refactor(access): collapse connection access levels to a single tier

Assigning a connection now implies full content access. The old two-tier split
(CHAT_EDITOR vs FULL_CONTENT) was a distinction users had to reason about for
little benefit, and it silently hid the Dashboards section from anyone on the
lower tier.

CHAT_EDITOR is kept @deprecated purely so existing rows parse: fromString folds
it — and a blank value — into FULL_CONTENT, and resolveAccess returns
FULL_CONTENT for every grant. Legacy rows upgrade themselves on read, so no
migration is required (verified: an untouched CHAT_EDITOR row now resolves with
canManageContent=true). No grant still means NONE.

The "Full Access" / "Chat + Editor" badges and the two-option selector are gone;
assigning is one action, and only Owner/Admin badges remain since they mean
something different.

Note this widens access for anyone previously on the lower tier: they gain write
access to that connection's Brain notes, schema docs, knowledge and dashboards.

ConnectionAccessLevelCollapseTest covers the real resolution path.
AccessControlServiceTest cannot: it stubs resolveAccess to return a fixed value,
so its CHAT_EDITOR case passed identically before and after this change — a mock
cannot catch a change to the thing it replaces. That test is annotated to say so
rather than deleted, since it still guards the enum's own semantics.

Author: notSumit25

backend/src/main/java/com/dbaagent/model/ConnectionAccessLevel.java

@@ -1,16 +1,32 @@
 package com.dbaagent.model;
 
+/**
+ * The access level stored on a {@link ConnectionAccessGrant}.
+ *
+ * <p>There is now only one level: {@link #FULL_CONTENT}. Assigning a connection to a user
+ * grants full content access to it — the old two-tier split (chat/editor only vs. full)
+ * was a distinction users had to reason about for little benefit, and it silently hid the
+ * Dashboards section from anyone on the lower tier.
+ *
+ * <p>{@code CHAT_EDITOR} is retained purely so existing rows written before this change
+ * still parse; {@link #fromString} folds it into FULL_CONTENT rather than failing, and
+ * nothing writes it any more. Do not reintroduce it as a distinct level without also
+ * restoring the UI that explains it.
+ */
 public enum ConnectionAccessLevel {
+    /** @deprecated legacy value; resolves to {@link #FULL_CONTENT}. Retained for old rows. */
+    @Deprecated
     CHAT_EDITOR,
     FULL_CONTENT;
 
     public static ConnectionAccessLevel fromString(String value) {
         if (value == null || value.isBlank()) {
-            throw new IllegalArgumentException("Access level is required");
+            // Assignment now implies full access, so an omitted level is not an error.
+            return FULL_CONTENT;
         }
         return switch (value.trim().toUpperCase()) {
-            case "CHAT_EDITOR" -> CHAT_EDITOR;
-            case "FULL_CONTENT", "FULL_ACCESS" -> FULL_CONTENT;
+            // Legacy values all collapse to the single remaining level.
+            case "CHAT_EDITOR", "FULL_CONTENT", "FULL_ACCESS" -> FULL_CONTENT;
             default -> throw new IllegalArgumentException("Unsupported access level: " + value);
         };
     }

backend/src/main/java/com/dbaagent/service/security/ConnectionAccessService.java

@@ -59,12 +59,14 @@ public ResolvedConnectionAccess resolveAccess(DatabaseConnection connection, Str
         }
 
         return grantRepository.findByConnectionIdAndUsernameIgnoreCase(connection.getId(), username)
+            // A grant is a grant: assignment implies full content access. Legacy
+            // CHAT_EDITOR rows resolve here too rather than to a lesser tier, so an
+            // existing user gains Dashboards/Brain write access instead of silently
+            // keeping a level the UI no longer explains.
             .map(grant -> buildResolved(
                 connection,
                 ConnectionOwnershipType.ASSIGNED,
-                grant.getAccessLevel() == ConnectionAccessLevel.FULL_CONTENT
-                    ? EffectiveConnectionAccess.FULL_CONTENT
-                    : EffectiveConnectionAccess.CHAT_EDITOR
+                EffectiveConnectionAccess.FULL_CONTENT
             ))
             .orElseGet(() -> buildResolved(connection, null, EffectiveConnectionAccess.NONE));
     }

backend/src/test/java/com/dbaagent/service/security/AccessControlServiceTest.java

