feat(infisical-pg): test first milestone one flow

backend-pg/src/ee/services/permission/org-permission.ts

@@ -0,0 +1,124 @@
+import picomatch from "picomatch";
+
+import {
+  AbilityBuilder,
+  buildMongoQueryMatcher,
+  createMongoAbility,
+  MongoAbility
+} from "@casl/ability";
+import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
+
+const $glob: FieldInstruction<string> = {
+  type: "field",
+  validate(instruction, value) {
+    if (typeof value !== "string") {
+      throw new Error(`"${instruction.name}" expects value to be a string`);
+    }
+  }
+};
+
+const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
+  const secretPath = context.get(object, node.field);
+  const permissionSecretGlobPath = node.value;
+  return picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false });
+};
+
+export const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
+
+export enum OrgPermissionActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete"
+}
+
+export enum OrgPermissionSubjects {
+  Workspace = "workspace",
+  Role = "role",
+  Member = "member",
+  Settings = "settings",
+  IncidentAccount = "incident-contact",
+  Sso = "sso",
+  Billing = "billing",
+  SecretScanning = "secret-scanning"
+}
+
+export type OrgPermissionSet =
+  | [OrgPermissionActions.Read, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions.Create, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions, OrgPermissionSubjects.Role]
+  | [OrgPermissionActions, OrgPermissionSubjects.Member]
+  | [OrgPermissionActions, OrgPermissionSubjects.Settings]
+  | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
+  | [OrgPermissionActions, OrgPermissionSubjects.Sso]
+  | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing];
+
+const buildAdminPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  // ws permissions
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  // role permission
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Role);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Member);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Settings);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Sso);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
+
+  return build({ conditionsMatcher });
+};
+
+export const orgAdminPermissions = buildAdminPermission();
+
+const buildMemberPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  return build({ conditionsMatcher });
+};
+
+export const orgMemberPermissions = buildMemberPermission();

backend-pg/src/ee/services/permission/permission-dal.ts

@@ -0,0 +1,23 @@
+import { TDbClient } from "@app/db";
+import { TableName, TOrgMemberships } from "@app/db/schemas";
+
+export type TPermissionDalFactory = ReturnType<typeof permissionDalFactory>;
+
+export const permissionDalFactory = (db: TDbClient) => {
+  const getOrgPermission = async (
+    userId: string,
+    orgId: string
+  ): Promise<(TOrgMemberships & { permissions: string }) | undefined> => {
+    const membership = await db(TableName.OrgMembership)
+      .leftJoin(TableName.OrgRoles, `${TableName.OrgMembership}.roleId`, `${TableName.OrgRoles}.id`)
+      .select(`${TableName.OrgMembership}.*`, `${TableName.OrgRoles}.permissions`)
+      .where({ userId, [`${TableName.OrgMembership}.orgId`]: orgId })
+      .first();
+
+    return membership;
+  };
+
+  return {
+    getOrgPermission
+  };
+};

backend-pg/src/ee/services/permission/permission-service.ts

@@ -0,0 +1,50 @@
+import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+
+import {
+  conditionsMatcher,
+  orgAdminPermissions,
+  orgMemberPermissions,
+  OrgPermissionSet
+} from "./org-permission";
+import { TPermissionDalFactory } from "./permission-dal";
+
+import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
+import { unpackRules } from "@casl/ability/extra";
+
+type TPermissionServiceFactoryDep = {
+  permissionDal: TPermissionDalFactory;
+};
+
+export type TPermissionServiceFactory = ReturnType<typeof permissionServiceFactory>;
+
+export const permissionServiceFactory = ({ permissionDal }: TPermissionServiceFactoryDep) => {
+  /*
+   * Get user permission in an organization
+   * */
+  const getUserOrgPermission = async (userId: string, orgId: string) => {
+    const membership = await permissionDal.getOrgPermission(userId, orgId);
+    if (!membership) throw new UnauthorizedError({ name: "User not in org" });
+    if (membership.role === "custom" && !membership.permissions) {
+      throw new BadRequestError({ name: "Custom permission not found" });
+    }
+
+    if (membership.role === "admin") return { permission: orgAdminPermissions, membership };
+    if (membership.role === "member") return { permission: orgMemberPermissions, membership };
+    if (membership.role === "custom") {
+      const permission = createMongoAbility<OrgPermissionSet>(
+        // akhilmhdh: putting any due to ts incompatiable matching with string and the other
+        unpackRules<RawRuleOf<MongoAbility<OrgPermissionSet>>>(membership.permissions as any),
+        {
+          conditionsMatcher
+        }
+      );
+      return { permission, membership };
+    }
+
+    throw new BadRequestError({ name: "Role missing", message: "User role not found" });
+  };
+
+  return {
+    getUserOrgPermission
+  };
+};