From 0d221f497d29d2b4b93050ee84e2cec3cf9235f8 Mon Sep 17 00:00:00 2001 From: = Date: Sat, 4 Oct 2025 20:39:01 +0530 Subject: [PATCH] feat: lint and finally completed --- backend/src/@types/fastify.d.ts | 4 +- .../20250925145952_simplify-membership.ts | 2 +- backend/src/db/schemas/memberships.ts | 2 +- backend/src/db/seeds/3-project.ts | 2 +- backend/src/ee/routes/v1/org-role-router.ts | 2 +- backend/src/ee/routes/v1/secret-router.ts | 1 - .../access-approval-policy-service.ts | 4 +- .../access-approval-request-dal.ts | 62 ++-- .../access-approval-request-service.ts | 15 +- .../ee/services/gateway-v2/gateway-v2-dal.ts | 2 +- .../src/ee/services/gateway/gateway-dal.ts | 2 +- .../ee/services/permission/permission-dal.ts | 284 +++++++----------- .../permission/permission-service-types.ts | 9 +- .../services/permission/permission-service.ts | 16 +- .../secret-approval-request-dal.ts | 37 +-- backend/src/server/routes/v1/admin-router.ts | 21 +- .../deprecated-project-membership-router.ts | 8 +- .../server/routes/v1/organization-router.ts | 3 +- .../server/routes/v2/organization-router.ts | 10 +- .../additional-privilege-dal.ts | 14 +- .../services/convertor/convertor-service.ts | 4 +- .../group-project/group-project-dal.ts | 2 +- .../identity-alicloud-auth-service.ts | 2 +- .../identity-aws-auth-service.ts | 4 +- .../identity-azure-auth-service.ts | 4 +- .../identity-gcp-auth-service.ts | 4 +- .../identity-jwt-auth-service.ts | 4 +- .../identity-kubernetes-auth-service.ts | 4 +- .../identity-ldap-auth-service.ts | 4 +- .../identity-oci-auth-service.ts | 4 +- .../identity-oidc-auth-service.ts | 4 +- .../identity-tls-cert-auth-service.ts | 4 +- .../identity-tls-cert-auth-types.ts | 2 +- .../identity-token-auth-service.ts | 4 +- .../src/services/identity/identity-service.ts | 4 +- .../project-membership-group-factory.ts | 1 - backend/src/services/org/org-dal.ts | 1 - .../project-membership-service.ts | 2 - backend/src/services/project/project-queue.ts | 4 +- .../src/services/role/org/org-role-factory.ts | 2 +- .../role/project/project-role-factory.ts | 20 +- backend/src/services/role/role-service.ts | 13 +- backend/src/services/role/role-types.ts | 3 +- backend/src/services/secret/secret-queue.ts | 4 +- backend/src/services/secret/secret-service.ts | 3 +- frontend/src/hooks/api/secrets/types.ts | 1 - .../SecretListView/SecretDetailSidebar.tsx | 13 +- 47 files changed, 272 insertions(+), 349 deletions(-) diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 0ead72407..e3e8733f0 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -50,6 +50,7 @@ import { TSshHostServiceFactory } from "@app/ee/services/ssh-host/ssh-host-servi import { TSshHostGroupServiceFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-service"; import { TTrustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-types"; import { TAuthMode } from "@app/server/plugins/auth/inject-identity"; +import { TAdditionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service"; import { TApiKeyServiceFactory } from "@app/services/api-key/api-key-service"; import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service"; import { TAuthLoginFactory } from "@app/services/auth/auth-login-service"; @@ -62,6 +63,7 @@ import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-a import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service"; import { TCertificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service"; import { TCmekServiceFactory } from "@app/services/cmek/cmek-service"; +import { TConvertorServiceFactory } from "@app/services/convertor/convertor-service"; import { TExternalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service"; import { TExternalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service"; import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service"; @@ -124,8 +126,6 @@ import { TUserServiceFactory } from "@app/services/user/user-service"; import { TUserEngagementServiceFactory } from "@app/services/user-engagement/user-engagement-service"; import { TWebhookServiceFactory } from "@app/services/webhook/webhook-service"; import { TWorkflowIntegrationServiceFactory } from "@app/services/workflow-integration/workflow-integration-service"; -import { TConvertorServiceFactory } from "@app/services/convertor/convertor-service"; -import { TAdditionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service"; declare module "@fastify/request-context" { interface RequestContextData { diff --git a/backend/src/db/migrations/20250925145952_simplify-membership.ts b/backend/src/db/migrations/20250925145952_simplify-membership.ts index 4e4219538..f02af1b73 100644 --- a/backend/src/db/migrations/20250925145952_simplify-membership.ts +++ b/backend/src/db/migrations/20250925145952_simplify-membership.ts @@ -37,7 +37,7 @@ export async function up(knex: Knex): Promise { t.foreign("scopeNamespaceId").references("id").inTable(TableName.Namespace).onDelete("CASCADE"); t.boolean("isActive").defaultTo(true).notNullable(); - t.string("status").defaultTo("invited").notNullable(); + t.string("status"); t.string("inviteEmail"); t.datetime("lastInvitedAt"); t.string("lastLoginAuthMethod"); diff --git a/backend/src/db/schemas/memberships.ts b/backend/src/db/schemas/memberships.ts index 342880394..e871a5627 100644 --- a/backend/src/db/schemas/memberships.ts +++ b/backend/src/db/schemas/memberships.ts @@ -17,7 +17,7 @@ export const MembershipsSchema = z.object({ scopeProjectId: z.string().nullable().optional(), scopeNamespaceId: z.string().uuid().nullable().optional(), isActive: z.boolean().default(true), - status: z.string().default("invited"), + status: z.string().nullable().optional(), inviteEmail: z.string().nullable().optional(), lastInvitedAt: z.date().nullable().optional(), lastLoginAuthMethod: z.string().nullable().optional(), diff --git a/backend/src/db/seeds/3-project.ts b/backend/src/db/seeds/3-project.ts index 0ed462365..d0294022f 100644 --- a/backend/src/db/seeds/3-project.ts +++ b/backend/src/db/seeds/3-project.ts @@ -6,6 +6,7 @@ import { generateUserSrpKeys } from "@app/lib/crypto/srp"; import { initLogger, logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { AuthMethod } from "@app/services/auth/auth-type"; +import { membershipRoleDALFactory } from "@app/services/membership/membership-role-dal"; import { membershipUserDALFactory } from "@app/services/membership-user/membership-user-dal"; import { assignWorkspaceKeysToMembers, createProjectKey } from "@app/services/project/project-fns"; import { projectKeyDALFactory } from "@app/services/project-key/project-key-dal"; @@ -23,7 +24,6 @@ import { TableName } from "../schemas"; import { seedData1 } from "../seed-data"; -import { membershipRoleDALFactory } from "@app/services/membership/membership-role-dal"; export const DEFAULT_PROJECT_ENVS = [ { name: "Development", slug: "dev" }, diff --git a/backend/src/ee/routes/v1/org-role-router.ts b/backend/src/ee/routes/v1/org-role-router.ts index 3c165b0a6..5a8f03038 100644 --- a/backend/src/ee/routes/v1/org-role-router.ts +++ b/backend/src/ee/routes/v1/org-role-router.ts @@ -1,7 +1,7 @@ import { packRules } from "@casl/ability/extra"; import { z } from "zod"; -import { AccessScope, OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas"; +import { AccessScope, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { OrgPermissionSchema } from "@app/ee/services/permission/org-permission"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; diff --git a/backend/src/ee/routes/v1/secret-router.ts b/backend/src/ee/routes/v1/secret-router.ts index b9eeb7729..9b7f9f35f 100644 --- a/backend/src/ee/routes/v1/secret-router.ts +++ b/backend/src/ee/routes/v1/secret-router.ts @@ -11,7 +11,6 @@ const AccessListEntrySchema = z .object({ allowedActions: z.nativeEnum(ProjectPermissionSecretActions).array(), id: z.string(), - membershipId: z.string(), name: z.string() }) .array(); diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts index 31e28259f..16c7e962c 