Add/remove bulk users to projects upon add/remove users to/from groups

backend/src/ee/services/permission/permission-dal.ts

@@ -45,6 +45,44 @@ export const permissionDALFactory = (db: TDbClient) => {
 
   const getProjectPermission = async (userId: string, projectId: string) => {
     try {
+      const groups: string[] = await db(TableName.GroupProjectMembership)
+        .where(`${TableName.GroupProjectMembership}.projectId`, projectId)
+        .pluck(`${TableName.GroupProjectMembership}.groupId`);
+
+      const groupDocs = await db(TableName.UserGroupMembership)
+        .where(`${TableName.UserGroupMembership}.userId`, userId)
+        .whereIn(`${TableName.UserGroupMembership}.groupId`, groups)
+        .join(
+          TableName.GroupProjectMembership,
+          `${TableName.GroupProjectMembership}.groupId`,
+          `${TableName.UserGroupMembership}.groupId`
+        )
+        .join(
+          TableName.GroupProjectMembershipRole,
+          `${TableName.GroupProjectMembershipRole}.projectMembershipId`,
+          `${TableName.GroupProjectMembership}.id`
+        )
+        .leftJoin(
+          TableName.ProjectRoles,
+          `${TableName.GroupProjectMembershipRole}.customRoleId`,
+          `${TableName.ProjectRoles}.id`
+        )
+        .join(TableName.Project, `${TableName.GroupProjectMembership}.projectId`, `${TableName.Project}.id`)
+        .join(TableName.Organization, `${TableName.Project}.orgId`, `${TableName.Organization}.id`)
+        .select(selectAllTableCols(TableName.GroupProjectMembershipRole))
+        .select(
+          db.ref("id").withSchema(TableName.GroupProjectMembership).as("membershipId"),
+          // TODO(roll-forward-migration): remove this field when we drop this in next migration after a week
+          db.ref("role").withSchema(TableName.GroupProjectMembership).as("oldRoleField"),
+          db.ref("createdAt").withSchema(TableName.GroupProjectMembership).as("membershipCreatedAt"),
+          db.ref("updatedAt").withSchema(TableName.GroupProjectMembership).as("membershipUpdatedAt"),
+          db.ref("projectId").withSchema(TableName.GroupProjectMembership),
+          db.ref("authEnforced").withSchema(TableName.Organization).as("orgAuthEnforced"),
+          db.ref("orgId").withSchema(TableName.Project),
+          db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug")
+        )
+        .select("permissions");
+
       const docs = await db(TableName.ProjectMembership)
         .join(
           TableName.ProjectUserMembershipRole,
@@ -67,17 +105,16 @@ export const permissionDALFactory = (db: TDbClient) => {
           db.ref("role").withSchema(TableName.ProjectMembership).as("oldRoleField"),
           db.ref("createdAt").withSchema(TableName.ProjectMembership).as("membershipCreatedAt"),
           db.ref("updatedAt").withSchema(TableName.ProjectMembership).as("membershipUpdatedAt"),
+          db.ref("projectId").withSchema(TableName.ProjectMembership),
           db.ref("authEnforced").withSchema(TableName.Organization).as("orgAuthEnforced"),
           db.ref("orgId").withSchema(TableName.Project),
           db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug")
         )
         .select("permissions");
 
-      console.log("getProjectPermission docs: ", docs);
-
       const permission = sqlNestRelationships({
-        data: docs,
-        key: "membershipId",
+        data: docs.concat(groupDocs),
+        key: "projectId",
         parentMapper: ({
           orgId,
           orgAuthEnforced,
@@ -107,11 +144,48 @@ export const permissionDALFactory = (db: TDbClient) => {
           }
         ]
       });
+
+      // const permission = sqlNestRelationships({
+      //   data: docs, // TODO: concat?
+      //   key: "membershipId",
+      //   parentMapper: ({
+      //     orgId,
+      //     orgAuthEnforced,
+      //     membershipId,
+      //     membershipCreatedAt,
+      //     membershipUpdatedAt,
+      //     oldRoleField,
+      //     // role
+      //   }) => ({
+      //     orgId,
+      //     orgAuthEnforced,
+      //     userId,
+      //     role: oldRoleField,
+      //     // role,
+      //     id: membershipId,
+      //     projectId,
+      //     createdAt: membershipCreatedAt,
+      //     updatedAt: membershipUpdatedAt
+      //   }),
+      //   childrenMapper: [
+      //     {
+      //       key: "id",
+      //       label: "roles" as const,
+      //       mapper: (data) =>
+      //         ProjectUserMembershipRolesSchema.extend({
+      //           permissions: z.unknown(),
+      //           customRoleSlug: z.string().optional().nullable()
+      //         }).parse(data)
+      //     }
+      //   ]
+      // });
+
       // when introducting cron mode change it here
       const activeRoles = permission?.[0]?.roles.filter(
         ({ isTemporary, temporaryAccessEndTime }) =>
           !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
       );
+
       return permission?.[0] ? { ...permission[0], roles: activeRoles } : undefined;
     } catch (error) {
       throw new DatabaseError({ error, name: "GetProjectPermission" });

backend/src/ee/services/permission/project-permission.ts

@@ -218,6 +218,7 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Groups);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);