@gitpod/gitpod-protocol 0.1.5-me-ingress.20 → 0.1.5-me-image.2

package/src/admin-protocol.ts

@@ -5,9 +5,13 @@
  */
 
 import { User, Workspace, NamedWorkspaceFeatureFlag } from "./protocol";
+import { FindPrebuildsParams } from "./gitpod-service";
+import { PrebuildWithStatus } from "./teams-projects-protocol"
+import { Project, Team } from "./teams-projects-protocol";
 import { WorkspaceInstance, WorkspaceInstancePhase } from "./workspace-instance";
 import { RoleOrPermission } from "./permission";
 import { AccountStatement } from "./accounting-protocol";
+import { InstallationAdminSettings } from "./installation-admin-protocol";
 
 export interface AdminServer {
     adminGetUsers(req: AdminGetListRequest<User>): Promise<AdminGetListResult<User>>;
@@ -17,11 +21,17 @@ export interface AdminServer {
     adminModifyRoleOrPermission(req: AdminModifyRoleOrPermissionRequest): Promise<User>;
     adminModifyPermanentWorkspaceFeatureFlag(req: AdminModifyPermanentWorkspaceFeatureFlagRequest): Promise<User>;
 
+    adminGetTeamById(id: string): Promise<Team | undefined>;
+
     adminGetWorkspaces(req: AdminGetWorkspacesRequest): Promise<AdminGetListResult<WorkspaceAndInstance>>;
     adminGetWorkspace(id: string): Promise<WorkspaceAndInstance>;
     adminForceStopWorkspace(id: string): Promise<void>;
     adminRestoreSoftDeletedWorkspace(id: string): Promise<void>;
 
+    adminGetProjectsBySearchTerm(req: AdminGetListRequest<Project>): Promise<AdminGetListResult<Project>>;
+    adminGetProjectById(id: string): Promise<Project | undefined>;
+
+    adminFindPrebuilds(params: FindPrebuildsParams): Promise<PrebuildWithStatus[]>;
     adminSetLicense(key: string): Promise<void>;
 
     adminGetAccountStatement(userId: string): Promise<AccountStatement>;
@@ -29,6 +39,9 @@ export interface AdminServer {
     adminIsStudent(userId: string): Promise<boolean>;
     adminAddStudentEmailDomain(userId: string, domain: string): Promise<void>;
     adminGrantExtraHours(userId: string, extraHours: number): Promise<void>;
+
+    adminGetSettings(): Promise<InstallationAdminSettings>
+    adminUpdateSettings(settings: InstallationAdminSettings): Promise<void>
 }
 
 export interface AdminGetListRequest<T> {
@@ -65,7 +78,7 @@ export interface AdminModifyPermanentWorkspaceFeatureFlagRequest {
     }[]
 }
 
-export interface WorkspaceAndInstance extends Omit<Workspace, "id"|"creationTime">, Omit<WorkspaceInstance, "id"|"creationTime"> {
+export interface WorkspaceAndInstance extends Omit<Workspace, "id" | "creationTime">, Omit<WorkspaceInstance, "id" | "creationTime"> {
     workspaceId: string;
     workspaceCreationTime: string;
     instanceId: string;
@@ -78,7 +91,7 @@ export namespace WorkspaceAndInstance {
         return {
             id: wai.workspaceId,
             creationTime: wai.workspaceCreationTime,
-            ... wai
+            ...wai
         };
     }
 
@@ -89,7 +102,7 @@ export namespace WorkspaceAndInstance {
         return {
             id: wai.instanceId,
             creationTime: wai.instanceCreationTime,
-            ... wai
+            ...wai
         };
     }
 }
@@ -102,4 +115,4 @@ export type AdminGetWorkspacesQuery = {
     instanceId?: string;
     workspaceId?: string;
     ownerId?: string;
-};
+};

package/src/analytics.ts

@@ -8,7 +8,7 @@
 export const IAnalyticsWriter = Symbol("IAnalyticsWriter");
 
 type Identity =
-    | { userId: string | number }
+    | { userId: string | number; anonymousId?: string | number }
     | { userId?: string | number; anonymousId: string | number };
 
 interface Message {
@@ -34,14 +34,12 @@ export type PageMessage = Message & Identity & {
     context?: any;
 };
 