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts @@ -5,6 +5,8 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; +import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal"; +import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal"; import { TUserDALFactory } from "@app/services/user/user-dal"; @@ -28,8 +30,6 @@ import { TListAccessApprovalPoliciesDTO, TUpdateAccessApprovalPolicy } from "./access-approval-policy-types"; -import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal"; -import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal"; type TAccessApprovalPolicyServiceFactoryDep = { projectDAL: TProjectDALFactory; diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts b/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts index 86b66ae8c..3bea66696 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts @@ -3,9 +3,10 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { AccessApprovalRequestsSchema, + AccessScope, TableName, TAccessApprovalRequests, - TOrgMemberships, + TMemberships, TUserGroupMembership, TUsers } from "@app/db/schemas"; @@ -238,7 +239,6 @@ export interface TAccessApprovalRequestDALFactory extends Omit { const accessApprovalRequestOrm = ormify(db, TableName.AccessApprovalRequest); - // TODO(simp): check this from begginging const findRequestsWithPrivilegeByPolicyIds: TAccessApprovalRequestDALFactory["findRequestsWithPrivilegeByPolicyIds"] = async (policyIds) => { try { @@ -293,24 +293,24 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR `requestedByUser.id` ) - .leftJoin( - db(TableName.OrgMembership).as("approverOrgMembership"), - `${TableName.AccessApprovalPolicyApprover}.approverUserId`, - `approverOrgMembership.userId` - ) - - .leftJoin( - db(TableName.OrgMembership).as("approverGroupOrgMembership"), - `${TableName.Users}.id`, - `approverGroupOrgMembership.userId` - ) - - .leftJoin( - db(TableName.OrgMembership).as("reviewerOrgMembership"), - `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`, - `reviewerOrgMembership.userId` - ) - + .leftJoin(db(TableName.Membership).as("approverOrgMembership"), (qb) => { + qb.on( + `${TableName.AccessApprovalPolicyApprover}.approverUserId`, + `approverOrgMembership.actorUserId` + ).andOn(`approverOrgMembership.scope`, db.raw("?", [AccessScope.Organization])); + }) + .leftJoin(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => { + qb.on(`${TableName.Users}.id`, `approverGroupOrgMembership.actorUserId`).andOn( + `approverGroupOrgMembership.scope`, + db.raw("?", [AccessScope.Organization]) + ); + }) + .leftJoin(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => { + qb.on( + `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`, + `reviewerOrgMembership.actorUserId` + ).andOn(`reviewerOrgMembership.scope`, db.raw("?", [AccessScope.Organization])); + }) .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`) .select(selectAllTableCols(TableName.AccessApprovalRequest)) @@ -359,22 +359,22 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR db.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"), db.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"), - db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeUserId"), - db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeMembershipId"), + db.ref("actorUserId").withSchema(TableName.AdditionalPrivilege).as("privilegeUserId"), + db.ref("projectId").withSchema(TableName.AdditionalPrivilege).as("privilegeMembershipId"), - db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeIsTemporary"), - db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryMode"), - db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryRange"), + db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("privilegeIsTemporary"), + db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryMode"), + db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryRange"), db .ref("temporaryAccessStartTime") - .withSchema(TableName.ProjectUserAdditionalPrivilege) + .withSchema(TableName.AdditionalPrivilege) .as("privilegeTemporaryAccessStartTime"), db .ref("temporaryAccessEndTime") - .withSchema(TableName.ProjectUserAdditionalPrivilege) + .withSchema(TableName.AdditionalPrivilege) .as("privilegeTemporaryAccessEndTime"), - db.ref("permissions").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegePermissions") + db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("privilegePermissions") ) .orderBy(`${TableName.AccessApprovalRequest}.createdAt`, "desc"); @@ -407,7 +407,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR privilege: doc.privilegeId ? { membershipId: doc.privilegeMembershipId, - userId: doc.privilegeUserId, + userId: doc.privilegeUserId || "", projectId: doc.projectId, isTemporary: doc.privilegeIsTemporary, temporaryMode: doc.privilegeTemporaryMode, @@ -772,9 +772,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR ) .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`) .leftJoin( - TableName.ProjectUserAdditionalPrivilege, + TableName.AdditionalPrivilege, `${TableName.AccessApprovalRequest}.privilegeId`, - `${TableName.ProjectUserAdditionalPrivilege}.id` + `${TableName.AdditionalPrivilege}.id` ) .leftJoin( diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts index 58daca232..4eed1c0f1 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts @@ -1,7 +1,7 @@ import slugify from "@sindresorhus/slugify"; import msFn from "ms"; -import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas"; +import { ActionProjectType, ProjectMembershipRole, TemporaryPermissionMode } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; @@ -10,12 +10,12 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { EnforcementLevel } from "@app/lib/types"; import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification"; import { TriggerFeature } from "@app/lib/workflow-integrations/types"; +import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service"; import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal"; -import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal"; import { TProjectSlackConfigDALFactory } from "@app/services/slack/project-slack-config-dal"; import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service"; import { TUserDALFactory } from "@app/services/user/user-dal"; @@ -30,7 +30,6 @@ import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal" import { verifyRequestedPermissions } from "./access-approval-request-fns"; import { TAccessApprovalRequestReviewerDALFactory } from "./access-approval-request-reviewer-dal"; import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-approval-request-types"; -import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal"; type TSecretApprovalRequestServiceFactoryDep = { additionalPrivilegeDAL: Pick; @@ -708,9 +707,9 @@ export const accessApprovalRequestServiceFactory = ({ // Permanent access const privilege = await additionalPrivilegeDAL.create( { - userId: accessApprovalRequest.requestedByUserId, + actorUserId: accessApprovalRequest.requestedByUserId, projectId: accessApprovalRequest.projectId, - slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`, + name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`, permissions: JSON.stringify(accessApprovalRequest.permissions) }, tx @@ -723,12 +722,12 @@ export const accessApprovalRequestServiceFactory = ({ const privilege = await additionalPrivilegeDAL.create( { - userId: accessApprovalRequest.requestedByUserId, + actorUserId: accessApprovalRequest.requestedByUserId, projectId: accessApprovalRequest.projectId, - slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`, + name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`, permissions: JSON.stringify(accessApprovalRequest.permissions), isTemporary: true, // Explicitly set to true for the privilege - temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative, + temporaryMode: TemporaryPermissionMode.Relative, temporaryRange: accessApprovalRequest.temporaryRange!, temporaryAccessStartTime: startTime, temporaryAccessEndTime: new Date(startTime.getTime() + relativeTempAllocatedTimeInMs) diff --git a/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts b/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts index e2099e803..e0e7e582e 100644 --- a/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts +++ b/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts @@ -1,7 +1,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; -import { AccessScope, GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas"; +import { GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas"; import { DatabaseError } from "@app/lib/errors"; import { buildFindFilter, ormify, selectAllTableCols, TFindFilter, TFindOpt } from "@app/lib/knex"; diff --git a/backend/src/ee/services/gateway/gateway-dal.ts b/backend/src/ee/services/gateway/gateway-dal.ts index b23d42d39..58f59d313 100644 --- a/backend/src/ee/services/gateway/gateway-dal.ts +++ b/backend/src/ee/services/gateway/gateway-dal.ts @@ -19,7 +19,7 @@ export const gatewayDALFactory = (db: TDbClient) => { .