RBAC: scrub "enterprise" / "OSS" / cloud-side references from comments

Code comments throughout the OSS-facing RBAC surface mentioned the
enterprise plugin, CASL, the cloud webapp, the cloud-side test suite,
and specific cloud file paths. Two reasons not to keep that:

  - Reputation: comments framing the OSS code as "the OSS path" vs
    "the enterprise path" pollute the public repo with implementation
    framing that shouldn't be there.
  - Implementation leakage: enterprise/cloud comments give away
    structural details about the closed-source plugin (where its data
    lives, what library it uses, which Linear tickets track it).

Rewrites use neutral language — "the loaded RBAC plugin (if any)",
"the default fallback", "an installed plugin" — and drop references
to specific cloud-side files / TRI-IDs / CASL.

Plan-tier names ("Enterprise" as a public product tier in the Roles
page upsell, `planCode === "enterprise"` checks, `<TierEnterprise />`
in pre-existing files) are intentionally left as-is — they're the
public marketing name for a paid tier, not implementation detail.

Removed `.server-changes/rbac-userrole-default-assignment.md` —
documented a feature that was reverted in d2bf617 (upfront UserRole
inserts on create-org / acceptInvite).

Verified: 162/162 OSS e2e.full pass, 31/31 OSS rbac unit pass.

Author: matt-aitken

.changeset/rbac-assignable-role-ids.md

@@ -2,4 +2,4 @@
 "@trigger.dev/plugins": patch
 ---
 
-RBAC plugin: new `getAssignableRoleIds(organizationId)` method on `RoleBaseAccessController`. Returns the subset of `allRoles(organizationId)` IDs that may be assigned right now — used by the Teams page UI to disable role-dropdown options outside the org's plan tier. OSS fallback returns `[]` (permissive — `allRoles` already returns `[]` so there's nothing to gate); the enterprise plugin queries its plan client and returns the plan-allowed system roles plus all custom roles. Server-side enforcement (rejecting an actual `setUserRole` to a plan-gated role) is unchanged and remains the source of truth — this method is purely a UI affordance.
+RBAC plugin: new `getAssignableRoleIds(organizationId)` method on `RoleBaseAccessController`. Returns the subset of `allRoles(organizationId)` IDs that may be assigned right now — used by the Teams page UI to disable role-dropdown options that aren't currently assignable. The default fallback returns `[]` (permissive — `allRoles` already returns `[]` so there's nothing to gate); a plugin may apply its own gating policy and return the assignable subset. Server-side enforcement (rejecting an actual `setUserRole` to a non-assignable role) is unchanged and remains the source of truth — this method is purely a UI affordance.

.server-changes/rbac-pat-role-selection.md

@@ -4,13 +4,12 @@ type: feature
 ---
 
 RBAC: PAT creation flow now lets users pick a system role at create
-time, persisted as an enterprise.TokenRole row (TRI-8749). Defaults to
-the caller's own role so a PAT can't be more privileged than the
-person creating it. Custom (org-defined) roles are out of scope for
-v1 — only the four global system roles are offered, and the binding
-is global to the PAT regardless of which org the request later
-targets. Compensating-delete pattern on TokenRole insert failure
-keeps the two writes (Prisma PAT row + Drizzle TokenRole row)
-consistent without cross-ORM transaction wrestling. OSS path is a
-no-op: when the RBAC plugin isn't installed the dropdown is hidden,
-no roleId is submitted, and the PAT works exactly as before.
+time, persisted via the RBAC plugin's `setTokenRole`. Defaults to the
+caller's own role so a PAT can't be more privileged than the person
+creating it. Custom (org-defined) roles are out of scope for v1 — only
+the four global system roles are offered, and the binding is global to
+the PAT regardless of which org the request later targets. A
+compensating-delete on `setTokenRole` failure keeps the PAT row and
+the role row consistent without cross-store transaction wrestling.
+With no RBAC plugin installed the dropdown is hidden, no roleId is
+submitted, and the PAT works exactly as before.

.server-changes/rbac-userrole-default-assignment.md

@@ -215,8 +215,8 @@ export async function acceptInvite({
     };
   });
 
-  // No upfront RBAC UserRole insert — the enterprise plugin's
-  // getUserRole derives the new member's role from the legacy
+  // No upfront RBAC UserRole insert — the loaded RBAC plugin (if any)
+  // is responsible for deriving the new member's role from the legacy
   // OrgMember.role write inside the transaction above (ADMIN → Owner,
   // MEMBER → Admin) until an Owner explicitly changes their role on
   // the Teams page. Keeps the invite path tight and consistent with

apps/webapp/app/models/member.server.ts

@@ -82,12 +82,12 @@ export async function createOrganization(
     },
   });
 
