@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/project/canLeave.spec.ts

@@ -11,7 +11,7 @@ import {
   WorkspaceNoAccessError,
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { TIME_MS } from '../../../core/helpers/timeConstants.js'
 
 describe('canLeaveProjectPolicy', () => {
@@ -39,7 +39,7 @@ describe('canLeaveProjectPolicy', () => {
         workspaceId: 'workspace-id'
       }),
       getProjectRole: async () => Roles.Stream.Reviewer,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canLoad.spec.ts

@@ -13,6 +13,7 @@ import {
 } from '../../domain/authErrors.js'
 import { TIME_MS } from '../../../core/index.js'
 import { ProjectVisibility } from '../../domain/projects/types.js'
+import { getWorkspaceFake } from '../../../tests/fakes.js'
 
 const buildCanLoadPolicy = (overrides?: Partial<Parameters<typeof canLoadPolicy>[0]>) =>
   canLoadPolicy({
@@ -37,6 +38,21 @@ const buildCanLoadPolicy = (overrides?: Partial<Parameters<typeof canLoadPolicy>
   })
 
 describe('canLoad', () => {
+  it('returns ok if anyone is trying to load a publicly loadable project', async () => {
+    const canLoad = buildCanLoadPolicy()
+
+    // this is a deliberate copy pasta, if anyone removes from the baked in list,
+    // the test should fail
+    const publiclyLoadableProjects = ['8be1007be1']
+
+    for (const projectId of publiclyLoadableProjects) {
+      const result = await canLoad({
+        userId: undefined,
+        projectId
+      })
+      expect(result).toBeAuthOKResult()
+    }
+  })
   it('returns error if user is not logged in', async () => {
     const canLoad = buildCanLoadPolicy()
 
@@ -164,7 +180,7 @@ describe('canLoad', () => {
         visibility: ProjectVisibility.Workspace,
         allowPublicComments: false
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canLoad.ts

@@ -45,6 +45,9 @@ type PolicyErrors = InstanceType<
 export const canLoadPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors> =
   (loaders) =>
   async ({ userId, projectId }) => {
+    if (publiclyLoadableProjects.includes(projectId)) {
+      return ok()
+    }
     const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
       userId
     })
@@ -70,3 +73,7 @@ export const canLoadPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyError
 
     return ok()
   }
+
+const publiclyLoadableProjects = [
+  '8be1007be1' // Demo models
+]

package/src/authz/policies/project/canMoveToWorkspace.spec.ts

@@ -12,7 +12,11 @@ import {
   WorkspaceProjectMoveInvalidError,
   WorkspacesNotEnabledError
 } from '../../domain/authErrors.js'
-import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
+import {
+  getProjectFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../../tests/fakes.js'
 
 const buildCanMoveToWorkspace = (
   overrides?: Partial<Parameters<typeof canMoveToWorkspacePolicy>[0]>
@@ -42,15 +46,7 @@ const buildCanMoveToWorkspace = (
     getWorkspaceSsoSession: async () => {
       assert.fail()
     },
-    getWorkspacePlan: async () => {
-      return {
-        status: 'valid',
-        workspaceId: 'workspace-id',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        name: 'team'
-      }
-    },
+    getWorkspacePlan: getWorkspacePlanFake({ workspaceId: 'workspace-id' }),
     getWorkspaceLimits: async () => {
       return {
         modelCount: 5,

package/src/authz/policies/project/canPublish.spec.ts

@@ -13,6 +13,7 @@ import {
 } from '../../domain/authErrors.js'
 import { TIME_MS } from '../../../core/index.js'
 import { ProjectVisibility } from '../../domain/projects/types.js'
+import { getWorkspaceFake } from '../../../tests/fakes.js'
 
 const buildCanPublishPolicy = (
   overrides?: Partial<Parameters<typeof canPublishPolicy>[0]>
@@ -122,7 +123,7 @@ describe('canPublish', () => {
         visibility: ProjectVisibility.Workspace,
         allowPublicComments: false
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canRead.spec.ts

