => setOpen(false)}
         />
       ) : null}
@@ -630,12 +528,10 @@ const OrganizationMemberRoleRow_MemberRoleFragment = graphql(`
     name
     description
     locked
-    organizationAccessScopes
-    projectAccessScopes
-    targetAccessScopes
     canDelete
     canUpdate
     membersCount
+    permissions
   }
 `);
 
@@ -816,8 +712,6 @@ const OrganizationMemberRoles_OrganizationFragment = graphql(`
         id
         name
       }
-      ...OrganizationMemberRoleCreator_MeFragment
-      ...OrganizationMemberRoleEditor_MeFragment
     }
     oidcIntegration {
       id
@@ -825,6 +719,8 @@ const OrganizationMemberRoles_OrganizationFragment = graphql(`
         id
       }
     }
+    ...OrganizationMemberRoleCreator_OrganizationFragment
+    ...OrganizationMemberRoleEditor_OrganizationFragment
   }
 `);
 
@@ -856,8 +752,7 @@ export function OrganizationMemberRoles(props: {
       >
         {roleToEdit ? (
           <OrganizationMemberRoleEditor
-            organizationSlug={organization.slug}
-            me={organization.me}
+            organization={organization}
             role={roleToEdit}
             close={() => setRoleToEdit(null)}
           />
@@ -874,8 +769,7 @@ export function OrganizationMemberRoles(props: {
         {roleToShow ? (
           <OrganizationMemberRoleEditor
             mode="read-only"
-            organizationSlug={organization.slug}
-            me={organization.me}
+            organization={organization}
             role={roleToShow}
             close={() => setRoleToShow(null)}
           />
@@ -947,10 +841,7 @@ export function OrganizationMemberRoles(props: {
           subPageTitle="List of roles"
           description="Manage the roles that can be assigned to members of this organization."
         >
-          <OrganizationMemberRoleCreateButton
-            me={organization.me}
-            organizationSlug={organization.slug}
-          />
+          <OrganizationMemberRoleCreateButton organization={organization} />
         </SubPageLayoutHeader>
         <table className="w-full table-auto divide-y-[1px] divide-gray-500/20">
           <thead>
diff --git a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
index 73c339ca88..13a6be3a78 100644
--- a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
+++ b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
@@ -10,8 +10,8 @@ import { FragmentType, graphql, useFragment } from '@/gql';
 import { PermissionLevel } from '@/gql/graphql';
 import { ResultOf } from '@graphql-typed-document-node/core';
 
-export const SelectedPermissionOverview_MemberPermissionGroupsFragment = graphql(`
-  fragment SelectedPermissionOverview_MemberPermissionGroupsFragment on Organization {
+export const SelectedPermissionOverview_OrganizationFragment = graphql(`
+  fragment SelectedPermissionOverview_OrganizationFragment on Organization {
     availableMemberPermissionGroups {
       id
       title
@@ -21,20 +21,21 @@ export const SelectedPermissionOverview_MemberPermissionGroupsFragment = graphql
         description
         level
         title
+        isReadOnly
       }
     }
   }
 `);
 
 export type SelectedPermissionOverviewProps = {
-  organization: FragmentType<typeof SelectedPermissionOverview_MemberPermissionGroupsFragment>;
+  organization: FragmentType<typeof SelectedPermissionOverview_OrganizationFragment>;
   activePermissionIds: Array<string>;
   showOnlyAllowedPermissions: boolean;
 };
 
 export function SelectedPermissionOverview(props: SelectedPermissionOverviewProps) {
   const organization = useFragment(
-    SelectedPermissionOverview_MemberPermissionGroupsFragment,
+    SelectedPermissionOverview_OrganizationFragment,
     props.organization,
   );
   const activePermissionIds = useMemo<ReadonlySet<string>>(
@@ -77,7 +78,7 @@ export function SelectedPermissionOverview(props: SelectedPermissionOverviewProp
 }
 
 type AvailableMembershipPermissions = ResultOf<
-  typeof SelectedPermissionOverview_MemberPermissionGroupsFragment
+  typeof SelectedPermissionOverview_OrganizationFragment
 >['availableMemberPermissionGroups'];
 
 type MembershipPermissionGroup = AvailableMembershipPermissions[number];
@@ -92,6 +93,7 @@ function PermissionLevelGroup(props: {
 }) {
   const [filteredGroups, totalAllowedCount] = useMemo(() => {
     let totalAllowedCount = 0;
+
     const filteredGroups: Array<
       MembershipPermissionGroup & {
         totalAllowedCount: number;
@@ -105,7 +107,7 @@ function PermissionLevelGroup(props: {
           return false;
         }
 
-        if (props.activePermissionIds.has(permission.id)) {
+        if (props.activePermissionIds.has(permission.id) || permission.isReadOnly) {
           totalAllowedCount++;
           groupTotalAllowedCount++;
         }
@@ -153,11 +155,12 @@ function PermissionLevelGroup(props: {
                   </tr>
                   {group.permissions.map(permission =>
                     props.showOnlyAllowedPermissions &&
-                    props.activePermissionIds.has(permission.id) === false ? null : (
+                    props.activePermissionIds.has(permission.id) === false &&
+                    !permission.isReadOnly ? null : (
                       <tr key={permission.id}>
                         <td>{permission.title}</td>
                         <td className="ml-2 text-right">
-                          {props.activePermissionIds.has(permission.id) ? (
+                          {props.activePermissionIds.has(permission.id) || permission.isReadOnly ? (
                             <span className="text-green-500">
                               <CheckIcon className="inline size-4" /> Allowed
                             </span>
diff --git a/packages/web/app/src/components/target/settings/registry-access-token.tsx b/packages/web/app/src/components/target/settings/registry-access-token.tsx
index bf3a46424c..b56c68679c 100644
--- a/packages/web/app/src/components/target/settings/registry-access-token.tsx
+++ b/packages/web/app/src/components/target/settings/registry-access-token.tsx
@@ -2,7 +2,6 @@ import { useState } from 'react';
 import { useForm, UseFormReturn } from 'react-hook-form';
 import { AnyVariables, useMutation, UseMutationState } from 'urql';
 import { z } from 'zod';
-import { Tag } from '@/components//v2/tag';
 import { PermissionScopeItem } from '@/components/organization/Permissions';
 import { Button } from '@/components/ui/button';
 import {
@@ -18,6 +17,7 @@ import { Input } from '@/components/ui/input';
 import { InputCopy } from '@/components/ui/input-copy';
 import { useToast } from '@/components/ui/use-toast';
 import { Accordion } from '@/components/v2/accordion';
+import { Tag } from '@/components/v2/tag';
 import { graphql } from '@/gql';
 import { TargetAccessScope } from '@/gql/graphql';
 import { RegistryAccessScope } from '@/lib/access/common';
diff --git a/packages/web/app/src/lib/access/organization.ts b/packages/web/app/src/lib/access/organization.ts
deleted file mode 100644
index 11554927b3..0000000000
--- a/packages/web/app/src/lib/access/organization.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { FragmentType, graphql, useFragment } from '@/gql';
-import { OrganizationAccessScope } from '@/gql/graphql';
-import { useRedirect } from './common';
-
-export { OrganizationAccessScope };
-
-const CanAccessOrganization_MemberFragment = graphql(`
-  fragment CanAccessOrganization_MemberFragment on Member {
-    id
-    organizationAccessScopes
-  }
-`);
-
-export function canAccessOrganization(
-  scope: OrganizationAccessScope,
-  mmember: null | FragmentType<typeof CanAccessOrganization_MemberFragment>,
-) {
-  const member = useFragment(CanAccessOrganization_MemberFragment, mmember);
-  if (!member) {
-    return false;
-  }
-
-  return member.organizationAccessScopes.includes(scope);
-}
-
-export function useOrganizationAccess({
-  scope,
-  organizationSlug,
-  member: mmember,
-  redirect = false,
-}: {
-  scope: OrganizationAccessScope;
-  member: null | FragmentType<typeof CanAccessOrganization_MemberFragment>;
-  redirect?: boolean;
-  organizationSlug: string;
-}) {
-  const member = useFragment(CanAccessOrganization_MemberFragment, mmember);
-  const canAccess = canAccessOrganization(scope, mmember);
-
-  useRedirect({
-    canAccess,
-    redirectTo: redirect
-      ? router => {
-          void router.navigate({
-            to: '/$organizationSlug',
-            params: {
-              organizationSlug,
-            },
-          });
-        }
-      : undefined,
-    entity: member,
-  });
-
-  return canAccess;
-}
diff --git a/packages/web/app/src/lib/access/project.ts b/packages/web/app/src/lib/access/project.ts
deleted file mode 100644
index dacc791b35..0000000000
--- a/packages/web/app/src/lib/access/project.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { FragmentType, graphql, useFragment } from '@/gql';
-import { ProjectAccessScope } from '@/gql/graphql';
-import { useRedirect } from './common';
-
-export { ProjectAccessScope };
-
-const CanAccessProject_MemberFragment = graphql(`
-  fragment CanAccessProject_MemberFragment on Member {
-    id
-    projectAccessScopes
-  }
-`);
-
-export function canAccessProject(
-  scope: ProjectAccessScope,
-  mmember: null | FragmentType<typeof CanAccessProject_MemberFragment>,
-) {
-  const member = useFragment(CanAccessProject_MemberFragment, mmember);
-  if (!member) {
-    return false;
-  }
-
-  return member.projectAccessScopes.includes(scope);
-}
-
-export function useProjectAccess({
-  scope,
-  member: mmember,
-  redirect = false,
-  organizationSlug,
-  projectSlug,
-}: {
-  scope: ProjectAccessScope;
-  member: null | FragmentType<typeof CanAccessProject_MemberFragment>;
-  redirect?: boolean;
-  organizationSlug: string;
-  projectSlug: string;
-}) {
-  const member = useFragment(CanAccessProject_MemberFragment, mmember);
-
-  const canAccess = canAccessProject(scope, mmember);
-  useRedirect({
-    canAccess,
-    redirectTo: redirect
-      ? router => {
-          void router.navigate({
-            to: '/$organizationSlug/$projectSlug',
-            params: {
-              organizationSlug,
-              projectSlug,
-            },
-          });
-        }
-      : undefined,
-    entity: member,
-  });
-
-  return canAccess;
-}
diff --git a/packages/web/app/src/lib/access/target.ts b/packages/web/app/src/lib/access/target.ts
deleted file mode 100644
index 5f8c22ccb6..0000000000
--- a/packages/web/app/src/lib/access/target.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import { FragmentType, graphql, useFragment } from '@/gql';
-import { TargetAccessScope } from '@/gql/graphql';
-
-export { TargetAccessScope };
-
-const CanAccessTarget_MemberFragment = graphql(`
-  fragment CanAccessTarget_MemberFragment on Member {
-    id
-    targetAccessScopes
-  }
-`);
-
-export function canAccessTarget(
-  scope: TargetAccessScope,
-  mmember: null | FragmentType<typeof CanAccessTarget_MemberFragment>,
-) {
-  const member = useFragment(CanAccessTarget_MemberFragment, mmember);
-
-  if (!member) {
-    return false;
-  }
-
-  return member.targetAccessScopes.includes(scope);
-}
diff --git a/packages/web/app/src/lib/hooks/laboratory/use-operation-collections-plugin.tsx b/packages/web/app/src/lib/hooks/laboratory/use-operation-collections-plugin.tsx
index 2346830740..22d056e8e1 100644
--- a/packages/web/app/src/lib/hooks/laboratory/use-operation-collections-plugin.tsx
+++ b/packages/web/app/src/lib/hooks/laboratory/use-operation-collections-plugin.tsx
@@ -80,15 +80,6 @@ export const TargetLaboratoryPageQuery = graphql(`
     $projectSlug: String!
     $targetSlug: String!
   ) {
-    organization(selector: { organizationSlug: $organizationSlug }) {
-      organization {
-        id
-        me {
-          id
-          ...CanAccessTarget_MemberFragment
-        }
-      }
-    }
     target(
       selector: {
         organizationSlug: $organizationSlug
diff --git a/packages/web/app/src/pages/organization-members.tsx b/packages/web/app/src/pages/organization-members.tsx
index f01b7a3d24..42a43a798a 100644
--- a/packages/web/app/src/pages/organization-members.tsx
+++ b/packages/web/app/src/pages/organization-members.tsx
@@ -17,7 +17,7 @@ const OrganizationMembersPage_OrganizationFragment = graphql(`
     ...OrganizationInvitations_OrganizationFragment
     ...OrganizationMemberRoles_OrganizationFragment
     ...OrganizationMembers_OrganizationFragment
-    ...SelectedPermissionOverview_MemberPermissionGroupsFragment
+    ...SelectedPermissionOverview_OrganizationFragment
     viewerCanManageInvitations
     viewerCanManageRoles
   }
diff --git a/packages/web/app/src/pages/project-policy.tsx b/packages/web/app/src/pages/project-policy.tsx
index f12b7c5f4b..6176073eb1 100644
--- a/packages/web/app/src/pages/project-policy.tsx
+++ b/packages/web/app/src/pages/project-policy.tsx
@@ -14,10 +14,6 @@ const ProjectPolicyPageQuery = graphql(`
     organization(selector: { organizationSlug: $organizationSlug }) {
       organization {
         id
-        me {
-          id
-          ...CanAccessProject_MemberFragment
-        }
       }
     }
     project(selector: { organizationSlug: $organizationSlug, projectSlug: $projectSlug }) {
diff --git a/packages/web/app/src/pages/project-settings.tsx b/packages/web/app/src/pages/project-settings.tsx
index 4055bd0f02..d7e75e0886 100644
--- a/packages/web/app/src/pages/project-settings.tsx
+++ b/packages/web/app/src/pages/project-settings.tsx
@@ -312,10 +312,6 @@ const ProjectSettingsPage_OrganizationFragment = graphql(`
   fragment ProjectSettingsPage_OrganizationFragment on Organization {
     id
     slug
-    me {
-      id
-      ...CanAccessProject_MemberFragment
-    }
     ...ExternalCompositionSettings_OrganizationFragment
     ...NativeCompositionSettings_OrganizationFragment
   }
diff --git a/packages/web/app/src/pages/target-settings.tsx b/packages/web/app/src/pages/target-settings.tsx
index ca62e0311c..1012a239ec 100644
--- a/packages/web/app/src/pages/target-settings.tsx
+++ b/packages/web/app/src/pages/target-settings.tsx
@@ -43,10 +43,9 @@ import { Switch } from '@/components/v2/switch';
 import { Table, TBody, Td, Tr } from '@/components/v2/table';
 import { Tag } from '@/components/v2/tag';
 import { env } from '@/env/frontend';
-import { FragmentType, graphql, useFragment } from '@/gql';
+import { graphql, useFragment } from '@/gql';
 import { BreakingChangeFormula, ProjectType } from '@/gql/graphql';
 import { useRedirect } from '@/lib/access/common';
-import { canAccessTarget, TargetAccessScope } from '@/lib/access/target';
 import { subDays } from '@/lib/date-time';
 import { useToggle } from '@/lib/hooks';
 import { cn } from '@/lib/utils';
@@ -54,12 +53,6 @@ import { zodResolver } from '@hookform/resolvers/zod';
 import { RadioGroupIndicator } from '@radix-ui/react-radio-group';
 import { Link, useRouter } from '@tanstack/react-router';
 
-const RegistryAccessTokens_MeFragment = graphql(`
-  fragment RegistryAccessTokens_MeFragment on Member {
-    ...CanAccessTarget_MemberFragment
-  }
-`);
-
 export const DeleteTokensDocument = graphql(`
   mutation deleteTokens($input: DeleteTokensInput!) {
     deleteTokens(input: $input) {
@@ -89,12 +82,10 @@ export const TokensDocument = graphql(`
 `);
 
 function RegistryAccessTokens(props: {
-  me: FragmentType<typeof RegistryAccessTokens_MeFragment>;
   organizationSlug: string;
   projectSlug: string;
   targetSlug: string;
 }) {
-  const me = useFragment(RegistryAccessTokens_MeFragment, props.me);
   const [{ fetching: deleting }, mutate] = useMutation(DeleteTokensDocument);
   const [checked, setChecked] = useState<string[]>([]);
   const [isModalOpen, toggleModalOpen] = useToggle();
@@ -124,8 +115,6 @@ function RegistryAccessTokens(props: {
     setChecked([]);
   }, [checked, mutate, props.organizationSlug, props.projectSlug, props.targetSlug]);
 
-  const canManage = canAccessTarget(TargetAccessScope.TokensWrite, me);
-
   return (
     <SubPageLayout>
       <SubPageLayoutHeader
@@ -147,23 +136,21 @@ function RegistryAccessTokens(props: {
           </>
         }
       />
-      {canManage && (
-        <div className="my-3.5 flex justify-between" data-cy="target-settings-registry-token">
-          <Button data-cy="new-button" onClick={toggleModalOpen}>
-            Create new registry token
+      <div className="my-3.5 flex justify-between" data-cy="target-settings-registry-token">
+        <Button data-cy="new-button" onClick={toggleModalOpen}>
+          Create new registry token
+        </Button>
+        {checked.length === 0 ? null : (
+          <Button
+            data-cy="delete-button"
+            variant="destructive"
+            disabled={deleting}
+            onClick={deleteTokens}
+          >
+            Delete ({checked.length || null})
           </Button>
-          {checked.length === 0 ? null : (
-            <Button
-              data-cy="delete-button"
-              variant="destructive"
-              disabled={deleting}
-              onClick={deleteTokens}
-            >
-              Delete ({checked.length || null})
-            </Button>
-          )}
-        </div>
-      )}
+        )}
+      </div>
       <Table>
         <TBody>
           {tokens?.map(token => (
@@ -176,7 +163,6 @@ function RegistryAccessTokens(props: {
                     )
                   }
                   checked={checked.includes(token.id)}
-                  disabled={!canManage}
                 />
               </Td>
               <Td>{token.alias}</Td>
@@ -1103,15 +1089,6 @@ const TargetSettingsPage_UpdateTargetSlugMutation = graphql(`
   }
 `);
 
-const TargetSettingsPage_OrganizationFragment = graphql(`
-  fragment TargetSettingsPage_OrganizationFragment on Organization {
-    me {
-      ...CanAccessTarget_MemberFragment
-      ...RegistryAccessTokens_MeFragment
-    }
-  }
-`);
-
 function TargetDelete(props: {
   organizationSlug: string;
   projectSlug: string;
@@ -1165,7 +1142,6 @@ const TargetSettingsPageQuery = graphql(`
       organization {
         id
         slug
-        ...TargetSettingsPage_OrganizationFragment
       }
     }
     project(selector: { organizationSlug: $organizationSlug, projectSlug: $projectSlug }) {
@@ -1212,10 +1188,6 @@ function TargetSettingsContent(props: {
   const currentOrganization = query.data?.organization?.organization;
   const currentProject = query.data?.project;
   const currentTarget = query.data?.target;
-  const organizationForSettings = useFragment(
-    TargetSettingsPage_OrganizationFragment,
-    currentOrganization,
-  );
 
   useRedirect({
     canAccess: currentTarget?.viewerCanAccessSettings === true,
@@ -1305,13 +1277,7 @@ function TargetSettingsContent(props: {
     );
   }
 
-  if (
-    !resolvedPage ||
-    !currentOrganization ||
-    !currentProject ||
-    !currentTarget ||
-    !organizationForSettings
-  ) {
+  if (!resolvedPage || !currentOrganization || !currentProject || !currentTarget) {
     return null;
   }
 
@@ -1344,7 +1310,7 @@ function TargetSettingsContent(props: {
         })}
       </NavLayout>
       <PageLayoutContent>
-        {currentOrganization && currentProject && currentTarget && organizationForSettings ? (
+        {currentOrganization && currentProject && currentTarget ? (
           <div className="space-y-12">
             {resolvedPage.key === 'general' ? (
               <>
@@ -1377,7 +1343,6 @@ function TargetSettingsContent(props: {
             ) : null}
             {resolvedPage.key === 'registry-token' ? (
               <RegistryAccessTokens
-                me={organizationForSettings.me}
                 organizationSlug={props.organizationSlug}
                 projectSlug={props.projectSlug}
                 targetSlug={props.targetSlug}
diff --git a/packages/web/app/src/pages/target.tsx b/packages/web/app/src/pages/target.tsx
index 5526ba6d85..b92b055a38 100644
--- a/packages/web/app/src/pages/target.tsx
+++ b/packages/web/app/src/pages/target.tsx
@@ -105,20 +105,9 @@ function Schemas(props: { schemas?: readonly CompositeSchema[]; schema?: SingleS
   );
 }
 
-const SchemaView_OrganizationFragment = graphql(`
-  fragment SchemaView_OrganizationFragment on Organization {
-    id
-    slug
-    me {
-      ...CanAccessTarget_MemberFragment
-    }
-  }
-`);
-
 const SchemaView_ProjectFragment = graphql(`
   fragment SchemaView_ProjectFragment on Project {
     id
-    slug
     type
   }
 `);
@@ -156,7 +145,6 @@ const SchemaView_TargetFragment = graphql(`
 `);
 
 function SchemaView(props: {
-  organization: FragmentType<typeof SchemaView_OrganizationFragment>;
   project: FragmentType<typeof SchemaView_ProjectFragment>;
   target: FragmentType<typeof SchemaView_TargetFragment>;
 }): ReactElement | null {
@@ -266,11 +254,6 @@ const TargetSchemaPageQuery = graphql(`
     $projectSlug: String!
     $targetSlug: String!
   ) {
-    organization(selector: { organizationSlug: $organizationSlug }) {
-      organization {
-        ...SchemaView_OrganizationFragment
-      }
-    }
     project(selector: { organizationSlug: $organizationSlug, projectSlug: $projectSlug }) {
       ...SchemaView_ProjectFragment
     }
@@ -304,7 +287,6 @@ function TargetSchemaPage(props: {
     return <QueryError organizationSlug={props.organizationSlug} error={query.error} />;
   }
 
-  const currentOrganization = query.data?.organization?.organization;
   const currentProject = query.data?.project;
   const target = query.data?.target;
 
@@ -349,8 +331,8 @@ function TargetSchemaPage(props: {
         </div>
       </div>
       <div>
-        {query.fetching ? null : currentOrganization && currentProject && target ? (
-          <SchemaView organization={currentOrganization} project={currentProject} target={target} />
+        {query.fetching ? null : currentProject && target ? (
+          <SchemaView project={currentProject} target={target} />
         ) : null}
       </div>
     </TargetLayout>
diff --git a/packages/web/app/src/stories/selected-permission-overview.stories.tsx b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
index 690a76ab43..7942420557 100644
--- a/packages/web/app/src/stories/selected-permission-overview.stories.tsx
+++ b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
@@ -2,7 +2,7 @@ import { makeFragmentData } from '@/gql';
 import { Meta, StoryObj } from '@storybook/react';
 import {
   SelectedPermissionOverview,
-  SelectedPermissionOverview_MemberPermissionGroupsFragment,
+  SelectedPermissionOverview_OrganizationFragment,
   SelectedPermissionOverviewProps,
 } from '../components/organization/members/selected-permission-overview';
 import { availableMemberPermissionGroups } from './utils';
@@ -21,7 +21,7 @@ const defaultProps: SelectedPermissionOverviewProps = {
       __typename: 'Organization',
       availableMemberPermissionGroups: availableMemberPermissionGroups as any,
     },
-    SelectedPermissionOverview_MemberPermissionGroupsFragment,
+    SelectedPermissionOverview_OrganizationFragment,
   ),
   activePermissionIds: [],
   showOnlyAllowedPermissions: false,

From e82f8c4fa68c38e10000189850c44b8d1d712008 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 10 Jan 2025 18:15:38 +0100
Subject: [PATCH 13/55] move default role definitions to organization-member
 module

---
 .../providers/organization-config.ts          |  20 ---
 .../providers/organization-manager.ts         | 161 +-----------------
 .../providers/organization-member-roles.ts    | 137 +++++++++------
 .../src/modules/shared/providers/storage.ts   |   2 -
 packages/services/storage/src/index.ts        |   3 -
 5 files changed, 87 insertions(+), 236 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-config.ts b/packages/services/api/src/modules/organization/providers/organization-config.ts
index e2b83b10b8..44d91ca013 100644
--- a/packages/services/api/src/modules/organization/providers/organization-config.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-config.ts
@@ -1,9 +1,3 @@
-import {
-  OrganizationAccessScope,
-  ProjectAccessScope,
-  TargetAccessScope,
-} from '../../auth/providers/scopes';
-
 export const reservedOrganizationSlugs = [
   'registry',
   'server',
@@ -51,17 +45,3 @@ export const reservedOrganizationSlugs = [
   'new',
   'org',
 ];
-
-export const organizationAdminScopes = [
-  ...Object.values(OrganizationAccessScope),
-  ...Object.values(ProjectAccessScope),
-  ...Object.values(TargetAccessScope),
-];
-
-export const organizationViewerScopes = [
-  OrganizationAccessScope.READ,
-  ProjectAccessScope.READ,
-  ProjectAccessScope.OPERATIONS_STORE_READ,
-  TargetAccessScope.READ,
-  TargetAccessScope.REGISTRY_READ,
-];
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 35b6ba210f..93899d4bc0 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -6,9 +6,6 @@ import { cache, share } from '../../../shared/helpers';
 import { AuditLogRecorder } from '../../audit-logs/providers/audit-log-recorder';
 import { Session } from '../../auth/lib/authz';
 import { AuthManager } from '../../auth/providers/auth-manager';
-import { OrganizationAccessScope } from '../../auth/providers/organization-access';
-import { ProjectAccessScope } from '../../auth/providers/project-access';
-import { TargetAccessScope } from '../../auth/providers/target-access';
 import { BillingProvider } from '../../billing/providers/billing.provider';
 import { OIDCIntegrationsProvider } from '../../oidc-integrations/providers/oidc-integrations.provider';
 import { Emails, mjml } from '../../shared/providers/emails';
@@ -19,12 +16,8 @@ import { Storage } from '../../shared/providers/storage';
 import { WEB_APP_URL } from '../../shared/providers/tokens';
 import { TokenStorage } from '../../token/providers/token-storage';
 import { createOrUpdateMemberRoleInputSchema } from '../validation';
-import {
-  organizationAdminScopes,
-  organizationViewerScopes,
-  reservedOrganizationSlugs,
-} from './organization-config';
-import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
+import { reservedOrganizationSlugs } from './organization-config';
+import { OrganizationMemberRoles } from './organization-member-roles';
 import { OrganizationMembers } from './organization-members';
 
 /**
@@ -307,8 +300,6 @@ export class OrganizationManager {
     const result = await this.storage.createOrganization({
       slug,
       userId: user.id,
-      adminScopes: organizationAdminScopes,
-      viewerScopes: organizationViewerScopes,
       reservedSlugs: reservedOrganizationSlugs,
     });
 
@@ -521,10 +512,7 @@ export class OrganizationManager {
       organizationId: input.organization,
     });
 
-    const [members, currentUserAccessScopes] = await Promise.all([
-      this.getOrganizationMembers({ organizationId: input.organization }),
-      this.authManager.getCurrentUserAccessScopes(organization.id),
-    ]);
+    const members = await this.getOrganizationMembers({ organizationId: input.organization });
     const existingMember = members.find(member => member.user.email === email);
 
     if (existingMember) {
@@ -544,21 +532,6 @@ export class OrganizationManager {
       throw new HiveError(`Role not found`);
     }
 
-    // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes =
-      role.legacyScopes?.filter(scope => !currentUserAccessScopes.includes(scope)) ?? [];
-
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserAccessScopes.join(','));
-      this.logger.debug(`Missing scopes: %s`, currentUserMissingScopes.join(','));
-      return {
-        error: {
-          message: `Not enough access to invite a member with this role`,
-          inputErrors: {},
-        },
-      };
-    }
-
     // Delete existing invitation
     await this.storage.deleteOrganizationInvitationByEmail({
       organizationId: organization.id,
@@ -991,16 +964,6 @@ export class OrganizationManager {
       };
     }
 
-    const accessCheckResult = await this.canDeleteRole(role);
-
-    if (!accessCheckResult.ok) {
-      return {
-        error: {
-          message: accessCheckResult.message,
-        },
-      };
-    }
-
     // delete the role
     await this.storage.deleteOrganizationMemberRole({
       organizationId: input.organizationId,
@@ -1248,122 +1211,4 @@ export class OrganizationManager {
 
     return this.organizationMemberRoles.findViewerRoleByOrganizationId(selector.organizationId);
   }
-
-  async canDeleteRole(role: OrganizationMemberRole): Promise<
-    | {
-        ok: false;
-        message: string;
-      }
-    | {
-        ok: true;
-      }
-  > {
-    // Ensure role is not locked (can't be deleted)
-    if (role.isLocked) {
-      return {
-        ok: false,
-        message: `Cannot delete a built-in role`,
-      };
-    }
-    // Ensure role has no members
-    let membersCount: number | null = role.membersCount;
-
-    if (typeof membersCount !== 'number') {
-      const freshRole = await this.organizationMemberRoles.findMemberRoleById(role.id);
-
-      if (!freshRole) {
-        throw new Error('Role not found');
-      }
-
-      // TODO: check this
-      membersCount = freshRole.membersCount ?? 0;
-    }
-
-    if (membersCount > 0) {
-      return {
-        ok: false,
-        message: `Cannot delete a role with members`,
-      };
-    }
-
-    return {
-      ok: true,
-    };
-  }
-
-  canUpdateRole(
-    role: OrganizationMemberRole,
-    currentUserScopes: readonly (
-      | OrganizationAccessScope
-      | ProjectAccessScope
-      | TargetAccessScope
-    )[],
-  ):
-    | {
-        ok: false;
-        message: string;
-      }
-    | {
-        ok: true;
-      } {
-    // Ensure role is not locked (can't be updated)
-    if (role.isLocked) {
-      return {
-        ok: false,
-        message: `Cannot update a built-in role`,
-      };
-    }
-
-    // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes =
-      role.legacyScopes?.filter(scope => !currentUserScopes.includes(scope)) ?? [];
-
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserScopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingScopes.join(', '));
-
-      return {
-        ok: false,
-        message: `Missing access to some of the scopes of the role`,
-      };
-    }
-
-    return {
-      ok: true,
-    };
-  }
-
-  canInviteRole(
-    role: OrganizationMemberRole,
-    currentUserScopes: readonly (
-      | OrganizationAccessScope
-      | ProjectAccessScope
-      | TargetAccessScope
-    )[],
-  ):
-    | {
-        ok: false;
-        message: string;
-      }
-    | {
-        ok: true;
-      } {
-    // Ensure user has access to all scopes in the role
-    const currentUserMissingScopes =
-      role.legacyScopes?.filter(scope => !currentUserScopes.includes(scope)) ?? [];
-
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %s`, currentUserScopes.join(', '));
-      this.logger.debug(`No access to scopes: %s`, currentUserMissingScopes.join(', '));
-
-      return {
-        ok: false,
-        message: `Missing access to some of the scopes of the role`,
-      };
-    }
-
-    return {
-      ok: true,
-    };
-  }
 }
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index 8f5a0dc2fd..589fb2e2d4 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -5,6 +5,7 @@ import { batch } from '../../../shared/helpers';
 import {
   Permission,
   PermissionsModel,
+  PermissionsPerResourceLevelAssignment,
   PermissionsPerResourceLevelAssignmentModel,
   permissionsToPermissionsPerResourceLevelAssignment,
 } from '../../auth/lib/authz';
@@ -17,10 +18,10 @@ import { Logger } from '../../shared/providers/logger';
 import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
 import * as OrganizationMemberPermissions from '../lib/organization-member-permissions';
 
-// function omit<T extends object, K extends keyof T>(obj: T, key: K): Omit<T, K> {
-//   const { [key]: _, ...rest } = obj;
-//   return rest;
-// }
+function omit<T extends object, K extends keyof T>(obj: T, key: K): Omit<T, K> {
+  const { [key]: _, ...rest } = obj;
+  return rest;
+}
 
 const MemberRoleModel = z
   .intersection(
@@ -48,16 +49,28 @@ const MemberRoleModel = z
       }),
     ]),
   )
-  .transform(record => ({
-    // TODO: omit "legacyScopes" property
-    ...record,
-    permissions: record.permissions
-      ? permissionsToPermissionsPerResourceLevelAssignment([
-          ...OrganizationMemberPermissions.permissions.default,
-          ...record.permissions,
-        ])
-      : transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes),
-  }));
+  .transform(record => {
+    let permissions: PermissionsPerResourceLevelAssignment;
+
+    // Both "Viewer" and "Admin" have pre-defined permissions
+    if (record.name === 'Viewer') {
+      permissions = predefinedRolesPermissions.viewer;
+    } else if (record.name === 'Admin') {
+      permissions = predefinedRolesPermissions.admin;
+    } else if (record.permissions) {
+      permissions = permissionsToPermissionsPerResourceLevelAssignment([
+        ...OrganizationMemberPermissions.permissions.default,
+        ...record.permissions,
+      ]);
+    } else {
+      permissions = transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes);
+    }
+
+    return {
+      ...omit(record, 'legacyScopes'),
+      permissions,
+    };
+  });
 
 export type OrganizationMemberRole = z.TypeOf<typeof MemberRoleModel>;
 
@@ -212,92 +225,91 @@ export class OrganizationMemberRoles {
 export function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
   scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
 ): z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> {
-  const permissions = permissionsToPermissionsPerResourceLevelAssignment([
-    ...OrganizationMemberPermissions.permissions.default,
-  ]);
+  const permissions = new Set<Permission>();
   for (const scope of scopes) {
     switch (scope) {
       case OrganizationAccessScope.READ: {
-        permissions.organization.add('organization:describe');
-        permissions.organization.add('support:manageTickets');
-        permissions.organization.add('project:create');
-        permissions.project.add('project:describe');
+        permissions.add('support:manageTickets');
+        permissions.add('project:create');
+        permissions.add('project:describe');
         break;
       }
       case OrganizationAccessScope.SETTINGS: {
-        permissions.organization.add('organization:modifySlug');
-        permissions.organization.add('schemaLinting:modifyOrganizationRules');
-        permissions.organization.add('billing:describe');
-        permissions.organization.add('billing:update');
-        permissions.organization.add('auditLog:export');
+        permissions.add('organization:modifySlug');
+        permissions.add('schemaLinting:modifyOrganizationRules');
+        permissions.add('billing:describe');
+        permissions.add('billing:update');
+        permissions.add('auditLog:export');
         break;
       }
       case OrganizationAccessScope.DELETE: {
-        permissions.organization.add('organization:delete');
+        permissions.add('organization:delete');
         break;
       }
       case OrganizationAccessScope.INTEGRATIONS: {
-        permissions.organization.add('oidc:modify');
-        permissions.organization.add('gitHubIntegration:modify');
-        permissions.organization.add('slackIntegration:modify');
-
+        permissions.add('oidc:modify');
+        permissions.add('gitHubIntegration:modify');
+        permissions.add('slackIntegration:modify');
         break;
       }
       case OrganizationAccessScope.MEMBERS: {
-        permissions.organization.add('member:manageInvites');
-        permissions.organization.add('member:removeMember');
-        permissions.organization.add('member:assignRole');
-        permissions.organization.add('member:modifyRole');
-        permissions.organization.add('member:describe');
+        permissions.add('member:manageInvites');
+        permissions.add('member:removeMember');
+        permissions.add('member:assignRole');
+        permissions.add('member:modifyRole');
+        permissions.add('member:describe');
         break;
       }
       case ProjectAccessScope.ALERTS: {
-        permissions.project.add('alert:modify');
+        permissions.add('alert:modify');
         break;
       }
       case ProjectAccessScope.READ: {
-        permissions.project.add('project:describe');
+        permissions.add('project:describe');
         break;
       }
       case ProjectAccessScope.DELETE: {
-        permissions.project.add('project:delete');
+        permissions.add('project:delete');
         break;
       }
       case ProjectAccessScope.SETTINGS: {
-        permissions.project.add('project:delete');
-        permissions.project.add('project:modifySettings');
-        permissions.project.add('schemaLinting:modifyProjectRules');
+        permissions.add('project:delete');
+        permissions.add('project:modifySettings');
+        permissions.add('schemaLinting:modifyProjectRules');
         break;
       }
       case TargetAccessScope.READ: {
-        permissions.project.add('target:create');
-        permissions.target.add('appDeployment:describe');
-        permissions.target.add('laboratory:describe');
+        permissions.add('target:create');
+        permissions.add('appDeployment:describe');
+        permissions.add('laboratory:describe');
         break;
       }
       case TargetAccessScope.REGISTRY_WRITE: {
-        permissions.target.add('laboratory:modify');
-        permissions.service.add('schemaCheck:approve');
+        permissions.add('laboratory:modify');
+        permissions.add('schemaCheck:approve');
         break;
       }
       case TargetAccessScope.TOKENS_WRITE: {
-        permissions.target.add('targetAccessToken:modify');
-        permissions.target.add('cdnAccessToken:modify');
+        permissions.add('targetAccessToken:modify');
+        permissions.add('cdnAccessToken:modify');
         break;
       }
       case TargetAccessScope.SETTINGS: {
-        permissions.target.add('target:modifySettings');
-        permissions.target.add('laboratory:modifyPreflightScript');
+        permissions.add('target:modifySettings');
+        permissions.add('laboratory:modifyPreflightScript');
         break;
       }
       case TargetAccessScope.DELETE: {
-        permissions.target.add('target:delete');
+        permissions.add('target:delete');
         break;
       }
     }
   }
 
-  return permissions;
+  return permissionsToPermissionsPerResourceLevelAssignment([
+    ...OrganizationMemberPermissions.permissions.default,
+    ...permissions,
+  ]);
 }
 
 const organizationMemberRoleFields = sql`
@@ -314,3 +326,22 @@ const organizationMemberRoleFields = sql`
     WHERE "om"."role_id" = "organization_member_roles"."id"
   ) AS "membersCount"
 `;
+
+const predefinedRolesPermissions = {
+  /**
+   * Permissions the default admin role is assigned with (aka full access)
+   **/
+  admin: permissionsToPermissionsPerResourceLevelAssignment([
+    ...OrganizationMemberPermissions.permissions.assignable,
+  ]),
+  /**
+   * Permissions the viewer role is assigned with (computed from legacy scopes)
+   **/
+  viewer: transformOrganizationMemberLegacyScopesIntoPermissionGroup([
+    OrganizationAccessScope.READ,
+    ProjectAccessScope.READ,
+    ProjectAccessScope.OPERATIONS_STORE_READ,
+    TargetAccessScope.READ,
+    TargetAccessScope.REGISTRY_READ,
+  ]),
+};
diff --git a/packages/services/api/src/modules/shared/providers/storage.ts b/packages/services/api/src/modules/shared/providers/storage.ts
index 1b4d145bf1..b8dd5f9695 100644
--- a/packages/services/api/src/modules/shared/providers/storage.ts
+++ b/packages/services/api/src/modules/shared/providers/storage.ts
@@ -94,8 +94,6 @@ export interface Storage {
   createOrganization(
     _: Pick<Organization, 'slug'> & {
       userId: string;
-      adminScopes: ReadonlyArray<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>;
-      viewerScopes: ReadonlyArray<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>;
       reservedSlugs: string[];
     },
   ): Promise<
diff --git a/packages/services/storage/src/index.ts b/packages/services/storage/src/index.ts
index f30cccb3f0..8ce471e7c7 100644
--- a/packages/services/storage/src/index.ts
+++ b/packages/services/storage/src/index.ts
@@ -701,20 +701,17 @@ export async function createStorage(
             organization_id,
             name,
             description,
-            scopes,
             locked
           )
           VALUES (
             ${org.id},
             'Admin',
             'Full access to all organization resources',
-            ${sql.array(input.adminScopes, 'text')},
             true
           ), (
             ${org.id},
             'Viewer',
             'Read-only access to all organization resources',
-            ${sql.array(input.viewerScopes, 'text')},
             true
           )
           RETURNING id, name

From dc5f41d48e08f39d0368e3537042df8236408667 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 10:11:05 +0100
Subject: [PATCH 14/55] this does no longer exist

---
 packages/services/api/src/index.ts            |  5 +-
 .../lib/organization-member-permissions.ts    |  5 -
 packages/web/app/src/lib/access/common.ts     | 95 +------------------
 packages/web/app/src/stories/utils.ts         |  9 --
 4 files changed, 2 insertions(+), 112 deletions(-)

diff --git a/packages/services/api/src/index.ts b/packages/services/api/src/index.ts
index 96e0591a70..ca2d1b9c0c 100644
--- a/packages/services/api/src/index.ts
+++ b/packages/services/api/src/index.ts
@@ -27,10 +27,7 @@ export { HttpClient } from './modules/shared/providers/http-client';
 export { OperationsManager } from './modules/operations/providers/operations-manager';
 export { OperationsReader } from './modules/operations/providers/operations-reader';
 export { ClickHouse, sql } from './modules/operations/providers/clickhouse-client';
-export {
-  organizationAdminScopes,
-  reservedOrganizationSlugs as reservedOrganizationNames,
-} from './modules/organization/providers/organization-config';
+export { reservedOrganizationSlugs as reservedOrganizationNames } from './modules/organization/providers/organization-config';
 export { CryptoProvider } from './modules/shared/providers/crypto';
 export {
   OrganizationAccessScope,
diff --git a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index b7caf4b599..f564b68b6d 100644
--- a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -207,11 +207,6 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         description: 'Can create alerts for schema versions.',
         dependsOn: 'project:describe',
       },
-      {
-        id: 'schemaVersion:approve',
-        title: 'Approve schema version (legacy)',
-        description: 'Can approve schema versions on projects using the legacy registry model.',
-      },
       {
         id: 'targetAccessToken:modify',
         title: 'Manage registry access tokens',
diff --git a/packages/web/app/src/lib/access/common.ts b/packages/web/app/src/lib/access/common.ts
index 6b6f1029e4..c5fc9fc0b6 100644
--- a/packages/web/app/src/lib/access/common.ts
+++ b/packages/web/app/src/lib/access/common.ts
@@ -1,5 +1,5 @@
 import React, { useEffect } from 'react';
-import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from '@/gql/graphql';
+import { TargetAccessScope } from '@/gql/graphql';
 import { useRouter } from '@tanstack/react-router';
 
 export interface Scope<T> {
@@ -22,99 +22,6 @@ export const RegistryAccessScope = {
   },
 };
 