@@ -270,6 +270,16 @@ void feedbackAccessUsesUnderlyingConnectionOwnership() {
         assertDoesNotThrow(() -> accessControlService.assertCanAccessFeedback("fb-1"));
     }
 
+    /**
+     * Guards the CHAT_EDITOR branch of {@link EffectiveConnectionAccess} itself.
+     *
+     * <p>Note this state is no longer reachable from a real grant: connection access
+     * levels collapsed to a single tier, so {@code ConnectionAccessService.resolveAccess}
+     * returns FULL_CONTENT for every grant (see
+     * {@code ConnectionAccessLevelCollapseTest}). This test stubs the resolver directly,
+     * so it exercises the enum's semantics, not the resolution path — keep it for the
+     * former, do not read it as evidence about the latter.
+     */
     @Test
     void assignedChatEditorUserCanUseChatEditor() {
         SecurityContextHolder.getContext().setAuthentication(

backend/src/test/java/com/dbaagent/service/security/ConnectionAccessLevelCollapseTest.java

@@ -0,0 +1,131 @@
+package com.dbaagent.service.security;
+
+import com.dbaagent.model.*;
+import com.dbaagent.repository.ConnectionAccessGrantRepository;
+import com.dbaagent.repository.CredentialRepository;
+import com.dbaagent.repository.UserRepository;
+import com.dbaagent.service.ConnectionChatAccessPolicyService;
+import com.dbaagent.service.SecurityEventService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Optional;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+/**
+ * The connection access tiers collapsed into a single level: any grant means full
+ * content access.
+ *
+ * <p>These exercise the <em>real</em> {@link ConnectionAccessService#resolveAccess}
+ * path. {@code AccessControlServiceTest} cannot cover this: it stubs
+ * {@code resolveAccess} to hand back a fixed {@link EffectiveConnectionAccess}, so it
+ * keeps passing no matter what the resolution logic does — it still contains a
+ * CHAT_EDITOR case that passes vacuously. A mock cannot catch a change to the thing it
+ * replaces.
+ */
+class ConnectionAccessLevelCollapseTest {
+
+    private static final String CONN = "conn-1";
+
+    private CredentialRepository credentialRepository;
+    private ConnectionAccessGrantRepository grantRepository;
+    private UserRepository userRepository;
+    private ConnectionAccessService service;
+
+    @BeforeEach
+    void setUp() {
+        credentialRepository = mock(CredentialRepository.class);
+        grantRepository = mock(ConnectionAccessGrantRepository.class);
+        userRepository = mock(UserRepository.class);
+
+        service = new ConnectionAccessService(
+            credentialRepository,
+            grantRepository,
+            userRepository,
+            mock(SecurityEventService.class),
+            mock(ConnectionChatAccessPolicyService.class)
+        );
+
+        // The connection must be admin-owned to be assignable at all.
+        User owner = new User();
+        owner.setUsername("admin");
+        owner.setRole("ADMIN");
+        when(userRepository.findByUsername("admin")).thenReturn(Optional.of(owner));
+    }
+
+    private DatabaseConnection connection() {
+        DatabaseConnection c = new DatabaseConnection();