@@ -11,9 +11,8 @@ import {
   WorkspaceNoAccessError,
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import cryptoRandomString from 'crypto-random-string'
-import { AuthCheckContextLoaders } from '../../domain/loaders.js'
 import { ProjectVisibility } from '../../domain/projects/types.js'
 
 const canReadProjectArgs = () => {
@@ -22,7 +21,7 @@ const canReadProjectArgs = () => {
   return { projectId, userId }
 }
 
-const getWorkspace: AuthCheckContextLoaders['getWorkspace'] = async () => ({
+const getWorkspace = getWorkspaceFake({
   id: 'aaa',
   slug: 'bbb'
 })

package/src/authz/policies/project/canReadAccIntegrationSettings.spec.ts

@@ -0,0 +1,133 @@
+import cryptoRandomString from 'crypto-random-string'
+import { Roles } from '../../../core/constants.js'
+import { parseFeatureFlags } from '../../../environment/index.js'
+import { OverridesOf } from '../../../tests/helpers/types.js'
+import { canReadAccIntegrationSettingsPolicy } from './canReadAccIntegrationSettings.js'
+import {
+  getProjectFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../../tests/fakes.js'
+import { assert, describe, expect, it } from 'vitest'
+import {
+  AccIntegrationNotEnabledError,
+  ProjectNoAccessError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { WorkspaceFeatureFlags, WorkspacePlans } from '../../../workspaces/index.js'
+
+const buildSUT = (
+  overrides?: OverridesOf<typeof canReadAccIntegrationSettingsPolicy>
+) => {
+  const workspaceId = cryptoRandomString({ length: 9 })
+
+  return canReadAccIntegrationSettingsPolicy({
+    getEnv: async () => parseFeatureFlags({ FF_ACC_INTEGRATION_ENABLED: 'true' }),
+    getServerRole: async () => {
+      return Roles.Server.User
+    },
+    getAdminOverrideEnabled: async () => {
+      return true
+    },
+    getProject: getProjectFake({
+      id: 'project-id',
+      workspaceId
+    }),
+    getProjectRole: async () => {
+      return Roles.Stream.Contributor
+    },
+    getWorkspace: getWorkspaceFake({
+      id: workspaceId
+    }),
+    getWorkspaceRole: async () => {
+      return Roles.Workspace.Member
+    },
+    getWorkspaceSsoProvider: async () => {
+      return null
+    },
+    getWorkspaceSsoSession: async () => {
+      assert.fail()
+    },
+    getWorkspacePlan: getWorkspacePlanFake({ workspaceId, name: 'enterprise' }),
+    ...overrides
+  })
+}
+
+const buildArgs = () => ({
+  userId: cryptoRandomString({ length: 9 }),
+  projectId: cryptoRandomString({ length: 9 })
+})
+
+describe('canReadAccIntegrationSettings returns a function, that', () => {
+  it('requires the ACC integration to be enabled', async () => {
+    const result = await buildSUT({
+      getEnv: async () => parseFeatureFlags({ FF_ACC_INTEGRATION_ENABLED: 'false' })
+    })(buildArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: AccIntegrationNotEnabledError.code
+    })
+  })
+  it('requires the project to belong to a workspace', async () => {
+    const result = await buildSUT({
+      getProject: getProjectFake({
+        id: 'project-id'
+      })
+    })(buildArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: AccIntegrationNotEnabledError.code
+    })
+  })
+  it('requires the given user to have read access to the project', async () => {
+    const result = await buildSUT({
+      getProjectRole: async () => null
+    })(buildArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ProjectNoAccessError.code
+    })
+  })
+  it('requires the workspace to have an active plan', async () => {
+    const result = await buildSUT({
+      getWorkspacePlan: async () => null
+    })(buildArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+  it('requires the workspace plan to have access to the ACC integration feature flag', async () => {
+    const result = await buildSUT({
+      getWorkspacePlan: async () => {
+        return {
+          status: 'valid',
+          workspaceId: cryptoRandomString({ length: 9 }),
+          name: WorkspacePlans.Enterprise,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+          featureFlags: WorkspaceFeatureFlags.none
+        }
+      }
+    })(buildArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+  it('allows plans with the feature flag on, to access the ACC integration feature', async () => {
+    const result = await buildSUT({
+      getWorkspacePlan: async () => {
+        return {
+          status: 'valid',
+          workspaceId: cryptoRandomString({ length: 9 }),
+          name: WorkspacePlans.Free,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+          featureFlags: WorkspaceFeatureFlags.accIntegration
+        }
+      }
+    })(buildArgs())
+    expect(result).toBeAuthOKResult()
+  })
+})

