feat: lint and finally completed

backend/src/@types/fastify.d.ts

@@ -50,6 +50,7 @@ import { TSshHostServiceFactory } from "@app/ee/services/ssh-host/ssh-host-servi
 import { TSshHostGroupServiceFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-service";
 import { TTrustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-types";
 import { TAuthMode } from "@app/server/plugins/auth/inject-identity";
+import { TAdditionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service";
 import { TApiKeyServiceFactory } from "@app/services/api-key/api-key-service";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { TAuthLoginFactory } from "@app/services/auth/auth-login-service";
@@ -62,6 +63,7 @@ import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-a
 import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
 import { TCertificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { TCmekServiceFactory } from "@app/services/cmek/cmek-service";
+import { TConvertorServiceFactory } from "@app/services/convertor/convertor-service";
 import { TExternalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { TExternalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
 import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
@@ -124,8 +126,6 @@ import { TUserServiceFactory } from "@app/services/user/user-service";
 import { TUserEngagementServiceFactory } from "@app/services/user-engagement/user-engagement-service";
 import { TWebhookServiceFactory } from "@app/services/webhook/webhook-service";
 import { TWorkflowIntegrationServiceFactory } from "@app/services/workflow-integration/workflow-integration-service";
-import { TConvertorServiceFactory } from "@app/services/convertor/convertor-service";
-import { TAdditionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service";
 
 declare module "@fastify/request-context" {
   interface RequestContextData {

backend/src/db/migrations/20250925145952_simplify-membership.ts

@@ -37,7 +37,7 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("scopeNamespaceId").references("id").inTable(TableName.Namespace).onDelete("CASCADE");
 
       t.boolean("isActive").defaultTo(true).notNullable();
-      t.string("status").defaultTo("invited").notNullable();
+      t.string("status");
       t.string("inviteEmail");
       t.datetime("lastInvitedAt");
       t.string("lastLoginAuthMethod");

backend/src/db/schemas/memberships.ts

@@ -17,7 +17,7 @@ export const MembershipsSchema = z.object({
   scopeProjectId: z.string().nullable().optional(),
   scopeNamespaceId: z.string().uuid().nullable().optional(),
   isActive: z.boolean().default(true),
-  status: z.string().default("invited"),
+  status: z.string().nullable().optional(),
   inviteEmail: z.string().nullable().optional(),
   lastInvitedAt: z.date().nullable().optional(),
   lastLoginAuthMethod: z.string().nullable().optional(),

backend/src/db/seeds/3-project.ts

@@ -6,6 +6,7 @@ import { generateUserSrpKeys } from "@app/lib/crypto/srp";
 import { initLogger, logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { AuthMethod } from "@app/services/auth/auth-type";
+import { membershipRoleDALFactory } from "@app/services/membership/membership-role-dal";
 import { membershipUserDALFactory } from "@app/services/membership-user/membership-user-dal";
 import { assignWorkspaceKeysToMembers, createProjectKey } from "@app/services/project/project-fns";
 import { projectKeyDALFactory } from "@app/services/project-key/project-key-dal";
@@ -23,7 +24,6 @@ import {
   TableName
 } from "../schemas";
 import { seedData1 } from "../seed-data";
-import { membershipRoleDALFactory } from "@app/services/membership/membership-role-dal";
 
 export const DEFAULT_PROJECT_ENVS = [
   { name: "Development", slug: "dev" },

backend/src/ee/routes/v1/org-role-router.ts

@@ -1,7 +1,7 @@
 import { packRules } from "@casl/ability/extra";
 import { z } from "zod";
 
-import { AccessScope, OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
+import { AccessScope, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { OrgPermissionSchema } from "@app/ee/services/permission/org-permission";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";

backend/src/ee/routes/v1/secret-router.ts

@@ -11,7 +11,6 @@ const AccessListEntrySchema = z
   .object({
     allowedActions: z.nativeEnum(ProjectPermissionSecretActions).array(),
     id: z.string(),
-    membershipId: z.string(),
     name: z.string()
   })
   .array();

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -5,6 +5,8 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
+import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
+import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
@@ -28,8 +30,6 @@ import {
   TListAccessApprovalPoliciesDTO,
   TUpdateAccessApprovalPolicy
 } from "./access-approval-policy-types";
-import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal";
-import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 
 type TAccessApprovalPolicyServiceFactoryDep = {
   projectDAL: TProjectDALFactory;

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -3,9 +3,10 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import {
   AccessApprovalRequestsSchema,
+  AccessScope,
   TableName,
   TAccessApprovalRequests,
-  TOrgMemberships,
+  TMemberships,
   TUserGroupMembership,
   TUsers
 } from "@app/db/schemas";
@@ -238,7 +239,6 @@ export interface TAccessApprovalRequestDALFactory extends Omit<TOrmify<TableName
 export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalRequestDALFactory => {
   const accessApprovalRequestOrm = ormify(db, TableName.AccessApprovalRequest);
 
-  // TODO(simp): check this from begginging
   const findRequestsWithPrivilegeByPolicyIds: TAccessApprovalRequestDALFactory["findRequestsWithPrivilegeByPolicyIds"] =
     async (policyIds) => {
       try {
@@ -293,24 +293,24 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
             `requestedByUser.id`
           )
 
-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("approverOrgMembership"),
-            `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
-            `approverOrgMembership.userId`
-          )
-
-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("approverGroupOrgMembership"),
-            `${TableName.Users}.id`,
-            `approverGroupOrgMembership.userId`
-          )
-
-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("reviewerOrgMembership"),
-            `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`,
-            `reviewerOrgMembership.userId`
-          )
-
+          .leftJoin<TMemberships>(db(TableName.Membership).as("approverOrgMembership"), (qb) => {
+            qb.on(
+              `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
+              `approverOrgMembership.actorUserId`
+            ).andOn(`approverOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
+          })
+          .leftJoin<TMemberships>(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => {
+            qb.on(`${TableName.Users}.id`, `approverGroupOrgMembership.actorUserId`).andOn(
+              `approverGroupOrgMembership.scope`,
+              db.raw("?", [AccessScope.Organization])
+            );
+          })
+          .leftJoin<TMemberships>(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => {
+            qb.on(
+              `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`,
+              `reviewerOrgMembership.actorUserId`
+            ).andOn(`reviewerOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
+          })
           .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
 
