PIT: add commits to snapshots and improve old role hidding

2026-10-14 10:29:52 +00:00 · 2025-05-23 01:46:13 -03:00
parent 2b21c9d348
commit 4a391c7ac2
9 changed files with 197 additions and 60 deletions
@@ -23,6 +23,7 @@ import { useGetProjectTypeFromRoute } from "@app/hooks";
 import { ProjectType } from "@app/hooks/api/workspace/types";

 import {
+  EXCLUDED_PERMISSION_SUBS,
  isConditionalSubjects,
  PROJECT_PERMISSION_OBJECT,
  ProjectTypePermissionSubjects,
@@ -66,6 +67,7 @@ const Content = ({ onClose }: ContentProps) => {
          subject as ProjectPermissionSub
        ] && (search ? title.toLowerCase().includes(search.toLowerCase()) : true)
    )
+    .filter(([subject]) => !EXCLUDED_PERMISSION_SUBS.includes(subject as ProjectPermissionSub))
    .sort((a, b) => a[1].title.localeCompare(b[1].title))
    .map(([subject]) => subject);

@@ -234,6 +234,7 @@ export const projectRoleFormSchema = z.object({
      })
        .array()
        .default([]),
+      [ProjectPermissionSub.Commits]: CommitPolicyActionSchema.array().default([]),
      [ProjectPermissionSub.Member]: MemberPolicyActionSchema.array().default([]),
      [ProjectPermissionSub.Groups]: GroupPolicyActionSchema.array().default([]),
      [ProjectPermissionSub.Role]: GeneralPolicyActionSchema.array().default([]),
@@ -280,8 +281,7 @@ export const projectRoleFormSchema = z.object({
      [ProjectPermissionSub.Kms]: GeneralPolicyActionSchema.array().default([]),
      [ProjectPermissionSub.Cmek]: CmekPolicyActionSchema.array().default([]),
      [ProjectPermissionSub.SecretSyncs]: SecretSyncPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.Kmip]: KmipPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.Commits]: CommitPolicyActionSchema.array().default([])
+      [ProjectPermissionSub.Kmip]: KmipPolicyActionSchema.array().default([])
    })
    .partial()
    .optional()
@@ -416,8 +416,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
        ProjectPermissionSub.SshCertificateTemplates,
        ProjectPermissionSub.SshCertificateAuthorities,
        ProjectPermissionSub.SshCertificates,
-        ProjectPermissionSub.SshHostGroups,
-        ProjectPermissionSub.Commits
+        ProjectPermissionSub.SshHostGroups
      ].includes(subject)
    ) {
      // from above statement we are sure it won't be undefined
@@ -742,6 +741,17 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
      });
    }

+    if (subject === ProjectPermissionSub.Commits) {
+      const canRead = action.includes(ProjectPermissionCommitsActions.Read);
+      const canPerformRollback = action.includes(ProjectPermissionCommitsActions.PerformRollback);
+
+      if (!formVal[subject]) formVal[subject] = [{}];
+      if (canRead) formVal[subject]![0][ProjectPermissionCommitsActions.Read] = true;
+      if (canPerformRollback)
+        formVal[subject]![0][ProjectPermissionCommitsActions.PerformRollback] = true;
+      return;
+    }
+
    if (subject === ProjectPermissionSub.PkiSubscribers) {
      if (!formVal[subject]) formVal[subject] = [];

@@ -861,6 +871,8 @@ export const formRolePermission2API = (formVal: TFormSchema["permissions"]) => {
  return permissions;
 };

