feat: changed backend-pg to backend

backend/src/services/identity/identity-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TIdentityDALFactory = ReturnType<typeof identityDALFactory>;
+
+export const identityDALFactory = (db: TDbClient) => {
+  const identityOrm = ormify(db, TableName.Identity);
+  return identityOrm;
+};

backend/src/services/identity/identity-org-dal.ts

@@ -0,0 +1,95 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName, TIdentityOrgMemberships } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
+
+export type TIdentityOrgDALFactory = ReturnType<typeof identityOrgDALFactory>;
+
+export const identityOrgDALFactory = (db: TDbClient) => {
+  const identityOrgOrm = ormify(db, TableName.IdentityOrgMembership);
+
+  const findOne = async (filter: Partial<TIdentityOrgMemberships>, tx?: Knex) => {
+    try {
+      const [data] = await (tx || db)(TableName.IdentityOrgMembership)
+        .where(filter)
+        .join(
+          TableName.Identity,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.Identity}.id`
+        )
+        .select(selectAllTableCols(TableName.IdentityOrgMembership))
+        .select(db.ref("name").withSchema(TableName.Identity))
+        .select(db.ref("authMethod").withSchema(TableName.Identity));
+      if (data) {
+        const { name, authMethod } = data;
+        return { ...data, identity: { id: data.identityId, name, authMethod } };
+      }
+    } catch (error) {
+      throw new DatabaseError({ error, name: "FindOne" });
+    }
+  };
+
+  const findByOrgId = async (orgId: string, tx?: Knex) => {
+    try {
+      const docs = await (tx || db)(TableName.IdentityOrgMembership)
+        .where(`${TableName.IdentityOrgMembership}.orgId`, orgId)
+        .join(
+          TableName.Identity,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.Identity}.id`
+        )
+        .leftJoin(
+          TableName.OrgRoles,
+          `${TableName.IdentityOrgMembership}.roleId`,
+          `${TableName.OrgRoles}.id`
+        )
+        .select(selectAllTableCols(TableName.IdentityOrgMembership))
+        // cr stands for custom role
+        .select(db.ref("id").as("crId").withSchema(TableName.OrgRoles))
+        .select(db.ref("name").as("crName").withSchema(TableName.OrgRoles))
+        .select(db.ref("slug").as("crSlug").withSchema(TableName.OrgRoles))
+        .select(db.ref("description").as("crDescription").withSchema(TableName.OrgRoles))
+        .select(db.ref("permissions").as("crPermission").withSchema(TableName.OrgRoles))
+        .select(db.ref("permissions").as("crPermission").withSchema(TableName.OrgRoles))
+        .select(db.ref("id").as("identityId").withSchema(TableName.Identity))
+        .select(db.ref("name").as("identityName").withSchema(TableName.Identity))
+        .select(db.ref("authMethod").as("identityAuthMethod").withSchema(TableName.Identity));
+      return docs.map(
+        ({
+          crId,
+          crDescription,
+          crSlug,
+          crPermission,
+          crName,
+          identityId,
+          identityName,
+          identityAuthMethod,
+          ...el
+        }) => ({
+          ...el,
+          identityId,
+          identity: {
+            id: identityId,
+            name: identityName,
+            authMethod: identityAuthMethod
+          },
+          customRole: el.roleId
+            ? {
+                id: crId,
+                name: crName,
+                slug: crSlug,
+                permissions: crPermission,
+                description: crDescription
+              }
+            : undefined
+        })
+      );
+    } catch (error) {
+      throw new DatabaseError({ error, name: "FindByOrgId" });
+    }
+  };
+
+  return { ...identityOrgOrm, findOne, findByOrgId };
+};