           .select(selectAllTableCols(TableName.AccessApprovalRequest))
@@ -359,22 +359,22 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
             db.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
             db.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),
 
-            db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeUserId"),
-            db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeMembershipId"),
+            db.ref("actorUserId").withSchema(TableName.AdditionalPrivilege).as("privilegeUserId"),
+            db.ref("projectId").withSchema(TableName.AdditionalPrivilege).as("privilegeMembershipId"),
 
-            db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeIsTemporary"),
-            db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryMode"),
-            db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryRange"),
+            db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("privilegeIsTemporary"),
+            db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryMode"),
+            db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryRange"),
             db
               .ref("temporaryAccessStartTime")
-              .withSchema(TableName.ProjectUserAdditionalPrivilege)
+              .withSchema(TableName.AdditionalPrivilege)
               .as("privilegeTemporaryAccessStartTime"),
             db
               .ref("temporaryAccessEndTime")
-              .withSchema(TableName.ProjectUserAdditionalPrivilege)
+              .withSchema(TableName.AdditionalPrivilege)
               .as("privilegeTemporaryAccessEndTime"),
 
-            db.ref("permissions").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegePermissions")
+            db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("privilegePermissions")
           )
           .orderBy(`${TableName.AccessApprovalRequest}.createdAt`, "desc");
 
@@ -407,7 +407,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
             privilege: doc.privilegeId
               ? {
                   membershipId: doc.privilegeMembershipId,
-                  userId: doc.privilegeUserId,
+                  userId: doc.privilegeUserId || "",
                   projectId: doc.projectId,
                   isTemporary: doc.privilegeIsTemporary,
                   temporaryMode: doc.privilegeTemporaryMode,
@@ -772,9 +772,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
         )
         .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
         .leftJoin(
-          TableName.ProjectUserAdditionalPrivilege,
+          TableName.AdditionalPrivilege,
           `${TableName.AccessApprovalRequest}.privilegeId`,
-          `${TableName.ProjectUserAdditionalPrivilege}.id`
+          `${TableName.AdditionalPrivilege}.id`
         )
 
         .leftJoin(

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -1,7 +1,7 @@
 import slugify from "@sindresorhus/slugify";
 import msFn from "ms";
 
-import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
+import { ActionProjectType, ProjectMembershipRole, TemporaryPermissionMode } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
@@ -10,12 +10,12 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
+import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
 import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
-import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 import { TProjectSlackConfigDALFactory } from "@app/services/slack/project-slack-config-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
@@ -30,7 +30,6 @@ import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal"
 import { verifyRequestedPermissions } from "./access-approval-request-fns";
 import { TAccessApprovalRequestReviewerDALFactory } from "./access-approval-request-reviewer-dal";
 import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-approval-request-types";
-import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 
 type TSecretApprovalRequestServiceFactoryDep = {
   additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "create" | "findById">;
@@ -708,9 +707,9 @@ export const accessApprovalRequestServiceFactory = ({
             // Permanent access
             const privilege = await additionalPrivilegeDAL.create(
               {
-                userId: accessApprovalRequest.requestedByUserId,
+                actorUserId: accessApprovalRequest.requestedByUserId,
                 projectId: accessApprovalRequest.projectId,
-                slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
+                name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                 permissions: JSON.stringify(accessApprovalRequest.permissions)
               },
               tx
@@ -723,12 +722,12 @@ export const accessApprovalRequestServiceFactory = ({
 
             const privilege = await additionalPrivilegeDAL.create(
               {
-                userId: accessApprovalRequest.requestedByUserId,
+                actorUserId: accessApprovalRequest.requestedByUserId,
                 projectId: accessApprovalRequest.projectId,
-                slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
+                name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                 permissions: JSON.stringify(accessApprovalRequest.permissions),
                 isTemporary: true, // Explicitly set to true for the privilege
-                temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative,
+                temporaryMode: TemporaryPermissionMode.Relative,
                 temporaryRange: accessApprovalRequest.temporaryRange!,
                 temporaryAccessStartTime: startTime,
                 temporaryAccessEndTime: new Date(startTime.getTime() + relativeTempAllocatedTimeInMs)

backend/src/ee/services/gateway-v2/gateway-v2-dal.ts

@@ -1,7 +1,7 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessScope, GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas";
+import { GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, TFindFilter, TFindOpt } from "@app/lib/knex";
 

backend/src/ee/services/gateway/gateway-dal.ts

@@ -19,7 +19,7 @@ export const gatewayDALFactory = (db: TDbClient) => {
         .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.Gateway}.identityId`)
         .join(TableName.Membership, `${TableName.Membership}.actorIdentityId`, `${TableName.Gateway}.identityId`)
         .select(selectAllTableCols(TableName.Gateway))
-        .select(db.ref("scopeOrgId").withSchema(TableName.IdentityOrgMembership).as("identityOrgId"))
+        .select(db.ref("scopeOrgId").withSchema(TableName.Membership).as("identityOrgId"))
         .select(db.ref("name").withSchema(TableName.Identity).as("identityName"))
         .where(`${TableName.Membership}.scope`, AccessScope.Organization);
 

backend/src/ee/services/permission/permission-dal.ts

@@ -9,7 +9,7 @@ import {
   MembershipsSchema,
   TableName,
   TMemberships,
-  TProjectRoles
+  TRoles
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
@@ -47,7 +47,10 @@ interface TPermissionDataReturn extends TMemberships {
 }
 
