feat: restrict integrations management to integration-full-all permission (#6509)

packages/api/src/router/home.ts

@@ -92,7 +92,7 @@ export const homeRouter = createTRPCRouter({
       });
     }
 
-    if (ctx.session?.user.permissions.includes("integration-create")) {
+    if (ctx.session?.user.permissions.includes("integration-full-all")) {
       statistics.push({
         titleKey: "integration",
         subtitleKey: "resources",

packages/api/src/router/integration/integration-router.ts

@@ -62,12 +62,13 @@ export const integrationRouter = createTRPCRouter({
         requiredSecrets: def.secretKinds,
       }));
     }),
-  all: protectedProcedure
+  all: permissionRequiredProcedure
+    .requiresPermission("integration-full-all")
     .meta({
       mcp: {
         enabled: true,
         description:
-          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
+          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Requires integration-full-all permission. Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
       },
     })
     .query(async ({ ctx }) => {
@@ -296,6 +297,7 @@ export const integrationRouter = createTRPCRouter({
       };
     }),
   create: permissionRequiredProcedure
+    .requiresPermission("integration-full-all")
     .requiresPermission("integration-create")
     .meta({
       mcp: {