-export const scopes: {
-  organization: readonly Scope<OrganizationAccessScope>[];
-  project: readonly Scope<ProjectAccessScope>[];
-  target: readonly Scope<TargetAccessScope>[];
-} = {
-  organization: [
-    {
-      name: 'Delete',
-      description: 'The member will be able to delete an organization',
-      mapping: {
-        'read-write': OrganizationAccessScope.Delete,
-      },
-    },
-    {
-      name: 'Settings',
-      description: "Manage organization's settings (change its name, etc.)",
-      mapping: {
-        'read-write': OrganizationAccessScope.Settings,
-      },
-    },
-    {
-      name: 'Integrations',
-      description: 'Manage 3rd party integrations (Slack, GitHub, etc.)',
-      mapping: {
-        'read-write': OrganizationAccessScope.Integrations,
-      },
-    },
-    {
-      name: 'Members',
-      description: 'Manage organization members (invite, remove, etc.)',
-      mapping: {
-        'read-write': OrganizationAccessScope.Members,
-      },
-    },
-  ],
-  project: [
-    {
-      name: 'Delete',
-      description: 'The member will be able to delete a project',
-      mapping: {
-        'read-write': ProjectAccessScope.Delete,
-      },
-    },
-    {
-      name: 'Settings',
-      description: 'Manage project settings (change its name, etc.)',
-      mapping: {
-        'read-write': ProjectAccessScope.Settings,
-      },
-    },
-    {
-      name: 'Alerts',
-      description: 'Manage 3rd party integrations (Slack, GitHub, etc.)',
-      mapping: {
-        'read-write': ProjectAccessScope.Alerts,
-      },
-    },
-    {
-      name: 'Operations Store',
-      description: 'Manage persisted operations',
-      mapping: {
-        'read-only': ProjectAccessScope.OperationsStoreRead,
-        'read-write': ProjectAccessScope.OperationsStoreWrite,
-      },
-    },
-  ],
-  target: [
-    {
-      name: 'Delete',
-      description: 'The member will be able to delete a target',
-      mapping: {
-        'read-write': TargetAccessScope.Delete,
-      },
-    },
-    RegistryAccessScope,
-    {
-      name: 'Settings',
-      description: 'Manage target settings (change its name, etc.)',
-      mapping: {
-        'read-write': TargetAccessScope.Settings,
-      },
-    },
-    {
-      name: 'Tokens',
-      description: 'Manage access tokens',
-      mapping: {
-        'read-only': TargetAccessScope.TokensRead,
-        'read-write': TargetAccessScope.TokensWrite,
-      },
-    },
-  ],
-};
-
 export function useRedirect({
   canAccess,
   entity,
diff --git a/packages/web/app/src/stories/utils.ts b/packages/web/app/src/stories/utils.ts
index eafc348411..fcd68ede91 100644
--- a/packages/web/app/src/stories/utils.ts
+++ b/packages/web/app/src/stories/utils.ts
@@ -289,15 +289,6 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         level: PermissionLevel.Project,
         title: 'Modify alerts',
       },
-      {
-        __typename: 'Permission',
-        isReadOnly: false,
-        id: 'schemaVersion:approve',
-        dependsOnId: null,
-        description: 'Can approve schema versions on projects using the legacy registry model.',
-        level: PermissionLevel.Target,
-        title: 'Approve schema version (legacy)',
-      },
       {
         __typename: 'Permission',
         isReadOnly: false,

From e5bc89655b5998aa4d82f58e880febc44b9ef2b7 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 11:01:13 +0100
Subject: [PATCH 15/55] minor cleanup

---
 integration-tests/testkit/flow.ts             | 30 ++++------
 .../providers/organization-manager.ts         | 23 ++------
 .../providers/organization-members.ts         | 55 ++++++++++++-------
 .../modules/organization/resolvers/Member.ts  |  5 +-
 4 files changed, 51 insertions(+), 62 deletions(-)

diff --git a/integration-tests/testkit/flow.ts b/integration-tests/testkit/flow.ts
index 07710d6818..2bab6572e1 100644
--- a/integration-tests/testkit/flow.ts
+++ b/integration-tests/testkit/flow.ts
@@ -50,9 +50,10 @@ export function createOrganization(input: CreateOrganizationInput, authToken: st
                 slug
                 owner {
                   id
-                  organizationAccessScopes
-                  projectAccessScopes
-                  targetAccessScopes
+                  role {
+                    id
+                    permissions
+                  }
                 }
                 memberRoles {
                   id
@@ -178,9 +179,10 @@ export function joinOrganization(code: string, authToken: string) {
                 user {
                   id
                 }
-                organizationAccessScopes
-                projectAccessScopes
-                targetAccessScopes
+                role {
+                  id
+                  permissions
+                }
               }
             }
           }
@@ -213,10 +215,8 @@ export function getOrganizationMembers(selector: OrganizationSelectorInput, auth
                 role {
                   id
                   name
+                  permissions
                 }
-                organizationAccessScopes
-                projectAccessScopes
-                targetAccessScopes
               }
             }
           }
@@ -664,9 +664,7 @@ export function createMemberRole(input: CreateMemberRoleInput, authToken: string
                 name
                 description
                 locked
-                organizationAccessScopes
-                projectAccessScopes
-                targetAccessScopes
+                permissions
               }
             }
           }
@@ -724,9 +722,7 @@ export function deleteMemberRole(input: DeleteMemberRoleInput, authToken: string
                 name
                 description
                 locked
-                organizationAccessScopes
-                projectAccessScopes
-                targetAccessScopes
+                permissions
               }
             }
           }
@@ -754,9 +750,7 @@ export function updateMemberRole(input: UpdateMemberRoleInput, authToken: string
               name
               description
               locked
-              organizationAccessScopes
-              projectAccessScopes
-              targetAccessScopes
+              permissions
             }
           }
           error {
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 93899d4bc0..7c0ef3e438 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -236,11 +236,6 @@ export class OrganizationManager {
     return organization;
   }
 
-  @cache((selector: OrganizationSelector) => selector.organizationId)
-  async getOrganizationMembers(selector: OrganizationSelector) {
-    return this.storage.getOrganizationMembers(selector);
-  }
-
   countOrganizationMembers(selector: OrganizationSelector) {
     return this.storage.countOrganizationMembers(selector);
   }
@@ -512,8 +507,10 @@ export class OrganizationManager {
       organizationId: input.organization,
     });
 
-    const members = await this.getOrganizationMembers({ organizationId: input.organization });
-    const existingMember = members.find(member => member.user.email === email);
+    const existingMember = await this.organizationMembers.findOrganizationMembershipByEmail(
+      organization,
+      email,
+    );
 
     if (existingMember) {
       return {
@@ -830,17 +827,6 @@ export class OrganizationManager {
       throw new Error(`Logged user is not a member of the organization`);
     }
 
-    // Ensure current user has access to all scopes of the member.
-    // User with less access scopes cannot remove a member with more access scopes.
-    const currentUserMissingScopes = member.scopes.filter(
-      scope => !currentUserAsMember.scopes.includes(scope),
-    );
-
-    if (currentUserMissingScopes.length > 0) {
-      this.logger.debug(`Logged user scopes: %o`, currentUserAsMember.scopes);
-      throw new HiveError(`Not enough access to remove the member`);
-    }
-
     await this.storage.deleteOrganizationMember({
       userId: user,
       organizationId: organization,
@@ -883,7 +869,6 @@ export class OrganizationManager {
     const inputValidation = createOrUpdateMemberRoleInputSchema.safeParse({
       name: input.name,
       description: input.description,
-      // TODO: validate permissions
     });
 
     if (!inputValidation.success) {
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index de995c072c..3fb5c07fd3 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -97,17 +97,17 @@ export class OrganizationMembers {
     userIds: Array<string> | null = null,
   ) {
     const query = sql`
-    SELECT
-      "om"."user_id" AS "userId"
-      , "om"."role_id" AS "legacyRoleId"
-      , "om"."scopes" AS "legacyScopes"
-      , "om"."connected_to_zendesk" AS "connectedToZendesk"
-    FROM
-      "organization_member" AS "om"
-    WHERE
-      "om"."organization_id" = ${organizationId}
-      ${userIds ? sql`AND "om"."user_id" = ANY(${sql.array(userIds, 'uuid')})` : sql``}
-  `;
+      SELECT
+        "om"."user_id" AS "userId"
+        , "om"."role_id" AS "legacyRoleId"
+        , "om"."scopes" AS "legacyScopes"
+        , "om"."connected_to_zendesk" AS "connectedToZendesk"
+      FROM
+        "organization_member" AS "om"
+      WHERE
+        "om"."organization_id" = ${organizationId}
+        ${userIds ? sql`AND "om"."user_id" = ANY(${sql.array(userIds, 'uuid')})` : sql``}
+    `;
 
     const result = await this.pool.any<unknown>(query);
     return result.map(row => RawOrganizationMembershipModel.parse(row));
@@ -212,33 +212,46 @@ export class OrganizationMembers {
     },
   );
 
-  findOrganizationOwner(organization: Organization) {
+  findOrganizationOwner(organization: Organization): Promise<OrganizationMembership | null> {
     return this.findOrganizationMembership({
       organization,
       userId: organization.ownerId,
     });
   }
 
-  /**
-   * Find the organization members that have no role assigned and use the legacy scopes.
-   */
-  async findOrganizationMembersWithoutAssignedRole(organization: Organization) {
+  async findOrganizationMembershipByEmail(
+    organization: Organization,
+    email: string,
+  ): Promise<OrganizationMembership | null> {
+    this.logger.debug(
+      'Find organization membership by email. (organizationId=%s, email=%s)',
+      organization.id,
+      email,
+    );
     const query = sql`
       SELECT
         "om"."user_id" AS "userId"
         , "om"."role_id" AS "legacyRoleId"
+        , "om"."scopes" AS "legacyScopes"
         , "om"."connected_to_zendesk" AS "connectedToZendesk"
       FROM
         "organization_member" AS "om"
+        INNER JOIN "users" AS "u"
+          ON "u"."id" = "om"."user_id"
       WHERE
         "om"."organization_id" = ${organization.id}
-        AND "om"."role_id" IS NULL
+        AND lower("u"."email") = lower(${email})
+      LIMIT 1
     `;
 
-    const records = await this.pool.any<unknown>(query);
-    const organizationMembers = records.map(row => RawOrganizationMembershipModel.parse(row));
-    const mapping = await this.resolveMemberships(organization, organizationMembers);
-    return Array.from(mapping.values());
+    const result = await this.pool.maybeOne<unknown>(query);
+    if (result === null) {
+      return null;
+    }
+
+    const membership = RawOrganizationMembershipModel.parse(result);
+    const mapping = await this.resolveMemberships(organization, [membership]);
+    return mapping.get(membership.userId) ?? null;
   }
 }
 
diff --git a/packages/services/api/src/modules/organization/resolvers/Member.ts b/packages/services/api/src/modules/organization/resolvers/Member.ts
index fad2a3ba14..eb3ca4b828 100644
--- a/packages/services/api/src/modules/organization/resolvers/Member.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Member.ts
@@ -4,10 +4,7 @@ import type { MemberResolvers } from './../../../__generated__/types';
 
 export const Member: MemberResolvers = {
   canLeaveOrganization: async (member, _, { injector }) => {
-    const { result } = await injector.get(OrganizationManager).canLeaveOrganization({
-      organizationId: member.organizationId,
-      userId: member.userId,
-    });
+    const { result } = await injector.get(OrganizationManager).canLeaveOrganization(member);
 
     return result;
   },

From 7e278a55c1c3791f7102f1e56bfc688f9d5e0d14 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 11:52:33 +0100
Subject: [PATCH 16/55] fix: permission dependencies and decoding

---
 .../lib/organization-member-permissions.ts    |  4 +-
 .../providers/organization-manager.ts         |  8 ++++
 .../providers/organization-member-roles.ts    | 46 ++++++++-----------
 .../providers/organization-members.ts         |  6 +--
 4 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index f564b68b6d..f808e5d9a1 100644
--- a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -66,7 +66,7 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         id: 'member:modifyRole',
         title: 'Modify member role',
         description: 'Member can modify, create and delete roles.',
-        dependsOn: 'member:describe',
+        dependsOn: 'member:assignRole',
       },
       {
         id: 'member:removeMember',
@@ -78,7 +78,7 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         id: 'member:manageInvites',
         title: 'Manage invites',
         description: 'Member can invite users via email and modify or delete pending invites.',
-        dependsOn: 'member:describe',
+        dependsOn: 'member:assignRole',
       },
     ],
   },
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 7c0ef3e438..b9ec962361 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -949,6 +949,14 @@ export class OrganizationManager {
       };
     }
 
+    if (role.membersCount > 0) {
+      return {
+        error: {
+          message: `Cannot delete a role with members`,
+        },
+      };
+    }
+
     // delete the role
     await this.storage.deleteOrganizationMemberRole({
       organizationId: input.organizationId,
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index 589fb2e2d4..fc5cfae60a 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -24,31 +24,22 @@ function omit<T extends object, K extends keyof T>(obj: T, key: K): Omit<T, K> {
 }
 
 const MemberRoleModel = z
-  .intersection(
-    z.object({
-      id: z.string(),
-      name: z.string(),
-      description: z.string(),
-      isLocked: z.boolean(),
-      organizationId: z.string(),
-      membersCount: z.number(),
-    }),
-    z.union([
-      z.object({
-        legacyScopes: z
-          .array(z.string())
-          .transform(
-            value =>
-              value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
-          ),
-        permissions: z.null(),
-      }),
-      z.object({
-        legacyScopes: z.null(),
-        permissions: z.array(PermissionsModel),
-      }),
-    ]),
-  )
+  .object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string(),
+    isLocked: z.boolean(),
+    organizationId: z.string(),
+    membersCount: z.number(),
+    legacyScopes: z
+      .array(z.string())
+      .nullable()
+      .transform(
+        value =>
+          value as Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope> | null,
+      ),
+    permissions: z.array(PermissionsModel).nullable(),
+  })
   .transform(record => {
     let permissions: PermissionsPerResourceLevelAssignment;
 
@@ -63,7 +54,9 @@ const MemberRoleModel = z
         ...record.permissions,
       ]);
     } else {
-      permissions = transformOrganizationMemberLegacyScopesIntoPermissionGroup(record.legacyScopes);
+      permissions = transformOrganizationMemberLegacyScopesIntoPermissionGroup(
+        record.legacyScopes ?? [],
+      );
     }
 
     return {
@@ -332,6 +325,7 @@ const predefinedRolesPermissions = {
    * Permissions the default admin role is assigned with (aka full access)
    **/
   admin: permissionsToPermissionsPerResourceLevelAssignment([
+    ...OrganizationMemberPermissions.permissions.default,
     ...OrganizationMemberPermissions.permissions.assignable,
   ]),
   /**
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 3fb5c07fd3..b1caac5dad 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -99,8 +99,7 @@ export class OrganizationMembers {
     const query = sql`
       SELECT
         "om"."user_id" AS "userId"
-        , "om"."role_id" AS "legacyRoleId"
-        , "om"."scopes" AS "legacyScopes"
+        , "om"."role_id" AS "roleId"
         , "om"."connected_to_zendesk" AS "connectedToZendesk"
       FROM
         "organization_member" AS "om"
@@ -231,8 +230,7 @@ export class OrganizationMembers {
     const query = sql`
       SELECT
         "om"."user_id" AS "userId"
-        , "om"."role_id" AS "legacyRoleId"
-        , "om"."scopes" AS "legacyScopes"
+        , "om"."role_id" AS "roleId"
         , "om"."connected_to_zendesk" AS "connectedToZendesk"
       FROM
         "organization_member" AS "om"

From 973224f287ccfba2a8f2d5c3a4d4d0b0d14d5e05 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 11:52:48 +0100
Subject: [PATCH 17/55] integration tests

---
 codegen.mts                                   |  24 +-
 integration-tests/testkit/seed.ts             |  20 +-
 .../tests/api/organization/members.spec.ts    | 345 +++---------------
 .../tests/api/organization/transfer.spec.ts   |  21 +-
 4 files changed, 81 insertions(+), 329 deletions(-)

diff --git a/codegen.mts b/codegen.mts
index 0f0e796ed4..ae23bb9ff7 100644
--- a/codegen.mts
+++ b/codegen.mts
@@ -102,18 +102,18 @@ const config: CodegenConfig = {
       plugins: ['typescript', 'typescript-operations'],
     },
     // Integration tests
-    // './integration-tests/testkit/gql/': {
-    //   documents: ['./integration-tests/(testkit|tests)/**/*.ts'],
-    //   preset: 'client',
-    //   plugins: [],
-    //   config: {
-    //     scalars: {
-    //       DateTime: 'string',
-    //       Date: 'string',
-    //       SafeInt: 'number',
-    //     },
-    //   },
-    // },
+    './integration-tests/testkit/gql/': {
+      documents: ['./integration-tests/(testkit|tests)/**/*.ts'],
+      preset: 'client',
+      plugins: [],
+      config: {
+        scalars: {
+          DateTime: 'string',
+          Date: 'string',
+          SafeInt: 'number',
+        },
+      },
+    },
   },
 };
 
diff --git a/integration-tests/testkit/seed.ts b/integration-tests/testkit/seed.ts
index 34f306e94d..131b5b999a 100644
--- a/integration-tests/testkit/seed.ts
+++ b/integration-tests/testkit/seed.ts
@@ -847,11 +847,7 @@ export function initSeed() {
                   return memberRoleDeletionResult.deleteMemberRole.ok?.updatedOrganization;
                 },
                 async createMemberRole(
-                  scopes: {
-                    organization: OrganizationAccessScope[];
-                    project: ProjectAccessScope[];
-                    target: TargetAccessScope[];
-                  },
+                  permissions: Array<string>,
                   options: { useMemberToken?: boolean } = {
                     useMemberToken: false,
                   },
@@ -867,9 +863,7 @@ export function initSeed() {
                       organizationSlug: organization.slug,
                       name,
                       description: 'some description',
-                      organizationAccessScopes: scopes.organization,
-                      projectAccessScopes: scopes.project,
-                      targetAccessScopes: scopes.target,
+                      selectedPermissions: permissions,
                     },
                     options.useMemberToken ? memberToken : ownerToken,
                   ).then(r => r.expectNoGraphQLErrors());
@@ -908,11 +902,7 @@ export function initSeed() {
                     name: string;
                     description: string;
                   },
-                  scopes: {
-                    organization: OrganizationAccessScope[];
-                    project: ProjectAccessScope[];
-                    target: TargetAccessScope[];
-                  },
+                  permissions: Array<string>,
                   options: { useMemberToken?: boolean } = {
                     useMemberToken: false,
                   },
@@ -923,9 +913,7 @@ export function initSeed() {
                       roleId: role.id,
                       name: role.name,
                       description: role.description,
-                      organizationAccessScopes: scopes.organization,
-                      projectAccessScopes: scopes.project,
-                      targetAccessScopes: scopes.target,
+                      selectedPermissions: permissions,
                     },
                     options.useMemberToken ? memberToken : ownerToken,
                   ).then(r => r.expectNoGraphQLErrors());
diff --git a/integration-tests/tests/api/organization/members.spec.ts b/integration-tests/tests/api/organization/members.spec.ts
index 6b0f3ced84..21a15c3710 100644
--- a/integration-tests/tests/api/organization/members.spec.ts
+++ b/integration-tests/tests/api/organization/members.spec.ts
@@ -1,8 +1,3 @@
-import {
-  OrganizationAccessScope,
-  ProjectAccessScope,
-  TargetAccessScope,
-} from 'testkit/gql/graphql';
 import { history } from '../../../testkit/emails';
 import { initSeed } from '../../../testkit/seed';
 
@@ -10,17 +5,42 @@ test.concurrent('owner of an organization should have all scopes', async ({ expe
   const { createOrg } = await initSeed().createOwner();
   const { organization } = await createOrg();
 
-  Object.values(OrganizationAccessScope).forEach(scope => {
-    expect(organization.owner.organizationAccessScopes).toContain(scope);
-  });
-
-  Object.values(ProjectAccessScope).forEach(scope => {
-    expect(organization.owner.projectAccessScopes).toContain(scope);
-  });
-
-  Object.values(TargetAccessScope).forEach(scope => {
-    expect(organization.owner.targetAccessScopes).toContain(scope);
-  });
+  expect(organization.owner.role.permissions).toMatchInlineSnapshot(`
+    [
+      organization:describe,
+      support:manageTickets,
+      organization:modifySlug,
+      auditLog:export,
+      organization:delete,
+      member:describe,
+      member:assignRole,
+      member:modifyRole,
+      member:removeMember,
+      member:manageInvites,
+      billing:describe,
+      billing:update,
+      oidc:modify,
+      gitHubIntegration:modify,
+      slackIntegration:modify,
+      project:create,
+      schemaLinting:modifyOrganizationRules,
+      project:describe,
+      project:delete,
+      project:modifySettings,
+      schemaLinting:modifyProjectRules,
+      target:create,
+      alert:modify,
+      target:delete,
+      target:modifySettings,
+      targetAccessToken:modify,
+      cdnAccessToken:modify,
+      laboratory:describe,
+      laboratory:modify,
+      laboratory:modifyPreflightScript,
+      appDeployment:describe,
+      schemaCheck:approve,
+    ]
+  `);
 });
 
 test.concurrent('invited member should have basic scopes (Viewer role)', async ({ expect }) => {
@@ -28,230 +48,35 @@ test.concurrent('invited member should have basic scopes (Viewer role)', async (
   const { inviteAndJoinMember } = await createOrg();
   const { member } = await inviteAndJoinMember();
 
-  // Should have only organization:read access
-  expect(member.organizationAccessScopes).toContainEqual(OrganizationAccessScope.Read);
-  // Nothing more
-  expect(member.organizationAccessScopes).toHaveLength(1);
-  // Should have only project:read and project:operations-store:read access
-  expect(member.projectAccessScopes).toContainEqual(ProjectAccessScope.Read);
-  expect(member.projectAccessScopes).toContainEqual(ProjectAccessScope.OperationsStoreRead);
-  // Nothing more
-  expect(member.projectAccessScopes).toHaveLength(2);
-  // Should have only target:read and target:registry:read access
-  expect(member.targetAccessScopes).toContainEqual(TargetAccessScope.Read);
-  expect(member.targetAccessScopes).toContainEqual(TargetAccessScope.RegistryRead);
-  // Nothing more
-  expect(member.targetAccessScopes).toHaveLength(2);
+  expect(member.role.permissions).toMatchInlineSnapshot(`
+    [
+      organization:describe,
+      support:manageTickets,
+      project:create,
+      project:describe,
+      target:create,
+      appDeployment:describe,
+      laboratory:describe,
+    ]
+  `);
 });
 
 test.concurrent(
-  'cannot create a role with an access scope that user has no access to',
-  async ({ expect }) => {
-    const { createOrg } = await initSeed().createOwner();
-    const { inviteAndJoinMember, organization } = await createOrg();
-    const { createMemberRole, assignMemberRole, member } = await inviteAndJoinMember();
-
-    // Create a role with organization:members access, so we could perform the test.
-    // To create a role, user must have access to organization:members first.
-    const membersManagerRole = await createMemberRole({
-      organization: [OrganizationAccessScope.Members],
-      project: [],
-      target: [],
-    });
-    await assignMemberRole({
-      roleId: membersManagerRole.id,
-      userId: member.user.id,
-    });
-
-    await expect(
-      createMemberRole(
-        {
-          organization: [OrganizationAccessScope.Settings], // <-- this scope is not part of the membersManagerRole, so it should fail
-          project: [],
-          target: [],
-        },
-        {
-          useMemberToken: true,
-        },
-      ),
-    ).rejects.toThrowError('Missing access');
-  },
-);
-
-test.concurrent(
-  'cannot grant an access scope to another user if user has no access to that scope',
-  async ({ expect }) => {
-    const { createOrg } = await initSeed().createOwner();
-    const { inviteAndJoinMember, organization } = await createOrg();
-    const { createMemberRole, assignMemberRole, member } = await inviteAndJoinMember();
-    const { member: viewerRoleMember } = await inviteAndJoinMember();
-
-    // Create a role with organization:members access, so we could perform the test.
-    // To create a role, user must have access to organization:members first.
-    const membersManagerRole = await createMemberRole({
-      organization: [OrganizationAccessScope.Members],
-      project: [],
-      target: [],
-    });
-    await assignMemberRole({
-      roleId: membersManagerRole.id,
-      userId: member.user.id,
-    });
-
-    const adminRoleId = organization.memberRoles?.find(r => r.name === 'Admin')?.id;
-
-    if (!adminRoleId) {
-      throw new Error('Admin role not found');
-    }
-
-    await expect(
-      assignMemberRole(
-        {
-          roleId: adminRoleId,
-          userId: viewerRoleMember.user.id,
-        },
-        {
-          useMemberToken: true,
-        },
-      ),
-    ).rejects.toThrowError('Missing access');
-  },
-);
-
-test.concurrent(
-  'granting no scopes is equal to setting read-only for org, project and target',
+  'granting no permissions is equal to setting read-only access for the organization',
   async ({ expect }) => {
     const { createOrg } = await initSeed().createOwner();
     const { inviteAndJoinMember } = await createOrg();
     const { createMemberRole } = await inviteAndJoinMember();
 
-    const readOnlyRole = await createMemberRole({
-      organization: [],
-      project: [],
-      target: [],
-    });
-    expect(readOnlyRole?.organizationAccessScopes).toHaveLength(1);
-    expect(readOnlyRole?.organizationAccessScopes).toContainEqual(OrganizationAccessScope.Read);
-    expect(readOnlyRole?.projectAccessScopes).toHaveLength(1);
-    expect(readOnlyRole?.projectAccessScopes).toContainEqual(ProjectAccessScope.Read);
-    expect(readOnlyRole?.targetAccessScopes).toHaveLength(1);
-    expect(readOnlyRole?.targetAccessScopes).toContainEqual(TargetAccessScope.Read);
+    const readOnlyRole = await createMemberRole([]);
+    expect(readOnlyRole.permissions).toMatchInlineSnapshot(`
+      [
+        organization:describe,
+      ]
+    `);
   },
 );
 
-test.concurrent('cannot downgrade a member when assigning a new role', async ({ expect }) => {
-  const { createOrg } = await initSeed().createOwner();
-  const { inviteAndJoinMember } = await createOrg();
-  const { createMemberRole, assignMemberRole, member } = await inviteAndJoinMember();
-  const { member: viewerRoleMember } = await inviteAndJoinMember();
-
-  const managerRole = await createMemberRole({
-    organization: [OrganizationAccessScope.Members],
-    project: [ProjectAccessScope.Settings],
-    target: [
-      TargetAccessScope.RegistryRead,
-      TargetAccessScope.RegistryWrite,
-      TargetAccessScope.Settings,
-    ],
-  });
-  const originalRole = await createMemberRole({
-    organization: [],
-    project: [],
-    target: [
-      TargetAccessScope.RegistryRead,
-      TargetAccessScope.RegistryWrite,
-      TargetAccessScope.Settings,
-    ],
-  });
-  const roleWithLessAccess = await createMemberRole({
-    organization: [],
-    project: [],
-    target: [TargetAccessScope.RegistryRead, TargetAccessScope.RegistryWrite],
-  });
-  await assignMemberRole({
-    roleId: managerRole.id,
-    userId: member.user.id,
-  });
-  await assignMemberRole({
-    roleId: originalRole.id,
-    userId: viewerRoleMember.user.id,
-  });
-
-  // non-admin member cannot downgrade another member
-  await expect(
-    assignMemberRole(
-      {
-        roleId: roleWithLessAccess.id,
-        userId: viewerRoleMember.user.id,
-      },
-      {
-        useMemberToken: true,
-      },
-    ),
-  ).rejects.toThrowError('Cannot downgrade member');
-  // admin can downgrade another member
-  await assignMemberRole({
-    roleId: roleWithLessAccess.id,
-    userId: viewerRoleMember.user.id,
-  });
-});
-
-test.concurrent('cannot downgrade a member when modifying a role', async ({ expect }) => {
-  const { createOrg } = await initSeed().createOwner();
-  const { inviteAndJoinMember } = await createOrg();
-  const { createMemberRole, assignMemberRole, member, updateMemberRole } =
-    await inviteAndJoinMember();
-  const { member: viewerRoleMember } = await inviteAndJoinMember();
-
-  const managerRole = await createMemberRole({
-    organization: [OrganizationAccessScope.Members],
-    project: [ProjectAccessScope.Settings],
-    target: [
-      TargetAccessScope.RegistryRead,
-      TargetAccessScope.RegistryWrite,
-      TargetAccessScope.Settings,
-    ],
-  });
-  const roleToBeUpdated = await createMemberRole({
-    organization: [],
-    project: [],
-    target: [
-      TargetAccessScope.RegistryRead,
-      TargetAccessScope.RegistryWrite,
-      TargetAccessScope.Settings,
-    ],
-  });
-  await assignMemberRole({
-    roleId: managerRole.id,
-    userId: member.user.id,
-  });
-  await assignMemberRole({
-    roleId: roleToBeUpdated.id,
-    userId: viewerRoleMember.user.id,
-  });
-
-  // non-admin member cannot downgrade another member
-  await expect(
-    updateMemberRole(
-      roleToBeUpdated,
-      {
-        organization: [],
-        project: [],
-        target: [TargetAccessScope.RegistryRead, TargetAccessScope.RegistryWrite], // <-- downgrade (missing: TargetAccessScope.Settings)
-      },
-      {
-        useMemberToken: true,
-      },
-    ),
-  ).rejects.toThrowError('Cannot downgrade member');
-  // admin can downgrade another member
-  await updateMemberRole(roleToBeUpdated, {
-    organization: [],
-    project: [],
-    target: [TargetAccessScope.RegistryRead, TargetAccessScope.RegistryWrite], // <-- downgrade (missing: TargetAccessScope.Settings)
-  });
-});
-
 test.concurrent('cannot delete a role with members', async ({ expect }) => {
   const { createOrg } = await initSeed().createOwner();
   const { inviteAndJoinMember } = await createOrg();
@@ -259,16 +84,8 @@ test.concurrent('cannot delete a role with members', async ({ expect }) => {
     await inviteAndJoinMember();
   const { member: viewerRoleMember } = await inviteAndJoinMember();
 
-  const membersManagerRole = await createMemberRole({
-    organization: [OrganizationAccessScope.Members],
-    project: [],
-    target: [],
-  });
-  const readOnlyRole = await createMemberRole({
-    organization: [],
-    project: [],
-    target: [],
-  });
+  const membersManagerRole = await createMemberRole([]);
+  const readOnlyRole = await createMemberRole([]);
   await assignMemberRole({
     roleId: membersManagerRole.id,
     userId: member.user.id,
@@ -282,56 +99,6 @@ test.concurrent('cannot delete a role with members', async ({ expect }) => {
   await expect(deleteMemberRole(readOnlyRole.id)).rejects.toThrowError(
     'Cannot delete a role with members',
   );
-  // delete the role as a member with enough access to delete the role
-  await expect(
-    deleteMemberRole(readOnlyRole.id, {
-      useMemberToken: true,
-    }),
-  ).rejects.toThrowError('Cannot delete a role with members');
-});
-
-test.concurrent('cannot invite a member with more access than the inviter', async ({ expect }) => {
-  const seed = initSeed();
-  const { createOrg } = await seed.createOwner();
-  const { inviteMember, inviteAndJoinMember, organization } = await createOrg();
-  const {
-    member: invitingMember,
-    memberToken: invitingMemberToken,
-    createMemberRole,
-    assignMemberRole,
-  } = await inviteAndJoinMember();
-
-  const adminRoleId = organization.memberRoles?.find(r => r.name === 'Admin')?.id;
-  if (!adminRoleId) {
-    throw new Error('Admin role not found');
-  }
-
-  const membersManagerRole = await createMemberRole({
-    organization: [OrganizationAccessScope.Members],
-    project: [],
-    target: [],
-  });
-  const readOnlyRole = await createMemberRole({
-    organization: [],
-    project: [],
-    target: [],
-  });
-
-  // give the inviting member a role with enough access to invite other members
-  await assignMemberRole({
-    roleId: membersManagerRole.id,
-    userId: invitingMember.user.id,
-  });
-
-  const inviteEmail = seed.generateEmail();
-  const failedInvitationResult = await inviteMember(inviteEmail, invitingMemberToken, adminRoleId);
-  expect(failedInvitationResult.error?.message).toEqual(
-    expect.stringContaining('Not enough access to invite a member'),
-  );
-
-  const invitationResult = await inviteMember(inviteEmail, invitingMemberToken, readOnlyRole.id);
-  const inviteCode = invitationResult.ok?.code;
-  expect(inviteCode).toBeDefined();
 });
 
 test.concurrent('email invitation', async ({ expect }) => {
diff --git a/integration-tests/tests/api/organization/transfer.spec.ts b/integration-tests/tests/api/organization/transfer.spec.ts
index fa65c65478..d399afcd88 100644
--- a/integration-tests/tests/api/organization/transfer.spec.ts
+++ b/integration-tests/tests/api/organization/transfer.spec.ts
@@ -342,20 +342,18 @@ test.concurrent(
 
     // current owner
     const owner = orgMembers.find(m => m.user.email === ownerEmail)!;
-    expect(orgMembers.find(m => m.id === owner.id)).toEqual(
+    expect(orgMembers.find(m => m.id === owner.id)?.role).toEqual(
       expect.objectContaining({
-        organizationAccessScopes: owner.organizationAccessScopes,
-        projectAccessScopes: owner.projectAccessScopes,
-        targetAccessScopes: owner.targetAccessScopes,
+        id: owner.role.id,
+        permissions: owner.role.permissions,
       }),
     );
 
     // potential new owner
-    expect(orgMembers.find(m => m.id === member.id)).toEqual(
+    expect(orgMembers.find(m => m.id === member.id)?.role).toEqual(
       expect.objectContaining({
-        organizationAccessScopes: member.organizationAccessScopes,
-        projectAccessScopes: member.projectAccessScopes,
-        targetAccessScopes: member.targetAccessScopes,
+        id: member.role.id,
+        permissions: member.role.permissions,
       }),
     );
   },
@@ -407,11 +405,10 @@ test.concurrent(
     expect(previousOwner.role?.name).toBe('Admin');
 
     // other members should not be affected
-    expect(orgMembers.find(m => m.id === lonelyMember.id)).toEqual(
+    expect(orgMembers.find(m => m.id === lonelyMember.id)?.role).toEqual(
       expect.objectContaining({
-        organizationAccessScopes: lonelyMember.organizationAccessScopes,
-        projectAccessScopes: lonelyMember.projectAccessScopes,
-        targetAccessScopes: lonelyMember.targetAccessScopes,
+        id: lonelyMember.role.id,
+        permissions: lonelyMember.role.permissions,
       }),
     );
   },

From 76a3fdf5edea34895140e2a770b770fd181b1ab8 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 12:30:27 +0100
Subject: [PATCH 18/55] remove member assignment permissions

---
 .../providers/organization-member-roles.ts            | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index fc5cfae60a..a0afe5c2e1 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -215,7 +215,7 @@ export class OrganizationMemberRoles {
   }
 }
 
-export function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
+function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
   scopes: Array<OrganizationAccessScope | ProjectAccessScope | TargetAccessScope>,
 ): z.TypeOf<typeof PermissionsPerResourceLevelAssignmentModel> {
   const permissions = new Set<Permission>();
@@ -246,10 +246,11 @@ export function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
         break;
       }
       case OrganizationAccessScope.MEMBERS: {
-        permissions.add('member:manageInvites');
-        permissions.add('member:removeMember');
-        permissions.add('member:assignRole');
-        permissions.add('member:modifyRole');
+        // TODO: decide wether these should be translated
+        // permissions.add('member:manageInvites');
+        // permissions.add('member:removeMember');
+        // permissions.add('member:assignRole');
+        // permissions.add('member:modifyRole');
         permissions.add('member:describe');
         break;
       }

From 4deca5dc695f09d3fd54e8a6a1567269374a9bc3 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 13:52:53 +0100
Subject: [PATCH 19/55] clarify permissions

---
 .../providers/organization-member-roles.ts           | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index a0afe5c2e1..e98ea4c338 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -246,11 +246,13 @@ function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
         break;
       }
       case OrganizationAccessScope.MEMBERS: {
-        // TODO: decide wether these should be translated
-        // permissions.add('member:manageInvites');
-        // permissions.add('member:removeMember');
-        // permissions.add('member:assignRole');
-        // permissions.add('member:modifyRole');
+        // Note: We do not assign the following permissions:
+        // - 'member:manageInvites'
+        // - 'member:removeMember'
+        // - 'member:assignRole'
+        // - 'member:modifyRole'
+        // The reason for this is that we changed the behavior of checking the permissions for
+        // the logic and it is not safe to translate them to the new permission layer.
         permissions.add('member:describe');
         break;
       }

From 0586df7441fdc848dbe6393fa0e0abe27c35f114 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 14:04:46 +0100
Subject: [PATCH 20/55] add warning for permissions

---
 .../api/src/modules/auth/module.graphql.ts    |  1 +
 .../src/modules/auth/resolvers/Permission.ts  |  3 +
 .../lib/organization-member-permissions.ts    |  9 ++
 .../components/organization/members/list.tsx  |  6 +-
 .../members/permission-selector.tsx           |  3 +-
 .../components/organization/members/roles.tsx | 98 +++++++++++++++----
 .../stories/permission-selector.stories.tsx   |  1 +
 7 files changed, 94 insertions(+), 27 deletions(-)

diff --git a/packages/services/api/src/modules/auth/module.graphql.ts b/packages/services/api/src/modules/auth/module.graphql.ts
index e6f069e5aa..7efb608798 100644
--- a/packages/services/api/src/modules/auth/module.graphql.ts
+++ b/packages/services/api/src/modules/auth/module.graphql.ts
@@ -112,6 +112,7 @@ export default gql`
     level: PermissionLevel!
     dependsOnId: ID
     isReadOnly: Boolean!
+    warning: String
   }
 
   type PermissionGroup {
diff --git a/packages/services/api/src/modules/auth/resolvers/Permission.ts b/packages/services/api/src/modules/auth/resolvers/Permission.ts
index ebad4c0c39..c20386cf17 100644
--- a/packages/services/api/src/modules/auth/resolvers/Permission.ts
+++ b/packages/services/api/src/modules/auth/resolvers/Permission.ts
@@ -20,4 +20,7 @@ export const Permission: PermissionResolvers = {
   level: async (permission, _arg, _ctx) => {
     return getPermissionGroup(permission.id);
   },
+  warning: async (permission, _arg, _ctx) => {
+    return permission.warning ?? null;
+  },
 };
diff --git a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index f808e5d9a1..c45e9ee6c5 100644
--- a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -6,6 +6,7 @@ export type PermissionRecord = {
   description: string;
   dependsOn?: Permission;
   isReadyOnly?: true;
+  warning?: string;
 };
 
 export type PermissionGroup = {
@@ -61,24 +62,32 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         title: 'Assign member role',
         description: 'Member can assign roles to users.',
         dependsOn: 'member:describe',
+        warning:
+          'Granting a role the ability to assign roles enables it to elevate its own permissions.',
       },
       {
         id: 'member:modifyRole',
         title: 'Modify member role',
         description: 'Member can modify, create and delete roles.',
         dependsOn: 'member:assignRole',
+        warning:
+          'Granting a role the ability to modify roles enables it to elevate its own permissions.',
       },
       {
         id: 'member:removeMember',
         title: 'Remove member',
         description: 'Member can remove users from the organization.',
         dependsOn: 'member:describe',
+        warning:
+          'Granting a role the ability to remove members enables it to remove any member form the organization, except the owner.',
       },
       {
         id: 'member:manageInvites',
         title: 'Manage invites',
         description: 'Member can invite users via email and modify or delete pending invites.',
         dependsOn: 'member:assignRole',
+        warning:
+          'Granting a role the ability to manage invites enables it to elevate its own permissions.',
       },
     ],
   },
diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index e7d3f17e03..54eaa96309 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -95,7 +95,6 @@ function OrganizationMemberRoleSwitcher(props: {
     props.organization,
   );
   const member = useFragment(OrganizationMemberRoleSwitcher_MemberFragment, props.member);
-  // A user can't change its own role
   const canAssignRole = organization.viewerCanAssignUserRoles;
   const roles = organization.memberRoles ?? [];
   const { toast } = useToast();
@@ -163,7 +162,7 @@ function OrganizationMemberRoleSwitcher(props: {
           }
 
           return {
-            active: false,
+            active: true,
           };
         }}
       />
@@ -367,9 +366,6 @@ const OrganizationMembers_OrganizationFragment = graphql(`
     owner {
       id
     }
-    me {
-      id
-    }
     members {
       nodes {
         id
diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index 959a9112f1..8a7aed102c 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -44,6 +44,7 @@ type AvailableMembershipPermissions = ResultOf<
 type MembershipPermissionGroup = AvailableMembershipPermissions[number];
 
 export type PermissionSelectorProps = {
+  isReadOnly?: boolean;
   organization: FragmentType<typeof PermissionSelector_OrganizationFragment>;
   selectedPermissionIds: ReadonlySet<string>;
   onSelectedPermissionsChange: (selectedPermissionIds: ReadonlySet<string>) => void;
@@ -182,7 +183,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                         </div>
                       )}
                     <Select
-                      disabled={permission.isReadOnly || needsDependency}
+                      disabled={props.isReadOnly || permission.isReadOnly || needsDependency}
                       value={
                         permission.isReadOnly || props.selectedPermissionIds.has(permission.id)
                           ? 'allow'
diff --git a/packages/web/app/src/components/organization/members/roles.tsx b/packages/web/app/src/components/organization/members/roles.tsx
index b3a17c21c3..6bb47bac8f 100644
--- a/packages/web/app/src/components/organization/members/roles.tsx
+++ b/packages/web/app/src/components/organization/members/roles.tsx
@@ -104,7 +104,6 @@ const OrganizationMemberRoleEditor_OrganizationFragment = graphql(`
 `);
 
 function OrganizationMemberRoleEditor(props: {
-  mode?: 'edit' | 'read-only';
   close(): void;
   role: FragmentType<typeof OrganizationMemberRoleRow_MemberRoleFragment>;
   organization: FragmentType<typeof OrganizationMemberRoleEditor_OrganizationFragment>;
@@ -118,7 +117,7 @@ function OrganizationMemberRoleEditor(props: {
     OrganizationMemberRoleEditor_UpdateMemberRoleMutation,
   );
   const { toast } = useToast();
-  const isDisabled = props.mode === 'read-only' || updateMemberRoleState.fetching;
+  const isDisabled = updateMemberRoleState.fetching;
   const form = useForm<RoleFormValues>({
     resolver: zodResolver(roleFormSchema),
     mode: 'onChange',
@@ -195,7 +194,7 @@ function OrganizationMemberRoleEditor(props: {
       <form onSubmit={form.handleSubmit(onSubmit)}>
         <DialogContent className="max-w-[960px]">
           <DialogHeader>
-            <DialogTitle>Member Role{props.mode === 'read-only' ? '' : ' Editor'}</DialogTitle>
+            <DialogTitle>Member Role Editor</DialogTitle>
             <DialogDescription>Adjust the permissions of this role.</DialogDescription>
           </DialogHeader>
           <div className="flex flex-row space-x-6">
@@ -240,28 +239,85 @@ function OrganizationMemberRoleEditor(props: {
               </div>
             </div>
           </div>
-          {props.mode === 'read-only' ? null : (
-            <DialogFooter>
-              <Button variant="ghost" onClick={props.close}>
-                Cancel
-              </Button>
-              <Button
-                type="submit"
-                onClick={form.handleSubmit(onSubmit)}
-                disabled={
-                  !form.formState.isValid || form.formState.isSubmitting || form.formState.disabled
-                }
-              >
-                {form.formState.isSubmitting ? 'Creating...' : 'Confirm selection'}
-              </Button>
-            </DialogFooter>
-          )}
+          <DialogFooter>
+            <Button variant="ghost" onClick={props.close}>
+              Cancel
+            </Button>
+            <Button
+              type="submit"
+              onClick={form.handleSubmit(onSubmit)}
+              disabled={
+                !form.formState.isValid || form.formState.isSubmitting || form.formState.disabled
+              }
+            >
+              {form.formState.isSubmitting ? 'Creating...' : 'Confirm selection'}
+            </Button>
+          </DialogFooter>
         </DialogContent>
       </form>
     </Form>
   );
 }
 
