fix: restrict app deploy to explicit enterprise permission (#40564)

api/services/enterprise/rbac_service.py

@@ -397,7 +397,6 @@ _LEGACY_APP_OWNER_KEYS: list[str] = [
     "app.acl.import_export_dsl",
     "app.acl.delete",
     "app.acl.release_and_version",
-    "app.acl.deploy",
     "app.acl.monitor",
     "app.acl.access_config",
     "app.acl.tracing_config",
@@ -412,7 +411,6 @@ _LEGACY_APP_ADMIN_KEYS: list[str] = [
     "app.acl.import_export_dsl",
     "app.acl.delete",
     "app.acl.release_and_version",
-    "app.acl.deploy",
     "app.acl.monitor",
     "app.acl.access_config",
     "app.acl.access_config",
@@ -428,7 +426,6 @@ _LEGACY_APP_EDITOR_KEYS: list[str] = [
     "app.acl.import_export_dsl",
     "app.acl.delete",
     "app.acl.release_and_version",
-    "app.acl.deploy",
     "app.acl.monitor",
     "app.acl.log_and_annotation",
     "app.acl.access_config",

api/tests/unit_tests/services/enterprise/test_rbac_service.py

@@ -636,10 +636,7 @@ class TestMyPermissions:
         assert not any(key.startswith("billing.") for key in out.workspace.permission_keys)
         if role == "editor":
             assert "app.acl.log_and_annotation" in out.app.default_permission_keys
-        if role in {"owner", "admin", "editor"}:
-            assert "app.acl.deploy" in out.app.default_permission_keys
-        else:
-            assert "app.acl.deploy" not in out.app.default_permission_keys
+        assert "app.acl.deploy" not in out.app.default_permission_keys
 
     @pytest.mark.parametrize(
         ("role", "expected_snippet_keys"),
@@ -747,6 +744,7 @@ class TestMemberRoles:
         assert "snippets.create_and_modify" in out.roles[0].permission_keys
         assert "app.acl.preview" in out.roles[0].permission_keys
         assert "dataset.acl.preview" in out.roles[0].permission_keys
+        assert "app.acl.deploy" not in out.roles[0].permission_keys
 
     def test_replace(self, mock_send: MagicMock, sqlite_session: Session):
         mock_send.return_value = {"account_id": "acct-2", "roles": []}
@@ -842,7 +840,10 @@ class TestResourcePermissions:
     def test_app_permissions_batch_get(self, mock_send: MagicMock, sqlite_session: Session):
         mock_send.return_value = {
             "data": [
-                {"resource_id": "app-1", "permission_keys": ["app.acl.view_layout", "app.acl.edit"]},
+                {
+                    "resource_id": "app-1",
+                    "permission_keys": ["app.acl.view_layout", "app.acl.edit", "app.acl.deploy"],
+                },
                 {"resource_id": "app-2", "permission_keys": []},
             ]
         }
@@ -857,7 +858,7 @@ class TestResourcePermissions:
         assert call.endpoint == "/rbac/apps/permission-keys/batch"
         assert call.json == {"app_ids": ["app-1", "app-2"]}
         assert out == {
-            "app-1": ["app.acl.view_layout", "app.acl.edit"],
+            "app-1": ["app.acl.view_layout", "app.acl.edit", "app.acl.deploy"],
             "app-2": [],
         }
 
@@ -878,6 +879,7 @@ class TestResourcePermissions:
             "app-1": svc._LEGACY_APP_EDITOR_KEYS,
             "app-2": svc._LEGACY_APP_EDITOR_KEYS,
         }
+        assert all("app.acl.deploy" not in permission_keys for permission_keys in out.values())
 
     def test_dataset_permissions_batch_get(self, mock_send: MagicMock, sqlite_session: Session):
         mock_send.return_value = {

web/utils/permission.spec.ts

@@ -114,7 +114,7 @@ describe('permission', () => {
       expect(capabilities.canImportExportDSL).toBe(true)
       expect(capabilities.canDelete).toBe(true)
       expect(capabilities.canReleaseAndVersion).toBe(true)
-      expect(capabilities.canDeploy).toBe(true)
+      expect(capabilities.canDeploy).toBe(false)
       expect(capabilities.canMonitor).toBe(true)
       expect(capabilities.canConfigureTracing).toBe(true)
       expect(capabilities.canAccessLogAndAnnotation).toBe(true)

web/utils/permission.ts

@@ -155,11 +155,7 @@ export const getAppACLCapabilities = (
       AppACLPermission.ReleaseAndVersion,
       hasMaintainerPermissions,
     ),
-    canDeploy: hasResourcePermission(
-      permissionKeys,
-      AppACLPermission.Deploy,
-      hasMaintainerPermissions,
-    ),
+    canDeploy: hasPermission(permissionKeys, AppACLPermission.Deploy),
     canMonitor: hasResourcePermission(
       permissionKeys,
       AppACLPermission.Monitor,