feat(server): removed name and description and fixed api for user privileges

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -34,7 +34,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
   permissionService
 }: TIdentityProjectAdditionalPrivilegeServiceFactoryDep) => {
   const create = async ({
-    name,
     slug,
     actor,
     actorId,
@@ -42,7 +41,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     identityId,
     permissions: customPermission,
     actorOrgId,
-    description,
+    actorAuthMethod,
     ...dto
   }: TCreateIdentityPrivilegeDTO) => {
     const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId });
@@ -53,6 +52,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
@@ -60,6 +60,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       ActorType.IDENTITY,
       identityId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
@@ -76,9 +77,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       const additionalPrivilege = await identityProjectAdditionalPrivilegeDAL.create({
         projectMembershipId: identityProjectMembership.id,
         slug,
-        permissions: customPermission,
-        name,
-        description
+        permissions: customPermission
       });
       return additionalPrivilege;
     }
@@ -88,8 +87,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       projectMembershipId: identityProjectMembership.id,
       slug,
       permissions: customPermission,
-      name,
-      description,
       isTemporary: true,
       temporaryMode: IdentityProjectAdditionalPrivilegeTemporaryMode.Relative,
       temporaryRange: dto.temporaryRange,
@@ -99,7 +96,14 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     return additionalPrivilege;
   };
 
-  const updateById = async ({ privilegeId, actorOrgId, actor, actorId, ...dto }: TUpdateIdentityPrivilegeDTO) => {
+  const updateById = async ({
+    privilegeId,
+    actorOrgId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    ...dto
+  }: TUpdateIdentityPrivilegeDTO) => {
     const identityPrivilege = await identityProjectAdditionalPrivilegeDAL.findById(privilegeId);
     if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" });
 
@@ -110,6 +114,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
@@ -117,6 +122,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       ActorType.IDENTITY,
       identityProjectMembership.identityId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
@@ -155,7 +161,13 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     return additionalPrivilege;
   };
 
-  const deleteById = async ({ actorId, actor, actorOrgId, privilegeId }: TDeleteIdentityPrivilegeDTO) => {
+  const deleteById = async ({
+    actorId,
+    actor,
+    actorOrgId,
+    privilegeId,
+    actorAuthMethod
+  }: TDeleteIdentityPrivilegeDTO) => {
     const identityPrivilege = await identityProjectAdditionalPrivilegeDAL.findById(privilegeId);
     if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" });
 
@@ -166,6 +178,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
@@ -173,6 +186,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       ActorType.IDENTITY,
       identityProjectMembership.identityId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
@@ -187,7 +201,8 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     privilegeId,
     actorOrgId,
     actor,
-    actorId
+    actorId,
+    actorAuthMethod
   }: TGetIdentityPrivilegeDetailsDTO) => {
     const identityPrivilege = await identityProjectAdditionalPrivilegeDAL.findById(privilegeId);
     if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" });
@@ -199,6 +214,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
@@ -206,6 +222,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       ActorType.IDENTITY,
       identityProjectMembership.identityId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
@@ -220,7 +237,8 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     identityId,
     actorOrgId,
     actor,
-    actorId
+    actorId,
+    actorAuthMethod
   }: TListIdentityPrivilegesDTO) => {
     const identityProjectMembership = await identityProjectDAL.findOne({ projectId, identityId });
     if (!identityProjectMembership) throw new BadRequestError({ message: `Failed to find identity` });
@@ -229,6 +247,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
@@ -236,6 +255,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       ActorType.IDENTITY,
       identityProjectMembership.identityId,
       identityProjectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-types.ts

