feat: lint and finally completed

2026-10-15 14:27:23 +00:00 · 2025-10-10 00:09:46 +05:30
parent 44b50c93c3
commit 0d221f497d
47 changed files with 272 additions and 349 deletions
@@ -1,7 +1,7 @@
 import { packRules } from "@casl/ability/extra";
 import { z } from "zod";

-import { AccessScope, OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
+import { AccessScope, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { OrgPermissionSchema } from "@app/ee/services/permission/org-permission";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -11,7 +11,6 @@ const AccessListEntrySchema = z
  .object({
    allowedActions: z.nativeEnum(ProjectPermissionSecretActions).array(),
    id: z.string(),
-    membershipId: z.string(),
    name: z.string()
  })
  .array();
@@ -5,6 +5,8 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
+import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
+import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
@@ -28,8 +30,6 @@ import {
  TListAccessApprovalPoliciesDTO,
  TUpdateAccessApprovalPolicy
 } from "./access-approval-policy-types";
-import { TMembershipUserDALFactory } from "@app/services/membership-user/membership-user-dal";
-import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";

 type TAccessApprovalPolicyServiceFactoryDep = {
  projectDAL: TProjectDALFactory;
@@ -3,9 +3,10 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import {
  AccessApprovalRequestsSchema,
+  AccessScope,
  TableName,
  TAccessApprovalRequests,
-  TOrgMemberships,
+  TMemberships,
  TUserGroupMembership,
  TUsers
 } from "@app/db/schemas";
@@ -238,7 +239,6 @@ export interface TAccessApprovalRequestDALFactory extends Omit<TOrmify<TableName
 export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalRequestDALFactory => {
  const accessApprovalRequestOrm = ormify(db, TableName.AccessApprovalRequest);

-  // TODO(simp): check this from begginging
  const findRequestsWithPrivilegeByPolicyIds: TAccessApprovalRequestDALFactory["findRequestsWithPrivilegeByPolicyIds"] =
    async (policyIds) => {
      try {
@@ -293,24 +293,24 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
            `requestedByUser.id`
          )

-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("approverOrgMembership"),
-            `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
-            `approverOrgMembership.userId`
-          )
-
-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("approverGroupOrgMembership"),
-            `${TableName.Users}.id`,
-            `approverGroupOrgMembership.userId`
-          )
-
-          .leftJoin<TOrgMemberships>(
-            db(TableName.OrgMembership).as("reviewerOrgMembership"),
-            `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`,
-            `reviewerOrgMembership.userId`
-          )
-
+          .leftJoin<TMemberships>(db(TableName.Membership).as("approverOrgMembership"), (qb) => {
+            qb.on(
+              `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
+              `approverOrgMembership.actorUserId`
+            ).andOn(`approverOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
+          })
+          .leftJoin<TMemberships>(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => {
+            qb.on(`${TableName.Users}.id`, `approverGroupOrgMembership.actorUserId`).andOn(
+              `approverGroupOrgMembership.scope`,
+              db.raw("?", [AccessScope.Organization])
+            );
+          })
+          .leftJoin<TMemberships>(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => {
+            qb.on(
+              `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`,
+              `reviewerOrgMembership.actorUserId`
+            ).andOn(`reviewerOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
+          })
          .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)

          .select(selectAllTableCols(TableName.AccessApprovalRequest))
@@ -359,22 +359,22 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
            db.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
            db.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),

-            db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeUserId"),
-            db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeMembershipId"),
+            db.ref("actorUserId").withSchema(TableName.AdditionalPrivilege).as("privilegeUserId"),
+            db.ref("projectId").withSchema(TableName.AdditionalPrivilege).as("privilegeMembershipId"),

-            db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeIsTemporary"),
-            db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryMode"),
-            db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryRange"),
+            db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("privilegeIsTemporary"),
+            db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryMode"),
+            db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("privilegeTemporaryRange"),
            db
              .ref("temporaryAccessStartTime")
-              .withSchema(TableName.ProjectUserAdditionalPrivilege)
+              .withSchema(TableName.AdditionalPrivilege)
              .as("privilegeTemporaryAccessStartTime"),
            db
              .ref("temporaryAccessEndTime")
-              .withSchema(TableName.ProjectUserAdditionalPrivilege)
+              .withSchema(TableName.AdditionalPrivilege)
              .as("privilegeTemporaryAccessEndTime"),

