[server] READONLY role

[bkwi]

What type of request is this?

New feature idea

Clear and concise description of the feature you are proposing

Adding new role that will only be able to view documents in an organization.

Additional context

hey @CorentinTh! Thanks for merging my PR (#660)!

I found this issue when I was trying to figure out what it would take to add a new role:

export const ORGANIZATION_ROLES = {
  MEMBER: 'member',
  OWNER: 'owner',
  ADMIN: 'admin',
  READONLY: 'readonly',  // <-- this one :)
} as const;

so that users with this role will only be able to view documents (and nothing else). Have you ever thought about adding something like this? And if yes, do you have a preference on how this should be implemented? Maybe something like extending the ensureUserIsInOrganization check with a required role?

Validations

• Check the feature is not already implemented in the project.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.
• Check that the feature is technically feasible and aligns with the project's goals.

[CorentinTh]

Thanks for the suggestion @bkwi 🙏

Some time ago I was thinking that switching to PBAC would maybe make more sens in organizations than RBAC, so user can configure more granularly the permissions in their organizations (like enable/disable new tagging rules creation, tag deletion, document creation, intake email management, ...) per user.

That being said, it's a huge refactor, and I haven't thought of all the implication yet, and maybe it's not such a good idea.

So in the meantime yeah, I think we can introduce this readonly organization role, and add something like ensureUserIsInOrganizationWithWritePermission that checks users is not readonly for mutation routes