 export interface TPermissionDALFactory {
-  getProjectUserPermissions: (projectId: string) => Promise<
+  getProjectUserPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<
     {
       roles: {
         id: string;
@@ -69,45 +72,19 @@ export interface TPermissionDALFactory {
         temporaryAccessEndTime: Date | null | undefined;
         isTemporary: boolean;
       }[];
-      orgId: string;
-      orgAuthEnforced: boolean | null | undefined;
       userId: string;
-      projectId: string;
       username: string;
-      projectType?: string | null;
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
       metadata: {
         id: string;
         key: string;
         value: string;
       }[];
-      userGroupRoles: {
-        id: string;
-        role: string;
-        customRoleSlug: string;
-        permissions: unknown;
-        temporaryRange: string | null | undefined;
-        temporaryMode: string | null | undefined;
-        temporaryAccessStartTime: Date | null | undefined;
-        temporaryAccessEndTime: Date | null | undefined;
-        isTemporary: boolean;
-      }[];
-      projectMembershipRoles: {
-        id: string;
-        role: string;
-        customRoleSlug: string;
-        permissions: unknown;
-        temporaryRange: string | null | undefined;
-        temporaryMode: string | null | undefined;
-        temporaryAccessStartTime: Date | null | undefined;
-        temporaryAccessEndTime: Date | null | undefined;
-        isTemporary: boolean;
-      }[];
     }[]
   >;
-  getProjectIdentityPermissions: (projectId: string) => Promise<
+  getProjectIdentityPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<
     {
       roles: {
         id: string;
@@ -140,8 +117,6 @@ export interface TPermissionDALFactory {
       createdAt: Date;
       updatedAt: Date;
       orgId: string;
-      projectType?: string | null;
-      orgAuthEnforced: boolean;
       metadata: {
         id: string;
         key: string;
@@ -363,7 +338,6 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
         ]
       });
 
-      console.log(">>>", data);
       return data;
     } catch (error) {
       throw new DatabaseError({ error, name: "Get Permission" });
@@ -381,7 +355,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
         .where(`${TableName.Membership}.scope`, AccessScope.Project)
         .join(TableName.Groups, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`)
         .join(TableName.MembershipRole, `${TableName.MembershipRole}.membershipId`, `${TableName.Membership}.id`)
-        .leftJoin<TProjectRoles>(
+        .leftJoin<TRoles>(
           { groupCustomRoles: TableName.Role },
           `${TableName.MembershipRole}.customRoleId`,
           `groupCustomRoles.id`
@@ -472,19 +446,19 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
     }
   };
 
-  // TODO(simp): this query is wrong and fix it
   const getProjectUserPermissions: TPermissionDALFactory["getProjectUserPermissions"] = async (
     projectId: string,
     orgId: string
   ) => {
-    try {
-      const userGroupSubquery = db(TableName.Groups)
-        .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`)
-        .where(`${TableName.Groups}.orgId`, orgId)
-        .select(db.ref("id").withSchema(TableName.Groups));
+    const userGroupSubquery = db(TableName.Groups)
+      .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`)
+      .where(`${TableName.Groups}.orgId`, orgId)
+      .select(db.ref("id").withSchema(TableName.Groups));
 
