Update MI authz logic

backend/src/ee/controllers/v1/roleController.ts

@@ -82,7 +82,7 @@ export const updateRole = async (req: Request, res: Response) => {
     body: { name, description, slug, permissions, workspaceId, orgId }
   } = await validateRequest(UpdateRoleSchema, req);
   const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
-
+  
   if (isOrgRole) {
     const { permission } = await getUserOrgPermissions(req.user.id, orgId);
     if (permission.cannot(OrgPermissionActions.Edit, OrgPermissionSubjects.Role)) {

backend/src/ee/controllers/v1/workspaceController.ts

@@ -757,19 +757,19 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
     }
   }));
 
-  const serviceV3Actors: MachineActor[] = (
+  const machineActors: MachineActor[] = (
     await MachineIdentity.find({
       workspace: new Types.ObjectId(workspaceId)
     })
   ).map((machineIdentity) => ({
     type: ActorType.MACHINE,
     metadata: {
-      serviceId: machineIdentity._id.toString(),
+      machineId: machineIdentity._id.toString(),
       name: machineIdentity.name
     }
   }));
 
-  const actors = [...userActors, ...serviceActors, ...serviceV3Actors];
+  const actors = [...userActors, ...serviceActors, ...machineActors];
 
   return res.status(200).send({
     actors

backend/src/ee/controllers/v3/machineIdentityController.ts

@@ -43,7 +43,7 @@ import { ForbiddenError } from "@casl/ability";
             refreshToken
         }
     } = await validateRequest(reqValidator.RefreshTokenV3, req);
-
+    
     const decodedToken = <jwt.MachineRefreshTokenJwtPayload>(
 		jwt.verify(refreshToken, await getAuthSecret())
 	);
@@ -51,7 +51,7 @@ import { ForbiddenError } from "@casl/ability";
     if (decodedToken.authTokenType !== AuthTokenType.MACHINE_REFRESH_TOKEN) throw UnauthorizedRequestError();
     
     let machineIdentity = await MachineIdentity.findOne({
-        _id: new Types.ObjectId(decodedToken.serviceTokenDataId),
+        _id: new Types.ObjectId(decodedToken._id),
         isActive: true
     });
     
@@ -101,7 +101,7 @@ import { ForbiddenError } from "@casl/ability";
 
     response.accessToken = createToken({
         payload: {
-            _id: machineIdentity._id.toString(), // TODO: fix this
+            _id: machineIdentity._id.toString(),
             authTokenType: AuthTokenType.MACHINE_ACCESS_TOKEN,
             tokenVersion: machineIdentity.tokenVersion
         },

backend/src/ee/services/ProjectRoleService.ts

@@ -332,6 +332,7 @@ export const getAuthDataProjectPermissions = async ({
     
       role = machineMembership.role;
       customRole = machineMembership.customRole;
+
       break;
     }
     default: