Add access approval requests to project permission cache logic

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -35,7 +35,7 @@ import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-a
 
 type TSecretApprovalRequestServiceFactoryDep = {
   additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "create" | "findById">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
   accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   projectDAL: Pick<
@@ -758,6 +758,8 @@ export const accessApprovalRequestServiceFactory = ({
             { privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED },
             tx
           );
+
+          await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx);
         }
       }
 

backend/src/ee/services/group/group-service.ts

@@ -46,10 +46,7 @@ type TGroupServiceFactoryDep = {
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "findLatestProjectKey" | "insertMany">;
   permissionService: Pick<
     TPermissionServiceFactory,
-    | "getOrgPermission"
+    "getOrgPermission" | "getOrgPermissionByRole" | "invalidateProjectPermissionCache"
-    | "getOrgPermissionByRole"
-    | "invalidateUserProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
   >;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
@@ -232,10 +229,8 @@ export const groupServiceFactory = ({
     });
 
     if (role) {
-      const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
       const groupProjects = await groupProjectDAL.find({ groupId: group.id });
       await Promise.allSettled([
-        ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
         ...groupProjects.map((groupProject) =>
           permissionService.invalidateProjectPermissionCache(groupProject.projectId)
         )
@@ -264,7 +259,6 @@ export const groupServiceFactory = ({
         message: "Failed to delete group due to plan restriction. Upgrade plan to delete group."
       });
 
-    const groupMembers = await userGroupMembershipDAL.find({ groupId: id });
     const groupProjects = await groupProjectDAL.find({ groupId: id });
 
     const [group] = await groupDAL.delete({
@@ -273,7 +267,6 @@ export const groupServiceFactory = ({
     });
 
     await Promise.allSettled([
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
       ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
     ]);
 
@@ -425,7 +418,6 @@ export const groupServiceFactory = ({
 
     const groupProjects = await groupProjectDAL.find({ groupId: group.id });
     await Promise.allSettled([
-      permissionService.invalidateUserProjectPermissionCache(user.id),
       ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
     ]);
 
@@ -512,7 +504,6 @@ export const groupServiceFactory = ({
 
     const groupProjects = await groupProjectDAL.find({ groupId: group.id });
     await Promise.allSettled([
-      permissionService.invalidateUserProjectPermissionCache(user.id),
       ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
     ]);
 

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -28,10 +28,7 @@ type TIdentityProjectAdditionalPrivilegeV2ServiceFactoryDep = {
   identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeV2DALFactory;
   identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
-  permissionService: Pick<
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
-  >;
 };
 
 export type TIdentityProjectAdditionalPrivilegeV2ServiceFactory = ReturnType<
@@ -118,10 +115,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
         permissions: packedPermission
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -141,10 +135,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
       temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -239,10 +230,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
         temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -260,10 +248,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
       temporaryMode: null
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -321,10 +306,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
 
     const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
 
     return {
       ...deletedPrivilege,

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -31,10 +31,7 @@ type TIdentityProjectAdditionalPrivilegeServiceFactoryDep = {
   identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeDALFactory;
   identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
-  permissionService: Pick<
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
-  >;
 };
 
 export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
@@ -133,10 +130,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
         permissions: packedPermission
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -156,10 +150,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -266,10 +257,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
         temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -287,10 +275,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       temporaryMode: null
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -366,10 +351,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
 
     const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return {
       ...deletedPrivilege,

backend/src/ee/services/permission/permission-service-types.ts

@@ -285,6 +285,4 @@ export type TPermissionServiceFactory = {
     checkPermissions: ProjectPermissionSet;
   }) => Promise<boolean>;
   invalidateProjectPermissionCache: (projectId: string, tx?: Knex) => Promise<void>;
-  invalidateUserProjectPermissionCache: (userId: string) => Promise<void>;
-  invalidateIdentityProjectPermissionCache: (identityId: string) => Promise<void>;
 };

backend/src/ee/services/permission/permission-service.ts

@@ -97,16 +97,6 @@ export const permissionServiceFactory = ({
     });
   };
 
-  const invalidateUserProjectPermissionCache = async (userId: string) => {
-    const pattern = KeyStorePrefixes.UserProjectPermissionPattern(userId);
-    await keyStore.deleteItems({ pattern });
-  };
-
-  const invalidateIdentityProjectPermissionCache = async (identityId: string) => {
-    const pattern = KeyStorePrefixes.IdentityProjectPermissionPattern(identityId);
-    await keyStore.deleteItems({ pattern });
-  };
-
   const calculateProjectPermissionTtl = (membership: unknown): number => {
     const now = new Date();
     let minTtl = KeyStoreTtls.ProjectPermissionCacheInSeconds;
@@ -805,8 +795,6 @@ export const permissionServiceFactory = ({
     buildOrgPermission,
     buildProjectPermissionRules,
     checkGroupProjectPermission,
-    invalidateProjectPermissionCache,
+    invalidateProjectPermissionCache
-    invalidateUserProjectPermissionCache,
-    invalidateIdentityProjectPermissionCache
   };
 };

