feat: completed ap, org roles and project roles and project membership

2026-10-15 22:46:24 +00:00 · 2025-10-09 23:58:10 +05:30
parent e232282bea
commit 4d68d48d89
13 changed files with 714 additions and 244 deletions
@@ -1,7 +1,6 @@
 import slugify from "@sindresorhus/slugify";
 import { z } from "zod";

-import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-types";
 import { backfillPermissionV1SchemaToV2Schema } from "@app/ee/services/permission/project-permission";
 import { ApiDocsTags, IDENTITY_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { UnauthorizedError } from "@app/lib/errors";
@@ -16,6 +15,7 @@ import {
  SanitizedIdentityPrivilegeSchema
 } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { AccessScope, MembershipActors, TemporaryPermissionMode } from "@app/db/schemas";

 export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: FastifyZodProvider) => {
  server.route({
@@ -56,6 +56,10 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
      if (!permissions && !privilegePermission) {
        throw new UnauthorizedError({ message: "Permission or privilegePermission must be provided" });
      }
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.body.projectSlug
+      });

      const permission = privilegePermission
        ? privilegePermission.actions.map((action) => ({
@@ -64,19 +68,35 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
            conditions: privilegePermission.conditions
          }))
        : permissions!;
-      const privilege = await server.services.identityProjectAdditionalPrivilege.create({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        ...req.body,
-        slug: req.body.slug ?? slugify(alphaNumericNanoId(12)),
-        isTemporary: false,
-        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-        // @ts-ignore-error this is valid ts
-        permissions: backfillPermissionV1SchemaToV2Schema(permission)
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.createAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        data: {
+          actorId: req.body.identityId,
+          actorType: MembershipActors.Identity,
+          ...req.body,
+          isTemporary: false,
+          name: req.body.slug || slugify(alphaNumericNanoId(8)),
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore-error this is valid ts
+          permissions: backfillPermissionV1SchemaToV2Schema(permission)
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.body.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -106,7 +126,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
          IDENTITY_ADDITIONAL_PRIVILEGE.CREATE.privilegePermission
        ).optional(),
        temporaryMode: z
-          .nativeEnum(IdentityProjectAdditionalPrivilegeTemporaryMode)
+          .nativeEnum(TemporaryPermissionMode)
          .describe(IDENTITY_ADDITIONAL_PRIVILEGE.CREATE.temporaryMode),
        temporaryRange: z
          .string()
@@ -138,19 +158,39 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
          }))
        : permissions!;