-            db.ref("permissions").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegePermissions")
+            db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("privilegePermissions")
          )
          .orderBy(`${TableName.AccessApprovalRequest}.createdAt`, "desc");

@@ -407,7 +407,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
            privilege: doc.privilegeId
              ? {
                  membershipId: doc.privilegeMembershipId,
-                  userId: doc.privilegeUserId,
+                  userId: doc.privilegeUserId || "",
                  projectId: doc.projectId,
                  isTemporary: doc.privilegeIsTemporary,
                  temporaryMode: doc.privilegeTemporaryMode,
@@ -772,9 +772,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
        )
        .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
        .leftJoin(
-          TableName.ProjectUserAdditionalPrivilege,
+          TableName.AdditionalPrivilege,
          `${TableName.AccessApprovalRequest}.privilegeId`,
-          `${TableName.ProjectUserAdditionalPrivilege}.id`
+          `${TableName.AdditionalPrivilege}.id`
        )

        .leftJoin(
@@ -1,7 +1,7 @@
 import slugify from "@sindresorhus/slugify";
 import msFn from "ms";

-import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
+import { ActionProjectType, ProjectMembershipRole, TemporaryPermissionMode } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
@@ -10,12 +10,12 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
+import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
 import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
-import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 import { TProjectSlackConfigDALFactory } from "@app/services/slack/project-slack-config-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
@@ -30,7 +30,6 @@ import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal"
 import { verifyRequestedPermissions } from "./access-approval-request-fns";
 import { TAccessApprovalRequestReviewerDALFactory } from "./access-approval-request-reviewer-dal";
 import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-approval-request-types";
-import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";

 type TSecretApprovalRequestServiceFactoryDep = {
  additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "create" | "findById">;
@@ -708,9 +707,9 @@ export const accessApprovalRequestServiceFactory = ({
            // Permanent access
            const privilege = await additionalPrivilegeDAL.create(
              {
-                userId: accessApprovalRequest.requestedByUserId,
+                actorUserId: accessApprovalRequest.requestedByUserId,
                projectId: accessApprovalRequest.projectId,
-                slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
+                name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                permissions: JSON.stringify(accessApprovalRequest.permissions)
              },
              tx
@@ -723,12 +722,12 @@ export const accessApprovalRequestServiceFactory = ({

            const privilege = await additionalPrivilegeDAL.create(
              {
-                userId: accessApprovalRequest.requestedByUserId,
+                actorUserId: accessApprovalRequest.requestedByUserId,
                projectId: accessApprovalRequest.projectId,
-                slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
+                name: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                permissions: JSON.stringify(accessApprovalRequest.permissions),
                isTemporary: true, // Explicitly set to true for the privilege
-                temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative,
+                temporaryMode: TemporaryPermissionMode.Relative,
                temporaryRange: accessApprovalRequest.temporaryRange!,
                temporaryAccessStartTime: startTime,
                temporaryAccessEndTime: new Date(startTime.getTime() + relativeTempAllocatedTimeInMs)
@@ -1,7 +1,7 @@
 import { Knex } from "knex";

 import { TDbClient } from "@app/db";
-import { AccessScope, GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas";
+import { GatewaysV2Schema, TableName, TGatewaysV2 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, TFindFilter, TFindOpt } from "@app/lib/knex";

@@ -19,7 +19,7 @@ export const gatewayDALFactory = (db: TDbClient) => {
        .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.Gateway}.identityId`)
        .join(TableName.Membership, `${TableName.Membership}.actorIdentityId`, `${TableName.Gateway}.identityId`)
        .select(selectAllTableCols(TableName.Gateway))
-        .select(db.ref("scopeOrgId").withSchema(TableName.IdentityOrgMembership).as("identityOrgId"))
+        .select(db.ref("scopeOrgId").withSchema(TableName.Membership).as("identityOrgId"))
        .select(db.ref("name").withSchema(TableName.Identity).as("identityName"))
        .where(`${TableName.Membership}.scope`, AccessScope.Organization);

