From 26543b6374e63d0ca23097c4a72fecb46bd10524 Mon Sep 17 00:00:00 2001 From: = Date: Thu, 9 Oct 2025 12:18:44 +0530 Subject: [PATCH] feat: more patchy patch --- .../github-org-sync-service.ts | 28 ++++++++----------- .../ldap-config/ldap-config-service.ts | 2 +- .../ee/services/permission/org-permission.ts | 4 ++- .../project-additional-privilege-factory.ts | 22 +++++++++++---- 4 files changed, 33 insertions(+), 23 deletions(-) diff --git a/backend/src/ee/services/github-org-sync/github-org-sync-service.ts b/backend/src/ee/services/github-org-sync/github-org-sync-service.ts index 73b310340..b2bcb4ef3 100644 --- a/backend/src/ee/services/github-org-sync/github-org-sync-service.ts +++ b/backend/src/ee/services/github-org-sync/github-org-sync-service.ts @@ -372,14 +372,12 @@ export const githubOrgSyncServiceFactory = ({ tx ); const memberships = await membershipGroupDAL.insertMany( - newGroups.map( - (el) => ({ - actorGroupId: el.id, - scope: AccessScope.Organization, - scopeOrgId: orgId - }), - tx - ) + newGroups.map((el) => ({ + actorGroupId: el.id, + scope: AccessScope.Organization, + scopeOrgId: orgId + })), + tx ); await membershipRoleDAL.insertMany( @@ -717,14 +715,12 @@ export const githubOrgSyncServiceFactory = ({ ); const memberships = await membershipGroupDAL.insertMany( - newGroups.map( - (el) => ({ - actorGroupId: el.id, - scope: AccessScope.Organization, - scopeOrgId: orgPermission.orgId - }), - tx - ) + newGroups.map((el) => ({ + actorGroupId: el.id, + scope: AccessScope.Organization, + scopeOrgId: orgPermission.orgId + })), + tx ); await membershipRoleDAL.insertMany( diff --git a/backend/src/ee/services/ldap-config/ldap-config-service.ts b/backend/src/ee/services/ldap-config/ldap-config-service.ts index 4649d1dd4..43ca5ab3d 100644 --- a/backend/src/ee/services/ldap-config/ldap-config-service.ts +++ b/backend/src/ee/services/ldap-config/ldap-config-service.ts @@ -467,7 +467,7 @@ export const ldapConfigServiceFactory = ({ const [orgMembership] = await orgDAL.findMembership( { - [`${TableName.Membership}.actorUserId` as "actorUserId"]: userAlias.userId, + [`${TableName.Membership}.actorUserId` as "actorUserId"]: newUserAlias.userId, [`${TableName.Membership}.scopeOrgId` as "scopeOrgId"]: orgId, [`${TableName.Membership}.scope` as "scope"]: AccessScope.Organization }, diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts index 7bd12de51..d4da8c98f 100644 --- a/backend/src/ee/services/permission/org-permission.ts +++ b/backend/src/ee/services/permission/org-permission.ts @@ -229,7 +229,9 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [ }), z.object({ subject: z.literal(OrgPermissionSubjects.Billing).describe("The entity this permission pertains to."), - action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.") + action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionBillingActions).describe( + "Describe what action an entity can take." + ) }), z.object({ subject: z.literal(OrgPermissionSubjects.Identity).describe("The entity this permission pertains to."), diff --git a/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts b/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts index dd0d2ea55..4b5179a6f 100644 --- a/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts +++ b/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts @@ -52,10 +52,14 @@ export const newProjectAdditionalPrivilegesFactory = ({ async (dto) => { const scope = getScopeField(dto.scopeData); - const { permission } = await $getPermission(dto.permission, scope.value); - ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member); - const { actorType } = dto.data; + const { permission } = await $getPermission(dto.permission, scope.value); + const permissionSet = + actorType === ActorType.USER + ? ([ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member] as const) + : ([ProjectPermissionIdentityActions.Edit, ProjectPermissionSub.Identity] as const); + ForbiddenError.from(permission).throwUnlessCan(...permissionSet); + const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId); const { permission: targetUserPermission, memberships } = await $getPermission( { ...dto.permission, type: actorType, id: dto.data.actorId }, @@ -98,7 +102,11 @@ export const newProjectAdditionalPrivilegesFactory = ({ const { actorType } = dto.selector; const { permission } = await $getPermission(dto.permission, scope.value); - ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member); + const permissionSet = + actorType === ActorType.USER + ? ([ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member] as const) + : ([ProjectPermissionIdentityActions.Edit, ProjectPermissionSub.Identity] as const); + ForbiddenError.from(permission).throwUnlessCan(...permissionSet); const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId); const { permission: targetUserPermission, memberships } = await $getPermission( @@ -142,7 +150,11 @@ export const newProjectAdditionalPrivilegesFactory = ({ const { actorType } = dto.selector; const { permission } = await $getPermission(dto.permission, scope.value); - ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member); + const permissionSet = + actorType === ActorType.USER + ? ([ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member] as const) + : ([ProjectPermissionIdentityActions.Edit, ProjectPermissionSub.Identity] as const); + ForbiddenError.from(permission).throwUnlessCan(...permissionSet); const membership = await membershipDAL.findOne({ scopeOrgId: dto.permission.orgId,