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.Gateway}.identityId`) .join(TableName.Membership, `${TableName.Membership}.actorIdentityId`, `${TableName.Gateway}.identityId`) .select(selectAllTableCols(TableName.Gateway)) - .select(db.ref("scopeOrgId").withSchema(TableName.IdentityOrgMembership).as("identityOrgId")) + .select(db.ref("scopeOrgId").withSchema(TableName.Membership).as("identityOrgId")) .select(db.ref("name").withSchema(TableName.Identity).as("identityName")) .where(`${TableName.Membership}.scope`, AccessScope.Organization); diff --git a/backend/src/ee/services/permission/permission-dal.ts b/backend/src/ee/services/permission/permission-dal.ts index 5875d0709..4841eed3d 100644 --- a/backend/src/ee/services/permission/permission-dal.ts +++ b/backend/src/ee/services/permission/permission-dal.ts @@ -9,7 +9,7 @@ import { MembershipsSchema, TableName, TMemberships, - TProjectRoles + TRoles } from "@app/db/schemas"; import { DatabaseError } from "@app/lib/errors"; import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; @@ -47,7 +47,10 @@ interface TPermissionDataReturn extends TMemberships { } export interface TPermissionDALFactory { - getProjectUserPermissions: (projectId: string) => Promise< + getProjectUserPermissions: ( + projectId: string, + orgId: string + ) => Promise< { roles: { id: string; @@ -69,45 +72,19 @@ export interface TPermissionDALFactory { temporaryAccessEndTime: Date | null | undefined; isTemporary: boolean; }[]; - orgId: string; - orgAuthEnforced: boolean | null | undefined; userId: string; - projectId: string; username: string; - projectType?: string | null; - id: string; - createdAt: Date; - updatedAt: Date; metadata: { id: string; key: string; value: string; }[]; - userGroupRoles: { - id: string; - role: string; - customRoleSlug: string; - permissions: unknown; - temporaryRange: string | null | undefined; - temporaryMode: string | null | undefined; - temporaryAccessStartTime: Date | null | undefined; - temporaryAccessEndTime: Date | null | undefined; - isTemporary: boolean; - }[]; - projectMembershipRoles: { - id: string; - role: string; - customRoleSlug: string; - permissions: unknown; - temporaryRange: string | null | undefined; - temporaryMode: string | null | undefined; - temporaryAccessStartTime: Date | null | undefined; - temporaryAccessEndTime: Date | null | undefined; - isTemporary: boolean; - }[]; }[] >; - getProjectIdentityPermissions: (projectId: string) => Promise< + getProjectIdentityPermissions: ( + projectId: string, + orgId: string + ) => Promise< { roles: { id: string; @@ -140,8 +117,6 @@ export interface TPermissionDALFactory { createdAt: Date; updatedAt: Date; orgId: string; - projectType?: string | null; - orgAuthEnforced: boolean; metadata: { id: string; key: string; @@ -363,7 +338,6 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { ] }); - console.log(">>>", data); return data; } catch (error) { throw new DatabaseError({ error, name: "Get Permission" }); @@ -381,7 +355,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { .where(`${TableName.Membership}.scope`, AccessScope.Project) .join(TableName.Groups, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`) .join(TableName.MembershipRole, `${TableName.MembershipRole}.membershipId`, `${TableName.Membership}.id`) - .leftJoin( + .leftJoin( { groupCustomRoles: TableName.Role }, `${TableName.MembershipRole}.customRoleId`, `groupCustomRoles.id` @@ -472,19 +446,19 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { } }; - // TODO(simp): this query is wrong and fix it const getProjectUserPermissions: TPermissionDALFactory["getProjectUserPermissions"] = async ( projectId: string, orgId: string ) => { - try { - const userGroupSubquery = db(TableName.Groups) - .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`) - .where(`${TableName.Groups}.orgId`, orgId) - .select(db.ref("id").withSchema(TableName.Groups)); + const userGroupSubquery = db(TableName.Groups) + .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`) + .where(`${TableName.Groups}.orgId`, orgId) + .select(db.ref("id").withSchema(TableName.Groups)); + try { const docs = await db - .replicaNode()(TableName.Membership) + .replicaNode()(TableName.Users) + .where("isGhost", "=", false) .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`) .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`) .leftJoin(TableName.AdditionalPrivilege, (qb) => { @@ -498,82 +472,54 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { .on(`${TableName.Membership}.actorUserId`, `${TableName.IdentityMetadata}.userId`) .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`); }) - .leftJoin( - TableName.UserGroupMembership, - `${TableName.UserGroupMembership}.groupId`, - `${TableName.Membership}.actorGroupId` - ) - .leftJoin(TableName.Users, (qb) => { - qb.on(`${TableName.Users}.id`, `${TableName.Membership}.actorUserId`).orOn( - `${TableName.Users}.id`, - `${TableName.UserGroupMembership}.groupId` - ); - }) .where(`${TableName.Membership}.scopeOrgId`, orgId) - .where(`${TableName.Membership}.scope`, AccessScope.Project) - .where(`${TableName.Membership}.scopeProjectId`, projectId) + .where((qb) => { + void qb + .whereNotNull(`${TableName.Membership}.actorUserId`) + .orWhereIn(`${TableName.Membership}.actorGroupId`, userGroupSubquery); + }) + .where((qb) => { + void qb + .where(`${TableName.Membership}.scope`, AccessScope.Project) + .where(`${TableName.Membership}.scopeProjectId`, projectId); + }) .select( db.ref("id").withSchema(TableName.Users).as("userId"), db.ref("username").withSchema(TableName.Users).as("username"), - // groups specific - db.ref("slug").withSchema("groupCustomRoles").as("userGroupProjectMembershipRoleCustomRoleSlug"), - db.ref("permissions").withSchema("groupCustomRoles").as("userGroupProjectMembershipRolePermission"), - db.ref("id").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleId"), - db.ref("role").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRole"), - db.ref("customRoleId").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleCustomRoleId"), - db.ref("isTemporary").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleIsTemporary"), - db - .ref("temporaryMode") - .withSchema(TableName.MembershipRole) - .as("userGroupProjectMembershipRoleTemporaryMode"), - db - .ref("temporaryRange") - .withSchema(TableName.MembershipRole) - .as("userGroupProjectMembershipRoleTemporaryRange"), + db.ref("slug").withSchema(TableName.Role).as("roleSlug"), + db.ref("permissions").withSchema(TableName.Role).as("customRolePermission"), + db.ref("id").withSchema(TableName.MembershipRole).as("membershipRoleId"), + db.ref("role").withSchema(TableName.MembershipRole).as("membershipRole"), + db.ref("temporaryMode").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryMode"), + db.ref("isTemporary").withSchema(TableName.MembershipRole).as("membershipRoleIsTemporary"), + db.ref("temporaryRange").