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -27,10 +27,7 @@ import {
 type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
   projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
-  permissionService: Pick<
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateUserProjectPermissionCache" | "invalidateProjectPermissionCache"
-  >;
   accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
 };
 
@@ -119,10 +116,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
         permissions: packedPermission
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-        permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -143,10 +137,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -245,10 +236,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
         temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
       });
 
-      await Promise.allSettled([
+      await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
-        permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-        permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-      ]);
 
       return {
         ...additionalPrivilege,
@@ -266,10 +254,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       temporaryMode: null
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
 
     return {
       ...additionalPrivilege,
@@ -318,10 +303,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     );
     const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
 
     return {
       ...deletedPrivilege,

backend/src/services/group-project/group-project-service.ts

@@ -45,10 +45,7 @@ type TGroupProjectServiceFactoryDep = {
   groupDAL: Pick<TGroupDALFactory, "findOne" | "findAllGroupPossibleMembers">;
   permissionService: Pick<
     TPermissionServiceFactory,
-    | "getProjectPermission"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
-    | "getProjectPermissionByRole"
-    | "invalidateProjectPermissionCache"
-    | "invalidateUserProjectPermissionCache"
   >;
 };
 
@@ -269,11 +266,7 @@ export const groupProjectServiceFactory = ({
       return groupProjectMembership;
     });
 
-    const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
+    await permissionService.invalidateProjectPermissionCache(projectId);
-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
 
     return projectGroup;
   };
@@ -384,11 +377,7 @@ export const groupProjectServiceFactory = ({
       return groupProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
     });
 
-    const groupMembers = await userGroupMembershipDAL.find({ groupId });
+    await permissionService.invalidateProjectPermissionCache(projectId);
-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
 
     return updatedRoles;
   };
@@ -421,8 +410,6 @@ export const groupProjectServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionGroupActions.Delete, ProjectPermissionSub.Groups);
 
-    const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
-
     const deletedProjectGroup = await groupProjectDAL.transaction(async (tx) => {
       const groupMembersNotInProject = await userGroupMembershipDAL.findGroupMembersNotInProject(
         group.id,
@@ -446,10 +433,7 @@ export const groupProjectServiceFactory = ({
       return projectGroup;
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
 
     return deletedProjectGroup;
   };

backend/src/services/identity-project/identity-project-service.ts

@@ -37,10 +37,7 @@ type TIdentityProjectServiceFactoryDep = {
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
   permissionService: Pick<
     TPermissionServiceFactory,
-    | "getProjectPermission"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
-    | "getProjectPermissionByRole"
-    | "invalidateIdentityProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
   >;
 };
 
@@ -172,10 +169,7 @@ export const identityProjectServiceFactory = ({
       return { ...identityProjectMembership, roles: identityRoles };
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return projectIdentity;
   };
@@ -284,10 +278,7 @@ export const identityProjectServiceFactory = ({
       return identityProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return updatedRoles;
   };
@@ -320,10 +311,7 @@ export const identityProjectServiceFactory = ({
 
     const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
 
     return deletedIdentity;
   };

backend/src/services/project-membership/project-membership-service.ts

@@ -45,10 +45,7 @@ import { TProjectUserMembershipRoleDALFactory } from "./project-user-membership-
 type TProjectMembershipServiceFactoryDep = {
   permissionService: Pick<
     TPermissionServiceFactory,
-    | "getProjectPermission"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
-    | "getProjectPermissionByRole"
-    | "invalidateUserProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
   >;
   smtpService: TSmtpService;
   projectBotDAL: TProjectBotDALFactory;
@@ -245,12 +242,7 @@ export const projectMembershipServiceFactory = ({
       );
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...orgMembers.map(({ userId }) =>
-        userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve()
-      )
-    ]);
 
     if (sendEmails) {
       await notificationService.createUserNotifications(
@@ -384,12 +376,7 @@ export const projectMembershipServiceFactory = ({
       return projectUserMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      membershipUser?.userId
-        ? permissionService.invalidateUserProjectPermissionCache(membershipUser.userId)
-        : Promise.resolve()
-    ]);
 
     return updatedRoles;
   };
@@ -435,10 +422,7 @@ export const projectMembershipServiceFactory = ({
       return deletedMembership;
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      membership.userId ? permissionService.invalidateUserProjectPermissionCache(membership.userId) : Promise.resolve()
-    ]);
 
     return membership;
   };
@@ -542,12 +526,7 @@ export const projectMembershipServiceFactory = ({
       return deletedMemberships;
     });
 
-    await Promise.allSettled([
+    await permissionService.invalidateProjectPermissionCache(projectId);
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...memberships.map(({ userId }) =>
-        userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve()
-      )
-    ]);
 
     return memberships;
   };