-      const privilege = await server.services.identityProjectAdditionalPrivilege.create({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        ...req.body,
-        slug: req.body.slug ?? slugify(alphaNumericNanoId(12)),
-        isTemporary: true,
-        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-        // @ts-ignore-error this is valid ts
-        permissions: backfillPermissionV1SchemaToV2Schema(permission)
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.body.projectSlug
      });
-      return { privilege };
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.createAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        data: {
+          actorId: req.body.identityId,
+          actorType: MembershipActors.Identity,
+          ...req.body,
+          isTemporary: true,
+          name: req.body.slug || slugify(alphaNumericNanoId(8)),
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore-error this is valid ts
+          permissions: backfillPermissionV1SchemaToV2Schema(permission)
+        }
+      });
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.body.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -183,7 +223,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
            ).optional(),
            isTemporary: z.boolean().describe(IDENTITY_ADDITIONAL_PRIVILEGE.UPDATE.isTemporary),
            temporaryMode: z
-              .nativeEnum(IdentityProjectAdditionalPrivilegeTemporaryMode)
+              .nativeEnum(TemporaryPermissionMode)
              .describe(IDENTITY_ADDITIONAL_PRIVILEGE.UPDATE.temporaryMode),
            temporaryRange: z
              .string()
@@ -216,18 +256,43 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
            conditions: privilegePermission.conditions
          }))
        : permissions!;
-      const privilege = await server.services.identityProjectAdditionalPrivilege.updateBySlug({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        slug: req.body.privilegeSlug,
-        identityId: req.body.identityId,
-        projectSlug: req.body.projectSlug,
+
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.body.projectSlug
+      });
+
+      const { membershipId } = await server.services.convertor.identityIdToMembershipId(
+        req.body.identityId,
+        AccessScope.Project,
+        projectId
+      );
+
+      const { privilegeId } = await server.services.convertor.additionalPrivilegeNameToId(
+        req.body.privilegeSlug,
+        membershipId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.updateAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: req.body.identityId,
+          actorType: MembershipActors.Identity,
+          id: privilegeId
+        },
        data: {
+          ...req.body,
+          isTemporary: true,
          ...updatedInfo,
          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
          // @ts-ignore-error this is valid ts
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore-error this is valid ts
          permissions: permission
            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
              // @ts-ignore-error this is valid ts
@@ -235,7 +300,16 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
            : undefined
        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.body.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -267,16 +341,45 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilege.deleteBySlug({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        slug: req.body.privilegeSlug,
-        identityId: req.body.identityId,
-        projectSlug: req.body.projectSlug
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.body.projectSlug
      });
-      return { privilege };
+
+      const { membershipId } = await server.services.convertor.identityIdToMembershipId(
+        req.body.identityId,
+        AccessScope.Project,
+        projectId
+      );
+
+      const { privilegeId } = await server.services.convertor.additionalPrivilegeNameToId(
+        req.body.privilegeSlug,
+        membershipId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.deleteAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: req.body.identityId,
+          actorType: MembershipActors.Identity,
+          id: privilegeId
+        }
+      });
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.body.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -310,15 +413,45 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilege.getPrivilegeDetailsBySlug({
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        slug: req.params.privilegeSlug,
-        ...req.query
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.query.projectSlug
      });
-      return { privilege };
+
+      const { membershipId } = await server.services.convertor.identityIdToMembershipId(
+        req.query.identityId,
+        AccessScope.Project,
+        projectId
+      );
+
+      const { privilegeId } = await server.services.convertor.additionalPrivilegeNameToId(
+        req.params.privilegeSlug,
+        membershipId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.getAdditionalPrivilegeById({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: req.query.identityId,
+          actorType: MembershipActors.Identity,
+          id: privilegeId
+        }
+      });
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.query.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -349,15 +482,32 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privileges = await server.services.identityProjectAdditionalPrivilege.listIdentityProjectPrivileges({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.query
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        orgId: req.permission.orgId,
+        slug: req.query.projectSlug
      });
+
+      const { additionalPrivileges: privileges } = await server.services.additionalPrivilege.listAdditionalPrivileges({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: req.query.identityId,
+          actorType: MembershipActors.Identity
+        }
+      });
+
      return {
-        privileges
+        privileges: privileges.map((privilege) => ({
+          ...privilege,
+          identityId: req.query.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }))
      };
    }
  });
@@ -1,9 +1,9 @@
 import slugify from "@sindresorhus/slugify";
 import { z } from "zod";

+import { AccessScope, MembershipActors, TemporaryPermissionMode } from "@app/db/schemas";
 import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
 import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
-import { ProjectUserAdditionalPrivilegeTemporaryMode } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
 import { PROJECT_USER_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -34,7 +34,7 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
          z.object({
            isTemporary: z.literal(true),
            temporaryMode: z
-              .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
+              .nativeEnum(TemporaryPermissionMode)
              .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.temporaryMode),
            temporaryRange: z
              .string()
@@ -55,17 +55,31 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
    },
    onRequest: verifyAuth([AuthMode.JWT]),
    handler: async (req) => {
-      const privilege = await server.services.projectUserAdditionalPrivilege.create({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        projectMembershipId: req.body.projectMembershipId,
-        ...req.body.type,
-        slug: req.body.slug || slugify(alphaNumericNanoId(8)),
-        permissions: req.body.permissions
+      const { userId, membership } = await server.services.convertor.userMembershipIdToUserId(
+        req.body.projectMembershipId,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.createAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        data: {
+          actorId: userId,
+          actorType: MembershipActors.User,
+          ...req.body.type,
+          name: req.body.slug || slugify(alphaNumericNanoId(8)),
+          permissions: req.body.permissions
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: { ...privilege, userId, projectId: membership.scopeProjectId as string, slug: privilege.name }
+      };
    }
  });