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryRange"), db .ref("temporaryAccessStartTime") .withSchema(TableName.MembershipRole) - .as("userGroupProjectMembershipRoleTemporaryAccessStartTime"), + .as("membershipRoleTemporaryAccessStartTime"), db .ref("temporaryAccessEndTime") .withSchema(TableName.MembershipRole) - .as("userGroupProjectMembershipRoleTemporaryAccessEndTime"), - // user specific - db.ref("id").withSchema(TableName.Membership).as("membershipId"), - db.ref("createdAt").withSchema(TableName.Membership).as("membershipCreatedAt"), - db.ref("updatedAt").withSchema(TableName.Membership).as("membershipUpdatedAt"), - db.ref("slug").withSchema(TableName.Role).as("userProjectMembershipRoleCustomRoleSlug"), - db.ref("permissions").withSchema(TableName.Role).as("userProjectCustomRolePermission"), - db.ref("id").withSchema(TableName.Role).as("userProjectMembershipRoleId"), - db.ref("role").withSchema(TableName.Role).as("userProjectMembershipRole"), - db.ref("temporaryMode").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryMode"), - db.ref("isTemporary").withSchema(TableName.Role).as("userProjectMembershipRoleIsTemporary"), - db.ref("temporaryRange").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryRange"), - db - .ref("temporaryAccessStartTime") - .withSchema(TableName.Role) - .as("userProjectMembershipRoleTemporaryAccessStartTime"), - db - .ref("temporaryAccessEndTime") - .withSchema(TableName.Role) - .as("userProjectMembershipRoleTemporaryAccessEndTime"), - db.ref("id").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesId"), - db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesPermissions"), - db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesTemporaryMode"), - db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesIsTemporary"), - db - .ref("temporaryRange") - .withSchema(TableName.AdditionalPrivilege) - .as("userAdditionalPrivilegesTemporaryRange"), - db.ref("userId").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesUserId"), + .as("membershipRoleTemporaryAccessEndTime"), + db.ref("createdAt").withSchema(TableName.MembershipRole).as("membershipRoleCreatedAt"), + db.ref("updatedAt").withSchema(TableName.MembershipRole).as("membershipRoleUpdatedAt"), + db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"), + db.ref("name").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeName"), + db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegePermissions"), + db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"), + db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryMode"), + db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeIsTemporary"), + db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryRange"), db .ref("temporaryAccessStartTime") .withSchema(TableName.AdditionalPrivilege) - .as("userAdditionalPrivilegesTemporaryAccessStartTime"), + .as("additionalPrivilegeTemporaryAccessStartTime"), db .ref("temporaryAccessEndTime") .withSchema(TableName.AdditionalPrivilege) - .as("userAdditionalPrivilegesTemporaryAccessEndTime"), + .as("additionalPrivilegeTemporaryAccessEndTime"), + db.ref("createdAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeCreatedAt"), + db.ref("updatedAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeUpdatedAt"), // general db.ref("id").withSchema(TableName.IdentityMetadata).as("metadataId"), db.ref("key").withSchema(TableName.IdentityMetadata).as("metadataKey"), @@ -583,84 +529,64 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { const userPermissions = sqlNestRelationships({ data: docs, key: "userId", - parentMapper: ({ username, membershipId, membershipCreatedAt, membershipUpdatedAt, userId }) => ({ + parentMapper: ({ username, userId }) => ({ userId, projectId, - username, - id: membershipId, - createdAt: membershipCreatedAt, - updatedAt: membershipUpdatedAt + username }), childrenMapper: [ { - key: "userGroupProjectMembershipRoleId", - label: "userGroupRoles" as const, - mapper: ({ - userGroupProjectMembershipRoleId, - userGroupProjectMembershipRole, - userGroupProjectMembershipRolePermission, - userGroupProjectMembershipRoleCustomRoleSlug, - userGroupProjectMembershipRoleIsTemporary, - userGroupProjectMembershipRoleTemporaryMode, - userGroupProjectMembershipRoleTemporaryAccessEndTime, - userGroupProjectMembershipRoleTemporaryAccessStartTime, - userGroupProjectMembershipRoleTemporaryRange - }) => ({ - id: userGroupProjectMembershipRoleId, - role: userGroupProjectMembershipRole, - customRoleSlug: userGroupProjectMembershipRoleCustomRoleSlug, - permissions: userGroupProjectMembershipRolePermission, - temporaryRange: userGroupProjectMembershipRoleTemporaryRange, - temporaryMode: userGroupProjectMembershipRoleTemporaryMode, - temporaryAccessStartTime: userGroupProjectMembershipRoleTemporaryAccessStartTime, - temporaryAccessEndTime: userGroupProjectMembershipRoleTemporaryAccessEndTime, - isTemporary: userGroupProjectMembershipRoleIsTemporary - }) - }, - { - key: "userProjectMembershipRoleId", - label: "projectMembershipRoles" as const, - mapper: ({ - userProjectMembershipRoleId, - userProjectMembershipRole, - userProjectCustomRolePermission, - userProjectMembershipRoleIsTemporary, - userProjectMembershipRoleTemporaryMode, - userProjectMembershipRoleTemporaryRange, - userProjectMembershipRoleTemporaryAccessEndTime, - userProjectMembershipRoleTemporaryAccessStartTime, - userProjectMembershipRoleCustomRoleSlug - }) => ({ - id: userProjectMembershipRoleId, - role: userProjectMembershipRole, - customRoleSlug: userProjectMembershipRoleCustomRoleSlug, - permissions: userProjectCustomRolePermission, - temporaryRange: userProjectMembershipRoleTemporaryRange, - temporaryMode: userProjectMembershipRoleTemporaryMode, - temporaryAccessStartTime: userProjectMembershipRoleTemporaryAccessStartTime, - temporaryAccessEndTime: userProjectMembershipRoleTemporaryAccessEndTime, - isTemporary: userProjectMembershipRoleIsTemporary - }) - }, - { - key: "userAdditionalPrivilegesId", + key: "additionalPrivilegeId", label: "additionalPrivileges" as const, mapper: ({ - userAdditionalPrivilegesId, - userAdditionalPrivilegesPermissions, - userAdditionalPrivilegesIsTemporary, - userAdditionalPrivilegesTemporaryMode, - userAdditionalPrivilegesTemporaryRange, - userAdditionalPrivilegesTemporaryAccessEndTime, - userAdditionalPrivilegesTemporaryAccessStartTime + additionalPrivilegeId, + additionalPrivilegePermissions, + additionalPrivilegeIsTemporary, + additionalPrivilegeTemporaryMode, + additionalPrivilegeTemporaryRange, + additionalPrivilegeTemporaryAccessEndTime, + additionalPrivilegeTemporaryAccessStartTime, + additionalPrivilegeCreatedAt, + additionalPrivilegeUpdatedAt }) => ({ - id: userAdditionalPrivilegesId, - permissions: userAdditionalPrivilegesPermissions, - temporaryRange: userAdditionalPrivilegesTemporaryRange, - temporaryMode: userAdditionalPrivilegesTemporaryMode, - temporaryAccessStartTime: userAdditionalPrivilegesTemporaryAccessStartTime, - temporaryAccessEndTime: userAdditionalPrivilegesTemporaryAccessEndTime, - isTemporary: userAdditionalPrivilegesIsTemporary + id: additionalPrivilegeId, + permissions: additionalPrivilegePermissions, + temporaryRange: additionalPrivilegeTemporaryRange, + temporaryMode: additionalPrivilegeTemporaryMode, + temporaryAccessStartTime: additionalPrivilegeTemporaryAccessStartTime, + temporaryAccessEndTime: additionalPrivilegeTemporaryAccessEndTime, + isTemporary: additionalPrivilegeIsTemporary, + createdAt: additionalPrivilegeCreatedAt, + updatedAt: additionalPrivilegeUpdatedAt + }) + }, + { + key: "membershipRoleId", + label: "roles" as const, + mapper: ({ + roleSlug, + customRolePermission, + membershipRoleId, + membershipRole, + membershipRoleIsTemporary, + membershipRoleTemporaryMode, + membershipRoleTemporaryRange, + membershipRoleTemporaryAccessEndTime, + membershipRoleTemporaryAccessStartTime, + membershipRoleCreatedAt, + membershipRoleUpdatedAt + }) => ({ + id: membershipRoleId, + role: membershipRole, + permissions: customRolePermission, + customRoleSlug: roleSlug, + temporaryRange: membershipRoleTemporaryRange, + temporaryMode: membershipRoleTemporaryMode, + temporaryAccessStartTime: membershipRoleTemporaryAccessStartTime, + temporaryAccessEndTime: membershipRoleTemporaryAccessEndTime, + isTemporary: membershipRoleIsTemporary, + createdAt: membershipRoleCreatedAt, + updatedAt: membershipRoleUpdatedAt }) }, { @@ -678,17 +604,11 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { return userPermissions .map((userPermission) => { if (!userPermission) return undefined; - if (!userPermission?.userGroupRoles?.