Complete basic pre-cleaned group member assignment/unassignment

backend/src/ee/services/group/group-service.ts

@@ -2,23 +2,44 @@ import { ForbiddenError } from "@casl/ability";
 
 import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
 
+import { TOrgDALFactory } from "../../../services/org/org-dal";
+import { TUserDALFactory } from "../../../services/user/user-dal";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { TGroupDALFactory } from "./group-dal";
-import { TCreateGroupDTO, TDeleteGroupDTO, TUpdateGroupDTO } from "./group-types";
+import {
+  TCreateGroupDTO,
+  TCreateGroupUserMembershipDTO,
+  TDeleteGroupDTO,
+  TDeleteGroupUserMembershipDTO,
+  TGetGroupUserMembershipsDTO,
+  TUpdateGroupDTO
+} from "./group-types";
+import { TUserGroupMembershipDALFactory } from "./user-group-membership-dal";
 
 type TGroupServiceFactoryDep = {
+  // TODO: Pick
+  userDAL: TUserDALFactory;
   groupDAL: TGroupDALFactory;
+  orgDAL: TOrgDALFactory;
+  userGroupMembershipDAL: TUserGroupMembershipDALFactory;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getOrgPermissionByRole">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TGroupServiceFactory = ReturnType<typeof groupServiceFactory>;
 
-export const groupServiceFactory = ({ groupDAL, permissionService, licenseService }: TGroupServiceFactoryDep) => {
+export const groupServiceFactory = ({
+  userDAL,
+  groupDAL,
+  orgDAL,
+  userGroupMembershipDAL,
+  permissionService,
+  licenseService
+}: TGroupServiceFactoryDep) => {
   const createGroup = async ({
     name,
     slug,
@@ -48,7 +69,7 @@ export const groupServiceFactory = ({ groupDAL, permissionService, licenseServic
 
     const group = await groupDAL.create({
       name,
-      slug,
+      slug, // TODO: slugify
       orgId,
       role: isCustomRole ? OrgMembershipRole.Custom : role,
       roleId: customRole?.id
@@ -101,7 +122,7 @@ export const groupServiceFactory = ({ groupDAL, permissionService, licenseServic
       },
       {
         name,
-        slug,
+        slug, // TODO: slugify
         ...(role
           ? {
               role: customRole ? OrgMembershipRole.Custom : role,
@@ -114,7 +135,7 @@ export const groupServiceFactory = ({ groupDAL, permissionService, licenseServic
     return updatedGroup;
   };
 
-  const deleteGroup = async ({ slug, actor, actorId, orgId, actorAuthMethod, actorOrgId }: TDeleteGroupDTO) => {
+  const deleteGroup = async ({ groupSlug, actor, actorId, orgId, actorAuthMethod, actorOrgId }: TDeleteGroupDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Groups);
 
@@ -127,15 +148,172 @@ export const groupServiceFactory = ({ groupDAL, permissionService, licenseServic
 
     const [group] = await groupDAL.delete({
       orgId,
-      slug
+      slug: groupSlug
     });
 
     return group;
   };
 
+  const getGroupUserMemberships = async ({
+    slug,
+    actor,
+    actorId,
+    orgId,
+    actorAuthMethod,
+    actorOrgId
+  }: TGetGroupUserMembershipsDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Groups);
+
+    const group = await groupDAL.findOne({
+      orgId,
+      slug
+    });
+
+    if (!group)
+      throw new BadRequestError({
+        message: `Failed to find group with slug ${slug}`
+      });
+
+    const users = await groupDAL.findAllGroupMembers(group.orgId, group.id);
+    return users;
+  };
+
+  const createGroupUserMemberships = async ({
+    groupSlug,
+    username,
+    actor,
+    actorId,
+    orgId,
+    actorAuthMethod,
+    actorOrgId
+  }: TCreateGroupUserMembershipDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Groups);
+
+    // check if group with slug exists
+    const group = await groupDAL.findOne({
+      orgId,
+      slug: groupSlug
+    });
+
+    if (!group)
+      throw new BadRequestError({
+        message: `Failed to find group with slug ${groupSlug}`
+      });
+
+    const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, orgId);
+
+    // check if user has broader or equal to privileges than group
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to add user to more privileged group" });
+
+    // get user with username
+    const user = await userDAL.findOne({
+      username
+    });
+
+    if (!user)
+      throw new BadRequestError({
+        message: `Failed to find user with username ${username}`
+      });
+
+    // check if user group membership already exists
+    const existingUserGroupMembership = await userGroupMembershipDAL.findOne({
+      groupId: group.id,
+      userId: user.id
+    });
+
+    if (existingUserGroupMembership)
+      throw new BadRequestError({
+        message: `User ${username} is already part of the group ${groupSlug}`
+      });
+
+    // check if user is even part of the organization
+    const existingUserOrgMembership = await orgDAL.findMembership({
+      userId: user.id,
+      orgId
+    });
+
+    if (!existingUserOrgMembership)
+      throw new BadRequestError({
+        message: `User ${username} is not part of the organization`
+      });
+
+    const t = await userGroupMembershipDAL.create({
+      userId: user.id,
+      groupId: group.id
+    });
+
+    return t;
+  };
+
+  const deleteGroupUserMemberships = async ({
+    groupSlug,
+    username,
+    actor,
+    actorId,
+    orgId,
+    actorAuthMethod,
+    actorOrgId
+  }: TDeleteGroupUserMembershipDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Groups);
+
+    // check if group with slug exists
+    const group = await groupDAL.findOne({
+      orgId,
+      slug: groupSlug
+    });
+
+    if (!group)
+      throw new BadRequestError({
+        message: `Failed to find group with slug ${groupSlug}`
+      });
+
+    const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, orgId);
+
+    // check if user has broader or equal to privileges than group
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to delete user from more privileged group" });
+
+    // get user with username
+    const user = await userDAL.findOne({
+      username
+    });
+
+    if (!user)
+      throw new BadRequestError({
+        message: `Failed to find user with username ${username}`
+      });
+
+    // check if user group membership already exists
+    const existingUserGroupMembership = await userGroupMembershipDAL.findOne({
+      groupId: group.id,
+      userId: user.id
+    });
+
+    if (!existingUserGroupMembership)
+      throw new BadRequestError({
+        message: `User ${username} is not part of the group ${groupSlug}`
+      });
+
+    const t = await userGroupMembershipDAL.delete({
+      groupId: group.id,
+      userId: user.id
+    });
+
+    return t;
+  };
+
   return {
     createGroup,
     updateGroup,
-    deleteGroup
+    deleteGroup,
+    getGroupUserMemberships,
+    createGroupUserMemberships,
+    deleteGroupUserMemberships
   };
 };