+        c.setId(CONN);
+        c.setOwnerUsername("admin");
+        return c;
+    }
+
+    private void grantWith(ConnectionAccessLevel level) {
+        ConnectionAccessGrant grant = new ConnectionAccessGrant();
+        grant.setConnectionId(CONN);
+        grant.setUsername("dave");
+        grant.setAccessLevel(level);
+        when(grantRepository.findByConnectionIdAndUsernameIgnoreCase(CONN, "dave"))
+            .thenReturn(Optional.of(grant));
+    }
+
+    @Test
+    @DisplayName("A legacy CHAT_EDITOR grant row now resolves to FULL_CONTENT")
+    void legacyChatEditorRowIsUpgraded() {
+        // Installs predating the collapse still have CHAT_EDITOR rows on disk. They must
+        // resolve to full access rather than a tier the UI no longer explains — this is
+        // what makes the change work with no DB migration.
+        grantWith(ConnectionAccessLevel.CHAT_EDITOR);
+
+        var access = service.resolveAccess(connection(), "dave", false).getEffectiveAccess();
+
+        assertThat(access).isEqualTo(EffectiveConnectionAccess.FULL_CONTENT);
+        assertThat(access.canManageContent()).isTrue();
+        assertThat(access.canReadContent()).isTrue();
+    }
+
+    @Test
+    @DisplayName("A FULL_CONTENT grant still resolves to FULL_CONTENT")
+    void fullContentUnchanged() {
+        grantWith(ConnectionAccessLevel.FULL_CONTENT);
+
+        assertThat(service.resolveAccess(connection(), "dave", false).getEffectiveAccess())
+            .isEqualTo(EffectiveConnectionAccess.FULL_CONTENT);
+    }
+
+    @Test
+    @DisplayName("No grant still means NONE — the collapse must not hand access to strangers")
+    void noGrantStillDenied() {
+        when(grantRepository.findByConnectionIdAndUsernameIgnoreCase(CONN, "dave"))
+            .thenReturn(Optional.empty());
+
+        var access = service.resolveAccess(connection(), "dave", false).getEffectiveAccess();
+
+        assertThat(access).isEqualTo(EffectiveConnectionAccess.NONE);
+        assertThat(access.canUseConnection()).isFalse();
+        assertThat(access.canManageContent()).isFalse();
+    }
+
+    @Test
+    @DisplayName("The owner is still OWNER, not merely FULL_CONTENT")
+    void ownerUnchanged() {
+        assertThat(service.resolveAccess(connection(), "admin", false).getEffectiveAccess())
+            .isEqualTo(EffectiveConnectionAccess.OWNER);
+    }
+
+    @Test
+    @DisplayName("Every stored access-level string parses to FULL_CONTENT")
+    void fromStringCollapses() {
+        assertThat(ConnectionAccessLevel.fromString("CHAT_EDITOR")).isEqualTo(ConnectionAccessLevel.FULL_CONTENT);
+        assertThat(ConnectionAccessLevel.fromString("FULL_CONTENT")).isEqualTo(ConnectionAccessLevel.FULL_CONTENT);
+        assertThat(ConnectionAccessLevel.fromString("FULL_ACCESS")).isEqualTo(ConnectionAccessLevel.FULL_CONTENT);
+        // Blank is no longer an error: assignment implies full access.
+        assertThat(ConnectionAccessLevel.fromString(null)).isEqualTo(ConnectionAccessLevel.FULL_CONTENT);
+        assertThat(ConnectionAccessLevel.fromString("  ")).isEqualTo(ConnectionAccessLevel.FULL_CONTENT);
+    }
+}