-export type RemoteTrackMessage = Omit<TrackMessage, "timestamp" | "userId" | "anonymousId"> & {
-    anonymousId?: string | number;
-};
+export type RemoteTrackMessage = Omit<TrackMessage, "timestamp" | "userId">;
 export type RemotePageMessage = Omit<PageMessage, "timestamp" | "userId"> & {
-    anonymousId?: string | number;
+    includePII?: boolean;
 };
 
-export type RemoteIdentifyMessage = Omit<IdentifyMessage, "timestamp" | "userId" | "anonymousId">;
+export type RemoteIdentifyMessage = Omit<IdentifyMessage, "timestamp" | "userId">;
 
 export interface IAnalyticsWriter {
 

package/src/context-url.spec.ts

@@ -6,34 +6,48 @@
 
 import * as chai from 'chai';
 import { suite, test } from 'mocha-typescript';
+import { Workspace } from '.';
 import { ContextURL } from './context-url';
 const expect = chai.expect;
 
+type WsContextUrl = Pick<Workspace, "context" | "contextURL">;
+
 @suite
 export class ContextUrlTest {
 
     @test public parseContextUrl_withEnvVar() {
-        const actual = ContextURL.parseToURL("passedin=test%20value/https://github.com/gitpod-io/gitpod-test-repo");
+        const actual = ContextURL.getNormalizedURL({ contextURL: "passedin=test%20value/https://github.com/gitpod-io/gitpod-test-repo", context: {} } as WsContextUrl);
         expect(actual?.host).to.equal("github.com");
         expect(actual?.pathname).to.equal("/gitpod-io/gitpod-test-repo");
     }
 
     @test public parseContextUrl_withEnvVar_withoutSchema() {
-        const actual = ContextURL.parseToURL("passedin=test%20value/github.com/gitpod-io/gitpod-test-repo");
+        const actual = ContextURL.getNormalizedURL({ contextURL: "passedin=test%20value/github.com/gitpod-io/gitpod-test-repo", context: {} } as WsContextUrl);
         expect(actual?.host).to.equal("github.com");
         expect(actual?.pathname).to.equal("/gitpod-io/gitpod-test-repo");
     }
 
+    @test public parseContextUrl_withEnvVar_sshUrl() {
+        const actual = ContextURL.getNormalizedURL({ contextURL: "passedin=test%20value/git@github.com:gitpod-io/gitpod-test-repo.git", context: {} } as WsContextUrl);
+        expect(actual?.host).to.equal("github.com");
+        expect(actual?.pathname).to.equal("/gitpod-io/gitpod-test-repo.git");
+    }
+
     @test public parseContextUrl_withPrebuild() {
-        const actual = ContextURL.parseToURL("prebuild/https://github.com/gitpod-io/gitpod-test-repo");
+        const actual = ContextURL.getNormalizedURL({ contextURL: "prebuild/https://github.com/gitpod-io/gitpod-test-repo", context: {} } as WsContextUrl);
         expect(actual?.host).to.equal("github.com");
         expect(actual?.pathname).to.equal("/gitpod-io/gitpod-test-repo");
     }
 
     @test public parseContextUrl_withPrebuild_withoutSchema() {
-        const actual = ContextURL.parseToURL("prebuild/github.com/gitpod-io/gitpod-test-repo");
+        const actual = ContextURL.getNormalizedURL({ contextURL: "prebuild/github.com/gitpod-io/gitpod-test-repo", context: {} } as WsContextUrl);
         expect(actual?.host).to.equal("github.com");
         expect(actual?.pathname).to.equal("/gitpod-io/gitpod-test-repo");
     }
+
+    @test public parseContextUrl_badUrl() {
+        const actual = ContextURL.getNormalizedURL({ contextURL: "[Object object]", context: {} } as WsContextUrl);
+        expect(actual).to.be.undefined;
+    }
 }
 module.exports = new ContextUrlTest()

package/src/context-url.ts

@@ -4,10 +4,62 @@
  * See License-AGPL.txt in the project root for license information.
  */
 
