[Feature Request] Restrict schedule and on-call rotation modifications to administrators

[VILJkid]

What problem would you like to solve? Please describe:
In GoAlert, when integrating external Identity Providers (IdPs) like Keycloak via OIDC, organizations often want to onboard all users so they can view on-call calendars and receive notifications. However, by default, GoAlert grants all authenticated users (role = 'user') permission to create, edit, and delete schedules, on-call rotations, shift rules, and participant lists.

This creates a significant operational risk in compliance-driven environments where regular users can accidentally (or maliciously) alter on-call rotations, shift orders, or remove themselves from critical schedules without oversight. Furthermore, GoAlert currently lacks a built-in RBAC or configuration setting to restrict schedule and rotation modifications exclusively to administrators.

Describe the solution you'd like:

1. Backend Authorization: Introduce strict authorization checks at both the store and GraphQL API layers (permission.Admin) so that only users with the admin role can create, update, or delete schedules, schedule rules, and on-call rotations.
2. Shift Overrides & Coverage: Preserve regular user capabilities for managing temporary schedule overrides and shift coverage (trading or covering shifts), allowing engineers to handle day-to-day shift swaps without needing admin intervention for routine coverage.
3. Frontend UI Integration: Conditionally hide administrative controls (such as the "Add User" button, drag/reorder handles, three-dot action menus for setting active users or removing participants, and schedule/rotation edit/delete header buttons) when viewed by non-admin users (role = 'user').

Describe alternatives you've considered:

• Maintaining a custom downstream fork of GoAlert with hardcoded permission checks.
• Relying entirely on user self-discipline or auditing change logs, which does not prevent accidental mistakes or unauthorized edits.

Additional context:

• Particularly relevant for organizations leveraging OIDC/Keycloak SSO where user provisioning happens automatically upon first login.
• Aligns GoAlert with standard enterprise security models where rotation and schedule definitions are restricted to designated on-call leads or administrators.

We can offer a solution by introducing a patch PR which will handle this problem.
Sponsored by Obmondo