feat: implementing dataPortal roles to bypass granular permissions

[trigal2012]

Pull Request type

Please check the type of change your PR introduces:

• Bugfix
• Feature
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build-related changes
• Documentation content changes
• Other (please describe):

What is the current behavior?

Issue Number: N/A

What is the new behavior?

Implemented Cascading Hierarchy for Data Portal Access
Added markdown to document current and future intentions of the Roles

root
dataPortalAdmin
dataPortalManager
dataPortalBasic

3. Permission Matrix

Capability	Basic	Manager	Admin	Root
Edit All Org/Location Data	✅	✅	✅	✅
View User List	❌	✅	✅	✅
Assign Basic/Manager Roles	❌	✅	✅	✅
Assign Admin Roles	❌	❌	✅	✅
Assign Root Roles	❌	❌	❌	✅

---

Does this introduce a breaking change?

• Yes
• No

no breaking changes but volunteer permissions should be updated manually once this is deployed

Other information

these accounts can be used for testing on the preview url

User ID	Username	Email	Permission ID	Role	Password
user_01KGKJ4W7S3RCY4A01092FSBQX	rootTest	diana+preview-root@inreach.org	perm_01GW2HKXRTRWKY87HNTTFZCBH1	root
user_01KGKJYTXV9FY4CKES7N76YZT0	adminTest	diana+preview-admin@inreach.org	perm_01H0QX1XC0335R04JMGMQ3KXVN	dataPortalAdmin
user_01KGKK0M53H7AB5027D3X62G4V	managerTest	diana+preview-manager@inreach.org	perm_01H0QX1XC04Z9G8H44G464YHQQ	dataPortalManager
user_01KGKK20EG14BMYN186NK2FV4V	basicTest	diana+preview-basic@inreach.org	perm_01H0QX1XC037A47900JPAX6JBP	dataPortalBasic

[alwaysmeticulous]

🤖 No test run has been triggered as your Meticulous project has been deactivated (since you haven't viewed any test results in a while). Click here to reactivate.

_{Last updated for commit d014ad3. This comment will update as new commits are pushed.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
inreach-app	Ready	Preview, Comment	Feb 5, 2026 10:55pm

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (11)

• apps/app/src/pages/admin/index.tsx is excluded by none and included by none
• apps/app/src/pages/org/[slug]/[orgLocationId]/edit.tsx is excluded by none and included by none
• apps/app/src/pages/org/[slug]/edit.tsx is excluded by none and included by none
• docs/AccessControl/1-AccessControlOverview.md is excluded by none and included by none
• packages/api/lib/middleware/permissions.ts is excluded by none and included by none
• packages/api/lib/permissions.ts is excluded by none and included by none
• packages/api/router/user/mutation.toggleDataPortalAccess.handler.ts is excluded by none and included by none
• packages/api/router/user/query.forUserTable.handler.ts is excluded by none and included by none
• packages/ui/components/data-portal/CsvDownload.tsx is excluded by none and included by none
• packages/ui/components/data-portal/DownloadTable.tsx is excluded by none and included by none
• packages/ui/components/data-portal/UserTable.tsx is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📦 Next.js Bundle Analysis for @weareinreach/app

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[relativeci]

#3000 Bundle Size — 5.56MiB (~+0.01%).

d014ad3(current) vs 6cbc5d9 dev#2999(baseline)

Warning

Bundle contains 5 duplicate packages – View duplicate packages

Bundle metrics   1 change 1 regression

	Current #3000	Baseline #2999
Initial JS	3.05MiB(+0.01%)	3.05MiB
Initial CSS	9.7KiB	9.7KiB
Cache Invalidation	30.52%	30.52%
Chunks	61	61
Assets	74	74
Modules	1913	1913
Duplicate Modules	227	227
Duplicate Code	7.45%	7.45%
Packages	158	158
Duplicate Packages	5	5

Bundle size by type   1 change 1 regression

	Current #3000	Baseline #2999
JS	4.33MiB (+0.01%)	4.33MiB
Other	1.12MiB	1.12MiB
Fonts	95.78KiB	95.78KiB
CSS	9.7KiB	9.7KiB
IMG	8.57KiB	8.57KiB

Bundle analysis report Branch permissions Project dashboard

---

^{Generated by RelativeCI Documentation Report issue}