feat(infisical-pg): test first milestone one flow

backend-pg/src/ee/LICENSE

@@ -0,0 +1,36 @@
+The Infisical Enterprise license (the “Enterprise License”)
+Copyright (c) 2022 Infisical Inc
+
+With regard to the Infisical Software:
+
+This software and associated documentation files (the "Software") may only be
+used in production, if you (and any entity that you represent) have agreed to,
+and are in compliance with, the Infisical Subscription Terms of Service, available
+at https://infisical.com/terms (the “Enterprise Terms”), or other
+agreement governing the use of the Software, as agreed by you and Infisical,
+and otherwise have a valid Infisical Enterprise License for the
+correct number of user seats. Subject to the foregoing sentence, you are free to
+modify this Software and publish patches to the Software. You agree that Infisical
+and/or its licensors (as applicable) retain all right, title and interest in and
+to all such modifications and/or patches, and all such modifications and/or
+patches may only be used, copied, modified, displayed, distributed, or otherwise
+exploited with a valid Infiscial Enterprise subscription for the correct
+number of user seats. Notwithstanding the foregoing, you may copy and modify
+the Software for development and testing purposes, without requiring a
+subscription. You agree that Infisical and/or its licensors (as applicable) retain
+all right, title and interest in and to all such modifications. You are not
+granted any other rights beyond what is expressly stated herein. Subject to the
+foregoing, it is forbidden to copy, merge, publish, distribute, sublicense,
+and/or sell the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+For all third party components incorporated into the Infisical Software, those
+components are licensed under the original license provided by the owner of the
+applicable component.

backend-pg/src/ee/routes/v1/index.ts

@@ -0,0 +1,6 @@
+import { registerOrgRoleRouter } from "./org-role";
+
+export const registerV1EERoutes = async (server: FastifyZodProvider) => {
+  // org role starts with organization
+  await server.register(registerOrgRoleRouter, { prefix: "/organization" });
+};

backend-pg/src/ee/routes/v1/org-role.ts

@@ -0,0 +1,150 @@
+import { z } from "zod";
+
+import { OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/:organizationId/roles",
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim()
+      }),
+      body: z.object({
+        slug: z.string().trim(),
+        name: z.string().trim(),
+        description: z.string().trim().optional(),
+        workspaceId: z.string().trim().optional(),
+        orgId: z.string().trim(),
+        permissions: z.any().array()
+      }),
+      response: {
+        200: z.object({
+          role: OrgRolesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const role = await server.services.orgRole.createRole(
+        req.auth.userId,
+        req.params.organizationId,
+        { ...req.body, permissions: JSON.stringify(req.body.permissions) }
+      );
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:organizationId/roles/:roleId",
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim(),
+        roleId: z.string().trim()
+      }),
+      body: z.object({
+        slug: z.string().trim().optional(),
+        name: z.string().trim().optional(),
+        description: z.string().trim().optional(),
+        workspaceId: z.string().trim().optional(),
+        orgId: z.string().trim(),
+        permissions: z.any().array()
+      }),
+      response: {
+        200: z.object({
+          role: OrgRolesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const role = await server.services.orgRole.updateRole(
+        req.auth.userId,
+        req.params.organizationId,
+        req.params.roleId,
+        {
+          ...req.body,
+          permissions: req.body.permissions ? JSON.stringify(req.body.permissions) : undefined
+        }
+      );
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:organizationId/roles/:roleId",
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim(),
+        roleId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          role: OrgRolesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const role = await server.services.orgRole.deleteRole(
+        req.auth.userId,
+        req.params.organizationId,
+        req.params.roleId
+      );
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:organizationId/roles",
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          roles: OrgRolesSchema.omit({ permissions: true })
+            .merge(z.object({ permissions: z.unknown() }))
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const roles = await server.services.orgRole.listRoles(
+        req.auth.userId,
+        req.params.organizationId
+      );
+      return { roles };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:organizationId/permissions",
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          membership: OrgMembershipsSchema,
+          permissions: z.any().array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { permissions, membership } = await server.services.orgRole.getUserPermission(
+        req.auth.userId,
+        req.params.organizationId
+      );
+      return { permissions, membership };
+    }
+  });
+};

