fix: approval policy org check

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -162,7 +162,7 @@ export const accessApprovalPolicyServiceFactory = ({
 
       if (invalidUsernames.length) {
         throw new BadRequestError({
-          message: `Invalid approver user: ${invalidUsernames.join(", ")}`
+          message: `Invalid approver user: ${invalidUsernames.map((i) => i.username).join(", ")}`
         });
       }
 
@@ -173,6 +173,22 @@ export const accessApprovalPolicyServiceFactory = ({
         }))
       );
     }
+
+    if (approverUserIds.length > 0) {
+      const allApproverUserIds = approverUserIds.map((au) => au.id);
+      const approverMembers = await orgMembershipDAL.find({
+        $in: { userId: allApproverUserIds },
+        orgId: actorOrgId
+      });
+
+      if (approverMembers.length !== allApproverUserIds.length) {
+        const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
+        const userIdsNotInOrg = allApproverUserIds.filter((id) => !approverMemberUserIds.has(id));
+        throw new BadRequestError({
+          message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
+        });
+      }
+    }
     let groupBypassers: string[] = [];
     let bypasserUserIds: string[] = [];
 
@@ -488,7 +504,7 @@ export const accessApprovalPolicyServiceFactory = ({
 
           if (invalidUsernames.length) {
             throw new BadRequestError({
-              message: `Invalid approver user: ${invalidUsernames.join(", ")}`
+              message: `Invalid approver user: ${invalidUsernames.map((i) => i.username).join(", ")}`
             });
           }
 
@@ -499,6 +515,22 @@ export const accessApprovalPolicyServiceFactory = ({
             }))
           );
         }
+
+        if (approverUserIds.length > 0) {
+          const allApproverUserIds = approverUserIds.map((au) => au.id);
+          const approverMembers = await orgMembershipDAL.find({
+            $in: { userId: allApproverUserIds },
+            orgId: actorOrgId
+          });
+
+          if (approverMembers.length !== allApproverUserIds.length) {
+            const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
+            const userIdsNotInOrg = allApproverUserIds.filter((id) => !approverMemberUserIds.has(id));
+            throw new BadRequestError({
+              message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
+            });
+          }
+        }
         await accessApprovalPolicyApproverDAL.insertMany(
           approverUserIds.map((el) => ({
             approverUserId: el.id,

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -7,6 +7,7 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { containsGlobPatterns } from "@app/lib/picomatch";
+import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
@@ -39,6 +40,7 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "find">;
   userDAL: Pick<TUserDALFactory, "find">;
+  orgMembershipDAL: Pick<TOrgMembershipDALFactory, "find">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
   secretApprovalPolicyBypasserDAL: TSecretApprovalPolicyBypasserDALFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -56,6 +58,7 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyEnvironmentDAL,
   projectEnvDAL,
   userDAL,
+  orgMembershipDAL,
   licenseService,
   secretApprovalRequestDAL
 }: TSecretApprovalPolicyServiceFactoryDep) => {
@@ -233,6 +236,24 @@ export const secretApprovalPolicyServiceFactory = ({
         userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
       }
 
+      if (userApproverIds.length > 0) {
+        const approverMembers = await orgMembershipDAL.find(
+          {
+            $in: { userId: userApproverIds },
+            orgId: actorOrgId
+          },
+          { tx }
+        );
+
+        if (approverMembers.length !== userApproverIds.length) {
+          const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
+          const userIdsNotInOrg = userApproverIds.filter((id) => !approverMemberUserIds.has(id));
+          throw new BadRequestError({
+            message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
+          });
+        }
+      }
+
       await secretApprovalPolicyApproverDAL.insertMany(
         userApproverIds.map((approverUserId) => ({
           approverUserId,
@@ -425,6 +446,24 @@ export const secretApprovalPolicyServiceFactory = ({
           userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
         }
 
+        if (userApproverIds.length > 0) {
+          const approverMembers = await orgMembershipDAL.find(
+            {
+              $in: { userId: userApproverIds },
+              orgId: actorOrgId
+            },
+            { tx }
+          );
+
+          if (approverMembers.length !== userApproverIds.length) {
+            const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
+            const userIdsNotInOrg = userApproverIds.filter((id) => !approverMemberUserIds.has(id));
+            throw new BadRequestError({
+              message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
+            });
+          }
+        }
+
         await secretApprovalPolicyApproverDAL.insertMany(
           userApproverIds.map((approverUserId) => ({
             approverUserId,

backend/src/server/routes/index.ts

@@ -604,6 +604,7 @@ export const registerRoutes = async (
     secretApprovalPolicyDAL,
     licenseService,
     userDAL,
+    orgMembershipDAL,
     secretApprovalRequestDAL
   });
   const tokenService = tokenServiceFactory({ tokenDAL: authTokenDAL, userDAL, orgMembershipDAL });