[0] && !userPermission?.projectMembershipRoles?.[0]) return undefined; + if (!userPermission?.roles?.[0]) return undefined; // when introducting cron mode change it here const activeRoles = - userPermission?.projectMembershipRoles?.filter( - ({ isTemporary, temporaryAccessEndTime }) => - !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime) - ) ?? []; - - const activeGroupRoles = - userPermission?.userGroupRoles?.filter( + userPermission?.roles?.filter( ({ isTemporary, temporaryAccessEndTime }) => !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime) ) ?? []; @@ -701,7 +621,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => { return { ...userPermission, - roles: [...activeRoles, ...activeGroupRoles], + roles: activeRoles, additionalPrivileges: activeAdditionalPrivileges }; }) diff --git a/backend/src/ee/services/permission/permission-service-types.ts b/backend/src/ee/services/permission/permission-service-types.ts index 321dad609..c333e5784 100644 --- a/backend/src/ee/services/permission/permission-service-types.ts +++ b/backend/src/ee/services/permission/permission-service-types.ts @@ -74,25 +74,24 @@ export type TPermissionServiceFactory = { memberships: Array; hasRole: (role: string) => boolean; }>; - // TODO(simp): check what is this doing - getProjectPermissions: (projectId: string) => Promise<{ + getProjectPermissions: ( + projectId: string, + orgId: string + ) => Promise<{ userPermissions: { permission: MongoAbility; id: string; name: string; - membershipId: string; }[]; identityPermissions: { permission: MongoAbility; id: string; name: string; - membershipId: string; }[]; groupPermissions: { permission: MongoAbility; id: string; name: string; - membershipId: string; }[]; }>; getOrgPermissionByRoles: ( diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts index 2564bf264..a1b6bc7ce 100644 --- a/backend/src/ee/services/permission/permission-service.ts +++ b/backend/src/ee/services/permission/permission-service.ts @@ -350,6 +350,7 @@ export const permissionServiceFactory = ({ actorType: actor }); if (!permissionData?.length) throw new ForbiddenRequestError({ name: "You are not member of this organization" }); + const permissionFromRoles = permissionData.flatMap((membership) => { const activeRoles = membership?.roles .filter( @@ -426,9 +427,9 @@ export const permissionServiceFactory = ({ }; }; - const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId) => { + const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId, orgId) => { // fetch user permissions - const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId); + const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId, orgId); const userPermissions = rawUserProjectPermissions.map((userProjectPermission) => { const rolePermissions = userProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || []; @@ -468,13 +469,12 @@ export const permissionServiceFactory = ({ return { permission, id: userProjectPermission.userId, - name: userProjectPermission.username, - membershipId: userProjectPermission.id + name: userProjectPermission.username }; }); // fetch identity permissions - const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId); + const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId, orgId); const identityPermissions = rawIdentityProjectPermissions.map((identityProjectPermission) => { const rolePermissions = identityProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || []; @@ -514,8 +514,7 @@ export const permissionServiceFactory = ({ return { permission, id: identityProjectPermission.identityId, - name: identityProjectPermission.username, - membershipId: identityProjectPermission.id + name: identityProjectPermission.username }; }); @@ -532,8 +531,7 @@ export const permissionServiceFactory = ({ return { permission, id: groupProjectPermission.groupId, - name: groupProjectPermission.username, - membershipId: groupProjectPermission.id + name: groupProjectPermission.username }; }); diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts index 01caef223..42e6da268 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts @@ -2,9 +2,10 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { + AccessScope, SecretApprovalRequestsSchema, TableName, - TOrgMemberships, + TMemberships, TSecretApprovalRequests, TSecretApprovalRequestsSecrets, TUserGroupMembership, @@ -109,24 +110,26 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => { `secretApprovalReviewerUser.id` ) - .leftJoin( - db(TableName.OrgMembership).as("approverOrgMembership"), - `${TableName.SecretApprovalPolicyApprover}.approverUserId`, - `approverOrgMembership.userId` - ) + .leftJoin(db(TableName.Membership).as("approverOrgMembership"), (qb) => { + qb.on(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, `approverOrgMembership.actorUserId`).andOn( + `approverOrgMembership.scope`, + db.raw("?", [AccessScope.Organization]) + ); + }) - .leftJoin( - db(TableName.OrgMembership).as("approverGroupOrgMembership"), - `secretApprovalPolicyGroupApproverUser.id`, - `approverGroupOrgMembership.userId` - ) - - .leftJoin( - db(TableName.OrgMembership).as("reviewerOrgMembership"), - `${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, - `reviewerOrgMembership.userId` - ) + .leftJoin(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => { + qb.on(`secretApprovalPolicyGroupApproverUser.id`, `approverGroupOrgMembership.actorUserId`).andOn( + `approverGroupOrgMembership.scope`, + db.raw("?", [AccessScope.Organization]) + ); + }) + .leftJoin(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => { + qb.on(`${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, `reviewerOrgMembership.actorUserId`).andOn( + `reviewerOrgMembership.scope`, + db.raw("?", [AccessScope.Organization]) + ); + }) .select(selectAllTableCols(TableName.SecretApprovalRequest)) .select( tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover), diff --git a/backend/src/server/routes/v1/admin-router.ts b/backend/src/server/routes/v1/admin-router.ts index 03dd8ed94..ddb3f2326 100644 --- a/backend/src/server/routes/v1/admin-router.ts +++ b/backend/src/server/routes/v1/admin-router.ts @@ -5,6 +5,7 @@ import { IdentitiesSchema, OrganizationsSchema, OrgMembershipsSchema, + OrgMembershipStatus, SuperAdminSchema, UsersSchema } from "@app/db/schemas"; @@ -279,7 +280,10 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => { ); return { - organizationMembership + organizationMembership: { + ...organizationMembership, + status: organizationMembership?.status || OrgMembershipStatus.Accepted + } }; } }); @@ -892,7 +896,13 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => { }, handler: async (req) => { const organizationMembership = await server.services.superAdmin.resendOrgInvite(req.params, req.permission); - return { organizationMembership }; + + return { + organizationMembership: { + ...organizationMembership, + status: organizationMembership?.status || OrgMembershipStatus.Accepted + } + }; } }); @@ -922,7 +932,12 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => { req.params.organizationId, req.permission ); - return { organizationMembership }; + return { + organizationMembership: { + ...organizationMembership, + status: organizationMembership?.status || OrgMembershipStatus.Accepted + } + }; } }); diff --git a/backend/src/server/routes/v1/deprecated-project-membership-router.ts