package/src/authz/policies/project/canReadAccIntegrationSettings.ts

@@ -0,0 +1,87 @@
+import { err, ok } from 'true-myth/result'
+import {
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  ProjectNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspaceSsoSessionNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  AccIntegrationNotEnabledError
+} from '../../domain/authErrors.js'
+import { MaybeUserContext, ProjectContext } from '../../domain/context.js'
+import { Loaders } from '../../domain/loaders.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import { ensureImplicitProjectMemberWithReadAccessFragment } from '../../fragments/projects.js'
+import {
+  isWorkspaceFeatureFlagOn,
+  WorkspaceFeatureFlags
+} from '../../../workspaces/index.js'
+
+type PolicyLoaderKeys =
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProject
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole
+  | typeof Loaders.getWorkspacePlan
+
+type PolicyArgs = MaybeUserContext & ProjectContext
+
+type PolicyErrors = InstanceType<
+  | typeof ServerNoAccessError
+  | typeof ServerNoSessionError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof ProjectNotFoundError
+  | typeof ProjectNoAccessError
+  | typeof WorkspaceNoAccessError
+  | typeof WorkspaceSsoSessionNoAccessError
+  | typeof ProjectNotEnoughPermissionsError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+  | typeof AccIntegrationNotEnabledError
+>
+
+export const canReadAccIntegrationSettingsPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, projectId }) => {
+    const env = await loaders.getEnv()
+    const project = await loaders.getProject({ projectId })
+
+    if (!env.FF_ACC_INTEGRATION_ENABLED || !project?.workspaceId) {
+      return err(new AccIntegrationNotEnabledError())
+    }
+
+    const ensuredProjectRole = await ensureImplicitProjectMemberWithReadAccessFragment(
+      loaders
+    )({
+      userId,
+      projectId
+    })
+    if (ensuredProjectRole.isErr) {
+      return err(ensuredProjectRole.error)
+    }
+
+    const workspacePlan = await loaders.getWorkspacePlan({
+      workspaceId: project.workspaceId
+    })
+    if (!workspacePlan) return err(new WorkspacePlanNoFeatureAccessError())
+    const canUseFeature = isWorkspaceFeatureFlagOn({
+      workspaceFeatureFlags: workspacePlan.featureFlags,
+      feature: WorkspaceFeatureFlags.accIntegration
+    })
+    if (!canUseFeature) return err(new WorkspacePlanNoFeatureAccessError())
+
+    return ok()
+  }

package/src/authz/policies/project/canReadSettings.spec.ts

@@ -10,7 +10,7 @@ import {
   WorkspaceNoAccessError,
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { TIME_MS } from '../../../core/helpers/timeConstants.js'
 import { ProjectVisibility } from '../../domain/projects/types.js'
 
@@ -45,7 +45,7 @@ describe('canReadProjectSettingsPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canReadWebhooks.spec.ts