src/components/tabs/admin/UsersTab.jsx

@@ -22,9 +22,13 @@ import {
 } from 'lucide-react'
 import { adminAPI } from '@/lib/api/client'
 import { useAuth, ROLES } from '@/hooks/useAuth'
+import { PERMISSIONS, roleLabel } from '@/lib/permissions'
+import RoleManager from './RoleManager'
 
 const ROLE_BADGE_CLASSES = {
   [ROLES.ADMIN]: 'bg-red-100 text-red-700 border-red-200',
+  [ROLES.DBA]: 'bg-purple-100 text-purple-700 border-purple-200',
+  [ROLES.DATA_ENGINEER]: 'bg-teal-100 text-teal-700 border-teal-200',
   [ROLES.DEVELOPER]: 'bg-blue-100 text-blue-700 border-blue-200',
 }
 
@@ -35,18 +39,28 @@ const STATUS_BADGE_CLASSES = {
   DISABLED: 'bg-gray-100 text-gray-700 border-gray-200',
 }
 
-const ACCESS_MATRIX = [
-  { area: 'Chat', developer: 'Own + Assigned', admin: 'Full' },
-  { area: 'Editor', developer: 'Own + Assigned', admin: 'Full' },
-  { area: 'Brain', developer: 'Own + Full Access', admin: 'Full' },
-  { area: 'Schema Docs', developer: 'Own + Full Access', admin: 'Full' },
-  { area: 'Company Knowledge', developer: 'Own + Full Access', admin: 'Full' },
-  { area: 'Performance', developer: '—', admin: 'Full' },
+/**
+ * The sidebar sections, and the permission that opens each. Rendered as a live matrix
+ * against whatever roles the backend reports, so a new custom role appears here without
+ * a code change — the previous hardcoded two-column table silently went stale the moment
+ * a third role existed.
+ */
+const SECTION_MATRIX = [
+  { area: 'Agent', permission: PERMISSIONS.VIEW_AGENT },
+  { area: 'Dashboards', permission: PERMISSIONS.VIEW_DASHBOARDS },
+  { area: 'Digest', permission: PERMISSIONS.VIEW_DIGEST },
+  { area: 'Brain', permission: PERMISSIONS.VIEW_BRAIN },
+  { area: 'Performance', permission: PERMISSIONS.VIEW_PERFORMANCE },
+  { area: 'Editor', permission: PERMISSIONS.VIEW_EDITOR },
+  { area: 'Connection settings', permission: PERMISSIONS.MANAGE_CONNECTIONS },
+  { area: 'User management', permission: PERMISSIONS.MANAGE_USERS },
 ]
 
 const FALLBACK_ROLES = [
-  { name: ROLES.DEVELOPER, description: 'Access to Chat and the SQL Editor' },
-  { name: ROLES.ADMIN, description: 'Access to all product areas and administrative controls' },
+  { name: ROLES.ADMIN, description: 'Full access to all product areas and administrative controls' },
+  { name: ROLES.DBA, description: 'All product areas and connection settings, except user management' },
+  { name: ROLES.DATA_ENGINEER, description: 'Agent, Dashboards, and the SQL Editor' },
+  { name: ROLES.DEVELOPER, description: 'Agent, Digest, Dashboards, Performance, and the SQL Editor' },
 ]
 
 function badgeClassForRole(role) {
@@ -552,26 +566,48 @@ export default function UsersTab() {
             <div className="grid grid-cols-1 xl:grid-cols-[minmax(0,1fr)_420px] gap-6">
               <div>
                 <h3 className="text-sm font-medium text-gray-700 mb-4">Role Permissions</h3>
-                <div className="border border-gray-200 rounded-lg overflow-hidden">
+                <div className="border border-gray-200 rounded-lg overflow-x-auto">
                   <table className="w-full">
                     <thead className="bg-gray-50">
                       <tr>
                         <th className="px-4 py-2.5 text-left text-xs font-medium text-gray-500 uppercase">Area</th>
-                        <th className="px-4 py-2.5 text-center text-xs font-medium text-gray-500 uppercase">Developer</th>
-                        <th className="px-4 py-2.5 text-center text-xs font-medium text-gray-500 uppercase">Admin</th>
+                        {availableRoles.map((role) => (
+                          <th key={role.name} className="px-3 py-2.5 text-center text-xs font-medium text-gray-500 uppercase whitespace-nowrap">
+                            {role.displayName || roleLabel(role.name)}
+                          </th>
+                        ))}
                       </tr>
                     </thead>
                     <tbody className="divide-y divide-gray-200">
-                      {ACCESS_MATRIX.map((row) => (
+                      {SECTION_MATRIX.map((row) => (
                         <tr key={row.area}>
-                          <td className="px-4 py-2 text-sm text-gray-700 font-medium">{row.area}</td>
-                          <td className="px-4 py-2 text-center text-xs text-gray-600">{row.developer}</td>
-                          <td className="px-4 py-2 text-center text-xs text-green-600 font-medium">{row.admin}</td>
+                          <td className="px-4 py-2 text-sm text-gray-700 font-medium whitespace-nowrap">{row.area}</td>
+                          {availableRoles.map((role) => {
+                            const granted = (role.permissions || []).some(
+                              (p) => (typeof p === 'string' ? p : p?.name) === row.permission,
+                            )
+                            return (
+                              <td key={role.name} className="px-3 py-2 text-center">
+                                {granted ? (
+                                  <CheckCircle size={14} className="inline text-green-600" aria-label="Allowed" />
+                                ) : (
+                                  <span className="text-gray-300" aria-label="Not allowed">—</span>
+                                )}
+                              </td>
+                            )
+                          })}
                         </tr>
                       ))}
                     </tbody>
                   </table>
                 </div>
+                <p className="mt-2 text-xs text-gray-500">
+                  Built-in roles are fixed. Create a custom role below to define your own combination.
+                </p>
+
+                <div className="mt-6">
+                  <RoleManager roles={availableRoles} onChanged={loadData} />
+                </div>
               </div>
 