-  // No upfront RBAC UserRole insert — the enterprise plugin's
-  // getUserRole derives the creator's role from the legacy
+  // No upfront RBAC UserRole insert — the loaded RBAC plugin (if any)
+  // is responsible for deriving the creator's role from the legacy
   // OrgMember.role = "ADMIN" write above (which maps to Owner) until an
   // Owner explicitly changes someone's role on the Teams page. Keeps
-  // the create-org path tight and lets the fallback path stay the
-  // single source of truth for "who has what role" by default.
+  // the create-org path tight and lets the plugin stay the single
+  // source of truth for "who has what role" by default.
   return { ...organization };
 }
 

apps/webapp/app/models/organization.server.ts

@@ -19,9 +19,9 @@ export class TeamPresenter extends BasePresenter {
         getLimit(organizationId, "teamMembers", 100_000_000),
         getCurrentPlan(organizationId),
         getPlans(),
-        // RBAC role catalogue (system roles + any org-defined custom roles).
-        // OSS fallback returns []; on cloud the enterprise plugin returns
-        // the seeded system roles plus the org's custom roles.
+        // RBAC role catalogue (system roles + any org-defined custom
+        // roles). The default fallback returns []; an installed plugin
+        // may return the seeded system roles plus any custom roles.
         rbac.allRoles(organizationId),
         // Plan-gated subset — the Teams page disables dropdown options not
         // in this set. Server-side enforcement is independent (setUserRole

apps/webapp/app/presenters/TeamPresenter.server.ts

@@ -221,10 +221,9 @@ function RoleCard({
   );
 }
 
-// Permission name-prefix → display group. Mirrors PERMISSION_METADATA's
-// groupings server-side (cloud/enterprise/plugins/src/rbac/permissions.ts)
-// but lives client-side because the wire-format Permission only carries
-// `name` and `description`. Keep in lockstep.
+// Permission name-prefix → display group. Lives client-side because
+// the wire-format Permission only carries `name` and `description` —
+// the RBAC plugin doesn't ship grouping metadata over the wire.
 const PERMISSION_GROUP_BY_NAME: Record<string, string> = {
   "read:runs": "Runs",
   "write:runs": "Runs",
@@ -283,9 +282,8 @@ function groupPermissions(
   );
 }
 
-// "Create role" upsell shown to non-Enterprise plans. Enterprise sees
-// nothing here for now — the actual create-role UI is a follow-up
-// (depends on TRI-8747's controller-level CRUD already in place).
+// "Create role" upsell shown to non-Enterprise plans. Enterprise plans
+// don't see this — the actual create-role UI is a follow-up.
 function CreateRoleUpsell() {
   const [open, setOpen] = useState(false);
   return (

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.roles/route.tsx

@@ -581,9 +581,8 @@ function RolePicker({
 }) {
   const fetcher = useFetcher<{ ok: boolean; error?: string } | { ok: true }>();
   const assignable = new Set(assignableRoleIds);
-  // OSS deployments return [] (allRoles also returns []) — when there
-  // are no roles to pick from, render nothing rather than an empty
-  // dropdown.
+  // With no RBAC plugin installed, the loader returns no roles —
+  // render nothing rather than an empty dropdown.
   if (roles.length === 0) return null;
 
   const isSubmitting = fetcher.state === "submitting";

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.team/route.tsx

@@ -56,12 +56,13 @@ export const meta: MetaFunction = () => {
   ];
 };
 
-// PATs aren't org-scoped, but role/permission catalogues are seeded
-// per-org in enterprise's allRoles. To get the canonical system roles
-// (Owner/Admin/Member/Viewer — orgId IS NULL on those rows), we hand
-// allRoles any orgId the user belongs to and filter down to system
+// PATs aren't org-scoped, but the RBAC plugin's allRoles is org-keyed
+// (a plugin may also expose org-defined custom roles alongside the
+// global system roles). To get the canonical system roles (Owner /
+// Admin / Member / Viewer), we hand allRoles any orgId the user
+// belongs to and filter down to the rows the plugin marks as system
 // roles. This is a UI-only convenience — the chosen role becomes a
-// global TokenRole row that applies wherever the PAT is used. Custom
+// global TokenRole that applies wherever the PAT is used. Custom
 // (org-defined) roles are out of scope for v1: their org-binding
 // semantics for a multi-org user's PAT need a separate design pass.
 async function loadSystemRolesForUser(userId: string) {
@@ -95,7 +96,8 @@ export const loader = async ({ request }: LoaderFunctionArgs) => {
     // Default the role picker to the user's own role in their primary
     // org so a freshly-created PAT isn't more privileged than the
     // person creating it. Falls back to Member if they don't have one
-    // (new user, OSS path with no role assignments yet).
+    // (new user, or no RBAC plugin installed so no role assignments
+    // exist).
     const defaultRoleId = userRoleId ?? SYSTEM_ROLE_IDS.member;
 
