feat: updated identity additional privilege permission object in api to have a proper body and explanation

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -1,5 +1,7 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
+import { PackRule, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
+import { z } from "zod";
 
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
@@ -8,7 +10,7 @@ import { TIdentityProjectDALFactory } from "@app/services/identity-project/ident
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSet, ProjectPermissionSub } from "../permission/project-permission";
 import { TIdentityProjectAdditionalPrivilegeDALFactory } from "./identity-project-additional-privilege-dal";
 import {
   IdentityProjectAdditionalPrivilegeTemporaryMode,
@@ -30,6 +32,22 @@ export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
   typeof identityProjectAdditionalPrivilegeServiceFactory
 >;
 
+// TODO(akhilmhdh): move this to more centralized
+export const UnpackedPermissionSchema = z.object({
+  subject: z.union([z.string().min(1), z.string().array()]).optional(),
+  action: z.union([z.string().min(1), z.string().array()]),
+  conditions: z
+    .object({
+      environment: z.string().optional(),
+      secretPath: z
+        .object({
+          $glob: z.string().min(1)
+        })
+        .optional()
+    })
+    .optional()
+});
+
 export const identityProjectAdditionalPrivilegeServiceFactory = ({
   identityProjectAdditionalPrivilegeDAL,
   identityProjectDAL,
@@ -86,7 +104,14 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
         slug,
         permissions: customPermission
       });
-      return additionalPrivilege;
+      return {
+        ...additionalPrivilege,
+        permissions: UnpackedPermissionSchema.array().parse(
+          unpackRules(
+            (additionalPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[]
+          )
+        )
+      };
     }
 
     const relativeTempAllocatedTimeInMs = ms(dto.temporaryRange);
@@ -100,7 +125,14 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       temporaryAccessStartTime: new Date(dto.temporaryAccessStartTime),
       temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
     });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: UnpackedPermissionSchema.array().parse(
+        unpackRules(
+          (additionalPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[]
+        )
+      )
+    };
   };
 
   const updateBySlug = async ({
@@ -163,7 +195,14 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
         temporaryAccessStartTime: new Date(temporaryAccessStartTime || ""),
         temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
       });
-      return additionalPrivilege;
+      return {
+        ...additionalPrivilege,
+        permissions: UnpackedPermissionSchema.array().parse(
+          unpackRules(
+            (additionalPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[]
+          )
+        )
+      };
     }
 
     const additionalPrivilege = await identityProjectAdditionalPrivilegeDAL.updateById(identityPrivilege.id, {
@@ -174,7 +213,14 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       temporaryRange: null,
       temporaryMode: null
     });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: UnpackedPermissionSchema.array().parse(
+        unpackRules(
+          (additionalPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[]
+        )
+      )
+    };
   };
 
   const deleteBySlug = async ({
@@ -220,7 +266,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" });
 
     const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
-    return deletedPrivilege;
+    return {
+      ...deletedPrivilege,
+      permissions: UnpackedPermissionSchema.array().parse(
+        unpackRules((deletedPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
+      )
+    };
   };
 
   const getPrivilegeDetailsBySlug = async ({
@@ -254,7 +305,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     });
     if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" });
 
-    return identityPrivilege;
+    return {
+      ...identityPrivilege,
+      permissions: UnpackedPermissionSchema.array().parse(
+        unpackRules((identityPrivilege.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
+      )
+    };
   };
 
   const listIdentityProjectPrivileges = async ({
@@ -284,7 +340,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     const identityPrivileges = await identityProjectAdditionalPrivilegeDAL.find({
       projectMembershipId: identityProjectMembership.id
     });
-    return identityPrivileges;
+    return identityPrivileges.map((el) => ({
+      ...el,
+      permissions: UnpackedPermissionSchema.array().parse(
+        unpackRules((el.permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
+      )
+    }));
   };
 
   return {