@@ -11,7 +11,7 @@ import {
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
 import { canReadProjectWebhooksPolicy } from './canReadWebhooks.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { TIME_MS } from '../../../core/helpers/timeConstants.js'
 import { ProjectVisibility } from '../../domain/projects/types.js'
 
@@ -43,7 +43,7 @@ describe('canReadProjectWebhooksPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canUpdate.spec.ts

@@ -12,7 +12,7 @@ import {
   WorkspaceNoAccessError,
   WorkspaceSsoSessionNoAccessError
 } from '../../domain/authErrors.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { TIME_MS } from '../../../core/index.js'
 
 // Default deps allow test to succeed, this makes it so that we need to override less of them
@@ -40,10 +40,7 @@ const buildWorkspaceSUT = (
       id: 'project-id',
       workspaceId: 'workspace-id'
     }),
-    getWorkspace: async () => ({
-      id: 'workspace-id',
-      slug: 'workspace-slug'
-    }),
+    getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
     getWorkspaceRole: async () => Roles.Workspace.Member,
     getWorkspaceSsoProvider: async () => ({
       providerId: 'provider-id'

package/src/authz/policies/project/canUpdateEmbedTokens.spec.ts

@@ -0,0 +1,132 @@
+import cryptoRandomString from 'crypto-random-string'
+import { Roles } from '../../../core/constants.js'
+import { parseFeatureFlags } from '../../../environment/index.js'
+import {
+  getProjectFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../../tests/fakes.js'
+import { canUpdateEmbedTokensPolicy } from './canUpdateEmbedTokens.js'
+import { assert, describe, expect, it } from 'vitest'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { OverridesOf } from '../../../tests/helpers/types.js'
+import { WorkspaceFeatureFlags } from '../../../workspaces/index.js'
+
+const buildCanUpdateEmbedTokens = (
+  overrides?: OverridesOf<typeof canUpdateEmbedTokensPolicy>
+) => {
+  const workspaceId = cryptoRandomString({ length: 9 })
+
+  return canUpdateEmbedTokensPolicy({
+    getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+    getServerRole: async () => {
+      return Roles.Server.User
+    },
+    getProject: getProjectFake({
+      id: 'project-id',
+      workspaceId
+    }),
+    getProjectRole: async () => {
+      return Roles.Stream.Owner
+    },
+    getWorkspace: getWorkspaceFake({
+      id: workspaceId
+    }),
+    getWorkspaceRole: async () => {
+      return Roles.Workspace.Admin
+    },
+    getWorkspaceSsoProvider: async () => {
+      return null
+    },
+    getWorkspaceSsoSession: async () => {
+      assert.fail()
+    },
+    getWorkspacePlan: getWorkspacePlanFake({ workspaceId }),
+    ...overrides
+  })
+}
+
+const canUpdateEmbedTokensArgs = () => ({
+  userId: cryptoRandomString({ length: 9 }),
+  projectId: cryptoRandomString({ length: 9 })
+})
+
+describe('canUpdateEmbedTokensArgs returns a function, that', () => {
+  it('requires a user session', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getServerRole: async () => {
+        return null
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ServerNoAccessError.code
+    })
+  })
+  it('requires user to be project owner', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getWorkspaceRole: async () => {
+        return Roles.Workspace.Member
+      },
+      getProjectRole: async () => {
+        return Roles.Stream.Contributor
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ProjectNotEnoughPermissionsError.code
+    })
+  })
+  it('does not check workspace plan if workspaces not enabled', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'false'
+        }),
+      getWorkspacePlan: async () => {
+        assert.fail()
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthOKResult()
+  })
+  it('does not check workspace plan if project is not in a workspace', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getWorkspacePlan: async () => {
+        assert.fail()
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthOKResult()
+  })
+  it('requires a paid workspace plan, if project is in a workspace', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getWorkspacePlan: async () => {
+        return {
+          status: 'valid',
+          workspaceId: 'foo',
+          name: 'free',
+          createdAt: new Date(),
+          updatedAt: new Date(),
+          featureFlags: WorkspaceFeatureFlags.none
+        }
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+  it('allows action on paid workspace plans', async () => {
+    const result = await buildCanUpdateEmbedTokens()(canUpdateEmbedTokensArgs())
+    expect(result).toBeAuthOKResult()
+  })
+})