@@ -91,7 +105,7 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
            z.object({
              isTemporary: z.literal(true).describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.isTemporary),
              temporaryMode: z
-                .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
+                .nativeEnum(TemporaryPermissionMode)
                .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.temporaryMode),
              temporaryRange: z
                .string()
@@ -113,21 +127,43 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
    },
    onRequest: verifyAuth([AuthMode.JWT]),
    handler: async (req) => {
-      const privilege = await server.services.projectUserAdditionalPrivilege.updateById({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        ...req.body,
-        ...req.body.type,
-        permissions: req.body.permissions
-          ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore-error this is valid ts
-            req.body.permissions
-          : undefined,
-        privilegeId: req.params.privilegeId
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.privilegeId,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.updateAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        data: {
+          ...req.body,
+          ...req.body.type,
+          permissions: req.body.permissions
+            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+              // @ts-ignore-error this is valid ts
+              req.body.permissions
+            : undefined
+        },
+        selector: {
+          id: req.params.privilegeId,
+          actorId: membership.actorUserId as string,
+          actorType: MembershipActors.User
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          userId: membership.actorUserId as string,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -149,14 +185,34 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
    },
    onRequest: verifyAuth([AuthMode.JWT]),
    handler: async (req) => {
-      const privilege = await server.services.projectUserAdditionalPrivilege.deleteById({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        privilegeId: req.params.privilegeId
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.privilegeId,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.deleteAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          id: req.params.privilegeId,
+          actorId: membership.actorUserId as string,
+          actorType: MembershipActors.User
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          userId: membership.actorUserId as string,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -178,14 +234,33 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
    },
    onRequest: verifyAuth([AuthMode.JWT]),
    handler: async (req) => {
-      const privileges = await server.services.projectUserAdditionalPrivilege.listPrivileges({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        projectMembershipId: req.query.projectMembershipId
+      const { userId, membership } = await server.services.convertor.userMembershipIdToUserId(
+        req.query.projectMembershipId,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivileges: privileges } = await server.services.additionalPrivilege.listAdditionalPrivileges({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: userId,
+          actorType: MembershipActors.User
+        }
      });
-      return { privileges };
+
+      return {
+        privileges: privileges.map((privilege) => ({
+          ...privilege,
+          userId: membership.actorUserId as string,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }))
+      };
    }
  });

@@ -207,14 +282,34 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
    },
    onRequest: verifyAuth([AuthMode.JWT]),
    handler: async (req) => {
-      const privilege = await server.services.projectUserAdditionalPrivilege.getPrivilegeDetailsById({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        privilegeId: req.params.privilegeId
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.privilegeId,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.getAdditionalPrivilegeById({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          id: req.params.privilegeId,
+          actorId: membership.actorUserId as string,
+          actorType: MembershipActors.User
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          userId: membership.actorUserId as string,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });
 };
@@ -1,7 +1,7 @@
 import slugify from "@sindresorhus/slugify";
 import { z } from "zod";

