feat(rbac): Add database schema for RBAC tables

[jordan-umusu]

Summary by cubic

Introduces the RBAC database schema with scopes, roles, groups, and assignments to support org- and workspace-level permissions. Adds the "viewer" workspace role and aligns backend enums and frontend types.

• New Features

  • Added RBAC tables: scope, role, role_scope, group, group_member, group_assignment, user_role_assignment.
  • Added ScopeSource enum (system, registry, custom) with a DB enum and indexes.
  • Enforced org-wide vs workspace-specific role assignments via unique constraints and partial indexes.
  • Synced WorkspaceRole to include viewer; updated frontend types/schemas.

• Migration

  • Run alembic upgrade head.
  • Ensure UI/API paths handle the new "viewer" role.
  • No seed data included; create roles/scopes as needed.

^{Written for commit 7a37727. Summary will update on new commits.}

[jordan-umusu]

• feat(rbac): Test suite #2036
• feat(rbac): Add rbac frontend #1988
• feat(rbac): Add @require_scope decorators to all API endpoints #1987
• feat(rbac): Add RBAC service and API routers #1986
• feat(rbac): Seed registry scopes during sync #1985
• feat(rbac): RBAC auth layer #1984
• feat(rbac): Add database schema for RBAC tables #1983 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[jordan-umusu]

@cubic review

[cubic-dev-ai]

@cubic review

@jordan-umusu I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 5 files

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7a37727f59

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="alembic/versions/8b630b0a094e_add_rbac_tables.py">

<violation number="1" location="alembic/versions/8b630b0a094e_add_rbac_tables.py:285">
P1: Partial unique index is missing `organization_id`, which would prevent users from having org-level role assignments in multiple organizations. The index should be on `["user_id", "organization_id"]` to allow one org-level assignment per user per organization.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
TestFailureScenarios/test_execute_raises_when_tarball_missing	View Logs