+    try {
       const docs = await db
-        .replicaNode()(TableName.Membership)
+        .replicaNode()(TableName.Users)
+        .where("isGhost", "=", false)
         .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`)
         .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
         .leftJoin(TableName.AdditionalPrivilege, (qb) => {
@@ -498,82 +472,54 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
             .on(`${TableName.Membership}.actorUserId`, `${TableName.IdentityMetadata}.userId`)
             .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
         })
-        .leftJoin(
-          TableName.UserGroupMembership,
-          `${TableName.UserGroupMembership}.groupId`,
-          `${TableName.Membership}.actorGroupId`
-        )
-        .leftJoin(TableName.Users, (qb) => {
-          qb.on(`${TableName.Users}.id`, `${TableName.Membership}.actorUserId`).orOn(
-            `${TableName.Users}.id`,
-            `${TableName.UserGroupMembership}.groupId`
-          );
-        })
         .where(`${TableName.Membership}.scopeOrgId`, orgId)
-        .where(`${TableName.Membership}.scope`, AccessScope.Project)
-        .where(`${TableName.Membership}.scopeProjectId`, projectId)
+        .where((qb) => {
+          void qb
+            .whereNotNull(`${TableName.Membership}.actorUserId`)
+            .orWhereIn(`${TableName.Membership}.actorGroupId`, userGroupSubquery);
+        })
+        .where((qb) => {
+          void qb
+            .where(`${TableName.Membership}.scope`, AccessScope.Project)
+            .where(`${TableName.Membership}.scopeProjectId`, projectId);
+        })
         .select(
           db.ref("id").withSchema(TableName.Users).as("userId"),
           db.ref("username").withSchema(TableName.Users).as("username"),
-          // groups specific
-          db.ref("slug").withSchema("groupCustomRoles").as("userGroupProjectMembershipRoleCustomRoleSlug"),
-          db.ref("permissions").withSchema("groupCustomRoles").as("userGroupProjectMembershipRolePermission"),
-          db.ref("id").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleId"),
-          db.ref("role").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRole"),
-          db.ref("customRoleId").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleCustomRoleId"),
-          db.ref("isTemporary").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleIsTemporary"),
-          db
-            .ref("temporaryMode")
-            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryMode"),
-          db
-            .ref("temporaryRange")
-            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryRange"),
+          db.ref("slug").withSchema(TableName.Role).as("roleSlug"),
+          db.ref("permissions").withSchema(TableName.Role).as("customRolePermission"),
+          db.ref("id").withSchema(TableName.MembershipRole).as("membershipRoleId"),
+          db.ref("role").withSchema(TableName.MembershipRole).as("membershipRole"),
+          db.ref("temporaryMode").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryMode"),
+          db.ref("isTemporary").withSchema(TableName.MembershipRole).as("membershipRoleIsTemporary"),
+          db.ref("temporaryRange").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryRange"),
           db
             .ref("temporaryAccessStartTime")
             .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryAccessStartTime"),
+            .as("membershipRoleTemporaryAccessStartTime"),
           db
             .ref("temporaryAccessEndTime")
             .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryAccessEndTime"),
-          // user specific
-          db.ref("id").withSchema(TableName.Membership).as("membershipId"),
-          db.ref("createdAt").withSchema(TableName.Membership).as("membershipCreatedAt"),
-          db.ref("updatedAt").withSchema(TableName.Membership).as("membershipUpdatedAt"),
-          db.ref("slug").withSchema(TableName.Role).as("userProjectMembershipRoleCustomRoleSlug"),
-          db.ref("permissions").withSchema(TableName.Role).as("userProjectCustomRolePermission"),
-          db.ref("id").withSchema(TableName.Role).as("userProjectMembershipRoleId"),
-          db.ref("role").withSchema(TableName.Role).as("userProjectMembershipRole"),
-          db.ref("temporaryMode").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryMode"),
-          db.ref("isTemporary").withSchema(TableName.Role).as("userProjectMembershipRoleIsTemporary"),
-          db.ref("temporaryRange").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryRange"),
-          db
-            .ref("temporaryAccessStartTime")
-            .withSchema(TableName.Role)
-            .as("userProjectMembershipRoleTemporaryAccessStartTime"),
-          db
-            .ref("temporaryAccessEndTime")
-            .withSchema(TableName.Role)
-            .as("userProjectMembershipRoleTemporaryAccessEndTime"),
-          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesId"),
-          db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesPermissions"),
-          db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesTemporaryMode"),
-          db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesIsTemporary"),
-          db
-            .ref("temporaryRange")
-            .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryRange"),
-          db.ref("userId").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesUserId"),
+            .as("membershipRoleTemporaryAccessEndTime"),
+          db.ref("createdAt").withSchema(TableName.MembershipRole).as("membershipRoleCreatedAt"),
+          db.ref("updatedAt").withSchema(TableName.MembershipRole).as("membershipRoleUpdatedAt"),
+          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"),
+          db.ref("name").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeName"),
+          db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegePermissions"),
+          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"),
+          db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryMode"),
+          db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeIsTemporary"),
+          db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryRange"),
           db
             .ref("temporaryAccessStartTime")
             .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryAccessStartTime"),
+            .as("additionalPrivilegeTemporaryAccessStartTime"),
           db
             .ref("temporaryAccessEndTime")
             .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryAccessEndTime"),
+            .as("additionalPrivilegeTemporaryAccessEndTime"),
+          db.ref("createdAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeCreatedAt"),
+          db.ref("updatedAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeUpdatedAt"),
           // general
           db.ref("id").withSchema(TableName.IdentityMetadata).as("metadataId"),
           db.ref("key").withSchema(TableName.IdentityMetadata).as("metadataKey"),
@@ -583,84 +529,64 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
       const userPermissions = sqlNestRelationships({
         data: docs,
         key: "userId",
-        parentMapper: ({ username, membershipId, membershipCreatedAt, membershipUpdatedAt, userId }) => ({
+        parentMapper: ({ username, userId }) => ({
           userId,
           projectId,
-          username,
-          id: membershipId,
-          createdAt: membershipCreatedAt,
-          updatedAt: membershipUpdatedAt
+          username
         }),
         childrenMapper: [
           {
-            key: "userGroupProjectMembershipRoleId",
-            label: "userGroupRoles" as const,
-            mapper: ({
-              userGroupProjectMembershipRoleId,
-              userGroupProjectMembershipRole,
-              userGroupProjectMembershipRolePermission,
-              userGroupProjectMembershipRoleCustomRoleSlug,
-              userGroupProjectMembershipRoleIsTemporary,
-              userGroupProjectMembershipRoleTemporaryMode,
-              userGroupProjectMembershipRoleTemporaryAccessEndTime,
-              userGroupProjectMembershipRoleTemporaryAccessStartTime,
-              userGroupProjectMembershipRoleTemporaryRange
-            }) => ({
-              id: userGroupProjectMembershipRoleId,
-              role: userGroupProjectMembershipRole,
-              customRoleSlug: userGroupProjectMembershipRoleCustomRoleSlug,
-              permissions: userGroupProjectMembershipRolePermission,
-              temporaryRange: userGroupProjectMembershipRoleTemporaryRange,
-              temporaryMode: userGroupProjectMembershipRoleTemporaryMode,
-              temporaryAccessStartTime: userGroupProjectMembershipRoleTemporaryAccessStartTime,
-              temporaryAccessEndTime: userGroupProjectMembershipRoleTemporaryAccessEndTime,
-              isTemporary: userGroupProjectMembershipRoleIsTemporary
-            })
-          },
-          {
-            key: "userProjectMembershipRoleId",
-            label: "projectMembershipRoles" as const,
-            mapper: ({
-              userProjectMembershipRoleId,
-              userProjectMembershipRole,
-              userProjectCustomRolePermission,
-              userProjectMembershipRoleIsTemporary,
-              userProjectMembershipRoleTemporaryMode,
-              userProjectMembershipRoleTemporaryRange,
-              userProjectMembershipRoleTemporaryAccessEndTime,
-              userProjectMembershipRoleTemporaryAccessStartTime,
-              userProjectMembershipRoleCustomRoleSlug
-            }) => ({
-              id: userProjectMembershipRoleId,
-              role: userProjectMembershipRole,
-              customRoleSlug: userProjectMembershipRoleCustomRoleSlug,
-              permissions: userProjectCustomRolePermission,
-              temporaryRange: userProjectMembershipRoleTemporaryRange,
-              temporaryMode: userProjectMembershipRoleTemporaryMode,
-              temporaryAccessStartTime: userProjectMembershipRoleTemporaryAccessStartTime,
-              temporaryAccessEndTime: userProjectMembershipRoleTemporaryAccessEndTime,
-              isTemporary: userProjectMembershipRoleIsTemporary
-            })
-          },
-          {
-            key: "userAdditionalPrivilegesId",
+            key: "additionalPrivilegeId",
             label: "additionalPrivileges" as const,
             mapper: ({
-              userAdditionalPrivilegesId,
-              userAdditionalPrivilegesPermissions,
-              userAdditionalPrivilegesIsTemporary,
-              userAdditionalPrivilegesTemporaryMode,
-              userAdditionalPrivilegesTemporaryRange,
-              userAdditionalPrivilegesTemporaryAccessEndTime,
-              userAdditionalPrivilegesTemporaryAccessStartTime
+              additionalPrivilegeId,
+              additionalPrivilegePermissions,
+              additionalPrivilegeIsTemporary,
+              additionalPrivilegeTemporaryMode,
+              additionalPrivilegeTemporaryRange,
+              additionalPrivilegeTemporaryAccessEndTime,
+              additionalPrivilegeTemporaryAccessStartTime,
+              additionalPrivilegeCreatedAt,
+              additionalPrivilegeUpdatedAt
             }) => ({
-              id: userAdditionalPrivilegesId,
-              permissions: userAdditionalPrivilegesPermissions,
-              temporaryRange: userAdditionalPrivilegesTemporaryRange,
-              temporaryMode: userAdditionalPrivilegesTemporaryMode,
-              temporaryAccessStartTime: userAdditionalPrivilegesTemporaryAccessStartTime,
-              temporaryAccessEndTime: userAdditionalPrivilegesTemporaryAccessEndTime,
-              isTemporary: userAdditionalPrivilegesIsTemporary
+              id: additionalPrivilegeId,
+              permissions: additionalPrivilegePermissions,
+              temporaryRange: additionalPrivilegeTemporaryRange,
+              temporaryMode: additionalPrivilegeTemporaryMode,
+              temporaryAccessStartTime: additionalPrivilegeTemporaryAccessStartTime,
+              temporaryAccessEndTime: additionalPrivilegeTemporaryAccessEndTime,
+              isTemporary: additionalPrivilegeIsTemporary,
+              createdAt: additionalPrivilegeCreatedAt,
+              updatedAt: additionalPrivilegeUpdatedAt
+            })
+          },
+          {
+            key: "membershipRoleId",
+            label: "roles" as const,
+            mapper: ({
+              roleSlug,
+              customRolePermission,
+              membershipRoleId,
+              membershipRole,
+              membershipRoleIsTemporary,
+              membershipRoleTemporaryMode,
+              membershipRoleTemporaryRange,
+              membershipRoleTemporaryAccessEndTime,
+              membershipRoleTemporaryAccessStartTime,
+              membershipRoleCreatedAt,
+              membershipRoleUpdatedAt
+            }) => ({
+              id: membershipRoleId,
+              role: membershipRole,
+              permissions: customRolePermission,
+              customRoleSlug: roleSlug,
+              temporaryRange: membershipRoleTemporaryRange,
+              temporaryMode: membershipRoleTemporaryMode,
+              temporaryAccessStartTime: membershipRoleTemporaryAccessStartTime,
+              temporaryAccessEndTime: membershipRoleTemporaryAccessEndTime,
+              isTemporary: membershipRoleIsTemporary,
+              createdAt: membershipRoleCreatedAt,
+              updatedAt: membershipRoleUpdatedAt
             })
           },
           {
@@ -678,17 +604,11 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
       return userPermissions
         .map((userPermission) => {
           if (!userPermission) return undefined;
-          if (!userPermission?.userGroupRoles?.[0] && !userPermission?.projectMembershipRoles?.[0]) return undefined;
+          if (!userPermission?.roles?.[0]) return undefined;
 