@@ -9,7 +9,7 @@ import {
  MembershipsSchema,
  TableName,
  TMemberships,
-  TProjectRoles
+  TRoles
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
@@ -47,7 +47,10 @@ interface TPermissionDataReturn extends TMemberships {
 }

 export interface TPermissionDALFactory {
-  getProjectUserPermissions: (projectId: string) => Promise<
+  getProjectUserPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<
    {
      roles: {
        id: string;
@@ -69,45 +72,19 @@ export interface TPermissionDALFactory {
        temporaryAccessEndTime: Date | null | undefined;
        isTemporary: boolean;
      }[];
-      orgId: string;
-      orgAuthEnforced: boolean | null | undefined;
      userId: string;
-      projectId: string;
      username: string;
-      projectType?: string | null;
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
      metadata: {
        id: string;
        key: string;
        value: string;
      }[];
-      userGroupRoles: {
-        id: string;
-        role: string;
-        customRoleSlug: string;
-        permissions: unknown;
-        temporaryRange: string | null | undefined;
-        temporaryMode: string | null | undefined;
-        temporaryAccessStartTime: Date | null | undefined;
-        temporaryAccessEndTime: Date | null | undefined;
-        isTemporary: boolean;
-      }[];
-      projectMembershipRoles: {
-        id: string;
-        role: string;
-        customRoleSlug: string;
-        permissions: unknown;
-        temporaryRange: string | null | undefined;
-        temporaryMode: string | null | undefined;
-        temporaryAccessStartTime: Date | null | undefined;
-        temporaryAccessEndTime: Date | null | undefined;
-        isTemporary: boolean;
-      }[];
    }[]
  >;
-  getProjectIdentityPermissions: (projectId: string) => Promise<
+  getProjectIdentityPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<
    {
      roles: {
        id: string;
@@ -140,8 +117,6 @@ export interface TPermissionDALFactory {
      createdAt: Date;
      updatedAt: Date;
      orgId: string;
-      projectType?: string | null;
-      orgAuthEnforced: boolean;
      metadata: {
        id: string;
        key: string;
@@ -363,7 +338,6 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
        ]
      });

-      console.log(">>>", data);
      return data;
    } catch (error) {
      throw new DatabaseError({ error, name: "Get Permission" });
@@ -381,7 +355,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
        .where(`${TableName.Membership}.scope`, AccessScope.Project)
        .join(TableName.Groups, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`)
        .join(TableName.MembershipRole, `${TableName.MembershipRole}.membershipId`, `${TableName.Membership}.id`)
-        .leftJoin<TProjectRoles>(
+        .leftJoin<TRoles>(
          { groupCustomRoles: TableName.Role },
          `${TableName.MembershipRole}.customRoleId`,
          `groupCustomRoles.id`
@@ -472,19 +446,19 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
    }
  };

-  // TODO(simp): this query is wrong and fix it
  const getProjectUserPermissions: TPermissionDALFactory["getProjectUserPermissions"] = async (
    projectId: string,
    orgId: string
  ) => {
-    try {
-      const userGroupSubquery = db(TableName.Groups)
-        .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`)
-        .where(`${TableName.Groups}.orgId`, orgId)
-        .select(db.ref("id").withSchema(TableName.Groups));
+    const userGroupSubquery = db(TableName.Groups)
+      .leftJoin(TableName.UserGroupMembership, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`)
+      .where(`${TableName.Groups}.orgId`, orgId)
+      .select(db.ref("id").withSchema(TableName.Groups));