               <div className="border border-gray-200 rounded-lg p-4">
@@ -668,7 +704,7 @@ function RoleSelector({ user, roles, onRoleChange, loading, disabled }) {
     >
       {roles.map((role) => (
         <option key={role.name} value={role.name}>
-          {role.name}
+          {role.displayName || roleLabel(role.name)}
         </option>
       ))}
     </select>
@@ -921,7 +957,6 @@ function ChangePasswordModal({ user, loading, onClose, onSubmit }) {
 }
 
 function ConnectionAccessModal({ user, data, loading, onClose, onSave, onRevoke, onSavePolicy, onPreviewPolicy }) {
-  const [drafts, setDrafts] = useState({})
   const [policyDrafts, setPolicyDrafts] = useState({})
   const [policyPreviews, setPolicyPreviews] = useState({})
   const [previewLoading, setPreviewLoading] = useState({})
@@ -960,15 +995,14 @@ function ConnectionAccessModal({ user, data, loading, onClose, onSave, onRevoke,
             <div className="space-y-3">
               {assignableConnections.map((connection) => {
                 const assignment = assignmentsByConnection.get(connection.connectionId)
-                const draft = drafts[connection.connectionId] || assignment?.accessLevel || 'CHAT_EDITOR'
+                // Assignment implies full access now, so there is no level to choose.
+                const draft = 'FULL_CONTENT'
                 const policyDraft = policyDrafts[connection.connectionId]
                   ?? assignment?.chatAccessPolicy?.plainEnglishPolicy
                   ?? ''
                 const preview = policyPreviews[connection.connectionId] || assignment?.chatAccessPolicy
 
                 const isAssigned = Boolean(assignment)
-                const isFull = assignment?.accessLevel === 'FULL_CONTENT'
-                const isDirty = isAssigned && draft !== assignment.accessLevel
 
                 return (
                   <div
@@ -984,13 +1018,9 @@ function ConnectionAccessModal({ user, data, loading, onClose, onSave, onRevoke,
                         <div className="flex items-center gap-2 flex-wrap">
                           <span className="font-medium text-gray-900">{connection.connectionName}</span>
                           {isAssigned ? (
-                            <span className={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-semibold border ${
-                              isFull
-                                ? 'border-green-300 bg-green-100 text-green-800'
-                                : 'border-emerald-300 bg-emerald-100 text-emerald-800'
-                            }`}>
+                            <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-semibold border border-green-300 bg-green-100 text-green-800">
                               <CheckCircle size={12} />
-                              {isFull ? 'Full Access' : 'Chat + Editor'}
+                              Assigned
                             </span>
                           ) : (
                             <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-semibold border border-gray-300 bg-gray-100 text-gray-500">
@@ -1003,22 +1033,13 @@ function ConnectionAccessModal({ user, data, loading, onClose, onSave, onRevoke,
                       </div>
 
                       <div className="flex items-center gap-2 shrink-0">
-                        <select
-                          value={draft}
-                          onChange={(event) => setDrafts((prev) => ({ ...prev, [connection.connectionId]: event.target.value }))}
-                          className="px-3 py-2 border border-gray-300 rounded-md text-sm bg-white focus:outline-none focus:ring-2 focus:ring-gray-900 focus:border-transparent"
-                          disabled={loading}
-                        >
-                          <option value="CHAT_EDITOR">Chat + Editor</option>
-                          <option value="FULL_CONTENT">Full Access</option>
-                        </select>
                         <button
                           onClick={() => onSave(user.id, connection.connectionId, draft)}
-                          disabled={loading || (isAssigned && !isDirty)}
+                          disabled={loading || isAssigned}
                           className="inline-flex items-center gap-1.5 px-3 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 rounded-md transition-colors disabled:opacity-40 disabled:cursor-not-allowed"
                         >
                           <CheckCircle size={14} />
-                          {isAssigned ? (isDirty ? 'Update' : 'Saved') : 'Assign'}
+                          {isAssigned ? 'Assigned' : 'Assign'}
                         </button>
                         <button
                           onClick={() => onRevoke(user.id, connection.connectionId)}