+const OrganizationMemberRoleView_OrganizationFragment = graphql(`
+  fragment OrganizationMemberRoleView_OrganizationFragment on Organization {
+    id
+    ...SelectedPermissionOverview_OrganizationFragment
+  }
+`);
+
+function OrganizationMemberRoleView(props: {
+  role: FragmentType<typeof OrganizationMemberRoleRow_MemberRoleFragment>;
+  organization: FragmentType<typeof OrganizationMemberRoleView_OrganizationFragment>;
+  close: VoidFunction;
+}) {
+  const role = useFragment(OrganizationMemberRoleRow_MemberRoleFragment, props.role);
+  const organization = useFragment(
+    OrganizationMemberRoleView_OrganizationFragment,
+    props.organization,
+  );
+
+  const [showOnlyGrantedPermissions, setShowOnlyGrantedPermissions] = useState(true);
+
+  return (
+    <DialogContent className="max-w-[960px]">
+      <DialogHeader>
+        <DialogTitle>Member Role: {role.name}</DialogTitle>
+        <DialogDescription>{role.description}</DialogDescription>
+      </DialogHeader>
+      <div className="grow">
+        <div className="flex h-[400px] flex-col space-y-2">
+          <div className="overflow-scroll">
+            <SelectedPermissionOverview
+              showOnlyAllowedPermissions={showOnlyGrantedPermissions}
+              activePermissionIds={role.permissions}
+              organization={organization}
+            />
+          </div>
+        </div>
+      </div>
+      <DialogFooter>
+        <div className="mr-2 flex items-center space-x-2">
+          <Checkbox
+            id="show-only-granted-permissions"
+            checked={showOnlyGrantedPermissions}
+            onCheckedChange={value => setShowOnlyGrantedPermissions(!!value)}
+          />
+          <label
+            htmlFor="show-only-granted-permissions"
+            className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+          >
+            Show only granted permissions
+          </label>
+        </div>
+        <Button variant="ghost" onClick={props.close}>
+          Close
+        </Button>
+      </DialogFooter>
+    </DialogContent>
+  );
+}
+
 const OrganizationMemberRoleCreator_CreateMemberRoleMutation = graphql(`
   mutation OrganizationMemberRoleCreator_CreateMemberRoleMutation($input: CreateMemberRoleInput!) {
     createMemberRole(input: $input) {
@@ -721,6 +777,7 @@ const OrganizationMemberRoles_OrganizationFragment = graphql(`
     }
     ...OrganizationMemberRoleCreator_OrganizationFragment
     ...OrganizationMemberRoleEditor_OrganizationFragment
+    ...OrganizationMemberRoleView_OrganizationFragment
   }
 `);
 
@@ -767,8 +824,7 @@ export function OrganizationMemberRoles(props: {
         }}
       >
         {roleToShow ? (
-          <OrganizationMemberRoleEditor
-            mode="read-only"
+          <OrganizationMemberRoleView
             organization={organization}
             role={roleToShow}
             close={() => setRoleToShow(null)}
diff --git a/packages/web/app/src/stories/permission-selector.stories.tsx b/packages/web/app/src/stories/permission-selector.stories.tsx
index 6a7d44bf1a..fb0d7c2b74 100644
--- a/packages/web/app/src/stories/permission-selector.stories.tsx
+++ b/packages/web/app/src/stories/permission-selector.stories.tsx
@@ -29,6 +29,7 @@ const defaultProps: Omit<
     },
     PermissionSelector_OrganizationFragment,
   ),
+  isReadOnly: false,
 };
 
 function Template(args: PermissionSelectorProps) {

From efb3394337773f99a96bfa8d695b96aa2c121357 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 13 Jan 2025 14:23:33 +0100
Subject: [PATCH 21/55] show warning for dangerous permissions

---
 .../members/permission-selector.tsx           | 20 ++++++++++--
 .../members/selected-permission-overview.tsx  | 32 ++++++++++++++++---
 .../selected-permission-overview.stories.tsx  |  2 ++
 packages/web/app/src/stories/utils.ts         |  8 +++++
 4 files changed, 55 insertions(+), 7 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index 8a7aed102c..509754db14 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -1,5 +1,5 @@
 import { useMemo, useRef, useState } from 'react';
-import { InfoIcon } from 'lucide-react';
+import { InfoIcon, TriangleAlert } from 'lucide-react';
 import {
   Accordion,
   AccordionContent,
@@ -32,6 +32,7 @@ export const PermissionSelector_OrganizationFragment = graphql(`
         level
         title
         isReadOnly
+        warning
       }
     }
   }
@@ -137,7 +138,19 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                       <div className="font-semibold text-white">{permission.title}</div>
                       <div className="text-xs text-gray-400">{permission.description}</div>
                     </div>
-                    {!!permission.dependsOnId &&
+                    {permission.warning && props.selectedPermissionIds.has(permission.id) ? (
+                      <div className="flex grow justify-end">
+                        <TooltipProvider>
+                          <Tooltip>
+                            <TooltipTrigger>
+                              <TriangleAlert className="text-yellow-700" />
+                            </TooltipTrigger>
+                            <TooltipContent>{permission.warning}</TooltipContent>
+                          </Tooltip>
+                        </TooltipProvider>
+                      </div>
+                    ) : (
+                      !!permission.dependsOnId &&
                       permissionToGroupTitleMapping.has(permission.dependsOnId) && (
                         <div className="flex grow justify-end">
                           <TooltipProvider>
@@ -181,7 +194,8 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                             </Tooltip>
                           </TooltipProvider>
                         </div>
-                      )}
+                      )
+                    )}
                     <Select
                       disabled={props.isReadOnly || permission.isReadOnly || needsDependency}
                       value={
diff --git a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
index 13a6be3a78..e68ac49346 100644
--- a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
+++ b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
@@ -6,8 +6,10 @@ import {
   AccordionTrigger,
 } from '@/components/ui/accordion';
 import { CheckIcon, XIcon } from '@/components/ui/icon';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { FragmentType, graphql, useFragment } from '@/gql';
 import { PermissionLevel } from '@/gql/graphql';
+import { cn } from '@/lib/utils';
 import { ResultOf } from '@graphql-typed-document-node/core';
 
 export const SelectedPermissionOverview_OrganizationFragment = graphql(`
@@ -22,6 +24,7 @@ export const SelectedPermissionOverview_OrganizationFragment = graphql(`
         level
         title
         isReadOnly
+        warning
       }
     }
   }
@@ -158,12 +161,33 @@ function PermissionLevelGroup(props: {
                     props.activePermissionIds.has(permission.id) === false &&
                     !permission.isReadOnly ? null : (
                       <tr key={permission.id}>
-                        <td>{permission.title}</td>
+                        <td
+                          className={cn(
+                            permission.warning &&
+                              props.activePermissionIds.has(permission.id) &&
+                              'text-yellow-700',
+                          )}
+                        >
+                          {permission.title}
+                        </td>
                         <td className="ml-2 text-right">
                           {props.activePermissionIds.has(permission.id) || permission.isReadOnly ? (
-                            <span className="text-green-500">
-                              <CheckIcon className="inline size-4" /> Allowed
-                            </span>
+                            permission.warning ? (
+                              <TooltipProvider>
+                                <Tooltip>
+                                  <TooltipTrigger>
+                                    <span className="text-yellow-700">
+                                      <CheckIcon className="inline size-4" /> Allowed
+                                    </span>
+                                  </TooltipTrigger>
+                                  <TooltipContent>{permission.warning}</TooltipContent>
+                                </Tooltip>
+                              </TooltipProvider>
+                            ) : (
+                              <span className="text-green-500">
+                                <CheckIcon className="inline size-4" /> Allowed
+                              </span>
+                            )
                           ) : (
                             <span>
                               <XIcon className="inline size-4" /> Deny
diff --git a/packages/web/app/src/stories/selected-permission-overview.stories.tsx b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
index 7942420557..a2b56e55dc 100644
--- a/packages/web/app/src/stories/selected-permission-overview.stories.tsx
+++ b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
@@ -49,6 +49,8 @@ export const OnlyAllowedPermissions: Story = {
       'billing:describe',
       'billing:update',
       'project:describe',
+      'member:describe',
+      'member:manageInvites',
     ],
     showOnlyAllowedPermissions: true,
   },
diff --git a/packages/web/app/src/stories/utils.ts b/packages/web/app/src/stories/utils.ts
index fcd68ede91..5edbecce59 100644
--- a/packages/web/app/src/stories/utils.ts
+++ b/packages/web/app/src/stories/utils.ts
@@ -75,6 +75,8 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         description: 'Member can assign roles to users.',
         level: PermissionLevel.Organization,
         title: 'Assign member role',
+        warning:
+          'Granting a role the ability to assign roles enables it to elevate its own permissions.',
       },
       {
         __typename: 'Permission',
@@ -84,6 +86,8 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         description: 'Member can modify, create and delete roles.',
         level: PermissionLevel.Organization,
         title: 'Modify member role',
+        warning:
+          'Granting a role the ability to modify roles enables it to elevate its own permissions.',
       },
       {
         __typename: 'Permission',
@@ -93,6 +97,8 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         description: 'Member can remove users from the organization.',
         level: PermissionLevel.Organization,
         title: 'Remove member',
+        warning:
+          'Granting a role the ability to remove members enables it to remove any member form the organization, except the owner.',
       },
       {
         __typename: 'Permission',
@@ -102,6 +108,8 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         description: 'Member can invite users via email and modify or delete pending invites.',
         level: PermissionLevel.Organization,
         title: 'Manage invites',
+        warning:
+          'Granting a role the ability to manage invites enables it to elevate its own permissions.',
       },
     ],
   },

From bf78e8d624e5fad4374a8113b72bf33f211f9db4 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 14 Jan 2025 17:34:59 +0100
Subject: [PATCH 22/55] remove commented out code

---
 .../src/modules/token/providers/token-manager.ts  | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/packages/services/api/src/modules/token/providers/token-manager.ts b/packages/services/api/src/modules/token/providers/token-manager.ts
index 037354f970..9fd8619f27 100644
--- a/packages/services/api/src/modules/token/providers/token-manager.ts
+++ b/packages/services/api/src/modules/token/providers/token-manager.ts
@@ -72,21 +72,6 @@ export class TokenManager {
       throw new HiveError('User is not a member of the organization');
     }
 
-    // const newScopes = [...input.organizationScopes, ...input.projectScopes, ...input.targetScopes];
-
-    // // See what scopes were removed or added
-    // const modifiedScopes = diffArrays(currentMember.scopes, newScopes);
-
-    // // Check if the current user has rights to set these scopes.
-    // const currentUserMissingScopes = modifiedScopes.filter(
-    //   scope => !currentMember.scopes.includes(scope),
-    // );
-
-    // if (currentUserMissingScopes.length > 0) {
-    //   this.logger.debug(`Logged user scopes: %o`, currentMember.scopes);
-    //   throw new HiveError(`No access to the scopes: ${currentUserMissingScopes.join(', ')}`);
-    // }
-
     pushIfMissing(scopes, TargetAccessScope.READ);
     pushIfMissing(scopes, ProjectAccessScope.READ);
     pushIfMissing(scopes, OrganizationAccessScope.READ);

From ff9997eac41d69d8913e9788db1b89b8ef012fc0 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 12:24:09 +0100
Subject: [PATCH 23/55] tree structure for resources

---
 .../providers/organization-members.ts         | 213 ++++++++++--------
 packages/services/server/src/index.ts         |   1 +
 2 files changed, 115 insertions(+), 99 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index b1caac5dad..1d88a5896f 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -3,57 +3,54 @@ import { sql, type DatabasePool } from 'slonik';
 import { z } from 'zod';
 import { Organization } from '../../../shared/entities';
 import { batchBy } from '../../../shared/helpers';
-import { isUUID } from '../../../shared/is-uuid';
 import { Logger } from '../../shared/providers/logger';
 import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
+import { Storage } from '../../shared/providers/storage';
 import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
 
-const RawOrganizationMembershipModel = z.object({
-  userId: z.string(),
-  roleId: z.string(),
-  connectedToZendesk: z
-    .boolean()
-    .nullable()
-    .transform(value => value ?? false),
+const WildcardAssignmentModel = z.literal('*');
+
+const AppDeploymentAssignmentModel = z.object({
+  type: z.literal('appDeployment'),
+  appName: z.string(),
 });
 
-const UUIDResourceAssignmentModel = z.union([z.literal('*'), z.array(z.string().uuid())]);
+const ServiceAssignmentModel = z.object({ type: z.literal('service'), serviceName: z.string() });
 
-/**
- * String in the form `targetId/serviceName`
- * Example: `f81ce726-2abf-4653-bf4c-d8436cde255a/users`
- */
-const ServiceResourceAssignmentStringModel = z
-  .string()
-  .refine(value => {
-    const [targetId, serviceName = ''] = value.split('/');
-    if (isUUID(targetId) === false || serviceName === '') {
-      return false;
-    }
-    return true;
-  }, 'Invalid service resource assignment')
-  .transform(value => value.split('/') as [targetId: string, serviceName: string]);
-
-const ServiceResourceAssignmentModel = z.union([
-  z.literal('*'),
-  z.array(ServiceResourceAssignmentStringModel),
-]);
-
-const ResourceAssignmentGroupModel = z.object({
-  /** Resources assigned to a 'projects' permission group */
-  project: UUIDResourceAssignmentModel,
-  /** Resources assigned to a 'targets' permission group */
-  target: UUIDResourceAssignmentModel,
-  /** Resources assigned to a 'service' permission group */
-  service: ServiceResourceAssignmentModel,
-  /** Resources assigned to a 'appDeployment' permission group */
-  appDeployment: ServiceResourceAssignmentModel,
+const TargetAssignmentModel = z.object({
+  type: z.literal('target'),
+  id: z.string().uuid(),
+  services: z.union([WildcardAssignmentModel, z.array(ServiceAssignmentModel)]),
+  appDeployments: z.union([WildcardAssignmentModel, z.array(AppDeploymentAssignmentModel)]),
+});
+
+const ProjectAssignmentModel = z.object({
+  type: z.literal('project'),
+  id: z.string().uuid(),
+  targets: z.union([WildcardAssignmentModel, z.array(TargetAssignmentModel)]),
 });
 
+const AssignedResourceModel = z.union([WildcardAssignmentModel, z.array(ProjectAssignmentModel)]);
+
 /**
  * Resource assignments as stored within the database.
  */
-type ResourceAssignmentGroup = z.TypeOf<typeof ResourceAssignmentGroupModel>;
+type ResourceAssignmentGroup = z.TypeOf<typeof AssignedResourceModel>;
+
+const RawOrganizationMembershipModel = z.object({
+  userId: z.string(),
+  roleId: z.string(),
+  connectedToZendesk: z
+    .boolean()
+    .nullable()
+    .transform(value => value ?? false),
+  /**
+   * Resources that are assigned to the membership
+   * If no resources are defined the permissions of the role are applied to all resources within the organization.
+   */
+  // TODO: introduce this value
+  // assignedResources: AssignedResourceModel.nullable().transform(value => value ?? '*'),
+});
 
 export type OrganizationMembershipRoleAssignment = {
   role: OrganizationMemberRole;
@@ -85,6 +82,7 @@ export class OrganizationMembers {
   constructor(
     @Inject(PG_POOL_CONFIG) private pool: DatabasePool,
     private organizationMemberRoles: OrganizationMemberRoles,
+    private storage: Storage,
     logger: Logger,
   ) {
     this.logger = logger.child({
@@ -98,9 +96,7 @@ export class OrganizationMembers {
   ) {
     const query = sql`
       SELECT
-        "om"."user_id" AS "userId"
-        , "om"."role_id" AS "roleId"
-        , "om"."connected_to_zendesk" AS "connectedToZendesk"
+        ${organizationMemberFields(sql`"om"`)}
       FROM
         "organization_member" AS "om"
       WHERE
@@ -144,13 +140,8 @@ export class OrganizationMembers {
           throw new Error('Could not resolve role.');
         }
 
-        // TODO: see if membership has resource assignments
-        const resources: ResourceAssignmentGroup = {
-          project: '*',
-          target: '*',
-          service: '*',
-          appDeployment: '*',
-        };
+        // TODO: use value read from database
+        const resources: ResourceAssignmentGroup = '*';
 
         organizationMembershipByUserId.set(record.userId, {
           organizationId: organization.id,
@@ -161,7 +152,7 @@ export class OrganizationMembers {
             resources,
             resolvedResources: resolveResourceAssignment({
               organizationId: organization.id,
-              groups: resources,
+              projects: resources,
             }),
             role: membershipRole,
           },
@@ -229,9 +220,7 @@ export class OrganizationMembers {
     );
     const query = sql`
       SELECT
-        "om"."user_id" AS "userId"
-        , "om"."role_id" AS "roleId"
-        , "om"."connected_to_zendesk" AS "connectedToZendesk"
+        ${organizationMemberFields(sql`"om"`)}
       FROM
         "organization_member" AS "om"
         INNER JOIN "users" AS "u"
@@ -253,6 +242,13 @@ export class OrganizationMembers {
   }
 }
 
+const organizationMemberFields = (prefix = sql`"organization_member"`) => sql`
+  ${prefix}."user_id" AS "userId"
+  , ${prefix}."role_id" AS "roleId"
+  , ${prefix}."connected_to_zendesk" AS "connectedToZendesk"
+  , ${prefix}."assigned_resources" AS "assignedResources"
+`;
+
 type OrganizationAssignment = {
   type: 'organization';
   organizationId: string;
@@ -290,17 +286,11 @@ export type ResourceAssignment =
 type ResolvedResourceAssignments = {
   organization: OrganizationAssignment;
   project: OrganizationAssignment | Array<ProjectAssignment>;
-  target: OrganizationAssignment | Array<ProjectAssignment> | Array<TargetAssignment>;
-  service:
-    | OrganizationAssignment
-    | Array<ProjectAssignment>
-    | Array<TargetAssignment>
-    | Array<ServiceAssignment>;
+  target: OrganizationAssignment | Array<ProjectAssignment | TargetAssignment>;
+  service: OrganizationAssignment | Array<ProjectAssignment | TargetAssignment | ServiceAssignment>;
   appDeployment:
     | OrganizationAssignment
-    | Array<ProjectAssignment>
-    | Array<TargetAssignment>
-    | Array<AppDeploymentAssignment>;
+    | Array<ProjectAssignment | TargetAssignment | AppDeploymentAssignment>;
 };
 
 /**
@@ -319,56 +309,81 @@ type ResolvedResourceAssignments = {
  */
 function resolveResourceAssignment(args: {
   organizationId: string;
-  groups: ResourceAssignmentGroup;
+  projects: ResourceAssignmentGroup;
 }): ResolvedResourceAssignments {
-  const organization: OrganizationAssignment = {
+  const organizationAssignment: OrganizationAssignment = {
     type: 'organization',
     organizationId: args.organizationId,
   };
 
-  let project: ResolvedResourceAssignments['project'] = organization;
-
-  if (args.groups.project !== '*') {
-    project = args.groups.project.map(projectId => ({
-      type: 'project',
-      projectId,
-    }));
+  if (args.projects === '*') {
+    return {
+      organization: organizationAssignment,
+      project: organizationAssignment,
+      target: organizationAssignment,
+      appDeployment: organizationAssignment,
+      service: organizationAssignment,
+    };
   }
 
-  let target: ResolvedResourceAssignments['target'] = project;
+  let projectAssignments: ResolvedResourceAssignments['project'] = [];
+  let targetAssignments: ResolvedResourceAssignments['target'] = [];
+  let serviceAssignments: ResolvedResourceAssignments['service'] = [];
+  let appDeploymentAssignments: ResolvedResourceAssignments['appDeployment'] = [];
 
-  if (args.groups.target !== '*') {
-    target = args.groups.target.map(targetId => ({
-      type: 'target',
-      targetId,
-    }));
-  }
-
-  let service: ResolvedResourceAssignments['service'] = target;
+  for (const project of args.projects) {
+    const projectAssignment: ProjectAssignment = {
+      type: 'project',
+      projectId: project.id,
+    };
+    projectAssignments.push(projectAssignment);
 
-  if (args.groups.service !== '*') {
-    service = args.groups.service.map(([targetId, serviceName]) => ({
-      type: 'service',
-      targetId,
-      serviceName,
-    }));
-  }
+    if (project.targets === '*') {
+      targetAssignments.push(projectAssignment);
+      continue;
+    }
 
-  let appDeployment: ResolvedResourceAssignments['appDeployment'] = target;
+    for (const target of project.targets) {
+      const targetAssignment: TargetAssignment = {
+        type: 'target',
+        targetId: target.id,
+      };
+
+      targetAssignments.push(targetAssignment);
+
+      // services
+      if (target.services === '*') {
+        serviceAssignments.push(targetAssignment);
+      } else {
+        for (const service of target.services) {
+          serviceAssignments.push({
+            type: 'service',
+            targetId: target.id,
+            serviceName: service.serviceName,
+          });
+        }
+      }
 
-  if (args.groups.service !== '*') {
-    appDeployment = args.groups.service.map(([targetId, appDeploymentName]) => ({
-      type: 'appDeployment',
-      targetId,
-      appDeploymentName,
-    }));
+      // app deployments
+      if (target.appDeployments === '*') {
+        appDeploymentAssignments.push(targetAssignment);
+      } else {
+        for (const appDeployment of target.appDeployments) {
+          appDeploymentAssignments.push({
+            type: 'appDeployment',
+            targetId: target.id,
+            appDeploymentName: appDeployment.appName,
+          });
+        }
+      }
+    }
   }
 
   return {
-    organization,
-    project,
-    target,
-    service,
-    appDeployment,
+    organization: organizationAssignment,
+    project: projectAssignments,
+    target: targetAssignments,
+    service: serviceAssignments,
+    appDeployment: appDeploymentAssignments,
   };
 }
diff --git a/packages/services/server/src/index.ts b/packages/services/server/src/index.ts
index 23ddd43dfe..54d286069c 100644
--- a/packages/services/server/src/index.ts
+++ b/packages/services/server/src/index.ts
@@ -412,6 +412,7 @@ export async function main() {
           organizationMembers: new OrganizationMembers(
             storage.pool,
             new OrganizationMemberRoles(storage.pool, server.log),
+            storage,
             server.log,
           ),
         }),

From 85ccba79884cba8e83f542d76db5be07219d7964 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 12:29:13 +0100
Subject: [PATCH 24/55] use permissions

---
 .../providers/oidc-integrations.provider.ts   | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts b/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
index e0533376e5..45bf958eda 100644
--- a/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
+++ b/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
@@ -382,18 +382,15 @@ export class OIDCIntegrationsProvider {
       } as const;
     }
 
-    const viewer = await this.session.getViewer();
-    const [member, adminRole] = await Promise.all([
-      this.storage.getOrganizationMember({
-        organizationId: oidcIntegration.linkedOrganizationId,
-        userId: viewer.id,
-      }),
-      this.storage.getAdminOrganizationMemberRole({
+    if (
+      !(await this.session.canPerformAction({
+        action: 'member:assignRole',
         organizationId: oidcIntegration.linkedOrganizationId,
-      }),
-    ]);
-
-    if (member?.role.id !== adminRole.id) {
+        params: {
+          organizationId: oidcIntegration.linkedOrganizationId,
+        },
+      }))
+    ) {
       return {
         type: 'error',
         message: 'You do not have permission to update the default member role.',

From 1171e0bfeeb6600a2fb0596e6a5a560511241d6e Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 12:29:28 +0100
Subject: [PATCH 25/55] less permissions for viewers

---
 .../providers/organization-member-roles.ts          | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index e98ea4c338..daea683445 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -223,8 +223,8 @@ function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
     switch (scope) {
       case OrganizationAccessScope.READ: {
         permissions.add('support:manageTickets');
-        permissions.add('project:create');
         permissions.add('project:describe');
+        permissions.add('project:create');
         break;
       }
       case OrganizationAccessScope.SETTINGS: {
@@ -334,11 +334,10 @@ const predefinedRolesPermissions = {
   /**
    * Permissions the viewer role is assigned with (computed from legacy scopes)
    **/
-  viewer: transformOrganizationMemberLegacyScopesIntoPermissionGroup([
-    OrganizationAccessScope.READ,
-    ProjectAccessScope.READ,
-    ProjectAccessScope.OPERATIONS_STORE_READ,
-    TargetAccessScope.READ,
-    TargetAccessScope.REGISTRY_READ,
+  viewer: permissionsToPermissionsPerResourceLevelAssignment([
+    'support:manageTickets',
+    'project:describe',
+    'appDeployment:describe',
+    'laboratory:describe',
   ]),
 };

From 678b983a12f550d9fc7895cda6365d87e64cbb53 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 12:43:00 +0100
Subject: [PATCH 26/55] dem typings

---
 .../resolvers/OIDCIntegration.ts               | 18 +++++++++++++-----
 .../providers/organization-manager.ts          | 11 ++++++++---
 .../providers/organization-member-roles.ts     | 13 +++++++++----
 3 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/packages/services/api/src/modules/oidc-integrations/resolvers/OIDCIntegration.ts b/packages/services/api/src/modules/oidc-integrations/resolvers/OIDCIntegration.ts
index 0febf82623..931bbb2ad7 100644
--- a/packages/services/api/src/modules/oidc-integrations/resolvers/OIDCIntegration.ts
+++ b/packages/services/api/src/modules/oidc-integrations/resolvers/OIDCIntegration.ts
@@ -14,20 +14,28 @@ export const OIDCIntegration: OidcIntegrationResolvers = {
    * Fallbacks to Viewer if default member role is not set
    */
   defaultMemberRole: async (oidcIntegration, _, { injector }) => {
-    if (!oidcIntegration.defaultMemberRoleId) {
-      return injector.get(OrganizationManager).getViewerMemberRole({
+    if (oidcIntegration.defaultMemberRoleId) {
+      const role = await injector.get(OrganizationManager).getMemberRole({
         organizationId: oidcIntegration.linkedOrganizationId,
+        roleId: oidcIntegration.defaultMemberRoleId,
       });
+
+      if (!role) {
+        throw new Error(
+          `Default role not found (role_id=${oidcIntegration.defaultMemberRoleId}, organization=${oidcIntegration.linkedOrganizationId})`,
+        );
+      }
+
+      return role;
     }
 
-    const role = await injector.get(OrganizationManager).getMemberRole({
+    const role = await injector.get(OrganizationManager).getViewerMemberRole({
       organizationId: oidcIntegration.linkedOrganizationId,
-      roleId: oidcIntegration.defaultMemberRoleId,
     });
 
     if (!role) {
       throw new Error(
-        `Default role not found (role_id=${oidcIntegration.defaultMemberRoleId}, organization=${oidcIntegration.linkedOrganizationId})`,
+        `Viewer role not found (organization=${oidcIntegration.linkedOrganizationId})`,
       );
     }
 
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index b9ec962361..8ff61d04cc 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -17,7 +17,7 @@ import { WEB_APP_URL } from '../../shared/providers/tokens';
 import { TokenStorage } from '../../token/providers/token-storage';
 import { createOrUpdateMemberRoleInputSchema } from '../validation';
 import { reservedOrganizationSlugs } from './organization-config';
-import { OrganizationMemberRoles } from './organization-member-roles';
+import { OrganizationMemberRoles, type OrganizationMemberRole } from './organization-member-roles';
 import { OrganizationMembers } from './organization-members';
 
 /**
@@ -1175,7 +1175,10 @@ export class OrganizationManager {
     return this.organizationMemberRoles.getMemberRolesForOrganizationId(selector.organizationId);
   }
 
-  async getMemberRole(selector: { organizationId: string; roleId: string }) {
+  async getMemberRole(selector: {
+    organizationId: string;
+    roleId: string;
+  }): Promise<OrganizationMemberRole | null> {
     const role = await this.organizationMemberRoles.findMemberRoleById(selector.roleId);
 
     if (!role) {
@@ -1193,7 +1196,9 @@ export class OrganizationManager {
     return role;
   }
 
-  async getViewerMemberRole(selector: { organizationId: string }) {
+  async getViewerMemberRole(selector: {
+    organizationId: string;
+  }): Promise<OrganizationMemberRole | null> {
     await this.session.assertPerformAction({
       action: 'member:describe',
       organizationId: selector.organizationId,
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index daea683445..1c225c773f 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -99,7 +99,7 @@ export class OrganizationMemberRoles {
   }
 
   /** Find member roles by their ID */
-  async findMemberRolesByIds(roleIds: Array<string>) {
+  async findMemberRolesByIds(roleIds: Array<string>): Promise<Map<string, OrganizationMemberRole>> {
     this.logger.debug('Find organization membership roles. (roleIds=%o)', roleIds);
 
     const query = sql`
@@ -128,7 +128,10 @@ export class OrganizationMemberRoles {
     return roleIds.map(async roleId => roles.get(roleId) ?? null);
   });
 
-  async findRoleByOrganizationIdAndName(organizationId: string, name: string) {
+  async findRoleByOrganizationIdAndName(
+    organizationId: string,
+    name: string,
+  ): Promise<OrganizationMemberRole | null> {
     const result = await this.pool.maybeOne<unknown>(sql`/* findViewerRoleForOrganizationId */
       SELECT
         ${organizationMemberRoleFields}
@@ -147,7 +150,9 @@ export class OrganizationMemberRoles {
     return MemberRoleModel.parse(result);
   }
 
-  async findViewerRoleByOrganizationId(organizationId: string) {
+  async findViewerRoleByOrganizationId(
+    organizationId: string,
+  ): Promise<OrganizationMemberRole | null> {
     return this.findRoleByOrganizationIdAndName(organizationId, 'Viewer');
   }
 
@@ -190,7 +195,7 @@ export class OrganizationMemberRoles {
     name: string;
     permissions: ReadonlyArray<string>;
     description: string;
-  }) {
+  }): Promise<OrganizationMemberRole> {
     const permissions = args.permissions.filter(permission =>
       OrganizationMemberPermissions.permissions.assignable.has(permission as Permission),
     );

From 572f11aa236569902934c8dee0e565dd6b4de8c5 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 13:01:36 +0100
Subject: [PATCH 27/55] remove null check

---
 .../services/api/src/modules/auth/lib/supertokens-strategy.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index 5d624ca28f..18e1af8b32 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -72,7 +72,7 @@ export class SuperTokensCookieBasedSession extends Session {
     }
 
     // owner of organization should have full right to do anything.
-    if (organizationMembership?.isOwner) {
+    if (organizationMembership.isOwner) {
       this.logger.debug(
         'User is organization owner, resolve admin access policy. (userId=%s, organizationId=%s)',
         user.id,

From e8507df7144c94c252acf8191826372f5726a0c3 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 13:04:04 +0100
Subject: [PATCH 28/55] case check

---
 .../api/src/modules/auth/lib/supertokens-strategy.ts        | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index 18e1af8b32..bf574ca1bb 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -151,7 +151,7 @@ export class SuperTokensCookieBasedSession extends Session {
       return `hrn:${organizationId}:target/${resource.targetId}/appDeployment/${resource.appDeploymentName}`;
     }
 
-    throw new Error('never');
+    casesExhausted(resource);
   }
 
   private translateAssignedRolesToAuthorizationPolicyStatements(
@@ -325,3 +325,7 @@ const SuperTokenAccessTokenModel = zod.object({
   superTokensUserId: zod.string(),
   email: zod.string(),
 });
+
+function casesExhausted(_value: never): never {
+  throw new Error('Not all cases were handled.');
+}

From 054f4751a5f1b56a9c42ef684dfa25e8171c8285 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 13:07:45 +0100
Subject: [PATCH 29/55] merge defs

---
 .../src/modules/organization/module.graphql.ts    | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/packages/services/api/src/modules/organization/module.graphql.ts b/packages/services/api/src/modules/organization/module.graphql.ts
index 6025930e28..4d615f48c7 100644
--- a/packages/services/api/src/modules/organization/module.graphql.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.ts
@@ -304,15 +304,6 @@ export default gql`
     message: String!
   }
 
-  extend type Member {
-    canLeaveOrganization: Boolean!
-    role: MemberRole!
-    """
-    Whether the viewer can remove this member from the organization.
-    """
-    viewerCanRemove: Boolean!
-  }
-
   type MemberRole {
     id: ID!
     name: String!
@@ -456,6 +447,12 @@ export default gql`
     id: ID!
     user: User!
     isOwner: Boolean!
+    canLeaveOrganization: Boolean!
+    role: MemberRole!
+    """
+    Whether the viewer can remove this member from the organization.
+    """
+    viewerCanRemove: Boolean!
   }
 
   type MemberConnection {

From f2896eb58f641d21114f8f47c3e7486c8089e20a Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 13:14:34 +0100
Subject: [PATCH 30/55] dry

---
 .../src/modules/organization/resolvers/MemberRole.ts | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
index 2e94a09983..9fd2e9d349 100644
--- a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
@@ -1,4 +1,4 @@
-import { Session } from '../../auth/lib/authz';
+import { Permission, Session } from '../../auth/lib/authz';
 import type { MemberRoleResolvers } from './../../../__generated__/types';
 
 export const MemberRole: MemberRoleResolvers = {
@@ -39,12 +39,8 @@ export const MemberRole: MemberRoleResolvers = {
     return role.isLocked;
   },
   permissions: (role, _arg, _ctx) => {
-    return [
-      ...role.permissions.organization,
-      ...role.permissions.project,
-      ...role.permissions.target,
-      ...role.permissions.service,
-      ...role.permissions.appDeployment,
-    ];
+    return Array.from(Object.values(role.permissions)).flatMap((set: Set<Permission>) =>
+      Array.from(set),
+    );
   },
 };

From b4e782d657ad5da7cf74129f7b3e3770a887b058 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 13:42:25 +0100
Subject: [PATCH 31/55] changeset

---
 .changeset/tall-islands-occur.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 .changeset/tall-islands-occur.md

diff --git a/.changeset/tall-islands-occur.md b/.changeset/tall-islands-occur.md
new file mode 100644
index 0000000000..d0ab6dd71e
--- /dev/null
+++ b/.changeset/tall-islands-occur.md
@@ -0,0 +1,16 @@
+---
+'hive': major
+---
+
+Introduce new permission system for organization member roles.
+
+The existing scopes assigned to organization member users are now replaced with permissions.
+Using the permissions allows more granular access control to features in Hive.
+
+This introduces the following breaking changes:
+
+- Organization members with the default `Viewer` role, will experience downgraded permissions. They will no longer be able to create targets or projects.
+- Organization member roles permissions for inviting, removing or assigning roles have been revoked. A organization admin will have to re-apply the permissions to the desired member roles.
+- Organization members with permissions for managing invites, removing members, assigning roles or modifying roles are no longer restrained in granting more rights to other users. Please be aware when granting these permissions to a user role. We recommend only assigning these to member roles that are considered "Admin" user roles.
+
+A future update will introduce resource based access control (based on project, target, service or app deployments) for organization members.

From ada68469ccf7bbc2db4fa87a3b3d1d9c76a9678c Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 14:04:45 +0100
Subject: [PATCH 32/55] oops this column does not yet exist

---
 .../organization/providers/organization-members.ts     | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 1d88a5896f..d7f6cbaa10 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -30,6 +30,15 @@ const ProjectAssignmentModel = z.object({
   targets: z.union([WildcardAssignmentModel, z.array(TargetAssignmentModel)]),
 });
 
+/**
+ * Tree data structure that represents the resources assigned to an organization member.
+ *
+ * Together with the assigned member role, these are used to determine whether a user is allowed
+ * or not allowed to perform an action on a specific resource (project, target, service, or app deployment).
+ *
+ * If no resources are assigned to a member role, the permissions are granted on all the resources within the
+ * organization.
+ */
 const AssignedResourceModel = z.union([WildcardAssignmentModel, z.array(ProjectAssignmentModel)]);
 
 /**
@@ -246,7 +255,6 @@ const organizationMemberFields = (prefix = sql`"organization_member"`) => sql`
   ${prefix}."user_id" AS "userId"
   , ${prefix}."role_id" AS "roleId"
   , ${prefix}."connected_to_zendesk" AS "connectedToZendesk"
-  , ${prefix}."assigned_resources" AS "assignedResources"
 `;
 
 type OrganizationAssignment = {

From 131326c2fe372740ac1cc67a834d2de9c912ee55 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 15:06:01 +0100
Subject: [PATCH 33/55] jeez

---
 integration-tests/tests/api/organization/members.spec.ts        | 2 --
 .../modules/organization/providers/organization-member-roles.ts | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/integration-tests/tests/api/organization/members.spec.ts b/integration-tests/tests/api/organization/members.spec.ts
index 21a15c3710..ce2570320b 100644
--- a/integration-tests/tests/api/organization/members.spec.ts
+++ b/integration-tests/tests/api/organization/members.spec.ts
@@ -52,9 +52,7 @@ test.concurrent('invited member should have basic scopes (Viewer role)', async (
     [
       organization:describe,
       support:manageTickets,
-      project:create,
       project:describe,
-      target:create,
       appDeployment:describe,
       laboratory:describe,
     ]
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index 1c225c773f..1159f7b9bc 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -340,6 +340,7 @@ const predefinedRolesPermissions = {
    * Permissions the viewer role is assigned with (computed from legacy scopes)
    **/
   viewer: permissionsToPermissionsPerResourceLevelAssignment([
+    ...OrganizationMemberPermissions.permissions.default,
     'support:manageTickets',
     'project:describe',
     'appDeployment:describe',

From cafc5984d4b10eca9da7505094202a9b0c36dbb1 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 17 Jan 2025 15:58:21 +0100
Subject: [PATCH 34/55] assign role that could do these things

---
 integration-tests/tests/api/target/crud.spec.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/integration-tests/tests/api/target/crud.spec.ts b/integration-tests/tests/api/target/crud.spec.ts
index de7eef843e..15fc5f1df7 100644
--- a/integration-tests/tests/api/target/crud.spec.ts
+++ b/integration-tests/tests/api/target/crud.spec.ts
@@ -140,8 +140,12 @@ test.concurrent(
 test.concurrent('organization member user can create a target', async ({ expect }) => {
   const { createOrg } = await initSeed().createOwner();
   const { ownerEmail: orgMemberEmail, ownerToken: orgMemberToken } = await initSeed().createOwner();
-  const { createProject, inviteMember, joinMemberUsingCode } = await createOrg();
-  const inviteMemberResult = await inviteMember(orgMemberEmail);
+  const { createProject, inviteMember, joinMemberUsingCode, organization } = await createOrg();
+  const inviteMemberResult = await inviteMember(
+    orgMemberEmail,
+    undefined,
+    organization.memberRoles?.find(role => role.name === 'Admin')?.id,
+  );
 
   if (inviteMemberResult.ok == null) {
     throw new Error('Invite did not succeed' + JSON.stringify(inviteMemberResult));

From 24d4d05b87628a635cd153fa566bf475c93c4649 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 20 Jan 2025 09:44:13 +0100
Subject: [PATCH 35/55] fix: update role

---
 .../src/modules/organization/providers/organization-manager.ts  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 8ff61d04cc..fe9301af7a 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -1116,7 +1116,7 @@ export class OrganizationManager {
       roleName,
     );
 
-    if (foundRole && foundRole.id === input.roleId) {
+    if (foundRole && foundRole.id !== input.roleId) {
       const msg = 'Role name already exists. Please choose a different name.';
 
       return {

From 1eecb0d9467a020982321c932db591b557f2b729 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 20 Jan 2025 09:44:24 +0100
Subject: [PATCH 36/55] fix: positioning

---
 .../organization/members/common.tsx           |  3 +-
 .../components/organization/members/list.tsx  | 97 +++++++++----------
 2 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/common.tsx b/packages/web/app/src/components/organization/members/common.tsx
index 9ce146ac5a..871c861dd5 100644
--- a/packages/web/app/src/components/organization/members/common.tsx
+++ b/packages/web/app/src/components/organization/members/common.tsx
@@ -20,6 +20,7 @@ type Role<T> = {
 } & T;
 
 export function RoleSelector<T>(props: {
+  className?: string;
   roles: readonly Role<T>[];
   defaultRole?: Role<T>;
   isRoleActive(role: Role<T>):
@@ -47,7 +48,7 @@ export function RoleSelector<T>(props: {
       <PopoverTrigger asChild>
         <Button
           variant="outline"
-          className="ml-auto flex items-center gap-x-4"
+          className={cn('flex items-center gap-x-4', props.className)}
           data-cy="role-selector-trigger"
           disabled={props.disabled === true || isBusy}
           onClick={() => {
diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index 54eaa96309..d11fd95164 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -109,64 +109,63 @@ function OrganizationMemberRoleSwitcher(props: {
   }
 
   return (
-    <>
-      <RoleSelector
-        searchPlaceholder="Select new role..."
-        roles={roles}
-        onSelect={async role => {
-          try {
-            const result = await assignRole({
-              input: {
-                organizationSlug: organization.slug,
-                roleId: role.id,
-                userId: member.user.id,
-              },
-            });
+    <RoleSelector
+      className="mx-auto"
+      searchPlaceholder="Select new role..."
+      roles={roles}
+      onSelect={async role => {
+        try {
+          const result = await assignRole({
+            input: {
+              organizationSlug: organization.slug,
+              roleId: role.id,
+              userId: member.user.id,
+            },
+          });
 
-            if (result.error) {
-              toast({
-                variant: 'destructive',
-                title: `Failed to assign role to ${props.memberName}`,
-                description: result.error.message,
-              });
-            } else if (result.data?.assignMemberRole.error) {
-              toast({
-                variant: 'destructive',
-                title: `Failed to assign role to ${props.memberName}`,
-                description: result.data.assignMemberRole.error.message,
-              });
-            } else if (result.data?.assignMemberRole.ok) {
-              toast({
-                title: `Assigned ${role.name} to ${result.data.assignMemberRole.ok.updatedMember.user.displayName}`,
-              });
-            }
-          } catch (error: any) {
-            console.error(error);
+          if (result.error) {
             toast({
               variant: 'destructive',
               title: `Failed to assign role to ${props.memberName}`,
-              description: 'message' in error ? error.message : String(error),
+              description: result.error.message,
+            });
+          } else if (result.data?.assignMemberRole.error) {
+            toast({
+              variant: 'destructive',
+              title: `Failed to assign role to ${props.memberName}`,
+              description: result.data.assignMemberRole.error.message,
+            });
+          } else if (result.data?.assignMemberRole.ok) {
+            toast({
+              title: `Assigned ${role.name} to ${result.data.assignMemberRole.ok.updatedMember.user.displayName}`,
             });
           }
-        }}
-        defaultRole={memberRole}
-        disabled={!canAssignRole || assignRoleState.fetching}
-        isRoleActive={role => {
-          const isCurrentRole = role.id === props.memberRoleId;
-
-          if (isCurrentRole) {
-            return {
-              active: false,
-              reason: 'This is the current role',
-            };
-          }
+        } catch (error: any) {
+          console.error(error);
+          toast({
+            variant: 'destructive',
+            title: `Failed to assign role to ${props.memberName}`,
+            description: 'message' in error ? error.message : String(error),
+          });
+        }
+      }}
+      defaultRole={memberRole}
+      disabled={!canAssignRole || assignRoleState.fetching}
+      isRoleActive={role => {
+        const isCurrentRole = role.id === props.memberRoleId;
 
+        if (isCurrentRole) {
           return {
-            active: true,
+            active: false,
+            reason: 'This is the current role',
           };
-        }}
-      />
-    </>
+        }
+
+        return {
+          active: true,
+        };
+      }}
+    />
   );
 }
 

From 22c4edfc4d36f7d5d3998f0acd478b5f4d368a9c Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 20 Jan 2025 16:28:07 +0100
Subject: [PATCH 37/55] remove app deployment describe permission