           // when introducting cron mode change it here
           const activeRoles =
-            userPermission?.projectMembershipRoles?.filter(
-              ({ isTemporary, temporaryAccessEndTime }) =>
-                !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
-            ) ?? [];
-
-          const activeGroupRoles =
-            userPermission?.userGroupRoles?.filter(
+            userPermission?.roles?.filter(
               ({ isTemporary, temporaryAccessEndTime }) =>
                 !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
             ) ?? [];
@@ -701,7 +621,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
 
           return {
             ...userPermission,
-            roles: [...activeRoles, ...activeGroupRoles],
+            roles: activeRoles,
             additionalPrivileges: activeAdditionalPrivileges
           };
         })

backend/src/ee/services/permission/permission-service-types.ts

@@ -74,25 +74,24 @@ export type TPermissionServiceFactory = {
     memberships: Array<TMemberships & { roles: { role: string; customRoleSlug?: string | null }[] }>;
     hasRole: (role: string) => boolean;
   }>;
-  // TODO(simp): check what is this doing
-  getProjectPermissions: (projectId: string) => Promise<{
+  getProjectPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<{
     userPermissions: {
       permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
       id: string;
       name: string;
-      membershipId: string;
     }[];
     identityPermissions: {
       permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
       id: string;
       name: string;
-      membershipId: string;
     }[];
     groupPermissions: {
       permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
       id: string;
       name: string;
-      membershipId: string;
     }[];
   }>;
   getOrgPermissionByRoles: (

backend/src/ee/services/permission/permission-service.ts

@@ -350,6 +350,7 @@ export const permissionServiceFactory = ({
       actorType: actor
     });
     if (!permissionData?.length) throw new ForbiddenRequestError({ name: "You are not member of this organization" });
+
     const permissionFromRoles = permissionData.flatMap((membership) => {
       const activeRoles = membership?.roles
         .filter(
@@ -426,9 +427,9 @@ export const permissionServiceFactory = ({
     };
   };
 
-  const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId) => {
+  const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId, orgId) => {
     // fetch user permissions
-    const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId);
+    const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId, orgId);
     const userPermissions = rawUserProjectPermissions.map((userProjectPermission) => {
       const rolePermissions =
         userProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || [];
@@ -468,13 +469,12 @@ export const permissionServiceFactory = ({
       return {
         permission,
         id: userProjectPermission.userId,
-        name: userProjectPermission.username,
-        membershipId: userProjectPermission.id
+        name: userProjectPermission.username
       };
     });
 
     // fetch identity permissions
-    const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId);
+    const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId, orgId);
     const identityPermissions = rawIdentityProjectPermissions.map((identityProjectPermission) => {
       const rolePermissions =
         identityProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || [];
@@ -514,8 +514,7 @@ export const permissionServiceFactory = ({
       return {
         permission,
         id: identityProjectPermission.identityId,
-        name: identityProjectPermission.username,
-        membershipId: identityProjectPermission.id
+        name: identityProjectPermission.username
       };
     });
 
@@ -532,8 +531,7 @@ export const permissionServiceFactory = ({
       return {
         permission,
         id: groupProjectPermission.groupId,
-        name: groupProjectPermission.username,
-        membershipId: groupProjectPermission.id
+        name: groupProjectPermission.username
       };
     });
 

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -2,9 +2,10 @@ import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
 import {
+  AccessScope,
   SecretApprovalRequestsSchema,
   TableName,
-  TOrgMemberships,
+  TMemberships,
   TSecretApprovalRequests,
   TSecretApprovalRequestsSecrets,
   TUserGroupMembership,
@@ -109,24 +110,26 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         `secretApprovalReviewerUser.id`
       )
 
-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("approverOrgMembership"),
-        `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
-        `approverOrgMembership.userId`
-      )
+      .leftJoin<TMemberships>(db(TableName.Membership).as("approverOrgMembership"), (qb) => {
+        qb.on(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, `approverOrgMembership.actorUserId`).andOn(
+          `approverOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })
 
