Allow superusers to reset any project (#6346)

admin/server/projects.go

@@ -1538,18 +1538,24 @@ func (s *Server) RedeployProject(ctx context.Context, req *adminv1.RedeployProje
 		attribute.String("args.project", req.Project),
 	)
 
-	org, err := s.admin.DB.FindOrganizationByName(ctx, req.Organization)
+	proj, err := s.admin.DB.FindProjectByName(ctx, req.Organization, req.Project)
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 
-	// check if org has blocking billing errors
-	err = s.admin.CheckBlockingBillingErrors(ctx, org.ID)
+	claims := auth.GetClaims(ctx)
+	forceAccess := req.SuperuserForceAccess && claims.Superuser(ctx)
+	if !claims.ProjectPermissions(ctx, proj.OrganizationID, proj.ID).ManageProd && !forceAccess {
+		return nil, status.Error(codes.PermissionDenied, "does not have permission to manage deployment")
+	}
+
+	org, err := s.admin.DB.FindOrganizationByName(ctx, req.Organization)
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 
-	proj, err := s.admin.DB.FindProjectByName(ctx, req.Organization, req.Project)
+	// check if org has blocking billing errors
+	err = s.admin.CheckBlockingBillingErrors(ctx, org.ID)
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
@@ -1562,11 +1568,6 @@ func (s *Server) RedeployProject(ctx context.Context, req *adminv1.RedeployProje
 		}
 	}
 
-	claims := auth.GetClaims(ctx)
-	if !claims.ProjectPermissions(ctx, proj.OrganizationID, proj.ID).ManageProd {
-		return nil, status.Error(codes.PermissionDenied, "does not have permission to manage deployment")
-	}
-
 	_, err = s.admin.RedeployProject(ctx, proj, depl)
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())

cli/cmd/sudo/project/reset.go

@@ -35,8 +35,9 @@ func ResetCmd(ch *cmdutil.Helper) *cobra.Command {
 			}
 
 			_, err = client.RedeployProject(cmd.Context(), &adminv1.RedeployProjectRequest{
-				Organization: org,
-				Project:      project,
+				Organization:         org,
+				Project:              project,
+				SuperuserForceAccess: true,
 			})
 			if err != nil {
 				return err

proto/gen/rill/admin/v1/admin.swagger.yaml

@@ -1274,6 +1274,10 @@ paths:
           in: path
           required: true
           type: string
+        - name: superuserForceAccess
+          in: query
+          required: false
+          type: boolean
       tags:
         - AdminService
   /v1/organizations/{organization}/projects/{project}/reports:

proto/rill/admin/v1/api.proto

@@ -1184,6 +1184,7 @@ message CreateAssetResponse {
 message RedeployProjectRequest {
   string organization = 1;
   string project = 2;
+  bool superuser_force_access = 3;
 }
 
 message RedeployProjectResponse {}

web-admin/src/client/gen/admin-service/admin-service.ts

@@ -82,6 +82,7 @@ import type {
   V1RemoveProjectMemberUserResponse,
   V1SetProjectMemberUserRoleResponse,
   V1RedeployProjectResponse,
+  AdminServiceRedeployProjectParams,
   V1CreateReportResponse,
   AdminServiceCreateReportBodyBody,
   V1GenerateReportYAMLResponse,
@@ -2875,10 +2876,12 @@ This RPC can be used to redeploy a project that has been hibernated.
 export const adminServiceRedeployProject = (
   organization: string,
   project: string,
+  params?: AdminServiceRedeployProjectParams,
 ) => {
   return httpClient<V1RedeployProjectResponse>({
     url: `/v1/organizations/${organization}/projects/${project}/redeploy`,
     method: "post",
+    params,
   });
 };
 
@@ -2895,25 +2898,37 @@ export const createAdminServiceRedeployProject = <
   mutation?: CreateMutationOptions<
     Awaited<ReturnType<typeof adminServiceRedeployProject>>,
     TError,
-    { organization: string; project: string },
+    {
+      organization: string;
+      project: string;
+      params?: AdminServiceRedeployProjectParams;
+    },
     TContext
   >;
 }) => {
   const { mutation: mutationOptions } = options ?? {};
 
   const mutationFn: MutationFunction<
     Awaited<ReturnType<typeof adminServiceRedeployProject>>,
-    { organization: string; project: string }
+    {
+      organization: string;
+      project: string;
+      params?: AdminServiceRedeployProjectParams;
+    }
   > = (props) => {
-    const { organization, project } = props ?? {};
+    const { organization, project, params } = props ?? {};
 
-    return adminServiceRedeployProject(organization, project);
+    return adminServiceRedeployProject(organization, project, params);
   };
 
   return createMutation<
     Awaited<ReturnType<typeof adminServiceRedeployProject>>,
     TError,
-    { organization: string; project: string },
+    {
+      organization: string;
+      project: string;
+      params?: AdminServiceRedeployProjectParams;
+    },
     TContext
   >(mutationFn, mutationOptions);
 };

web-admin/src/client/gen/index.schemas.ts

@@ -184,6 +184,10 @@ export type AdminServiceListMagicAuthTokensParams = {
   pageToken?: string;
 };
 
+export type AdminServiceRedeployProjectParams = {
+  superuserForceAccess?: boolean;
+};
+
 export type AdminServiceAddProjectMemberUserBody = {
   email?: string;
   role?: string;

web-common/src/proto/gen/rill/admin/v1/api_pb.ts

@@ -2706,6 +2706,11 @@ export class RedeployProjectRequest extends Message<RedeployProjectRequest> {
    */
   project = "";
 
+  /**
+   * @generated from field: bool superuser_force_access = 3;
+   */
+  superuserForceAccess = false;
+
   constructor(data?: PartialMessage<RedeployProjectRequest>) {
     super();
     proto3.util.initPartial(data, this);
@@ -2716,6 +2721,7 @@ export class RedeployProjectRequest extends Message<RedeployProjectRequest> {
   static readonly fields: FieldList = proto3.util.newFieldList(() => [
     { no: 1, name: "organization", kind: "scalar", T: 9 /* ScalarType.STRING */ },
     { no: 2, name: "project", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "superuser_force_access", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
   ]);
 
   static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RedeployProjectRequest {