Continue ST V3 roles

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         secretVersioning: true,
         pitRecovery: false,
         ipAllowlisting: false,
-        rbac: false,
+        rbac: true,
         customRateLimits: false,
         customAlerts: false,
         auditLogs: false,

backend/src/ee/services/ProjectRoleService.ts

@@ -12,7 +12,12 @@ import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js
 import picomatch from "picomatch";
 import { AuthData } from "../../interfaces/middleware";
 import { ActorType, IRole } from "../models";
-import { Membership, ServiceTokenData, ServiceTokenDataV3 } from "../../models";
+import { 
+  IServiceTokenDataV3, 
+  Membership, 
+  ServiceMembership,
+  ServiceTokenData
+} from "../../models";
 import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 import { checkIPAgainstBlocklist } from "../../utils/ip";
 
@@ -265,10 +270,10 @@ export const getAuthDataProjectPermissions = async ({
         user: authData.authPayload._id,
         workspace: workspaceId
       })
-        .populate<{
-          customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
-        }>("customRole")
-        .exec();
+      .populate<{
+        customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
+      }>("customRole")
+      .exec();
     
       if (!membership || (membership.role === "custom" && !membership.customRole)) {
         throw UnauthorizedRequestError();
@@ -285,24 +290,27 @@ export const getAuthDataProjectPermissions = async ({
       break;
     }
     case ActorType.SERVICE_V3: {
-      const serviceTokenData = await ServiceTokenDataV3
-        .findById(authData.authPayload._id)
-        .populate<{
-          customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
-        }>("customRole")
-        .exec();
-        
-      if (!serviceTokenData || (serviceTokenData.role === "custom" && !serviceTokenData.customRole)) {
+      const serviceMembership = await ServiceMembership.findOne({
+        service: authData.authPayload._id,
+        workspace: workspaceId
+      })
+      .populate<{
+        customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
+        service: IServiceTokenDataV3
+      }>("customRole service")
+      .exec();
+      
+      if (!serviceMembership || (serviceMembership.role === "custom" && !serviceMembership.customRole)) {
         throw UnauthorizedRequestError();
       }
 
       checkIPAgainstBlocklist({
         ipAddress: authData.ipAddress,
-        trustedIps: serviceTokenData.trustedIps
+        trustedIps: serviceMembership.service.trustedIps
       });
     
-      role = serviceTokenData.role;
-      customRole = serviceTokenData.customRole;
+      role = serviceMembership.role;
+      customRole = serviceMembership.customRole;
       break;
     }
     default:

backend/src/ee/services/RoleService.ts

@@ -1,6 +1,6 @@
 import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@casl/ability";
 import { MembershipOrg } from "../../models";
-import { IRole } from "../models/role";
+import { IRole } from "../models";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { ACCEPTED } from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
@@ -20,7 +20,8 @@ export enum OrgPermissionSubjects {
   IncidentAccount = "incident-contact",
   Sso = "sso",
   Billing = "billing",
-  SecretScanning = "secret-scanning"
+  SecretScanning = "secret-scanning",
+  ServiceTokens = "service-tokens" // TODO: consider renaming
 }
 
 export type OrgPermissionSet =
@@ -32,7 +33,8 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
   | [OrgPermissionActions, OrgPermissionSubjects.Sso]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
-  | [OrgPermissionActions, OrgPermissionSubjects.Billing];
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing]
+  | [OrgPermissionActions, OrgPermissionSubjects.ServiceTokens];
 
 const buildAdminPermission = () => {
   const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -75,6 +77,11 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
 
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.ServiceTokens);
+
   return build({ conditionsMatcher });
 };
 
@@ -98,6 +105,11 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
 
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.ServiceTokens);
+
   return build({ conditionsMatcher });
 };
 
@@ -105,6 +117,7 @@ export const memberPermissions = buildMemberPermission();
 
 export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   // TODO(akhilmhdh): speed this up by pulling from cache later
+  
   const membership = await MembershipOrg.findOne({
     user: userId,
     organization: orgId,
@@ -131,4 +144,4 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   }
 
   throw BadRequestError({ message: "User role not found" });
-};
+};