feat(rbac): removed owner role and changed member permissions

backend/src/controllers/v1/organizationController.ts

@@ -8,7 +8,7 @@ import {
 } from "../../models";
 import { createOrganization as create } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
-import { ACCEPTED, OWNER } from "../../variables";
+import { ACCEPTED, ADMIN } from "../../variables";
 import { getLicenseServerUrl, getSiteURL } from "../../config";
 import { licenseServerKeyRequest } from "../../config/request";
 import { validateRequest } from "../../helpers/validation";
@@ -55,7 +55,7 @@ export const createOrganization = async (req: Request, res: Response) => {
   await addMembershipsOrg({
     userIds: [req.user._id.toString()],
     organizationId: organization._id.toString(),
-    roles: [OWNER],
+    roles: [ADMIN],
     statuses: [ACCEPTED]
   });
 

backend/src/ee/controllers/v1/roleController.ts

@@ -171,18 +171,6 @@ export const getRoles = async (req: Request, res: Response) => {
   const customRoles = await Role.find({ organization: orgId, isOrgRole, workspace: workspaceId });
   // as this is shared between org and workspace switch the rule set based on it
   const roles = [
-    // owner is only in org level role
-    ...(isOrgRole
-      ? [
-          {
-            _id: "owner",
-            name: "Owner",
-            slug: "owner",
-            description: "Complete administration access over the organization.",
-            permissions: adminPermissions.rules
-          }
-        ]
-      : []),
     {
       _id: "admin",
       name: "Admin",
@@ -192,7 +180,7 @@ export const getRoles = async (req: Request, res: Response) => {
     },
     {
       _id: "member",
-      name: "Member",
+      name: isOrgRole ? "Member" : "Developer",
       slug: "member",
       description: "Non-administrative role in an organization",
       permissions: isOrgRole ? memberPermissions.rules : memberProjectPermissions.rules

backend/src/ee/services/ProjectRoleService.ts

@@ -158,13 +158,39 @@ const buildMemberPermission = () => {
   can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback);
 
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.ServiceTokens);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Settings);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Environments);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Tags);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
 

backend/src/ee/services/RoleService.ts

@@ -86,12 +86,17 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
   can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+
   can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
 
   return build({ conditionsMatcher });
 };
@@ -114,8 +119,7 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
     throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
   }
 
-  if (membership.role === "admin" || membership.role === "owner")
-    return { permission: adminPermissions, membership };
+  if (membership.role === "admin") return { permission: adminPermissions, membership };
 
   if (membership.role === "member") return { permission: memberPermissions, membership };
 

backend/src/helpers/signup.ts

@@ -1,7 +1,7 @@
 import { IUser } from "../models";
 import { createOrganization } from "./organization";
 import { addMembershipsOrg } from "./membershipOrg";
-import { ACCEPTED, OWNER } from "../variables";
+import { ACCEPTED, ADMIN } from "../variables";
 import { sendMail } from "../helpers/nodemailer";
 import { TokenService } from "../services";
 import { TOKEN_EMAIL_CONFIRMATION } from "../variables";
@@ -14,10 +14,10 @@ import { TOKEN_EMAIL_CONFIRMATION } from "../variables";
  * @returns {Boolean} success - whether or not operation was successful
  */
 export const sendEmailVerification = async ({ email }: { email: string }) => {
-	const token = await TokenService.createToken({
-		type: TOKEN_EMAIL_CONFIRMATION,
-		email,
-	});
+  const token = await TokenService.createToken({
+    type: TOKEN_EMAIL_CONFIRMATION,
+    email
+  });
 
   // send mail
   await sendMail({
@@ -25,8 +25,8 @@ export const sendEmailVerification = async ({ email }: { email: string }) => {
     subjectLine: "Infisical confirmation code",
     recipients: [email],
     substitutions: {
-      code: token,
-    },
+      code: token
+    }
   });
 };
 
@@ -36,17 +36,11 @@ export const sendEmailVerification = async ({ email }: { email: string }) => {
  * @param {String} obj.email - emai
  * @param {String} obj.code - code that was sent to [email]
  */
-export const checkEmailVerification = async ({
-	email,
-	code,
-}: {
-	email: string;
-	code: string;
-}) => {
+export const checkEmailVerification = async ({ email, code }: { email: string; code: string }) => {
   await TokenService.validateToken({
     type: TOKEN_EMAIL_CONFIRMATION,
     email,
-    token: code,
+    token: code
   });
 };
 
@@ -58,27 +52,27 @@ export const checkEmailVerification = async ({
  * @param {IUser} obj.user - user who we are initializing for
  */
 export const initializeDefaultOrg = async ({
-	organizationName,
-	user,
+  organizationName,
+  user
 }: {
-	organizationName: string;
-	user: IUser;
+  organizationName: string;
+  user: IUser;
 }) => {
-	try {
-		// create organization with user as owner and initialize a free
-		// subscription
-		const organization = await createOrganization({
-			email: user.email,
-			name: organizationName,
-		});
+  try {
+    // create organization with user as owner and initialize a free
+    // subscription
+    const organization = await createOrganization({
+      email: user.email,
+      name: organizationName
+    });
 
-		await addMembershipsOrg({
-			userIds: [user._id.toString()],
-			organizationId: organization._id.toString(),
-			roles: [OWNER],
-			statuses: [ACCEPTED],
-		});
-	} catch (err) {
-		throw new Error(`Failed to initialize default organization and workspace [err=${err}]`);
-	}
-};
+    await addMembershipsOrg({
+      userIds: [user._id.toString()],
+      organizationId: organization._id.toString(),
+      roles: [ADMIN],
+      statuses: [ACCEPTED]
+    });
+  } catch (err) {
+    throw new Error(`Failed to initialize default organization and workspace [err=${err}]`);
+  }
+};

backend/src/models/membershipOrg.ts

@@ -1,5 +1,5 @@
 import { Document, Schema, Types, model } from "mongoose";
-import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER, OWNER } from "../variables";
+import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER } from "../variables";
 
 export interface IMembershipOrg extends Document {
   _id: Types.ObjectId;
@@ -26,7 +26,7 @@ const membershipOrgSchema = new Schema(
     },
     role: {
       type: String,
-      enum: [OWNER, ADMIN, MEMBER, CUSTOM],
+      enum: [ADMIN, MEMBER, CUSTOM],
       required: true
     },
     status: {

backend/src/utils/setup/backfillData.ts

@@ -13,6 +13,7 @@ import {
   Integration,
   IntegrationAuth,
   Membership,
+  MembershipOrg,
   Organization,
   Secret,
   SecretBlindIndexData,
@@ -23,10 +24,12 @@ import {
 import { generateKeyPair } from "../../utils/crypto";
 import { client, getEncryptionKey, getRootEncryptionKey } from "../../config";
 import {
+  ADMIN,
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_BASE64,
   ENCODING_SCHEME_UTF8,
   MEMBER,
+  OWNER,
   VIEWER
 } from "../../variables";
 import { InternalServerError } from "../errors";
@@ -691,5 +694,16 @@ export const backfillPermission = async () => {
       }
     ]
   );
+
+  await MembershipOrg.updateMany(
+    {
+      role: OWNER
+    },
+    {
+      $set: {
+        role: ADMIN
+      }
+    }
+  );
   console.log("Backfill: Finishing converting old denied permission in workspace to viewers");
 };