diff --git a/backend/src/ee/services/permission/permission-fns.ts b/backend/src/ee/services/permission/permission-fns.ts index cccadb86e..b3e20fcf2 100644 --- a/backend/src/ee/services/permission/permission-fns.ts +++ b/backend/src/ee/services/permission/permission-fns.ts @@ -131,12 +131,12 @@ function validateOrgSSO(actorAuthMethod: ActorAuthMethod, isOrgSsoEnforced: TOrg } } -const escapeHandlebarsMissingMetadata = (obj: Record) => { +const escapeHandlebarsMissingDict = (obj: Record, key = "identity.metadata") => { const handler = { get(target: Record, prop: string) { - if (!(prop in target)) { + if (!Object.hasOwn(target, prop)) { // eslint-disable-next-line no-param-reassign - target[prop] = `{{identity.metadata.${prop}}}`; // Add missing key as an "own" property + target[prop] = `{{${key}.${prop}}}`; // Add missing key as an "own" property } return target[prop]; } @@ -145,4 +145,4 @@ const escapeHandlebarsMissingMetadata = (obj: Record) => { return new Proxy(obj, handler); }; -export { escapeHandlebarsMissingMetadata, isAuthMethodSaml, validateOrgSSO }; +export { escapeHandlebarsMissingDict, isAuthMethodSaml, validateOrgSSO }; diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts index 6b36234ca..232d347cc 100644 --- a/backend/src/ee/services/permission/permission-service.ts +++ b/backend/src/ee/services/permission/permission-service.ts @@ -23,7 +23,7 @@ import { TServiceTokenDALFactory } from "@app/services/service-token/service-tok import { orgAdminPermissions, orgMemberPermissions, orgNoAccessPermissions, OrgPermissionSet } from "./org-permission"; import { TPermissionDALFactory } from "./permission-dal"; -import { escapeHandlebarsMissingMetadata, validateOrgSSO } from "./permission-fns"; +import { escapeHandlebarsMissingDict, validateOrgSSO } from "./permission-fns"; import { TBuildOrgPermissionDTO, TBuildProjectPermissionDTO, @@ -244,20 +244,21 @@ export const permissionServiceFactory = ({ const rules = buildProjectPermissionRules(rolePermissions.concat(additionalPrivileges)); const templatedRules = handlebars.compile(JSON.stringify(rules), { data: false }); - const metadataKeyValuePair = escapeHandlebarsMissingMetadata( + const metadataKeyValuePair = escapeHandlebarsMissingDict( objectify( userProjectPermission.metadata, (i) => i.key, (i) => i.value ) ); + const templateValue = { + id: userProjectPermission.userId, + username: userProjectPermission.username, + metadata: metadataKeyValuePair + }; const interpolateRules = templatedRules( { - identity: { - id: userProjectPermission.userId, - username: userProjectPermission.username, - metadata: metadataKeyValuePair - } + identity: templateValue }, { data: false } ); @@ -318,24 +319,26 @@ export const permissionServiceFactory = ({ const rules = buildProjectPermissionRules(rolePermissions.concat(additionalPrivileges)); const templatedRules = handlebars.compile(JSON.stringify(rules), { data: false }); - const identityAuthInfo = requestContext.get("identityAuthInfo"); + const unescapedIdentityAuthInfo = requestContext.get("identityAuthInfo"); const unescapedMetadata = objectify( identityProjectPermission.metadata, (i) => i.key, (i) => i.value - // eslint-disable-next-line @typescript-eslint/no-explicit-any - ) as Record; - if (identityAuthInfo?.identityId === identityId && identityAuthInfo) { - unescapedMetadata.auth = identityAuthInfo; - } - const metadataKeyValuePair = escapeHandlebarsMissingMetadata(unescapedMetadata); + ); + const identityAuthInfo = + unescapedIdentityAuthInfo?.identityId === identityId && unescapedIdentityAuthInfo + ? escapeHandlebarsMissingDict(unescapedIdentityAuthInfo as never, "identity.auth") + : {}; + const metadataKeyValuePair = escapeHandlebarsMissingDict(unescapedMetadata); + const templateValue = { + id: identityProjectPermission.identityId, + username: identityProjectPermission.username, + metadata: metadataKeyValuePair, + auth: identityAuthInfo + }; const interpolateRules = templatedRules( { - identity: { - id: identityProjectPermission.identityId, - username: identityProjectPermission.username, - metadata: metadataKeyValuePair - } + identity: templateValue }, { data: false } ); @@ -428,20 +431,21 @@ export const permissionServiceFactory = ({ const rules = buildProjectPermissionRules(rolePermissions.concat(additionalPrivileges)); const templatedRules = handlebars.compile(JSON.stringify(rules), { data: false }); - const metadataKeyValuePair = escapeHandlebarsMissingMetadata( + const metadataKeyValuePair = escapeHandlebarsMissingDict( objectify( userProjectPermission.metadata, (i) => i.key, (i) => i.value ) ); + const templateValue = { + id: userProjectPermission.userId, + username: userProjectPermission.username, + metadata: metadataKeyValuePair + }; const interpolateRules = templatedRules( { - identity: { - id: userProjectPermission.userId, - username: userProjectPermission.username, - metadata: metadataKeyValuePair - } + identity: templateValue }, { data: false } ); @@ -473,21 +477,21 @@ export const permissionServiceFactory = ({ const rules = buildProjectPermissionRules(rolePermissions.concat(additionalPrivileges)); const templatedRules = handlebars.compile(JSON.stringify(rules), { data: false }); - const metadataKeyValuePair = escapeHandlebarsMissingMetadata( + const metadataKeyValuePair = escapeHandlebarsMissingDict( objectify( identityProjectPermission.metadata, (i) => i.key, (i) => i.value ) ); - + const templateValue = { + id: identityProjectPermission.identityId, + username: identityProjectPermission.username, + metadata: metadataKeyValuePair + }; const interpolateRules = templatedRules( { - identity: { - id: identityProjectPermission.identityId, - username: identityProjectPermission.username, - metadata: metadataKeyValuePair - } + identity: templateValue }, { data: false } );