---
 .../tests/api/organization/members.spec.ts    |  2 --
 .../providers/app-deployments-manager.ts      | 24 -------------------
 .../app-deployments/resolvers/Target.ts       | 13 ++--------
 .../api/src/modules/auth/lib/authz.ts         |  1 -
 .../auth/lib/target-access-token-strategy.ts  |  1 -
 .../lib/organization-member-permissions.ts    | 12 ----------
 .../providers/organization-member-roles.ts    |  2 --
 .../members/selected-permission-overview.tsx  |  4 ----
 packages/web/app/src/stories/utils.ts         | 16 -------------
 9 files changed, 2 insertions(+), 73 deletions(-)

diff --git a/integration-tests/tests/api/organization/members.spec.ts b/integration-tests/tests/api/organization/members.spec.ts
index ce2570320b..f61e671762 100644
--- a/integration-tests/tests/api/organization/members.spec.ts
+++ b/integration-tests/tests/api/organization/members.spec.ts
@@ -37,7 +37,6 @@ test.concurrent('owner of an organization should have all scopes', async ({ expe
       laboratory:describe,
       laboratory:modify,
       laboratory:modifyPreflightScript,
-      appDeployment:describe,
       schemaCheck:approve,
     ]
   `);
@@ -53,7 +52,6 @@ test.concurrent('invited member should have basic scopes (Viewer role)', async (
       organization:describe,
       support:manageTickets,
       project:describe,
-      appDeployment:describe,
       laboratory:describe,
     ]
   `);
diff --git a/packages/services/api/src/modules/app-deployments/providers/app-deployments-manager.ts b/packages/services/api/src/modules/app-deployments/providers/app-deployments-manager.ts
index 73bca40f39..4b2cb08652 100644
--- a/packages/services/api/src/modules/app-deployments/providers/app-deployments-manager.ts
+++ b/packages/services/api/src/modules/app-deployments/providers/app-deployments-manager.ts
@@ -37,20 +37,6 @@ export class AppDeploymentsManager {
       version: appDeploymentInput.version,
     });
 
-    if (!appDeployment) {
-      return null;
-    }
-
-    await this.session.assertPerformAction({
-      action: 'appDeployment:describe',
-      organizationId: target.orgId,
-      params: {
-        organizationId: target.orgId,
-        projectId: target.projectId,
-        targetId: target.id,
-      },
-    });
-
     return appDeployment;
   }
 
@@ -195,16 +181,6 @@ export class AppDeploymentsManager {
     target: Target,
     args: { cursor: string | null; first: number | null },
   ) {
-    await this.session.assertPerformAction({
-      action: 'appDeployment:describe',
-      organizationId: target.orgId,
-      params: {
-        organizationId: target.orgId,
-        projectId: target.projectId,
-        targetId: target.id,
-      },
-    });
-
     return await this.appDeployments.getPaginatedAppDeployments({
       targetId: target.id,
       cursor: args.cursor,
diff --git a/packages/services/api/src/modules/app-deployments/resolvers/Target.ts b/packages/services/api/src/modules/app-deployments/resolvers/Target.ts
index a320f93bd2..8b43a24a89 100644
--- a/packages/services/api/src/modules/app-deployments/resolvers/Target.ts
+++ b/packages/services/api/src/modules/app-deployments/resolvers/Target.ts
@@ -29,7 +29,7 @@ export const Target: Pick<
       first: args.first ?? null,
     });
   },
-  viewerCanViewAppDeployments: async (target, _arg, { injector, session }) => {
+  viewerCanViewAppDeployments: async (target, _arg, { injector }) => {
     const organization = await injector.get(OrganizationManager).getOrganization({
       organizationId: target.orgId,
     });
@@ -40,15 +40,6 @@ export const Target: Pick<
     ) {
       return false;
     }
-
-    return session.canPerformAction({
-      action: 'appDeployment:describe',
-      organizationId: organization.id,
-      params: {
-        organizationId: organization.id,
-        projectId: target.projectId,
-        targetId: target.id,
-      },
-    });
+    return true;
   },
 };
diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index 78c6ed22b1..9c8d16e77b 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -370,7 +370,6 @@ const permissionsByLevel = {
     z.literal('laboratory:describe'),
     z.literal('laboratory:modify'),
     z.literal('laboratory:modifyPreflightScript'),
-    z.literal('appDeployment:describe'),
     z.literal('schema:loadFromRegistry'),
     z.literal('schema:compose'),
   ],
diff --git a/packages/services/api/src/modules/auth/lib/target-access-token-strategy.ts b/packages/services/api/src/modules/auth/lib/target-access-token-strategy.ts
index a36532a3f0..946335160b 100644
--- a/packages/services/api/src/modules/auth/lib/target-access-token-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/target-access-token-strategy.ts
@@ -177,7 +177,6 @@ function transformAccessTokenLegacyScopes(args: {
           {
             effect: 'allow',
             action: [
-              'appDeployment:describe',
               'appDeployment:create',
               'appDeployment:publish',
               'appDeployment:retire',
diff --git a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index c45e9ee6c5..ba6ad6f81f 100644
--- a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -255,18 +255,6 @@ export const allPermissionGroups: Array<PermissionGroup> = [
       },
     ],
   },
-  {
-    id: 'app-deployments',
-    title: 'App Deployments',
-    permissions: [
-      {
-        id: 'appDeployment:describe',
-        title: 'View app deployments',
-        description: 'Member can view app deployments.',
-        dependsOn: 'project:describe',
-      },
-    ],
-  },
   {
     id: 'schema-checks',
     title: 'Schema Checks',
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index 1159f7b9bc..6621e2cb73 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -281,7 +281,6 @@ function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
       }
       case TargetAccessScope.READ: {
         permissions.add('target:create');
-        permissions.add('appDeployment:describe');
         permissions.add('laboratory:describe');
         break;
       }
@@ -343,7 +342,6 @@ const predefinedRolesPermissions = {
     ...OrganizationMemberPermissions.permissions.default,
     'support:manageTickets',
     'project:describe',
-    'appDeployment:describe',
     'laboratory:describe',
   ]),
 };
diff --git a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
index e68ac49346..fa00d2d44b 100644
--- a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
+++ b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
@@ -64,10 +64,6 @@ export function SelectedPermissionOverview(props: SelectedPermissionOverviewProp
       level: PermissionLevel.Service,
       title: 'Service',
     },
-    {
-      level: PermissionLevel.AppDeployment,
-      title: 'App Deployment',
-    },
   ].map(group => (
     <PermissionLevelGroup
       key={group.level}
diff --git a/packages/web/app/src/stories/utils.ts b/packages/web/app/src/stories/utils.ts
index 5edbecce59..5832f1f4cf 100644
--- a/packages/web/app/src/stories/utils.ts
+++ b/packages/web/app/src/stories/utils.ts
@@ -352,22 +352,6 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
       },
     ],
   },
-  {
-    __typename: 'PermissionGroup',
-    id: 'app-deployments',
-    title: 'App Deployments',
-    permissions: [
-      {
-        __typename: 'Permission',
-        isReadOnly: false,
-        id: 'appDeployment:describe',
-        dependsOnId: 'project:describe',
-        description: 'Member can view app deployments.',
-        level: PermissionLevel.Target,
-        title: 'View app deployments',
-      },
-    ],
-  },
   {
     __typename: 'PermissionGroup',
     id: 'schema-checks',

From bf905a94a0aa4530668a6bccbed14ca1d30823be Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Wed, 22 Jan 2025 10:14:59 +0100
Subject: [PATCH 38/55] move to helpers

---
 .../services/api/src/modules/auth/lib/authz.ts     | 14 +-------------
 packages/services/api/src/shared/helpers.ts        | 13 +++++++++++++
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index 9c8d16e77b..d043cf843c 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { FastifyReply, FastifyRequest } from '@hive/service-common';
 import type { User } from '../../../shared/entities';
 import { AccessError } from '../../../shared/errors';
+import { objectEntries, objectFromEntries } from '../../../shared/helpers';
 import { isUUID } from '../../../shared/is-uuid';
 import { Logger } from '../../shared/providers/logger';
 
@@ -314,19 +315,6 @@ function schemaCheckOrPublishIdentity(
   return ids;
 }
 
-/** Typed Object.fromEntries */
-function objectFromEntries<$Key extends string, $Value>(
-  entries: Array<[$Key, $Value]>,
-): Record<$Key, $Value> {
-  return Object.fromEntries(entries) as Record<$Key, $Value>;
-}
-
-function objectEntries<$Key extends string, $Value>(
-  object: Record<$Key, $Value>,
-): Array<[$Key, $Value]> {
-  return Object.entries(object) as Array<[$Key, $Value]>;
-}
-
 /**
  * Object map containing all possible actions
  *
diff --git a/packages/services/api/src/shared/helpers.ts b/packages/services/api/src/shared/helpers.ts
index ba11f10059..83d2312245 100644
--- a/packages/services/api/src/shared/helpers.ts
+++ b/packages/services/api/src/shared/helpers.ts
@@ -413,3 +413,16 @@ export function nsToMs(ns: number) {
 export function msToNs(ms: number) {
   return ms * NS_TO_MS;
 }
+
+/** Typed Object.fromEntries */
+export function objectFromEntries<$Key extends string, $Value>(
+  entries: Array<[$Key, $Value]>,
+): Record<$Key, $Value> {
+  return Object.fromEntries(entries) as Record<$Key, $Value>;
+}
+
+export function objectEntries<$Key extends string, $Value>(
+  object: Record<$Key, $Value>,
+): Array<[$Key, $Value]> {
+  return Object.entries(object) as Array<[$Key, $Value]>;
+}

From 1066f1788b9bdf1342102419b717522f485052b1 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Wed, 22 Jan 2025 14:48:33 +0100
Subject: [PATCH 39/55] simplify amount of user permissions

---
 .../tests/api/organization/members.spec.ts    |  5 +--
 .../api/src/modules/auth/lib/authz.ts         |  5 +--
 .../providers/oidc-integrations.provider.ts   |  2 +-
 .../lib/organization-member-permissions.ts    | 33 +++--------------
 .../providers/organization-manager.ts         | 16 ++++-----
 .../providers/organization-member-roles.ts    |  7 ++--
 .../modules/organization/resolvers/Member.ts  |  2 +-
 .../organization/resolvers/MemberRole.ts      |  6 ++--
 .../organization/resolvers/Organization.ts    |  6 ++--
 .../selected-permission-overview.stories.tsx  |  2 +-
 packages/web/app/src/stories/utils.ts         | 35 +------------------
 11 files changed, 27 insertions(+), 92 deletions(-)

diff --git a/integration-tests/tests/api/organization/members.spec.ts b/integration-tests/tests/api/organization/members.spec.ts
index f61e671762..2d359fa018 100644
--- a/integration-tests/tests/api/organization/members.spec.ts
+++ b/integration-tests/tests/api/organization/members.spec.ts
@@ -13,10 +13,7 @@ test.concurrent('owner of an organization should have all scopes', async ({ expe
       auditLog:export,
       organization:delete,
       member:describe,
-      member:assignRole,
-      member:modifyRole,
-      member:removeMember,
-      member:manageInvites,
+      member:modify,
       billing:describe,
       billing:update,
       oidc:modify,
diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index d043cf843c..2152d64b15 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -334,10 +334,7 @@ const permissionsByLevel = {
     z.literal('billing:describe'),
     z.literal('billing:update'),
     z.literal('member:describe'),
-    z.literal('member:assignRole'),
-    z.literal('member:modifyRole'),
-    z.literal('member:removeMember'),
-    z.literal('member:manageInvites'),
+    z.literal('member:modify'),
     z.literal('project:create'),
     z.literal('schemaLinting:modifyOrganizationRules'),
     z.literal('auditLog:export'),
diff --git a/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts b/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
index 45bf958eda..86d3d00530 100644
--- a/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
+++ b/packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts
@@ -384,7 +384,7 @@ export class OIDCIntegrationsProvider {
 
     if (
       !(await this.session.canPerformAction({
-        action: 'member:assignRole',
+        action: 'member:modify',
         organizationId: oidcIntegration.linkedOrganizationId,
         params: {
           organizationId: oidcIntegration.linkedOrganizationId,
diff --git a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
index ba6ad6f81f..92ce201bdb 100644
--- a/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
+++ b/packages/services/api/src/modules/organization/lib/organization-member-permissions.ts
@@ -57,37 +57,14 @@ export const allPermissionGroups: Array<PermissionGroup> = [
         title: 'View members',
         description: 'Member can access the organization member overview.',
       },
+
       {
-        id: 'member:assignRole',
-        title: 'Assign member role',
-        description: 'Member can assign roles to users.',
-        dependsOn: 'member:describe',
-        warning:
-          'Granting a role the ability to assign roles enables it to elevate its own permissions.',
-      },
-      {
-        id: 'member:modifyRole',
-        title: 'Modify member role',
-        description: 'Member can modify, create and delete roles.',
-        dependsOn: 'member:assignRole',
-        warning:
-          'Granting a role the ability to modify roles enables it to elevate its own permissions.',
-      },
-      {
-        id: 'member:removeMember',
-        title: 'Remove member',
-        description: 'Member can remove users from the organization.',
+        id: 'member:modify',
+        title: 'Manage members',
+        description: 'Member can invite users, update and assign roles.',
         dependsOn: 'member:describe',
         warning:
-          'Granting a role the ability to remove members enables it to remove any member form the organization, except the owner.',
-      },
-      {
-        id: 'member:manageInvites',
-        title: 'Manage invites',
-        description: 'Member can invite users via email and modify or delete pending invites.',
-        dependsOn: 'member:assignRole',
-        warning:
-          'Granting a role the ability to manage invites enables it to elevate its own permissions.',
+          'Granting a role the ability to manage members enables it to elevate its own permissions.',
       },
     ],
   },
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index fe9301af7a..5908be90c1 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -259,7 +259,7 @@ export class OrganizationManager {
   @cache((selector: OrganizationSelector) => selector.organizationId)
   async getInvitations(selector: OrganizationSelector) {
     await this.session.assertPerformAction({
-      action: 'member:manageInvites',
+      action: 'member:modify',
       organizationId: selector.organizationId,
       params: {
         organizationId: selector.organizationId,
@@ -478,7 +478,7 @@ export class OrganizationManager {
 
   async deleteInvitation(input: { email: string; organizationId: string }) {
     await this.session.assertPerformAction({
-      action: 'member:manageInvites',
+      action: 'member:modify',
       organizationId: input.organizationId,
       params: {
         organizationId: input.organizationId,
@@ -489,7 +489,7 @@ export class OrganizationManager {
 
   async inviteByEmail(input: { email: string; organization: string; role?: string | null }) {
     await this.session.assertPerformAction({
-      action: 'member:manageInvites',
+      action: 'member:modify',
       organizationId: input.organization,
       params: {
         organizationId: input.organization,
@@ -792,7 +792,7 @@ export class OrganizationManager {
   ): Promise<Organization> {
     this.logger.info('Deleting a member from an organization (selector=%o)', selector);
     await this.session.assertPerformAction({
-      action: 'member:removeMember',
+      action: 'member:modify',
       organizationId: selector.organizationId,
       params: {
         organizationId: selector.organizationId,
@@ -859,7 +859,7 @@ export class OrganizationManager {
     const organizationId = await this.idTranslator.translateOrganizationId(input);
 
     await this.session.assertPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId,
       params: {
         organizationId,
@@ -932,7 +932,7 @@ export class OrganizationManager {
 
   async deleteMemberRole(input: { organizationId: string; roleId: string }) {
     await this.session.assertPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId: input.organizationId,
       params: {
         organizationId: input.organizationId,
@@ -985,7 +985,7 @@ export class OrganizationManager {
     const organizationId = await this.idTranslator.translateOrganizationId(input);
 
     await this.session.assertPerformAction({
-      action: 'member:assignRole',
+      action: 'member:modify',
       organizationId,
       params: {
         organizationId,
@@ -1075,7 +1075,7 @@ export class OrganizationManager {
   }) {
     const organizationId = await this.idTranslator.translateOrganizationId(input);
     await this.session.assertPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId,
       params: {
         organizationId,
diff --git a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
index 6621e2cb73..918518a35a 100644
--- a/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-member-roles.ts
@@ -251,11 +251,8 @@ function transformOrganizationMemberLegacyScopesIntoPermissionGroup(
         break;
       }
       case OrganizationAccessScope.MEMBERS: {
-        // Note: We do not assign the following permissions:
-        // - 'member:manageInvites'
-        // - 'member:removeMember'
-        // - 'member:assignRole'
-        // - 'member:modifyRole'
+        // Note: We do not assign the following permission:
+        // - 'member:modify
         // The reason for this is that we changed the behavior of checking the permissions for
         // the logic and it is not safe to translate them to the new permission layer.
         permissions.add('member:describe');
diff --git a/packages/services/api/src/modules/organization/resolvers/Member.ts b/packages/services/api/src/modules/organization/resolvers/Member.ts
index eb3ca4b828..3c6d199b16 100644
--- a/packages/services/api/src/modules/organization/resolvers/Member.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Member.ts
@@ -14,7 +14,7 @@ export const Member: MemberResolvers = {
     }
 
     return await session.canPerformAction({
-      action: 'member:removeMember',
+      action: 'member:modify',
       organizationId: member.organizationId,
       params: {
         organizationId: member.organizationId,
diff --git a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
index 9fd2e9d349..055581b280 100644
--- a/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/MemberRole.ts
@@ -7,7 +7,7 @@ export const MemberRole: MemberRoleResolvers = {
       return false;
     }
     return await injector.get(Session).canPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId: role.organizationId,
       params: {
         organizationId: role.organizationId,
@@ -19,7 +19,7 @@ export const MemberRole: MemberRoleResolvers = {
       return false;
     }
     return await injector.get(Session).canPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId: role.organizationId,
       params: {
         organizationId: role.organizationId,
@@ -28,7 +28,7 @@ export const MemberRole: MemberRoleResolvers = {
   },
   canInvite: async (role, _, { injector }) => {
     return await injector.get(Session).canPerformAction({
-      action: 'member:manageInvites',
+      action: 'member:modify',
       organizationId: role.organizationId,
       params: {
         organizationId: role.organizationId,
diff --git a/packages/services/api/src/modules/organization/resolvers/Organization.ts b/packages/services/api/src/modules/organization/resolvers/Organization.ts
index f449df39de..71281a6395 100644
--- a/packages/services/api/src/modules/organization/resolvers/Organization.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Organization.ts
@@ -148,7 +148,7 @@ export const Organization: Pick<
 
   viewerCanManageInvitations: (organization, _arg, { session }) => {
     return session.canPerformAction({
-      action: 'member:manageInvites',
+      action: 'member:modify',
       organizationId: organization.id,
       params: {
         organizationId: organization.id,
@@ -157,7 +157,7 @@ export const Organization: Pick<
   },
   viewerCanAssignUserRoles: (organization, _arg, { session }) => {
     return session.canPerformAction({
-      action: 'member:assignRole',
+      action: 'member:modify',
       organizationId: organization.id,
       params: {
         organizationId: organization.id,
@@ -166,7 +166,7 @@ export const Organization: Pick<
   },
   viewerCanManageRoles: (organization, _arg, { session }) => {
     return session.canPerformAction({
-      action: 'member:modifyRole',
+      action: 'member:modify',
       organizationId: organization.id,
       params: {
         organizationId: organization.id,
diff --git a/packages/web/app/src/stories/selected-permission-overview.stories.tsx b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
index a2b56e55dc..8c7f8e74c4 100644
--- a/packages/web/app/src/stories/selected-permission-overview.stories.tsx
+++ b/packages/web/app/src/stories/selected-permission-overview.stories.tsx
@@ -50,7 +50,7 @@ export const OnlyAllowedPermissions: Story = {
       'billing:update',
       'project:describe',
       'member:describe',
-      'member:manageInvites',
+      'member:modify',
     ],
     showOnlyAllowedPermissions: true,
   },
diff --git a/packages/web/app/src/stories/utils.ts b/packages/web/app/src/stories/utils.ts
index 5832f1f4cf..3e7fefb6e5 100644
--- a/packages/web/app/src/stories/utils.ts
+++ b/packages/web/app/src/stories/utils.ts
@@ -70,7 +70,7 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
       {
         __typename: 'Permission',
         isReadOnly: false,
-        id: 'member:assignRole',
+        id: 'member:modify',
         dependsOnId: 'member:describe',
         description: 'Member can assign roles to users.',
         level: PermissionLevel.Organization,
@@ -78,39 +78,6 @@ export const availableMemberPermissionGroups: Organization['availableMemberPermi
         warning:
           'Granting a role the ability to assign roles enables it to elevate its own permissions.',
       },
-      {
-        __typename: 'Permission',
-        isReadOnly: false,
-        id: 'member:modifyRole',
-        dependsOnId: 'member:describe',
-        description: 'Member can modify, create and delete roles.',
-        level: PermissionLevel.Organization,
-        title: 'Modify member role',
-        warning:
-          'Granting a role the ability to modify roles enables it to elevate its own permissions.',
-      },
-      {
-        __typename: 'Permission',
-        isReadOnly: false,
-        id: 'member:removeMember',
-        dependsOnId: 'member:describe',
-        description: 'Member can remove users from the organization.',
-        level: PermissionLevel.Organization,
-        title: 'Remove member',
-        warning:
-          'Granting a role the ability to remove members enables it to remove any member form the organization, except the owner.',
-      },
-      {
-        __typename: 'Permission',
-        isReadOnly: false,
-        id: 'member:manageInvites',
-        dependsOnId: 'member:describe',
-        description: 'Member can invite users via email and modify or delete pending invites.',
-        level: PermissionLevel.Organization,
-        title: 'Manage invites',
-        warning:
-          'Granting a role the ability to manage invites enables it to elevate its own permissions.',
-      },
     ],
   },
   {

From bacac9ee71595f0a4b66522d57cb4a150f6b05bc Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Thu, 23 Jan 2025 13:42:11 +0100
Subject: [PATCH 40/55] member role resource assignments (#6354)

---
 integration-tests/testkit/flow.ts             |   1 +
 integration-tests/testkit/seed.ts             |   7 +-
 .../tests/api/project/crud.spec.ts            |  59 ++
 .../tests/api/schema/check.spec.ts            | 336 ++++++++
 ...-00-00.granular-member-role-permissions.ts |   4 +
 .../api/src/modules/auth/lib/authz.ts         |   5 +
 .../modules/auth/lib/supertokens-strategy.ts  |   2 +-
 .../modules/organization/module.graphql.ts    | 122 +++
 .../providers/organization-manager.ts         |  17 +-
 .../providers/organization-members.ts         | 241 +++++-
 .../modules/organization/resolvers/Member.ts  |   4 +
 .../resolvers/Mutation/assignMemberRole.ts    |   1 +
 .../src/modules/shared/providers/storage.ts   |   9 +-
 packages/services/storage/src/db/types.ts     |   1 +
 packages/services/storage/src/index.ts        |  79 +-
 .../components/organization/members/list.tsx  | 224 ++---
 .../members/member-role-picker.tsx            | 228 ++++++
 .../members/member-role-selector.tsx          |  75 ++
 .../members/resource-selector.tsx             | 767 ++++++++++++++++++
 19 files changed, 1991 insertions(+), 191 deletions(-)
 create mode 100644 packages/web/app/src/components/organization/members/member-role-picker.tsx
 create mode 100644 packages/web/app/src/components/organization/members/member-role-selector.tsx
 create mode 100644 packages/web/app/src/components/organization/members/resource-selector.tsx

diff --git a/integration-tests/testkit/flow.ts b/integration-tests/testkit/flow.ts
index 2bab6572e1..d41251f549 100644
--- a/integration-tests/testkit/flow.ts
+++ b/integration-tests/testkit/flow.ts
@@ -181,6 +181,7 @@ export function joinOrganization(code: string, authToken: string) {
                 }
                 role {
                   id
+                  name
                   permissions
                 }
               }
diff --git a/integration-tests/testkit/seed.ts b/integration-tests/testkit/seed.ts
index 131b5b999a..66ccbf8da5 100644
--- a/integration-tests/testkit/seed.ts
+++ b/integration-tests/testkit/seed.ts
@@ -48,6 +48,7 @@ import {
   updateMemberRole,
   updateTargetValidationSettings,
 } from './flow';
+import * as GraphQLSchema from './gql/graphql';
 import {
   BreakingChangeFormula,
   OrganizationAccessScope,
@@ -185,10 +186,10 @@ export function initSeed() {
 
               return members;
             },
-            async projects() {
+            async projects(token = ownerToken) {
               const projectsResult = await getOrganizationProjects(
                 { organizationSlug: organization.slug },
-                ownerToken,
+                token,
               ).then(r => r.expectNoGraphQLErrors());
 
               const projects = projectsResult.organization?.organization.projects.nodes;
@@ -806,6 +807,7 @@ export function initSeed() {
                   input: {
                     roleId: string;
                     userId: string;
+                    resouces?: GraphQLSchema.MemberResourceAssignmentInput;
                   },
                   options: { useMemberToken?: boolean } = {
                     useMemberToken: false,
@@ -816,6 +818,7 @@ export function initSeed() {
                       organizationSlug: organization.slug,
                       userId: input.userId,
                       roleId: input.roleId,
+                      resources: input.resouces ?? { allProjects: true },
                     },
                     options.useMemberToken ? memberToken : ownerToken,
                   ).then(r => r.expectNoGraphQLErrors());
diff --git a/integration-tests/tests/api/project/crud.spec.ts b/integration-tests/tests/api/project/crud.spec.ts
index 2900058189..69385e0c6e 100644
--- a/integration-tests/tests/api/project/crud.spec.ts
+++ b/integration-tests/tests/api/project/crud.spec.ts
@@ -199,3 +199,62 @@ test.concurrent(
     expect(renameResult.updateProjectSlug.error?.message).toBeDefined();
   },
 );
+
+test.concurrent('prevent access to projects with assigned resources on member', async () => {
+  const { createOrg } = await initSeed().createOwner();
+  const { createProject, inviteAndJoinMember, projects: getProjects } = await createOrg();
+  const { project } = await createProject(ProjectType.Single);
+  // By default the viewer will have the "Viewer" role.
+  const { member, assignMemberRole, memberToken } = await inviteAndJoinMember();
+
+  // By default the user should have access to all the projects within the organization.
+  let projects = await getProjects(memberToken);
+  expect(projects).toHaveLength(1);
+  expect(projects.at(0)?.id).toEqual(project.id);
+
+  // Limit the users access to no projects using the "Viewer" role
+  await assignMemberRole({
+    roleId: member.role.id,
+    userId: member.user.id,
+    resouces: {
+      projects: [],
+    },
+  });
+
+  projects = await getProjects(memberToken);
+  expect(projects).toHaveLength(0);
+});
+
+test.concurrent('restrict access to single project with assigned resources on member', async () => {
+  const { createOrg } = await initSeed().createOwner();
+  const { createProject, inviteAndJoinMember, projects: getProjects } = await createOrg();
+  const { project: firstProject } = await createProject(ProjectType.Single);
+  const { project: secondProject } = await createProject(ProjectType.Single);
+
+  // By default the viewer will have the "Viewer" role.
+  const { member, assignMemberRole, memberToken } = await inviteAndJoinMember();
+
+  // By default the user should have access to all the projects within the organization.
+  let projects = await getProjects(memberToken);
+  expect(projects).toHaveLength(2);
+  expect(projects.at(0)?.id).toEqual(secondProject.id);
+  expect(projects.at(1)?.id).toEqual(firstProject.id);
+
+  // Limit the users access to a single project using the "Viewer" role
+  await assignMemberRole({
+    roleId: member.role.id,
+    userId: member.user.id,
+    resouces: {
+      projects: [
+        {
+          projectId: firstProject.id,
+          targets: { allTargets: true },
+        },
+      ],
+    },
+  });
+
+  projects = await getProjects(memberToken);
+  expect(projects).toHaveLength(1);
+  expect(projects.at(0)?.id).toEqual(firstProject.id);
+});
diff --git a/integration-tests/tests/api/schema/check.spec.ts b/integration-tests/tests/api/schema/check.spec.ts
index dff7abbd8f..bda7de42eb 100644
--- a/integration-tests/tests/api/schema/check.spec.ts
+++ b/integration-tests/tests/api/schema/check.spec.ts
@@ -1315,6 +1315,342 @@ test.concurrent(
   },
 );
 
+test.concurrent(
+  'can not approve schema check with insufficient permissions granted by default user role',
+  async () => {
+    const { createOrg } = await initSeed().createOwner();
+    const { organization, createProject, inviteAndJoinMember } = await createOrg();
+
+    // Setup Start: Create a failed schema check
+
+    const { project, createTargetAccessToken, target } = await createProject(ProjectType.Single);
+
+    // Create a token with write rights
+    const writeToken = await createTargetAccessToken({});
+
+    // Publish schema with write rights
+    const publishResult = await writeToken
+      .publishSchema({
+        sdl: /* GraphQL */ `
+          type Query {
+            ping: String
+          }
+        `,
+      })
+      .then(r => r.expectNoGraphQLErrors());
+
+    // Schema publish should be successful
+    expect(publishResult.schemaPublish.__typename).toBe('SchemaPublishSuccess');
+
+    const checkResult = await writeToken
+      .checkSchema(/* GraphQL */ `
+        type Query {
+          ping: Float
+        }
+      `)
+      .then(r => r.expectNoGraphQLErrors());
+
+    if (checkResult.schemaCheck.__typename !== 'SchemaCheckError') {
+      throw new Error('Invalid result: ' + checkResult.schemaCheck.__typename);
+    }
+    const schemaCheckId = await checkResult.schemaCheck.schemaCheck?.id;
+    if (!schemaCheckId) {
+      throw new Error('Invalid result: ' + JSON.stringify(checkResult, null, 2));
+    }
+
+    // Setup Done: Create a failed schema check
+
+    // Create a member with no access to projects
+    const { member, assignMemberRole, memberToken } = await inviteAndJoinMember();
+    expect(member.role.name).toEqual('Viewer');
+    await assignMemberRole({
+      roleId: member.role.id,
+      userId: member.user.id,
+      resouces: { projects: [] },
+    });
+
+    // Attempt approving the failed schema check
+    const errors = await execute({
+      document: ApproveFailedSchemaCheckMutation,
+      variables: {
+        input: {
+          organizationSlug: organization.slug,
+          projectSlug: project.slug,
+          targetSlug: target.slug,
+          schemaCheckId,
+        },
+      },
+      authToken: memberToken,
+    }).then(r => r.expectGraphQLErrors());
+    expect(errors).toHaveLength(1);
+    expect(errors.at(0)).toMatchObject({
+      extensions: {
+        code: 'UNAUTHORISED',
+      },
+      message: `No access (reason: "Missing permission for performing 'schemaCheck:approve' on resource")`,
+      path: ['approveFailedSchemaCheck'],
+    });
+  },
+);
+
+test.concurrent(
+  'can not approve schema check with insufficient permissions granted by member role (no access to project resource)',
+  async () => {
+    const { createOrg } = await initSeed().createOwner();
+    const { organization, createProject, inviteAndJoinMember } = await createOrg();
+
+    // Setup Start: Create a failed schema check
+
+    const { project, createTargetAccessToken, target } = await createProject(ProjectType.Single);
+
+    // Create a token with write rights
+    const writeToken = await createTargetAccessToken({});
+
+    // Publish schema with write rights
+    const publishResult = await writeToken
+      .publishSchema({
+        sdl: /* GraphQL */ `
+          type Query {
+            ping: String
+          }
+        `,
+      })
+      .then(r => r.expectNoGraphQLErrors());
+
+    // Schema publish should be successful
+    expect(publishResult.schemaPublish.__typename).toBe('SchemaPublishSuccess');
+
+    const checkResult = await writeToken
+      .checkSchema(/* GraphQL */ `
+        type Query {
+          ping: Float
+        }
+      `)
+      .then(r => r.expectNoGraphQLErrors());
+
+    if (checkResult.schemaCheck.__typename !== 'SchemaCheckError') {
+      throw new Error('Invalid result: ' + checkResult.schemaCheck.__typename);
+    }
+    const schemaCheckId = await checkResult.schemaCheck.schemaCheck?.id;
+    if (!schemaCheckId) {
+      throw new Error('Invalid result: ' + JSON.stringify(checkResult, null, 2));
+    }
+
+    // Setup Done: Create a failed schema check
+
+    // Create a member with no access to projects
+    const { member, assignMemberRole, createMemberRole, memberToken } = await inviteAndJoinMember();
+    const memberRole = await createMemberRole(['schemaCheck:approve', 'project:describe']);
+    await assignMemberRole({
+      roleId: memberRole.id,
+      userId: member.user.id,
+      resouces: { projects: [] },
+    });
+
+    // Attempt approving the failed schema check
+    const errors = await execute({
+      document: ApproveFailedSchemaCheckMutation,
+      variables: {
+        input: {
+          organizationSlug: organization.slug,
+          projectSlug: project.slug,
+          targetSlug: target.slug,
+          schemaCheckId,
+        },
+      },
+      authToken: memberToken,
+    }).then(r => r.expectGraphQLErrors());
+    expect(errors).toHaveLength(1);
+    expect(errors.at(0)).toMatchObject({
+      extensions: {
+        code: 'UNAUTHORISED',
+      },
+      message: `No access (reason: "Missing permission for performing 'schemaCheck:approve' on resource")`,
+      path: ['approveFailedSchemaCheck'],
+    });
+  },
+);
+
+test.concurrent(
+  'can not approve schema check with insufficient permissions granted by member role (no access to target resource)',
+  async () => {
+    const { createOrg } = await initSeed().createOwner();
+    const { organization, createProject, inviteAndJoinMember } = await createOrg();
+
+    // Setup Start: Create a failed schema check
+
+    const { project, createTargetAccessToken, target, targets } = await createProject(
+      ProjectType.Single,
+    );
+
+    // Create a token with write rights
+    const writeToken = await createTargetAccessToken({});
+
+    // Publish schema with write rights
+    const publishResult = await writeToken
+      .publishSchema({
+        sdl: /* GraphQL */ `
+          type Query {
+            ping: String
+          }
+        `,
+      })
+      .then(r => r.expectNoGraphQLErrors());
+
+    // Schema publish should be successful
+    expect(publishResult.schemaPublish.__typename).toBe('SchemaPublishSuccess');
+
+    const checkResult = await writeToken
+      .checkSchema(/* GraphQL */ `
+        type Query {
+          ping: Float
+        }
+      `)
+      .then(r => r.expectNoGraphQLErrors());
+
+    if (checkResult.schemaCheck.__typename !== 'SchemaCheckError') {
+      throw new Error('Invalid result: ' + checkResult.schemaCheck.__typename);
+    }
+    const schemaCheckId = await checkResult.schemaCheck.schemaCheck?.id;
+    if (!schemaCheckId) {
+      throw new Error('Invalid result: ' + JSON.stringify(checkResult, null, 2));
+    }
+
+    // Setup Done: Create a failed schema check
+
+    // Create a member with no access to projects
+    const { member, createMemberRole, assignMemberRole, memberToken } = await inviteAndJoinMember();
+    const memberRole = await createMemberRole(['schemaCheck:approve', 'project:describe']);
+    await assignMemberRole({
+      roleId: memberRole.id,
+      userId: member.user.id,
+      resouces: {
+        projects: [
+          {
+            projectId: project.id,
+            targets: {
+              targets: [],
+            },
+          },
+        ],
+      },
+    });
+
+    // Attempt approving the failed schema check
+    const errors = await execute({
+      document: ApproveFailedSchemaCheckMutation,
+      variables: {
+        input: {
+          organizationSlug: organization.slug,
+          projectSlug: project.slug,
+          targetSlug: target.slug,
+          schemaCheckId,
+        },
+      },
+      authToken: memberToken,
+    }).then(r => r.expectGraphQLErrors());
+    expect(errors).toHaveLength(1);
+    expect(errors.at(0)).toMatchObject({
+      extensions: {
+        code: 'UNAUTHORISED',
+      },
+      message: `No access (reason: "Missing permission for performing 'schemaCheck:approve' on resource")`,
+      path: ['approveFailedSchemaCheck'],
+    });
+  },
+);
+
+test.concurrent(
+  'can approve schema with sufficient permissions granted by member role (access to target)',
+  async () => {
+    const { createOrg } = await initSeed().createOwner();
+    const { organization, createProject, inviteAndJoinMember } = await createOrg();
+
+    // Setup Start: Create a failed schema check
+
+    const { project, createTargetAccessToken, target } = await createProject(ProjectType.Single);
+
+    // Create a token with write rights
+    const writeToken = await createTargetAccessToken({});
+
+    // Publish schema with write rights
+    const publishResult = await writeToken
+      .publishSchema({
+        sdl: /* GraphQL */ `
+          type Query {
+            ping: String
+          }
+        `,
+      })
+      .then(r => r.expectNoGraphQLErrors());
+
+    // Schema publish should be successful
+    expect(publishResult.schemaPublish.__typename).toBe('SchemaPublishSuccess');
+
+    const checkResult = await writeToken
+      .checkSchema(/* GraphQL */ `
+        type Query {
+          ping: Float
+        }
+      `)
+      .then(r => r.expectNoGraphQLErrors());
+
+    if (checkResult.schemaCheck.__typename !== 'SchemaCheckError') {
+      throw new Error('Invalid result: ' + checkResult.schemaCheck.__typename);
+    }
+    const schemaCheckId = await checkResult.schemaCheck.schemaCheck?.id;
+    if (!schemaCheckId) {
+      throw new Error('Invalid result: ' + JSON.stringify(checkResult, null, 2));
+    }
+
+    // Setup Done: Create a failed schema check
+
+    // Create a member with no access to projects
+    const { member, createMemberRole, assignMemberRole, memberToken } = await inviteAndJoinMember();
+    const memberRole = await createMemberRole(['schemaCheck:approve', 'project:describe']);
+    await assignMemberRole({
+      roleId: memberRole.id,
+      userId: member.user.id,
+      resouces: {
+        projects: [
+          {
+            projectId: project.id,
+            targets: {
+              targets: [
+                {
+                  targetId: target.id,
+                  appDeployments: { allAppDeployments: true },
+                  services: { allServices: true },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    });
+
+    // Attempt approving the failed schema check
+    const result = await execute({
+      document: ApproveFailedSchemaCheckMutation,
+      variables: {
+        input: {
+          organizationSlug: organization.slug,
+          projectSlug: project.slug,
+          targetSlug: target.slug,
+          schemaCheckId,
+        },
+      },
+      authToken: memberToken,
+    }).then(r => r.expectNoGraphQLErrors());
+    expect(result.approveFailedSchemaCheck.ok).toMatchObject({
+      schemaCheck: {
+        __typename: 'SuccessfulSchemaCheck',
+        isApproved: true,
+      },
+    });
+  },
+);
+
 test.concurrent(
   'subsequent schema check with shared contextId that contains new breaking changes that have not been approved fails',
   async ({ expect }) => {
diff --git a/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts b/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
index 8e1e01fe8d..cf9941a0e3 100644
--- a/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
+++ b/packages/migrations/src/actions/2025.01.30T00-00-00.granular-member-role-permissions.ts
@@ -7,5 +7,9 @@ export default {
       ALTER "scopes" DROP NOT NULL
       , ADD COLUMN "permissions" text[]
     ;
+
+    ALTER TABLE "organization_member"
+      ADD COLUMN "assigned_resources" JSONB
+    ;
   `,
 } satisfies MigrationExecutor;
diff --git a/packages/services/api/src/modules/auth/lib/authz.ts b/packages/services/api/src/modules/auth/lib/authz.ts
index 2152d64b15..5cf3ef5802 100644
--- a/packages/services/api/src/modules/auth/lib/authz.ts
+++ b/packages/services/api/src/modules/auth/lib/authz.ts
@@ -141,7 +141,12 @@ export abstract class Session {
   }): Promise<void> {
     const permissions = await this._loadPolicyStatementsForOrganization(args.organizationId);
 
+    this.logger.debug('Resolved permission statements for viewer. (permissions=%o)', permissions);
+
     const resourceIdsForAction = actionDefinitions[args.action](args.params as any);
+
+    this.logger.debug('Resolved action resource IDs. (resourceIds=%o)', resourceIdsForAction);
+
     let isAllowed = false;
 
     for (const permission of permissions) {
diff --git a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
index bf574ca1bb..fd2e80a927 100644
--- a/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
+++ b/packages/services/api/src/modules/auth/lib/supertokens-strategy.ts
@@ -140,7 +140,7 @@ export class SuperTokensCookieBasedSession extends Session {
     }
 
     if (resource.type === 'target') {
-      return `hrn:${organizationId}:project/${resource.targetId}`;
+      return `hrn:${organizationId}:target/${resource.targetId}`;
     }
 
     if (resource.type === 'service') {
diff --git a/packages/services/api/src/modules/organization/module.graphql.ts b/packages/services/api/src/modules/organization/module.graphql.ts
index 4d615f48c7..cb18039957 100644
--- a/packages/services/api/src/modules/organization/module.graphql.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.ts
@@ -424,6 +424,7 @@ export default gql`
     organizationSlug: String!
     userId: ID!
     roleId: ID!
+    resources: MemberResourceAssignmentInput!
   }
 
   type AssignMemberRoleOk {
@@ -449,6 +450,7 @@ export default gql`
     isOwner: Boolean!
     canLeaveOrganization: Boolean!
     role: MemberRole!
+    resourceAssignment: MemberResourceAssignment!
     """
     Whether the viewer can remove this member from the organization.
     """
@@ -459,4 +461,124 @@ export default gql`
     nodes: [Member!]!
     total: Int!
   }
+
+  input MemberAppDeploymentAssignmentInput {
+    appDeployment: String!
+  }
+
+  """
+  @oneOf
+  """
+  input MemberTargetAppDeploymentsAssignmentInput {
+    """
+    Whether the permissions should apply for all app deployments within the target.
+    """
+    allAppDeployments: Boolean
+    """
+    Specific app deployments within the target for which the permissions should be applied.
+    """
+    appDeployments: [MemberAppDeploymentAssignmentInput!]
+  }
+
+  input MemberServiceAssignmentInput {
+    serviceName: String!
+  }
+
+  """
+  @oneOf
+  """
+  input MemberTargetServicesAssignmentInput {
+    """
+    Whether the permissions should apply for all services within the target.
+    """
+    allServices: Boolean
+    """
+    Specific services within the target for which the permissions should be applied.
+    """
+    services: [MemberServiceAssignmentInput!]
+  }
+
+  input MemberTargetAssignmentInput {
+    targetId: ID!
+    services: MemberTargetServicesAssignmentInput!
+    appDeployments: MemberTargetAppDeploymentsAssignmentInput!
+  }
+
+  """
+  @oneOf
+  """
+  input MemberProjectTargetsAssignmentInput {
+    """
+    Whether the permissions should apply for all targets within the project.
+    """
+    allTargets: Boolean
+    """
+    Specific targets within the projects for which the permissions should be applied.
+    """
+    targets: [MemberTargetAssignmentInput!]
+  }
+
+  input MemberProjectAssignmentInput {
+    projectId: ID!
+    targets: MemberProjectTargetsAssignmentInput!
+  }
+
+  """
+  @oneOf
+  """
+  input MemberResourceAssignmentInput {
+    """
+    Whether the permissions should apply for all projects within the organization.
+    """
+    allProjects: Boolean
+    """
+    Specific projects within the organization for which the permissions should be applied.
+    """
+    projects: [MemberProjectAssignmentInput!]
+  }
+
+  """
+  @oneOf
+  """
+  type MemberTargetServicesAssignment {
+    allServices: Boolean
+    services: [String!]
+  }
+
+  """
+  @oneOf
+  """
+  type MemberTargetAppDeploymentAssignment {
+    allAppDeployments: Boolean
+    appDeployments: [String!]
+  }
+
+  type MemberTargetAssignment {
+    targetId: ID!
+    target: Target!
+    services: MemberTargetServicesAssignment!
+    appDeployments: MemberTargetAppDeploymentAssignment!
+  }
+
+  """
+  @oneOf
+  """
+  type MemberProjectTargetsAssignment {
+    allTargets: Boolean
+    targets: [MemberTargetAssignment!]
+  }
+
+  type MemberProjectAssignment {
+    projectId: ID!
+    project: Project!
+    targets: MemberProjectTargetsAssignment!
+  }
+
+  """
+  @oneOf
+  """
+  type MemberResourceAssignment {
+    allProjects: Boolean
+    projects: [MemberProjectAssignment!]
+  }
 `;
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 5908be90c1..65852c7b24 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { Inject, Injectable, Scope } from 'graphql-modules';
+import * as GraphQLSchema from '../../../__generated__/types';
 import { Organization } from '../../../shared/entities';
 import { HiveError } from '../../../shared/errors';
 import { cache, share } from '../../../shared/helpers';
@@ -981,7 +982,12 @@ export class OrganizationManager {
     };
   }
 
