From 32a2fdf34757c84832d75992efe09ce292cb5460 Mon Sep 17 00:00:00 2001
From: cstns <cstn.serban@gmail.com>
Date: Fri, 9 Oct 2026 13:20:42 +0300
Subject: [PATCH 1/3] Let application Owners create instances from the team
 pages

The Add Instance button on team Home and the Create Instance buttons on team Hosted Instances only checked the team role, so a team Member with Owner access on an application saw them disabled. They now allow it when the team role or any application role permits it. The create form already only lists applications the user can create in.
---
 frontend/src/composables/Permissions.js       | 28 +++++++++++++++
 frontend/src/pages/team/Home/index.vue        |  9 ++---
 frontend/src/pages/team/Instances.vue         | 12 +++----
 .../frontend/composables/Permissions.spec.js  | 34 +++++++++++++++++++
 4 files changed, 73 insertions(+), 10 deletions(-)
 create mode 100644 test/unit/frontend/composables/Permissions.spec.js

diff --git a/frontend/src/composables/Permissions.js b/frontend/src/composables/Permissions.js
index 704c6f722e..d0b4d1af62 100644
--- a/frontend/src/composables/Permissions.js
+++ b/frontend/src/composables/Permissions.js
@@ -52,6 +52,25 @@ export const hasPermission = (scope, teamMembership, context) => {
     return true
 }
 
+/**
+ * Checks if a user has the required permission either at the team level or in at least
+ * one application where they have an application-level role.
+ *
+ * Used for team-wide actions that end up in an application of the user's choosing,
+ * e.g. creating an instance from the team pages.
+ *
+ * @param {string} scope - The specific scope for which the permission check is being made.
+ * @param {Object|null} teamMembership - The user's team membership information.
+ * @returns {boolean} Returns true if the user has the permission in the team or in any of their applications.
+ */
+export const hasPermissionInAnyApplication = (scope, teamMembership) => {
+    if (hasPermission(scope, teamMembership)) {
+        return true
+    }
+    const applications = Object.keys(teamMembership?.permissions?.applications || {})
+    return applications.some(applicationId => hasPermission(scope, teamMembership, { applicationId }))
+}
+
 /**
  * Check if the user has the minimum required role.
  * @param {Role} role - The role to check against.
@@ -110,6 +129,14 @@ export default function usePermissions () {
      */
     const _hasPermission = (scope, context) => hasPermission(scope, teamMembership.value, context)
 
+    /**
+     * Checks if a user has the required permission in the team or in at least one of their applications.
+     *
+     * @param {string} scope - The specific scope for which the permission check is being made.
+     * @returns {boolean} Returns true if the user has the permission in the team or in any of their applications.
+     */
+    const _hasPermissionInAnyApplication = (scope) => hasPermissionInAnyApplication(scope, teamMembership.value)
+
     /**
      * Check if the user has the minimum required role.
      * @param {Role} role - The role to check against.
@@ -133,6 +160,7 @@ export default function usePermissions () {
     return {
         isVisitingAdmin: _isVisitingAdmin,
         hasPermission: _hasPermission,
+        hasPermissionInAnyApplication: _hasPermissionInAnyApplication,
         hasAMinimumTeamRoleOf: _hasAMinimumTeamRoleOf,
         hasALowerOrEqualTeamRoleThan: _hasALowerOrEqualTeamRoleThan
     }
diff --git a/frontend/src/pages/team/Home/index.vue b/frontend/src/pages/team/Home/index.vue
index 275024d6cc..50367ab74d 100644
--- a/frontend/src/pages/team/Home/index.vue
+++ b/frontend/src/pages/team/Home/index.vue
@@ -38,11 +38,11 @@
 
                             <template #actions>
                                 <ff-button
-                                    v-ff-tooltip:left="!hasPermission('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
+                                    v-ff-tooltip:left="!hasPermissionInAnyApplication('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
                                     data-action="create-project"
                                     kind="secondary"
                                     :to="{name: 'team-instance-create'}"
-                                    :disabled="!hasPermission('project:create')"
+                                    :disabled="!hasPermissionInAnyApplication('project:create')"
                                 >
                                     <template #icon-left>
                                         <PlusIcon class="ff-icon" />
@@ -189,10 +189,11 @@ export default {
     setup () {
         const { groupBySimplifiedStates } = useInstanceStates()
 
-        const { hasPermission } = usePermissions()
+        const { hasPermission, hasPermissionInAnyApplication } = usePermissions()
         return {
             groupBySimplifiedStates,
-            hasPermission
+            hasPermission,
+            hasPermissionInAnyApplication
         }
     },
     data () {
diff --git a/frontend/src/pages/team/Instances.vue b/frontend/src/pages/team/Instances.vue
index 2dfa37423b..bdceeb0610 100644
--- a/frontend/src/pages/team/Instances.vue
+++ b/frontend/src/pages/team/Instances.vue
@@ -74,11 +74,11 @@
                             </template>
                         </ff-popover>
                         <ff-button
-                            v-ff-tooltip:left="!hasPermission('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
+                            v-ff-tooltip:left="!hasPermissionInAnyApplication('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
                             data-action="create-project"
                             kind="primary"
                             :to="{name: 'team-instance-create'}"
-                            :disabled="!hasPermission('project:create')"
+                            :disabled="!hasPermissionInAnyApplication('project:create')"
                         >
                             <template #icon-left>
                                 <PlusSmallIcon />
@@ -148,10 +148,10 @@
                     </template>
                     <template #actions>
                         <ff-button
-                            v-ff-tooltip:bottom="!hasPermission('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
+                            v-ff-tooltip:bottom="!hasPermissionInAnyApplication('project:create') && 'Your role does not allow creating new instances. Contact a team admin to change your role.'"
                             kind="primary"
                             :to="{name: 'team-instance-create'}"
-                            :disabled="!hasPermission('project:create')"
+                            :disabled="!hasPermissionInAnyApplication('project:create')"
                         >
                             <template #icon-left>
                                 <PlusSmallIcon />
@@ -225,9 +225,9 @@ export default {
     setup () {
         const { statesMap } = useInstanceStates()
         const { navigateTo } = useNavigationHelper()
-        const { hasPermission } = usePermissions()
+        const { hasPermission, hasPermissionInAnyApplication } = usePermissions()
 
