Add two new roles for premium users

[zhumo]

Problem

As a Fleet admin who is expanding my Fleet user base to other teams/groups/departments in my organization, I want to control the other departments' users' permissions more granularly, so that I can limit the surface area of Fleet in case of breach. Furthermore, the other teams may not have the need for all of Fleet's features and may lack the expertise to use those features responsibly. Therefore, I want to limit the other teams' ability to do things which would de-stabilize my Fleet instance, such as run a computationally intensive query.

In particular, the customer requested:

1. a role for their CI/CD runner to change configs only. Currently, the CI/CD runner has an admin role which is too powerful.
2. a role for the company's data analysts to fetch live and pre-built queries. Currently the observer role only allows running pre-built queries, while the maintainer role is too powerful.

Business Case

This enables Fleet to be used by a more diverse user base. It reduces the hesitancy on the part of the Fleet admin to give more access more broadly.

Measurement

Number of users in Fleet per deployment with these two roles.

Requirements

1. Create two new roles: "Observer+" and "GitOps" who are able to to accomplish the tasks described above in the "Problem" section.
2. The two new roles are premium-only
3. Map the two roles onto the permissions listed here: https://fleetdm.com/docs/using-fleet/permissions#user-permissions. PROPOSAL: https://docs.google.com/spreadsheets/d/1wNcvH0O4M1PwVZI0gEcxTrh-Qd0OCBDwman39A3bjCA/edit?usp=sharing
4. The Observer+ users should always be able to access the dashboard so that they can land on the home page.
5. The GitOps user is API-only and should not be able to access the dashboard (standard access denied page)
6. The GitOps user is not able to be selected from the drop down (can be created via API only)

• Documentation Make sure to cover the fact that this is premium only and implications of migration between the two.
• Other depts. Inform Sales and CX and the requesting customer.
• Premium The two new roles is a premium-only feature. Make sure to update the pricing page after this is launched.

Design

UI Mocks

(https://www.figma.com/file/hdALBDsrti77QuDNSzLdkx/%F0%9F%9A%A7-Fleet-EE-(dev-ready%2C-scratchpad)?node-id=12784%3A332506&t=65B5O2ObCow2L7Vy-0)

OBSERVER+ UI (Stuffz to QA)

• No changes to Fleet Free

Create and edit a user

• Can create a Global observer+ user on premium only
• Can create a Team observer+ user
• Can edit a user to become a Global observer+ user or Team observer+ user

User Management table

• Observer+ role has an underline with a tooltip explaining what Observer+ is

Queries table

• Observer+ can see create new query button while Observer still cannot

Host details page > Query host

• Observer+ can run any query on host (the modal has all queries listed) while observer only sees queries that are marked observer can run
• Observer+ can click "Create new query" button while observer cannot see the button

New query/ edit query page (not shown in mocks)

• Observer still gets a 403 when going to queries/new while Observer+ can view page when going to queries/new
• Observer+ has option to run but not save query
• Observer+ can edit sql (even if not saving) while observer still cannot
• Observer+ sql is always shown vs observer still has the show/hide sql toggle
• Observer+ can see schema right side panel while observer still cannot
• Live query successfully runs for Observer+

API

TODO

CLI

[TODO

](https://www.figma.com/file/hdALBDsrti77QuDNSzLdkx/%F0%9F%9A%A7-Fleet-EE-(dev-ready%2C-scratchpad)?node-id=12784%3A332506&t=65B5O2ObCow2L7Vy-0)

Related

Child issues

Interface team

• TODO

Platform team

• TODO

Agent team

• TODO

Documentation

• TODO

[zhumo]

Proposed permissions: https://docs.google.com/spreadsheets/d/1wNcvH0O4M1PwVZI0gEcxTrh-Qd0OCBDwman39A3bjCA/edit?usp=sharing