feat: implement audit logs and custom role management components

- Added new components for displaying and managing audit logs, including a data table and filters for user actions.
- Introduced a custom roles management interface, allowing users to create and modify roles with specific permissions.
- Updated permission checks to ensure proper access control for audit logs and custom roles.
- Refactored existing components to integrate new functionality and improve user experience.

packages/server/src/lib/access-control.ts

@@ -168,21 +168,23 @@ export const memberRole = ac.newRole({
 	gitProviders: [],
 	traefikFiles: [],
 	api: [],
-	volume: [],
-	deployment: [],
-	envVars: [],
-	projectEnvVars: [],
-	environmentEnvVars: [],
+	// Service-level enterprise resources — member can do everything within services they have access to
+	volume: ["read", "create", "delete"],
+	deployment: ["read", "create", "cancel"],
+	envVars: ["read", "write"],
+	projectEnvVars: ["read", "write"],
+	environmentEnvVars: ["read", "write"],
+	backup: ["read", "create", "update", "delete", "restore"],
+	volumeBackup: ["read", "create", "update", "delete", "restore"],
+	schedule: ["read", "create", "update", "delete"],
+	domain: ["read", "create", "delete"],
+	logs: ["read"],
+	monitoring: ["read"],
+	// Org-level enterprise resources — member cannot manage these
 	server: [],
 	registry: [],
 	certificate: [],
-	backup: [],
-	volumeBackup: [],
-	schedule: [],
-	domain: [],
 	destination: [],
 	notification: [],
-	logs: [],
-	monitoring: [],
 	auditLog: [],
 });

packages/server/src/services/permission.ts

@@ -182,13 +182,14 @@ export const resolvePermissions = async (
 	const legacyOverrides =
 		memberRecord.role === "member" ? getLegacyOverrides(memberRecord) : {};
 
-	const isStaticRole = memberRecord.role in staticRoles;
+	const isPrivilegedRole =
+		memberRecord.role === "owner" || memberRecord.role === "admin";
 	const result = {} as ResolvedPermissions;
 
 	for (const [resource, actions] of Object.entries(statements)) {
 		const resourcePerms = {} as Record<string, boolean>;
 		for (const action of actions) {
-			if (isStaticRole && enterpriseOnlyResources.has(resource)) {
+			if (isPrivilegedRole && enterpriseOnlyResources.has(resource)) {
 				resourcePerms[action] = true;
 				continue;
 			}