Migrate paywalled flags to entitlements

[daryllimyt]

Summary

• migrate paywalled feature flags to tier entitlements with backend gating and defaults
• gate registry UDF visibility by entitlement and backfill required metadata
• update frontend gating to use organization entitlements

Testing

• uv run ruff check .
• uv run pyright tracecat/registry/actions/service.py tracecat/registry/actions/schemas.py tracecat/registry/actions/bound.py tracecat/registry/repository.py tracecat/api/app.py tests/unit/test_registry.py packages/tracecat-registry/tracecat_registry/_internal/registry.py packages/tracecat-registry/tracecat_registry/config.py packages/tracecat-registry/tracecat_registry/core/ee/__init__.py packages/tracecat-registry/tracecat_registry/core/ee/durations.py packages/tracecat-registry/tracecat_registry/core/ee/tasks.py packages/tracecat-registry/tracecat_registry/core/agent.py alembic/versions/a91c2b7d4e3f_add_required_entitlements_to_registry_actions.py
• pnpm -C frontend generate-client-ci
• uv run pytest tests/unit/test_registry.py (fails: missing TRACECAT__SERVICE_KEY in env)

Rollout / Risk

• entitlement gates can hide UDFs and APIs if org tiers are misconfigured
• migration updates default tier entitlements and registry action metadata

Issue

• N/A

Screenshots

• N/A

---

Summary by cubic

Migrated paywalled feature flags to organization tier entitlements and enforced gating across backend APIs, registry UDFs, and frontend UI. This aligns EE feature access with org tiers and prevents accidental exposure.

• Refactors

  • Added effective entitlements API: GET /organization/entitlements and frontend hook useEntitlements.
  • Replaced feature-flag checks with require_entitlement in routers (git sync, agent presets, case dropdowns/durations/tasks/triggers) and agent runtime/session.
  • Added required_entitlements to registry actions and filtered listings/secrets by org entitlements.
  • Updated validation to require agent_approvals entitlement for tool_approvals.
  • Simplified FeatureFlag enum to ai-ranking only.

• Migration

  • Run Alembic upgrades: 6b1d2e4f8c01, a91c2b7d4e3f.
  • Regenerate frontend client.
  • Verify org tier configuration; misconfigured entitlements will hide UDFs and routes.

^{Written for commit b9638a1. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 54 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="tests/temporal/test_durable_agent_workflow.py">

<violation number="1" location="tests/temporal/test_durable_agent_workflow.py:65">
P3: Move the `tracecat.tiers` import to the module level to follow the repository rule against function-level imports.</violation>
</file>

<file name="tests/unit/test_validation.py">

<violation number="1" location="tests/unit/test_validation.py:972">
P3: Move this import to module scope to follow the project rule against function-level imports (avoids hidden import side effects and keeps import ordering consistent).</violation>
</file>

<file name="tracecat/registry/actions/schemas.py">

<violation number="1" location="tracecat/registry/actions/schemas.py:459">
P2: RegistryActionUpdate.from_bound does not propagate the new required_entitlements option, so updates built from a bound action will clear entitlements. Include required_entitlements in the options mapping to avoid losing this metadata.</violation>
</file>

<file name="tracecat/validation/service.py">

<violation number="1" location="tracecat/validation/service.py:402">
P2: Avoid raising a ValueError for missing organization_id inside validation; it will bubble up as a 500. Treat this as a validation failure by defaulting to not entitled and letting the existing ValidationDetail path return a user-facing error instead.

(Based on your team's feedback about error handling posture.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Avoid raising a ValueError for missing organization_id inside validation; it will bubble up as a 500. Treat this as a validation failure by defaulting to not entitled and letting the existing ValidationDetail path return a user-facing error instead.

(Based on your team's feedback about error handling posture.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tracecat/validation/service.py, line 402:

<comment>Avoid raising a ValueError for missing organization_id inside validation; it will bubble up as a 500. Treat this as a validation failure by defaulting to not entitled and letting the existing ValidationDetail path return a user-facing error instead.

(Based on your team's feedback about error handling posture.) </comment>

<file context>
@@ -390,23 +392,31 @@ async def validate_dsl_actions(
-                    loc=(act_stmt.ref, "tool_approvals"),
+            if agent_approvals_entitled is None:
+                if role.organization_id is None:
+                    raise ValueError(
+                        "Role must have organization_id to validate entitlements"
+                    )
</file context>

[cubic-dev-ai]

P3: Move the tracecat.tiers import to the module level to follow the repository rule against function-level imports.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/temporal/test_durable_agent_workflow.py, line 65:

<comment>Move the `tracecat.tiers` import to the module level to follow the repository rule against function-level imports.</comment>

<file context>
@@ -57,17 +56,18 @@
-    """Enable agent approvals feature flag for all tests in this module."""
+def enable_agent_approvals_entitlement(monkeypatch):
+    """Enable agent approvals entitlement for all tests in this module."""
+    from tracecat.tiers import defaults as tier_defaults
+
     monkeypatch.setattr(
</file context>

[cubic-dev-ai]

P3: Move this import to module scope to follow the project rule against function-level imports (avoids hidden import side effects and keeps import ordering consistent).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/unit/test_validation.py, line 972:

<comment>Move this import to module scope to follow the project rule against function-level imports (avoids hidden import side effects and keeps import ordering consistent).</comment>

<file context>
@@ -965,13 +963,21 @@ async def test_validate_dsl_with_optional_oauth_credentials(
-    # Ensure feature flag disabled
-    monkeypatch.setattr(config, "TRACECAT__FEATURE_FLAGS", set())
+    # Ensure entitlement disabled
+    from tracecat.tiers import defaults as tier_defaults
+
+    monkeypatch.setattr(
</file context>

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
TestFailureScenarios/test_execute_raises_when_tarball_missing	View Logs