feat: allow secret approvals with user groups

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -22,13 +22,29 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
       )
 
       .leftJoin(TableName.Users, `${TableName.SecretApprovalPolicyApprover}.approverUserId`, `${TableName.Users}.id`)
-
+      .leftJoin(
+        TableName.SecretApprovalPolicyGroupApprover,
+        `${TableName.SecretApprovalPolicy}.id`,
+        `${TableName.SecretApprovalPolicyGroupApprover}.policyId`
+      )
+      .leftJoin(
+        TableName.UserGroupMembership,
+        `${TableName.SecretApprovalPolicyGroupApprover}.approverGroupId`,
+        `${TableName.UserGroupMembership}.userId`
+      )
       .select(
         tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
         tx.ref("email").withSchema(TableName.Users).as("approverEmail"),
         tx.ref("firstName").withSchema(TableName.Users).as("approverFirstName"),
         tx.ref("lastName").withSchema(TableName.Users).as("approverLastName")
       )
+      .select(
+        tx.ref("approverGroupId").withSchema(TableName.SecretApprovalPolicyGroupApprover),
+        tx.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
+        tx.ref("email").withSchema(TableName.Users).as("approverGroupEmail"),
+        tx.ref("firstName").withSchema(TableName.Users).as("approverGroupFirstName"),
+        tx.ref("lastName").withSchema(TableName.Users).as("approverGroupLastName")
+      )
       .select(
         tx.ref("name").withSchema(TableName.Environment).as("envName"),
         tx.ref("slug").withSchema(TableName.Environment).as("envSlug"),
@@ -61,6 +77,16 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
               firstName: approverFirstName,
               lastName: approverLastName
             })
+          },
+          {
+            key: "approverGroupUserId",
+            label: "userApprovers" as const,
+            mapper: ({ approverGroupUserId, approverGroupEmail, approverGroupFirstName, approverGroupLastName }) => ({
+              userId: approverGroupUserId,
+              email: approverGroupEmail,
+              firstName: approverGroupFirstName,
+              lastName: approverGroupLastName
+            })
           }
         ]
       });
@@ -89,6 +115,13 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
             mapper: ({ approverUserId }) => ({
               userId: approverUserId
             })
+          },
+          {
+            key: "approverGroupId",
+            label: "groupApprovers" as const,
+            mapper: ({ approverGroupId }) => ({
+              groupId: approverGroupId
+            })
           }
         ]
       });

backend/src/ee/services/secret-approval-policy/secret-approval-policy-group-approver-dal.ts

@@ -0,0 +1,12 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TSecretApprovalPolicyGroupApproverDALFactory = ReturnType<
+  typeof secretApprovalPolicyGroupApproverDALFactory
+>;
+
+export const secretApprovalPolicyGroupApproverDALFactory = (db: TDbClient) => {
+  const sapGroupApproverOrm = ormify(db, TableName.SecretApprovalPolicyGroupApprover);
+  return sapGroupApproverOrm;
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -11,6 +11,7 @@ import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
 import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
+import { TSecretApprovalPolicyGroupApproverDALFactory } from "./secret-approval-policy-group-approver-dal";
 import {
   TCreateSapDTO,
   TDeleteSapDTO,
@@ -29,6 +30,7 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
+  secretApprovalPolicyGroupApproverDAL: TSecretApprovalPolicyGroupApproverDALFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
@@ -38,6 +40,7 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyDAL,
   permissionService,
   secretApprovalPolicyApproverDAL,
+  secretApprovalPolicyGroupApproverDAL,
   projectEnvDAL,
   licenseService
 }: TSecretApprovalPolicyServiceFactoryDep) => {
@@ -49,12 +52,16 @@ export const secretApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
+    groupApprovers,
     projectId,
     secretPath,
     environment,
     enforcementLevel
   }: TCreateSapDTO) => {
-    if (approvals > approvers.length)
+    if (!groupApprovers && !approvers)
+      throw new BadRequestError({ message: "Either of approvers or group approvers must be provided" });
+
+    if (!groupApprovers && approvals > approvers.length)
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -91,6 +98,7 @@ export const secretApprovalPolicyServiceFactory = ({
         },
         tx
       );
+
       await secretApprovalPolicyApproverDAL.insertMany(
         approvers.map((approverUserId) => ({
           approverUserId,
@@ -98,6 +106,14 @@ export const secretApprovalPolicyServiceFactory = ({
         })),
         tx
       );
+
+      await secretApprovalPolicyGroupApproverDAL.insertMany(
+        groupApprovers.map((approverGroupId) => ({
+          approverGroupId,
+          policyId: doc.id
+        })),
+        tx
+      );
       return doc;
     });
     return { ...secretApproval, environment: env, projectId };
@@ -105,6 +121,7 @@ export const secretApprovalPolicyServiceFactory = ({
 
   const updateSecretApprovalPolicy = async ({
     approvers,
+    groupApprovers,
     secretPath,
     name,
     actorId,
@@ -156,6 +173,16 @@ export const secretApprovalPolicyServiceFactory = ({
           tx
         );
       }
+      if (groupApprovers) {
+        await secretApprovalPolicyGroupApproverDAL.delete({ policyId: doc.id }, tx);
+        await secretApprovalPolicyGroupApproverDAL.insertMany(
+          groupApprovers.map((approverGroupId) => ({
+            approverGroupId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
       return doc;
     });
     return {

backend/src/ee/services/secret-approval-policy/secret-approval-policy-types.ts

@@ -5,6 +5,7 @@ export type TCreateSapDTO = {
   secretPath?: string | null;
   environment: string;
   approvers: string[];
+  groupApprovers: string[];
   projectId: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -14,7 +15,8 @@ export type TUpdateSapDTO = {
   secretPolicyId: string;
   approvals?: number;
   secretPath?: string | null;
-  approvers: string[];
+  approvers?: string[];
+  groupApprovers?: string[];
   name?: string;
   enforcementLevel?: EnforcementLevel;
 } & Omit<TProjectPermission, "projectId">;