backend-pg/src/ee/services/permission/org-permission.ts

@@ -0,0 +1,124 @@
+import picomatch from "picomatch";
+
+import {
+  AbilityBuilder,
+  buildMongoQueryMatcher,
+  createMongoAbility,
+  MongoAbility
+} from "@casl/ability";
+import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
+
+const $glob: FieldInstruction<string> = {
+  type: "field",
+  validate(instruction, value) {
+    if (typeof value !== "string") {
+      throw new Error(`"${instruction.name}" expects value to be a string`);
+    }
+  }
+};
+
+const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
+  const secretPath = context.get(object, node.field);
+  const permissionSecretGlobPath = node.value;
+  return picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false });
+};
+
+export const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
+
+export enum OrgPermissionActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete"
+}
+
+export enum OrgPermissionSubjects {
+  Workspace = "workspace",
+  Role = "role",
+  Member = "member",
+  Settings = "settings",
+  IncidentAccount = "incident-contact",
+  Sso = "sso",
+  Billing = "billing",
+  SecretScanning = "secret-scanning"
+}
+
+export type OrgPermissionSet =
+  | [OrgPermissionActions.Read, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions.Create, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions, OrgPermissionSubjects.Role]
+  | [OrgPermissionActions, OrgPermissionSubjects.Member]
+  | [OrgPermissionActions, OrgPermissionSubjects.Settings]
+  | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
+  | [OrgPermissionActions, OrgPermissionSubjects.Sso]
+  | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing];
+
+const buildAdminPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  // ws permissions
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  // role permission
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Role);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Member);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Settings);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Sso);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
+
+  return build({ conditionsMatcher });
+};
+
+export const orgAdminPermissions = buildAdminPermission();
+
+const buildMemberPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  return build({ conditionsMatcher });
+};
+
+export const orgMemberPermissions = buildMemberPermission();

backend-pg/src/ee/services/permission/permission-dal.ts

@@ -0,0 +1,23 @@
+import { TDbClient } from "@app/db";
+import { TableName, TOrgMemberships } from "@app/db/schemas";
+
+export type TPermissionDalFactory = ReturnType<typeof permissionDalFactory>;
+
+export const permissionDalFactory = (db: TDbClient) => {
+  const getOrgPermission = async (
+    userId: string,
+    orgId: string
+  ): Promise<(TOrgMemberships & { permissions: string }) | undefined> => {
+    const membership = await db(TableName.OrgMembership)
+      .leftJoin(TableName.OrgRoles, `${TableName.OrgMembership}.roleId`, `${TableName.OrgRoles}.id`)
+      .select(`${TableName.OrgMembership}.*`, `${TableName.OrgRoles}.permissions`)
+      .where({ userId, [`${TableName.OrgMembership}.orgId`]: orgId })
+      .first();
+
+    return membership;
+  };
+
+  return {
+    getOrgPermission
+  };
+};

backend-pg/src/ee/services/permission/permission-service.ts

@@ -0,0 +1,50 @@
+import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+
+import {
+  conditionsMatcher,
+  orgAdminPermissions,
+  orgMemberPermissions,
+  OrgPermissionSet
+} from "./org-permission";
+import { TPermissionDalFactory } from "./permission-dal";
+
+import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
+import { unpackRules } from "@casl/ability/extra";
+
+type TPermissionServiceFactoryDep = {
+  permissionDal: TPermissionDalFactory;
+};
+
+export type TPermissionServiceFactory = ReturnType<typeof permissionServiceFactory>;
+
+export const permissionServiceFactory = ({ permissionDal }: TPermissionServiceFactoryDep) => {
+  /*
+   * Get user permission in an organization
+   * */
+  const getUserOrgPermission = async (userId: string, orgId: string) => {
+    const membership = await permissionDal.getOrgPermission(userId, orgId);
+    if (!membership) throw new UnauthorizedError({ name: "User not in org" });
+    if (membership.role === "custom" && !membership.permissions) {
+      throw new BadRequestError({ name: "Custom permission not found" });
+    }
+
+    if (membership.role === "admin") return { permission: orgAdminPermissions, membership };
+    if (membership.role === "member") return { permission: orgMemberPermissions, membership };
+    if (membership.role === "custom") {
+      const permission = createMongoAbility<OrgPermissionSet>(
+        // akhilmhdh: putting any due to ts incompatiable matching with string and the other
+        unpackRules<RawRuleOf<MongoAbility<OrgPermissionSet>>>(membership.permissions as any),
+        {
+          conditionsMatcher
+        }
+      );
+      return { permission, membership };
+    }
+
+    throw new BadRequestError({ name: "Role missing", message: "User role not found" });
+  };
+
+  return {
+    getUserOrgPermission
+  };
+};