feat: changed backend-pg to backend

backend/src/ee/services/secret-approval-policy/secret-approval-policy-approver-dal.ts

@@ -0,0 +1,12 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TSecretApprovalPolicyApproverDALFactory = ReturnType<
+  typeof secretApprovalPolicyApproverDALFactory
+>;
+
+export const secretApprovalPolicyApproverDALFactory = (db: TDbClient) => {
+  const sapApproverOrm = ormify(db, TableName.SecretApprovalPolicyApprover);
+  return sapApproverOrm;
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -0,0 +1,86 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName, TSecretApprovalPolicies } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import {
+  buildFindFilter,
+  mergeOneToManyRelation,
+  ormify,
+  selectAllTableCols,
+  TFindFilter
+} from "@app/lib/knex";
+
+export type TSecretApprovalPolicyDALFactory = ReturnType<typeof secretApprovalPolicyDALFactory>;
+
+export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
+  const secretApprovalPolicyOrm = ormify(db, TableName.SecretApprovalPolicy);
+
+  const sapFindQuery = (tx: Knex, filter: TFindFilter<TSecretApprovalPolicies>) =>
+    tx(TableName.SecretApprovalPolicy)
+      .where(buildFindFilter(filter))
+      .join(
+        TableName.Environment,
+        `${TableName.SecretApprovalPolicy}.envId`,
+        `${TableName.Environment}.id`
+      )
+      .join(
+        TableName.SecretApprovalPolicyApprover,
+        `${TableName.SecretApprovalPolicy}.id`,
+        `${TableName.SecretApprovalPolicyApprover}.policyId`
+      )
+      .select(tx.ref("approverId").withSchema(TableName.SecretApprovalPolicyApprover))
+      .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
+      .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
+      .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
+      .select(tx.ref("projectId").withSchema(TableName.Environment))
+      .select(selectAllTableCols(TableName.SecretApprovalPolicy))
+      .orderBy("createdAt", "asc");
+
+  const findById = async (id: string, tx?: Knex) => {
+    try {
+      const doc = await sapFindQuery(tx || db, {
+        [`${TableName.SecretApprovalPolicy}.id` as "id"]: id
+      });
+      const formatedDoc = mergeOneToManyRelation(
+        doc,
+        "id",
+        ({ approverId, envId, envName: name, envSlug: slug, ...el }) => ({
+          ...el,
+          envId,
+          environment: { id: envId, name, slug }
+        }),
+        ({ approverId }) => approverId,
+        "approvers"
+      );
+      return formatedDoc?.[0];
+    } catch (error) {
+      throw new DatabaseError({ error, name: "FindById" });
+    }
+  };
+
+  const find = async (
+    filter: TFindFilter<TSecretApprovalPolicies & { projectId: string }>,
+    tx?: Knex
+  ) => {
+    try {
+      const docs = await sapFindQuery(tx || db, filter);
+      const formatedDoc = mergeOneToManyRelation(
+        docs,
+        "id",
+        ({ approverId, envId, envName: name, envSlug: slug, ...el }) => ({
+          ...el,
+          envId,
+          environment: { id: envId, name, slug }
+        }),
+        ({ approverId }) => approverId,
+        "approvers"
+      );
+      return formatedDoc;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find" });
+    }
+  };
+
+  return { ...secretApprovalPolicyOrm, findById, find };
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -0,0 +1,237 @@
+import { ForbiddenError, subject } from "@casl/ability";
+import picomatch from "picomatch";
+
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
+import { BadRequestError } from "@app/lib/errors";
+import { containsGlobPatterns } from "@app/lib/picomatch";
+import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
+import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
+
+import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
+import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
+import {
+  TCreateSapDTO,
+  TDeleteSapDTO,
+  TGetBoardSapDTO,
+  TListSapDTO,
+  TUpdateSapDTO
+} from "./secret-approval-policy-types";
+
+const getPolicyScore = (policy: { secretPath?: string | null }) =>
+  // if glob pattern score is 1, if not exist score is 0 and if its not both then its exact path meaning score 2
+  // eslint-disable-next-line
+  policy.secretPath ? (containsGlobPatterns(policy.secretPath) ? 1 : 2) : 0;
+
+type TSecretApprovalPolicyServiceFactoryDep = {
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
+  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
+  secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
+  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
+};
+
+export type TSecretApprovalPolicyServiceFactory = ReturnType<
+  typeof secretApprovalPolicyServiceFactory
+>;
+
+export const secretApprovalPolicyServiceFactory = ({
+  secretApprovalPolicyDAL,
+  permissionService,
+  secretApprovalPolicyApproverDAL,
+  projectEnvDAL,
+  projectMembershipDAL
+}: TSecretApprovalPolicyServiceFactoryDep) => {
+  const createSecretApprovalPolicy = async ({
+    name,
+    actor,
+    actorId,
+    approvals,
+    approvers,
+    projectId,
+    secretPath,
+    environment
+  }: TCreateSapDTO) => {
+    if (approvals > approvers.length)
+      throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
+
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      ProjectPermissionSub.SecretApproval
+    );
+    const env = await projectEnvDAL.findOne({ slug: environment, projectId });
+    if (!env) throw new BadRequestError({ message: "Environment not found" });
+
+    const secretApprovers = await projectMembershipDAL.find({
+      projectId,
+      $in: { id: approvers }
+    });
+    if (secretApprovers.length !== approvers.length)