+import { Workspace } from ".";
+
+/**
+ * The whole point of these methods is to overcome inconsistencies in our data model.
+ * Ideally we remove it at some point once we fixed our model, as it:
+ *  - duplicates logic
+ *  - but additional burden on clients (using this, copying this to other languages!)
+ *
+ * TODO(gpl) See if we can get this into `server` code to remove the burden from clients
+ */
 export namespace ContextURL {
   export const INCREMENTAL_PREBUILD_PREFIX = "incremental-prebuild";
   export const PREBUILD_PREFIX = "prebuild";
   export const IMAGEBUILD_PREFIX = "imagebuild";
+  export const SNAPSHOT_PREFIX = "snapshot";
+  export const REFERRER_PREFIX = 'referrer:';
+
+  /**
+   * This function will (try to) return the HTTP(S) URL of the context the user originally created this workspace on.
+   * Especially it will not contain any modifiers or be of different scheme than HTTP(S).
+   *
+   * Use this function if you need to provided a _working_ URL to the original context.
+   * @param ws
+   * @returns
+   */
+  export function getNormalizedURL(ws: Pick<Workspace, "context" | "contextURL"> | undefined): URL | undefined {
+    const normalized = normalize(ws);
+    if (!normalized) {
+      return undefined;
+    }
+
+    try {
+      return new URL(normalized);
+    } catch (err) {
+      console.error(`unable to parse URL from normalized contextURL: '${normalized}'`, err);
+    }
+    return undefined;
+  }
+
+  function normalize(ws: Pick<Workspace, "context" | "contextURL"> | undefined): string | undefined {
+    if (!ws) {
+      return undefined;
+    }
+    if (ws.context.normalizedContextURL) {
+      return ws.context.normalizedContextURL;
+    }
+
+    // fallback: we do not yet set normalizedContextURL on all workspaces, yet, let alone older existing workspaces
+    let fallback: string | undefined = undefined;
+    try {
+      fallback = removePrefixes(ws.contextURL);
+    } catch (err) {
+      console.error(`unable to remove prefixes from contextURL: '${ws.contextURL}'`, err);
+    }
+    return fallback;
+  }
 
   /**
    * The field "contextUrl" might contain prefixes like:
@@ -15,29 +67,33 @@ export namespace ContextURL {
    *  - prebuild/...
    * This is the analogon to the (Prefix)ContextParser structure in "server".
    */
-  export function parseToURL(contextUrl: string | undefined): URL | undefined {
+  function removePrefixes(contextUrl: string | undefined): string | undefined {
     if (contextUrl === undefined) {
       return undefined;
     }
 
     const segments = contextUrl.split("/");
     if (segments.length === 1) {
-      return new URL(segments[0]);  // this might be something, we just try
+      return segments[0];  // this might be something, we just try
     }
 
-    const segmentsToURL = (offset: number): URL => {
+    const segmentsToURL = (offset: number): string => {
       let rest = segments.slice(offset).join("/");
+      if (/^git@[^:\/]+:/.test(rest)) {
+        rest = rest.replace(/^git@([^:\/]+):/, 'https://$1/');
+      }
       if (!rest.startsWith("http")) {
         rest = 'https://' + rest;
       }
-      return new URL(rest);
+      return rest;
     };
 
-
     const firstSegment = segments[0];
     if (firstSegment === PREBUILD_PREFIX ||
         firstSegment === INCREMENTAL_PREBUILD_PREFIX ||
-        firstSegment === IMAGEBUILD_PREFIX) {
+        firstSegment === IMAGEBUILD_PREFIX ||
+        firstSegment === SNAPSHOT_PREFIX ||
+        firstSegment.startsWith(REFERRER_PREFIX)) {
       return segmentsToURL(1);
     }
 

package/src/gitpod-service.ts

@@ -6,10 +6,10 @@
 
 import {
     User, WorkspaceInfo, WorkspaceCreationResult, WorkspaceInstanceUser,
-    WhitelistedRepository, WorkspaceImageBuild, AuthProviderInfo, Branding, CreateWorkspaceMode,
+    WhitelistedRepository, WorkspaceImageBuild, AuthProviderInfo, CreateWorkspaceMode,
     Token, UserEnvVarValue, ResolvePluginsParams, PreparePluginUploadParams, Terms,
     ResolvedPlugins, Configuration, InstallPluginsParams, UninstallPluginParams, UserInfo, GitpodTokenType,
-    GitpodToken, AuthProviderEntry, GuessGitTokenScopesParams, GuessedGitTokenScopes
+    GitpodToken, AuthProviderEntry, GuessGitTokenScopesParams, GuessedGitTokenScopes, ProjectEnvVar
 } from './protocol';
 import {
     Team, TeamMemberInfo,
@@ -30,6 +30,7 @@ import { GithubUpgradeURL, PlanCoupon } from './payment-protocol';
 import { TeamSubscription, TeamSubscriptionSlot, TeamSubscriptionSlotResolved } from './team-subscription-protocol';
 import { RemotePageMessage, RemoteTrackMessage, RemoteIdentifyMessage } from './analytics';
 import { IDEServer } from './ide-protocol';
+import { InstallationAdminSettings, TelemetryData } from './installation-admin-protocol';
 