-  async assignMemberRole(input: { organizationSlug: string; userId: string; roleId: string }) {
+  async assignMemberRole(input: {
+    organizationSlug: string;
+    userId: string;
+    roleId: string;
+    resources: GraphQLSchema.MemberResourceAssignmentInput;
+  }) {
     const organizationId = await this.idTranslator.translateOrganizationId(input);
 
     await this.session.assertPerformAction({
@@ -1016,11 +1022,18 @@ export class OrganizationManager {
       };
     }
 
+    const resourceAssignmentGroup =
+      await this.organizationMembers.transformGraphQLMemberResourceAssignmentInputToResourceAssignmentGroup(
+        organization,
+        input.resources,
+      );
+
     // Assign the role to the member
-    await this.storage.assignOrganizationMemberRole({
+    await this.organizationMembers.assignOrganizationMemberRole({
       organizationId,
       userId: input.userId,
       roleId: input.roleId,
+      resourceAssignmentGroup,
     });
 
     // Access cache is stale by now
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index d7f6cbaa10..849c801473 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -1,6 +1,7 @@
 import { Inject, Injectable, Scope } from 'graphql-modules';
 import { sql, type DatabasePool } from 'slonik';
 import { z } from 'zod';
+import * as GraphQLSchema from '../../../__generated__/types';
 import { Organization } from '../../../shared/entities';
 import { batchBy } from '../../../shared/helpers';
 import { Logger } from '../../shared/providers/logger';
@@ -57,14 +58,14 @@ const RawOrganizationMembershipModel = z.object({
    * Resources that are assigned to the membership
    * If no resources are defined the permissions of the role are applied to all resources within the organization.
    */
-  // TODO: introduce this value
-  // assignedResources: AssignedResourceModel.nullable().transform(value => value ?? '*'),
+  assignedResources: AssignedResourceModel.nullable().transform(value => value ?? '*'),
 });
 
 export type OrganizationMembershipRoleAssignment = {
   role: OrganizationMemberRole;
   /**
    * Resource assignments as stored within the database.
+   * They are used for displaying the selection UI on the frontend.
    */
   resources: ResourceAssignmentGroup;
   /**
@@ -149,8 +150,7 @@ export class OrganizationMembers {
           throw new Error('Could not resolve role.');
         }
 
-        // TODO: use value read from database
-        const resources: ResourceAssignmentGroup = '*';
+        const resources: ResourceAssignmentGroup = record.assignedResources ?? '*';
 
         organizationMembershipByUserId.set(record.userId, {
           organizationId: organization.id,
@@ -249,12 +249,245 @@ export class OrganizationMembers {
     const mapping = await this.resolveMemberships(organization, [membership]);
     return mapping.get(membership.userId) ?? null;
   }
+
+  async assignOrganizationMemberRole(args: {
+    organizationId: string;
+    roleId: string;
+    userId: string;
+    resourceAssignmentGroup: ResourceAssignmentGroup;
+  }) {
+    await this.pool.query(
+      sql`/* assignOrganizationMemberRole */
+        UPDATE
+          "organization_member"
+        SET
+          "role_id" = ${args.roleId}
+          , "assigned_resources" = ${JSON.stringify(
+            /** we parse it to avoid additional properties being stored within the database. */
+            AssignedResourceModel.parse(args.resourceAssignmentGroup),
+          )}
+        WHERE
+          "organization_id" = ${args.organizationId}
+          AND "user_id" = ${args.userId}
+      `,
+    );
+  }
+
+  /**
+   * This method translates the database stored member resource assignment to the GraphQL layer
+   * exposed resource assignment.
+   *
+   * Note: This currently by-passes access checks, granting the viewer read access to all resources
+   * within the organization.
+   */
+  async resolveGraphQLMemberResourceAssignment(
+    member: OrganizationMembership,
+  ): Promise<GraphQLSchema.ResolversTypes['MemberResourceAssignment']> {
+    if (member.assignedRole.resources === '*') {
+      return {
+        allProjects: true,
+      };
+    }
+
+    const projects = await this.storage.findProjectsByIds(
+      member.assignedRole.resources.map(project => project.id),
+    );
+
+    // if there is no project all the assignments do not longer exist.
+    const [firstProject] = projects.values();
+    if (!firstProject) {
+      return {
+        projects: [],
+      };
+    }
+
+    const filteredProjects = member.assignedRole.resources.filter(row => projects.get(row.id));
+
+    const targetAssignments = filteredProjects.flatMap(project =>
+      project.targets === '*' ? [] : project.targets,
+    );
+
+    const targets = await this.storage.findTargetsByIds(
+      firstProject.orgId,
+      targetAssignments.map(target => target.id),
+    );
+
+    return {
+      projects: filteredProjects
+        .map(projectAssignment => {
+          const project = projects.get(projectAssignment.id);
+          if (!project) {
+            return null;
+          }
+
+          return {
+            projectId: project.id,
+            project,
+            targets:
+              projectAssignment.targets === '*'
+                ? { allTargets: true }
+                : {
+                    targets: projectAssignment.targets
+                      .map(targetAssignment => {
+                        const target = targets.get(targetAssignment.id);
+                        if (!target) return null;
+
+                        return {
+                          targetId: target.id,
+                          target,
+                          appDeployments:
+                            targetAssignment.appDeployments === '*'
+                              ? { allAppDeployments: true }
+                              : {
+                                  appDeployments: targetAssignment.appDeployments.map(
+                                    deployment => deployment.appName,
+                                  ),
+                                },
+                          services:
+                            targetAssignment.services === '*'
+                              ? { allServices: true }
+                              : {
+                                  services: targetAssignment.services.map(
+                                    service => service.serviceName,
+                                  ),
+                                },
+                        };
+                      })
+                      .filter(isSome),
+                  },
+          };
+        })
+        .filter(isSome),
+    };
+  }
+
+  /**
+   * Transforms and resolves a {GraphQL.MemberResourceAssignmentInput} to a {ResourceAssignmentGroup}
+   * that can eb stored within our database
+   *
+   * - Projects and Targets that can not be found in our database are omitted from the resolved object.
+   * - Projects and Targets that do not follow the hierarchical structure are omitted from teh resolved object.
+   *
+   * These measures are done in order to prevent users to grant access to other organizations.
+   */
+  async transformGraphQLMemberResourceAssignmentInputToResourceAssignmentGroup(
+    organization: Organization,
+    input: GraphQLSchema.MemberResourceAssignmentInput,
+  ): Promise<ResourceAssignmentGroup> {
+    if (input.allProjects) {
+      return '*';
+    }
+
+    if (input.projects == null) {
+      return [];
+    }
+
+    const projects = await this.storage.findProjectsByIds(
+      input.projects.map(record => record.projectId),
+    );
+
+    /** Mutable array that we populate with the resolved data from the database */
+    const resourceAssignmentGroup: ResourceAssignmentGroup = [];
+
+    // In case we are not assigning all targets to the project,
+    // we need to  load all the targets/projects that would be assigned
+    // for verifying they belong to the organization and/or project.
+    // This prevents breaking permission boundaries through fault/sus input.
+    const targetLookupIds = new Set<string>();
+    const projectTargetAssignments: Array<{
+      projectId: string;
+      /**  mutable array that is within "resourceAssignmentGroup" */
+      projectTargets: Array<z.TypeOf<typeof TargetAssignmentModel>>;
+      targets: readonly GraphQLSchema.MemberTargetAssignmentInput[];
+    }> = [];
+
+    for (const record of input.projects) {
+      const project = projects.get(record.projectId);
+
+      // In case the project was not found or does not belogn the the organization,
+      // we omit it as it could grant an user permissions for a project within another organization.
+      if (!project || project.orgId !== organization.id) {
+        this.logger.debug('Omitted non-existing project.');
+        continue;
+      }
+
+      if (record.targets.allTargets === true) {
+        resourceAssignmentGroup.push({
+          type: 'project',
+          id: project.id,
+          targets: '*',
+        });
+        continue;
+      }
+
+      const projectTargets: Array<z.TypeOf<typeof TargetAssignmentModel>> = [];
+
+      resourceAssignmentGroup.push({
+        type: 'project',
+        id: project.id,
+        targets: projectTargets,
+      });
+
+      if (record.targets.targets) {
+        for (const target of record.targets.targets) {
+          targetLookupIds.add(target.targetId);
+        }
+        projectTargetAssignments.push({
+          projectTargets,
+          targets: record.targets.targets,
+          projectId: project.id,
+        });
+      }
+    }
+
+    const targets = await this.storage.findTargetsByIds(
+      organization.id,
+      Array.from(targetLookupIds),
+    );
+
+    for (const record of projectTargetAssignments) {
+      for (const targetRecord of record.targets) {
+        const target = targets.get(targetRecord.targetId);
+
+        // In case the target was not found or does not belogn the the organization,
+        // we omit it as it could grant an user permissions for a target within another organization.
+        if (!target || target.projectId !== record.projectId) {
+          this.logger.debug('Omitted non-existing target.');
+          continue;
+        }
+
+        record.projectTargets.push({
+          type: 'target',
+          id: target.id,
+          appDeployments: targetRecord.appDeployments.allAppDeployments
+            ? '*'
+            : (targetRecord.appDeployments.appDeployments ?? []).map(record => ({
+                type: 'appDeployment',
+                appName: record.appDeployment,
+              })),
+          services: targetRecord.services.allServices
+            ? '*'
+            : (targetRecord.services.services ?? []).map(record => ({
+                type: 'service',
+                serviceName: record?.serviceName,
+              })),
+        });
+      }
+    }
+
+    return resourceAssignmentGroup;
+  }
+}
+
+function isSome<T>(input: T | null): input is Exclude<T, null> {
+  return input != null;
 }
 
 const organizationMemberFields = (prefix = sql`"organization_member"`) => sql`
   ${prefix}."user_id" AS "userId"
   , ${prefix}."role_id" AS "roleId"
   , ${prefix}."connected_to_zendesk" AS "connectedToZendesk"
+  , ${prefix}."assigned_resources" AS "assignedResources"
 `;
 
 type OrganizationAssignment = {
diff --git a/packages/services/api/src/modules/organization/resolvers/Member.ts b/packages/services/api/src/modules/organization/resolvers/Member.ts
index 3c6d199b16..55d2b542e3 100644
--- a/packages/services/api/src/modules/organization/resolvers/Member.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Member.ts
@@ -1,5 +1,6 @@
 import { Storage } from '../../shared/providers/storage';
 import { OrganizationManager } from '../providers/organization-manager';
+import { OrganizationMembers } from '../providers/organization-members';
 import type { MemberResolvers } from './../../../__generated__/types';
 
 export const Member: MemberResolvers = {
@@ -34,4 +35,7 @@ export const Member: MemberResolvers = {
     }
     return user;
   },
+  resourceAssignment: async (member, _arg, { injector }) => {
+    return injector.get(OrganizationMembers).resolveGraphQLMemberResourceAssignment(member);
+  },
 };
diff --git a/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts b/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
index 1ea7417ea4..40a1a07fb7 100644
--- a/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
+++ b/packages/services/api/src/modules/organization/resolvers/Mutation/assignMemberRole.ts
@@ -10,5 +10,6 @@ export const assignMemberRole: NonNullable<MutationResolvers['assignMemberRole']
     organizationSlug: input.organizationSlug,
     userId: input.userId,
     roleId: input.roleId,
+    resources: input.resources,
   });
 };
diff --git a/packages/services/api/src/modules/shared/providers/storage.ts b/packages/services/api/src/modules/shared/providers/storage.ts
index b8dd5f9695..f2e8f73fa0 100644
--- a/packages/services/api/src/modules/shared/providers/storage.ts
+++ b/packages/services/api/src/modules/shared/providers/storage.ts
@@ -195,11 +195,6 @@ export interface Storage {
 
   deleteOrganizationMember(_: OrganizationSelector & { userId: string }): Promise<void>;
 
-  assignOrganizationMemberRole(_: {
-    organizationId: string;
-    roleId: string;
-    userId: string;
-  }): Promise<void>;
   deleteOrganizationMemberRole(_: { organizationId: string; roleId: string }): Promise<void>;
 
   getProject(_: ProjectSelector): Promise<Project | never>;
@@ -210,6 +205,8 @@ export interface Storage {
 
   getProjects(_: OrganizationSelector): Promise<Project[] | never>;
 
+  findProjectsByIds(projectIds: Array<string>): Promise<Map<string, Project>>;
+
   createProject(_: Pick<Project, 'type'> & { slug: string } & OrganizationSelector): Promise<
     | {
         ok: true;
@@ -307,6 +304,8 @@ export interface Storage {
 
   getTargets(_: ProjectSelector): Promise<readonly Target[]>;
 
+  findTargetsByIds(organizationId: string, targetIds: Array<string>): Promise<Map<string, Target>>;
+
   getTargetIdsOfOrganization(_: OrganizationSelector): Promise<readonly string[]>;
   getTargetIdsOfProject(_: ProjectSelector): Promise<readonly string[]>;
   getTargetSettings(_: TargetSelector): Promise<TargetSettings | never>;
diff --git a/packages/services/storage/src/db/types.ts b/packages/services/storage/src/db/types.ts
index 9102b23e57..3bf684addb 100644
--- a/packages/services/storage/src/db/types.ts
+++ b/packages/services/storage/src/db/types.ts
@@ -177,6 +177,7 @@ export interface organization_invitations {
 }
 
 export interface organization_member {
+  assigned_resources: any | null;
   connected_to_zendesk: boolean;
   organization_id: string;
   role: user_role;
diff --git a/packages/services/storage/src/index.ts b/packages/services/storage/src/index.ts
index 8ce471e7c7..0fe9417ac0 100644
--- a/packages/services/storage/src/index.ts
+++ b/packages/services/storage/src/index.ts
@@ -19,6 +19,7 @@ import type {
   Project,
   Schema,
   Storage,
+  Target,
   TargetSettings,
 } from '@hive/api';
 import { context, SpanKind, SpanStatusCode, trace } from '@hive/service-common';
@@ -505,7 +506,7 @@ export async function createStorage(
               ${args.userId},
               (
                 COALESCE(
-                  (SELECT default_role_id FROM oidc_integrations 
+                  (SELECT default_role_id FROM oidc_integrations
                     WHERE id = ${args.oidcIntegrationId}),
                   (SELECT id FROM organization_member_roles
                     WHERE organization_id = ${linkedOrganizationId} AND name = 'Viewer')
@@ -1010,7 +1011,7 @@ export async function createStorage(
           WHERE
             organization_id = ${organizationId}
             AND id = ${roleId}
-            AND locked = false 
+            AND locked = false
             AND (
               SELECT count(*)
               FROM organization_member
@@ -1086,7 +1087,7 @@ export async function createStorage(
     },
     async updateOrganizationRateLimits({ monthlyRateLimit, organizationId: organization }) {
       return transformOrganization(
-        await pool.one<Slonik<organizations>>(sql`/* updateOrganizationRateLimits */ 
+        await pool.one<Slonik<organizations>>(sql`/* updateOrganizationRateLimits */
           UPDATE organizations
           SET limit_operations_monthly = ${monthlyRateLimit.operations}, limit_retention_days = ${monthlyRateLimit.retentionInDays}
           WHERE id = ${organization}
@@ -1274,15 +1275,6 @@ export async function createStorage(
         `,
       );
     },
-    async assignOrganizationMemberRole({ userId, organizationId, roleId }) {
-      await pool.query(
-        sql`/* assignOrganizationMemberRole */
-          UPDATE organization_member
-          SET role_id = ${roleId}
-          WHERE organization_id = ${organizationId} AND user_id = ${userId}
-        `,
-      );
-    },
     async getProjectId({ projectSlug, organizationSlug }) {
       // Based on project's clean_id and organization's clean_id, resolve the actual uuid of the project
       const result = await pool.one<Pick<projects, 'id'>>(
@@ -1301,7 +1293,7 @@ export async function createStorage(
           SELECT t.id FROM targets as t
           LEFT JOIN projects AS p ON (p.id = t.project_id)
           LEFT JOIN organizations AS o ON (o.id = p.org_id)
-          WHERE 
+          WHERE
             t.clean_id = ${selector.targetSlug} AND
             p.clean_id = ${selector.projectSlug} AND
             o.clean_id = ${selector.organizationSlug} AND
@@ -1406,6 +1398,18 @@ export async function createStorage(
 
       return result.rows.map(transformProject);
     },
+    async findProjectsByIds(ids) {
+      const result = await pool.query<Slonik<projects>>(
+        sql`/* findProjectsByIds */ SELECT * FROM projects WHERE id = ANY(${sql.array(ids, 'uuid')}) AND type != 'CUSTOM'`,
+      );
+
+      const map = new Map<string, Project>();
+      result.rows.forEach(row => {
+        const project = transformProject(row);
+        map.set(project.id, project);
+      });
+      return map;
+    },
     async updateProjectSlug({ slug, organizationId: organization, projectId: project }) {
       return pool.transaction(async t => {
         const projectSlugExists = await t.exists(
@@ -1697,6 +1701,29 @@ export async function createStorage(
         orgId: organization,
       }));
     },
+    async findTargetsByIds(organizationId, targetIds) {
+      const map = new Map<string, Target>();
+
+      if (targetIds.length === 0) {
+        return map;
+      }
+
+      const results = await pool.query<unknown>(sql`/* getTargets */
+        SELECT
+          ${targetSQLFields}
+        FROM
+          "targets"
+        WHERE
+          "id" = ANY(${sql.array(targetIds, 'uuid')})
+      `);
+
+      for (const row of results.rows) {
+        const target: Target = { ...TargetModel.parse(row), orgId: organizationId };
+        map.set(target.id, target);
+      }
+
+      return map;
+    },
     async getTargetIdsOfOrganization({ organizationId: organization }) {
       const results = await pool.query<Slonik<Pick<targets, 'id'>>>(
         sql`/* getTargetIdsOfOrganization */
@@ -1856,7 +1883,7 @@ export async function createStorage(
         }>(sql`/* countPeriodSchemaVersionsOfProject */
           SELECT COUNT(*) as total FROM schema_versions as sv
           LEFT JOIN targets as t ON (t.id = sv.target_id)
-          WHERE 
+          WHERE
             t.project_id = ${project}
             AND sv.created_at >= ${period.from.toISOString()}
             AND sv.created_at < ${period.to.toISOString()}
@@ -1878,7 +1905,7 @@ export async function createStorage(
           total: number;
         }>(sql`/* countPeriodSchemaVersionsOfTarget */
           SELECT COUNT(*) as total FROM schema_versions
-          WHERE 
+          WHERE
             target_id = ${target}
             AND created_at >= ${period.from.toISOString()}
             AND created_at < ${period.to.toISOString()}
@@ -2198,7 +2225,7 @@ export async function createStorage(
 
     async getVersion({ projectId: project, targetId: target, versionId: version }) {
       const result = await pool.one(sql`/* getVersion */
-        SELECT 
+        SELECT
           ${schemaVersionSQLFields(sql`sv.`)}
         FROM schema_versions as sv
         LEFT JOIN schema_log as sl ON (sl.id = sv.action_id)
@@ -2225,7 +2252,7 @@ export async function createStorage(
       }
 
       const query = sql`/* getPaginatedSchemaVersionsForTargetId */
-        SELECT 
+        SELECT
           ${schemaVersionSQLFields()}
         FROM
           "schema_versions"
@@ -2809,7 +2836,7 @@ export async function createStorage(
       `);
 
       // get organizations data
-      const organizationsResult = pool.query<Slonik<organizations>>(sql`/* adminGetOrganizations */ 
+      const organizationsResult = pool.query<Slonik<organizations>>(sql`/* adminGetOrganizations */
         SELECT * FROM organizations
       `);
 
@@ -2892,7 +2919,7 @@ export async function createStorage(
     },
     async deleteOrganizationBilling(selector) {
       await pool.query<Slonik<organizations_billing>>(
-        sql`/* deleteOrganizationBilling */ 
+        sql`/* deleteOrganizationBilling */
           DELETE FROM organizations_billing
           WHERE organization_id = ${selector.organizationId}`,
       );
@@ -3117,7 +3144,7 @@ export async function createStorage(
       return tracedTransaction('updateOIDCDefaultMemberRole', pool, async trx => {
         // Make sure the role exists and is associated with the organization
         const roleId = await trx.oneFirst<string>(sql`/* checkRoleExists */
-          SELECT id FROM "organization_member_roles" 
+          SELECT id FROM "organization_member_roles"
           WHERE
             "id" = ${args.roleId} AND
             "organization_id" = (
@@ -3198,7 +3225,7 @@ export async function createStorage(
 
     async getCDNAccessTokenById(args) {
       const result = await pool.maybeOne(sql`/* getCDNAccessTokenById */
-        SELECT 
+        SELECT
           "id"
           , "target_id"
           , "s3_key"
@@ -3319,7 +3346,7 @@ export async function createStorage(
         DO UPDATE
           SET "config" = ${sql.jsonb(input.policy)},
               "allow_overriding" = ${input.allowOverrides},
-              "updated_at" = now() 
+              "updated_at" = now()
         RETURNING *;
       `);
 
@@ -3334,7 +3361,7 @@ export async function createStorage(
         (resource_type, resource_id)
       DO UPDATE
         SET "config" = ${sql.jsonb(input.policy)},
-            "updated_at" = now() 
+            "updated_at" = now()
       RETURNING *;
     `);
 
@@ -3979,7 +4006,7 @@ export async function createStorage(
             "id" = ${args.schemaCheckId}
             AND "is_success" = false
             AND "schema_composition_errors" IS NULL
-          RETURNING 
+          RETURNING
             "id"
         `);
       } else if (didUpdateContractChecks) {
@@ -3997,7 +4024,7 @@ export async function createStorage(
             "id" = ${args.schemaCheckId}
             AND "is_success" = false
             AND "schema_composition_errors" IS NULL
-          RETURNING 
+          RETURNING
             "id"
         `);
       }
@@ -5075,7 +5102,7 @@ export const userFields = (
   , ${user}"supertoken_user_id" AS "superTokensUserId"
   , ${user}"is_admin" AS "isAdmin"
   , ${user}"oidc_integration_id" AS "oidcIntegrationId"
-  , ${user}"zendesk_user_id" AS "zendeskId" 
+  , ${user}"zendesk_user_id" AS "zendeskId"
   , ${superTokensThirdParty}"third_party_id" AS "provider"
 `;
 
diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index d11fd95164..5305ccd8d4 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -14,160 +14,21 @@ import {
   AlertDialogTitle,
 } from '@/components/ui/alert-dialog';
 import { Button } from '@/components/ui/button';
+import { Dialog, DialogContent, DialogTrigger } from '@/components/ui/dialog';
 import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu';
+import { Link } from '@/components/ui/link';
 import { SubPageLayout, SubPageLayoutHeader } from '@/components/ui/page-content-layout';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
 import { AuthProvider } from '@/gql/graphql';
-import { RoleSelector } from './common';
 import { MemberInvitationButton } from './invitations';
-
-const OrganizationMemberRoleSwitcher_AssignRoleMutation = graphql(`
-  mutation OrganizationMemberRoleSwitcher_AssignRoleMutation($input: AssignMemberRoleInput!) {
-    assignMemberRole(input: $input) {
-      ok {
-        updatedMember {
-          id
-          user {
-            id
-            displayName
-          }
-          role {
-            id
-            # Updates the members count of the role
-            membersCount
-          }
-        }
-        previousMemberRole {
-          id
-          # Updates the members count of the role
-          membersCount
-        }
-      }
-      error {
-        message
-      }
-    }
-  }
-`);
-
-const OrganizationMemberRoleSwitcher_OrganizationFragment = graphql(`
-  fragment OrganizationMemberRoleSwitcher_OrganizationFragment on Organization {
-    id
-    slug
-    viewerCanAssignUserRoles
-    owner {
-      id
-    }
-    memberRoles {
-      id
-      name
-      description
-      locked
-    }
-  }
-`);
-
-const OrganizationMemberRoleSwitcher_MemberFragment = graphql(`
-  fragment OrganizationMemberRoleSwitcher_MemberFragment on Member {
-    id
-    user {
-      id
-    }
-  }
-`);
-
-function OrganizationMemberRoleSwitcher(props: {
-  organization: FragmentType<typeof OrganizationMemberRoleSwitcher_OrganizationFragment>;
-  memberId: string;
-  memberName: string;
-  memberRoleId: string;
-  member?: FragmentType<typeof OrganizationMemberRoleSwitcher_MemberFragment>;
-}) {
-  const organization = useFragment(
-    OrganizationMemberRoleSwitcher_OrganizationFragment,
-    props.organization,
-  );
-  const member = useFragment(OrganizationMemberRoleSwitcher_MemberFragment, props.member);
-  const canAssignRole = organization.viewerCanAssignUserRoles;
-  const roles = organization.memberRoles ?? [];
-  const { toast } = useToast();
-  const [assignRoleState, assignRole] = useMutation(
-    OrganizationMemberRoleSwitcher_AssignRoleMutation,
-  );
-  const memberRole = roles?.find(role => role.id === props.memberRoleId);
-
-  if (!memberRole || !member) {
-    console.error('No role or member provided to OrganizationMemberRoleSwitcher');
-    return null;
-  }
-
-  return (
-    <RoleSelector
-      className="mx-auto"
-      searchPlaceholder="Select new role..."
-      roles={roles}
-      onSelect={async role => {
-        try {
-          const result = await assignRole({
-            input: {
-              organizationSlug: organization.slug,
-              roleId: role.id,
-              userId: member.user.id,
-            },
-          });
-
-          if (result.error) {
-            toast({
-              variant: 'destructive',
-              title: `Failed to assign role to ${props.memberName}`,
-              description: result.error.message,
-            });
-          } else if (result.data?.assignMemberRole.error) {
-            toast({
-              variant: 'destructive',
-              title: `Failed to assign role to ${props.memberName}`,
-              description: result.data.assignMemberRole.error.message,
-            });
-          } else if (result.data?.assignMemberRole.ok) {
-            toast({
-              title: `Assigned ${role.name} to ${result.data.assignMemberRole.ok.updatedMember.user.displayName}`,
-            });
-          }
-        } catch (error: any) {
-          console.error(error);
-          toast({
-            variant: 'destructive',
-            title: `Failed to assign role to ${props.memberName}`,
-            description: 'message' in error ? error.message : String(error),
-          });
-        }
-      }}
-      defaultRole={memberRole}
-      disabled={!canAssignRole || assignRoleState.fetching}
-      isRoleActive={role => {
-        const isCurrentRole = role.id === props.memberRoleId;
-
-        if (isCurrentRole) {
-          return {
-            active: false,
-            reason: 'This is the current role',
-          };
-        }
-
-        return {
-          active: true,
-        };
-      }}
-    />
-  );
-}
+import { MemberRolePicker } from './member-role-picker';
 
 export const authProviderToIconAndTextMap: Record<
   AuthProvider,
@@ -225,7 +86,7 @@ const OrganizationMemberRow_MemberFragment = graphql(`
     }
     isOwner
     viewerCanRemove
-    ...OrganizationMemberRoleSwitcher_MemberFragment
+    ...MemberRole_MemberFragment
   }
 `);
 
@@ -329,13 +190,7 @@ function OrganizationMemberRow(props: {
               </Tooltip>
             </TooltipProvider>
           ) : (
-            <OrganizationMemberRoleSwitcher
-              organization={organization}
-              memberId={member.id}
-              memberName={member.user.displayName}
-              memberRoleId={member.role.id}
-              member={member}
-            />
+            <MemberRole member={member} organization={organization} />
           )}
         </td>
         <td className="py-3 text-right text-sm">
@@ -358,6 +213,73 @@ function OrganizationMemberRow(props: {
   );
 }
 
+const MemberRole_OrganizationFragment = graphql(`
+  fragment MemberRole_OrganizationFragment on Organization {
+    id
+    viewerCanAssignUserRoles
+    ...MemberRolePicker_OrganizationFragment
+  }
+`);
+
+const MemberRole_MemberFragment = graphql(`
+  fragment MemberRole_MemberFragment on Member {
+    id
+    role {
+      id
+      name
+    }
+    resourceAssignment {
+      allProjects
+      projects {
+        project {
+          id
+          slug
+        }
+      }
+    }
+    ...MemberRolePicker_MemberFragment
+  }
+`);
+
+function MemberRole(props: {
+  member: FragmentType<typeof MemberRole_MemberFragment>;
+  organization: FragmentType<typeof MemberRole_OrganizationFragment>;
+}) {
+  const member = useFragment(MemberRole_MemberFragment, props.member);
+  const organization = useFragment(MemberRole_OrganizationFragment, props.organization);
+  const [isOpen, setIsOpen] = useState(false);
+
+  return (
+    <>
+      {member.role.name}
+      {member.resourceAssignment.allProjects ? (
+        ' (all resources)'
+      ) : member.resourceAssignment.projects?.length ? (
+        <>
+          {'(' + member.resourceAssignment.projects.length} project
+          {member.resourceAssignment.projects.length === 1 ? '' : 's'})
+        </>
+      ) : null}{' '}
+      {organization.viewerCanAssignUserRoles && (
+        <Dialog open={isOpen} onOpenChange={isOpen => setIsOpen(isOpen)}>
+          <DialogTrigger asChild>
+            <Link>change</Link>
+          </DialogTrigger>
+          <DialogContent className="min-w-[800px]">
+            {isOpen && (
+              <MemberRolePicker
+                organization={organization}
+                member={member}
+                close={() => setIsOpen(false)}
+              />
+            )}
+          </DialogContent>
+        </Dialog>
+      )}
+    </>
+  );
+}
+
 const OrganizationMembers_OrganizationFragment = graphql(`
   fragment OrganizationMembers_OrganizationFragment on Organization {
     id
@@ -380,8 +302,8 @@ const OrganizationMembers_OrganizationFragment = graphql(`
       total
     }
     viewerCanManageInvitations
-    ...OrganizationMemberRoleSwitcher_OrganizationFragment
     ...MemberInvitationForm_OrganizationFragment
+    ...MemberRole_OrganizationFragment
   }
 `);
 