-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("approverGroupOrgMembership"),
-        `secretApprovalPolicyGroupApproverUser.id`,
-        `approverGroupOrgMembership.userId`
-      )
-
-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("reviewerOrgMembership"),
-        `${TableName.SecretApprovalRequestReviewer}.reviewerUserId`,
-        `reviewerOrgMembership.userId`
-      )
+      .leftJoin<TMemberships>(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => {
+        qb.on(`secretApprovalPolicyGroupApproverUser.id`, `approverGroupOrgMembership.actorUserId`).andOn(
+          `approverGroupOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })
 
+      .leftJoin<TMemberships>(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => {
+        qb.on(`${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, `reviewerOrgMembership.actorUserId`).andOn(
+          `reviewerOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })
       .select(selectAllTableCols(TableName.SecretApprovalRequest))
       .select(
         tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),

backend/src/server/routes/v1/admin-router.ts

@@ -5,6 +5,7 @@ import {
   IdentitiesSchema,
   OrganizationsSchema,
   OrgMembershipsSchema,
+  OrgMembershipStatus,
   SuperAdminSchema,
   UsersSchema
 } from "@app/db/schemas";
@@ -279,7 +280,10 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
       );
 
       return {
-        organizationMembership
+        organizationMembership: {
+          ...organizationMembership,
+          status: organizationMembership?.status || OrgMembershipStatus.Accepted
+        }
       };
     }
   });
@@ -892,7 +896,13 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const organizationMembership = await server.services.superAdmin.resendOrgInvite(req.params, req.permission);
-      return { organizationMembership };
+
+      return {
+        organizationMembership: {
+          ...organizationMembership,
+          status: organizationMembership?.status || OrgMembershipStatus.Accepted
+        }
+      };
     }
   });
 
@@ -922,7 +932,12 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
         req.params.organizationId,
         req.permission
       );
-      return { organizationMembership };
+      return {
+        organizationMembership: {
+          ...organizationMembership,
+          status: organizationMembership?.status || OrgMembershipStatus.Accepted
+        }
+      };
     }
   });
 

backend/src/server/routes/v1/deprecated-project-membership-router.ts

@@ -4,6 +4,7 @@ import {
   AccessScope,
   OrgMembershipRole,
   OrgMembershipsSchema,
+  OrgMembershipStatus,
   ProjectMembershipsSchema,
   ProjectUserMembershipRolesSchema,
   TemporaryPermissionMode,
@@ -275,7 +276,12 @@ export const registerDeprecatedProjectMembershipRouter = async (server: FastifyZ
       });
 
       return {
-        data: data.map((el) => ({ ...el, orgId: req.permission.orgId, role: OrgMembershipRole.Member })),
+        data: data.map((el) => ({
+          ...el,
+          orgId: req.permission.orgId,
+          role: OrgMembershipRole.Member,
+          status: el.status || OrgMembershipStatus.Accepted
+        })),
         success: true
       };
     }

backend/src/server/routes/v1/organization-router.ts

@@ -6,6 +6,7 @@ import {
   GroupsSchema,
   IncidentContactsSchema,
   OrgMembershipsSchema,
+  OrgMembershipStatus,
   OrgRolesSchema,
   UsersSchema
 } from "@app/db/schemas";
@@ -263,7 +264,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         req.permission.authMethod,
         req.permission.orgId
       );
-      return { users };
+      return { users: users.map((el) => ({ ...el, status: el.status || OrgMembershipStatus.Accepted })) };
     }
   });
 

backend/src/server/routes/v2/organization-router.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 
 import {
   OrgMembershipsSchema,
+  OrgMembershipStatus,
   ProjectMembershipsSchema,
   ProjectsSchema,
   UserEncryptionKeysSchema,
@@ -63,7 +64,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         req.permission.authMethod,
         req.permission.orgId
       );
-      return { users };
+      return { users: users.map((el) => ({ ...el, status: el.status || OrgMembershipStatus.Accepted })) };
     }
   });
 
@@ -168,7 +169,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         orgId: req.params.organizationId,
         membershipId: req.params.membershipId
       });
-      return { membership };
+      return { membership: { ...membership, status: membership.status || OrgMembershipStatus.Accepted } };
     }
   });
 
@@ -224,7 +225,8 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         membership: {
           ...membership,
           role: "",
-          orgId: req.params.organizationId
+          orgId: req.params.organizationId,
+          status: membership.status || OrgMembershipStatus.Accepted
         }
       };
     }
@@ -269,6 +271,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
       return {
         membership: {
           ...membership,
+          status: membership.status || OrgMembershipStatus.Accepted,
           role: "",
           orgId: req.params.organizationId
         }
@@ -317,6 +320,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
       return {
         memberships: memberships.map((el) => ({
           ...el,
+          status: el?.status || OrgMembershipStatus.Accepted,
           role: "",
           orgId: req.params.organizationId
         }))

backend/src/services/additional-privilege/additional-privilege-dal.ts

@@ -1,21 +1,11 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { ormify } from "@app/lib/knex";
 
 export type TAdditionalPrivilegeDALFactory = ReturnType<typeof additionalPrivilegeDALFactory>;
 
 export const additionalPrivilegeDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.AdditionalPrivilege);
 
-  const getMembershipById = async (privilegeId: string) => {
-    const doc = await db
-      .replicaNode()(TableName.AdditionalPrivilege)
-      .join(TableName.Membership, `${TableName.AdditionalPrivilege}.membershipId`, `${TableName.Membership}.id`)
-      .select(selectAllTableCols(TableName.Membership))
-      .where(`${TableName.AdditionalPrivilege}.id`, privilegeId)
-      .first();
-    return doc;
-  };
-
-  return { ...orm, getMembershipById };
+  return orm;
 };

backend/src/services/convertor/convertor-service.ts

@@ -1,14 +1,14 @@
 import { AccessScope } from "@app/db/schemas";
 import { NotFoundError } from "@app/lib/errors";
 