 export interface GitpodClient {
     onInstanceUpdate(instance: WorkspaceInstance): void;
@@ -55,7 +56,6 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     getOwnAuthProviders(): Promise<AuthProviderEntry[]>;
     updateOwnAuthProvider(params: GitpodServer.UpdateOwnAuthProviderParams): Promise<AuthProviderEntry>;
     deleteOwnAuthProvider(params: GitpodServer.DeleteOwnAuthProviderParams): Promise<void>;
-    getBranding(): Promise<Branding>;
     getConfiguration(): Promise<Configuration>;
     getToken(query: GitpodServer.GetTokenSearchOptions): Promise<Token | undefined>;
     getGitpodTokenScopes(tokenHash: string): Promise<string[]>;
@@ -72,8 +72,15 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     getWorkspaceOwner(workspaceId: string): Promise<UserInfo | undefined>;
     getWorkspaceUsers(workspaceId: string): Promise<WorkspaceInstanceUser[]>;
     getFeaturedRepositories(): Promise<WhitelistedRepository[]>;
+    getSuggestedContextURLs(): Promise<string[]>;
+    /**
+     * **Security:**
+     * Sensitive information like an owner token is erased, since it allows access for all team members.
+     * If you need to access an owner token use `getOwnerToken` instead.
+     */
     getWorkspace(id: string): Promise<WorkspaceInfo>;
     isWorkspaceOwner(workspaceId: string): Promise<boolean>;
+    getOwnerToken(workspaceId: string): Promise<string>;
 
     /**
      * Creates and starts a workspace for the given context URL.
@@ -126,6 +133,11 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     resetGenericInvite(inviteId: string): Promise<TeamMembershipInvite>;
     deleteTeam(teamId: string, userId: string): Promise<void>;
 
+    // Admin Settings
+    adminGetSettings(): Promise<InstallationAdminSettings>;
+    adminUpdateSettings(settings: InstallationAdminSettings): Promise<void>;
+    adminGetTelemetryData(): Promise<TelemetryData>;
+
     // Projects
     getProviderRepositoriesForUser(params: GetProviderRepositoriesParams): Promise<ProviderRepository[]>;
     createProject(params: CreateProjectParams): Promise<Project>;
@@ -142,6 +154,9 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     guessRepositoryConfiguration(cloneUrl: string): Promise<string | undefined>;
     setProjectConfiguration(projectId: string, configString: string): Promise<void>;
     updateProjectPartial(partialProject: PartialProject): Promise<void>;
+    setProjectEnvironmentVariable(projectId: string, name: string, value: string, censored: boolean): Promise<void>;
+    getProjectEnvironmentVariables(projectId: string): Promise<ProjectEnvVar[]>;
+    deleteProjectEnvironmentVariable(variableId: string): Promise<void>;
 
     // content service
     getContentBlobUploadUrl(name: string): Promise<string>
@@ -239,6 +254,16 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     identifyUser(event: RemoteIdentifyMessage): Promise<void>;
 }
 
+export interface RateLimiterError {
+    method?: string,
+
+    /**
+     * Retry after this many seconds, earliest.
+     * cmp.: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
+     */
+    retryAfter: number,
+}
+
 export interface CreateProjectParams {
     name: string;
     slug?: string;
@@ -384,10 +409,12 @@ export class GitpodCompositeClient<Client extends GitpodClient> implements Gitpo
 
     public registerClient(client: Partial<Client>): Disposable {
         this.clients.push(client);
-        const index = this.clients.length;
         return {
             dispose: () => {
-                this.clients.slice(index, 1);
+                const index = this.clients.indexOf(client);
+                if (index > -1) {
+                    this.clients.splice(index, 1);
+                }
             }
         }
     }
@@ -577,7 +604,7 @@ export class WorkspaceInstanceUpdateListener {
 }
 
 export interface GitpodServiceOptions {
-    onReconnect?: () => (void | Promise<void>)
+    onReconnect?: () => (void | Promise<void>)
 }
 
 export class GitpodServiceImpl<Client extends GitpodClient, Server extends GitpodServer> {

package/src/headless-workspace-log.ts

@@ -4,6 +4,30 @@
  * See License-AGPL.txt in the project root for license information.
  */
 