diff --git a/packages/web/app/src/components/organization/members/member-role-picker.tsx b/packages/web/app/src/components/organization/members/member-role-picker.tsx
new file mode 100644
index 0000000000..9fcf8fed8e
--- /dev/null
+++ b/packages/web/app/src/components/organization/members/member-role-picker.tsx
@@ -0,0 +1,228 @@
+import { useState } from 'react';
+import { useMutation } from 'urql';
+import { Button } from '@/components/ui/button';
+import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { useToast } from '@/components/ui/use-toast';
+import { FragmentType, graphql, useFragment } from '@/gql';
+import * as GraphQLSchema from '@/gql/graphql';
+import { MemberRoleSelector } from './member-role-selector';
+import { ResourceSelector, type ResourceSelection } from './resource-selector';
+
+const MemberRolePicker_OrganizationFragment = graphql(`
+  fragment MemberRolePicker_OrganizationFragment on Organization {
+    id
+    slug
+    ...ResourceSelector_OrganizationFragment
+    ...MemberRoleSelector_OrganizationFragment
+  }
+`);
+
+const MemberRolePicker_MemberFragment = graphql(`
+  fragment MemberRolePicker_MemberFragment on Member {
+    id
+    user {
+      id
+      displayName
+      email
+    }
+    role {
+      id
+    }
+    resourceAssignment {
+      allProjects
+      projects {
+        project {
+          id
+          slug
+        }
+        targets {
+          allTargets
+          targets {
+            target {
+              id
+              slug
+            }
+            services {
+              allServices
+              services
+            }
+            appDeployments {
+              allAppDeployments
+              appDeployments
+            }
+          }
+        }
+      }
+    }
+    ...MemberRoleSelector_MemberFragment
+  }
+`);
+
+const MemberRolePicker_AssignRoleMutation = graphql(`
+  mutation OrganizationMemberRoleSwitcher_AssignRoleMutation($input: AssignMemberRoleInput!) {
+    assignMemberRole(input: $input) {
+      ok {
+        updatedMember {
+          id
+          role {
+            id
+            name
+          }
+          user {
+            id
+            displayName
+          }
+          ...OrganizationMemberRow_MemberFragment
+        }
+        previousMemberRole {
+          id
+          # Updates the members count of the role
+          membersCount
+        }
+      }
+      error {
+        message
+      }
+    }
+  }
+`);
+
+export function MemberRolePicker(props: {
+  organization: FragmentType<typeof MemberRolePicker_OrganizationFragment>;
+  member: FragmentType<typeof MemberRolePicker_MemberFragment>;
+  close: VoidFunction;
+}) {
+  const organization = useFragment(MemberRolePicker_OrganizationFragment, props.organization);
+  const member = useFragment(MemberRolePicker_MemberFragment, props.member);
+  const [selectedRoleId, setSelectedRoleId] = useState(member.role.id);
+  const [selection, setSelection] = useState<ResourceSelection>(() => ({
+    projects:
+      member.resourceAssignment.allProjects === true
+        ? '*'
+        : (member.resourceAssignment.projects ?? []).map(record => ({
+            id: record.project.id,
+            slug: record.project.slug,
+            targets:
+              record.targets.allTargets === true
+                ? '*'
+                : (record.targets.targets ?? []).map(record => ({
+                    id: record.target.id,
+                    slug: record.target.slug,
+                    appDeployments:
+                      record.appDeployments.allAppDeployments === true
+                        ? '*'
+                        : (record.appDeployments.appDeployments ?? []),
+                    services:
+                      record.services.allServices === true ? '*' : (record.services.services ?? []),
+                  })),
+          })),
+  }));
+
+  const [assignRoleState, assignRole] = useMutation(MemberRolePicker_AssignRoleMutation);
+  const { toast } = useToast();
+
+  return (
+    <>
+      <DialogHeader>
+        <DialogTitle>
+          Assign Member Role for {member.user.displayName} ({member.user.email})
+        </DialogTitle>
+        <DialogDescription>
+          A member can be granted permissions by attaching a member role. The access to the
+          resources within the project can further be restricted.
+        </DialogDescription>
+      </DialogHeader>
+      <div>
+        <div className="mb-1 text-sm font-bold">Member Role</div>
+        <MemberRoleSelector
+          organization={organization}
+          member={member}
+          selectedRoleId={selectedRoleId}
+          onSelectRoleId={roleId => setSelectedRoleId(roleId)}
+        />
+      </div>
+      <div>
+        <div className="mb-1 text-sm font-bold">Resources</div>
+        <ResourceSelector
+          selection={selection}
+          onSelectionChange={setSelection}
+          organization={organization}
+        />
+      </div>
+      <DialogFooter>
+        <Button
+          disabled={assignRoleState.fetching}
+          onClick={async () => {
+            try {
+              const result = await assignRole({
+                input: {
+                  organizationSlug: organization.slug,
+                  roleId: selectedRoleId,
+                  userId: member.user.id,
+                  resources:
+                    transformResourceSelectionToGraphQLMemberResourceAssignmentInput(selection),
+                },
+              });
+              if (result.error) {
+                toast({
+                  variant: 'destructive',
+                  title: `Failed to assign role to ${member.user.displayName}`,
+                  description: result.error.message,
+                });
+              } else if (result.data?.assignMemberRole.error) {
+                toast({
+                  variant: 'destructive',
+                  title: `Failed to assign role to ${member.user.displayName}`,
+                  description: result.data.assignMemberRole.error.message,
+                });
+              } else if (result.data?.assignMemberRole.ok) {
+                toast({
+                  title: `Assigned ${result.data?.assignMemberRole.ok.updatedMember.role.name} to ${result.data.assignMemberRole.ok.updatedMember.user.displayName}`,
+                });
+                props.close();
+              }
+            } catch (error: any) {
+              console.error(error);
+              toast({
+                variant: 'destructive',
+                title: `Failed to assign role to ${member.user.displayName}`,
+                description: 'message' in error ? error.message : String(error),
+              });
+            }
+          }}
+        >
+          {assignRoleState.fetching ? 'Loading...' : 'Confirm'}
+        </Button>
+      </DialogFooter>
+    </>
+  );
+}
+
+function transformResourceSelectionToGraphQLMemberResourceAssignmentInput(
+  selection: ResourceSelection,
+): GraphQLSchema.MemberResourceAssignmentInput {
+  if (selection.projects === '*') {
+    return {
+      allProjects: true,
+    };
+  }
+
+  return {
+    projects: selection.projects.map(project => ({
+      projectId: project.id,
+      targets:
+        project.targets === '*'
+          ? { allTargets: true }
+          : {
+              targets: project.targets.map(target => ({
+                targetId: target.id,
+                appDeployments: { appDeployments: [] },
+                services:
+                  target.services === '*'
+                    ? { allServices: true }
+                    : { services: target.services.map(service => ({ serviceName: service })) },
+              })),
+            },
+    })),
+  };
+}
diff --git a/packages/web/app/src/components/organization/members/member-role-selector.tsx b/packages/web/app/src/components/organization/members/member-role-selector.tsx
new file mode 100644
index 0000000000..3c1c863450
--- /dev/null
+++ b/packages/web/app/src/components/organization/members/member-role-selector.tsx
@@ -0,0 +1,75 @@
+import { FragmentType, graphql, useFragment } from '@/gql';
+import { RoleSelector } from './common';
+
+const MemberRoleSelector_OrganizationFragment = graphql(`
+  fragment MemberRoleSelector_OrganizationFragment on Organization {
+    id
+    slug
+    viewerCanAssignUserRoles
+    owner {
+      id
+    }
+    memberRoles {
+      id
+      name
+      description
+      locked
+    }
+  }
+`);
+
+const MemberRoleSelector_MemberFragment = graphql(`
+  fragment MemberRoleSelector_MemberFragment on Member {
+    id
+    role {
+      id
+    }
+    user {
+      id
+    }
+  }
+`);
+
+export function MemberRoleSelector(props: {
+  organization: FragmentType<typeof MemberRoleSelector_OrganizationFragment>;
+  member: FragmentType<typeof MemberRoleSelector_MemberFragment>;
+  selectedRoleId: string;
+  onSelectRoleId: (roleId: string) => void;
+}) {
+  const organization = useFragment(MemberRoleSelector_OrganizationFragment, props.organization);
+  const member = useFragment(MemberRoleSelector_MemberFragment, props.member);
+  const canAssignRole = organization.viewerCanAssignUserRoles;
+  const roles = organization.memberRoles ?? [];
+
+  const memberRole = roles.find(role => role.id === props.selectedRoleId);
+
+  if (!memberRole || !member) {
+    console.error('No role or member provided to MemberRoleSelector');
+    return null;
+  }
+
+  return (
+    <RoleSelector
+      searchPlaceholder="Select new role..."
+      roles={roles}
+      onSelect={role => {
+        props.onSelectRoleId(role.id);
+      }}
+      defaultRole={memberRole}
+      disabled={!canAssignRole}
+      isRoleActive={role => {
+        const isCurrentRole = role.id === member.id;
+        if (isCurrentRole) {
+          return {
+            active: false,
+            reason: 'This is the current role',
+          };
+        }
+
+        return {
+          active: true,
+        };
+      }}
+    />
+  );
+}
diff --git a/packages/web/app/src/components/organization/members/resource-selector.tsx b/packages/web/app/src/components/organization/members/resource-selector.tsx
new file mode 100644
index 0000000000..35a7fff792
--- /dev/null
+++ b/packages/web/app/src/components/organization/members/resource-selector.tsx
@@ -0,0 +1,767 @@
+import { useMemo, useState } from 'react';
+import { produce } from 'immer';
+import { ChevronRightIcon, XIcon } from 'lucide-react';
+import { useQuery } from 'urql';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
+import { graphql, useFragment, type FragmentType } from '@/gql';
+import { ProjectType } from '@/gql/graphql';
+import { cn } from '@/lib/utils';
+
+export type ResourceSelection = {
+  projects:
+    | '*'
+    | Array<{
+        id: string;
+        slug: string;
+        targets:
+          | '*'
+          | Array<{
+              id: string;
+              slug: string;
+              appDeployments: '*' | Array<string>;
+              services: '*' | Array<string>;
+            }>;
+      }>;
+};
+
+const ResourceSelector_OrganizationFragment = graphql(`
+  fragment ResourceSelector_OrganizationFragment on Organization {
+    id
+    slug
+    projects {
+      nodes {
+        id
+        slug
+        type
+      }
+    }
+  }
+`);
+
+const ResourceSelector_OrganizationProjectTargestQuery = graphql(`
+  query ResourceSelector_OrganizationProjectTargestQuery(
+    $organizationSlug: String!
+    $projectSlug: String!
+  ) {
+    organization: organizationBySlug(organizationSlug: $organizationSlug) {
+      id
+      project: projectBySlug(projectSlug: $projectSlug) {
+        id
+        type
+        targets {
+          nodes {
+            id
+            slug
+          }
+        }
+      }
+    }
+  }
+`);
+
+const ResourceSelector_OrganizationProjectTargetQuery = graphql(`
+  query ResourceSelector_OrganizationProjectTargetQuery(
+    $organizationSlug: String!
+    $projectSlug: String!
+    $targetSlug: String!
+  ) {
+    organization: organizationBySlug(organizationSlug: $organizationSlug) {
+      id
+      project: projectBySlug(projectSlug: $projectSlug) {
+        id
+        type
+        targets {
+          nodes {
+            id
+            slug
+          }
+        }
+        target: targetBySlug(targetSlug: $targetSlug) {
+          id
+          latestValidSchemaVersion {
+            id
+            schemas {
+              nodes {
+                ... on CompositeSchema {
+                  id
+                  service
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`);
+
+export function ResourceSelector(props: {
+  organization: FragmentType<typeof ResourceSelector_OrganizationFragment>;
+  selection: ResourceSelection;
+  onSelectionChange: (selection: ResourceSelection) => void;
+}) {
+  const organization = useFragment(ResourceSelector_OrganizationFragment, props.organization);
+  const [breadcrumb, setBreadcrumb] = useState(
+    null as
+      | null
+      | { projectId: string; targetId?: undefined }
+      | { projectId: string; targetId: string },
+  );
+
+  const projectState = useMemo(() => {
+    if (props.selection.projects === '*') {
+      return null;
+    }
+
+    type SelectedItem = {
+      project: (typeof organization.projects.nodes)[number];
+      projectSelection: (typeof props.selection.projects)[number];
+    };
+
+    type NotSelectedItem = (typeof organization.projects.nodes)[number];
+
+    const selectedProjects: Array<SelectedItem> = [];
+    const notSelectedProjects: Array<NotSelectedItem> = [];
+
+    let activeProject: null | {
+      project: (typeof organization.projects.nodes)[number];
+      projectSelection: (typeof props.selection.projects)[number];
+    } = null;
+
+    for (const project of organization.projects.nodes) {
+      const projectSelection = props.selection.projects.find(item => item.id === project.id);
+
+      if (projectSelection) {
+        selectedProjects.push({ project, projectSelection });
+
+        if (breadcrumb?.projectId === project.id) {
+          activeProject = { project, projectSelection };
+        }
+
+        continue;
+      }
+
+      notSelectedProjects.push(project);
+    }
+
+    return {
+      selected: selectedProjects,
+      notSelected: notSelectedProjects,
+      activeProject,
+      addProject(item: (typeof organization.projects.nodes)[number]) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') {
+              return;
+            }
+
+            state.projects.push({
+              id: item.id,
+              slug: item.slug,
+              targets: [],
+            });
+          }),
+        );
+      },
+      removeProject(item: (typeof organization.projects.nodes)[number]) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') {
+              return;
+            }
+            state.projects = state.projects.filter(project => project.id !== item.id);
+          }),
+        );
+        setBreadcrumb(breadcrumb => {
+          if (breadcrumb?.projectId === item.id) {
+            return null;
+          }
+          return breadcrumb;
+        });
+      },
+    };
+  }, [organization.projects.nodes, props.selection, breadcrumb?.projectId]);
+
+  const [organizationProjectTargets] = useQuery({
+    query: ResourceSelector_OrganizationProjectTargestQuery,
+    pause: !projectState?.activeProject,
+    variables: {
+      organizationSlug: organization.slug,
+      projectSlug: projectState?.activeProject?.project.slug ?? '',
+    },
+  });
+
+  const targetState = useMemo(() => {
+    if (
+      !organizationProjectTargets?.data?.organization?.project?.targets?.nodes ||
+      !projectState?.activeProject
+    ) {
+      return null;
+    }
+
+    const projectId = projectState.activeProject.project.id;
+
+    if (projectState.activeProject.projectSelection.targets === '*') {
+      return {
+        selection: '*',
+        setGranular() {
+          props.onSelectionChange(
+            produce(props.selection, state => {
+              if (state.projects === '*') return;
+
+              const project = state.projects.find(project => project.id === projectId);
+              if (!project) return;
+
+              project.targets = [];
+            }),
+          );
+        },
+      } as const;
+    }
+
+    type SelectedItem = {
+      target: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number];
+      targetSelection: (typeof projectState.activeProject.projectSelection.targets)[number];
+    };
+
+    type NotSelectedItem =
+      (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number];
+
+    const selected: Array<SelectedItem> = [];
+    const notSelected: Array<NotSelectedItem> = [];
+
+    let activeTarget: null | {
+      targetSelection: (typeof projectState.activeProject.projectSelection.targets)[number];
+      target: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number];
+    } = null;
+
+    for (const target of organizationProjectTargets.data.organization.project.targets.nodes) {
+      const targetSelection = projectState.activeProject.projectSelection.targets.find(
+        item => item.id === target.id,
+      );
+
+      if (targetSelection) {
+        selected.push({ target, targetSelection });
+
+        if (breadcrumb?.targetId === target.id) {
+          activeTarget = {
+            targetSelection,
+            target,
+          };
+        }
+        continue;
+      }
+
+      notSelected.push(target);
+    }
+
+    return {
+      selection: {
+        selected,
+        notSelected,
+      },
+      activeTarget,
+      activeProject: projectState.activeProject,
+      addTarget(
+        item: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number],
+      ) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project) return;
+            if (project.targets === '*') return;
+            project.targets.push({
+              id: item.id,
+              slug: item.slug,
+              appDeployments: [],
+              services: [],
+            });
+          }),
+        );
+      },
+      removeTarget(
+        item: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number],
+      ) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project) return;
+            if (project.targets === '*') return;
+            project.targets = project.targets.filter(target => target.id !== item.id);
+          }),
+        );
+        setBreadcrumb(breadcrumb => {
+          if (breadcrumb?.targetId === item.id) {
+            return {
+              ...breadcrumb,
+              targetId: undefined,
+            };
+          }
+          return breadcrumb;
+        });
+      },
+      setAll() {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project) return;
+            project.targets = '*';
+          }),
+        );
+        setBreadcrumb({ projectId });
+      },
+    };
+  }, [
+    projectState?.activeProject,
+    organizationProjectTargets?.data?.organization?.project?.targets?.nodes,
+    breadcrumb?.targetId,
+  ]);
+
+  const [organizationProjectTarget] = useQuery({
+    query: ResourceSelector_OrganizationProjectTargetQuery,
+    pause: !targetState?.activeTarget || !projectState?.activeProject,
+    variables: {
+      organizationSlug: organization.slug,
+      projectSlug: projectState?.activeProject?.project.slug ?? '',
+      targetSlug: targetState?.activeTarget?.target?.slug ?? '',
+    },
+  });
+
+  const serviceState = useMemo(() => {
+    if (
+      !projectState?.activeProject ||
+      !targetState?.activeTarget ||
+      !breadcrumb?.targetId ||
+      /* breadcrumb.mode !== 'service' || */
+      !organizationProjectTarget.data?.organization?.project
+    ) {
+      return null;
+    }
+
+    if (organizationProjectTarget.data.organization.project.type === ProjectType.Single) {
+      return 'none' as const;
+    }
+
+    const projectId = projectState.activeProject.projectSelection.id;
+    const targetId = targetState.activeTarget.targetSelection.id;
+
+    if (targetState.activeTarget.targetSelection.services === '*') {
+      return {
+        selection: '*' as const,
+        setGranular() {
+          props.onSelectionChange(
+            produce(props.selection, state => {
+              if (state.projects === '*') return;
+              const project = state.projects.find(project => project.id === projectId);
+              if (!project || project.targets === '*') return;
+              const target = project.targets.find(target => target.id === targetId);
+              if (!target) return;
+              target.services = [];
+            }),
+          );
+        },
+      };
+    }
+
+    const selectedServices: Array<string> = [...targetState.activeTarget.targetSelection.services];
+    const notSelectedServices: Array<string> = [];
+
+    if (
+      organizationProjectTarget.data.organization.project.target?.latestValidSchemaVersion?.schemas
+    ) {
+      for (const schema of organizationProjectTarget.data.organization.project.target
+        .latestValidSchemaVersion.schemas.nodes) {
+        if (
+          schema.__typename === 'CompositeSchema' &&
+          schema.service &&
+          !selectedServices.find(serviceName => serviceName === schema.service)
+        ) {
+          notSelectedServices.push(schema.service);
+        }
+      }
+    }
+
+    return {
+      selection: {
+        selected: selectedServices,
+        notSelected: notSelectedServices,
+      },
+      setAll() {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project || project.targets === '*') return;
+            const target = project.targets.find(target => target.id === targetId);
+            if (!target) return;
+            target.services = '*';
+          }),
+        );
+      },
+      addService(serviceName: string) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project || project.targets === '*') return;
+            const target = project.targets.find(target => target.id === targetId);
+            if (
+              !target ||
+              target.services === '*' ||
+              target.services.find(service => service === serviceName)
+            ) {
+              return;
+            }
+
+            target.services.push(serviceName);
+          }),
+        );
+      },
+      removeService(serviceName: string) {
+        props.onSelectionChange(
+          produce(props.selection, state => {
+            if (state.projects === '*') return;
+            const project = state.projects.find(project => project.id === projectId);
+            if (!project || project.targets === '*') return;
+            const target = project.targets.find(target => target.id === targetId);
+            if (!target || target.services === '*') {
+              return;
+            }
+            target.services = target.services.filter(name => name !== serviceName);
+          }),
+        );
+      },
+    };
+  }, [targetState?.activeTarget, breadcrumb, projectState?.activeProject]);
+
+  return (
+    <Tabs defaultValue="granular" value={props.selection.projects === '*' ? 'full' : 'granular'}>
+      <TabsList variant="content" className="mt-1">
+        <TabsTrigger
+          variant="content"
+          value="full"
+          onClick={() => {
+            props.onSelectionChange({ projects: '*' });
+            setBreadcrumb(null);
+          }}
+        >
+          Full Access
+        </TabsTrigger>
+        <TabsTrigger
+          variant="content"
+          value="granular"
+          onClick={() => {
+            props.onSelectionChange({ projects: [] });
+          }}
+        >
+          Granular Access
+        </TabsTrigger>
+      </TabsList>
+      <TabsContent value="full" variant="content">
+        <p className="text-muted-foreground text-sm">
+          Grant permissions on all resources within the organization.
+        </p>
+      </TabsContent>
+      <TabsContent value="granular" variant="content">
+        {projectState && (
+          <>
+            <p className="text-muted-foreground mb-4 text-sm">
+              Grant permissions on the selected resources.
+            </p>
+            <div>
+              <div className="flex text-sm">
+                <div className="flex-1 rounded-tl-sm border-l border-t border-transparent border-l-inherit border-t-inherit px-2 py-1 font-bold">
+                  Projects
+                </div>
+                <div className="flex flex-1 items-baseline border-l border-t border-transparent border-l-inherit border-t-inherit px-2 py-1">
+                  <div className="font-bold">Targets</div>
+                  {targetState && (
+                    <div className="ml-auto text-xs">
+                      <button
+                        className={cn(targetState.selection !== '*' && 'text-orange-500')}
+                        onClick={targetState.setGranular}
+                      >
+                        Select
+                      </button>
+                      {' / '}
+                      <button
+                        className={cn(targetState.selection === '*' && 'text-orange-500')}
+                        onClick={targetState.setAll}
+                      >
+                        All
+                      </button>
+                    </div>
+                  )}
+                </div>
+                <div className="flex flex-1 items-baseline rounded-tr-sm border-x border-t border-transparent border-x-inherit border-t-inherit px-2 py-1">
+                  <span className="font-bold">Services</span>
+                  {serviceState && serviceState !== 'none' && (
+                    <div className="ml-auto text-xs">
+                      <button
+                        className={cn(serviceState.selection !== '*' && 'text-orange-500')}
+                        onClick={serviceState.setGranular}
+                      >
+                        Select
+                      </button>
+                      {' / '}
+                      <button
+                        className={cn('mr-1', serviceState.selection === '*' && 'text-orange-500')}
+                        onClick={serviceState.setAll}
+                      >
+                        All
+                      </button>
+                    </div>
+                  )}
+                </div>
+              </div>
+              <div className="mt-0 flex min-h-[250px] flex-wrap rounded-sm">
+                <div className="flex flex-1 flex-col border pt-2">
+                  <div className="text-muted-foreground mb-1 px-2 text-xs uppercase">
+                    access granted
+                  </div>
+                  {projectState.selected.length ? (
+                    projectState.selected.map(selection => (
+                      <RowItem
+                        key={selection.project.id}
+                        title={
+                          selection.project.slug +
+                          (selection.projectSelection.targets === '*'
+                            ? ' (all targets, all services)'
+                            : ` (${selection.projectSelection.targets.length} target${selection.projectSelection.targets.length === 1 ? '' : 's'})`)
+                        }
+                        isActive={projectState.activeProject?.project.id === selection.project.id}
+                        onClick={() => {
+                          setBreadcrumb({ projectId: selection.project.id });
+                        }}
+                        onDelete={() => projectState.removeProject(selection.project)}
+                      />
+                    ))
+                  ) : (
+                    <div className="px-2 text-xs">None selected</div>
+                  )}
+                  <div className="text-muted-foreground mb-1 mt-3 px-2 text-xs uppercase">
+                    not selected
+                  </div>
+                  {projectState.notSelected.length ? (
+                    projectState.notSelected.map(project => (
+                      <RowItem
+                        key={project.id}
+                        title={project.slug}
+                        isActive={breadcrumb?.projectId === project.id}
+                        onClick={() => projectState.addProject(project)}
+                      />
+                    ))
+                  ) : (
+                    <div className="px-2 text-xs">All selected</div>
+                  )}
+                </div>
+
+                <div className="flex flex-1 flex-col border-y border-r pt-2">
+                  {targetState === null ? (
+                    <div className="text-muted-foreground px-2 text-sm">
+                      Select a project for adjusting the target access.
+                    </div>
+                  ) : (
+                    <>
+                      {targetState.selection === '*' ? (
+                        <div className="text-muted-foreground px-2 text-xs">
+                          Access to all targets of project granted.
+                        </div>
+                      ) : (
+                        <>
+                          <div className="text-muted-foreground mb-1 px-2 text-xs uppercase">
+                            access granted
+                          </div>
+                          {targetState.selection.selected.length ? (
+                            targetState.selection.selected.map(selection => (
+                              <RowItem
+                                key={selection.target.id}
+                                title={
+                                  selection.target.slug +
+                                  (targetState.activeProject.project.type === ProjectType.Single
+                                    ? ' (full access)'
+                                    : selection.targetSelection.services === '*'
+                                      ? ' (all services)'
+                                      : ` (${selection.targetSelection.services.length} service${selection.targetSelection.services.length === 1 ? '' : 's'})`)
+                                }
+                                isActive={
+                                  targetState.activeTarget?.target.id === selection.target.id
+                                }
+                                onClick={() => {
+                                  setBreadcrumb({
+                                    projectId: targetState.activeProject.project.id,
+                                    targetId: selection.target.id,
+                                  });
+                                }}
+                                onDelete={() => {
+                                  targetState.removeTarget(selection.target);
+                                }}
+                              />
+                            ))
+                          ) : (
+                            <div className="px-2 text-xs">None selected</div>
+                          )}
+                          <div className="text-muted-foreground mb-1 mt-3 px-2 text-xs uppercase">
+                            Not selected
+                          </div>
+                          {targetState.selection.notSelected.length ? (
+                            targetState.selection.notSelected.map(target => (
+                              <RowItem
+                                key={target.id}
+                                title={target.slug}
+                                isActive={
+                                  false /* state.breadcrumb?.target?.targetId === target.id */
+                                }
+                                onClick={() => targetState.addTarget(target)}
+                              />
+                            ))
+                          ) : (
+                            <div className="px-2 text-xs">All selected</div>
+                          )}
+                        </>
+                      )}
+                    </>
+                  )}
+                </div>
+                <div className="flex flex-1 flex-col border-y border-r pt-2">
+                  {projectState.activeProject?.projectSelection.targets === '*' ? (
+                    <div className="text-muted-foreground px-2 text-xs">
+                      Access to all services of projects targets granted.
+                    </div>
+                  ) : serviceState === null ? (
+                    <div className="text-muted-foreground px-2 text-xs">
+                      Select a target for adjusting the service access.
+                    </div>
+                  ) : (
+                    <>
+                      {serviceState === 'none' ? (
+                        <div className="text-muted-foreground text-xs">
+                          Project is monolithic and has no services.
+                        </div>
+                      ) : serviceState.selection === '*' ? (
+                        <div className="text-muted-foreground px-2 text-xs">
+                          Access to all services in target granted.
+                        </div>
+                      ) : (
+                        <>
+                          <div className="text-muted-foreground mb-1 px-2 text-xs uppercase">
+                            access granted
+                          </div>
+                          {serviceState.selection.selected.length ? (
+                            serviceState.selection.selected.map(serviceName => (
+                              <RowItem
+                                key={serviceName}
+                                title={serviceName}
+                                isActive={false}
+                                onDelete={() => serviceState.removeService(serviceName)}
+                              />
+                            ))
+                          ) : (
+                            <div className="px-2 text-xs">None</div>
+                          )}
+                          <div className="text-muted-foreground mb-1 mt-3 px-2 text-xs uppercase">
+                            Not selected
+                          </div>
+                          {serviceState.selection.notSelected.map(serviceName => (
+                            <RowItem
+                              key={serviceName}
+                              title={serviceName}
+                              isActive={false}
+                              onClick={() => serviceState.addService(serviceName)}
+                            />
+                          ))}
+                          <form
+                            onSubmit={ev => {
+                              ev.preventDefault();
+                              const input: HTMLInputElement = ev.currentTarget.serviceName;
+                              const serviceName = input.value.trim().toLowerCase();
+
+                              if (!serviceName) {
+                                return;
+                              }
+
+                              serviceState.addService(serviceName);
+                              input.value = '';
+                            }}
+                          >
+                            <input
+                              placeholder="Add service by name"
+                              className="mx-2 mt-1 max-w-[70%] border-b text-sm"
+                              name="serviceName"
+                            />
+                          </form>
+                        </>
+                      )}
+                    </>
+                  )}
+                </div>
+              </div>
+            </div>
+            <div className="flex h-5 items-center text-sm">
+              {projectState.activeProject && (
+                <>
+                  <button
+                    onClick={() =>
+                      projectState.activeProject &&
+                      setBreadcrumb({ projectId: projectState.activeProject.project.id })
+                    }
+                  >
+                    {projectState.activeProject.project.slug}
+                  </button>{' '}
+                  {targetState?.activeTarget && (
+                    <>
+                      <ChevronRightIcon size="14" /> {targetState.activeTarget.target.slug}
+                    </>
+                  )}
+                </>
+              )}
+            </div>
+          </>
+        )}
+      </TabsContent>
+    </Tabs>
+  );
+}
+
+function RowItem(props: {
+  title: string;
+  isActive?: boolean;
+  onClick?: () => void;
+  onDelete?: () => void;
+}) {
+  return (
+    <div
+      className="flex cursor-pointer items-center space-x-1 px-2 py-1 data-[active=true]:cursor-default data-[active=true]:bg-gray-200 data-[active=true]:text-black"
+      data-active={props.isActive}
+    >
+      <span className="grow text-sm" onClick={props.onClick}>
+        {props.title} {props.isActive && <ChevronRightIcon size={12} className="inline" />}
+      </span>
+
+      {props.onDelete && (
+        <TooltipProvider>
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <button
+                onClick={() => {
+                  props.onDelete?.();
+                }}
+              >
+                <XIcon
+                  size={12}
+                  data-active={props.isActive}
+                  className="text-muted-foreground data-[active=true]:text-secondary"
+                />
+              </button>
+            </TooltipTrigger>
+            <TooltipContent>Remove</TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      )}
+    </div>
+  );
+}

From 650c1cdbed73d17997a05fea42c4da7415d3ce24 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 24 Jan 2025 12:09:33 +0100
Subject: [PATCH 41/55] use sheet instead of dialog

---
 .../components/organization/members/list.tsx  | 27 ++++----
 .../members/member-role-picker.tsx            | 62 ++++++++++++++-----
 .../members/resource-selector.tsx             |  8 +--
 .../members/selected-permission-overview.tsx  |  6 +-
 4 files changed, 67 insertions(+), 36 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index 5305ccd8d4..461d7bbf3e 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -23,6 +23,7 @@ import {
 } from '@/components/ui/dropdown-menu';
 import { Link } from '@/components/ui/link';
 import { SubPageLayout, SubPageLayoutHeader } from '@/components/ui/page-content-layout';
+import * as Sheet from '@/components/ui/sheet';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
@@ -256,25 +257,23 @@ function MemberRole(props: {
         ' (all resources)'
       ) : member.resourceAssignment.projects?.length ? (
         <>
-          {'(' + member.resourceAssignment.projects.length} project
+          {' (' + member.resourceAssignment.projects.length} project
           {member.resourceAssignment.projects.length === 1 ? '' : 's'})
         </>
       ) : null}{' '}
       {organization.viewerCanAssignUserRoles && (
-        <Dialog open={isOpen} onOpenChange={isOpen => setIsOpen(isOpen)}>
-          <DialogTrigger asChild>
+        <Sheet.Sheet open={isOpen} onOpenChange={isOpen => setIsOpen(isOpen)}>
+          <Sheet.SheetTrigger asChild>
             <Link>change</Link>
-          </DialogTrigger>
-          <DialogContent className="min-w-[800px]">
-            {isOpen && (
-              <MemberRolePicker
-                organization={organization}
-                member={member}
-                close={() => setIsOpen(false)}
-              />
-            )}
-          </DialogContent>
-        </Dialog>
+          </Sheet.SheetTrigger>
+          {isOpen && (
+            <MemberRolePicker
+              organization={organization}
+              member={member}
+              close={() => setIsOpen(false)}
+            />
+          )}
+        </Sheet.Sheet>
       )}
     </>
   );
diff --git a/packages/web/app/src/components/organization/members/member-role-picker.tsx b/packages/web/app/src/components/organization/members/member-role-picker.tsx
index 9fcf8fed8e..f847aee36c 100644
--- a/packages/web/app/src/components/organization/members/member-role-picker.tsx
+++ b/packages/web/app/src/components/organization/members/member-role-picker.tsx
@@ -1,19 +1,26 @@
 import { useState } from 'react';
 import { useMutation } from 'urql';
 import { Button } from '@/components/ui/button';
-import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { Heading } from '@/components/ui/heading';
+import * as Sheet from '@/components/ui/sheet';
 import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
 import * as GraphQLSchema from '@/gql/graphql';
 import { MemberRoleSelector } from './member-role-selector';
 import { ResourceSelector, type ResourceSelection } from './resource-selector';
+import { SelectedPermissionOverview } from './selected-permission-overview';
 
 const MemberRolePicker_OrganizationFragment = graphql(`
   fragment MemberRolePicker_OrganizationFragment on Organization {
     id
     slug
+    memberRoles {
+      id
+      permissions
+    }
     ...ResourceSelector_OrganizationFragment
     ...MemberRoleSelector_OrganizationFragment
+    ...SelectedPermissionOverview_OrganizationFragment
   }
 `);
 
@@ -121,35 +128,58 @@ export function MemberRolePicker(props: {
   const [assignRoleState, assignRole] = useMutation(MemberRolePicker_AssignRoleMutation);
   const { toast } = useToast();
 
+  const selectedRole = organization.memberRoles?.find(role => role.id === selectedRoleId) ?? null;
+
   return (
-    <>
-      <DialogHeader>
-        <DialogTitle>
+    <Sheet.SheetContent className="flex max-h-screen min-w-[800px] flex-col overflow-y-scroll">
+      <Sheet.SheetHeader>
+        <Sheet.SheetTitle>
           Assign Member Role for {member.user.displayName} ({member.user.email})
-        </DialogTitle>
-        <DialogDescription>
+        </Sheet.SheetTitle>
+        <Sheet.SheetDescription>
           A member can be granted permissions by attaching a member role. The access to the
           resources within the project can further be restricted.
-        </DialogDescription>
-      </DialogHeader>
-      <div>
-        <div className="mb-1 text-sm font-bold">Member Role</div>
+        </Sheet.SheetDescription>
+      </Sheet.SheetHeader>
+      <div className="pt-2">
+        <Heading size="lg" className="mb-1 text-sm">
+          Assigned Member Role
+        </Heading>
         <MemberRoleSelector
           organization={organization}
           member={member}
           selectedRoleId={selectedRoleId}
           onSelectRoleId={roleId => setSelectedRoleId(roleId)}
         />
+        <p className="text-muted-foreground mt-2 text-sm">
+          The role assigned to the user that will grant permissions.
+        </p>
+        {selectedRole && (
+          <SelectedPermissionOverview
+            showOnlyAllowedPermissions
+            organization={organization}
+            activePermissionIds={selectedRole.permissions}
+            isExpanded={false}
+          />
+        )}
       </div>
-      <div>
-        <div className="mb-1 text-sm font-bold">Resources</div>
+      <div className="pt-10">
+        <Heading size="lg" className="mb-1 text-sm">
+          Assigned Resources
+        </Heading>
+        <p className="text-muted-foreground mt-2 text-sm">
+          Specify the resources on which the permissions will be granted.
+        </p>
         <ResourceSelector
           selection={selection}
           onSelectionChange={setSelection}
           organization={organization}
         />
       </div>
-      <DialogFooter>
+      <Sheet.SheetFooter className="mb-0 mt-auto">
+        <Button onClick={props.close} variant="ghost">
+          Abort
+        </Button>
         <Button
           disabled={assignRoleState.fetching}
           onClick={async () => {
@@ -191,10 +221,10 @@ export function MemberRolePicker(props: {
             }
           }}
         >
-          {assignRoleState.fetching ? 'Loading...' : 'Confirm'}
+          {assignRoleState.fetching ? 'Loading...' : 'Assign Role to user'}
         </Button>
-      </DialogFooter>
-    </>
+      </Sheet.SheetFooter>
+    </Sheet.SheetContent>
   );
 }
 
diff --git a/packages/web/app/src/components/organization/members/resource-selector.tsx b/packages/web/app/src/components/organization/members/resource-selector.tsx
index 35a7fff792..6933218dab 100644
--- a/packages/web/app/src/components/organization/members/resource-selector.tsx
+++ b/packages/web/app/src/components/organization/members/resource-selector.tsx
@@ -462,16 +462,14 @@ export function ResourceSelector(props: {
         </TabsTrigger>
       </TabsList>
       <TabsContent value="full" variant="content">
-        <p className="text-muted-foreground text-sm">
-          Grant permissions on all resources within the organization.
+        <p className="text-sm">
+          The permissions are granted on all projects, targets and services within the organization.
         </p>
       </TabsContent>
       <TabsContent value="granular" variant="content">
         {projectState && (
           <>
-            <p className="text-muted-foreground mb-4 text-sm">
-              Grant permissions on the selected resources.
-            </p>
+            <p className="mb-4 text-sm">The permissions are granted on the specified resources.</p>
             <div>
               <div className="flex text-sm">
                 <div className="flex-1 rounded-tl-sm border-l border-t border-transparent border-l-inherit border-t-inherit px-2 py-1 font-bold">
diff --git a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
index fa00d2d44b..f21e8a7690 100644
--- a/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
+++ b/packages/web/app/src/components/organization/members/selected-permission-overview.tsx
@@ -34,6 +34,8 @@ export type SelectedPermissionOverviewProps = {
   organization: FragmentType<typeof SelectedPermissionOverview_OrganizationFragment>;
   activePermissionIds: Array<string>;
   showOnlyAllowedPermissions: boolean;
+  /** default: true */
+  isExpanded?: boolean;
 };
 
 export function SelectedPermissionOverview(props: SelectedPermissionOverviewProps) {
@@ -72,6 +74,7 @@ export function SelectedPermissionOverview(props: SelectedPermissionOverviewProp
       activePermissionIds={activePermissionIds}
       memberPermissionGroups={organization.availableMemberPermissionGroups}
       showOnlyAllowedPermissions={props.showOnlyAllowedPermissions}
+      isExpanded={props.isExpanded ?? true}
     />
   ));
 }
@@ -89,6 +92,7 @@ function PermissionLevelGroup(props: {
   activePermissionIds: ReadonlySet<string>;
   /** whether only allowed permissions should be shown */
   showOnlyAllowedPermissions: boolean;
+  isExpanded: boolean;
 }) {
   const [filteredGroups, totalAllowedCount] = useMemo(() => {
     let totalAllowedCount = 0;
@@ -136,7 +140,7 @@ function PermissionLevelGroup(props: {
   return (
     <Accordion
       type="single"
-      defaultValue={totalAllowedCount > 0 ? props.title : undefined}
+      defaultValue={totalAllowedCount > 0 && props.isExpanded ? props.title : undefined}
       collapsible
     >
       <AccordionItem value={props.title}>

From 362ad5fa03fd33a531b9be666e006ce0cc73da5c Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 24 Jan 2025 15:34:57 +0100
Subject: [PATCH 42/55] make se;ection more user-friendly

---
 integration-tests/testkit/seed.ts             |   7 +-
 .../tests/api/project/crud.spec.ts            |   6 +-
 .../tests/api/schema/check.spec.ts            |  20 +-
 .../modules/organization/module.graphql.ts    | 111 ++++-----
 .../providers/organization-manager.ts         |   2 +-
 .../providers/organization-members.ts         | 225 ++++++++++--------
 .../components/organization/members/list.tsx  |  17 +-
 .../members/member-role-picker.tsx            |  94 +++-----
 .../members/resource-selector.tsx             | 222 ++++++++---------
 9 files changed, 355 insertions(+), 349 deletions(-)

diff --git a/integration-tests/testkit/seed.ts b/integration-tests/testkit/seed.ts
index 66ccbf8da5..a7cf737f07 100644
--- a/integration-tests/testkit/seed.ts
+++ b/integration-tests/testkit/seed.ts
@@ -807,7 +807,7 @@ export function initSeed() {
                   input: {
                     roleId: string;
                     userId: string;
-                    resouces?: GraphQLSchema.MemberResourceAssignmentInput;
+                    resouces?: GraphQLSchema.ResourceAssignmentInput;
                   },
                   options: { useMemberToken?: boolean } = {
                     useMemberToken: false,
@@ -818,7 +818,10 @@ export function initSeed() {
                       organizationSlug: organization.slug,
                       userId: input.userId,
                       roleId: input.roleId,
-                      resources: input.resouces ?? { allProjects: true },
+                      resources: input.resouces ?? {
+                        mode: GraphQLSchema.ResourceAssignmentMode.All,
+                        projects: [],
+                      },
                     },
                     options.useMemberToken ? memberToken : ownerToken,
                   ).then(r => r.expectNoGraphQLErrors());
diff --git a/integration-tests/tests/api/project/crud.spec.ts b/integration-tests/tests/api/project/crud.spec.ts
index 69385e0c6e..8c060b200a 100644
--- a/integration-tests/tests/api/project/crud.spec.ts
+++ b/integration-tests/tests/api/project/crud.spec.ts
@@ -1,4 +1,4 @@
-import { ProjectType } from 'testkit/gql/graphql';
+import { ProjectType, ResourceAssignmentMode } from 'testkit/gql/graphql';
 import { updateProjectSlug } from '../../../testkit/flow';
 import { initSeed } from '../../../testkit/seed';
 
@@ -217,6 +217,7 @@ test.concurrent('prevent access to projects with assigned resources on member',
     roleId: member.role.id,
     userId: member.user.id,
     resouces: {
+      mode: ResourceAssignmentMode.Granular,
       projects: [],
     },
   });
@@ -245,10 +246,11 @@ test.concurrent('restrict access to single project with assigned resources on me
     roleId: member.role.id,
     userId: member.user.id,
     resouces: {
+      mode: ResourceAssignmentMode.Granular,
       projects: [
         {
           projectId: firstProject.id,
-          targets: { allTargets: true },
+          targets: { mode: ResourceAssignmentMode.All },
         },
       ],
     },
diff --git a/integration-tests/tests/api/schema/check.spec.ts b/integration-tests/tests/api/schema/check.spec.ts
index bda7de42eb..67063c125b 100644
--- a/integration-tests/tests/api/schema/check.spec.ts
+++ b/integration-tests/tests/api/schema/check.spec.ts
@@ -1,4 +1,8 @@
-import { ProjectType, RuleInstanceSeverityLevel } from 'testkit/gql/graphql';
+import {
+  ProjectType,
+  ResourceAssignmentMode,
+  RuleInstanceSeverityLevel,
+} from 'testkit/gql/graphql';
 // eslint-disable-next-line import/no-extraneous-dependencies
 import { createStorage } from '@hive/storage';
 import { graphql } from '../../../testkit/gql';
@@ -1366,7 +1370,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: member.role.id,
       userId: member.user.id,
-      resouces: { projects: [] },
+      resouces: { mode: ResourceAssignmentMode.Granular, projects: [] },
     });
 
     // Attempt approving the failed schema check
@@ -1444,7 +1448,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: memberRole.id,
       userId: member.user.id,
-      resouces: { projects: [] },
+      resouces: { mode: ResourceAssignmentMode.Granular, projects: [] },
     });
 
     // Attempt approving the failed schema check
@@ -1518,17 +1522,19 @@ test.concurrent(
 
     // Setup Done: Create a failed schema check
 
-    // Create a member with no access to projects
+    // Create a member with no access to project targets
     const { member, createMemberRole, assignMemberRole, memberToken } = await inviteAndJoinMember();
     const memberRole = await createMemberRole(['schemaCheck:approve', 'project:describe']);
     await assignMemberRole({
       roleId: memberRole.id,
       userId: member.user.id,
       resouces: {
+        mode: ResourceAssignmentMode.Granular,
         projects: [
           {
             projectId: project.id,
             targets: {
+              mode: ResourceAssignmentMode.Granular,
               targets: [],
             },
           },
@@ -1612,15 +1618,17 @@ test.concurrent(
       roleId: memberRole.id,
       userId: member.user.id,
       resouces: {
+        mode: ResourceAssignmentMode.Granular,
         projects: [
           {
             projectId: project.id,
             targets: {
+              mode: ResourceAssignmentMode.Granular,
               targets: [
                 {
                   targetId: target.id,
-                  appDeployments: { allAppDeployments: true },
-                  services: { allServices: true },
+                  appDeployments: { mode: ResourceAssignmentMode.Granular, appDeployments: [] },
+                  services: { mode: ResourceAssignmentMode.Granular, services: [] },
                 },
               ],
             },
diff --git a/packages/services/api/src/modules/organization/module.graphql.ts b/packages/services/api/src/modules/organization/module.graphql.ts
index cb18039957..06852077e8 100644
--- a/packages/services/api/src/modules/organization/module.graphql.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.ts
@@ -424,7 +424,7 @@ export default gql`
     organizationSlug: String!
     userId: ID!
     roleId: ID!
-    resources: MemberResourceAssignmentInput!
+    resources: ResourceAssignmentInput!
   }
 
   type AssignMemberRoleOk {
@@ -450,135 +450,116 @@ export default gql`
     isOwner: Boolean!
     canLeaveOrganization: Boolean!
     role: MemberRole!
-    resourceAssignment: MemberResourceAssignment!
+    resourceAssignment: ResourceAssignment!
     """
     Whether the viewer can remove this member from the organization.
     """
     viewerCanRemove: Boolean!
   }
 
+  enum ResourceAssignmentMode {
+    all
+    granular
+  }
+
   type MemberConnection {
     nodes: [Member!]!
     total: Int!
   }
 
-  input MemberAppDeploymentAssignmentInput {
+  input AppDeploymentResourceAssignmentInput {
     appDeployment: String!
   }
 
-  """
-  @oneOf
-  """
-  input MemberTargetAppDeploymentsAssignmentInput {
+  input TargetAppDeploymentsResourceAssignmentInput {
     """
     Whether the permissions should apply for all app deployments within the target.
     """
-    allAppDeployments: Boolean
+    mode: ResourceAssignmentMode!
     """
     Specific app deployments within the target for which the permissions should be applied.
     """
-    appDeployments: [MemberAppDeploymentAssignmentInput!]
+    appDeployments: [AppDeploymentResourceAssignmentInput!]
   }
 
-  input MemberServiceAssignmentInput {
+  input ServiceResourceAssignmentInput {
     serviceName: String!
   }
 
-  """
-  @oneOf
-  """
-  input MemberTargetServicesAssignmentInput {
+  input TargetServicesResourceAssignmentInput {
     """
-    Whether the permissions should apply for all services within the target.
+    Whether the permissions should apply for all services within the target or only selected ones.
     """
-    allServices: Boolean
+    mode: ResourceAssignmentMode!
     """
     Specific services within the target for which the permissions should be applied.
     """
-    services: [MemberServiceAssignmentInput!]
+    services: [ServiceResourceAssignmentInput!]
   }
 
-  input MemberTargetAssignmentInput {
+  input TargetResourceAssignmentInput {
     targetId: ID!
-    services: MemberTargetServicesAssignmentInput!
-    appDeployments: MemberTargetAppDeploymentsAssignmentInput!
+    services: TargetServicesResourceAssignmentInput!
+    appDeployments: TargetAppDeploymentsResourceAssignmentInput!
   }
 
-  """
-  @oneOf
-  """
-  input MemberProjectTargetsAssignmentInput {
+  input ProjectTargetsResourceAssignmentInput {
     """
-    Whether the permissions should apply for all targets within the project.
+    Whether the permissions should apply for all targets within the project or only selected ones.
     """
-    allTargets: Boolean
+    mode: ResourceAssignmentMode!
     """
     Specific targets within the projects for which the permissions should be applied.
     """
-    targets: [MemberTargetAssignmentInput!]
+    targets: [TargetResourceAssignmentInput!]
   }
 
-  input MemberProjectAssignmentInput {
+  input ProjectResourceAssignmentInput {
     projectId: ID!
-    targets: MemberProjectTargetsAssignmentInput!
+    targets: ProjectTargetsResourceAssignmentInput!
   }
 
-  """
-  @oneOf
-  """
-  input MemberResourceAssignmentInput {
+  input ResourceAssignmentInput {
     """
-    Whether the permissions should apply for all projects within the organization.
+    Whether the permissions should apply for all projects within the organization or only selected ones.
     """
-    allProjects: Boolean
+    mode: ResourceAssignmentMode!
     """
     Specific projects within the organization for which the permissions should be applied.
     """
-    projects: [MemberProjectAssignmentInput!]
+    projects: [ProjectResourceAssignmentInput!]
   }
 
-  """
-  @oneOf
-  """
-  type MemberTargetServicesAssignment {
-    allServices: Boolean
-    services: [String!]
+  type TargetServicesResourceAssignment {
+    mode: ResourceAssignmentMode!
+    services: [String!]!
   }
 
-  """
-  @oneOf
-  """
-  type MemberTargetAppDeploymentAssignment {
-    allAppDeployments: Boolean
-    appDeployments: [String!]
+  type TargetAppDeploymentsResourceAssignment {
+    mode: ResourceAssignmentMode!
+    appDeployments: [String!]!
   }
 
-  type MemberTargetAssignment {
+  type TargetResouceAssignment {
     targetId: ID!
     target: Target!
-    services: MemberTargetServicesAssignment!
-    appDeployments: MemberTargetAppDeploymentAssignment!
+    services: TargetServicesResourceAssignment!
+    appDeployments: TargetAppDeploymentsResourceAssignment!
   }
 
-  """
-  @oneOf
-  """
-  type MemberProjectTargetsAssignment {
-    allTargets: Boolean
-    targets: [MemberTargetAssignment!]
+  type ProjectTargetsResourceAssignment {
+    mode: ResourceAssignmentMode!
+    targets: [TargetResouceAssignment!]
   }
 
-  type MemberProjectAssignment {
+  type ProjectResourceAssignment {
     projectId: ID!
     project: Project!
-    targets: MemberProjectTargetsAssignment!
+    targets: ProjectTargetsResourceAssignment!
   }
 
-  """
-  @oneOf
-  """
-  type MemberResourceAssignment {
-    allProjects: Boolean
-    projects: [MemberProjectAssignment!]
+  type ResourceAssignment {
+    mode: ResourceAssignmentMode!
+    projects: [ProjectResourceAssignment!]
   }
 `;
diff --git a/packages/services/api/src/modules/organization/providers/organization-manager.ts b/packages/services/api/src/modules/organization/providers/organization-manager.ts
index 65852c7b24..ed1c503bc2 100644
--- a/packages/services/api/src/modules/organization/providers/organization-manager.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-manager.ts
@@ -986,7 +986,7 @@ export class OrganizationManager {
     organizationSlug: string;
     userId: string;
     roleId: string;
-    resources: GraphQLSchema.MemberResourceAssignmentInput;
+    resources: GraphQLSchema.ResourceAssignmentInput;
   }) {
     const organizationId = await this.idTranslator.translateOrganizationId(input);
 
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 849c801473..e33c54e460 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -10,6 +10,9 @@ import { Storage } from '../../shared/providers/storage';
 import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
 
 const WildcardAssignmentModel = z.literal('*');
+const GranularAssignmentModel = z.literal('granular');
+
+const SelectionModeModel = z.union([WildcardAssignmentModel, GranularAssignmentModel]);
 
 const AppDeploymentAssignmentModel = z.object({
   type: z.literal('appDeployment'),
@@ -18,17 +21,44 @@ const AppDeploymentAssignmentModel = z.object({
 
 const ServiceAssignmentModel = z.object({ type: z.literal('service'), serviceName: z.string() });
 
+const AssignedServicesModel = z.object({
+  mode: SelectionModeModel,
+  services: z
+    .array(ServiceAssignmentModel)
+    .optional()
+    .nullable()
+    .transform(value => value ?? []),
+});
+
+const AssignedAppDeploymentsModel = z.object({
+  mode: SelectionModeModel,
+  appDeployments: z
+    .array(AppDeploymentAssignmentModel)
+    .optional()
+    .nullable()
+    .transform(value => value ?? []),
+});
+
 const TargetAssignmentModel = z.object({
   type: z.literal('target'),
   id: z.string().uuid(),
-  services: z.union([WildcardAssignmentModel, z.array(ServiceAssignmentModel)]),
-  appDeployments: z.union([WildcardAssignmentModel, z.array(AppDeploymentAssignmentModel)]),
+  services: AssignedServicesModel,
+  appDeployments: AssignedAppDeploymentsModel,
+});
+
+const AssignedTargetsModel = z.object({
+  mode: SelectionModeModel,
+  targets: z
+    .array(TargetAssignmentModel)
+    .optional()
+    .nullable()
+    .transform(value => value ?? []),
 });
 
 const ProjectAssignmentModel = z.object({
   type: z.literal('project'),
   id: z.string().uuid(),
-  targets: z.union([WildcardAssignmentModel, z.array(TargetAssignmentModel)]),
+  targets: AssignedTargetsModel,
 });
 
 /**
@@ -40,12 +70,19 @@ const ProjectAssignmentModel = z.object({
  * If no resources are assigned to a member role, the permissions are granted on all the resources within the
  * organization.
  */
-const AssignedResourceModel = z.union([WildcardAssignmentModel, z.array(ProjectAssignmentModel)]);
+const AssignedProjectsModel = z.object({
+  mode: SelectionModeModel,
+  projects: z
+    .array(ProjectAssignmentModel)
+    .optional()
+    .nullable()
+    .transform(value => value ?? []),
+});
 
 /**
  * Resource assignments as stored within the database.
  */
-type ResourceAssignmentGroup = z.TypeOf<typeof AssignedResourceModel>;
+type ResourceAssignmentGroup = z.TypeOf<typeof AssignedProjectsModel>;
 
 const RawOrganizationMembershipModel = z.object({
   userId: z.string(),
@@ -58,7 +95,9 @@ const RawOrganizationMembershipModel = z.object({
    * Resources that are assigned to the membership
    * If no resources are defined the permissions of the role are applied to all resources within the organization.
    */
-  assignedResources: AssignedResourceModel.nullable().transform(value => value ?? '*'),
+  assignedResources: AssignedProjectsModel.nullable().transform(
+    value => value ?? { mode: '*' as const, projects: [] },
+  ),
 });
 
 export type OrganizationMembershipRoleAssignment = {
@@ -150,7 +189,10 @@ export class OrganizationMembers {
           throw new Error('Could not resolve role.');
         }
 
-        const resources: ResourceAssignmentGroup = record.assignedResources ?? '*';
+        const resources: ResourceAssignmentGroup = record.assignedResources ?? {
+          mode: '*',
+          projects: [],
+        };
 
         organizationMembershipByUserId.set(record.userId, {
           organizationId: organization.id,
@@ -264,7 +306,7 @@ export class OrganizationMembers {
           "role_id" = ${args.roleId}
           , "assigned_resources" = ${JSON.stringify(
             /** we parse it to avoid additional properties being stored within the database. */
-            AssignedResourceModel.parse(args.resourceAssignmentGroup),
+            AssignedProjectsModel.parse(args.resourceAssignmentGroup),
           )}
         WHERE
           "organization_id" = ${args.organizationId}
@@ -282,37 +324,24 @@ export class OrganizationMembers {
    */
   async resolveGraphQLMemberResourceAssignment(
     member: OrganizationMembership,
-  ): Promise<GraphQLSchema.ResolversTypes['MemberResourceAssignment']> {
-    if (member.assignedRole.resources === '*') {
-      return {
-        allProjects: true,
-      };
-    }
-
+  ): Promise<GraphQLSchema.ResolversTypes['ResourceAssignment']> {
     const projects = await this.storage.findProjectsByIds(
-      member.assignedRole.resources.map(project => project.id),
+      member.assignedRole.resources.projects.map(project => project.id),
     );
 
-    // if there is no project all the assignments do not longer exist.
-    const [firstProject] = projects.values();
-    if (!firstProject) {
-      return {
-        projects: [],
-      };
-    }
-
-    const filteredProjects = member.assignedRole.resources.filter(row => projects.get(row.id));
-
-    const targetAssignments = filteredProjects.flatMap(project =>
-      project.targets === '*' ? [] : project.targets,
+    const filteredProjects = member.assignedRole.resources.projects.filter(row =>
+      projects.get(row.id),
     );
 
