Added authz logic to MI

backend/src/ee/services/ProjectRoleService.ts

@@ -11,7 +11,7 @@ import { UnauthorizedRequestError } from "../../utils/errors";
 import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
 import picomatch from "picomatch";
 import { AuthData } from "../../interfaces/middleware";
-import { ActorType, IRole } from "../models";
+import { ActorType, IRole, Role } from "../models";
 import { 
   IMachineIdentity,
   MachineMembership, 
@@ -20,6 +20,7 @@ import {
 } from "../../models";
 import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 import { checkIPAgainstBlocklist } from "../../utils/ip";
+import { BadRequestError } from "../../utils/errors";
 
 const $glob: FieldInstruction<string> = {
   type: "field",
@@ -60,7 +61,8 @@ export enum ProjectPermissionSub {
   Secrets = "secrets",
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
-  SecretRotation = "secret-rotation"
+  SecretRotation = "secret-rotation",
+  MachineIdentity = "machine-identity"
 }
 
 type SubjectFields = {
@@ -85,6 +87,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation]
+  | [ProjectPermissionActions, ProjectPermissionSub.MachineIdentity]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
@@ -131,6 +134,11 @@ const buildAdminPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
 
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.MachineIdentity);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
@@ -196,6 +204,11 @@ const buildMemberPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
 
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.MachineIdentity);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.MachineIdentity);
+
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
@@ -236,6 +249,7 @@ const buildViewerPermission = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.MachineIdentity);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
@@ -337,3 +351,59 @@ export const getAuthDataProjectPermissions = async ({
       throw UnauthorizedRequestError();
   }
 }
+
+export const getRolePermissions = async (role: string, workspaceId: string) => {
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+  if (isCustomRole) {
+    const workspaceRole = await Role.findOne({
+      slug: role,
+      isOrgRole: false,
+      workspace: new Types.ObjectId(workspaceId)
+    });
+
+    if (!workspaceRole) throw BadRequestError({ message: "Role not found" });
+    
+    return createMongoAbility<ProjectPermissionSet>(workspaceRole.permissions as RawRuleOf<MongoAbility<ProjectPermissionSet>>[], {
+      conditionsMatcher
+    });
+  }
+
+  switch (role) {
+    case ADMIN:
+      return adminProjectPermissions;
+    case MEMBER:
+      return memberProjectPermissions;
+    case VIEWER:
+      return viewerProjectPermission;
+    default:
+      throw BadRequestError({ message: "Role not found" });
+  }
+}
+
+/**
+ * Extracts and formats permissions from a CASL Ability object or a raw permission set. 
+ * @param ability
+ * @returns 
+ */
+ const extractPermissions = (ability: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet) => {
+  return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
+}
+
+/**
+ * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
+ * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
+ * 
+*/
+export const isAtLeastAsPrivilegedWorkspace = (permissions1: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet, permissions2: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet) => {
+
+  const set1 = new Set(extractPermissions(permissions1));
+  const set2 = new Set(extractPermissions(permissions2));
+  
+  for (const perm of set2) {
+    if (!set1.has(perm)) {
+      return false;
+    }
+  }
+
+  return set1.size >= set2.size;
+}

backend/src/ee/services/RoleService.ts

@@ -1,8 +1,9 @@
+import { Types } from "mongoose";
 import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@casl/ability";
 import { MembershipOrg } from "../../models";
-import { IRole } from "../models";
+import { IRole, Role } from "../models";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER } from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
 
 export enum OrgPermissionActions {
@@ -21,7 +22,7 @@ export enum OrgPermissionSubjects {
   Sso = "sso",
   Billing = "billing",
   SecretScanning = "secret-scanning",
-  ServiceTokens = "service-tokens" // TODO: consider renaming
+  MachineIdentity = "machine-identity"
 }
 
 export type OrgPermissionSet =
@@ -34,7 +35,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.Sso]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
   | [OrgPermissionActions, OrgPermissionSubjects.Billing]
-  | [OrgPermissionActions, OrgPermissionSubjects.ServiceTokens];
+  | [OrgPermissionActions, OrgPermissionSubjects.MachineIdentity];
 
 const buildAdminPermission = () => {
   const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -77,10 +78,10 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.MachineIdentity);
 
   return build({ conditionsMatcher });
 };
@@ -105,10 +106,10 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.ServiceTokens);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.ServiceTokens);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.MachineIdentity);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.MachineIdentity);
 
   return build({ conditionsMatcher });
 };
@@ -132,11 +133,11 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
     throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
   }
 
-  if (membership.role === "admin") return { permission: adminPermissions, membership };
+  if (membership.role === ADMIN) return { permission: adminPermissions, membership };
 
-  if (membership.role === "member") return { permission: memberPermissions, membership };
+  if (membership.role === MEMBER) return { permission: memberPermissions, membership };
 
-  if (membership.role === "custom") {
+  if (membership.role === CUSTOM) {
     const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
       conditionsMatcher
     });
@@ -144,4 +145,58 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   }
 
   throw BadRequestError({ message: "User role not found" });
-};
+};
+
+export const getOrgRolePermissions = async (role: string, orgId: string) => {
+  const isCustomRole = ![ADMIN, MEMBER].includes(role);
+  if (isCustomRole) {
+    const orgRole = await Role.findOne({
+      slug: role,
+      isOrgRole: true,
+      organization: new Types.ObjectId(orgId)
+    });
+
+    if (!orgRole) throw BadRequestError({ message: "Org Role not found" });
+    
+    return createMongoAbility<OrgPermissionSet>(orgRole.permissions as RawRuleOf<MongoAbility<OrgPermissionSet>>[], {
+      conditionsMatcher
+    });
+  }
+
+  switch (role) {
+    case ADMIN:
+      return adminPermissions;
+    case MEMBER:
+      return memberPermissions;
+    default:
+      throw BadRequestError({ message: "User org role not found" });
+  }
+}
+
+/**
+ * Extracts and formats permissions from a CASL Ability object or a raw permission set. 
+ * @param ability
+ * @returns 
+ */
+const extractPermissions = (ability: MongoAbility<OrgPermissionSet> | OrgPermissionSet) => {
+  return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
+}
+
+/**
+ * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
+ * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
+ * 
+*/
+export const isAtLeastAsPrivilegedOrg = (permissions1: MongoAbility<OrgPermissionSet> | OrgPermissionSet, permissions2: MongoAbility<OrgPermissionSet> | OrgPermissionSet) => {
+
+  const set1 = new Set(extractPermissions(permissions1));
+  const set2 = new Set(extractPermissions(permissions2));
+  
+  for (const perm of set2) {
+    if (!set1.has(perm)) {
+      return false;
+    }
+  }
+
+  return set1.size >= set2.size;
+}