@@ -9,18 +9,14 @@ export type TCreateIdentityPrivilegeDTO = (
       permissions: unknown;
       identityId: string;
       projectId: string;
-      name: string;
       slug: string;
-      description?: string;
       isTemporary: false;
     }
   | {
       permissions: unknown;
       identityId: string;
       projectId: string;
-      name: string;
       slug: string;
-      description?: string;
       isTemporary: true;
       temporaryMode: IdentityProjectAdditionalPrivilegeTemporaryMode.Relative;
       temporaryRange: string;
@@ -32,9 +28,7 @@ export type TCreateIdentityPrivilegeDTO = (
 export type TUpdateIdentityPrivilegeDTO = { privilegeId: string } & Omit<TProjectPermission, "projectId"> &
   Partial<{
     permissions: unknown;
-    name: string;
     slug: string;
-    description?: string;
     isTemporary: boolean;
     temporaryMode: IdentityProjectAdditionalPrivilegeTemporaryMode.Relative;
     temporaryRange: string;

backend/src/ee/services/permission/permission-service.ts

@@ -180,10 +180,12 @@ export const permissionServiceFactory = ({
     authMethod: ActorAuthMethod,
     userOrgId?: string
   ): Promise<TProjectPermissionRT<ActorType.USER>> => {
-    const membership = await permissionDAL.getProjectPermission(userId, projectId);
-    if (!membership) throw new UnauthorizedError({ name: "User not in project" });
+    const userProjectPermission = await permissionDAL.getProjectPermission(userId, projectId);
+    if (!userProjectPermission) throw new UnauthorizedError({ name: "User not in project" });
 
-    if (membership.roles.some(({ role, permissions }) => role === ProjectMembershipRole.Custom && !permissions)) {
+    if (
+      userProjectPermission.roles.some(({ role, permissions }) => role === ProjectMembershipRole.Custom && !permissions)
+    ) {
       throw new BadRequestError({ name: "Custom permission not found" });
     }
 
@@ -192,11 +194,11 @@ export const permissionServiceFactory = ({
 
     // Extra: This means that when users are using API keys to make requests, they can't use slug-based routes.
     // Slug-based routes depend on the organization ID being present on the request, since project slugs aren't globally unique, and we need a way to filter by organization.
-    if (userOrgId !== "API_KEY" && membership.orgId !== userOrgId) {
+    if (userOrgId !== "API_KEY" && userProjectPermission.orgId !== userOrgId) {
       throw new UnauthorizedError({ name: "You are not logged into this organization" });
     }
 
-    validateOrgSAML(authMethod, membership.orgAuthEnforced);
+    validateOrgSAML(authMethod, userProjectPermission.orgAuthEnforced);
 
     // join two permissions and pass to build the final permission set
     const rolePermissions = userProjectPermission.roles?.map(({ role, permissions }) => ({ role, permissions })) || [];
@@ -210,7 +212,9 @@ export const permissionServiceFactory = ({
       permission: buildProjectPermission(rolePermissions.concat(additionalPrivileges)),
       membership: userProjectPermission,
       hasRole: (role: string) =>
-        membership.roles.findIndex(({ role: slug, customRoleSlug }) => role === slug || slug === customRoleSlug) !== -1
+        userProjectPermission.roles.findIndex(
+          ({ role: slug, customRoleSlug }) => role === slug || slug === customRoleSlug
+        ) !== -1
     };
   };
 

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -12,6 +12,7 @@ import {
   TCreateUserPrivilegeDTO,
   TDeleteUserPrivilegeDTO,
   TGetUserPrivilegeDetailsDTO,
+  TListUserPrivilegesDTO,
   TUpdateUserPrivilegeDTO
 } from "./project-user-additional-privilege-types";
 
@@ -31,13 +32,12 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
   permissionService
 }: TProjectUserAdditionalPrivilegeServiceFactoryDep) => {
   const create = async ({
-    name,
     slug,
     actor,
     actorId,
     permissions: customPermission,
     actorOrgId,
-    description,
+    actorAuthMethod,
     projectMembershipId,
     ...dto
   }: TCreateUserPrivilegeDTO) => {
@@ -48,6 +48,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       projectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -59,9 +60,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       const additionalPrivilege = await projectUserAdditionalPrivilegeDAL.create({
         projectMembershipId,
         slug,
-        permissions: customPermission,
-        name,
-        description
+        permissions: customPermission
       });
       return additionalPrivilege;
     }
@@ -71,8 +70,6 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       projectMembershipId,
       slug,
       permissions: customPermission,
-      name,
-      description,
       isTemporary: true,
       temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative,
       temporaryRange: dto.temporaryRange,
@@ -82,7 +79,14 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     return additionalPrivilege;
   };
 
-  const updateById = async ({ privilegeId, actorOrgId, actor, actorId, ...dto }: TUpdateUserPrivilegeDTO) => {
+  const updateById = async ({
+    privilegeId,
+    actorOrgId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    ...dto
+  }: TUpdateUserPrivilegeDTO) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
@@ -93,6 +97,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       projectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -129,7 +134,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     return additionalPrivilege;
   };
 
-  const deleteById = async ({ actorId, actor, actorOrgId, privilegeId }: TDeleteUserPrivilegeDTO) => {
+  const deleteById = async ({ actorId, actor, actorOrgId, actorAuthMethod, privilegeId }: TDeleteUserPrivilegeDTO) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
@@ -140,6 +145,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       projectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -148,7 +154,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     return deletedPrivilege;
   };
 
-  const getPrivilegeDetailsById = async ({ privilegeId, actorOrgId, actor, actorId }: TGetUserPrivilegeDetailsDTO) => {
+  const getPrivilegeDetailsById = async ({
+    privilegeId,
+    actorOrgId,
+    actor,
+    actorId,
+    actorAuthMethod
+  }: TGetUserPrivilegeDetailsDTO) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
@@ -159,17 +171,42 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       actor,
       actorId,
       projectMembership.projectId,
+      actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
 
     return userPrivilege;
   };
 
+  const listPrivileges = async ({
+    projectMembershipId,
+    actorOrgId,
+    actor,
+    actorId,
+    actorAuthMethod
+  }: TListUserPrivilegesDTO) => {
+    const projectMembership = await projectMembershipDAL.findById(projectMembershipId);
+    if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectMembership.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
+
+    const userPrivileges = await projectUserAdditionalPrivilegeDAL.find({ projectMembershipId });
+    return userPrivileges;
+  };
+
   return {
     create,
     updateById,
     deleteById,
-    getPrivilegeDetailsById
+    getPrivilegeDetailsById,
+    listPrivileges
   };
 };

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-types.ts

@@ -8,17 +8,13 @@ export type TCreateUserPrivilegeDTO = (
   | {
       permissions: unknown;
       projectMembershipId: string;
-      name: string;
       slug: string;
-      description?: string;
       isTemporary: false;
     }
   | {
       permissions: unknown;
       projectMembershipId: string;
-      name: string;
       slug: string;
-      description?: string;
       isTemporary: true;
       temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative;
       temporaryRange: string;
@@ -30,9 +26,7 @@ export type TCreateUserPrivilegeDTO = (
 export type TUpdateUserPrivilegeDTO = { privilegeId: string } & Omit<TProjectPermission, "projectId"> &
   Partial<{
     permissions: unknown;
-    name: string;
     slug: string;
-    description?: string;
     isTemporary: boolean;
     temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative;
     temporaryRange: string;
@@ -42,3 +36,5 @@ export type TUpdateUserPrivilegeDTO = { privilegeId: string } & Omit<TProjectPer
 export type TDeleteUserPrivilegeDTO = Omit<TProjectPermission, "projectId"> & { privilegeId: string };
 
 export type TGetUserPrivilegeDetailsDTO = Omit<TProjectPermission, "projectId"> & { privilegeId: string };
+
+export type TListUserPrivilegesDTO = Omit<TProjectPermission, "projectId"> & { projectMembershipId: string };