fix: remove fallback permssions on organization Id.

apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/__tests__/usePermissions.test.ts

@@ -44,5 +44,17 @@ describe("usePermissions", () => {
 
       expect(getResourcePermissionLevel("eventType", permissions)).toBe("all");
     });
+
+    it("should return 'all' for resource with manage permission", () => {
+      const permissions = ["eventType.manage"];
+
+      expect(getResourcePermissionLevel("eventType", permissions)).toBe("all");
+    });
+
+    it("should return 'all' for resource with manage permission even if other permissions are missing", () => {
+      const permissions = ["eventType.manage", "eventType.read"]; // Has manage and read, but missing create, update, delete
+
+      expect(getResourcePermissionLevel("eventType", permissions)).toBe("all");
+    });
   });
 });

apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts

@@ -51,14 +51,20 @@ export function usePermissions(): UsePermissionsReturn {
       return "all";
     }
 
-    // Filter out internal keys like _resource when checking permissions
-    const allResourcePerms = Object.keys(resourceConfig)
-      .filter((action) => !action.startsWith("_"))
+    // Check if user has manage permission for this resource
+    const hasManagePermission = permissions.includes(`${resource}.manage`);
+    if (hasManagePermission) {
+      return "all";
+    }
+
+    // Filter out internal keys like _resource and manage when checking for individual permissions
+    const crudPermissions = Object.keys(resourceConfig)
+      .filter((action) => !action.startsWith("_") && action !== "manage")
       .map((action) => `${resource}.${action}`);
-    const hasAllPerms = allResourcePerms.every((p) => permissions.includes(p));
+    const hasAllCrudPerms = crudPermissions.every((p) => permissions.includes(p));
     const hasReadPerm = permissions.includes(`${resource}.${CrudAction.Read}`);
 
-    if (hasAllPerms) return "all";
+    if (hasAllCrudPerms) return "all";
     if (hasReadPerm) return "read";
     return "none";
   };

apps/web/public/static/locales/en/common.json

@@ -3305,20 +3305,20 @@
   "pbac_desc_view_roles": "View roles",
   "pbac_desc_update_roles": "Update roles",
   "pbac_desc_delete_roles": "Delete roles",
-  "pbac_desc_manage_roles": "All actions on roles",
+  "pbac_desc_manage_roles": "All actions on roles across organization teams",
   "pbac_desc_create_event_types": "Create event types",
   "pbac_desc_view_event_types": "View event types",
   "pbac_desc_update_event_types": "Update event types",
   "pbac_desc_delete_event_types": "Delete event types",
-  "pbac_desc_manage_event_types": "All actions on event types",
+  "pbac_desc_manage_event_types": "All actions on event types across organization teams",
   "pbac_desc_create_teams": "Create teams",
   "pbac_desc_view_team_details": "View team details",
   "pbac_desc_update_team_settings": "Update team settings",
   "pbac_desc_delete_team": "Delete team",
   "pbac_desc_invite_team_members": "Invite team members",
   "pbac_desc_remove_team_members": "Remove team members",
   "pbac_desc_change_team_member_role": "Change role of team members",
-  "pbac_desc_manage_teams": "All actions on teams",
+  "pbac_desc_manage_teams": "All actions on teams across organization teams",
   "pbac_desc_create_organization": "Create organization",
   "pbac_desc_view_organization_details": "View organization details",
   "pbac_desc_list_organization_members": "List organization members",
@@ -3333,7 +3333,7 @@
   "pbac_desc_view_organization_bookings": "View organization bookings",
   "pbac_desc_view_booking_recordings": "View booking recordings",
   "pbac_desc_update_bookings": "Update bookings",
-  "pbac_desc_manage_bookings": "All actions on bookings",
+  "pbac_desc_manage_bookings": "All actions on bookings across organization teams",
   "pbac_desc_view_team_insights": "View team insights",
   "pbac_desc_manage_team_insights": "Manage team insights",
   "read_permission_auto_enabled_tooltip": "Read permission is automatically enabled when creating, updating, or deleting a resource",

packages/features/pbac/domain/types/permission-registry.ts

@@ -14,6 +14,7 @@ export enum CrudAction {
   Read = "read",
   Update = "update",
   Delete = "delete",
+  Manage = "manage",
 }
 
 export enum CustomAction {
@@ -138,6 +139,13 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       i18nKey: "pbac_action_delete",
       descriptionI18nKey: "pbac_desc_delete_roles",
     },
+    [CrudAction.Manage]: {
+      description: "Manage roles on all sub-teams",
+      category: "role",
+      i18nKey: "pbac_action_manage",
+      descriptionI18nKey: "pbac_desc_manage_roles",
+      scope: [Scope.Organization], // Only organizations should have "Manage" permissions
+    },
   },
   [Resource.EventType]: {
     _resource: {
@@ -167,6 +175,13 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       i18nKey: "pbac_action_delete",
       descriptionI18nKey: "pbac_desc_delete_event_types",
     },
+    [CrudAction.Manage]: {
+      description: "Manage event types",
+      category: "event",
+      i18nKey: "pbac_action_manage",
+      descriptionI18nKey: "pbac_desc_manage_event_types",
+      scope: [Scope.Organization], // Only organizations should have "Manage" permissions
+    },
   },
   [Resource.Team]: {
     _resource: {
@@ -215,6 +230,13 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       i18nKey: "pbac_action_change_member_role",
       descriptionI18nKey: "pbac_desc_change_team_member_role",
     },
+    [CrudAction.Manage]: {
+      description: "Manage team members",
+      category: "team",
+      i18nKey: "pbac_action_manage",
+      descriptionI18nKey: "pbac_desc_manage_team_members",
+      scope: [Scope.Organization], // Only organizations should have "Manage" permissions
+    },
   },
   [Resource.Organization]: {
     _resource: {
@@ -313,6 +335,13 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       i18nKey: "pbac_action_update",
       descriptionI18nKey: "pbac_desc_update_bookings",
     },
+    [CrudAction.Manage]: {
+      description: "Manage bookings",
+      category: "booking",
+      i18nKey: "pbac_action_manage",
+      descriptionI18nKey: "pbac_desc_manage_bookings",
+      scope: [Scope.Organization], // Only organizations should have "Manage" permissions
+    },
   },
   [Resource.Insights]: {
     _resource: {