feat: add analytics role (#491)

packages/db/0040.sql

@@ -0,0 +1 @@
+alter type user_role add value 'analytics';

packages/frontend/components/layout/Sidebar.tsx

@@ -485,14 +485,16 @@ export default function Sidebar() {
                 </Combobox.Footer>
               </Combobox.Dropdown>
             </Combobox>
-            <ActionIcon
-              variant="default"
-              size="sm"
-              component={Link}
-              href="/settings"
-            >
-              <IconSettings size={14} stroke={1} />
-            </ActionIcon>
+            {hasAccess(user.role, "billing", "read") && (
+              <ActionIcon
+                variant="default"
+                size="sm"
+                component={Link}
+                href="/settings"
+              >
+                <IconSettings size={14} stroke={1} />
+              </ActionIcon>
+            )}
           </Group>
 
           {user &&
@@ -570,10 +572,7 @@ export default function Sidebar() {
               <Menu closeOnItemClick={false}>
                 <Menu.Target data-testid="account-sidebar-item">
                   <ActionIcon variant="subtle" radius="xl" size={32}>
-                    <UserAvatar
-                      size={26}
-                      profile={user}
-                    />
+                    <UserAvatar size={26} profile={user} />
                   </ActionIcon>
                 </Menu.Target>
                 <Menu.Dropdown>

packages/frontend/pages/logs/index.tsx

@@ -54,6 +54,7 @@ import {
   useProject,
   useProjectInfiniteSWR,
   useRun,
+  useUser,
 } from "@/utils/dataHooks"
 import { fetcher } from "@/utils/fetcher"
 import { formatDateTime } from "@/utils/format"
@@ -70,7 +71,7 @@ import { useRouter } from "next/router"
 
 import IconPicker from "@/components/blocks/IconPicker"
 import { useEvaluators } from "@/utils/dataHooks/evaluators"
-import { deserializeLogic, serializeLogic } from "shared"
+import { deserializeLogic, hasAccess, serializeLogic } from "shared"
 import { useSortParams } from "@/utils/hooks"
 
 export const defaultColumns = {
@@ -174,6 +175,7 @@ const DEFAULT_CHECK = ["AND"]
 
 export default function Logs() {
   const router = useRouter()
+  const { user } = useUser()
   const { projectId } = useContext(ProjectContext)
   const { project, isLoading: projectLoading, setProjectId } = useProject()
   const { org } = useOrg()
@@ -234,6 +236,16 @@ export default function Logs() {
 
   const { run: selectedRun, loading: runLoading } = useRun(selectedRunId)
 
+  useEffect(() => {
+    if (!hasAccess(user?.role, "settings", "read")) {
+      router.push("/analytics")
+    }
+  }, [user.role])
+
+  if (!user.role) {
+    return <Loader />
+  }
+
   useEffect(() => {
     const newColumns = { ...allColumns }
     if (type === "llm" && Array.isArray(evaluators)) {

packages/frontend/pages/settings/index.tsx

@@ -9,35 +9,34 @@ import {
   Group,
   Loader,
   Popover,
-  SegmentedControl,
   Stack,
   Switch,
   Tabs,
   Text,
 } from "@mantine/core"
 import { NextSeo } from "next-seo"
-import Router from "next/router"
+import Router, { useRouter } from "next/router"
 
 import RenamableField from "@/components/blocks/RenamableField"
-import CheckPicker from "@/components/checks/Picker"
 import { SettingsCard } from "@/components/blocks/SettingsCard"
+import CheckPicker from "@/components/checks/Picker"
+import config from "@/utils/config"
+import { useOrg, useProject, useProjectRules, useUser } from "@/utils/dataHooks"
+import errorHandler from "@/utils/errors"
+import { fetcher } from "@/utils/fetcher"
+import { modals } from "@mantine/modals"
+import { notifications } from "@mantine/notifications"
 import {
   IconCheck,
-  IconPencil,
   IconFilter,
-  IconRefreshAlert,
   IconIdBadge,
+  IconPencil,
+  IconRefreshAlert,
 } from "@tabler/icons-react"
-import errorHandler from "@/utils/errors"
-import { fetcher } from "@/utils/fetcher"
-import { modals } from "@mantine/modals"
-import { notifications } from "@mantine/notifications"
-import { useOrg, useProject, useProjectRules, useUser } from "@/utils/dataHooks"
+import Link from "next/link"
 import { useEffect, useState } from "react"
 import { CheckLogic, hasAccess } from "shared"
 import useSWR from "swr"
-import config from "@/utils/config"
-import Link from "next/link"
 
 function Keys() {
   const [regenerating, setRegenerating] = useState(false)
@@ -276,6 +275,7 @@ export default function AppAnalytics() {
     addSmartDataRule,
     smartDataRuleLoading,
   } = useProject()
+  const router = useRouter()
 
   const { user } = useUser()
 
@@ -284,6 +284,16 @@ export default function AppAnalytics() {
     project?.id && org && `/orgs/${org.id}/usage?projectId=${project?.id}`,
   )
 
+  useEffect(() => {
+    if (!hasAccess(user?.role, "settings", "read")) {
+      router.push("/analytics")
+    }
+  }, [user.role])
+
+  if (projectUsageLoading || !user.role) {
+    return <Loader />
+  }
+
   return (
     <Container className="unblockable">
       <NextSeo title="Settings" />

packages/frontend/utils/dataHooks/views.ts

@@ -1,8 +1,12 @@
-import { useProjectMutation, useProjectSWR } from "."
+import { hasAccess } from "shared"
+import { useProjectMutation, useProjectSWR, useUser } from "."
 import { fetcher } from "../fetcher"
 
 export function useViews() {
-  const { data, isLoading, mutate } = useProjectSWR(`/views`)
+  const { user } = useUser()
+  const { data, isLoading, mutate } = useProjectSWR(
+    hasAccess(user?.role, "logs", "list") && `/views`,
+  )
 
   const { trigger: insert, isMutating: isInserting } = useProjectMutation(
     `/views`,

packages/shared/access-control/roles.ts

@@ -11,6 +11,8 @@ export type ResourceName =
   | "datasets"
   | "checklists"
   | "evaluations"
+  | "settings"
+
 export type Role = "owner" | "admin" | "member" | "viewer" | "billing"
 export type Action =
   | "create"
@@ -116,6 +118,13 @@ export const roles: Record<
         list: true,
         run: true,
       },
+      settings: {
+        create: true,
+        read: true,
+        update: true,
+        delete: true,
+        list: true,
+      },
     },
   },
   admin: {
@@ -202,6 +211,13 @@ export const roles: Record<
         list: true,
         run: true,
       },
+      settings: {
+        create: true,
+        read: true,
+        update: true,
+        delete: true,
+        list: true,
+      },
     },
   },
   member: {
@@ -285,6 +301,13 @@ export const roles: Record<
         list: true,
         run: true,
       },
+      settings: {
+        create: true,
+        read: true,
+        update: true,
+        delete: true,
+        list: true,
+      },
     },
   },
   viewer: {
@@ -360,6 +383,10 @@ export const roles: Record<
         list: true,
         run: false,
       },
+      settings: {
+        read: true,
+        list: true,
+      },
     },
   },
   prompt_editor: {
@@ -395,6 +422,21 @@ export const roles: Record<
       },
     },
   },
+  analytics: {
+    value: "analytics",
+    name: "Analytics Viewer",
+    description: "Can only access the Analytics page",
+    permissions: {
+      analytics: { read: true },
+      projects: {
+        read: true,
+        list: true,
+      },
+      users: {
+        list: true,
+      },
+    },
+  },
 }
 
 export function hasReadAccess(