feat(webapp): Owner-gate org/project management API routes (manage:organization / manage:project)

Author: nicktrn

apps/webapp/app/routes/api.v1.orgs.$orgParam.ts

@@ -4,7 +4,10 @@ import { z } from "zod";
 import { prisma } from "~/db.server";
 import { DeleteOrganizationService } from "~/services/deleteOrganization.server";
 import { logger } from "~/services/logger.server";
-import { resolveOrganizationForApiUser } from "~/services/organizationApiAccess.server";
+import {
+  authorizePatOrganizationAccess,
+  resolveOrganizationForApiUser,
+} from "~/services/organizationApiAccess.server";
 import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
 
 const ParamsSchema = z.object({
@@ -34,8 +37,6 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
     }
 
-    // Org delete/rename are membership-scoped only — the dashboard settings
-    // route gates them on membership, not an RBAC ability.
     const organization = await resolveOrganizationForApiUser({
       orgParam: parsedParams.data.orgParam,
       userId: authenticationResult.userId,
@@ -45,6 +46,18 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Organization not found" }, { status: 404 });
     }
 
+    // Rename/delete are Owner-only (via manage:all). Membership resolution above
+    // is the OSS floor; this is the role gate enforced when the RBAC plugin runs.
+    const denied = await authorizePatOrganizationAccess({
+      request,
+      organizationId: organization.id,
+      resource: "organization",
+      action: "manage",
+    });
+    if (denied) {
+      return denied;
+    }
+
     if (method === "DELETE") {
       try {
         await new DeleteOrganizationService().call({

apps/webapp/app/routes/api.v1.projects.$projectRef.default-region.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { prisma } from "~/db.server";
 import { RegionsPresenter } from "~/presenters/v3/RegionsPresenter.server";
 import { logger } from "~/services/logger.server";
+import { authorizePatOrganizationAccess } from "~/services/organizationApiAccess.server";
 import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
 import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { SetDefaultRegionService } from "~/v3/services/setDefaultRegion.server";
@@ -47,13 +48,24 @@ export async function action({ request, params }: ActionFunctionArgs) {
         },
         deletedAt: null,
       },
-      select: { id: true, slug: true },
+      select: { id: true, slug: true, organizationId: true },
     });
 
     if (!project) {
       return json({ error: "Project not found" }, { status: 404 });
     }
 
+    // Setting a project's region is Owner-only (via manage:all).
+    const denied = await authorizePatOrganizationAccess({
+      request,
+      organizationId: project.organizationId,
+      resource: "project",
+      action: "manage",
+    });
+    if (denied) {
+      return denied;
+    }
+
     let rawBody: unknown;
     try {
       rawBody = await request.json();

apps/webapp/app/routes/api.v1.projects.$projectRef.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { prisma } from "~/db.server";
 import { DeleteProjectService } from "~/services/deleteProject.server";
 import { logger } from "~/services/logger.server";
+import { authorizePatOrganizationAccess } from "~/services/organizationApiAccess.server";
 import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
 import { ProjectSettingsService } from "~/services/projectSettings.server";
 
@@ -106,13 +107,25 @@ export async function action({ request, params }: ActionFunctionArgs) {
       organization: { deletedAt: null, members: { some: { userId: authenticationResult.userId } } },
       deletedAt: null,
     },
-    select: { id: true },
+    select: { id: true, organizationId: true },
   });
 
   if (!project) {
     return json({ error: "Project not found" }, { status: 404 });
   }
 
+  // Rename/delete are Owner-only (via manage:all); membership resolve above is
+  // the OSS floor, this is the role gate when the RBAC plugin runs.
+  const denied = await authorizePatOrganizationAccess({
+    request,
+    organizationId: project.organizationId,
+    resource: "project",
+    action: "manage",
+  });
+  if (denied) {
+    return denied;
+  }
+
   try {
     if (method === "DELETE") {
       await new DeleteProjectService().call({

apps/webapp/app/services/organizationApiAccess.server.ts

@@ -3,10 +3,12 @@ import { isUserActorToken } from "@trigger.dev/rbac";
 import { prisma } from "~/db.server";
 import { rbac } from "~/services/rbac.server";
 
-type OrganizationScopedResource = "members";
+type OrganizationScopedResource = "members" | "organization" | "project";
 
 const RESOURCE_LABELS: Record<OrganizationScopedResource, string> = {
   members: "members",
+  organization: "organization",
+  project: "projects",
 };
 
 /**