b/backend/src/server/routes/v1/deprecated-project-membership-router.ts index a04eeedd1..25e07a466 100644 --- a/backend/src/server/routes/v1/deprecated-project-membership-router.ts +++ b/backend/src/server/routes/v1/deprecated-project-membership-router.ts @@ -4,6 +4,7 @@ import { AccessScope, OrgMembershipRole, OrgMembershipsSchema, + OrgMembershipStatus, ProjectMembershipsSchema, ProjectUserMembershipRolesSchema, TemporaryPermissionMode, @@ -275,7 +276,12 @@ export const registerDeprecatedProjectMembershipRouter = async (server: FastifyZ }); return { - data: data.map((el) => ({ ...el, orgId: req.permission.orgId, role: OrgMembershipRole.Member })), + data: data.map((el) => ({ + ...el, + orgId: req.permission.orgId, + role: OrgMembershipRole.Member, + status: el.status || OrgMembershipStatus.Accepted + })), success: true }; } diff --git a/backend/src/server/routes/v1/organization-router.ts b/backend/src/server/routes/v1/organization-router.ts index b8eb3ad6b..872b7b157 100644 --- a/backend/src/server/routes/v1/organization-router.ts +++ b/backend/src/server/routes/v1/organization-router.ts @@ -6,6 +6,7 @@ import { GroupsSchema, IncidentContactsSchema, OrgMembershipsSchema, + OrgMembershipStatus, OrgRolesSchema, UsersSchema } from "@app/db/schemas"; @@ -263,7 +264,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { req.permission.authMethod, req.permission.orgId ); - return { users }; + return { users: users.map((el) => ({ ...el, status: el.status || OrgMembershipStatus.Accepted })) }; } }); diff --git a/backend/src/server/routes/v2/organization-router.ts b/backend/src/server/routes/v2/organization-router.ts index 1d9ebe8b3..2db7b90b1 100644 --- a/backend/src/server/routes/v2/organization-router.ts +++ b/backend/src/server/routes/v2/organization-router.ts @@ -2,6 +2,7 @@ import { z } from "zod"; import { OrgMembershipsSchema, + OrgMembershipStatus, ProjectMembershipsSchema, ProjectsSchema, UserEncryptionKeysSchema, @@ -63,7 +64,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { req.permission.authMethod, req.permission.orgId ); - return { users }; + return { users: users.map((el) => ({ ...el, status: el.status || OrgMembershipStatus.Accepted })) }; } }); @@ -168,7 +169,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { orgId: req.params.organizationId, membershipId: req.params.membershipId }); - return { membership }; + return { membership: { ...membership, status: membership.status || OrgMembershipStatus.Accepted } }; } }); @@ -224,7 +225,8 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { membership: { ...membership, role: "", - orgId: req.params.organizationId + orgId: req.params.organizationId, + status: membership.status || OrgMembershipStatus.Accepted } }; } @@ -269,6 +271,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { return { membership: { ...membership, + status: membership.status || OrgMembershipStatus.Accepted, role: "", orgId: req.params.organizationId } @@ -317,6 +320,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { return { memberships: memberships.map((el) => ({ ...el, + status: el?.status || OrgMembershipStatus.Accepted, role: "", orgId: req.params.organizationId })) diff --git a/backend/src/services/additional-privilege/additional-privilege-dal.ts b/backend/src/services/additional-privilege/additional-privilege-dal.ts index e3f181e44..b11bd90d6 100644 --- a/backend/src/services/additional-privilege/additional-privilege-dal.ts +++ b/backend/src/services/additional-privilege/additional-privilege-dal.ts @@ -1,21 +1,11 @@ import { TDbClient } from "@app/db"; import { TableName } from "@app/db/schemas"; -import { ormify, selectAllTableCols } from "@app/lib/knex"; +import { ormify } from "@app/lib/knex"; export type TAdditionalPrivilegeDALFactory = ReturnType; export const additionalPrivilegeDALFactory = (db: TDbClient) => { const orm = ormify(db, TableName.AdditionalPrivilege); - const getMembershipById = async (privilegeId: string) => { - const doc = await db - .replicaNode()(TableName.AdditionalPrivilege) - .join(TableName.Membership, `${TableName.AdditionalPrivilege}.membershipId`, `${TableName.Membership}.id`) - .select(selectAllTableCols(TableName.Membership)) - .where(`${TableName.AdditionalPrivilege}.id`, privilegeId) - .first(); - return doc; - }; - - return { ...orm, getMembershipById }; + return orm; }; diff --git a/backend/src/services/convertor/convertor-service.ts b/backend/src/services/convertor/convertor-service.ts index e049ef504..fe33c3ae8 100644 --- a/backend/src/services/convertor/convertor-service.ts +++ b/backend/src/services/convertor/convertor-service.ts @@ -1,14 +1,14 @@ import { AccessScope } from "@app/db/schemas"; import { NotFoundError } from "@app/lib/errors"; +import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal"; import { TMembershipDALFactory } from "../membership/membership-dal"; import { TProjectDALFactory } from "../project/project-dal"; -import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal"; type TConvertorServiceFactoryDep = { projectDAL: Pick; membershipDAL: Pick; - additionalPrivilegeDAL: Pick; + additionalPrivilegeDAL: Pick; }; export type TConvertorServiceFactory = ReturnType; diff --git a/backend/src/services/group-project/group-project-dal.ts b/backend/src/services/group-project/group-project-dal.ts index c89144b69..d4a093b83 100644 --- a/backend/src/services/group-project/group-project-dal.ts +++ b/backend/src/services/group-project/group-project-dal.ts @@ -139,7 +139,7 @@ export const groupProjectDALFactory = (db: TDbClient) => { .join(TableName.MembershipRole, `${TableName.MembershipRole}.membershipId`, `${TableName.Membership}.id`) .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`) .join(db(TableName.Membership).as("orgMembership"), (qb) => { - qb.on(`${TableName.Users}.id`, `orgMembership.userId`) + qb.on(`${TableName.Users}.id`, `orgMembership.actorUserId`) .andOn(`orgMembership.scope`, db.raw("?", [AccessScope.Organization])) .andOn(`orgMembership.scopeOrgId`, `${TableName.Project}.orgId`); }) diff --git a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts index d78616662..43584a1af 100644 --- a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts +++ b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts @@ -18,9 +18,9 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { logger } from "@app/lib/logger"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityAliCloudAuthDALFactory } from "./identity-alicloud-auth-dal"; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts index 20cb178c5..8793c3a00 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts @@ -5,7 +5,6 @@ import RE2 from "re2"; import { AccessScope, IdentityAuthMethod } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -18,9 +17,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityAwsAuthDALFactory } from "./identity-aws-auth-dal"; import { extractPrincipalArn, extractPrincipalArnEntity } from "./identity-aws-auth-fns"; diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts index 485cc26da..b3250ed56 100644 --- a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts +++ b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts @@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability"; import { AccessScope, IdentityAuthMethod } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityAzureAuthDALFactory } from "./identity-azure-auth-dal"; import { validateAzureIdentity } from "./identity-azure-auth-fns"; diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts index bf0f1c069..fe7b9b6d7 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts @@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability"; import { AccessScope, IdentityAuthMethod } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityGcpAuthDALFactory } from "./identity-gcp-auth-dal"; import { validateIamIdentity, validateIdTokenIdentity } from "./identity-gcp-auth-fns"; diff --git a/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts