feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics (calcom#25765)

* feat: add enabled column to UserFeatures and TeamFeatures for tri-state semantics

- Add enabled Boolean column to UserFeatures model with default true
- Add enabled Boolean column to TeamFeatures model with default true
- Update FeaturesRepository to use tri-state semantics:
  - enabled=true: feature is explicitly enabled
  - enabled=false: feature is explicitly disabled (blocks inheritance)
  - No row: inherit from team/org level
- Update SQL queries to check enabled=true for feature access
- Add enableFeatureForTeam method to interface and implementation

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* update comments

* add integration tests

* add more test

* select enabled only

* no @default(true)

* fix types and tests

* add missing enabled

* add missing enabled

* rename enableFeatureForTeam to updateFeatureForTeam and support FeatureState

* refactor: rename updateFeatureForTeam to setTeamFeatureState

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* fix integration test

* fix tests

* add more tests

* add missing enabled

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: eunjae-lee

apps/api/v2/src/modules/organizations/roles/organizations-roles.controller.e2e-spec.ts

@@ -112,7 +112,7 @@ describe("Organizations Roles Endpoints", () => {
     });
 
     await featuresRepositoryFixture.create({ slug: "pbac", enabled: true });
-    await featuresRepositoryFixture.enableFeatureForTeam(pbacEnabledOrganization.id, "pbac");
+    await featuresRepositoryFixture.setTeamFeatureState(pbacEnabledOrganization.id, "pbac", "enabled");
 
     // Create memberships
     await membershipRepositoryFixture.create({

apps/api/v2/src/modules/organizations/roles/permissions/organizations-roles-permissions.controller.e2e-spec.ts

@@ -58,7 +58,7 @@ describe("Organizations Roles Permissions Endpoints", () => {
     });
 
     await featuresRepositoryFixture.create({ slug: "pbac", enabled: true });
-    await featuresRepositoryFixture.enableFeatureForTeam(pbacEnabledOrganization.id, "pbac");
+    await featuresRepositoryFixture.setTeamFeatureState(pbacEnabledOrganization.id, "pbac", "enabled");
 
     // Create user + membership in org
     pbacOrgUserWithRolePermission = await userRepositoryFixture.create({

apps/api/v2/src/modules/organizations/teams/roles/organizations-teams-roles.controller.e2e-spec.ts

@@ -126,7 +126,7 @@ describe("Organizations Roles Endpoints", () => {
     });
 
     await featuresRepositoryFixture.create({ slug: "pbac", enabled: true });
-    await featuresRepositoryFixture.enableFeatureForTeam(pbacEnabledTeam.id, "pbac");
+    await featuresRepositoryFixture.setTeamFeatureState(pbacEnabledTeam.id, "pbac", "enabled");
 
     // Create memberships
     await membershipRepositoryFixture.create({

apps/api/v2/src/modules/organizations/teams/roles/permissions/organizations-teams-roles-permissions.controller.e2e-spec.ts

@@ -67,7 +67,7 @@ describe("Organizations Teams Roles Permissions Endpoints", () => {
     });
 
     await featuresRepositoryFixture.create({ slug: "pbac", enabled: true });
-    await featuresRepositoryFixture.enableFeatureForTeam(pbacEnabledTeam.id, "pbac");
+    await featuresRepositoryFixture.setTeamFeatureState(pbacEnabledTeam.id, "pbac", "enabled");
 
     // Create user + membership in org
     pbacOrgUserWithRolePermission = await userRepositoryFixture.create({

apps/api/v2/test/fixtures/repository/features.repository.fixture.ts

@@ -28,21 +28,38 @@ export class FeaturesRepositoryFixture {
     });
   }
 
-  async enableFeatureForTeam(teamId: number, featureId: string, assignedBy = "test") {
-    await this.prismaWriteClient.teamFeatures.upsert({
-      where: {
-        teamId_featureId: {
+  async setTeamFeatureState(
+    teamId: number,
+    featureId: string,
+    state: "enabled" | "disabled" | "inherit",
+    assignedBy = "test"
+  ) {
+    if (state === "enabled" || state === "disabled") {
+      await this.prismaWriteClient.teamFeatures.upsert({
+        where: {
+          teamId_featureId: {
+            teamId,
+            featureId,
+          },
+        },
+        create: {
           teamId,
           featureId,
+          assignedBy,
+          enabled: state === "enabled",
         },
-      },
-      create: {
-        teamId,
-        featureId,
-        assignedBy,
-      },
-      update: {},
-    });
+        update: {
+          enabled: state === "enabled",
+        },
+      });
+    } else if (state === "inherit") {
+      await this.prismaWriteClient.teamFeatures.deleteMany({
+        where: {
+          teamId,
+          featureId,
+        },
+      });
+    }
   }
 
   async disableFeatureForTeam(teamId: number, featureSlug: string) {

apps/web/app/(use-page-wrapper)/settings/(settings-layout)/layout.tsx

@@ -20,7 +20,7 @@ import SettingsLayoutAppDirClient from "./SettingsLayoutAppDirClient";
 const getTeamFeatures = unstable_cache(
   async (teamId: number) => {
     const featuresRepository = new FeaturesRepository(prisma);
-    return await featuresRepository.getTeamFeatures(teamId);
+    return await featuresRepository.getEnabledTeamFeatures(teamId);
   },
   ["team-features"],
   {

apps/web/playwright/lib/test-helpers/pbac.ts

@@ -24,6 +24,7 @@ export const enablePBACForTeam = async (teamId: number) => {
       teamId: teamId,
       assignedBy: "e2e",
       assignedAt: new Date(),
+      enabled: true,
     },
   });
 };

packages/features/ee/teams/repositories/TeamRepository.ts

@@ -556,7 +556,7 @@ export class TeamRepository {
       FROM "Membership" m
       INNER JOIN "User" u ON m."userId" = u.id
       LEFT JOIN "Role" r ON m."customRoleId" = r.id
-      LEFT JOIN "TeamFeatures" f ON m."teamId" = f."teamId" AND f."featureId" = 'pbac'
+      LEFT JOIN "TeamFeatures" f ON m."teamId" = f."teamId" AND f."featureId" = 'pbac' AND f.enabled = true
       WHERE m."teamId" = ${teamId}
         AND m."accepted" = true
         AND (

packages/features/flags/config.ts

@@ -37,3 +37,5 @@ export type AppFlags = {
 };
 
 export type TeamFeatures = Record<keyof AppFlags, boolean>;
+
+export type FeatureState = "enabled" | "disabled" | "inherit";