+    try {
      const docs = await db
-        .replicaNode()(TableName.Membership)
+        .replicaNode()(TableName.Users)
+        .where("isGhost", "=", false)
        .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`)
        .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
        .leftJoin(TableName.AdditionalPrivilege, (qb) => {
@@ -498,82 +472,54 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
            .on(`${TableName.Membership}.actorUserId`, `${TableName.IdentityMetadata}.userId`)
            .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
        })
-        .leftJoin(
-          TableName.UserGroupMembership,
-          `${TableName.UserGroupMembership}.groupId`,
-          `${TableName.Membership}.actorGroupId`
-        )
-        .leftJoin(TableName.Users, (qb) => {
-          qb.on(`${TableName.Users}.id`, `${TableName.Membership}.actorUserId`).orOn(
-            `${TableName.Users}.id`,
-            `${TableName.UserGroupMembership}.groupId`
-          );
-        })
        .where(`${TableName.Membership}.scopeOrgId`, orgId)
-        .where(`${TableName.Membership}.scope`, AccessScope.Project)
-        .where(`${TableName.Membership}.scopeProjectId`, projectId)
+        .where((qb) => {
+          void qb
+            .whereNotNull(`${TableName.Membership}.actorUserId`)
+            .orWhereIn(`${TableName.Membership}.actorGroupId`, userGroupSubquery);
+        })
+        .where((qb) => {
+          void qb
+            .where(`${TableName.Membership}.scope`, AccessScope.Project)
+            .where(`${TableName.Membership}.scopeProjectId`, projectId);
+        })
        .select(
          db.ref("id").withSchema(TableName.Users).as("userId"),
          db.ref("username").withSchema(TableName.Users).as("username"),
-          // groups specific
-          db.ref("slug").withSchema("groupCustomRoles").as("userGroupProjectMembershipRoleCustomRoleSlug"),
-          db.ref("permissions").withSchema("groupCustomRoles").as("userGroupProjectMembershipRolePermission"),
-          db.ref("id").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleId"),
-          db.ref("role").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRole"),
-          db.ref("customRoleId").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleCustomRoleId"),
-          db.ref("isTemporary").withSchema(TableName.MembershipRole).as("userGroupProjectMembershipRoleIsTemporary"),
-          db
-            .ref("temporaryMode")
-            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryMode"),
-          db
-            .ref("temporaryRange")
-            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryRange"),
+          db.ref("slug").withSchema(TableName.Role).as("roleSlug"),
+          db.ref("permissions").withSchema(TableName.Role).as("customRolePermission"),
+          db.ref("id").withSchema(TableName.MembershipRole).as("membershipRoleId"),
+          db.ref("role").withSchema(TableName.MembershipRole).as("membershipRole"),
+          db.ref("temporaryMode").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryMode"),
+          db.ref("isTemporary").withSchema(TableName.MembershipRole).as("membershipRoleIsTemporary"),
+          db.ref("temporaryRange").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryRange"),
          db
            .ref("temporaryAccessStartTime")
            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryAccessStartTime"),
+            .as("membershipRoleTemporaryAccessStartTime"),
          db
            .ref("temporaryAccessEndTime")
            .withSchema(TableName.MembershipRole)
-            .as("userGroupProjectMembershipRoleTemporaryAccessEndTime"),
-          // user specific
-          db.ref("id").withSchema(TableName.Membership).as("membershipId"),
-          db.ref("createdAt").withSchema(TableName.Membership).as("membershipCreatedAt"),
-          db.ref("updatedAt").withSchema(TableName.Membership).as("membershipUpdatedAt"),
-          db.ref("slug").withSchema(TableName.Role).as("userProjectMembershipRoleCustomRoleSlug"),
-          db.ref("permissions").withSchema(TableName.Role).as("userProjectCustomRolePermission"),
-          db.ref("id").withSchema(TableName.Role).as("userProjectMembershipRoleId"),
-          db.ref("role").withSchema(TableName.Role).as("userProjectMembershipRole"),
-          db.ref("temporaryMode").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryMode"),
-          db.ref("isTemporary").withSchema(TableName.Role).as("userProjectMembershipRoleIsTemporary"),
-          db.ref("temporaryRange").withSchema(TableName.Role).as("userProjectMembershipRoleTemporaryRange"),
-          db
-            .ref("temporaryAccessStartTime")
-            .withSchema(TableName.Role)
-            .as("userProjectMembershipRoleTemporaryAccessStartTime"),
-          db
-            .ref("temporaryAccessEndTime")
-            .withSchema(TableName.Role)
-            .as("userProjectMembershipRoleTemporaryAccessEndTime"),
-          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesId"),
-          db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesPermissions"),
-          db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesTemporaryMode"),
-          db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesIsTemporary"),
-          db
-            .ref("temporaryRange")
-            .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryRange"),
-          db.ref("userId").withSchema(TableName.AdditionalPrivilege).as("userAdditionalPrivilegesUserId"),
+            .as("membershipRoleTemporaryAccessEndTime"),
+          db.ref("createdAt").withSchema(TableName.MembershipRole).as("membershipRoleCreatedAt"),
+          db.ref("updatedAt").withSchema(TableName.MembershipRole).as("membershipRoleUpdatedAt"),
+          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"),
+          db.ref("name").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeName"),
+          db.ref("permissions").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegePermissions"),
+          db.ref("id").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeId"),
+          db.ref("temporaryMode").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryMode"),
+          db.ref("isTemporary").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeIsTemporary"),
+          db.ref("temporaryRange").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeTemporaryRange"),
          db
            .ref("temporaryAccessStartTime")
            .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryAccessStartTime"),
+            .as("additionalPrivilegeTemporaryAccessStartTime"),
          db
            .ref("temporaryAccessEndTime")
            .withSchema(TableName.AdditionalPrivilege)
-            .as("userAdditionalPrivilegesTemporaryAccessEndTime"),
+            .as("additionalPrivilegeTemporaryAccessEndTime"),
+          db.ref("createdAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeCreatedAt"),
+          db.ref("updatedAt").withSchema(TableName.AdditionalPrivilege).as("additionalPrivilegeUpdatedAt"),