+    const targetAssignments = filteredProjects.flatMap(project => project.targets.targets);
+
     const targets = await this.storage.findTargetsByIds(
-      firstProject.orgId,
+      member.organizationId,
       targetAssignments.map(target => target.id),
     );
 
     return {
+      mode: member.assignedRole.resources.mode === '*' ? ('all' as const) : ('granular' as const),
       projects: filteredProjects
         .map(projectAssignment => {
           const project = projects.get(projectAssignment.id);
@@ -323,38 +352,39 @@ export class OrganizationMembers {
           return {
             projectId: project.id,
             project,
-            targets:
-              projectAssignment.targets === '*'
-                ? { allTargets: true }
-                : {
-                    targets: projectAssignment.targets
-                      .map(targetAssignment => {
-                        const target = targets.get(targetAssignment.id);
-                        if (!target) return null;
-
-                        return {
-                          targetId: target.id,
-                          target,
-                          appDeployments:
-                            targetAssignment.appDeployments === '*'
-                              ? { allAppDeployments: true }
-                              : {
-                                  appDeployments: targetAssignment.appDeployments.map(
-                                    deployment => deployment.appName,
-                                  ),
-                                },
-                          services:
-                            targetAssignment.services === '*'
-                              ? { allServices: true }
-                              : {
-                                  services: targetAssignment.services.map(
-                                    service => service.serviceName,
-                                  ),
-                                },
-                        };
-                      })
-                      .filter(isSome),
-                  },
+            targets: {
+              mode:
+                projectAssignment.targets.mode === '*' ? ('all' as const) : ('granular' as const),
+              targets: projectAssignment.targets.targets
+                .map(targetAssignment => {
+                  const target = targets.get(targetAssignment.id);
+                  if (!target) return null;
+
+                  return {
+                    targetId: target.id,
+                    target,
+                    services: {
+                      mode:
+                        targetAssignment.services.mode === '*'
+                          ? ('all' as const)
+                          : ('granular' as const),
+                      services: targetAssignment.services.services.map(
+                        service => service.serviceName,
+                      ),
+                    },
+                    appDeployments: {
+                      mode:
+                        targetAssignment.appDeployments.mode === '*'
+                          ? ('all' as const)
+                          : ('granular' as const),
+                      appDeployments: targetAssignment.appDeployments.appDeployments.map(
+                        deployment => deployment.appName,
+                      ),
+                    },
+                  };
+                })
+                .filter(isSome),
+            },
           };
         })
         .filter(isSome),
@@ -372,23 +402,22 @@ export class OrganizationMembers {
    */
   async transformGraphQLMemberResourceAssignmentInputToResourceAssignmentGroup(
     organization: Organization,
-    input: GraphQLSchema.MemberResourceAssignmentInput,
+    input: GraphQLSchema.ResourceAssignmentInput,
   ): Promise<ResourceAssignmentGroup> {
-    if (input.allProjects) {
-      return '*';
-    }
+    /** Mutable array that we populate with the resolved data from the database */
+    const resourceAssignmentGroup: ResourceAssignmentGroup = {
+      mode: input.mode === 'all' ? '*' : 'granular',
+      projects: [],
+    };
 
-    if (input.projects == null) {
-      return [];
+    if (!input.projects) {
+      return resourceAssignmentGroup;
     }
 
     const projects = await this.storage.findProjectsByIds(
-      input.projects.map(record => record.projectId),
+      input.projects.map(record => record.projectId) ?? [],
     );
 
-    /** Mutable array that we populate with the resolved data from the database */
-    const resourceAssignmentGroup: ResourceAssignmentGroup = [];
-
     // In case we are not assigning all targets to the project,
     // we need to  load all the targets/projects that would be assigned
     // for verifying they belong to the organization and/or project.
@@ -398,7 +427,7 @@ export class OrganizationMembers {
       projectId: string;
       /**  mutable array that is within "resourceAssignmentGroup" */
       projectTargets: Array<z.TypeOf<typeof TargetAssignmentModel>>;
-      targets: readonly GraphQLSchema.MemberTargetAssignmentInput[];
+      targets: readonly GraphQLSchema.TargetResourceAssignmentInput[];
     }> = [];
 
     for (const record of input.projects) {
@@ -411,21 +440,15 @@ export class OrganizationMembers {
         continue;
       }
 
-      if (record.targets.allTargets === true) {
-        resourceAssignmentGroup.push({
-          type: 'project',
-          id: project.id,
-          targets: '*',
-        });
-        continue;
-      }
-
       const projectTargets: Array<z.TypeOf<typeof TargetAssignmentModel>> = [];
 
-      resourceAssignmentGroup.push({
+      resourceAssignmentGroup.projects.push({
         type: 'project',
         id: project.id,
-        targets: projectTargets,
+        targets: {
+          mode: record.targets.mode === 'all' ? '*' : 'granular',
+          targets: projectTargets,
+        },
       });
 
       if (record.targets.targets) {
@@ -459,18 +482,22 @@ export class OrganizationMembers {
         record.projectTargets.push({
           type: 'target',
           id: target.id,
-          appDeployments: targetRecord.appDeployments.allAppDeployments
-            ? '*'
-            : (targetRecord.appDeployments.appDeployments ?? []).map(record => ({
+          appDeployments: {
+            mode: targetRecord.appDeployments.mode === 'all' ? '*' : 'granular',
+            appDeployments:
+              targetRecord.appDeployments.appDeployments?.map(record => ({
                 type: 'appDeployment',
                 appName: record.appDeployment,
-              })),
-          services: targetRecord.services.allServices
-            ? '*'
-            : (targetRecord.services.services ?? []).map(record => ({
+              })) ?? [],
+          },
+          services: {
+            mode: targetRecord.services.mode === 'all' ? '*' : 'granular',
+            services:
+              targetRecord.services.services?.map(record => ({
                 type: 'service',
                 serviceName: record?.serviceName,
-              })),
+              })) ?? [],
+          },
         });
       }
     }
@@ -557,7 +584,7 @@ function resolveResourceAssignment(args: {
     organizationId: args.organizationId,
   };
 
-  if (args.projects === '*') {
+  if (args.projects.mode === '*') {
     return {
       organization: organizationAssignment,
       project: organizationAssignment,
@@ -572,19 +599,19 @@ function resolveResourceAssignment(args: {
   let serviceAssignments: ResolvedResourceAssignments['service'] = [];
   let appDeploymentAssignments: ResolvedResourceAssignments['appDeployment'] = [];
 
-  for (const project of args.projects) {
+  for (const project of args.projects.projects) {
     const projectAssignment: ProjectAssignment = {
       type: 'project',
       projectId: project.id,
     };
     projectAssignments.push(projectAssignment);
 
-    if (project.targets === '*') {
+    if (project.targets.mode === '*') {
       targetAssignments.push(projectAssignment);
       continue;
     }
 
-    for (const target of project.targets) {
+    for (const target of project.targets.targets) {
       const targetAssignment: TargetAssignment = {
         type: 'target',
         targetId: target.id,
@@ -593,10 +620,10 @@ function resolveResourceAssignment(args: {
       targetAssignments.push(targetAssignment);
 
       // services
-      if (target.services === '*') {
+      if (target.services.mode === '*') {
         serviceAssignments.push(targetAssignment);
       } else {
-        for (const service of target.services) {
+        for (const service of target.services.services) {
           serviceAssignments.push({
             type: 'service',
             targetId: target.id,
@@ -606,10 +633,10 @@ function resolveResourceAssignment(args: {
       }
 
       // app deployments
-      if (target.appDeployments === '*') {
+      if (target.appDeployments.mode === '*') {
         appDeploymentAssignments.push(targetAssignment);
       } else {
-        for (const appDeployment of target.appDeployments) {
+        for (const appDeployment of target.appDeployments.appDeployments) {
           appDeploymentAssignments.push({
             type: 'appDeployment',
             targetId: target.id,
diff --git a/packages/web/app/src/components/organization/members/list.tsx b/packages/web/app/src/components/organization/members/list.tsx
index 461d7bbf3e..7896f8e5ee 100644
--- a/packages/web/app/src/components/organization/members/list.tsx
+++ b/packages/web/app/src/components/organization/members/list.tsx
@@ -14,7 +14,6 @@ import {
   AlertDialogTitle,
 } from '@/components/ui/alert-dialog';
 import { Button } from '@/components/ui/button';
-import { Dialog, DialogContent, DialogTrigger } from '@/components/ui/dialog';
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -27,30 +26,30 @@ import * as Sheet from '@/components/ui/sheet';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
-import { AuthProvider } from '@/gql/graphql';
+import * as GraphQLSchema from '@/gql/graphql';
 import { MemberInvitationButton } from './invitations';
 import { MemberRolePicker } from './member-role-picker';
 
 export const authProviderToIconAndTextMap: Record<
-  AuthProvider,
+  GraphQLSchema.AuthProvider,
   {
     icon: IconType;
     text: string;
   }
 > = {
-  [AuthProvider.Google]: {
+  [GraphQLSchema.AuthProvider.Google]: {
     icon: FaGoogle,
     text: 'Google OAuth 2.0',
   },
-  [AuthProvider.Github]: {
+  [GraphQLSchema.AuthProvider.Github]: {
     icon: FaGithub,
     text: 'GitHub OAuth 2.0',
   },
-  [AuthProvider.Oidc]: {
+  [GraphQLSchema.AuthProvider.Oidc]: {
     icon: FaOpenid,
     text: 'OpenID Connect',
   },
-  [AuthProvider.UsernamePassword]: {
+  [GraphQLSchema.AuthProvider.UsernamePassword]: {
     icon: FaUserLock,
     text: 'Email & Password',
   },
@@ -230,7 +229,7 @@ const MemberRole_MemberFragment = graphql(`
       name
     }
     resourceAssignment {
-      allProjects
+      mode
       projects {
         project {
           id
@@ -253,7 +252,7 @@ function MemberRole(props: {
   return (
     <>
       {member.role.name}
-      {member.resourceAssignment.allProjects ? (
+      {member.resourceAssignment.mode === GraphQLSchema.ResourceAssignmentMode.All ? (
         ' (all resources)'
       ) : member.resourceAssignment.projects?.length ? (
         <>
diff --git a/packages/web/app/src/components/organization/members/member-role-picker.tsx b/packages/web/app/src/components/organization/members/member-role-picker.tsx
index f847aee36c..97aa99c9a9 100644
--- a/packages/web/app/src/components/organization/members/member-role-picker.tsx
+++ b/packages/web/app/src/components/organization/members/member-role-picker.tsx
@@ -7,7 +7,7 @@ import { useToast } from '@/components/ui/use-toast';
 import { FragmentType, graphql, useFragment } from '@/gql';
 import * as GraphQLSchema from '@/gql/graphql';
 import { MemberRoleSelector } from './member-role-selector';
-import { ResourceSelector, type ResourceSelection } from './resource-selector';
+import { ResourceSelector } from './resource-selector';
 import { SelectedPermissionOverview } from './selected-permission-overview';
 
 const MemberRolePicker_OrganizationFragment = graphql(`
@@ -36,25 +36,25 @@ const MemberRolePicker_MemberFragment = graphql(`
       id
     }
     resourceAssignment {
-      allProjects
+      mode
       projects {
         project {
           id
           slug
         }
         targets {
-          allTargets
+          mode
           targets {
             target {
               id
               slug
             }
             services {
-              allServices
+              mode
               services
             }
             appDeployments {
-              allAppDeployments
+              mode
               appDeployments
             }
           }
@@ -102,27 +102,37 @@ export function MemberRolePicker(props: {
   const organization = useFragment(MemberRolePicker_OrganizationFragment, props.organization);
   const member = useFragment(MemberRolePicker_MemberFragment, props.member);
   const [selectedRoleId, setSelectedRoleId] = useState(member.role.id);
-  const [selection, setSelection] = useState<ResourceSelection>(() => ({
-    projects:
-      member.resourceAssignment.allProjects === true
-        ? '*'
-        : (member.resourceAssignment.projects ?? []).map(record => ({
-            id: record.project.id,
-            slug: record.project.slug,
-            targets:
-              record.targets.allTargets === true
-                ? '*'
-                : (record.targets.targets ?? []).map(record => ({
-                    id: record.target.id,
-                    slug: record.target.slug,
-                    appDeployments:
-                      record.appDeployments.allAppDeployments === true
-                        ? '*'
-                        : (record.appDeployments.appDeployments ?? []),
-                    services:
-                      record.services.allServices === true ? '*' : (record.services.services ?? []),
-                  })),
-          })),
+  const [selection, setSelection] = useState<GraphQLSchema.ResourceAssignmentInput>(() => ({
+    mode: member.resourceAssignment.mode,
+    projects: (member.resourceAssignment.projects ?? []).map(
+      (record): GraphQLSchema.ProjectResourceAssignmentInput => ({
+        projectId: record.project.id,
+        targets: {
+          mode: record.targets.mode,
+          targets: (record.targets.targets ?? []).map(
+            (target): GraphQLSchema.TargetResourceAssignmentInput => ({
+              targetId: target.target.id,
+              services: {
+                mode: target.services.mode,
+                services: target.services.services.map(
+                  (service): GraphQLSchema.ServiceResourceAssignmentInput => ({
+                    serviceName: service,
+                  }),
+                ),
+              },
+              appDeployments: {
+                mode: target.appDeployments.mode,
+                appDeployments: target.appDeployments.appDeployments.map(
+                  (appDeploymentName): GraphQLSchema.AppDeploymentResourceAssignmentInput => ({
+                    appDeployment: appDeploymentName,
+                  }),
+                ),
+              },
+            }),
+          ),
+        },
+      }),
+    ),
   }));
 
   const [assignRoleState, assignRole] = useMutation(MemberRolePicker_AssignRoleMutation);
@@ -189,8 +199,7 @@ export function MemberRolePicker(props: {
                   organizationSlug: organization.slug,
                   roleId: selectedRoleId,
                   userId: member.user.id,
-                  resources:
-                    transformResourceSelectionToGraphQLMemberResourceAssignmentInput(selection),
+                  resources: selection,
                 },
               });
               if (result.error) {
@@ -227,32 +236,3 @@ export function MemberRolePicker(props: {
     </Sheet.SheetContent>
   );
 }
-
-function transformResourceSelectionToGraphQLMemberResourceAssignmentInput(
-  selection: ResourceSelection,
-): GraphQLSchema.MemberResourceAssignmentInput {
-  if (selection.projects === '*') {
-    return {
-      allProjects: true,
-    };
-  }
-
-  return {
-    projects: selection.projects.map(project => ({
-      projectId: project.id,
-      targets:
-        project.targets === '*'
-          ? { allTargets: true }
-          : {
-              targets: project.targets.map(target => ({
-                targetId: target.id,
-                appDeployments: { appDeployments: [] },
-                services:
-                  target.services === '*'
-                    ? { allServices: true }
-                    : { services: target.services.map(service => ({ serviceName: service })) },
-              })),
-            },
-    })),
-  };
-}
diff --git a/packages/web/app/src/components/organization/members/resource-selector.tsx b/packages/web/app/src/components/organization/members/resource-selector.tsx
index 6933218dab..721cd31f58 100644
--- a/packages/web/app/src/components/organization/members/resource-selector.tsx
+++ b/packages/web/app/src/components/organization/members/resource-selector.tsx
@@ -5,26 +5,9 @@ import { useQuery } from 'urql';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 import { graphql, useFragment, type FragmentType } from '@/gql';
-import { ProjectType } from '@/gql/graphql';
+import * as GraphQLSchema from '@/gql/graphql';
 import { cn } from '@/lib/utils';
 
-export type ResourceSelection = {
-  projects:
-    | '*'
-    | Array<{
-        id: string;
-        slug: string;
-        targets:
-          | '*'
-          | Array<{
-              id: string;
-              slug: string;
-              appDeployments: '*' | Array<string>;
-              services: '*' | Array<string>;
-            }>;
-      }>;
-};
-
 const ResourceSelector_OrganizationFragment = graphql(`
   fragment ResourceSelector_OrganizationFragment on Organization {
     id
@@ -98,8 +81,8 @@ const ResourceSelector_OrganizationProjectTargetQuery = graphql(`
 
 export function ResourceSelector(props: {
   organization: FragmentType<typeof ResourceSelector_OrganizationFragment>;
-  selection: ResourceSelection;
-  onSelectionChange: (selection: ResourceSelection) => void;
+  selection: GraphQLSchema.ResourceAssignmentInput;
+  onSelectionChange: (selection: GraphQLSchema.ResourceAssignmentInput) => void;
 }) {
   const organization = useFragment(ResourceSelector_OrganizationFragment, props.organization);
   const [breadcrumb, setBreadcrumb] = useState(
@@ -110,13 +93,13 @@ export function ResourceSelector(props: {
   );
 
   const projectState = useMemo(() => {
-    if (props.selection.projects === '*') {
+    if (props.selection.mode === GraphQLSchema.ResourceAssignmentMode.All) {
       return null;
     }
 
     type SelectedItem = {
       project: (typeof organization.projects.nodes)[number];
-      projectSelection: (typeof props.selection.projects)[number];
+      projectSelection: GraphQLSchema.ProjectResourceAssignmentInput;
     };
 
     type NotSelectedItem = (typeof organization.projects.nodes)[number];
@@ -124,13 +107,12 @@ export function ResourceSelector(props: {
     const selectedProjects: Array<SelectedItem> = [];
     const notSelectedProjects: Array<NotSelectedItem> = [];
 
-    let activeProject: null | {
-      project: (typeof organization.projects.nodes)[number];
-      projectSelection: (typeof props.selection.projects)[number];
-    } = null;
+    let activeProject: null | SelectedItem = null;
 
     for (const project of organization.projects.nodes) {
-      const projectSelection = props.selection.projects.find(item => item.id === project.id);
+      const projectSelection = props.selection.projects?.find(
+        item => item.projectId === project.id,
+      );
 
       if (projectSelection) {
         selectedProjects.push({ project, projectSelection });
@@ -152,14 +134,12 @@ export function ResourceSelector(props: {
       addProject(item: (typeof organization.projects.nodes)[number]) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') {
-              return;
-            }
-
-            state.projects.push({
-              id: item.id,
-              slug: item.slug,
-              targets: [],
+            state.projects?.push({
+              projectId: item.id,
+              targets: {
+                mode: GraphQLSchema.ResourceAssignmentMode.Granular,
+                targets: [],
+              },
             });
           }),
         );
@@ -167,10 +147,7 @@ export function ResourceSelector(props: {
       removeProject(item: (typeof organization.projects.nodes)[number]) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') {
-              return;
-            }
-            state.projects = state.projects.filter(project => project.id !== item.id);
+            state.projects = state.projects?.filter(project => project.projectId !== item.id);
           }),
         );
         setBreadcrumb(breadcrumb => {
@@ -202,18 +179,18 @@ export function ResourceSelector(props: {
 
     const projectId = projectState.activeProject.project.id;
 
-    if (projectState.activeProject.projectSelection.targets === '*') {
+    if (
+      projectState.activeProject.projectSelection.targets.mode ===
+      GraphQLSchema.ResourceAssignmentMode.All
+    ) {
       return {
         selection: '*',
         setGranular() {
           props.onSelectionChange(
             produce(props.selection, state => {
-              if (state.projects === '*') return;
-
-              const project = state.projects.find(project => project.id === projectId);
+              const project = state.projects?.find(project => project.projectId === projectId);
               if (!project) return;
-
-              project.targets = [];
+              project.targets.mode = GraphQLSchema.ResourceAssignmentMode.Granular;
             }),
           );
         },
@@ -222,7 +199,10 @@ export function ResourceSelector(props: {
 
     type SelectedItem = {
       target: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number];
-      targetSelection: (typeof projectState.activeProject.projectSelection.targets)[number];
+      targetSelection: Exclude<
+        typeof projectState.activeProject.projectSelection.targets.targets,
+        null | undefined
+      >[number];
     };
 
     type NotSelectedItem =
@@ -232,13 +212,16 @@ export function ResourceSelector(props: {
     const notSelected: Array<NotSelectedItem> = [];
 
     let activeTarget: null | {
-      targetSelection: (typeof projectState.activeProject.projectSelection.targets)[number];
+      targetSelection: Exclude<
+        typeof projectState.activeProject.projectSelection.targets.targets,
+        null | undefined
+      >[number];
       target: (typeof organizationProjectTargets.data.organization.project.targets.nodes)[number];
     } = null;
 
     for (const target of organizationProjectTargets.data.organization.project.targets.nodes) {
-      const targetSelection = projectState.activeProject.projectSelection.targets.find(
-        item => item.id === target.id,
+      const targetSelection = projectState.activeProject.projectSelection.targets.targets?.find(
+        item => item.targetId === target.id,
       );
 
       if (targetSelection) {
@@ -268,15 +251,18 @@ export function ResourceSelector(props: {
       ) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
+            const project = state.projects?.find(project => project.projectId === projectId);
             if (!project) return;
-            if (project.targets === '*') return;
-            project.targets.push({
-              id: item.id,
-              slug: item.slug,
-              appDeployments: [],
-              services: [],
+            project.targets.targets?.push({
+              targetId: item.id,
+              appDeployments: {
+                mode: GraphQLSchema.ResourceAssignmentMode.Granular,
+                appDeployments: [],
+              },
+              services: {
+                mode: GraphQLSchema.ResourceAssignmentMode.Granular,
+                services: [],
+              },
             });
           }),
         );
@@ -286,11 +272,11 @@ export function ResourceSelector(props: {
       ) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
+            const project = state.projects?.find(project => project.projectId === projectId);
             if (!project) return;
-            if (project.targets === '*') return;
-            project.targets = project.targets.filter(target => target.id !== item.id);
+            project.targets.targets = project.targets.targets?.filter(
+              target => target.targetId !== item.id,
+            );
           }),
         );
         setBreadcrumb(breadcrumb => {
@@ -306,10 +292,9 @@ export function ResourceSelector(props: {
       setAll() {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
+            const project = state.projects?.find(project => project.projectId === projectId);
             if (!project) return;
-            project.targets = '*';
+            project.targets.mode = GraphQLSchema.ResourceAssignmentMode.All;
           }),
         );
         setBreadcrumb({ projectId });
@@ -336,38 +321,43 @@ export function ResourceSelector(props: {
       !projectState?.activeProject ||
       !targetState?.activeTarget ||
       !breadcrumb?.targetId ||
-      /* breadcrumb.mode !== 'service' || */
       !organizationProjectTarget.data?.organization?.project
     ) {
       return null;
     }
 
-    if (organizationProjectTarget.data.organization.project.type === ProjectType.Single) {
+    if (
+      organizationProjectTarget.data.organization.project.type === GraphQLSchema.ProjectType.Single
+    ) {
       return 'none' as const;
     }
 
-    const projectId = projectState.activeProject.projectSelection.id;
-    const targetId = targetState.activeTarget.targetSelection.id;
+    const projectId = projectState.activeProject.projectSelection.projectId;
+    const targetId = targetState.activeTarget.targetSelection.targetId;
 
-    if (targetState.activeTarget.targetSelection.services === '*') {
+    if (
+      targetState.activeTarget.targetSelection.services.mode ===
+      GraphQLSchema.ResourceAssignmentMode.All
+    ) {
       return {
         selection: '*' as const,
         setGranular() {
           props.onSelectionChange(
             produce(props.selection, state => {
-              if (state.projects === '*') return;
-              const project = state.projects.find(project => project.id === projectId);
-              if (!project || project.targets === '*') return;
-              const target = project.targets.find(target => target.id === targetId);
+              const project = state.projects?.find(project => project.projectId === projectId);
+              if (!project) return;
+              const target = project.targets.targets?.find(target => target.targetId === targetId);
               if (!target) return;
-              target.services = [];
+              target.services.mode = GraphQLSchema.ResourceAssignmentMode.Granular;
             }),
           );
         },
       };
     }
 
-    const selectedServices: Array<string> = [...targetState.activeTarget.targetSelection.services];
+    const selectedServices: GraphQLSchema.ServiceResourceAssignmentInput[] = [
+      ...(targetState.activeTarget.targetSelection.services.services ?? []),
+    ];
     const notSelectedServices: Array<string> = [];
 
     if (
@@ -378,7 +368,7 @@ export function ResourceSelector(props: {
         if (
           schema.__typename === 'CompositeSchema' &&
           schema.service &&
-          !selectedServices.find(serviceName => serviceName === schema.service)
+          !selectedServices.find(service => service.serviceName === schema.service)
         ) {
           notSelectedServices.push(schema.service);
         }
@@ -393,59 +383,68 @@ export function ResourceSelector(props: {
       setAll() {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
-            if (!project || project.targets === '*') return;
-            const target = project.targets.find(target => target.id === targetId);
+            const project = state.projects?.find(project => project.projectId === projectId);
+            if (!project) return;
+            const target = project.targets.targets?.find(target => target.targetId === targetId);
+
             if (!target) return;
-            target.services = '*';
+            target.services.mode = GraphQLSchema.ResourceAssignmentMode.All;
           }),
         );
       },
       addService(serviceName: string) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
-            if (!project || project.targets === '*') return;
-            const target = project.targets.find(target => target.id === targetId);
+            const project = state.projects?.find(project => project.projectId === projectId);
+            if (!project) return;
+            const target = project.targets.targets?.find(target => target.targetId === targetId);
             if (
               !target ||
-              target.services === '*' ||
-              target.services.find(service => service === serviceName)
+              target.services.services?.find(service => service.serviceName === serviceName)
             ) {
               return;
             }
 
-            target.services.push(serviceName);
+            target.services.services?.push({
+              serviceName,
+            });
           }),
         );
       },
       removeService(serviceName: string) {
         props.onSelectionChange(
           produce(props.selection, state => {
-            if (state.projects === '*') return;
-            const project = state.projects.find(project => project.id === projectId);
-            if (!project || project.targets === '*') return;
-            const target = project.targets.find(target => target.id === targetId);
-            if (!target || target.services === '*') {
+            const project = state.projects?.find(project => project.projectId === projectId);
+            if (!project) return;
+            const target = project.targets.targets?.find(target => target.targetId === targetId);
+            if (!target) {
               return;
             }
-            target.services = target.services.filter(name => name !== serviceName);
+            target.services.services = target.services.services?.filter(
+              service => service.serviceName !== serviceName,
+            );
           }),
         );
       },
     };
-  }, [targetState?.activeTarget, breadcrumb, projectState?.activeProject]);
+  }, [targetState?.activeTarget, breadcrumb, projectState?.activeProject, props.selection]);
 
   return (
-    <Tabs defaultValue="granular" value={props.selection.projects === '*' ? 'full' : 'granular'}>
+    <Tabs
+      defaultValue="granular"
+      value={
+        props.selection.mode === GraphQLSchema.ResourceAssignmentMode.All ? 'full' : 'granular'
+      }
+    >
       <TabsList variant="content" className="mt-1">
         <TabsTrigger
           variant="content"
           value="full"
           onClick={() => {
-            props.onSelectionChange({ projects: '*' });
+            props.onSelectionChange({
+              ...props.selection,
+              mode: GraphQLSchema.ResourceAssignmentMode.All,
+            });
             setBreadcrumb(null);
           }}
         >
@@ -455,7 +454,10 @@ export function ResourceSelector(props: {
           variant="content"
           value="granular"
           onClick={() => {
-            props.onSelectionChange({ projects: [] });
+            props.onSelectionChange({
+              ...props.selection,
+              mode: GraphQLSchema.ResourceAssignmentMode.Granular,
+            });
           }}
         >
           Granular Access
@@ -527,9 +529,10 @@ export function ResourceSelector(props: {
                         key={selection.project.id}
                         title={
                           selection.project.slug +
-                          (selection.projectSelection.targets === '*'
+                          (selection.projectSelection.targets.mode ===
+                          GraphQLSchema.ResourceAssignmentMode.All
                             ? ' (all targets, all services)'
-                            : ` (${selection.projectSelection.targets.length} target${selection.projectSelection.targets.length === 1 ? '' : 's'})`)
+                            : ` (${selection.projectSelection.targets.targets?.length ?? 0} target${selection.projectSelection.targets.targets?.length === 1 ? '' : 's'})`)
                         }
                         isActive={projectState.activeProject?.project.id === selection.project.id}
                         onClick={() => {
@@ -580,11 +583,13 @@ export function ResourceSelector(props: {
                                 key={selection.target.id}
                                 title={
                                   selection.target.slug +
-                                  (targetState.activeProject.project.type === ProjectType.Single
+                                  (targetState.activeProject.project.type ===
+                                  GraphQLSchema.ProjectType.Single
                                     ? ' (full access)'
-                                    : selection.targetSelection.services === '*'
+                                    : selection.targetSelection.services.mode ===
+                                        GraphQLSchema.ResourceAssignmentMode.All
                                       ? ' (all services)'
-                                      : ` (${selection.targetSelection.services.length} service${selection.targetSelection.services.length === 1 ? '' : 's'})`)
+                                      : ` (${selection.targetSelection.services.services?.length ?? 0} service${selection.targetSelection.services?.services?.length === 1 ? '' : 's'})`)
                                 }
                                 isActive={
                                   targetState.activeTarget?.target.id === selection.target.id
@@ -626,7 +631,8 @@ export function ResourceSelector(props: {
                   )}
                 </div>
                 <div className="flex flex-1 flex-col border-y border-r pt-2">
-                  {projectState.activeProject?.projectSelection.targets === '*' ? (
+                  {projectState.activeProject?.projectSelection.targets.mode ===
+                  GraphQLSchema.ResourceAssignmentMode.All ? (
                     <div className="text-muted-foreground px-2 text-xs">
                       Access to all services of projects targets granted.
                     </div>
@@ -650,12 +656,12 @@ export function ResourceSelector(props: {
                             access granted
                           </div>
                           {serviceState.selection.selected.length ? (
-                            serviceState.selection.selected.map(serviceName => (
+                            serviceState.selection.selected.map(service => (
                               <RowItem
-                                key={serviceName}
-                                title={serviceName}
+                                key={service.serviceName}
+                                title={service.serviceName}
                                 isActive={false}
-                                onDelete={() => serviceState.removeService(serviceName)}
+                                onDelete={() => serviceState.removeService(service.serviceName)}
                               />
                             ))
                           ) : (

From 342cc23b5ad68aa9b222797059be9e30c416381e Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 24 Jan 2025 15:44:40 +0100
Subject: [PATCH 43/55] typo

---
 .../modules/organization/providers/organization-members.ts    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index e33c54e460..7136f75328 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -345,7 +345,7 @@ export class OrganizationMembers {
       projects: filteredProjects
         .map(projectAssignment => {
           const project = projects.get(projectAssignment.id);
-          if (!project) {
+          if (!project || project.orgId !== member.organizationId) {
             return null;
           }
 
@@ -393,7 +393,7 @@ export class OrganizationMembers {
 
   /**
    * Transforms and resolves a {GraphQL.MemberResourceAssignmentInput} to a {ResourceAssignmentGroup}
-   * that can eb stored within our database
+   * that can be stored within our database
    *
    * - Projects and Targets that can not be found in our database are omitted from the resolved object.
    * - Projects and Targets that do not follow the hierarchical structure are omitted from teh resolved object.

From c0b78c590850ebd1fe07b45e67f0642b82462f96 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 24 Jan 2025 15:58:57 +0100
Subject: [PATCH 44/55] sanatize input

---
 .../providers/app-deployments.ts              |  2 +-
 .../providers/organization-members.ts         | 24 ++++++++++++-------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/packages/services/api/src/modules/app-deployments/providers/app-deployments.ts b/packages/services/api/src/modules/app-deployments/providers/app-deployments.ts
index d811d05884..b12960c1bb 100644
--- a/packages/services/api/src/modules/app-deployments/providers/app-deployments.ts
+++ b/packages/services/api/src/modules/app-deployments/providers/app-deployments.ts
@@ -17,7 +17,7 @@ import { Storage } from '../../shared/providers/storage';
 import { APP_DEPLOYMENTS_ENABLED } from './app-deployments-enabled-token';
 import { PersistedDocumentScheduler } from './persisted-document-scheduler';
 
-const AppDeploymentNameModel = z
+export const AppDeploymentNameModel = z
   .string()
   .min(1, 'Must be at least 1 character long')
   .max(64, 'Must be at most 64 characters long')
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 7136f75328..76a2a51d59 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -4,6 +4,8 @@ import { z } from 'zod';
 import * as GraphQLSchema from '../../../__generated__/types';
 import { Organization } from '../../../shared/entities';
 import { batchBy } from '../../../shared/helpers';
+import { isUUID } from '../../../shared/is-uuid';
+import { AppDeploymentNameModel } from '../../app-deployments/providers/app-deployments';
 import { Logger } from '../../shared/providers/logger';
 import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
 import { Storage } from '../../shared/providers/storage';
@@ -414,8 +416,10 @@ export class OrganizationMembers {
       return resourceAssignmentGroup;
     }
 
+    const sanitizedProjects = input.projects.filter(project => isUUID(project.projectId));
+
     const projects = await this.storage.findProjectsByIds(
-      input.projects.map(record => record.projectId) ?? [],
+      sanitizedProjects.map(record => record.projectId),
     );
 
     // In case we are not assigning all targets to the project,
@@ -430,7 +434,7 @@ export class OrganizationMembers {
       targets: readonly GraphQLSchema.TargetResourceAssignmentInput[];
     }> = [];
 
-    for (const record of input.projects) {
+    for (const record of sanitizedProjects) {
       const project = projects.get(record.projectId);
 
       // In case the project was not found or does not belogn the the organization,
@@ -452,12 +456,13 @@ export class OrganizationMembers {
       });
 
       if (record.targets.targets) {
-        for (const target of record.targets.targets) {
+        const sanitizedTargets = record.targets.targets.filter(target => isUUID(target.targetId));
+        for (const target of sanitizedTargets) {
           targetLookupIds.add(target.targetId);
         }
         projectTargetAssignments.push({
           projectTargets,
-          targets: record.targets.targets,
+          targets: sanitizedTargets,
           projectId: project.id,
         });
       }
@@ -485,14 +490,17 @@ export class OrganizationMembers {
           appDeployments: {
             mode: targetRecord.appDeployments.mode === 'all' ? '*' : 'granular',
             appDeployments:
-              targetRecord.appDeployments.appDeployments?.map(record => ({
-                type: 'appDeployment',
-                appName: record.appDeployment,
-              })) ?? [],
+              targetRecord.appDeployments.appDeployments
+                ?.filter(name => AppDeploymentNameModel.safeParse(name).success)
+                .map(record => ({
+                  type: 'appDeployment',
+                  appName: record.appDeployment,
+                })) ?? [],
           },
           services: {
             mode: targetRecord.services.mode === 'all' ? '*' : 'granular',
             services:
+              // TODO: it seems like we do not validate service names
               targetRecord.services.services?.map(record => ({
                 type: 'service',
                 serviceName: record?.serviceName,

From cb296177a402afc9ef6bae263f1f393c97012a77 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Fri, 24 Jan 2025 16:12:34 +0100
Subject: [PATCH 45/55] batch

---
 .../providers/organization-members.ts         | 28 +++---
 .../src/modules/shared/providers/storage.ts   |  7 +-
 packages/services/storage/src/index.ts        | 97 +++++++++++++------
 3 files changed, 87 insertions(+), 45 deletions(-)

diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 76a2a51d59..bdb11bc1b1 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -327,9 +327,9 @@ export class OrganizationMembers {
   async resolveGraphQLMemberResourceAssignment(
     member: OrganizationMembership,
   ): Promise<GraphQLSchema.ResolversTypes['ResourceAssignment']> {
-    const projects = await this.storage.findProjectsByIds(
-      member.assignedRole.resources.projects.map(project => project.id),
-    );
+    const projects = await this.storage.findProjectsByIds({
+      projectIds: member.assignedRole.resources.projects.map(project => project.id),
+    });
 
     const filteredProjects = member.assignedRole.resources.projects.filter(row =>
       projects.get(row.id),
@@ -337,10 +337,10 @@ export class OrganizationMembers {
 
     const targetAssignments = filteredProjects.flatMap(project => project.targets.targets);
 
-    const targets = await this.storage.findTargetsByIds(
-      member.organizationId,
-      targetAssignments.map(target => target.id),
-    );
+    const targets = await this.storage.findTargetsByIds({
+      organizationId: member.organizationId,
+      targetIds: targetAssignments.map(target => target.id),
+    });
 
     return {
       mode: member.assignedRole.resources.mode === '*' ? ('all' as const) : ('granular' as const),
@@ -418,9 +418,9 @@ export class OrganizationMembers {
 
     const sanitizedProjects = input.projects.filter(project => isUUID(project.projectId));
 
-    const projects = await this.storage.findProjectsByIds(
-      sanitizedProjects.map(record => record.projectId),
-    );
+    const projects = await this.storage.findProjectsByIds({
+      projectIds: sanitizedProjects.map(record => record.projectId),
+    });
 
     // In case we are not assigning all targets to the project,
     // we need to  load all the targets/projects that would be assigned
@@ -468,10 +468,10 @@ export class OrganizationMembers {
       }
     }
 
-    const targets = await this.storage.findTargetsByIds(
-      organization.id,
-      Array.from(targetLookupIds),
-    );
+    const targets = await this.storage.findTargetsByIds({
+      organizationId: organization.id,
+      targetIds: Array.from(targetLookupIds),
+    });
 
     for (const record of projectTargetAssignments) {
       for (const targetRecord of record.targets) {
diff --git a/packages/services/api/src/modules/shared/providers/storage.ts b/packages/services/api/src/modules/shared/providers/storage.ts
index f2e8f73fa0..3701c38227 100644
--- a/packages/services/api/src/modules/shared/providers/storage.ts
+++ b/packages/services/api/src/modules/shared/providers/storage.ts
@@ -205,7 +205,7 @@ export interface Storage {
 
   getProjects(_: OrganizationSelector): Promise<Project[] | never>;
 
-  findProjectsByIds(projectIds: Array<string>): Promise<Map<string, Project>>;
+  findProjectsByIds(args: { projectIds: Array<string> }): Promise<Map<string, Project>>;
 
   createProject(_: Pick<Project, 'type'> & { slug: string } & OrganizationSelector): Promise<
     | {
@@ -304,7 +304,10 @@ export interface Storage {
 
   getTargets(_: ProjectSelector): Promise<readonly Target[]>;
 
-  findTargetsByIds(organizationId: string, targetIds: Array<string>): Promise<Map<string, Target>>;
+  findTargetsByIds(args: {
+    organizationId: string;
+    targetIds: Array<string>;
+  }): Promise<Map<string, Target>>;
 
   getTargetIdsOfOrganization(_: OrganizationSelector): Promise<readonly string[]>;
   getTargetIdsOfProject(_: ProjectSelector): Promise<readonly string[]>;
diff --git a/packages/services/storage/src/index.ts b/packages/services/storage/src/index.ts
index 0fe9417ac0..0fa4d00c07 100644
--- a/packages/services/storage/src/index.ts
+++ b/packages/services/storage/src/index.ts
@@ -32,7 +32,7 @@ import {
   type SchemaLog,
   type SchemaPolicy,
 } from '../../api/src/shared/entities';
-import { batch } from '../../api/src/shared/helpers';
+import { batch, batchBy } from '../../api/src/shared/helpers';
 import {
   alert_channels,
   alerts,
@@ -1398,18 +1398,36 @@ export async function createStorage(
 
       return result.rows.map(transformProject);
     },
-    async findProjectsByIds(ids) {
-      const result = await pool.query<Slonik<projects>>(
-        sql`/* findProjectsByIds */ SELECT * FROM projects WHERE id = ANY(${sql.array(ids, 'uuid')}) AND type != 'CUSTOM'`,
-      );
+    findProjectsByIds: batch<{ projectIds: Array<string> }, Map<string, Project>>(
+      async function FindProjectByIdsBatchHandler(args) {
+        const allProjectIds = args.flatMap(args => args.projectIds);
+        const allProjectsLookupMap = new Map<string, Project>();
 
-      const map = new Map<string, Project>();
-      result.rows.forEach(row => {
-        const project = transformProject(row);
-        map.set(project.id, project);
-      });
-      return map;
-    },
+        if (allProjectIds.length === 0) {
+          return args.map(async () => allProjectsLookupMap);
+        }
+
+        const result = await pool.query<Slonik<projects>>(
+          sql`/* findProjectsByIds */ SELECT * FROM projects WHERE id = ANY(${sql.array(allProjectIds, 'uuid')}) AND type != 'CUSTOM'`,
+        );
+
+        result.rows.forEach(row => {
+          const project = transformProject(row);
+          allProjectsLookupMap.set(project.id, project);
+        });
+
+        return args.map(async arg => {
+          const map = new Map<string, Project>();
+          for (const projectId of arg.projectIds) {
+            const project = allProjectsLookupMap.get(projectId);
+            if (!project) continue;
+            map.set(projectId, project);
+          }
+
+          return map;
+        });
+      },
+    ),
     async updateProjectSlug({ slug, organizationId: organization, projectId: project }) {
       return pool.transaction(async t => {
         const projectSlugExists = await t.exists(
@@ -1701,29 +1719,50 @@ export async function createStorage(
         orgId: organization,
       }));
     },
-    async findTargetsByIds(organizationId, targetIds) {
-      const map = new Map<string, Target>();
+    findTargetsByIds: batchBy<
+      {
+        organizationId: string;
+        targetIds: Array<string>;
+      },
+      Map<string, Target>
+    >(
+      org => org.organizationId,
+      async function FindTargetsByIdsBatchHandler(args) {
+        const resultLookupMap = new Map<string, Target>();
 
-      if (targetIds.length === 0) {
-        return map;
-      }
+        const allTargetIds = args.flatMap(arg => arg.targetIds);
 
-      const results = await pool.query<unknown>(sql`/* getTargets */
-        SELECT
+        if (allTargetIds.length === 0) {
+          return args.map(async () => resultLookupMap);
+        }
+
+        const orgId = args[0].organizationId;
+
+        const results = await pool.query<unknown>(sql`/* getTargets */
+          SELECT
           ${targetSQLFields}
-        FROM
+          FROM
           "targets"
-        WHERE
-          "id" = ANY(${sql.array(targetIds, 'uuid')})
-      `);
+          WHERE
+          "id" = ANY(${sql.array(allTargetIds, 'uuid')})
+        `);
 
-      for (const row of results.rows) {
-        const target: Target = { ...TargetModel.parse(row), orgId: organizationId };
-        map.set(target.id, target);
-      }
+        for (const row of results.rows) {
+          const target: Target = { ...TargetModel.parse(row), orgId };
+          resultLookupMap.set(target.id, target);
+        }
 
-      return map;
-    },
+        return args.map(async arg => {
+          const map = new Map<string, Target>();
+          for (const targetId of arg.targetIds) {
+            const target = resultLookupMap.get(targetId);
+            if (!target) continue;
+            map.set(targetId, target);
+          }
+          return map;
+        });
+      },
+    ),
     async getTargetIdsOfOrganization({ organizationId: organization }) {
       const results = await pool.query<Slonik<Pick<targets, 'id'>>>(
         sql`/* getTargetIdsOfOrganization */

From df6d70809d432e4fc4357c9e26caa12a5a012375 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 27 Jan 2025 14:53:49 +0100
Subject: [PATCH 46/55] fix