+import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 import { TMembershipDALFactory } from "../membership/membership-dal";
 import { TProjectDALFactory } from "../project/project-dal";
-import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 
 type TConvertorServiceFactoryDep = {
   projectDAL: Pick<TProjectDALFactory, "findOne">;
   membershipDAL: Pick<TMembershipDALFactory, "findOne">;
-  additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "getMembershipById" | "findOne">;
+  additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "findOne">;
 };
 
 export type TConvertorServiceFactory = ReturnType<typeof convertorServiceFactory>;

backend/src/services/group-project/group-project-dal.ts

@@ -139,7 +139,7 @@ export const groupProjectDALFactory = (db: TDbClient) => {
       .join(TableName.MembershipRole, `${TableName.MembershipRole}.membershipId`, `${TableName.Membership}.id`)
       .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
       .join<TMemberships>(db(TableName.Membership).as("orgMembership"), (qb) => {
-        qb.on(`${TableName.Users}.id`, `orgMembership.userId`)
+        qb.on(`${TableName.Users}.id`, `orgMembership.actorUserId`)
           .andOn(`orgMembership.scope`, db.raw("?", [AccessScope.Organization]))
           .andOn(`orgMembership.scopeOrgId`, `${TableName.Project}.orgId`);
       })

backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts

@@ -18,9 +18,9 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityAliCloudAuthDALFactory } from "./identity-alicloud-auth-dal";

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -5,7 +5,6 @@ import RE2 from "re2";
 
 import { AccessScope, IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -18,9 +17,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityAwsAuthDALFactory } from "./identity-aws-auth-dal";
 import { extractPrincipalArn, extractPrincipalArnEntity } from "./identity-aws-auth-fns";

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability";
 
 import { AccessScope, IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityAzureAuthDALFactory } from "./identity-azure-auth-dal";
 import { validateAzureIdentity } from "./identity-azure-auth-fns";

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability";
 
 import { AccessScope, IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityGcpAuthDALFactory } from "./identity-gcp-auth-dal";
 import { validateIamIdentity, validateIdTokenIdentity } from "./identity-gcp-auth-fns";

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -5,7 +5,6 @@ import { JwksClient } from "jwks-rsa";
 
 import { AccessScope, IdentityAuthMethod, TIdentityJwtAuthsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -25,11 +24,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { getValueByDot } from "@app/lib/template/dot-access";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityJwtAuthDALFactory } from "./identity-jwt-auth-dal";
 import { doesFieldValueMatchJwtPolicy } from "./identity-jwt-auth-fns";

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -9,7 +9,6 @@ import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service
 import { TGatewayV2DALFactory } from "@app/ee/services/gateway-v2/gateway-v2-dal";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import {
   OrgPermissionGatewayActions,
   OrgPermissionIdentityActions,
@@ -29,11 +28,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityKubernetesAuthDALFactory } from "./identity-kubernetes-auth-dal";
 import { extractK8sUsername } from "./identity-kubernetes-auth-fns";

backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts

@@ -6,7 +6,6 @@ import { AccessScope, IdentityAuthMethod } from "@app/db/schemas";
 import { TIdentityAuthTemplateDALFactory } from "@app/ee/services/identity-auth-template";
 import { testLDAPConfig } from "@app/ee/services/ldap-config/ldap-fns";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import {
   OrgPermissionIdentityActions,
   OrgPermissionMachineIdentityAuthTemplateActions,
@@ -32,11 +31,12 @@ import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityLdapAuthDALFactory } from "./identity-ldap-auth-dal";
 import {

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -19,9 +19,10 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityOciAuthDALFactory } from "./identity-oci-auth-dal";
 import {
@@ -32,7 +33,6 @@ import {
   TRevokeOciAuthDTO,
   TUpdateOciAuthDTO
 } from "./identity-oci-auth-types";
-import { TOrgDALFactory } from "../org/org-dal";
 
 type TIdentityOciAuthServiceFactoryDep = {
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create" | "delete">;

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -6,7 +6,6 @@ import { JwksClient } from "jwks-rsa";
 
 import { AccessScope, IdentityAuthMethod, TIdentityOidcAuthsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -26,11 +25,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { getValueByDot } from "@app/lib/template/dot-access";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityOidcAuthDALFactory } from "./identity-oidc-auth-dal";
 import { doesAudValueMatchOidcPolicy, doesFieldValueMatchOidcPolicy } from "./identity-oidc-auth-fns";

backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability";
 
 import { AccessScope, IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -16,11 +15,12 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityTlsCertAuthDALFactory } from "./identity-tls-cert-auth-dal";
 import { TIdentityTlsCertAuthServiceFactory } from "./identity-tls-cert-auth-types";

backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts

@@ -1,4 +1,4 @@
-import { TIdentityAccessTokens, TMemberships, TIdentityTlsCertAuths } from "@app/db/schemas";
+import { TIdentityAccessTokens, TIdentityTlsCertAuths, TMemberships } from "@app/db/schemas";
 import { TProjectPermission } from "@app/lib/types";
 
 export type TLoginTlsCertAuthDTO = {

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability";
 
 import { AccessScope, IdentityAuthMethod, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TOrgDALFactory } from "../org/org-dal";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import {
   constructPermissionErrorMessage,
@@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/li
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityTokenAuthDALFactory } from "./identity-token-auth-dal";
 import {

backend/src/services/identity/identity-service.ts

@@ -12,6 +12,8 @@ import { TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 
+import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
+import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
 import { TIdentityDALFactory } from "./identity-dal";
@@ -26,8 +28,6 @@ import {
   TSearchOrgIdentitiesByOrgIdDTO,
   TUpdateIdentityDTO
 } from "./identity-types";
-import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
-import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 
 type TIdentityServiceFactoryDep = {
   identityDAL: TIdentityDALFactory;

backend/src/services/membership-group/project/project-membership-group-factory.ts

@@ -23,7 +23,6 @@ type TProjectMembershipGroupScopeFactoryDep = {
   membershipGroupDAL: Pick<TMembershipGroupDALFactory, "findOne">;
 };
 
-// TODO(simp): check for group in org
 export const newProjectMembershipGroupFactory = ({
   permissionService,
   orgDAL,

backend/src/services/org/org-dal.ts

@@ -638,7 +638,6 @@ export const orgDALFactory = (db: TDbClient) => {
     }
   };
 
-  // TODO(simp): resolve this role field later
   const findIdentityOrganization = async (
     identityId: string
   ): Promise<{ id: string; name: string; slug: string; role: string }> => {

backend/src/services/project-membership/project-membership-service.ts

@@ -385,8 +385,6 @@ export const projectMembershipServiceFactory = ({
         tx
       );
 
