feat: enforce user roles

enforces user admin role requirement for
- creating / deleting / setting role for organization users
- creating / deleting / setting role for project users
- updating project name
- deleting project

hides action elements based on role for
- admin console
- team settings if team is only visible through project membership
- add project tile if not team admin
- project name text editor if not team / project admin
- add redirect from team page if settings only visible through project
  membership
- add redirect from admin console if not org admin

role enforcement is handled on the api side through a custom GraphQL
directive `hasRole`. on the client side, role information is fetched in
the TopNavbar's `me` query and stored in the `UserContext`.

there is a custom hook, `useCurrentUser`, that provides a user object
with two functions, `isVisibile` & `isAdmin` which is used to check
roles in order to render/hide relevant UI elements.

internal/auth/auth.go

@@ -16,9 +16,17 @@ const (
 	InstallOnly                 = "install_only"
 )
 
+type Role string
+
+const (
+	RoleAdmin  Role = "admin"
+	RoleMember Role = "member"
+)
+
 type AccessTokenClaims struct {
 	UserID     string         `json:"userId"`
 	Restricted RestrictedMode `json:"restricted"`
+	OrgRole    Role           `json:"orgRole"`
 	jwt.StandardClaims
 }
 
@@ -39,11 +47,16 @@ func (r *ErrMalformedToken) Error() string {
 	return "token is malformed"
 }
 
-func NewAccessToken(userID string, restrictedMode RestrictedMode) (string, error) {
+func NewAccessToken(userID string, restrictedMode RestrictedMode, orgRole string) (string, error) {
+	role := RoleMember
+	if orgRole == "admin" {
+		role = RoleAdmin
+	}
 	accessExpirationTime := time.Now().Add(5 * time.Second)
 	accessClaims := &AccessTokenClaims{
 		UserID:         userID,
 		Restricted:     restrictedMode,
+		OrgRole:        role,
 		StandardClaims: jwt.StandardClaims{ExpiresAt: accessExpirationTime.Unix()},
 	}
 
@@ -60,6 +73,7 @@ func NewAccessTokenCustomExpiration(userID string, dur time.Duration) (string, e
 	accessClaims := &AccessTokenClaims{
 		UserID:         userID,
 		Restricted:     Unrestricted,
+		OrgRole:        RoleMember,
 		StandardClaims: jwt.StandardClaims{ExpiresAt: accessExpirationTime.Unix()},
 	}