-        return { hasPermission, navigateTo, statesMap }
+        return { hasPermission, hasPermissionInAnyApplication, navigateTo, statesMap }
     },
     data () {
         return {
diff --git a/test/unit/frontend/composables/Permissions.spec.js b/test/unit/frontend/composables/Permissions.spec.js
new file mode 100644
index 0000000000..4ae914d326
--- /dev/null
+++ b/test/unit/frontend/composables/Permissions.spec.js
@@ -0,0 +1,34 @@
+import { describe, expect, test } from 'vitest'
+
+import { Roles } from '../../../../forge/lib/roles.js'
+import { hasPermissionInAnyApplication } from '../../../../frontend/src/composables/Permissions.js'
+
+describe('hasPermissionInAnyApplication', () => {
+    test('allows a team Owner', () => {
+        expect(hasPermissionInAnyApplication('project:create', { role: Roles.Owner })).toBe(true)
+    })
+
+    test('denies a team Member with no application roles', () => {
+        expect(hasPermissionInAnyApplication('project:create', { role: Roles.Member })).toBe(false)
+    })
+
+    test('allows a team Member who is Owner of an application', () => {
+        const teamMembership = {
+            role: Roles.Member,
+            permissions: { applications: { app1: Roles.Viewer, app2: Roles.Owner } }
+        }
+        expect(hasPermissionInAnyApplication('project:create', teamMembership)).toBe(true)
+    })
+
+    test('denies a team Member whose application roles are all below Owner', () => {
+        const teamMembership = {
+            role: Roles.Member,
+            permissions: { applications: { app1: Roles.Viewer, app2: Roles.Member } }
+        }
+        expect(hasPermissionInAnyApplication('project:create', teamMembership)).toBe(false)
+    })
+
+    test('denies when there is no team membership', () => {
+        expect(hasPermissionInAnyApplication('project:create', null)).toBe(false)
+    })
+})

From 45e89f1484549fd46247d8dfb341f37affef27cc Mon Sep 17 00:00:00 2001
From: cstns <cstn.serban@gmail.com>
Date: Fri, 9 Oct 2026 14:30:51 +0300
Subject: [PATCH 2/3] Expect the create button to be enabled for a member who
 owns an application

The member in this spec has the Owner role on application-5, so with application Owners now able to create instances the button is enabled for them.
---
 .../cypress/tests-ee/rbac/rbac-member-contextual.spec.js     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/e2e/frontend/cypress/tests-ee/rbac/rbac-member-contextual.spec.js b/test/e2e/frontend/cypress/tests-ee/rbac/rbac-member-contextual.spec.js
index 02b9ebff5c..c9c58cea10 100644
--- a/test/e2e/frontend/cypress/tests-ee/rbac/rbac-member-contextual.spec.js
+++ b/test/e2e/frontend/cypress/tests-ee/rbac/rbac-member-contextual.spec.js
@@ -588,10 +588,11 @@ describe('FlowFuse - RBAC Member Contextual permissions', () => {
             }
         })
     })
-    it('should not be able to create new instances', () => {
+    it('should be able to create new instances because they own an application', () => {
         cy.get('[data-nav="team-instances"]').click()
         cy.get('[data-action="create-project"]').should('exist')
-        cy.get('[data-action="create-project"]').should('be.disabled')
+        // the user has an owner role in application-5
+        cy.get('[data-action="create-project"]').should('not.be.disabled')
 
         // todo: users without permissions to create an instance in any application should be redirected when accessing
         //  the instance creation form

From 861db736f59ea7cdfcedf71117a9b744206571e1 Mon Sep 17 00:00:00 2001
From: cstns <cstn.serban@gmail.com>
Date: Fri, 9 Oct 2026 15:11:55 +0300
Subject: [PATCH 3/3] Expect the create button to be enabled for a viewer who
 owns an application

Same as the member spec, the viewer here has the Owner role on application-5, so the create button is enabled for them now.
---
 .../cypress/tests-ee/rbac/rbac-viewer-contextual.spec.js     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/e2e/frontend/cypress/tests-ee/rbac/rbac-viewer-contextual.spec.js b/test/e2e/frontend/cypress/tests-ee/rbac/rbac-viewer-contextual.spec.js
index 6b1f970533..de2a6cb4f7 100644
--- a/test/e2e/frontend/cypress/tests-ee/rbac/rbac-viewer-contextual.spec.js
+++ b/test/e2e/frontend/cypress/tests-ee/rbac/rbac-viewer-contextual.spec.js
@@ -565,10 +565,11 @@ describe('FlowFuse - RBAC Viewer Contextual permissions', () => {
             }
         })
     })
-    it('should not be able to create new instances', () => {
+    it('should be able to create new instances because they own an application', () => {
         cy.get('[data-nav="team-instances"]').click()
         cy.get('[data-action="create-project"]').should('exist')
-        cy.get('[data-action="create-project"]').should('be.disabled')
+        // the user has an owner role in application-5
+        cy.get('[data-action="create-project"]').should('not.be.disabled')
 
         // todo: users without permissions to create an instance in any application should be redirected when accessing
         //  the instance creation form