feat: allow ad-hoc creation of new teams (#3964)

Co-authored-by: Tom Moor <tom@getoutline.com>

server/policies/team.test.ts

@@ -1,3 +1,4 @@
+import env from "@server/env";
 import { buildUser, buildTeam, buildAdmin } from "@server/test/factories";
 import { setupTestDatabase } from "@server/test/support";
 import { serialize } from "./index";
@@ -12,6 +13,7 @@ it("should allow reading only", async () => {
   const abilities = serialize(user, team);
   expect(abilities.read).toEqual(true);
   expect(abilities.manage).toEqual(false);
+  expect(abilities.createTeam).toEqual(false);
   expect(abilities.createAttachment).toEqual(true);
   expect(abilities.createCollection).toEqual(true);
   expect(abilities.createDocument).toEqual(true);
@@ -27,6 +29,25 @@ it("should allow admins to manage", async () => {
   const abilities = serialize(admin, team);
   expect(abilities.read).toEqual(true);
   expect(abilities.manage).toEqual(true);
+  expect(abilities.createTeam).toEqual(false);
+  expect(abilities.createAttachment).toEqual(true);
+  expect(abilities.createCollection).toEqual(true);
+  expect(abilities.createDocument).toEqual(true);
+  expect(abilities.createGroup).toEqual(true);
+  expect(abilities.createIntegration).toEqual(true);
+});
+
+it("should allow creation on hosted envs", async () => {
+  env.DEPLOYMENT = "hosted";
+
+  const team = await buildTeam();
+  const admin = await buildAdmin({
+    teamId: team.id,
+  });
+  const abilities = serialize(admin, team);
+  expect(abilities.read).toEqual(true);
+  expect(abilities.manage).toEqual(true);
+  expect(abilities.createTeam).toEqual(true);
   expect(abilities.createAttachment).toEqual(true);
   expect(abilities.createCollection).toEqual(true);
   expect(abilities.createDocument).toEqual(true);

server/policies/team.ts

@@ -1,3 +1,4 @@
+import env from "@server/env";
 import { Team, User } from "@server/models";
 import { allow } from "./cancan";
 
@@ -10,6 +11,12 @@ allow(User, "share", Team, (user, team) => {
   return team.sharing;
 });
 
+allow(User, "createTeam", Team, () => {
+  if (env.DEPLOYMENT !== "hosted") {
+    throw "createTeam only available on cloud";
+  }
+});
+
 allow(User, ["update", "manage"], Team, (user, team) => {
   if (!team || user.isViewer || user.teamId !== team.id) {
     return false;