enterprise feature: project-level membership

[mayberryzane]

Summary

• adds an enterprise ability to set project-level access for users with member role
• changes invites to default to member (onboarding, invite through members page, workspace secret link)
• renames some of the resolver methods to be more clear about what kind of permissions are being checked
  https://www.loom.com/share/8b4de7ae89b44e13ad0c88055f2bec13

How did you test this change?

• clicktested locally
• unit test for various access level resolver methods and Projects resolver

Are there any deployment considerations?

• no

Does this work require review from our design team?

• @julian-highlight

[changeset-bot]

⚠️ No Changeset found

Latest commit: 788f8f1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR

Some errors occurred when validating the changesets config:
The package or glob expression "rrdom" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "rrdom-nodejs" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "rrweb" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "rrweb-player" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "rrweb-snapshot" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "@rrweb/types" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "@rrweb/web-extension" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.
The package or glob expression "rrvideo" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.

[ccschmitz]

Code + click test are looking good!

One thing I noticed is that non-admins still have access to some of the admin UI even though the page doesn't really work for them. For example, if I'm a project-level member, I can still access /w/${workspaceId} even though I see an error.

Think it would be worthwhile to only define those routes for admins inside AppRouter?

I also think we might be linking to some admin-only pages for members too. e.g. LogsOverageCard, the session overage CTA, the default settings page redirect, and possibly a few more (I tried to audit the places I saw /w/${ in the app.

[ccschmitz]

Nit, should we update the span name?

Suggested change

	span, ctx := util.StartSpanFromContext(ctx, "isAdminInWorkspace", util.ResourceName("resolver.internal.auth"))
	span, ctx := util.StartSpanFromContext(ctx, "isUserInWorkspace", util.ResourceName("resolver.internal.auth"))