          // general
          db.ref("id").withSchema(TableName.IdentityMetadata).as("metadataId"),
          db.ref("key").withSchema(TableName.IdentityMetadata).as("metadataKey"),
@@ -583,84 +529,64 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
      const userPermissions = sqlNestRelationships({
        data: docs,
        key: "userId",
-        parentMapper: ({ username, membershipId, membershipCreatedAt, membershipUpdatedAt, userId }) => ({
+        parentMapper: ({ username, userId }) => ({
          userId,
          projectId,
-          username,
-          id: membershipId,
-          createdAt: membershipCreatedAt,
-          updatedAt: membershipUpdatedAt
+          username
        }),
        childrenMapper: [
          {
-            key: "userGroupProjectMembershipRoleId",
-            label: "userGroupRoles" as const,
-            mapper: ({
-              userGroupProjectMembershipRoleId,
-              userGroupProjectMembershipRole,
-              userGroupProjectMembershipRolePermission,
-              userGroupProjectMembershipRoleCustomRoleSlug,
-              userGroupProjectMembershipRoleIsTemporary,
-              userGroupProjectMembershipRoleTemporaryMode,
-              userGroupProjectMembershipRoleTemporaryAccessEndTime,
-              userGroupProjectMembershipRoleTemporaryAccessStartTime,
-              userGroupProjectMembershipRoleTemporaryRange
-            }) => ({
-              id: userGroupProjectMembershipRoleId,
-              role: userGroupProjectMembershipRole,
-              customRoleSlug: userGroupProjectMembershipRoleCustomRoleSlug,
-              permissions: userGroupProjectMembershipRolePermission,
-              temporaryRange: userGroupProjectMembershipRoleTemporaryRange,
-              temporaryMode: userGroupProjectMembershipRoleTemporaryMode,
-              temporaryAccessStartTime: userGroupProjectMembershipRoleTemporaryAccessStartTime,
-              temporaryAccessEndTime: userGroupProjectMembershipRoleTemporaryAccessEndTime,
-              isTemporary: userGroupProjectMembershipRoleIsTemporary
-            })
-          },
-          {
-            key: "userProjectMembershipRoleId",
-            label: "projectMembershipRoles" as const,
-            mapper: ({
-              userProjectMembershipRoleId,
-              userProjectMembershipRole,
-              userProjectCustomRolePermission,
-              userProjectMembershipRoleIsTemporary,
-              userProjectMembershipRoleTemporaryMode,
-              userProjectMembershipRoleTemporaryRange,
-              userProjectMembershipRoleTemporaryAccessEndTime,
-              userProjectMembershipRoleTemporaryAccessStartTime,
-              userProjectMembershipRoleCustomRoleSlug
-            }) => ({
-              id: userProjectMembershipRoleId,
-              role: userProjectMembershipRole,
-              customRoleSlug: userProjectMembershipRoleCustomRoleSlug,
-              permissions: userProjectCustomRolePermission,
-              temporaryRange: userProjectMembershipRoleTemporaryRange,
-              temporaryMode: userProjectMembershipRoleTemporaryMode,
-              temporaryAccessStartTime: userProjectMembershipRoleTemporaryAccessStartTime,
-              temporaryAccessEndTime: userProjectMembershipRoleTemporaryAccessEndTime,
-              isTemporary: userProjectMembershipRoleIsTemporary
-            })
-          },
-          {
-            key: "userAdditionalPrivilegesId",
+            key: "additionalPrivilegeId",
            label: "additionalPrivileges" as const,
            mapper: ({
-              userAdditionalPrivilegesId,
-              userAdditionalPrivilegesPermissions,
-              userAdditionalPrivilegesIsTemporary,
-              userAdditionalPrivilegesTemporaryMode,
-              userAdditionalPrivilegesTemporaryRange,
-              userAdditionalPrivilegesTemporaryAccessEndTime,
-              userAdditionalPrivilegesTemporaryAccessStartTime
+              additionalPrivilegeId,
+              additionalPrivilegePermissions,
+              additionalPrivilegeIsTemporary,
+              additionalPrivilegeTemporaryMode,
+              additionalPrivilegeTemporaryRange,
+              additionalPrivilegeTemporaryAccessEndTime,
+              additionalPrivilegeTemporaryAccessStartTime,
+              additionalPrivilegeCreatedAt,
+              additionalPrivilegeUpdatedAt
            }) => ({
-              id: userAdditionalPrivilegesId,
-              permissions: userAdditionalPrivilegesPermissions,
-              temporaryRange: userAdditionalPrivilegesTemporaryRange,
-              temporaryMode: userAdditionalPrivilegesTemporaryMode,
-              temporaryAccessStartTime: userAdditionalPrivilegesTemporaryAccessStartTime,
-              temporaryAccessEndTime: userAdditionalPrivilegesTemporaryAccessEndTime,
-              isTemporary: userAdditionalPrivilegesIsTemporary
+              id: additionalPrivilegeId,
+              permissions: additionalPrivilegePermissions,
+              temporaryRange: additionalPrivilegeTemporaryRange,
+              temporaryMode: additionalPrivilegeTemporaryMode,
+              temporaryAccessStartTime: additionalPrivilegeTemporaryAccessStartTime,
+              temporaryAccessEndTime: additionalPrivilegeTemporaryAccessEndTime,
+              isTemporary: additionalPrivilegeIsTemporary,
+              createdAt: additionalPrivilegeCreatedAt,
+              updatedAt: additionalPrivilegeUpdatedAt
+            })
+          },
+          {
+            key: "membershipRoleId",
+            label: "roles" as const,
+            mapper: ({
+              roleSlug,
+              customRolePermission,
+              membershipRoleId,
+              membershipRole,
+              membershipRoleIsTemporary,
+              membershipRoleTemporaryMode,
+              membershipRoleTemporaryRange,
+              membershipRoleTemporaryAccessEndTime,
+              membershipRoleTemporaryAccessStartTime,
+              membershipRoleCreatedAt,
+              membershipRoleUpdatedAt
+            }) => ({
+              id: membershipRoleId,
+              role: membershipRole,
+              permissions: customRolePermission,
+              customRoleSlug: roleSlug,
+              temporaryRange: membershipRoleTemporaryRange,
+              temporaryMode: membershipRoleTemporaryMode,
+              temporaryAccessStartTime: membershipRoleTemporaryAccessStartTime,
+              temporaryAccessEndTime: membershipRoleTemporaryAccessEndTime,
+              isTemporary: membershipRoleIsTemporary,
+              createdAt: membershipRoleCreatedAt,
+              updatedAt: membershipRoleUpdatedAt
            })
          },
          {
@@ -678,17 +604,11 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
      return userPermissions
        .map((userPermission) => {
          if (!userPermission) return undefined;
-          if (!userPermission?.userGroupRoles?.[0] && !userPermission?.projectMembershipRoles?.[0]) return undefined;
+          if (!userPermission?.roles?.[0]) return undefined;