b/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts index 38d59cd5a..a99c8ad78 100644 --- a/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts +++ b/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts @@ -5,7 +5,6 @@ import { JwksClient } from "jwks-rsa"; import { AccessScope, IdentityAuthMethod, TIdentityJwtAuthsUpdate } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -25,11 +24,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { getValueByDot } from "@app/lib/template/dot-access"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityJwtAuthDALFactory } from "./identity-jwt-auth-dal"; import { doesFieldValueMatchJwtPolicy } from "./identity-jwt-auth-fns"; diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts index c61d46677..952b1e31d 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts @@ -9,7 +9,6 @@ import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service import { TGatewayV2DALFactory } from "@app/ee/services/gateway-v2/gateway-v2-dal"; import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionGatewayActions, OrgPermissionIdentityActions, @@ -29,11 +28,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { logger } from "@app/lib/logger"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityKubernetesAuthDALFactory } from "./identity-kubernetes-auth-dal"; import { extractK8sUsername } from "./identity-kubernetes-auth-fns"; diff --git a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts index a545ca930..1a8ea3ed6 100644 --- a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts +++ b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts @@ -6,7 +6,6 @@ import { AccessScope, IdentityAuthMethod } from "@app/db/schemas"; import { TIdentityAuthTemplateDALFactory } from "@app/ee/services/identity-auth-template"; import { testLDAPConfig } from "@app/ee/services/ldap-config/ldap-fns"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionMachineIdentityAuthTemplateActions, @@ -32,11 +31,12 @@ import { logger } from "@app/lib/logger"; import { ActorType, AuthTokenType } from "../auth/auth-type"; import { TIdentityDALFactory } from "../identity/identity-dal"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityLdapAuthDALFactory } from "./identity-ldap-auth-dal"; import { diff --git a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts index dabd79195..bfac3d158 100644 --- a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts +++ b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts @@ -19,9 +19,10 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { logger } from "@app/lib/logger"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityOciAuthDALFactory } from "./identity-oci-auth-dal"; import { @@ -32,7 +33,6 @@ import { TRevokeOciAuthDTO, TUpdateOciAuthDTO } from "./identity-oci-auth-types"; -import { TOrgDALFactory } from "../org/org-dal"; type TIdentityOciAuthServiceFactoryDep = { identityAccessTokenDAL: Pick; diff --git a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts index f88bfa94f..e2dddf7ec 100644 --- a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts +++ b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts @@ -6,7 +6,6 @@ import { JwksClient } from "jwks-rsa"; import { AccessScope, IdentityAuthMethod, TIdentityOidcAuthsUpdate } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -26,11 +25,12 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { getValueByDot } from "@app/lib/template/dot-access"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityOidcAuthDALFactory } from "./identity-oidc-auth-dal"; import { doesAudValueMatchOidcPolicy, doesFieldValueMatchOidcPolicy } from "./identity-oidc-auth-fns"; diff --git a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts index 9d26a8be8..54d2146cd 100644 --- a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts +++ b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts @@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability"; import { AccessScope, IdentityAuthMethod } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -16,11 +15,12 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedEr import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityTlsCertAuthDALFactory } from "./identity-tls-cert-auth-dal"; import { TIdentityTlsCertAuthServiceFactory } from "./identity-tls-cert-auth-types"; diff --git a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts index 3df5713e5..eb9f4ab5d 100644 --- a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts +++ b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts @@ -1,4 +1,4 @@ -import { TIdentityAccessTokens, TMemberships, TIdentityTlsCertAuths } from "@app/db/schemas"; +import { TIdentityAccessTokens, TIdentityTlsCertAuths, TMemberships } from "@app/db/schemas"; import { TProjectPermission } from "@app/lib/types"; export type TLoginTlsCertAuthDTO = { diff --git a/backend/src/services/identity-token-auth/identity-token-auth-service.ts b/backend/src/services/identity-token-auth/identity-token-auth-service.ts index 1c0dd30e0..2ae05cb97 100644 --- a/backend/src/services/identity-token-auth/identity-token-auth-service.ts +++ b/backend/src/services/identity-token-auth/identity-token-auth-service.ts @@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability"; import { AccessScope, IdentityAuthMethod, TableName } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; -import { TOrgDALFactory } from "../org/org-dal"; import { OrgPermissionIdentityActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { constructPermissionErrorMessage, @@ -15,9 +14,10 @@ import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/li import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; +import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityTokenAuthDALFactory } from "./identity-token-auth-dal"; import { diff --git a/backend/src/services/identity/identity-service.ts b/backend/src/services/identity/identity-service.ts index cd272e807..3bad42b75 100644 --- a/backend/src/services/identity/identity-service.ts +++ b/backend/src/services/identity/identity-service.ts @@ -12,6 +12,8 @@ import { TKeyStoreFactory } from "@app/keystore/keystore"; import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors"; import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal"; +import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; +import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; import { TOrgDALFactory } from "../org/org-dal"; import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns"; import { TIdentityDALFactory } from "./identity-dal"; @@ -26,8 +28,6 @@ import { TSearchOrgIdentitiesByOrgIdDTO, TUpdateIdentityDTO } from "./identity-types"; -import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal"; -import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; type TIdentityServiceFactoryDep = { identityDAL: TIdentityDALFactory; diff --git a/backend/src/services/membership-group/project/project-membership-group-factory.ts b/backend/src/services/membership-group/project/project-membership-group-factory.ts index 54394a697..6900e3755 100644 --- a/backend/src/services/membership-group/project/project-membership-group-factory.ts +++ b/backend/src/services/membership-group/project/project-membership-group-factory.ts @@ -23,7 +23,6 @@ type TProjectMembershipGroupScopeFactoryDep = { membershipGroupDAL: Pick; }; -// TODO(simp): check for group in org export const newProjectMembershipGroupFactory = ({ permissionService, orgDAL, diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts index 7a2d98c13..9fa0be700 100644 --- a/backend/src/services/org/org-dal.ts +++ b/backend/src/services/org/org-dal.ts @@ -638,7 +638,6 @@ export const orgDALFactory = (db: TDbClient) => { } }; - // TODO(simp): resolve this role field later const findIdentityOrganization = async ( identityId: string ): Promise<{ id: string; name: string; slug: string; role: string }> => { diff --git a/backend/src/services/project-membership/project-membership-service.ts