package/src/authz/policies/project/canUpdateEmbedTokens.ts

@@ -0,0 +1,101 @@
+import { err, ok } from 'true-myth/result'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../domain/authErrors.js'
+import { MaybeUserContext, ProjectContext } from '../../domain/context.js'
+import { Loaders } from '../../domain/loaders.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureImplicitProjectMemberWithWriteAccessFragment,
+  ensureMinimumProjectRoleFragment
+} from '../../fragments/projects.js'
+import { Roles } from '../../../core/constants.js'
+
+type PolicyLoaderKeys =
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getProject
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole
+  | typeof Loaders.getWorkspacePlan
+
+type PolicyArgs = MaybeUserContext & ProjectContext
+
+type PolicyErrors = InstanceType<
+  | typeof ServerNoAccessError
+  | typeof ServerNoSessionError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof ProjectNotFoundError
+  | typeof ProjectNoAccessError
+  | typeof WorkspaceNoAccessError
+  | typeof WorkspaceSsoSessionNoAccessError
+  | typeof ProjectNotEnoughPermissionsError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+>
+
+export const canUpdateEmbedTokensPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, projectId }) => {
+    const env = await loaders.getEnv()
+    const project = await loaders.getProject({ projectId })
+
+    if (!!project?.workspaceId && env.FF_WORKSPACES_MODULE_ENABLED) {
+      // Ensure owner-level access and valid plan
+      const ensuredProjectRole =
+        await ensureImplicitProjectMemberWithWriteAccessFragment(loaders)({
+          userId,
+          projectId,
+          role: Roles.Stream.Owner
+        })
+      if (ensuredProjectRole.isErr) {
+        return err(ensuredProjectRole.error)
+      }
+
+      const plan = await loaders.getWorkspacePlan({ workspaceId: project.workspaceId })
+
+      switch (plan?.name) {
+        case 'academia':
+        case 'enterprise':
+        case 'pro':
+        case 'proUnlimited':
+        case 'proUnlimitedInvoiced':
+        case 'team':
+        case 'teamUnlimited':
+        case 'teamUnlimitedInvoiced':
+        case 'unlimited':
+          return ok()
+        case 'free':
+        default:
+          return err(new WorkspacePlanNoFeatureAccessError())
+      }
+    } else {
+      // Ensure project owner
+      const isProjectOwner = await ensureMinimumProjectRoleFragment(loaders)({
+        userId: userId!,
+        projectId,
+        role: Roles.Stream.Owner
+      })
+      if (isProjectOwner.isErr) {
+        return err(isProjectOwner.error)
+      }
+
+      return ok()
+    }
+  }

package/src/authz/policies/project/comment/canArchive.spec.ts

@@ -2,7 +2,11 @@ import { describe, expect, it } from 'vitest'
 import { canArchiveProjectCommentPolicy } from './canArchive.js'
 import { OverridesOf } from '../../../../tests/helpers/types.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getCommentFake, getProjectFake } from '../../../../tests/fakes.js'
+import {
+  getCommentFake,
+  getProjectFake,
+  getWorkspaceFake
+} from '../../../../tests/fakes.js'
 import { Roles } from '../../../../core/constants.js'
 import {
   CommentNotFoundError,
@@ -48,10 +52,7 @@ describe('canArchiveProjectCommentPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
-        id: 'workspace-id',
-        slug: 'workspace-slug'
-      }),
+      getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
       getWorkspaceRole: async () => Roles.Workspace.Member,
       getWorkspaceSsoProvider: async () => ({
         providerId: 'provider-id'