          // when introducting cron mode change it here
          const activeRoles =
-            userPermission?.projectMembershipRoles?.filter(
-              ({ isTemporary, temporaryAccessEndTime }) =>
-                !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
-            ) ?? [];
-
-          const activeGroupRoles =
-            userPermission?.userGroupRoles?.filter(
+            userPermission?.roles?.filter(
              ({ isTemporary, temporaryAccessEndTime }) =>
                !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
            ) ?? [];
@@ -701,7 +621,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {

          return {
            ...userPermission,
-            roles: [...activeRoles, ...activeGroupRoles],
+            roles: activeRoles,
            additionalPrivileges: activeAdditionalPrivileges
          };
        })
@@ -74,25 +74,24 @@ export type TPermissionServiceFactory = {
    memberships: Array<TMemberships & { roles: { role: string; customRoleSlug?: string | null }[] }>;
    hasRole: (role: string) => boolean;
  }>;
-  // TODO(simp): check what is this doing
-  getProjectPermissions: (projectId: string) => Promise<{
+  getProjectPermissions: (
+    projectId: string,
+    orgId: string
+  ) => Promise<{
    userPermissions: {
      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
      id: string;
      name: string;
-      membershipId: string;
    }[];
    identityPermissions: {
      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
      id: string;
      name: string;
-      membershipId: string;
    }[];
    groupPermissions: {
      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
      id: string;
      name: string;
-      membershipId: string;
    }[];
  }>;
  getOrgPermissionByRoles: (
@@ -350,6 +350,7 @@ export const permissionServiceFactory = ({
      actorType: actor
    });
    if (!permissionData?.length) throw new ForbiddenRequestError({ name: "You are not member of this organization" });
+
    const permissionFromRoles = permissionData.flatMap((membership) => {
      const activeRoles = membership?.roles
        .filter(
@@ -426,9 +427,9 @@ export const permissionServiceFactory = ({
    };
  };

