diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts index da87978fd..d69c6da79 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts @@ -35,7 +35,7 @@ import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-a type TSecretApprovalRequestServiceFactoryDep = { additionalPrivilegeDAL: Pick; - permissionService: Pick; + permissionService: Pick; accessApprovalPolicyApproverDAL: Pick; projectEnvDAL: Pick; projectDAL: Pick< @@ -758,6 +758,8 @@ export const accessApprovalRequestServiceFactory = ({ { privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED }, tx ); + + await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx); } } diff --git a/backend/src/ee/services/group/group-service.ts b/backend/src/ee/services/group/group-service.ts index 792c2824d..d4d30b5ae 100644 --- a/backend/src/ee/services/group/group-service.ts +++ b/backend/src/ee/services/group/group-service.ts @@ -46,10 +46,7 @@ type TGroupServiceFactoryDep = { projectKeyDAL: Pick; permissionService: Pick< TPermissionServiceFactory, - | "getOrgPermission" - | "getOrgPermissionByRole" - | "invalidateUserProjectPermissionCache" - | "invalidateProjectPermissionCache" + "getOrgPermission" | "getOrgPermissionByRole" | "invalidateProjectPermissionCache" >; licenseService: Pick; oidcConfigDAL: Pick; @@ -232,10 +229,8 @@ export const groupServiceFactory = ({ }); if (role) { - const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id }); const groupProjects = await groupProjectDAL.find({ groupId: group.id }); await Promise.allSettled([ - ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)), ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId) ) @@ -264,7 +259,6 @@ export const groupServiceFactory = ({ message: "Failed to delete group due to plan restriction. Upgrade plan to delete group." }); - const groupMembers = await userGroupMembershipDAL.find({ groupId: id }); const groupProjects = await groupProjectDAL.find({ groupId: id }); const [group] = await groupDAL.delete({ @@ -273,7 +267,6 @@ export const groupServiceFactory = ({ }); await Promise.allSettled([ - ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)), ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId)) ]); @@ -425,7 +418,6 @@ export const groupServiceFactory = ({ const groupProjects = await groupProjectDAL.find({ groupId: group.id }); await Promise.allSettled([ - permissionService.invalidateUserProjectPermissionCache(user.id), ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId)) ]); @@ -512,7 +504,6 @@ export const groupServiceFactory = ({ const groupProjects = await groupProjectDAL.find({ groupId: group.id }); await Promise.allSettled([ - permissionService.invalidateUserProjectPermissionCache(user.id), ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId)) ]); diff --git a/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts b/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts index 8f8c05c60..27b67367e 100644 --- a/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts +++ b/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts @@ -28,10 +28,7 @@ type TIdentityProjectAdditionalPrivilegeV2ServiceFactoryDep = { identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeV2DALFactory; identityProjectDAL: Pick; projectDAL: Pick; - permissionService: Pick< - TPermissionServiceFactory, - "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache" - >; + permissionService: Pick; }; export type TIdentityProjectAdditionalPrivilegeV2ServiceFactory = ReturnType< @@ -118,10 +115,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({ permissions: packedPermission }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -141,10 +135,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -239,10 +230,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || "")) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -260,10 +248,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({ temporaryMode: null }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -321,10 +306,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({ const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...deletedPrivilege, diff --git a/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts b/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts index 7a8f1a047..ddba76920 100644 --- a/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts +++ b/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts @@ -31,10 +31,7 @@ type TIdentityProjectAdditionalPrivilegeServiceFactoryDep = { identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeDALFactory; identityProjectDAL: Pick; projectDAL: Pick; - permissionService: Pick< - TPermissionServiceFactory, - "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache" - >; + permissionService: Pick; }; export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType< @@ -133,10 +130,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ permissions: packedPermission }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -156,10 +150,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -266,10 +257,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || "")) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -287,10 +275,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ temporaryMode: null }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...additionalPrivilege, @@ -366,10 +351,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId); return { ...deletedPrivilege, diff --git a/backend/src/ee/services/permission/permission-service-types.ts b/backend/src/ee/services/permission/permission-service-types.ts index 9e5d9700b..f25b84bd5 100644 --- a/backend/src/ee/services/permission/permission-service-types.ts +++ b/backend/src/ee/services/permission/permission-service-types.ts @@ -285,6 +285,4 @@ export type TPermissionServiceFactory = { checkPermissions: ProjectPermissionSet; }) => Promise; invalidateProjectPermissionCache: (projectId: string, tx?: Knex) => Promise; - invalidateUserProjectPermissionCache: (userId: string) => Promise; - invalidateIdentityProjectPermissionCache: (identityId: string) => Promise; }; diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts index b428acce5..9e94e1415 100644 --- a/backend/src/ee/services/permission/permission-service.ts +++ b/backend/src/ee/services/permission/permission-service.ts @@ -97,16 +97,6 @@ export const permissionServiceFactory = ({ }); }; - const invalidateUserProjectPermissionCache = async (userId: string) => { - const pattern = KeyStorePrefixes.UserProjectPermissionPattern(userId); - await keyStore.deleteItems({ pattern }); - }; - - const invalidateIdentityProjectPermissionCache = async (identityId: string) => { - const pattern = KeyStorePrefixes.IdentityProjectPermissionPattern(identityId); - await keyStore.deleteItems({ pattern }); - }; - const calculateProjectPermissionTtl = (membership: unknown): number => { const now = new Date(); let minTtl = KeyStoreTtls.ProjectPermissionCacheInSeconds; @@ -805,8 +795,6 @@ export const permissionServiceFactory = ({ buildOrgPermission, buildProjectPermissionRules, checkGroupProjectPermission, - invalidateProjectPermissionCache, - invalidateUserProjectPermissionCache, - invalidateIdentityProjectPermissionCache + invalidateProjectPermissionCache }; }; diff --git a/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts b/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts index 1127ac6b4..c2876572f 100644 --- a/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts +++ b/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts @@ -27,10 +27,7 @@ import { type TProjectUserAdditionalPrivilegeServiceFactoryDep = { projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory; projectMembershipDAL: Pick; - permissionService: Pick< - TPermissionServiceFactory, - "getProjectPermission" | "invalidateUserProjectPermissionCache" | "invalidateProjectPermissionCache" - >; + permissionService: Pick; accessApprovalRequestDAL: Pick; }; @@ -119,10 +116,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ permissions: packedPermission }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectMembership.projectId), - permissionService.invalidateUserProjectPermissionCache(projectMembership.userId) - ]); + await permissionService.invalidateProjectPermissionCache(projectMembership.projectId); return { ...additionalPrivilege, @@ -143,10 +137,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectMembership.projectId), - permissionService.invalidateUserProjectPermissionCache(projectMembership.userId) - ]); + await permissionService.invalidateProjectPermissionCache(projectMembership.projectId); return { ...additionalPrivilege, @@ -245,10 +236,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || "")) }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectMembership.projectId), - permissionService.invalidateUserProjectPermissionCache(projectMembership.userId) - ]); + await permissionService.invalidateProjectPermissionCache(projectMembership.projectId); return { ...additionalPrivilege, @@ -266,10 +254,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ temporaryMode: null }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectMembership.projectId), - permissionService.invalidateUserProjectPermissionCache(projectMembership.userId) - ]); + await permissionService.invalidateProjectPermissionCache(projectMembership.projectId); return { ...additionalPrivilege, @@ -318,10 +303,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ ); const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectMembership.projectId), - permissionService.invalidateUserProjectPermissionCache(projectMembership.userId) - ]); + await permissionService.invalidateProjectPermissionCache(projectMembership.projectId); return { ...deletedPrivilege, diff --git a/backend/src/services/group-project/group-project-service.ts b/backend/src/services/group-project/group-project-service.ts index b7ff13ee0..913aca2f3 100644 --- a/backend/src/services/group-project/group-project-service.ts +++ b/backend/src/services/group-project/group-project-service.ts @@ -45,10 +45,7 @@ type TGroupProjectServiceFactoryDep = { groupDAL: Pick; permissionService: Pick< TPermissionServiceFactory, - | "getProjectPermission" - | "getProjectPermissionByRole" - | "invalidateProjectPermissionCache" - | "invalidateUserProjectPermissionCache" + "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache" >; }; @@ -269,11 +266,7 @@ export const groupProjectServiceFactory = ({ return groupProjectMembership; }); - const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return projectGroup; }; @@ -384,11 +377,7 @@ export const groupProjectServiceFactory = ({ return groupProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx); }); - const groupMembers = await userGroupMembershipDAL.find({ groupId }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return updatedRoles; }; @@ -421,8 +410,6 @@ export const groupProjectServiceFactory = ({ }); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionGroupActions.Delete, ProjectPermissionSub.Groups); - const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id }); - const deletedProjectGroup = await groupProjectDAL.transaction(async (tx) => { const groupMembersNotInProject = await userGroupMembershipDAL.findGroupMembersNotInProject( group.id, @@ -446,10 +433,7 @@ export const groupProjectServiceFactory = ({ return projectGroup; }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return deletedProjectGroup; }; diff --git a/backend/src/services/identity-project/identity-project-service.ts b/backend/src/services/identity-project/identity-project-service.ts index 8333f2ed8..08fd2cf0b 100644 --- a/backend/src/services/identity-project/identity-project-service.ts +++ b/backend/src/services/identity-project/identity-project-service.ts @@ -37,10 +37,7 @@ type TIdentityProjectServiceFactoryDep = { identityOrgMembershipDAL: Pick; permissionService: Pick< TPermissionServiceFactory, - | "getProjectPermission" - | "getProjectPermissionByRole" - | "invalidateIdentityProjectPermissionCache" - | "invalidateProjectPermissionCache" + "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache" >; }; @@ -172,10 +169,7 @@ export const identityProjectServiceFactory = ({ return { ...identityProjectMembership, roles: identityRoles }; }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return projectIdentity; }; @@ -284,10 +278,7 @@ export const identityProjectServiceFactory = ({ return identityProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx); }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return updatedRoles; }; @@ -320,10 +311,7 @@ export const identityProjectServiceFactory = ({ const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - permissionService.invalidateIdentityProjectPermissionCache(identityId) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return deletedIdentity; }; diff --git a/backend/src/services/project-membership/project-membership-service.ts b/backend/src/services/project-membership/project-membership-service.ts index bb291c1cc..301ce1bc0 100644 --- a/backend/src/services/project-membership/project-membership-service.ts +++ b/backend/src/services/project-membership/project-membership-service.ts @@ -45,10 +45,7 @@ import { TProjectUserMembershipRoleDALFactory } from "./project-user-membership- type TProjectMembershipServiceFactoryDep = { permissionService: Pick< TPermissionServiceFactory, - | "getProjectPermission" - | "getProjectPermissionByRole" - | "invalidateUserProjectPermissionCache" - | "invalidateProjectPermissionCache" + "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache" >; smtpService: TSmtpService; projectBotDAL: TProjectBotDALFactory; @@ -245,12 +242,7 @@ export const projectMembershipServiceFactory = ({ ); }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - ...orgMembers.map(({ userId }) => - userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve() - ) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); if (sendEmails) { await notificationService.createUserNotifications( @@ -384,12 +376,7 @@ export const projectMembershipServiceFactory = ({ return projectUserMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx); }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - membershipUser?.userId - ? permissionService.invalidateUserProjectPermissionCache(membershipUser.userId) - : Promise.resolve() - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return updatedRoles; }; @@ -435,10 +422,7 @@ export const projectMembershipServiceFactory = ({ return deletedMembership; }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - membership.userId ? permissionService.invalidateUserProjectPermissionCache(membership.userId) : Promise.resolve() - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return membership; }; @@ -542,12 +526,7 @@ export const projectMembershipServiceFactory = ({ return deletedMemberships; }); - await Promise.allSettled([ - permissionService.invalidateProjectPermissionCache(projectId), - ...memberships.map(({ userId }) => - userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve() - ) - ]); + await permissionService.invalidateProjectPermissionCache(projectId); return memberships; };