[wip] maySetTimeout: introduce ogranizationId as argument

components/dashboard/src/data/current-user/may-set-timeout-query.ts

@@ -7,21 +7,26 @@
 import { useQuery } from "@tanstack/react-query";
 import { getGitpodService } from "../../service/service";
 import { useCurrentUser } from "../../user-context";
+import { useCurrentOrg } from "../organizations/orgs-query";
 
-export const useUserMaySetTimeout = () => {
+export const useMaySetTimeout = () => {
     const user = useCurrentUser();
+    const org = useCurrentOrg();
 
     return useQuery<boolean>({
-        queryKey: getUserMaySetTimeoutQueryKey(user?.id ?? ""),
+        queryKey: getMaySetTimeoutQueryKey(user?.id ?? "", org.data?.id ?? ""),
         queryFn: async () => {
             if (!user) {
                 throw new Error("No current user");
             }
+            if (!org.data) {
+                throw new Error("No current org");
+            }
 
-            return !!(await getGitpodService().server.maySetTimeout());
+            return !!(await getGitpodService().server.maySetTimeout({ organizationId: org.data.id }));
         },
-        enabled: !!user,
+        enabled: !!user && !!org.data,
     });
 };
 
-export const getUserMaySetTimeoutQueryKey = (userId: string) => ["may-set-timeout", { userId }];
+export const getMaySetTimeoutQueryKey = (userId: string, orgId: string) => ["may-set-timeout", { userId }, { orgId }];

components/dashboard/src/user-settings/Preferences.tsx

@@ -12,7 +12,7 @@ import { ThemeSelector } from "../components/ThemeSelector";
 import Alert from "../components/Alert";
 import { Link } from "react-router-dom";
 import { Heading2, Heading3, Subheading } from "../components/typography/headings";
-import { useUserMaySetTimeout } from "../data/current-user/may-set-timeout-query";
+import { useMaySetTimeout } from "../data/current-user/may-set-timeout-query";
 import { Button } from "../components/Button";
 import SelectIDE from "./SelectIDE";
 import { InputField } from "../components/forms/InputField";
@@ -26,7 +26,7 @@ export type IDEChangedTrackLocation = "workspace_list" | "workspace_start" | "pr
 export default function Preferences() {
     const { toast } = useToast();
     const { user, setUser } = useContext(UserContext);
-    const maySetTimeout = useUserMaySetTimeout();
+    const maySetTimeout = useMaySetTimeout();
     const updateDotfileRepo = useUpdateCurrentUserDotfileRepoMutation();
 
     const [dotfileRepo, setDotfileRepo] = useState<string>(user?.additionalData?.dotfileRepo || "");
@@ -57,7 +57,9 @@ export default function Preferences() {
                 const updatedUser = await getGitpodService().server.getLoggedInUser();
                 setUser(updatedUser);
 
-                toast("Your default workspace timeout was updated.");
+                toast(
+                    "Your default workspace timeout was updated. Note that this will only affect workspaces in paid organizations.",
+                );
             } catch (e) {
                 // TODO: Convert this to an error style toast
                 alert("Cannot set custom workspace timeout: " + e.message);

components/gitpod-protocol/src/gitpod-service.ts

@@ -259,7 +259,7 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     reportErrorBoundary(url: string, message: string): Promise<void>;
 
     getSupportedWorkspaceClasses(): Promise<SupportedWorkspaceClass[]>;
-    maySetTimeout(): Promise<boolean>;
+    maySetTimeout(opts?: { organizationId?: string }): Promise<boolean>;
     updateWorkspaceTimeoutSetting(setting: Partial<WorkspaceTimeoutSetting>): Promise<void>;
 
     /**

components/server/src/billing/entitlement-service-ubp.ts

@@ -121,7 +121,7 @@ export class EntitlementServiceUBP implements EntitlementService {
             }
         }
 
-        // TODO(gpl) Remove everything below once organizations are fully rolled out
+        // TODO(gpl) Remove everything below once organizationId is always passed
         // This is the old behavior, stemming from our transition to PAYF, where our API did-/doesn't pass organizationId, yet
         // Member of paid team?
         const teams = await this.teamDB.findTeamsByUser(userId);

components/server/src/user/user-service.ts

@@ -23,7 +23,6 @@ import { CreateUserParams } from "./user-authentication";
 import { IAnalyticsWriter } from "@gitpod/gitpod-protocol/lib/analytics";
 import { TransactionalContext } from "@gitpod/gitpod-db/lib/typeorm/transactional-db-impl";
 import { RelationshipUpdater } from "../authorization/relationship-updater";
-import { EntitlementService } from "../billing/entitlement-service";
 
 @injectable()
 export class UserService {
@@ -33,7 +32,6 @@ export class UserService {
         @inject(Authorizer) private readonly authorizer: Authorizer,
         @inject(IAnalyticsWriter) private readonly analytics: IAnalyticsWriter,
         @inject(RelationshipUpdater) private readonly relationshipUpdater: RelationshipUpdater,
-        @inject(EntitlementService) private readonly entitlementService: EntitlementService,
     ) {}
 
     public async createUser(
@@ -144,13 +142,6 @@ export class UserService {
             }
         }
 
-        if (!(await this.entitlementService.maySetTimeout(targetUserId))) {
-            throw new ApplicationError(
-                ErrorCodes.PERMISSION_DENIED,
-                "Configure workspace timeout only available for paid user.",
-            );
-        }
-
         const user = await this.findUserById(userId, targetUserId);
         AdditionalUserData.set(user, setting);
         await this.userDb.updateUserPartial(user);

components/server/src/workspace/gitpod-server-impl.ts

@@ -650,12 +650,16 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable {
         return updatedUser;
     }
 
-    public async maySetTimeout(ctx: TraceContext): Promise<boolean> {
-        const user = await this.checkUser("maySetTimeout");
+    public async maySetTimeout(ctx: TraceContext, opts?: { organizationId?: string }): Promise<boolean> {
+        const user = await this.checkUser("maySetTimeout", opts);
         await this.guardAccess({ kind: "user", subject: user }, "get");
+        // TODO(gpl) Remove once organizationId is mandatory
         await this.auth.checkPermissionOnUser(user.id, "read_info", user.id);
+        if (opts?.organizationId) {
+            await this.auth.checkPermissionOnOrganization(user.id, "read_info", opts.organizationId);
+        }
 
-        return await this.entitlementService.maySetTimeout(user.id);
+        return await this.entitlementService.maySetTimeout(user.id, opts?.organizationId);
     }
 
     public async updateWorkspaceTimeoutSetting(