backend/src/services/identity/identity-service.ts

@@ -0,0 +1,163 @@
+import { ForbiddenError } from "@casl/ability";
+
+import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
+import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
+import { TOrgPermission } from "@app/lib/types";
+
+import { ActorType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "./identity-dal";
+import { TIdentityOrgDALFactory } from "./identity-org-dal";
+import { TCreateIdentityDTO, TDeleteIdentityDTO, TUpdateIdentityDTO } from "./identity-types";
+
+type TIdentityServiceFactoryDep = {
+  identityDAL: TIdentityDALFactory;
+  identityOrgMembershipDAL: TIdentityOrgDALFactory;
+  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getOrgPermissionByRole">;
+};
+
+export type TIdentityServiceFactory = ReturnType<typeof identityServiceFactory>;
+
+export const identityServiceFactory = ({
+  identityDAL,
+  identityOrgMembershipDAL,
+  permissionService
+}: TIdentityServiceFactoryDep) => {
+  const createIdentity = async ({ name, role, actor, orgId, actorId }: TCreateIdentityDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Create,
+      OrgPermissionSubjects.Identity
+    );
+
+    const { permission: rolePermission, role: customRole } =
+      await permissionService.getOrgPermissionByRole(role, orgId);
+    const isCustomRole = Boolean(customRole);
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasRequiredPriviledges)
+      throw new BadRequestError({ message: "Failed to create a more privileged identity" });
+
+    const identity = await identityDAL.transaction(async (tx) => {
+      const newIdentity = await identityDAL.create({ name }, tx);
+      await identityOrgMembershipDAL.create(
+        {
+          identityId: newIdentity.id,
+          orgId,
+          role: isCustomRole ? OrgMembershipRole.Custom : role,
+          roleId: customRole?.id
+        },
+        tx
+      );
+      return newIdentity;
+    });
+
+
+    return identity;
+  };
+
+  const updateIdentity = async ({ id, role, name, actor, actorId }: TUpdateIdentityDTO) => {
+    const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id });
+    if (!identityOrgMembership)
+      throw new BadRequestError({ message: `Failed to find identity with id ${id}` });
+
+    const { permission } = await permissionService.getOrgPermission(
+      actor,
+      actorId,
+      identityOrgMembership.orgId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Edit,
+      OrgPermissionSubjects.Identity
+    );
+
+    const { permission: identityRolePermission } = await permissionService.getOrgPermission(
+      ActorType.IDENTITY,
+      id,
+      identityOrgMembership.orgId
+    );
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
+
+    let customRole: TOrgRoles | undefined;
+    if (role) {
+      const { permission: rolePermission, role: customOrgRole } =
+        await permissionService.getOrgPermissionByRole(role, identityOrgMembership.orgId);
+
+      const isCustomRole = Boolean(customOrgRole);
+      const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission);
+      if (!hasRequiredNewRolePermission)
+        throw new BadRequestError({ message: "Failed to create a more privileged identity" });
+      if (isCustomRole) customRole = customOrgRole;
+    }
+
+    const identity = await identityDAL.transaction(async (tx) => {
+      const newIdentity = name
+        ? await identityDAL.updateById(id, { name }, tx)
+        : await identityDAL.findById(id, tx);
+      if (role) {
+        await identityOrgMembershipDAL.update(
+          { identityId: id },
+          {
+            role: customRole ? OrgMembershipRole.Custom : role,
+            roleId: customRole?.id
+          },
+          tx
+        );
+      }
+      return newIdentity;
+    });
+
+    return { ...identity, orgId: identityOrgMembership.orgId };
+  };
+
+  const deleteIdentity = async ({ actorId, actor, id }: TDeleteIdentityDTO) => {
+    const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id });
+    if (!identityOrgMembership)
+      throw new BadRequestError({ message: `Failed to find identity with id ${id}` });
+
+    const { permission } = await permissionService.getOrgPermission(
+      actor,
+      actorId,
+      identityOrgMembership.orgId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Delete,
+      OrgPermissionSubjects.Identity
+    );
+    const { permission: identityRolePermission } = await permissionService.getOrgPermission(
+      ActorType.IDENTITY,
+      id,
+      identityOrgMembership.orgId
+    );
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
+
+    const deletedIdentity = await identityDAL.deleteById(id);
+    return { ...deletedIdentity, orgId: identityOrgMembership.orgId };
+  };
+
+  const listOrgIdentities = async ({ orgId, actor, actorId }: TOrgPermission) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Read,
+      OrgPermissionSubjects.Identity
+    );
+
+    const identityMemberhips = await identityOrgMembershipDAL.findByOrgId(orgId);
+    return identityMemberhips;
+  };
+
+  return {
+    createIdentity,
+    updateIdentity,
+    deleteIdentity,
+    listOrgIdentities
+  };
+};

backend/src/services/identity/identity-types.ts

@@ -0,0 +1,23 @@
+import { IPType } from "@app/lib/ip";
+import { TOrgPermission } from "@app/lib/types";
+
+export type TCreateIdentityDTO = {
+  role: string;
+  name: string;
+} & TOrgPermission;
+
+export type TUpdateIdentityDTO = {
+  id: string;
+  role?: string;
+  name?: string;
+} & Omit<TOrgPermission, "orgId">;
+
+export type TDeleteIdentityDTO = {
+  id: string;
+} & Omit<TOrgPermission, "orgId">;
+
+export interface TIdentityTrustedIp {
+  ipAddress: string;
+  type: IPType;
+  prefix: number;
+}