+export const EXCLUDED_PERMISSION_SUBS = [ProjectPermissionSub.SecretRollback];
+
 export type TProjectPermissionObject = {
  [K in ProjectPermissionSub]: {
    title: string;
@@ -1291,7 +1303,7 @@ const SecretsManagerPermissionSubjects = (enabled = false) => ({
  [ProjectPermissionSub.Tags]: enabled,
  [ProjectPermissionSub.Webhooks]: enabled,
  [ProjectPermissionSub.IpAllowList]: enabled,
-  [ProjectPermissionSub.SecretRollback]: false,
+  [ProjectPermissionSub.SecretRollback]: enabled,
  [ProjectPermissionSub.SecretRotation]: enabled,
  [ProjectPermissionSub.ServiceTokens]: enabled,
  [ProjectPermissionSub.Commits]: enabled
@@ -24,6 +24,7 @@ import { IdentityManagementPermissionConditions } from "./IdentityManagementPerm
 import { PermissionEmptyState } from "./PermissionEmptyState";
 import { PkiSubscriberPermissionConditions } from "./PkiSubscriberPermissionConditions";
 import {
+  EXCLUDED_PERMISSION_SUBS,
  formRolePermission2API,
  isConditionalSubjects,
  PROJECT_PERMISSION_OBJECT,
@@ -171,6 +172,7 @@ export const RolePermissionsSection = ({ roleSlug, isDisabled }: Props) => {
          <div className="py-4">
            {!isPending && <PermissionEmptyState />}
            {(Object.keys(PROJECT_PERMISSION_OBJECT) as ProjectPermissionSub[])
+              .filter((subject) => !EXCLUDED_PERMISSION_SUBS.includes(subject))
              .filter((subject) => ProjectTypePermissionSubjects[currentWorkspace.type][subject])
              .map((subject) => (
                <GeneralPermissionPolicies
@@ -328,39 +328,28 @@ export const RollbackPreviewTab = (): JSX.Element => {

            <div className="border-t border-mineshaft-600 py-4">
              <div className="flex w-full items-center justify-between gap-2">
-                <div className="flex-1">
-                  <Input
-                    placeholder="Restore Message"
-                    value={message}
-                    onChange={(e) => setMessage(e.target.value)}
-                    className="w-full border-mineshaft-500 bg-mineshaft-700 text-sm"
-                  />
-                </div>
-                <div className="flex gap-2">
-                  <Button
-                    onClick={() => {
-                      if (!message) {
-                        createNotification({
-                          type: "error",
-                          text: "Please enter a restore message"
-                        });
-                        return;
-                      }
-                      handlePopUpOpen("rollbackConfirm");
-                    }}
-                    colorSchema="primary"
-                    className="px-6 py-2"
-                    isDisabled={
-                      message.length === 0 ||
-                      !rollbackChangesNested ||
-                      !rollbackChangesNested?.some((folder) => {
-                        return folder.changes.length > 0;
-                      })
-                    }
-                  >
-                    Restore
-                  </Button>
-                </div>
+                <Input
+                  placeholder="Restore Message"
+                  value={message}
+                  onChange={(e) => setMessage(e.target.value)}
+                  className="w-full border-mineshaft-500 bg-mineshaft-700 py-2 text-sm"
+                />
+                <Button
+                  onClick={() => {
+                    handlePopUpOpen("rollbackConfirm");
+                  }}
+                  colorSchema="primary"
+                  className="px-6 py-2"
+                  isDisabled={
+                    message.length === 0 ||
+                    !rollbackChangesNested ||
+                    !rollbackChangesNested?.some((folder) => {
+                      return folder.changes.length > 0;
+                    })
+                  }
+                >
+                  Restore
+                </Button>
              </div>
            </div>
          </div>
@@ -453,7 +453,7 @@ export const SecretVersionDiffView: React.FC<SecretVersionDiffViewProps> = ({
  const differences = getVersionDifferences(item.versions);

  if (differences.length === 0) {
-    return <div className="px-6 py-3 text-gray-400">No details available</div>;
+    return null;
  }

  const changedFields = new Set<string>();
@@ -57,7 +57,7 @@ const CommitItem = ({
              </Button>
            </div>
            <p className="text-white-400 mt-2 flex flex-wrap items-center gap-4 text-sm">
-              <span className="flex items-center">
+              <span className="flex items-center text-mineshaft-300">
                {commit.actorMetadata?.email || commit.actorMetadata?.name || commit.actorType}
                <p className="ml-1 mr-1">committed</p>
                <time dateTime={commit.createdAt}>{formatTimeAgo(commit.createdAt)}</time>