-import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-types";
+import { AccessScope, MembershipActors, TemporaryPermissionMode } from "@app/db/schemas";
 import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
 import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
 import { ApiDocsTags, IDENTITY_ADDITIONAL_PRIVILEGE_V2 } from "@app/lib/api-docs";
@@ -43,7 +43,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
          z.object({
            isTemporary: z.literal(true),
            temporaryMode: z
-              .nativeEnum(IdentityProjectAdditionalPrivilegeTemporaryMode)
+              .nativeEnum(TemporaryPermissionMode)
              .describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.temporaryMode),
            temporaryRange: z
              .string()
@@ -64,18 +64,31 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilegeV2.create({
-        actorAuthMethod: req.permission.authMethod,
-        actorId: req.permission.id,
-        actorOrgId: req.permission.orgId,
-        actor: req.permission.type,
-        projectId: req.body.projectId,
-        identityId: req.body.identityId,
-        ...req.body.type,
-        slug: req.body.slug || slugify(alphaNumericNanoId(8)),
-        permissions: req.body.permissions
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.createAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: req.body.projectId,
+          orgId: req.permission.orgId
+        },
+        data: {
+          actorId: req.body.identityId,
+          actorType: MembershipActors.Identity,
+          ...req.body.type,
+          name: req.body.slug || slugify(alphaNumericNanoId(8)),
+          permissions: req.body.permissions
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.body.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId: req.body.projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -108,7 +121,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
          z.object({
            isTemporary: z.literal(true).describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.isTemporary),
            temporaryMode: z
-              .nativeEnum(IdentityProjectAdditionalPrivilegeTemporaryMode)
+              .nativeEnum(TemporaryPermissionMode)
              .describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.temporaryMode),
            temporaryRange: z
              .string()
@@ -129,19 +142,40 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilegeV2.updateById({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        id: req.params.id,
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.id,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.updateAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          id: req.params.id,
+          actorId: membership.actorIdentityId as string,
+          actorType: MembershipActors.Identity
+        },
        data: {
          ...req.body,
          ...req.body.type,
          permissions: req.body.permissions || undefined
        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: membership.actorIdentityId as string,
+          projectMembershipId: privilege.membershipId,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -171,14 +205,35 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilegeV2.deleteById({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        id: req.params.id
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.id,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.deleteAdditionalPrivilege({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          id: req.params.id,
+          actorId: membership.actorIdentityId as string,
+          actorType: MembershipActors.Identity
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: membership.actorIdentityId as string,
+          projectMembershipId: privilege.membershipId,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -208,14 +263,35 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilegeV2.getPrivilegeDetailsById({
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        id: req.params.id
+      const { membership } = await server.services.convertor.additionalPrivilegeIdToMembershipId(
+        req.params.id,
+        AccessScope.Project,
+        req.permission.orgId
+      );
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.getAdditionalPrivilegeById({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: membership.scopeProjectId as string,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          id: req.params.id,
+          actorId: membership.actorIdentityId as string,
+          actorType: MembershipActors.Identity
+        }
      });
-      return { privilege };
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: membership.actorIdentityId as string,
+          projectMembershipId: privilege.membershipId,
+          projectId: membership.scopeProjectId as string,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -249,15 +325,36 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privilege = await server.services.identityProjectAdditionalPrivilegeV2.getPrivilegeDetailsBySlug({
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actor: req.permission.type,
-        actorOrgId: req.permission.orgId,
-        slug: req.params.privilegeSlug,
-        ...req.query
+      const { id: projectId } = await server.services.convertor.projectSlugToId({
+        slug: req.query.projectSlug,
+        orgId: req.permission.orgId
      });
-      return { privilege };
+
+      const { additionalPrivilege: privilege } = await server.services.additionalPrivilege.getAdditionalPrivilegeByName(
+        {
+          permission: req.permission,
+          scopeData: {
+            scope: AccessScope.Project,
+            projectId,
+            orgId: req.permission.orgId
+          },
+          selector: {
+            name: req.params.privilegeSlug,
+            actorId: req.query.identityId,
+            actorType: MembershipActors.Identity
+          }
+        }
+      );
+
+      return {
+        privilege: {
+          ...privilege,
+          identityId: req.query.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId,
+          slug: privilege.name
+        }
+      };
    }
  });

@@ -288,15 +385,27 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      const privileges = await server.services.identityProjectAdditionalPrivilegeV2.listIdentityProjectPrivileges({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.query
+      const { additionalPrivileges: privileges } = await server.services.additionalPrivilege.listAdditionalPrivileges({
+        permission: req.permission,
+        scopeData: {
+          scope: AccessScope.Project,
+          projectId: req.query.projectId,
+          orgId: req.permission.orgId
+        },
+        selector: {
+          actorId: req.query.identityId,
+          actorType: MembershipActors.Identity
+        }
      });
+
      return {
-        privileges
+        privileges: privileges.map((privilege) => ({
+          ...privilege,
+          identityId: req.query.identityId,
+          projectMembershipId: privilege.membershipId,
+          projectId: req.query.projectId,
+          slug: privilege.name
+        }))
      };
    }
  });