+
+export enum HeadlessWorkspaceEventType {
+    LogOutput = "log-output",
+    FinishedSuccessfully = "finish-success",
+    FinishedButFailed = "finish-fail",
+    AbortedTimedOut = "aborted-timeout",
+    Aborted = "aborted",
+    Started = "started"
+}
+export namespace HeadlessWorkspaceEventType {
+    export function isRunning(t: HeadlessWorkspaceEventType) {
+        return t === HeadlessWorkspaceEventType.LogOutput;
+    }
+    export function didFinish(t: HeadlessWorkspaceEventType) {
+        return t === HeadlessWorkspaceEventType.FinishedButFailed || t === HeadlessWorkspaceEventType.FinishedSuccessfully;
+    }
+}
+
+export interface HeadlessWorkspaceEvent {
+    workspaceID: string;
+    text: string;
+    type: HeadlessWorkspaceEventType;
+}
+
 export interface HeadlessLogUrls {
     // A map of id to URL
     streams: { [streamID: string]: string };

package/src/ide-frontend-service.ts

@@ -7,7 +7,7 @@
 import { Event } from "./util/event";
 import { Disposable } from "./util/disposable";
 
-export type IDEFrontendState = 'init' | 'ready' | 'terminated';
+export type IDEFrontendState = 'init' | 'ready' | 'terminated';
 
 export interface IDEFrontendService {
     readonly state: IDEFrontendState;

package/src/ide-protocol.ts

@@ -29,6 +29,28 @@ export interface IDEOptions {
      * The default desktop IDE when the user has not specified one.
      */
     defaultDesktopIde: string;
+
+    /**
+     * Client specific IDE options.
+     */
+    clients?: { [id: string]: IDEClient };
+}
+
+export interface IDEClient {
+    /**
+     * The default desktop IDE when the user has not specified one.
+     */
+    defaultDesktopIDE?: string;
+
+    /**
+     * Desktop IDEs supported by the client.
+     */
+    desktopIDEs?: string[]
+
+    /**
+     * Steps to install the client on user machine.
+     */
+    installationSteps?: string[]
 }
 
 export interface IDEOption {
@@ -80,6 +102,11 @@ export interface IDEOption {
      */
     image: string;
 
+    /**
+     * The latest image ref to the IDE image, this image ref always resolve to digest.
+     */
+    latestImage?: string;
+
     /**
      * When this is `true`, the tag of this image is resolved to the latest
      * image digest regularly.

package/src/index.ts

@@ -19,3 +19,4 @@ export * from './context-url';
 export * from './teams-projects-protocol';
 export * from './snapshot-url';
 export * from './oss-allowlist';
+export * from './installation-admin-protocol';

package/src/installation-admin-protocol.ts

@@ -0,0 +1,42 @@
+/**
+ * Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+import { v4 as uuidv4 } from 'uuid';
+
+const InstallationAdminSettingsPrototype = {
+    sendTelemetry: true
+}
+
+export type InstallationAdminSettings = typeof InstallationAdminSettingsPrototype;
+
+export namespace InstallationAdminSettings {
+    export function fields(): (keyof InstallationAdminSettings)[] {
+        return Object.keys(InstallationAdminSettingsPrototype) as (keyof InstallationAdminSettings)[];
+    }
+}
+
+export interface InstallationAdmin {
+    id: string;
+    settings: InstallationAdminSettings;
+}
+
+export interface TelemetryData {
+    installationAdmin: InstallationAdmin
+    totalUsers: number
+    totalWorkspaces: number
+    totalInstances: number
+}
+
+export namespace InstallationAdmin {
+    export function createDefault(): InstallationAdmin {
+        return {
+            id: uuidv4(),
+            settings: {
+                ...InstallationAdminSettingsPrototype,
+            }
+        };
+    }
+}

package/src/messaging/error.ts

@@ -78,4 +78,7 @@ export namespace ErrorCodes {
 
     // 630 Snapshot Error
     export const SNAPSHOT_ERROR = 630;
+
+    // 640 Headless logs are not available (yet)
+    export const HEADLESS_LOG_NOT_YET_AVAILABLE = 640;
 }

package/src/messaging/node/connection.ts

@@ -6,37 +6,34 @@
  */
 
 import * as ws from "ws";
-import * as http from "http";
-import * as net from "net";
 import { IWebSocket } from "vscode-ws-jsonrpc";
-import { log } from '../../util/logging';
 