b/backend/src/services/project-membership/project-membership-service.ts index a2cbcc43e..c6e1b86d1 100644 --- a/backend/src/services/project-membership/project-membership-service.ts +++ b/backend/src/services/project-membership/project-membership-service.ts @@ -385,8 +385,6 @@ export const projectMembershipServiceFactory = ({ tx ); - // TODO(simp): likewise check in all services if i am missing anything - // Deletion should handle all cleanups like wise await secretReminderRecipientsDAL.delete( { projectId, diff --git a/backend/src/services/project/project-queue.ts b/backend/src/services/project/project-queue.ts index 9986f7ab9..30ec6d29f 100644 --- a/backend/src/services/project/project-queue.ts +++ b/backend/src/services/project/project-queue.ts @@ -30,6 +30,8 @@ import { logger } from "@app/lib/logger"; import { QueueJobs, QueueName, TQueueJobTypes, TQueueServiceFactory } from "@app/queue"; import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal"; +import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; +import { TMembershipUserDALFactory } from "../membership-user/membership-user-dal"; import { TOrgDALFactory } from "../org/org-dal"; import { TOrgServiceFactory } from "../org/org-service"; import { TProjectBotDALFactory } from "../project-bot/project-bot-dal"; @@ -41,8 +43,6 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TUserDALFactory } from "../user/user-dal"; import { TProjectDALFactory } from "./project-dal"; import { assignWorkspaceKeysToMembers, createProjectKey } from "./project-fns"; -import { TMembershipUserDALFactory } from "../membership-user/membership-user-dal"; -import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; export type TProjectQueueFactory = ReturnType; diff --git a/backend/src/services/role/org/org-role-factory.ts b/backend/src/services/role/org/org-role-factory.ts index d7c2fb12d..44fda1991 100644 --- a/backend/src/services/role/org/org-role-factory.ts +++ b/backend/src/services/role/org/org-role-factory.ts @@ -10,9 +10,9 @@ import { } from "@app/ee/services/permission/org-permission"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types"; import { BadRequestError } from "@app/lib/errors"; +import { isCustomOrgRole } from "@app/services/org/org-role-fns"; import { TRoleScopeFactory } from "../role-types"; -import { isCustomOrgRole } from "@app/services/org/org-role-fns"; // TODO(simp): missing external group checking type TOrgRoleScopeFactoryDep = { diff --git a/backend/src/services/role/project/project-role-factory.ts b/backend/src/services/role/project/project-role-factory.ts index db34d54de..2ab4e59d0 100644 --- a/backend/src/services/role/project/project-role-factory.ts +++ b/backend/src/services/role/project/project-role-factory.ts @@ -1,16 +1,7 @@ -import { v4 as uuidv4 } from "uuid"; import { ForbiddenError } from "@casl/ability"; +import { v4 as uuidv4 } from "uuid"; import { AccessScope, ActionProjectType, ProjectMembershipRole, ProjectType } from "@app/db/schemas"; -import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types"; -import { - isCustomProjectRole, - ProjectPermissionActions, - ProjectPermissionSub -} from "@app/ee/services/permission/project-permission"; -import { BadRequestError } from "@app/lib/errors"; - -import { TRoleScopeFactory } from "../role-types"; import { cryptographicOperatorPermissions, projectAdminPermissions, @@ -19,8 +10,17 @@ import { projectViewerPermission, sshHostBootstrapPermissions } from "@app/ee/services/permission/default-roles"; +import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types"; +import { + isCustomProjectRole, + ProjectPermissionActions, + ProjectPermissionSub +} from "@app/ee/services/permission/project-permission"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { TRoleScopeFactory } from "../role-types"; + type TProjectRoleScopeFactoryDep = { permissionService: Pick; projectDAL: Pick; diff --git a/backend/src/services/role/role-service.ts b/backend/src/services/role/role-service.ts index 741b7ec9c..41a612a05 100644 --- a/backend/src/services/role/role-service.ts +++ b/backend/src/services/role/role-service.ts @@ -1,9 +1,16 @@ +import { packRules } from "@casl/ability/extra"; +import { requestContext } from "@fastify/request-context"; + import { AccessScope, ActionProjectType, TableName } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars"; import { UnpackedPermissionSchema, unpackPermissions } from "@app/server/routes/sanitizedSchema/permission"; +import { ActorType } from "../auth/auth-type"; +import { TIdentityDALFactory } from "../identity/identity-dal"; +import { TProjectDALFactory } from "../project/project-dal"; +import { TUserDALFactory } from "../user/user-dal"; import { newNamespaceRoleFactory } from "./namespace/namespace-role-factory"; import { newOrgRoleFactory } from "./org/org-role-factory"; import { newProjectRoleFactory } from "./project/project-role-factory"; @@ -17,12 +24,6 @@ import { TListRoleDTO, TUpdateRoleDTO } from "./role-types"; -import { TProjectDALFactory } from "../project/project-dal"; -import { packRules } from "@casl/ability/extra"; -import { requestContext } from "@fastify/request-context"; -import { TIdentityDALFactory } from "../identity/identity-dal"; -import { TUserDALFactory } from "../user/user-dal"; -import { ActorType } from "../auth/auth-type"; type TRoleServiceFactoryDep = { roleDAL: TRoleDALFactory; diff --git a/backend/src/services/role/role-types.ts b/backend/src/services/role/role-types.ts index 522b805eb..96fc9c0f3 100644 --- a/backend/src/services/role/role-types.ts +++ b/backend/src/services/role/role-types.ts @@ -1,6 +1,7 @@ +import { MongoAbility, RawRuleOf } from "@casl/ability"; + import { AccessScopeData, TRoles } from "@app/db/schemas"; import { OrgServiceActor } from "@app/lib/types"; -import { MongoAbility, RawRuleOf } from "@casl/ability"; export interface TRoleScopeFactory { onCreateRoleGuard: (arg: TCreateRoleDTO) => Promise; diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index bca645836..61507d127 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -44,6 +44,8 @@ import { TIntegrationAuthServiceFactory } from "../integration-auth/integration- import { syncIntegrationSecrets } from "../integration-auth/integration-sync-secret"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; +import { TMembershipDALFactory } from "../membership/membership-dal"; +import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; import { TOrgServiceFactory } from "../org/org-service"; import { TProjectDALFactory } from "../project/project-dal"; import { createProjectKey } from "../project/project-fns"; @@ -76,8 +78,6 @@ import { TRemoveSecretReminderDTO, TSyncSecretsDTO } from "./secret-types"; -import { TMembershipDALFactory } from "../membership/membership-dal"; -import { TMembershipRoleDALFactory } from "../membership/membership-role-dal"; export type TSecretQueueFactory = ReturnType; type TSecretQueueFactoryDep = { diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 3a5ccc667..723cd368c 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1283,7 +1283,8 @@ export const secretServiceFactory = ({ }); const { userPermissions, identityPermissions, groupPermissions } = await permissionService.getProjectPermissions( - dto.projectId + dto.projectId, + dto.actorOrgId ); const attachAllowedActions = ( diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts index 6dc59762d..4f912fad2 100644 --- a/frontend/src/hooks/api/secrets/types.ts +++ b/frontend/src/hooks/api/secrets/types.ts @@ -266,6 +266,5 @@ export type TSecretReferenceTraceNode = { export type SecretAccessListEntry = { allowedActions: ProjectPermissionActions[]; id: string; - membershipId: string; name: string; }; diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx index d423264b5..3fd25e423 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx @@ -746,18 +746,9 @@ export const SecretDetailSidebar = ({ .join(", ")} className="z-[100] capitalize" > - +
{user.name} - +
))}