feat: restrict integrations management to integration-full-all permission (#6509)

apps/nextjs/src/app/[locale]/manage/integrations/edit/[id]/page.tsx

@@ -1,5 +1,7 @@
+import { notFound } from "next/navigation";
 import { Container, Fieldset, Group, Stack, Title } from "@mantine/core";
 
+import { auth } from "@homarr/auth/next";
 import { api } from "@homarr/api/server";
 import { getIntegrationName } from "@homarr/definitions";
 import { getI18n, getScopedI18n } from "@homarr/translation/server";
@@ -16,6 +18,11 @@ interface EditIntegrationPageProps {
 
 export default async function EditIntegrationPage(props: EditIntegrationPageProps) {
   const params = await props.params;
+  const session = await auth();
+
+  if (!session?.user.permissions.includes("integration-full-all")) {
+    notFound();
+  }
   const editT = await getScopedI18n("integration.page.edit");
   const t = await getI18n();
   const integration = await api.integration.byId({ id: params.id }).catch(catchTrpcNotFound);

apps/nextjs/src/app/[locale]/manage/integrations/new/page.tsx

@@ -23,7 +23,10 @@ interface NewIntegrationPageProps {
 export default async function IntegrationsNewPage(props: NewIntegrationPageProps) {
   const searchParams = await props.searchParams;
   const session = await auth();
-  if (!session?.user.permissions.includes("integration-create")) {
+  if (
+    !session?.user.permissions.includes("integration-full-all") ||
+    !session?.user.permissions.includes("integration-create")
+  ) {
     notFound();
   }
 

apps/nextjs/src/app/[locale]/manage/integrations/page.tsx

@@ -1,5 +1,5 @@
 import { Fragment } from "react";
-import { redirect } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import {
   AccordionControl,
   AccordionItem,
@@ -50,6 +50,9 @@ export default async function IntegrationsPage(props: IntegrationsPageProps) {
   if (!session) {
     redirect("/auth/login");
   }
+  if (!session.user.permissions.includes("integration-full-all")) {
+    notFound();
+  }
 
   const integrations = await api.integration.all();
   const t = await getScopedI18n("integration");

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -71,7 +71,7 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       icon: IconAffiliateFilled,
       href: "/manage/integrations",
       label: t("items.integrations"),
-      hidden: !session?.user.permissions.includes("integration-create"),
+      hidden: !session?.user.permissions.includes("integration-full-all"),
       "data-onboarding-tour-id": "manage-integrations",
     },
     {

packages/api/src/router/home.ts

@@ -92,7 +92,7 @@ export const homeRouter = createTRPCRouter({
       });
     }
 
-    if (ctx.session?.user.permissions.includes("integration-create")) {
+    if (ctx.session?.user.permissions.includes("integration-full-all")) {
       statistics.push({
         titleKey: "integration",
         subtitleKey: "resources",

packages/api/src/router/integration/integration-router.ts

@@ -62,12 +62,13 @@ export const integrationRouter = createTRPCRouter({
         requiredSecrets: def.secretKinds,
       }));
     }),
-  all: protectedProcedure
+  all: permissionRequiredProcedure
+    .requiresPermission("integration-full-all")
     .meta({
       mcp: {
         enabled: true,
         description:
-          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
+          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Requires integration-full-all permission. Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
       },
     })
     .query(async ({ ctx }) => {
@@ -296,6 +297,7 @@ export const integrationRouter = createTRPCRouter({
       };
     }),
   create: permissionRequiredProcedure
+    .requiresPermission("integration-full-all")
     .requiresPermission("integration-create")
     .meta({
       mcp: {

packages/spotlight/src/modes/command/global-group.tsx

@@ -95,7 +95,9 @@ export const globalCommandGroup = createGroup<Command>({
         icon: IconPlug,
         name: tOption("newIntegration.label"),
         useInteraction: interaction.children(newIntegrationChildrenOptions),
-        hidden: !session?.user.permissions.includes("integration-create"),
+        hidden:
+          !session?.user.permissions.includes("integration-full-all") ||
+          !session?.user.permissions.includes("integration-create"),
       },
       {
         commandKey: "newUser",

packages/spotlight/src/modes/page/pages-search-group.tsx

@@ -82,7 +82,7 @@ export const pagesSearchGroup = createGroup<{
         icon: IconPlug,
         path: "/manage/integrations",
         name: t("manageIntegration.label"),
-        hidden: !session,
+        hidden: !session?.user.permissions.includes("integration-full-all"),
       },
       {
         icon: IconSearch,