-      // TODO(simp): likewise check in all services if i am missing anything
-      // Deletion should handle all cleanups like wise
       await secretReminderRecipientsDAL.delete(
         {
           projectId,

backend/src/services/project/project-queue.ts

@@ -30,6 +30,8 @@ import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueJobTypes, TQueueServiceFactory } from "@app/queue";
 
 import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal";
+import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
+import { TMembershipUserDALFactory } from "../membership-user/membership-user-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TOrgServiceFactory } from "../org/org-service";
 import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
@@ -41,8 +43,6 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TUserDALFactory } from "../user/user-dal";
 import { TProjectDALFactory } from "./project-dal";
 import { assignWorkspaceKeysToMembers, createProjectKey } from "./project-fns";
-import { TMembershipUserDALFactory } from "../membership-user/membership-user-dal";
-import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 
 export type TProjectQueueFactory = ReturnType<typeof projectQueueFactory>;
 

backend/src/services/role/org/org-role-factory.ts

@@ -10,9 +10,9 @@ import {
 } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError } from "@app/lib/errors";
+import { isCustomOrgRole } from "@app/services/org/org-role-fns";
 
 import { TRoleScopeFactory } from "../role-types";
-import { isCustomOrgRole } from "@app/services/org/org-role-fns";
 
 // TODO(simp): missing external group checking
 type TOrgRoleScopeFactoryDep = {

backend/src/services/role/project/project-role-factory.ts

@@ -1,16 +1,7 @@
-import { v4 as uuidv4 } from "uuid";
 import { ForbiddenError } from "@casl/ability";
+import { v4 as uuidv4 } from "uuid";
 
 import { AccessScope, ActionProjectType, ProjectMembershipRole, ProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
-import {
-  isCustomProjectRole,
-  ProjectPermissionActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
-import { BadRequestError } from "@app/lib/errors";
-
-import { TRoleScopeFactory } from "../role-types";
 import {
   cryptographicOperatorPermissions,
   projectAdminPermissions,
@@ -19,8 +10,17 @@ import {
   projectViewerPermission,
   sshHostBootstrapPermissions
 } from "@app/ee/services/permission/default-roles";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
+import {
+  isCustomProjectRole,
+  ProjectPermissionActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
+import { BadRequestError } from "@app/lib/errors";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
+import { TRoleScopeFactory } from "../role-types";
+
 type TProjectRoleScopeFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   projectDAL: Pick<TProjectDALFactory, "findById">;

backend/src/services/role/role-service.ts

@@ -1,9 +1,16 @@
+import { packRules } from "@casl/ability/extra";
+import { requestContext } from "@fastify/request-context";
+
 import { AccessScope, ActionProjectType, TableName } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
 import { UnpackedPermissionSchema, unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 
+import { ActorType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
+import { TProjectDALFactory } from "../project/project-dal";
+import { TUserDALFactory } from "../user/user-dal";
 import { newNamespaceRoleFactory } from "./namespace/namespace-role-factory";
 import { newOrgRoleFactory } from "./org/org-role-factory";
 import { newProjectRoleFactory } from "./project/project-role-factory";
@@ -17,12 +24,6 @@ import {
   TListRoleDTO,
   TUpdateRoleDTO
 } from "./role-types";
-import { TProjectDALFactory } from "../project/project-dal";
-import { packRules } from "@casl/ability/extra";
-import { requestContext } from "@fastify/request-context";
-import { TIdentityDALFactory } from "../identity/identity-dal";
-import { TUserDALFactory } from "../user/user-dal";
-import { ActorType } from "../auth/auth-type";
 
 type TRoleServiceFactoryDep = {
   roleDAL: TRoleDALFactory;

backend/src/services/role/role-types.ts

@@ -1,6 +1,7 @@
+import { MongoAbility, RawRuleOf } from "@casl/ability";
+
 import { AccessScopeData, TRoles } from "@app/db/schemas";
 import { OrgServiceActor } from "@app/lib/types";
-import { MongoAbility, RawRuleOf } from "@casl/ability";
 
 export interface TRoleScopeFactory {
   onCreateRoleGuard: (arg: TCreateRoleDTO) => Promise<void>;

backend/src/services/secret/secret-queue.ts

@@ -44,6 +44,8 @@ import { TIntegrationAuthServiceFactory } from "../integration-auth/integration-
 import { syncIntegrationSecrets } from "../integration-auth/integration-sync-secret";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
+import { TMembershipDALFactory } from "../membership/membership-dal";
+import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 import { TOrgServiceFactory } from "../org/org-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { createProjectKey } from "../project/project-fns";
@@ -76,8 +78,6 @@ import {
   TRemoveSecretReminderDTO,
   TSyncSecretsDTO
 } from "./secret-types";
-import { TMembershipDALFactory } from "../membership/membership-dal";
-import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 
 export type TSecretQueueFactory = ReturnType<typeof secretQueueFactory>;
 type TSecretQueueFactoryDep = {

backend/src/services/secret/secret-service.ts

@@ -1283,7 +1283,8 @@ export const secretServiceFactory = ({
     });
 
     const { userPermissions, identityPermissions, groupPermissions } = await permissionService.getProjectPermissions(
-      dto.projectId
+      dto.projectId,
+      dto.actorOrgId
     );
 
     const attachAllowedActions = (

frontend/src/hooks/api/secrets/types.ts

@@ -266,6 +266,5 @@ export type TSecretReferenceTraceNode = {
 export type SecretAccessListEntry = {
   allowedActions: ProjectPermissionActions[];
   id: string;
-  membershipId: string;
   name: string;
 };

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx

@@ -746,18 +746,9 @@ export const SecretDetailSidebar = ({
                                 .join(", ")}
                               className="z-[100] capitalize"
                             >
-                              <Link
-                                to={
-                                  `${getProjectBaseURL(currentProject.type)}/members/$membershipId` as const
-                                }
-                                params={{
-                                  projectId: currentProject.id,
-                                  membershipId: user.membershipId
-                                }}
-                                className="text-secondary/80 rounded-md border border-mineshaft-600 bg-mineshaft-700 px-1 py-0.5 text-sm hover:text-mineshaft-100"
-                              >
+                              <div className="text-secondary/80 rounded-md border border-mineshaft-600 bg-mineshaft-700 px-1 py-0.5 text-sm hover:text-mineshaft-100">
                                 {user.name}
-                              </Link>
+                              </div>
                             </Tooltip>
                           </div>
                         ))}