Add compliance portal manager roles

[gearnode]

Adds two membership roles for compliance portal delegation without full admin access.

COMPLIANCE_PORTAL_MANAGER

• Full compliance portal management
• Supporting permissions to toggle document/audit/third-party portal visibility, set aliases, and manage Slack connectors used by the portal
• Lands on compliance-portals

COMPLIANCE_PORTAL_ACCESS_MANAGER

• Manage visitor access and document access requests only (list/create/update/delete portal access)
• Organization-scoped read of documents, audits, reports, and files that access requests may reference (callers still only load IDs attached to requests they can list)
• Lands on Access for a portal (forbidden tabs are hidden)

Also

• GraphQL / MCP / CLI / n8n / console UI surfaces for both roles
• Portal config tabs are gated by permission fields; access managers are redirected from overview to Access
• PageError shows dedicated forbidden copy for FORBIDDEN errors
• SAML role mapping allowlists the portal roles without newly admitting AUDITOR
• Fixed commitment UI permission checks to use the compliance-portal: action namespace
• Migrations add the final COMPLIANCE_PORTAL_* enum values directly (no rename migration)

  

---

Summary by cubic

Adds two portal-scoped membership roles, COMPLIANCE_PORTAL_MANAGER and COMPLIANCE_PORTAL_ACCESS_MANAGER, to delegate compliance portal management and access approvals without broader admin rights. The console gates tabs by permission, redirects access managers to Access, and shows a clear forbidden state when a page is denied.

Coredata +54 -6

Add the new roles to authz_role; extend MembershipRole and validation; create migrations that add the portal-scoped names directly (no rename step).

Service +114 -8

Add Compliance Portal Manager/Access Manager policies and map them across policy sets; minimal IAM for access managers (org read + membership-profile get); extend Probo and resource-alias policies; SAML role mapping uses an explicit allowlist that includes the portal roles but not AUDITOR.

GraphQL API +16 -0

Expose the new roles in Connect and Console membership role enums.

MCP +2 -0

Include both roles in the MCP spec enum.

prb (CLI) +2 -2

Allow filtering by the new roles in prb user list.

Package: helpers +33 -2

Add role constants/labels and include them in assignable roles for owners/admins.

Package: n8n-node +6 -0

Add the roles to createUser, listUsers, and updateMembership options.

App: console +139 -59

Permission-gate portal tabs and create actions; redirect access managers from portal root to Access; fix commitment permission namespaces; route both roles to compliance-portals; wire PageError to the forbidden copy; add i18n labels/descriptions.

Tests +8 -6

Add roles to test utilities and update IAM policy set tests.

Agents +4 -10

Update authorization and routing docs with the new role names and explain org-scoped reads for access managers.

^{Written for commit c74e8bd. Summary will update on new commits.}

[SachaProbo]

Maybe merge the migration?

[cursor]

Done — folded the rename into the original ADD migrations so they introduce COMPLIANCE_PORTAL_MANAGER / COMPLIANCE_PORTAL_ACCESS_MANAGER directly, and dropped 20260805T074339Z.sql.

[cubic-dev-ai]

2 issues found across 32 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/console/src/pages/organizations/compliance-portals/configuration/CompliancePortalConfigLayout.tsx">

<violation number="1" location="apps/console/src/pages/organizations/compliance-portals/configuration/CompliancePortalConfigLayout.tsx:133">
P1: Access managers lose most compliance portal tabs instead of seeing them with the child-route forbidden state. The new permission wrappers hide the routes entirely, contradicting the required “all tabs remain visible” UX; keep these `TabLink`s rendered unconditionally and let the child routes handle `FORBIDDEN`.</violation>
</file>

<file name="apps/console/src/_locales/en-US.json">

<violation number="1" location="apps/console/src/_locales/en-US.json:408">
P2: The new pageError.forbidden keys are never referenced: PageError.tsx still renders the "Page not found" text for FORBIDDEN errors, so the user-friendly "you do not have access" state described in the PR won't actually be shown to denied users. Wire the FORBIDDEN branch of PageError.tsx to the new keys (or confirm the other changed file does) so the intended messaging appears.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Access managers lose most compliance portal tabs instead of seeing them with the child-route forbidden state. The new permission wrappers hide the routes entirely, contradicting the required “all tabs remain visible” UX; keep these TabLinks rendered unconditionally and let the child routes handle FORBIDDEN.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/compliance-portals/configuration/CompliancePortalConfigLayout.tsx, line 133:

<comment>Access managers lose most compliance portal tabs instead of seeing them with the child-route forbidden state. The new permission wrappers hide the routes entirely, contradicting the required “all tabs remain visible” UX; keep these `TabLink`s rendered unconditionally and let the child routes handle `FORBIDDEN`.</comment>

<file context>
@@ -107,46 +130,66 @@ export default function CompliancePortalConfigLayout({ queryRef }: CompliancePor
-          <IconBell2 className="size-4" />
-          {t("configLayout.tabs.mailingList")}
-        </TabLink>
+        {compliancePortal.canListFrameworks && (
+          <TabLink to={portalBase} end>
+            <IconSettingsGear2 className="size-4" />
</file context>

[cursor]

Leaving this as-is. Hiding forbidden tabs was an intentional follow-up in efda6bc07 (access managers land on Access directly instead of seeing every tab with a no-access page).

[cubic-dev-ai]

P2: The new pageError.forbidden keys are never referenced: PageError.tsx still renders the "Page not found" text for FORBIDDEN errors, so the user-friendly "you do not have access" state described in the PR won't actually be shown to denied users. Wire the FORBIDDEN branch of PageError.tsx to the new keys (or confirm the other changed file does) so the intended messaging appears.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/_locales/en-US.json, line 408:

<comment>The new pageError.forbidden keys are never referenced: PageError.tsx still renders the "Page not found" text for FORBIDDEN errors, so the user-friendly "you do not have access" state described in the PR won't actually be shown to denied users. Wire the FORBIDDEN branch of PageError.tsx to the new keys (or confirm the other changed file does) so the intended messaging appears.</comment>

<file context>
@@ -405,6 +405,10 @@
       "title": "Page not found",
       "description": "The page you are looking for does not exist."
     },
+    "forbidden": {
+      "title": "You do not have access to this page",
+      "description": "Your role does not allow you to view this page. Ask an organization admin if you need access."
</file context>

[cursor]

Fixed — PageError now uses pageError.forbidden.*, and the Dutch locale got the matching keys.