From caabb3c4ab4739d679c3fd664c1477a637becaab Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Tue, 12 May 2026 12:28:43 +0100
Subject: [PATCH] fix(site): show Organizations in admin dropdown for
 single-org OSS deployments (#25175)

Fixes https://linear.app/codercom/issue/CODAGT-350

On OSS or no-license single-org deployments, the Organizations admin
link was hidden because `canViewOrganizationSettings` was gated on
`showOrganizations`, which requires either a multi-org entitlement or >1
org. The page was still reachable via direct URL, but the members view
displayed a raw "Template RBAC is a Premium feature. Contact sales!"
error from the groups API.

Two fixes:

1. Always render the Organizations link inside the `DeploymentDropdown`.
The dropdown itself is only shown to users with admin-level permissions,
so Organizations is effectively gated on having admin access.

2. Remove `groupsByUserIdQuery.error` from the error chain on the
members page. The groups endpoint is gated behind
`templateRBACEnabledMW` on enterprise, returning a 403 on OSS. The
groups data is already optional, so the page renders fine without it.

> Generated by Coder Agents
---
 site/e2e/tests/roles.spec.ts                      |  4 ++--
 .../dashboard/Navbar/DeploymentDropdown.tsx       | 11 ++++-------
 site/src/modules/dashboard/Navbar/MobileMenu.tsx  | 15 ++++++---------
 .../dashboard/Navbar/NavbarView.stories.tsx       | 15 +++++++++++++++
 .../OrganizationMembersPage.tsx                   |  1 -
 5 files changed, 27 insertions(+), 19 deletions(-)

diff --git a/site/e2e/tests/roles.spec.ts b/site/e2e/tests/roles.spec.ts
index 0bf80391c0..a1d39c7c42 100644
--- a/site/e2e/tests/roles.spec.ts
+++ b/site/e2e/tests/roles.spec.ts
@@ -22,10 +22,10 @@ const adminSettings = [
 ] as const;
 
 async function hasAccessToAdminSettings(page: Page, settings: AdminSetting[]) {
-	// Organizations and Audit Logs both require a license to be visible
+	// Audit Logs requires a license to be visible
 	const visibleSettings = license
 		? settings
-		: settings.filter((it) => it !== "Organizations" && it !== "Audit Logs");
+		: settings.filter((it) => it !== "Audit Logs");
 	const adminSettingsButton = page.getByRole("button", {
 		name: "Admin settings",
 	});
diff --git a/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx b/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx
index fc9ab9baaa..de236e693d 100644
--- a/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx
+++ b/site/src/modules/dashboard/Navbar/DeploymentDropdown.tsx
@@ -30,8 +30,8 @@ export const DeploymentDropdown: FC<DeploymentDropdownProps> = ({
 	if (
 		!canViewAuditLog &&
 		!canViewConnectionLog &&
-		!canViewOrganizations &&
 		!canViewDeployment &&
+		!canViewOrganizations &&
 		!canViewHealth &&
 		!canViewAIBridge
 	) {
@@ -63,7 +63,6 @@ export const DeploymentDropdown: FC<DeploymentDropdownProps> = ({
 
 const DeploymentDropdownContent: FC<DeploymentDropdownProps> = ({
 	canViewDeployment,
-	canViewOrganizations,
 	canViewAuditLog,
 	canViewHealth,
 	canViewConnectionLog,
@@ -76,11 +75,9 @@ const DeploymentDropdownContent: FC<DeploymentDropdownProps> = ({
 					<Link to="/deployment">Deployment</Link>
 				</DropdownMenuItem>
 			)}
-			{canViewOrganizations && (
-				<DropdownMenuItem asChild>
-					<Link to="/organizations">Organizations</Link>
-				</DropdownMenuItem>
-			)}
+			<DropdownMenuItem asChild>
+				<Link to="/organizations">Organizations</Link>
+			</DropdownMenuItem>
 			{canViewAuditLog && (
 				<DropdownMenuItem asChild>
 					<Link to={linkToAuditing}>Audit Logs</Link>
diff --git a/site/src/modules/dashboard/Navbar/MobileMenu.tsx b/site/src/modules/dashboard/Navbar/MobileMenu.tsx
index a6c7df982a..81822669b0 100644
--- a/site/src/modules/dashboard/Navbar/MobileMenu.tsx
+++ b/site/src/modules/dashboard/Navbar/MobileMenu.tsx
@@ -203,7 +203,6 @@ const ProxySettingsSub: FC<ProxySettingsSubProps> = ({ proxyContextValue }) => {
 
 const AdminSettingsSub: FC<MobileMenuPermissions> = ({
 	canViewDeployment,
-	canViewOrganizations,
 	canViewAuditLog,
 	canViewConnectionLog,
 	canViewHealth,
@@ -235,14 +234,12 @@ const AdminSettingsSub: FC<MobileMenuPermissions> = ({
 						<Link to="/deployment">Deployment</Link>
 					</DropdownMenuItem>
 				)}
-				{canViewOrganizations && (
-					<DropdownMenuItem
-						asChild
-						className={cn(itemStyles.default, itemStyles.sub)}
-					>
-						<Link to="/organizations">Organizations</Link>
-					</DropdownMenuItem>
-				)}
+				<DropdownMenuItem
+					asChild
+					className={cn(itemStyles.default, itemStyles.sub)}
+				>
+					<Link to="/organizations">Organizations</Link>
+				</DropdownMenuItem>
 				{canViewAuditLog && (
 					<DropdownMenuItem
 						asChild
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
index 6b60b352ae..977292c754 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
@@ -84,6 +84,21 @@ export const ForOrgAdmin: Story = {
 	},
 };
 
+export const ForSingleOrgOSSAdmin: Story = {
+	args: {
+		canViewAuditLog: false,
+		canViewOrganizations: false,
+		canViewConnectionLog: false,
+		canViewAIBridge: false,
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		await userEvent.click(
+			canvas.getByRole("button", { name: "Admin settings" }),
+		);
+	},
+};
+
 export const ForMember: Story = {
 	args: {
 		user: MockUserMember,
diff --git a/site/src/pages/OrganizationSettingsPage/OrganizationMembersPage.tsx b/site/src/pages/OrganizationSettingsPage/OrganizationMembersPage.tsx
index d887044b0b..be020df108 100644
--- a/site/src/pages/OrganizationSettingsPage/OrganizationMembersPage.tsx
+++ b/site/src/pages/OrganizationSettingsPage/OrganizationMembersPage.tsx
@@ -102,7 +102,6 @@ const OrganizationMembersPage: FC = () => {
 				error={
 					membersQuery.error ??
 					organizationRolesQuery.error ??
-					groupsByUserIdQuery.error ??
 					addMemberMutation.error ??
 					removeMemberMutation.error ??
 					updateMemberRolesMutation.error