+      throw new BadRequestError({ message: "Approver not found in project" });
+
+    const secretApproval = await secretApprovalPolicyDAL.transaction(async (tx) => {
+      const doc = await secretApprovalPolicyDAL.create(
+        {
+          envId: env.id,
+          approvals,
+          secretPath,
+          name
+        },
+        tx
+      );
+      await secretApprovalPolicyApproverDAL.insertMany(
+        secretApprovers.map(({ id }) => ({
+          approverId: id,
+          policyId: doc.id
+        })),
+        tx
+      );
+      return doc;
+    });
+    return { ...secretApproval, environment: env, projectId };
+  };
+
+  const updateSecretApprovalPolicy = async ({
+    approvers,
+    secretPath,
+    name,
+    actorId,
+    actor,
+    approvals,
+    secretPolicyId
+  }: TUpdateSapDTO) => {
+    const secretApprovalPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
+    if (!secretApprovalPolicy)
+      throw new BadRequestError({ message: "Secret approval policy not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      secretApprovalPolicy.projectId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      ProjectPermissionSub.SecretApproval
+    );
+
+    const updatedSap = await secretApprovalPolicyDAL.transaction(async (tx) => {
+      const doc = await secretApprovalPolicyDAL.updateById(
+        secretApprovalPolicy.id,
+        {
+          approvals,
+          secretPath,
+          name
+        },
+        tx
+      );
+      if (approvers) {
+        const secretApprovers = await projectMembershipDAL.find(
+          {
+            projectId: secretApprovalPolicy.projectId,
+            $in: { id: approvers }
+          },
+          { tx }
+        );
+        if (secretApprovers.length !== approvers.length)
+          throw new BadRequestError({ message: "Approver not found in project" });
+        if (doc.approvals > secretApprovers.length)
+          throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
+        await secretApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
+        await secretApprovalPolicyApproverDAL.insertMany(
+          secretApprovers.map(({ id }) => ({
+            approverId: id,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+      return doc;
+    });
+    return {
+      ...updatedSap,
+      environment: secretApprovalPolicy.environment,
+      projectId: secretApprovalPolicy.projectId
+    };
+  };
+
+  const deleteSecretApprovalPolicy = async ({ secretPolicyId, actor, actorId }: TDeleteSapDTO) => {
+    const sapPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
+    if (!sapPolicy) throw new BadRequestError({ message: "Secret approval policy not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      sapPolicy.projectId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      ProjectPermissionSub.SecretApproval
+    );
+
+    await secretApprovalPolicyDAL.deleteById(secretPolicyId);
+    return sapPolicy;
+  };
+
+  const getSecretApprovalPolicyByProjectId = async ({ actorId, actor, projectId }: TListSapDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.SecretApproval
+    );
+
+    const sapPolicies = await secretApprovalPolicyDAL.find({ projectId });
+    return sapPolicies;
+  };
+
+  const getSecretApprovalPolicy = async (
+    projectId: string,
+    environment: string,
+    secretPath: string
+  ) => {
+    const env = await projectEnvDAL.findOne({ slug: environment, projectId });
+    if (!env) throw new BadRequestError({ message: "Environment not found" });
+
+    const policies = await secretApprovalPolicyDAL.find({ envId: env.id });
+    if (!policies.length) return;
+    // this will filter policies either without scoped to secret path or the one that matches with secret path
+    const policiesFilteredByPath = policies.filter(
+      ({ secretPath: policyPath }) =>
+        !policyPath || picomatch.isMatch(secretPath, policyPath, { strictSlashes: false })
+    );
+    // now sort by priority. exact secret path gets first match followed by glob followed by just env scoped
+    // if that is tie get by first createdAt
+    const policiesByPriority = policiesFilteredByPath.sort(
+      (a, b) => getPolicyScore(b) - getPolicyScore(a)
+    );
+    const finalPolicy = policiesByPriority.shift();
+    return finalPolicy;
+  };
+
+  const getSecretApprovalPolicyOfFolder = async ({
+    projectId,
+    actor,
+    actorId,
+    environment,
+    secretPath
+  }: TGetBoardSapDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { secretPath, environment })
+    );
+    return getSecretApprovalPolicy(projectId, environment, secretPath);
+  };
+
+  return {
+    createSecretApprovalPolicy,
+    updateSecretApprovalPolicy,
+    deleteSecretApprovalPolicy,
+    getSecretApprovalPolicy,
+    getSecretApprovalPolicyByProjectId,
+    getSecretApprovalPolicyOfFolder
+  };
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-types.ts

@@ -0,0 +1,30 @@
+import { TProjectPermission } from "@app/lib/types";
+
+export type TCreateSapDTO = {
+  approvals: number;
+  secretPath?: string | null;
+  environment: string;
+  approvers: string[];
+  projectId: string;
+  name: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TUpdateSapDTO = {
+  secretPolicyId: string;
+  approvals?: number;
+  secretPath?: string | null;
+  approvers: string[];
+  name?: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDeleteSapDTO = {
+  secretPolicyId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TListSapDTO = TProjectPermission;
+
+export type TGetBoardSapDTO = {
+  projectId: string;
+  environment: string;
+  secretPath: string;
+} & Omit<TProjectPermission, "projectId">;