-export interface OnOpen {
-    (webSocket: ws, request: http.IncomingMessage, socket: net.Socket, head: Buffer): void;
-}
-
-export function toIWebSocket(webSocket: ws) {
-    let sendsAfterOpen = 0;
+export function toIWebSocket(ws: ws) {
     return <IWebSocket>{
         send: content => {
-            if (webSocket.readyState !== ws.OPEN) {
-                if (sendsAfterOpen++ > 3) {
-                    //log.debug(`Repeated try to send on closed web socket (readyState was ${webSocket.readyState})`, { ws });
-                }
+            if (ws.readyState >= ws.CLOSING) {
+                // ws is already CLOSING/CLOSED, send() would just return an error.
                 return;
             }
-            webSocket.send(content, err => {
-                if (err) {
-                    log.error('error in ws.send()', err, { ws });
-                }
-            })
+
+            // in general send-errors should trigger an 'error' event already, we just make sure it actually happens.
+            try {
+                ws.send(content, err => {
+                    if (!err) {
+                        return;
+                    }
+                    ws.emit('error', err);
+                });
+            } catch (err) {
+                ws.emit('error', err);
+            }
         },
-        onMessage: cb => webSocket.on('message', cb),
-        onError: cb => webSocket.on('error', cb),
-        onClose: cb => webSocket.on('close', cb),
+        onMessage: cb => ws.on('message', cb),
+        onError: cb => ws.on('error', cb),
+        onClose: cb => ws.on('close', cb),
         dispose: () => {
-            if (webSocket.readyState < ws.CLOSING) {
-                webSocket.close();
+            if (ws.readyState < ws.CLOSING) {
+                ws.close();
             }
         }
     };

package/src/permission.ts

@@ -13,6 +13,7 @@ export const Permissions = {
     "registry-access": undefined,
     "admin-users": undefined,
     "admin-workspaces": undefined,
+    "admin-projects": undefined,
     "admin-api": undefined,
     "ide-settings": undefined,
     "new-workspace-cluster": undefined,
@@ -34,6 +35,22 @@ export interface Role {
     permissions: PermissionName[],
 }
 
+export namespace RolesOrPermissions {
+    export function toPermissionSet(rolesOrPermissions: RoleOrPermission[] | undefined): Set<PermissionName> {
+        rolesOrPermissions = rolesOrPermissions || [];
+
+        const permissions = new Set<PermissionName>();
+        for (const rop of rolesOrPermissions) {
+            if (Permission.is(rop)) {
+                permissions.add(rop);
+            } else if (RoleName.is(rop)) {
+                Role.getByName(rop).permissions.forEach(p => permissions.add(p));
+            }
+        }
+        return permissions;
+    };
+}
+
 export namespace Permission {
     /** The permission to monitor the (live) state of a Gitpod installation */
     export const MONITOR: PermissionName = "monitor";
@@ -50,6 +67,9 @@ export namespace Permission {
     /** The permission for accessing all workspace data */
     export const ADMIN_WORKSPACES: PermissionName = "admin-workspaces";
 
+    /** The permission for accessing all projects data */
+    export const ADMIN_PROJECTS: PermissionName = "admin-projects";
+
     /** The permission to access the admin API */
     export const ADMIN_API: PermissionName = "admin-api";
 
@@ -62,9 +82,7 @@ export namespace Permission {
     }
 
     export const all = (): PermissionName[] => {
-        return Object.keys(Permission)
-            .map(k => (Permission as any)[k])
-            .filter(k => typeof(k) === 'string');
+        return Object.keys(Permissions) as PermissionName[];
     };
 }
 
@@ -94,6 +112,7 @@ export namespace Role {
         permissions: [
             Permission.ADMIN_USERS,
             Permission.ADMIN_WORKSPACES,
+            Permission.ADMIN_PROJECTS,
             Permission.ADMIN_API,
             Permission.ENFORCEMENT,
         ]