     return typedjson({
@@ -123,10 +125,9 @@ const CreateTokenSchema = z.discriminatedUnion("action", [
       .string({ required_error: "You must enter a name" })
       .min(2, "Your name must be at least 2 characters long")
       .max(50),
-    // Optional — when the RBAC plugin isn't installed (OSS), the UI
-    // hides the dropdown and submits no roleId; the action passes that
-    // through and createPersonalAccessToken just doesn't write a
-    // TokenRole row.
+    // Optional — when no RBAC plugin is installed the UI hides the
+    // dropdown and submits no roleId; the action passes that through
+    // and createPersonalAccessToken just doesn't write a TokenRole.
     roleId: z.string().optional(),
   }),
   z.object({
@@ -284,10 +285,11 @@ function CreatePersonalAccessToken({
     ? (lastSubmission?.payload?.token as CreatedPersonalAccessToken)
     : undefined;
 
-  // OSS path: rbac.allRoles returns []; we hide the dropdown entirely
-  // rather than showing an empty Select. createPersonalAccessToken's
-  // roleId is optional, so omitting it produces a working PAT with no
-  // explicit role attached (matches pre-RBAC behaviour).
+  // With no RBAC plugin installed, rbac.allRoles returns []; hide the
+  // dropdown entirely rather than showing an empty Select.
+  // createPersonalAccessToken's roleId is optional, so omitting it
+  // produces a working PAT with no explicit role attached (matches
+  // pre-RBAC behaviour).
   const showRolePicker = roles.length > 0;
   const [selectedRoleId, setSelectedRoleId] = useState(defaultRoleId);
 

apps/webapp/app/routes/account.tokens/route.tsx

@@ -11,9 +11,9 @@ const tokenValueLength = 40;
 //lowercase only, removed 0 and l to avoid confusion
 const tokenGenerator = customAlphabet("123456789abcdefghijkmnopqrstuvwxyz", tokenValueLength);
 
-// The OSS fallback's setTokenRole returns this exact string when no
-// enterprise plugin is loaded. We treat that as "no role attached" —
-// the PAT is still valid; auth just falls through to legacy permissive
+// The default fallback's setTokenRole returns this exact string when
+// no RBAC plugin is loaded. We treat that as "no role attached" — the
+// PAT is still valid; auth just falls through to legacy permissive
 // behaviour. Any other error is treated as a real failure and triggers
 // the compensating delete below.
 const FALLBACK_NOT_INSTALLED_ERROR = "RBAC plugin not installed";
@@ -351,25 +351,25 @@ export async function createPersonalAccessToken({
     },
   });
 
-  // Persist the role choice in enterprise.TokenRole. This lives on a
-  // different schema (Drizzle, not Prisma) — co-transactional inserts
-  // across the two ORMs are awkward, so we use a compensating-delete
-  // pattern: if setTokenRole fails, roll back the PAT row by deleting
-  // it. The auth path treats "no role" as permissive (matches OSS
-  // fallback) so a brief orphan window between the two writes is
-  // harmless. The compensating delete narrows that window from "until
-  // manual cleanup" to "until the request returns".
+  // Persist the role choice via the RBAC plugin's setTokenRole. The
+  // plugin may store this in a separate datastore from Prisma (e.g.
+  // Drizzle on a different schema), so co-transactional inserts are
+  // awkward — we use a compensating-delete pattern instead: if
+  // setTokenRole fails, roll back the PAT row by deleting it. The auth
+  // path treats "no role" as permissive (matches the default fallback)
+  // so a brief orphan window between the two writes is harmless. The
+  // compensating delete narrows that window from "until manual cleanup"
+  // to "until the request returns".
   if (roleId) {
     const roleResult = await rbac.setTokenRole({
       tokenId: personalAccessToken.id,
       roleId,
     });
     if (!roleResult.ok) {
-      // The OSS fallback always returns ok=false with this exact
-      // message. That isn't a failure — there's no enterprise plugin
-      // to write to, so the PAT just runs without an explicit role
-      // (matches the pre-RBAC behaviour). Don't compensating-delete
-      // in that case.
+      // The default fallback always returns ok=false with this exact
+      // message. That isn't a failure — there's no plugin to write to,
+      // so the PAT just runs without an explicit role (matches the
+      // pre-RBAC behaviour). Don't compensating-delete in that case.
       if (roleResult.error === FALLBACK_NOT_INSTALLED_ERROR) {
         logger.debug("createPersonalAccessToken: no RBAC plugin, skipping role assignment", {
           patId: personalAccessToken.id,