---
 .../modules/auth/providers/auth-manager.ts    |   1 -
 .../api/src/modules/organization/index.ts     |   2 +-
 .../modules/organization/module.graphql.ts    |   4 +-
 .../providers/organization-members.ts         | 223 ++++++++++--------
 .../schema/providers/schema-version-helper.ts |   4 +-
 .../members/member-role-picker.tsx            |   4 +-
 6 files changed, 132 insertions(+), 106 deletions(-)

diff --git a/packages/services/api/src/modules/auth/providers/auth-manager.ts b/packages/services/api/src/modules/auth/providers/auth-manager.ts
index b6a040763a..90d47425f4 100644
--- a/packages/services/api/src/modules/auth/providers/auth-manager.ts
+++ b/packages/services/api/src/modules/auth/providers/auth-manager.ts
@@ -45,7 +45,6 @@ export class AuthManager {
     private projectAccess: ProjectAccess,
     private targetAccess: TargetAccess,
     private userManager: UserManager,
-    private storage: Storage,
     private session: Session,
   ) {}
 
diff --git a/packages/services/api/src/modules/organization/index.ts b/packages/services/api/src/modules/organization/index.ts
index 37db80f104..1b65c48c59 100644
--- a/packages/services/api/src/modules/organization/index.ts
+++ b/packages/services/api/src/modules/organization/index.ts
@@ -10,5 +10,5 @@ export const organizationModule = createModule({
   dirname: __dirname,
   typeDefs,
   resolvers,
-  providers: [OrganizationManager, OrganizationMemberRoles, OrganizationMembers],
+  providers: [OrganizationMemberRoles, OrganizationMembers, OrganizationManager],
 });
diff --git a/packages/services/api/src/modules/organization/module.graphql.ts b/packages/services/api/src/modules/organization/module.graphql.ts
index 06852077e8..8117f10a8e 100644
--- a/packages/services/api/src/modules/organization/module.graphql.ts
+++ b/packages/services/api/src/modules/organization/module.graphql.ts
@@ -532,12 +532,12 @@ export default gql`
 
   type TargetServicesResourceAssignment {
     mode: ResourceAssignmentMode!
-    services: [String!]!
+    services: [String!]
   }
 
   type TargetAppDeploymentsResourceAssignment {
     mode: ResourceAssignmentMode!
-    appDeployments: [String!]!
+    appDeployments: [String!]
   }
 
   type TargetResouceAssignment {
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index bdb11bc1b1..133354a308 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -9,12 +9,14 @@ import { AppDeploymentNameModel } from '../../app-deployments/providers/app-depl
 import { Logger } from '../../shared/providers/logger';
 import { PG_POOL_CONFIG } from '../../shared/providers/pg-pool';
 import { Storage } from '../../shared/providers/storage';
-import { OrganizationMemberRole, OrganizationMemberRoles } from './organization-member-roles';
+import { OrganizationMemberRoles, type OrganizationMemberRole } from './organization-member-roles';
 
-const WildcardAssignmentModel = z.literal('*');
-const GranularAssignmentModel = z.literal('granular');
+const WildcardAssignmentModeModel = z.literal('*');
+const GranularAssignmentModeModel = z.literal('granular');
 
-const SelectionModeModel = z.union([WildcardAssignmentModel, GranularAssignmentModel]);
+const WildcardAssignmentMode = z.object({
+  mode: WildcardAssignmentModeModel,
+});
 
 const AppDeploymentAssignmentModel = z.object({
   type: z.literal('appDeployment'),
@@ -23,23 +25,25 @@ const AppDeploymentAssignmentModel = z.object({
 
 const ServiceAssignmentModel = z.object({ type: z.literal('service'), serviceName: z.string() });
 
-const AssignedServicesModel = z.object({
-  mode: SelectionModeModel,
-  services: z
-    .array(ServiceAssignmentModel)
-    .optional()
-    .nullable()
-    .transform(value => value ?? []),
-});
-
-const AssignedAppDeploymentsModel = z.object({
-  mode: SelectionModeModel,
-  appDeployments: z
-    .array(AppDeploymentAssignmentModel)
-    .optional()
-    .nullable()
-    .transform(value => value ?? []),
-});
+const AssignedServicesModel = z.union([
+  z.object({
+    mode: GranularAssignmentModeModel,
+    services: z
+      .array(ServiceAssignmentModel)
+      .optional()
+      .nullable()
+      .transform(value => value ?? []),
+  }),
+  WildcardAssignmentMode,
+]);
+
+const AssignedAppDeploymentsModel = z.union([
+  z.object({
+    mode: GranularAssignmentModeModel,
+    appDeployments: z.array(AppDeploymentAssignmentModel),
+  }),
+  WildcardAssignmentMode,
+]);
 
 const TargetAssignmentModel = z.object({
   type: z.literal('target'),
@@ -48,14 +52,13 @@ const TargetAssignmentModel = z.object({
   appDeployments: AssignedAppDeploymentsModel,
 });
 
-const AssignedTargetsModel = z.object({
-  mode: SelectionModeModel,
-  targets: z
-    .array(TargetAssignmentModel)
-    .optional()
-    .nullable()
-    .transform(value => value ?? []),
-});
+const AssignedTargetsModel = z.union([
+  z.object({
+    mode: GranularAssignmentModeModel,
+    targets: z.array(TargetAssignmentModel),
+  }),
+  WildcardAssignmentMode,
+]);
 
 const ProjectAssignmentModel = z.object({
   type: z.literal('project'),
@@ -63,6 +66,11 @@ const ProjectAssignmentModel = z.object({
   targets: AssignedTargetsModel,
 });
 
+const GranularAssignedProjectsModel = z.object({
+  mode: GranularAssignmentModeModel,
+  projects: z.array(ProjectAssignmentModel),
+});
+
 /**
  * Tree data structure that represents the resources assigned to an organization member.
  *
@@ -72,19 +80,13 @@ const ProjectAssignmentModel = z.object({
  * If no resources are assigned to a member role, the permissions are granted on all the resources within the
  * organization.
  */
-const AssignedProjectsModel = z.object({
-  mode: SelectionModeModel,
-  projects: z
-    .array(ProjectAssignmentModel)
-    .optional()
-    .nullable()
-    .transform(value => value ?? []),
-});
+const AssignedProjectsModel = z.union([GranularAssignedProjectsModel, WildcardAssignmentMode]);
 
 /**
  * Resource assignments as stored within the database.
  */
 type ResourceAssignmentGroup = z.TypeOf<typeof AssignedProjectsModel>;
+type GranularAssignedProjects = z.TypeOf<typeof GranularAssignedProjectsModel>;
 
 const RawOrganizationMembershipModel = z.object({
   userId: z.string(),
@@ -327,6 +329,9 @@ export class OrganizationMembers {
   async resolveGraphQLMemberResourceAssignment(
     member: OrganizationMembership,
   ): Promise<GraphQLSchema.ResolversTypes['ResourceAssignment']> {
+    if (member.assignedRole.resources.mode === '*') {
+      return { mode: 'all' };
+    }
     const projects = await this.storage.findProjectsByIds({
       projectIds: member.assignedRole.resources.projects.map(project => project.id),
     });
@@ -335,7 +340,9 @@ export class OrganizationMembers {
       projects.get(row.id),
     );
 
-    const targetAssignments = filteredProjects.flatMap(project => project.targets.targets);
+    const targetAssignments = filteredProjects.flatMap(project =>
+      project.targets.mode === 'granular' ? project.targets.targets : [],
+    );
 
     const targets = await this.storage.findTargetsByIds({
       organizationId: member.organizationId,
@@ -343,7 +350,7 @@ export class OrganizationMembers {
     });
 
     return {
-      mode: member.assignedRole.resources.mode === '*' ? ('all' as const) : ('granular' as const),
+      mode: 'granular' as const,
       projects: filteredProjects
         .map(projectAssignment => {
           const project = projects.get(projectAssignment.id);
@@ -354,39 +361,42 @@ export class OrganizationMembers {
           return {
             projectId: project.id,
             project,
-            targets: {
-              mode:
-                projectAssignment.targets.mode === '*' ? ('all' as const) : ('granular' as const),
-              targets: projectAssignment.targets.targets
-                .map(targetAssignment => {
-                  const target = targets.get(targetAssignment.id);
-                  if (!target) return null;
-
-                  return {
-                    targetId: target.id,
-                    target,
-                    services: {
-                      mode:
-                        targetAssignment.services.mode === '*'
-                          ? ('all' as const)
-                          : ('granular' as const),
-                      services: targetAssignment.services.services.map(
-                        service => service.serviceName,
-                      ),
-                    },
-                    appDeployments: {
-                      mode:
-                        targetAssignment.appDeployments.mode === '*'
-                          ? ('all' as const)
-                          : ('granular' as const),
-                      appDeployments: targetAssignment.appDeployments.appDeployments.map(
-                        deployment => deployment.appName,
-                      ),
-                    },
-                  };
-                })
-                .filter(isSome),
-            },
+            targets:
+              projectAssignment.targets.mode === '*'
+                ? { mode: 'all' as const }
+                : {
+                    mode: 'granular' as const,
+                    targets: projectAssignment.targets.targets
+                      .map(targetAssignment => {
+                        const target = targets.get(targetAssignment.id);
+                        if (!target) return null;
+
+                        return {
+                          targetId: target.id,
+                          target,
+                          services:
+                            targetAssignment.services.mode === '*'
+                              ? { mode: 'all' as const }
+                              : {
+                                  mode: 'granular' as const,
+                                  services: targetAssignment.services.services.map(
+                                    service => service.serviceName,
+                                  ),
+                                },
+                          appDeployments:
+                            targetAssignment.appDeployments.mode === '*'
+                              ? { mode: 'all' as const }
+                              : {
+                                  mode: 'granular' as const,
+                                  appDeployments:
+                                    targetAssignment.appDeployments.appDeployments.map(
+                                      deployment => deployment.appName,
+                                    ),
+                                },
+                        };
+                      })
+                      .filter(isSome),
+                  },
           };
         })
         .filter(isSome),
@@ -406,16 +416,23 @@ export class OrganizationMembers {
     organization: Organization,
     input: GraphQLSchema.ResourceAssignmentInput,
   ): Promise<ResourceAssignmentGroup> {
+    if (
+      !input.projects ||
+      // No need to resolve the projects if mode "all" is used.
+      // We will not store the selection in the database.
+      input.mode === 'all'
+    ) {
+      return {
+        mode: '*',
+      };
+    }
+
     /** Mutable array that we populate with the resolved data from the database */
-    const resourceAssignmentGroup: ResourceAssignmentGroup = {
-      mode: input.mode === 'all' ? '*' : 'granular',
+    const resourceAssignmentGroup: GranularAssignedProjects = {
+      mode: 'granular',
       projects: [],
     };
 
-    if (!input.projects) {
-      return resourceAssignmentGroup;
-    }
-
     const sanitizedProjects = input.projects.filter(project => isUUID(project.projectId));
 
     const projects = await this.storage.findProjectsByIds({
@@ -455,6 +472,12 @@ export class OrganizationMembers {
         },
       });
 
+      // No need to resolve the projects if mode "a;ll" is used.
+      // We will not store the selection in the database.
+      if (record.targets.mode === 'all') {
+        continue;
+      }
+
       if (record.targets.targets) {
         const sanitizedTargets = record.targets.targets.filter(target => isUUID(target.targetId));
         for (const target of sanitizedTargets) {
@@ -487,25 +510,31 @@ export class OrganizationMembers {
         record.projectTargets.push({
           type: 'target',
           id: target.id,
-          appDeployments: {
-            mode: targetRecord.appDeployments.mode === 'all' ? '*' : 'granular',
-            appDeployments:
-              targetRecord.appDeployments.appDeployments
-                ?.filter(name => AppDeploymentNameModel.safeParse(name).success)
-                .map(record => ({
-                  type: 'appDeployment',
-                  appName: record.appDeployment,
-                })) ?? [],
-          },
-          services: {
-            mode: targetRecord.services.mode === 'all' ? '*' : 'granular',
-            services:
-              // TODO: it seems like we do not validate service names
-              targetRecord.services.services?.map(record => ({
-                type: 'service',
-                serviceName: record?.serviceName,
-              })) ?? [],
-          },
+          services:
+            targetRecord.services.mode === 'all'
+              ? { mode: '*' }
+              : {
+                  mode: 'granular',
+                  services:
+                    // TODO: it seems like we do not validate service names
+                    targetRecord.services.services?.map(record => ({
+                      type: 'service',
+                      serviceName: record?.serviceName,
+                    })) ?? [],
+                },
+          appDeployments:
+            targetRecord.appDeployments.mode === 'all'
+              ? { mode: '*' }
+              : {
+                  mode: 'granular',
+                  appDeployments:
+                    targetRecord.appDeployments.appDeployments
+                      ?.filter(name => AppDeploymentNameModel.safeParse(name).success)
+                      .map(record => ({
+                        type: 'appDeployment',
+                        appName: record.appDeployment,
+                      })) ?? [],
+                },
         });
       }
     }
diff --git a/packages/services/api/src/modules/schema/providers/schema-version-helper.ts b/packages/services/api/src/modules/schema/providers/schema-version-helper.ts
index 86bc1df38c..63ba25c676 100644
--- a/packages/services/api/src/modules/schema/providers/schema-version-helper.ts
+++ b/packages/services/api/src/modules/schema/providers/schema-version-helper.ts
@@ -11,7 +11,6 @@ import {
 import { ProjectType } from '../../../shared/entities';
 import { cache } from '../../../shared/helpers';
 import { parseGraphQLSource } from '../../../shared/schema';
-import { OrganizationManager } from '../../organization/providers/organization-manager';
 import { ProjectManager } from '../../project/providers/project-manager';
 import { Logger } from '../../shared/providers/logger';
 import { Storage } from '../../shared/providers/storage';
@@ -33,7 +32,6 @@ export class SchemaVersionHelper {
     private schemaManager: SchemaManager,
     private schemaHelper: SchemaHelper,
     private projectManager: ProjectManager,
-    private organizationManager: OrganizationManager,
     private registryChecks: RegistryChecks,
     private storage: Storage,
     private logger: Logger,
@@ -57,7 +55,7 @@ export class SchemaVersionHelper {
         organizationId: schemaVersion.organizationId,
         projectId: schemaVersion.projectId,
       }),
-      this.organizationManager.getOrganization({
+      this.storage.getOrganization({
         organizationId: schemaVersion.organizationId,
       }),
     ]);
diff --git a/packages/web/app/src/components/organization/members/member-role-picker.tsx b/packages/web/app/src/components/organization/members/member-role-picker.tsx
index 97aa99c9a9..a2d65f3ac2 100644
--- a/packages/web/app/src/components/organization/members/member-role-picker.tsx
+++ b/packages/web/app/src/components/organization/members/member-role-picker.tsx
@@ -114,7 +114,7 @@ export function MemberRolePicker(props: {
               targetId: target.target.id,
               services: {
                 mode: target.services.mode,
-                services: target.services.services.map(
+                services: target.services.services?.map(
                   (service): GraphQLSchema.ServiceResourceAssignmentInput => ({
                     serviceName: service,
                   }),
@@ -122,7 +122,7 @@ export function MemberRolePicker(props: {
               },
               appDeployments: {
                 mode: target.appDeployments.mode,
-                appDeployments: target.appDeployments.appDeployments.map(
+                appDeployments: target.appDeployments.appDeployments?.map(
                   (appDeploymentName): GraphQLSchema.AppDeploymentResourceAssignmentInput => ({
                     appDeployment: appDeploymentName,
                   }),

From 912947c95c2e002a7b1277a1d702b92dcb114e59 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 27 Jan 2025 14:57:25 +0100
Subject: [PATCH 47/55] lint

---
 packages/services/api/src/modules/auth/providers/auth-manager.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/services/api/src/modules/auth/providers/auth-manager.ts b/packages/services/api/src/modules/auth/providers/auth-manager.ts
index 90d47425f4..6bc15c7970 100644
--- a/packages/services/api/src/modules/auth/providers/auth-manager.ts
+++ b/packages/services/api/src/modules/auth/providers/auth-manager.ts
@@ -1,7 +1,6 @@
 import { Injectable, Scope } from 'graphql-modules';
 import type { User } from '../../../shared/entities';
 import { AccessError } from '../../../shared/errors';
-import { Storage } from '../../shared/providers/storage';
 import { Session } from '../lib/authz';
 import { TargetAccessTokenSession } from '../lib/target-access-token-strategy';
 import {

From af6f7c482302ba8502b1bef2c22737f0daf80365 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Mon, 27 Jan 2025 17:52:16 +0100
Subject: [PATCH 48/55] fix permission inheritance

---
 .../tests/api/schema/check.spec.ts            |  4 +--
 .../providers/organization-members.ts         | 33 ++++++++++++-------
 .../members/resource-selector.tsx             |  7 +++-
 3 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/integration-tests/tests/api/schema/check.spec.ts b/integration-tests/tests/api/schema/check.spec.ts
index 67063c125b..75e2591874 100644
--- a/integration-tests/tests/api/schema/check.spec.ts
+++ b/integration-tests/tests/api/schema/check.spec.ts
@@ -1627,8 +1627,8 @@ test.concurrent(
               targets: [
                 {
                   targetId: target.id,
-                  appDeployments: { mode: ResourceAssignmentMode.Granular, appDeployments: [] },
-                  services: { mode: ResourceAssignmentMode.Granular, services: [] },
+                  appDeployments: { mode: ResourceAssignmentMode.All },
+                  services: { mode: ResourceAssignmentMode.All },
                 },
               ],
             },
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index 133354a308..d6019c39d4 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -2,7 +2,7 @@ import { Inject, Injectable, Scope } from 'graphql-modules';
 import { sql, type DatabasePool } from 'slonik';
 import { z } from 'zod';
 import * as GraphQLSchema from '../../../__generated__/types';
-import { Organization } from '../../../shared/entities';
+import { type Organization, type Project } from '../../../shared/entities';
 import { batchBy } from '../../../shared/helpers';
 import { isUUID } from '../../../shared/is-uuid';
 import { AppDeploymentNameModel } from '../../app-deployments/providers/app-deployments';
@@ -198,6 +198,11 @@ export class OrganizationMembers {
           projects: [],
         };
 
+        const resolvedResources = resolveResourceAssignment({
+          organizationId: organization.id,
+          projects: resources,
+        });
+
         organizationMembershipByUserId.set(record.userId, {
           organizationId: organization.id,
           userId: record.userId,
@@ -205,10 +210,7 @@ export class OrganizationMembers {
           connectedToZendesk: record.connectedToZendesk,
           assignedRole: {
             resources,
-            resolvedResources: resolveResourceAssignment({
-              organizationId: organization.id,
-              projects: resources,
-            }),
+            resolvedResources,
             role: membershipRole,
           },
         });
@@ -445,7 +447,7 @@ export class OrganizationMembers {
     // This prevents breaking permission boundaries through fault/sus input.
     const targetLookupIds = new Set<string>();
     const projectTargetAssignments: Array<{
-      projectId: string;
+      project: Project;
       /**  mutable array that is within "resourceAssignmentGroup" */
       projectTargets: Array<z.TypeOf<typeof TargetAssignmentModel>>;
       targets: readonly GraphQLSchema.TargetResourceAssignmentInput[];
@@ -486,7 +488,7 @@ export class OrganizationMembers {
         projectTargetAssignments.push({
           projectTargets,
           targets: sanitizedTargets,
-          projectId: project.id,
+          project,
         });
       }
     }
@@ -502,7 +504,7 @@ export class OrganizationMembers {
 
         // In case the target was not found or does not belogn the the organization,
         // we omit it as it could grant an user permissions for a target within another organization.
-        if (!target || target.projectId !== record.projectId) {
+        if (!target || target.projectId !== record.project.id) {
           this.logger.debug('Omitted non-existing target.');
           continue;
         }
@@ -511,6 +513,8 @@ export class OrganizationMembers {
           type: 'target',
           id: target.id,
           services:
+            // monolith schemas do not have services.
+            record.project.type === GraphQLSchema.ProjectType.SINGLE ||
             targetRecord.services.mode === 'all'
               ? { mode: '*' }
               : {
@@ -631,10 +635,10 @@ function resolveResourceAssignment(args: {
     };
   }
 
-  let projectAssignments: ResolvedResourceAssignments['project'] = [];
-  let targetAssignments: ResolvedResourceAssignments['target'] = [];
-  let serviceAssignments: ResolvedResourceAssignments['service'] = [];
-  let appDeploymentAssignments: ResolvedResourceAssignments['appDeployment'] = [];
+  const projectAssignments: ResolvedResourceAssignments['project'] = [];
+  const targetAssignments: ResolvedResourceAssignments['target'] = [];
+  const serviceAssignments: ResolvedResourceAssignments['service'] = [];
+  const appDeploymentAssignments: ResolvedResourceAssignments['appDeployment'] = [];
 
   for (const project of args.projects.projects) {
     const projectAssignment: ProjectAssignment = {
@@ -644,7 +648,10 @@ function resolveResourceAssignment(args: {
     projectAssignments.push(projectAssignment);
 
     if (project.targets.mode === '*') {
+      // allow actions on all sub-resources of this project
       targetAssignments.push(projectAssignment);
+      serviceAssignments.push(projectAssignment);
+      appDeploymentAssignments.push(projectAssignment);
       continue;
     }
 
@@ -658,6 +665,7 @@ function resolveResourceAssignment(args: {
 
       // services
       if (target.services.mode === '*') {
+        // allow actions on all services of this target
         serviceAssignments.push(targetAssignment);
       } else {
         for (const service of target.services.services) {
@@ -671,6 +679,7 @@ function resolveResourceAssignment(args: {
 
       // app deployments
       if (target.appDeployments.mode === '*') {
+        // allow actions on all app deployments of this target
         appDeploymentAssignments.push(targetAssignment);
       } else {
         for (const appDeployment of target.appDeployments.appDeployments) {
diff --git a/packages/web/app/src/components/organization/members/resource-selector.tsx b/packages/web/app/src/components/organization/members/resource-selector.tsx
index 721cd31f58..260e187321 100644
--- a/packages/web/app/src/components/organization/members/resource-selector.tsx
+++ b/packages/web/app/src/components/organization/members/resource-selector.tsx
@@ -178,6 +178,7 @@ export function ResourceSelector(props: {
     }
 
     const projectId = projectState.activeProject.project.id;
+    const projectType = projectState.activeProject.project.type;
 
     if (
       projectState.activeProject.projectSelection.targets.mode ===
@@ -260,7 +261,11 @@ export function ResourceSelector(props: {
                 appDeployments: [],
               },
               services: {
-                mode: GraphQLSchema.ResourceAssignmentMode.Granular,
+                mode:
+                  // for single projects we choose "All" by default as there is no granular selection available
+                  projectType === GraphQLSchema.ProjectType.Single
+                    ? GraphQLSchema.ResourceAssignmentMode.All
+                    : GraphQLSchema.ResourceAssignmentMode.Granular,
                 services: [],
               },
             });

From 6d7acf79639a7d0c8db42d26d0266f42d75d83e4 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 10:36:51 +0100
Subject: [PATCH 49/55] unit test for resource assignment group translation

---
 .../providers/organization-member.spec.ts     | 541 ++++++++++++++++++
 .../providers/organization-members.ts         |   2 +-
 2 files changed, 542 insertions(+), 1 deletion(-)
 create mode 100644 packages/services/api/src/modules/organization/providers/organization-member.spec.ts

diff --git a/packages/services/api/src/modules/organization/providers/organization-member.spec.ts b/packages/services/api/src/modules/organization/providers/organization-member.spec.ts
new file mode 100644
index 0000000000..1fe26c5599
--- /dev/null
+++ b/packages/services/api/src/modules/organization/providers/organization-member.spec.ts
@@ -0,0 +1,541 @@
+import { resolveResourceAssignment } from './organization-members';
+
+describe('resolveResourceAssignment', () => {
+  test('project wildcard: organization wide access to all resources', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: '*',
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      target: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      service: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      appDeployment: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+    });
+  });
+  test('project granular: access to single project', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: { mode: '*' },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      service: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      appDeployment: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+    });
+  });
+  test('project granular: access to multiple projects', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: { mode: '*' },
+              type: 'project',
+            },
+            {
+              id: 'ccc',
+              targets: { mode: '*' },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+        {
+          projectId: 'ccc',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+        {
+          projectId: 'ccc',
+          type: 'project',
+        },
+      ],
+      service: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+        {
+          projectId: 'ccc',
+          type: 'project',
+        },
+      ],
+      appDeployment: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+        {
+          projectId: 'ccc',
+          type: 'project',
+        },
+      ],
+    });
+  });
+  test('target granular: access to single target', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: { mode: '*' },
+                    services: { mode: '*' },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      service: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+    });
+  });
+  test('target granular: access to multiple targets', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: { mode: '*' },
+                    services: { mode: '*' },
+                  },
+                  {
+                    id: 'ddd',
+                    type: 'target',
+                    appDeployments: { mode: '*' },
+                    services: { mode: '*' },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+        {
+          targetId: 'ddd',
+          type: 'target',
+        },
+      ],
+      service: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+        {
+          targetId: 'ddd',
+          type: 'target',
+        },
+      ],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+        {
+          targetId: 'ddd',
+          type: 'target',
+        },
+      ],
+    });
+  });
+  test('service granular: access to single service', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: { mode: '*' },
+                    services: {
+                      mode: 'granular',
+                      services: [
+                        {
+                          serviceName: 'my-service',
+                          type: 'service',
+                        },
+                      ],
+                    },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      service: [
+        {
+          serviceName: 'my-service',
+          targetId: 'ccc',
+          type: 'service',
+        },
+      ],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+    });
+  });
+  test('service granular: access to multiple services', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: { mode: '*' },
+                    services: {
+                      mode: 'granular',
+                      services: [
+                        {
+                          serviceName: 'my-service',
+                          type: 'service',
+                        },
+                        {
+                          serviceName: 'my-other-service',
+                          type: 'service',
+                        },
+                      ],
+                    },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      service: [
+        {
+          serviceName: 'my-service',
+          targetId: 'ccc',
+          type: 'service',
+        },
+        {
+          serviceName: 'my-other-service',
+          targetId: 'ccc',
+          type: 'service',
+        },
+      ],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+    });
+  });
+  test('app deployment granular: access to single app deployment', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: {
+                      mode: 'granular',
+                      appDeployments: [{ appName: 'my-app', type: 'appDeployment' }],
+                    },
+                    services: {
+                      mode: 'granular',
+                      services: [],
+                    },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      service: [],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          appDeploymentName: 'my-app',
+          type: 'appDeployment',
+        },
+      ],
+    });
+  });
+  test('app deployment granular: access to multiple app deployments', () => {
+    expect(
+      resolveResourceAssignment({
+        organizationId: 'aaa',
+        projects: {
+          mode: 'granular',
+          projects: [
+            {
+              id: 'bbb',
+              targets: {
+                mode: 'granular',
+                targets: [
+                  {
+                    id: 'ccc',
+                    type: 'target',
+                    appDeployments: {
+                      mode: 'granular',
+                      appDeployments: [
+                        { appName: 'my-app', type: 'appDeployment' },
+                        { appName: 'my-other-app', type: 'appDeployment' },
+                      ],
+                    },
+                    services: {
+                      mode: 'granular',
+                      services: [],
+                    },
+                  },
+                ],
+              },
+              type: 'project',
+            },
+          ],
+        },
+      }),
+    ).toEqual({
+      organization: {
+        organizationId: 'aaa',
+        type: 'organization',
+      },
+      project: [
+        {
+          projectId: 'bbb',
+          type: 'project',
+        },
+      ],
+      target: [
+        {
+          targetId: 'ccc',
+          type: 'target',
+        },
+      ],
+      service: [],
+      appDeployment: [
+        {
+          targetId: 'ccc',
+          appDeploymentName: 'my-app',
+          type: 'appDeployment',
+        },
+        {
+          targetId: 'ccc',
+          appDeploymentName: 'my-other-app',
+          type: 'appDeployment',
+        },
+      ],
+    });
+  });
+});
diff --git a/packages/services/api/src/modules/organization/providers/organization-members.ts b/packages/services/api/src/modules/organization/providers/organization-members.ts
index d6019c39d4..69e3937072 100644
--- a/packages/services/api/src/modules/organization/providers/organization-members.ts
+++ b/packages/services/api/src/modules/organization/providers/organization-members.ts
@@ -616,7 +616,7 @@ type ResolvedResourceAssignments = {
  *
  * If one level specifies "*", it needs to inherit the resources defined on the next upper level.
  */
-function resolveResourceAssignment(args: {
+export function resolveResourceAssignment(args: {
   organizationId: string;
   projects: ResourceAssignmentGroup;
 }): ResolvedResourceAssignments {

From 0ac6d0ed3761f70441d8b4db15fd906c3a875d07 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 12:54:53 +0100
Subject: [PATCH 50/55] overflow-auto

---
 .../web/app/src/components/organization/members/roles.tsx     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/roles.tsx b/packages/web/app/src/components/organization/members/roles.tsx
index 6bb47bac8f..5a6fb65b60 100644
--- a/packages/web/app/src/components/organization/members/roles.tsx
+++ b/packages/web/app/src/components/organization/members/roles.tsx
@@ -229,7 +229,7 @@ function OrganizationMemberRoleEditor(props: {
             <div className="grow">
               <div className="flex h-[400px] flex-col space-y-2">
                 <FormLabel>Permissions</FormLabel>
-                <div className="overflow-scroll">
+                <div className="overflow-y-auto">
                   <PermissionSelector
                     onSelectedPermissionsChange={onChangeSelectedPermissions}
                     organization={organization}
@@ -481,7 +481,7 @@ function OrganizationMemberRoleCreator(props: {
               <div className="grow">
                 <div className="flex h-[400px] flex-col space-y-2">
                   <FormLabel>Permissions</FormLabel>
-                  <div className="overflow-scroll">
+                  <div className="overflow-y-auto">
                     <PermissionSelector
                       onSelectedPermissionsChange={onChangeSelectedPermissions}
                       organization={organization}

From f182dd8b3d8e984be5057c35559414004e56f765 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 12:57:04 +0100
Subject: [PATCH 51/55] no tooltip delay

---
 .../components/organization/members/permission-selector.tsx   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index 509754db14..37f383f00c 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -140,7 +140,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                     </div>
                     {permission.warning && props.selectedPermissionIds.has(permission.id) ? (
                       <div className="flex grow justify-end">
-                        <TooltipProvider>
+                        <TooltipProvider delayDuration={0}>
                           <Tooltip>
                             <TooltipTrigger>
                               <TriangleAlert className="text-yellow-700" />
@@ -153,7 +153,7 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                       !!permission.dependsOnId &&
                       permissionToGroupTitleMapping.has(permission.dependsOnId) && (
                         <div className="flex grow justify-end">
-                          <TooltipProvider>
+                          <TooltipProvider delayDuration={0}>
                             <Tooltip>
                               <TooltipTrigger>
                                 <InfoIcon />

From d2a31c563701167f4b8367f8cddf46cc1c59345e Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 13:16:22 +0100
Subject: [PATCH 52/55] focus ring scurr

---
 .../members/permission-selector.tsx           | 201 +++++++++---------
 1 file changed, 104 insertions(+), 97 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index 37f383f00c..74e85294b0 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -121,113 +121,120 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                   !props.selectedPermissionIds.has(permission.dependsOnId);
 
                 return (
-                  <div
-                    className={cn(
-                      'flex flex-row items-center justify-between space-x-4 border-orange-500 pb-2 text-sm',
-                      focusedPermission === permission.id && '-m-[1px] border',
-                    )}
-                    key={permission.id}
-                    data-permission-id={permission.id}
-                    ref={ref => {
-                      if (ref) {
-                        permissionRefs.current.set(permission.id, ref);
-                      }
-                    }}
-                  >
-                    <div className={cn(needsDependency && 'opacity-30')}>
-                      <div className="font-semibold text-white">{permission.title}</div>
-                      <div className="text-xs text-gray-400">{permission.description}</div>
-                    </div>
-                    {permission.warning && props.selectedPermissionIds.has(permission.id) ? (
-                      <div className="flex grow justify-end">
-                        <TooltipProvider delayDuration={0}>
-                          <Tooltip>
-                            <TooltipTrigger>
-                              <TriangleAlert className="text-yellow-700" />
-                            </TooltipTrigger>
-                            <TooltipContent>{permission.warning}</TooltipContent>
-                          </Tooltip>
-                        </TooltipProvider>
+                  <div className="relative">
+                    <div
+                      className={cn(
+                        'flex flex-row items-center justify-between space-x-4 pb-2 pr-2 text-sm',
+                      )}
+                      key={permission.id}
+                      data-permission-id={permission.id}
+                      ref={ref => {
+                        if (ref) {
+                          permissionRefs.current.set(permission.id, ref);
+                        }
+                      }}
+                    >
+                      <div className={cn(needsDependency && 'opacity-30')}>
+                        <div className="font-semibold text-white">{permission.title}</div>
+                        <div className="text-xs text-gray-400">{permission.description}</div>
                       </div>
-                    ) : (
-                      !!permission.dependsOnId &&
-                      permissionToGroupTitleMapping.has(permission.dependsOnId) && (
+                      {permission.warning && props.selectedPermissionIds.has(permission.id) ? (
                         <div className="flex grow justify-end">
                           <TooltipProvider delayDuration={0}>
                             <Tooltip>
                               <TooltipTrigger>
-                                <InfoIcon />
+                                <TriangleAlert className="text-yellow-700" />
                               </TooltipTrigger>
-                              <TooltipContent>
-                                <p>
-                                  This permission depends on another permission.{' '}
-                                  <Button
-                                    variant="orangeLink"
-                                    onClick={() => {
-                                      const dependencyPermission = permission.dependsOnId;
-                                      if (!dependencyPermission) {
-                                        return;
-                                      }
-                                      const element =
-                                        permissionRefs.current.get(dependencyPermission);
-
-                                      if (!element) {
-                                        return;
-                                      }
-                                      setOpenAccordions(values => {
-                                        const groupName =
-                                          permissionToGroupTitleMapping.get(dependencyPermission);
-
-                                        if (groupName && values.includes(groupName) === false) {
-                                          return [...values, groupName];
-                                        }
-                                        return values;
-                                      });
-                                      setFocusedPermission(dependencyPermission);
-                                      element.scrollIntoView({ behavior: 'smooth' });
-                                    }}
-                                  >
-                                    View permission.
-                                  </Button>
-                                </p>
-                              </TooltipContent>
+                              <TooltipContent>{permission.warning}</TooltipContent>
                             </Tooltip>
                           </TooltipProvider>
                         </div>
-                      )
-                    )}
-                    <Select
-                      disabled={props.isReadOnly || permission.isReadOnly || needsDependency}
-                      value={
-                        permission.isReadOnly || props.selectedPermissionIds.has(permission.id)
-                          ? 'allow'
-                          : 'not-selected'
-                      }
-                      onValueChange={value => {
-                        const dependents = dependencyGraph.get(permission.id) ?? [];
-                        if (value === 'allow') {
-                          props.onSelectedPermissionsChange(
-                            new Set([...props.selectedPermissionIds, permission.id]),
-                          );
-                        } else if (value === 'not-selected') {
-                          const selectedPermissionIds = new Set(props.selectedPermissionIds);
-                          selectedPermissionIds.delete(permission.id);
-                          for (const dependent of dependents) {
-                            selectedPermissionIds.delete(dependent);
-                          }
-                          props.onSelectedPermissionsChange(selectedPermissionIds);
+                      ) : (
+                        !!permission.dependsOnId &&
+                        permissionToGroupTitleMapping.has(permission.dependsOnId) && (
+                          <div className="flex grow justify-end">
+                            <TooltipProvider delayDuration={0}>
+                              <Tooltip>
+                                <TooltipTrigger>
+                                  <InfoIcon />
+                                </TooltipTrigger>
+                                <TooltipContent>
+                                  <p>
+                                    This permission depends on another permission.{' '}
+                                    <Button
+                                      variant="orangeLink"
+                                      onClick={() => {
+                                        const dependencyPermission = permission.dependsOnId;
+                                        if (!dependencyPermission) {
+                                          return;
+                                        }
+                                        const element =
+                                          permissionRefs.current.get(dependencyPermission);
+
+                                        if (!element) {
+                                          return;
+                                        }
+                                        setOpenAccordions(values => {
+                                          const groupName =
+                                            permissionToGroupTitleMapping.get(dependencyPermission);
+
+                                          if (groupName && values.includes(groupName) === false) {
+                                            return [...values, groupName];
+                                          }
+                                          return values;
+                                        });
+                                        setFocusedPermission(dependencyPermission);
+                                        element.scrollIntoView({
+                                          behavior: 'smooth',
+                                          block: 'center',
+                                        });
+                                      }}
+                                    >
+                                      View permission.
+                                    </Button>
+                                  </p>
+                                </TooltipContent>
+                              </Tooltip>
+                            </TooltipProvider>
+                          </div>
+                        )
+                      )}
+                      <Select
+                        disabled={props.isReadOnly || permission.isReadOnly || needsDependency}
+                        value={
+                          permission.isReadOnly || props.selectedPermissionIds.has(permission.id)
+                            ? 'allow'
+                            : 'not-selected'
                         }
-                        setFocusedPermission(null);
-                      }}
-                    >
-                      <SelectTrigger className="w-[150px] shrink-0">
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        <SelectItem value="not-selected">Not Selected</SelectItem>
-                        <SelectItem value="allow">Allow</SelectItem>
-                      </SelectContent>
-                    </Select>
+                        onValueChange={value => {
+                          const dependents = dependencyGraph.get(permission.id) ?? [];
+                          if (value === 'allow') {
+                            props.onSelectedPermissionsChange(
+                              new Set([...props.selectedPermissionIds, permission.id]),
+                            );
+                          } else if (value === 'not-selected') {
+                            const selectedPermissionIds = new Set(props.selectedPermissionIds);
+                            selectedPermissionIds.delete(permission.id);
+                            for (const dependent of dependents) {
+                              selectedPermissionIds.delete(dependent);
+                            }
+                            props.onSelectedPermissionsChange(selectedPermissionIds);
+                          }
+                          setFocusedPermission(null);
+                        }}
+                      >
+                        <SelectTrigger className="w-[150px] shrink-0">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="not-selected">Not Selected</SelectItem>
+                          <SelectItem value="allow">Allow</SelectItem>
+                        </SelectContent>
+                      </Select>
+                    </div>
+                    {focusedPermission === permission.id && (
+                      <div className="pointer-events-none absolute bottom-[3px] left-[-7px] right-0 top-[-4px] rounded-sm border border-yellow-400" />
+                    )}
                   </div>
                 );
               })}

From d219e5b6f2fe8876d24c21d274cc12fe36df64bf Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 13:25:33 +0100
Subject: [PATCH 53/55] typo

---
 integration-tests/testkit/seed.ts                | 4 ++--
 integration-tests/tests/api/project/crud.spec.ts | 4 ++--
 integration-tests/tests/api/schema/check.spec.ts | 8 ++++----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/integration-tests/testkit/seed.ts b/integration-tests/testkit/seed.ts
index a7cf737f07..d48dc568dc 100644
--- a/integration-tests/testkit/seed.ts
+++ b/integration-tests/testkit/seed.ts
@@ -807,7 +807,7 @@ export function initSeed() {
                   input: {
                     roleId: string;
                     userId: string;
-                    resouces?: GraphQLSchema.ResourceAssignmentInput;
+                    resources?: GraphQLSchema.ResourceAssignmentInput;
                   },
                   options: { useMemberToken?: boolean } = {
                     useMemberToken: false,
@@ -818,7 +818,7 @@ export function initSeed() {
                       organizationSlug: organization.slug,
                       userId: input.userId,
                       roleId: input.roleId,
-                      resources: input.resouces ?? {
+                      resources: input.resources ?? {
                         mode: GraphQLSchema.ResourceAssignmentMode.All,
                         projects: [],
                       },
diff --git a/integration-tests/tests/api/project/crud.spec.ts b/integration-tests/tests/api/project/crud.spec.ts
index 8c060b200a..26cb0e8780 100644
--- a/integration-tests/tests/api/project/crud.spec.ts
+++ b/integration-tests/tests/api/project/crud.spec.ts
@@ -216,7 +216,7 @@ test.concurrent('prevent access to projects with assigned resources on member',
   await assignMemberRole({
     roleId: member.role.id,
     userId: member.user.id,
-    resouces: {
+    resources: {
       mode: ResourceAssignmentMode.Granular,
       projects: [],
     },
@@ -245,7 +245,7 @@ test.concurrent('restrict access to single project with assigned resources on me
   await assignMemberRole({
     roleId: member.role.id,
     userId: member.user.id,
-    resouces: {
+    resources: {
       mode: ResourceAssignmentMode.Granular,
       projects: [
         {
diff --git a/integration-tests/tests/api/schema/check.spec.ts b/integration-tests/tests/api/schema/check.spec.ts
index 75e2591874..bacd1ba38b 100644
--- a/integration-tests/tests/api/schema/check.spec.ts
+++ b/integration-tests/tests/api/schema/check.spec.ts
@@ -1370,7 +1370,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: member.role.id,
       userId: member.user.id,
-      resouces: { mode: ResourceAssignmentMode.Granular, projects: [] },
+      resources: { mode: ResourceAssignmentMode.Granular, projects: [] },
     });
 
     // Attempt approving the failed schema check
@@ -1448,7 +1448,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: memberRole.id,
       userId: member.user.id,
-      resouces: { mode: ResourceAssignmentMode.Granular, projects: [] },
+      resources: { mode: ResourceAssignmentMode.Granular, projects: [] },
     });
 
     // Attempt approving the failed schema check
@@ -1528,7 +1528,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: memberRole.id,
       userId: member.user.id,
-      resouces: {
+      resources: {
         mode: ResourceAssignmentMode.Granular,
         projects: [
           {
@@ -1617,7 +1617,7 @@ test.concurrent(
     await assignMemberRole({
       roleId: memberRole.id,
       userId: member.user.id,
-      resouces: {
+      resources: {
         mode: ResourceAssignmentMode.Granular,
         projects: [
           {

From d679387ec12ae1adf2d5638af92115ca390b9ea7 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 13:29:42 +0100
Subject: [PATCH 54/55] ai bro

---
 .../components/organization/members/permission-selector.tsx    | 3 +--
 packages/web/app/src/components/organization/members/roles.tsx | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index 74e85294b0..a7d983b9f9 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -121,12 +121,11 @@ export function PermissionSelector(props: PermissionSelectorProps) {
                   !props.selectedPermissionIds.has(permission.dependsOnId);
 
                 return (
-                  <div className="relative">
+                  <div className="relative" key={permission.id}>
                     <div
                       className={cn(
                         'flex flex-row items-center justify-between space-x-4 pb-2 pr-2 text-sm',
                       )}
-                      key={permission.id}
                       data-permission-id={permission.id}
                       ref={ref => {
                         if (ref) {
diff --git a/packages/web/app/src/components/organization/members/roles.tsx b/packages/web/app/src/components/organization/members/roles.tsx
index 5a6fb65b60..f9fa6d2d8d 100644
--- a/packages/web/app/src/components/organization/members/roles.tsx
+++ b/packages/web/app/src/components/organization/members/roles.tsx
@@ -377,7 +377,7 @@ function OrganizationMemberRoleCreator(props: {
 
   const onChangeSelectedPermissions = useCallback((permissions: ReadonlySet<string>) => {
     setSelectedPermissions(new Set(permissions));
-    form.setValue('selectedPermissions', [...selectedPermissions]);
+    form.setValue('selectedPermissions', [...permissions]);
   }, []);
 
   const [showOnlyGrantedPermissions, setShowOnlyGrantedPermissions] = useState(true);

From d06ba598fd8ecc3a7d621a9877229a596f581d55 Mon Sep 17 00:00:00 2001
From: Laurin Quast <laurinquast@googlemail.com>
Date: Tue, 28 Jan 2025 15:44:47 +0100
Subject: [PATCH 55/55] access

---
 .../components/organization/members/permission-selector.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/web/app/src/components/organization/members/permission-selector.tsx b/packages/web/app/src/components/organization/members/permission-selector.tsx
index a7d983b9f9..841c5e7187 100644
--- a/packages/web/app/src/components/organization/members/permission-selector.tsx
+++ b/packages/web/app/src/components/organization/members/permission-selector.tsx
@@ -104,7 +104,11 @@ export function PermissionSelector(props: PermissionSelectorProps) {
       {groups.map(group => {
         return (
           <AccordionItem value={group.title} key={group.title}>
-            <AccordionTrigger className="w-full" key={group.title}>
+            <AccordionTrigger
+              className="w-full"
+              key={group.title}
+              aria-label={`${group.title} permission group with ${group.selectedPermissionCount} permissions selected`}
+            >
               {group.title}{' '}
               <span className="ml-auto mr-0">
                 {group.selectedPermissionCount > 0 && (