-  const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId) => {
+  const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId, orgId) => {
    // fetch user permissions
-    const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId);
+    const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId, orgId);
    const userPermissions = rawUserProjectPermissions.map((userProjectPermission) => {
      const rolePermissions =
        userProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || [];
@@ -468,13 +469,12 @@ export const permissionServiceFactory = ({
      return {
        permission,
        id: userProjectPermission.userId,
-        name: userProjectPermission.username,
-        membershipId: userProjectPermission.id
+        name: userProjectPermission.username
      };
    });

    // fetch identity permissions
-    const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId);
+    const rawIdentityProjectPermissions = await permissionDAL.getProjectIdentityPermissions(projectId, orgId);
    const identityPermissions = rawIdentityProjectPermissions.map((identityProjectPermission) => {
      const rolePermissions =
        identityProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || [];
@@ -514,8 +514,7 @@ export const permissionServiceFactory = ({
      return {
        permission,
        id: identityProjectPermission.identityId,
-        name: identityProjectPermission.username,
-        membershipId: identityProjectPermission.id
+        name: identityProjectPermission.username
      };
    });

@@ -532,8 +531,7 @@ export const permissionServiceFactory = ({
      return {
        permission,
        id: groupProjectPermission.groupId,
-        name: groupProjectPermission.username,
-        membershipId: groupProjectPermission.id
+        name: groupProjectPermission.username
      };
    });

@@ -2,9 +2,10 @@ import { Knex } from "knex";

 import { TDbClient } from "@app/db";
 import {
+  AccessScope,
  SecretApprovalRequestsSchema,
  TableName,
-  TOrgMemberships,
+  TMemberships,
  TSecretApprovalRequests,
  TSecretApprovalRequestsSecrets,
  TUserGroupMembership,
@@ -109,24 +110,26 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
        `secretApprovalReviewerUser.id`
      )

-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("approverOrgMembership"),
-        `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
-        `approverOrgMembership.userId`
-      )
+      .leftJoin<TMemberships>(db(TableName.Membership).as("approverOrgMembership"), (qb) => {
+        qb.on(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, `approverOrgMembership.actorUserId`).andOn(
+          `approverOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })

-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("approverGroupOrgMembership"),
-        `secretApprovalPolicyGroupApproverUser.id`,
-        `approverGroupOrgMembership.userId`
-      )
-
-      .leftJoin<TOrgMemberships>(
-        db(TableName.OrgMembership).as("reviewerOrgMembership"),
-        `${TableName.SecretApprovalRequestReviewer}.reviewerUserId`,
-        `reviewerOrgMembership.userId`
-      )
+      .leftJoin<TMemberships>(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => {
+        qb.on(`secretApprovalPolicyGroupApproverUser.id`, `approverGroupOrgMembership.actorUserId`).andOn(
+          `approverGroupOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })

+      .leftJoin<TMemberships>(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => {
+        qb.on(`${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, `reviewerOrgMembership.actorUserId`).andOn(
+          `reviewerOrgMembership.scope`,
+          db.raw("?", [AccessScope.Organization])
+        );
+      })
      .select(selectAllTableCols(TableName.SecretApprovalRequest))
      .select(
        tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),