feat: updated more types to avoid infer

backend/src/@types/fastify.d.ts

@@ -3,13 +3,12 @@ import "fastify";
 import { Redis } from "ioredis";
 
 import { TUsers } from "@app/db/schemas";
-import { TAccessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
+import { TAccessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
-import { TAccessApprovalRequestServiceFactory } from "@app/ee/services/access-approval-request/access-approval-request-service";
+import { TAccessApprovalRequestServiceFactory } from "@app/ee/services/access-approval-request/access-approval-request-types";
-import { TAssumePrivilegeServiceFactory } from "@app/ee/services/assume-privilege/assume-privilege-service";
+import { TAssumePrivilegeServiceFactory } from "@app/ee/services/assume-privilege/assume-privilege-types";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { TAuditLogServiceFactory, TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types";
-import { TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types";
+import { TAuditLogStreamServiceFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-types";
-import { TAuditLogStreamServiceFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-service";
+import { TCertificateAuthorityCrlServiceFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-types";
-import { TCertificateAuthorityCrlServiceFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-service";
 import { TCertificateEstServiceFactory } from "@app/ee/services/certificate-est/certificate-est-service";
 import { TDynamicSecretServiceFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-service";
 import { TDynamicSecretLeaseServiceFactory } from "@app/ee/services/dynamic-secret-lease/dynamic-secret-lease-service";
@@ -25,14 +24,13 @@ import { TKmipServiceFactory } from "@app/ee/services/kmip/kmip-service";
 import { TLdapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-config-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { TPitServiceFactory } from "@app/ee/services/pit/pit-service";
-import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
+import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-types";
-import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service";
+import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
-import { TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service";
+import { RateLimitConfiguration, TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-types";
-import { RateLimitConfiguration } from "@app/ee/services/rate-limit/rate-limit-types";
+import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-types";
-import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service";
+import { TScimServiceFactory } from "@app/ee/services/scim/scim-types";
-import { TScimServiceFactory } from "@app/ee/services/scim/scim-service";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
 import { TSecretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
@@ -44,7 +42,7 @@ import { TSshCertificateAuthorityServiceFactory } from "@app/ee/services/ssh/ssh
 import { TSshCertificateTemplateServiceFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-service";
 import { TSshHostServiceFactory } from "@app/ee/services/ssh-host/ssh-host-service";
 import { TSshHostGroupServiceFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-service";
-import { TTrustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service";
+import { TTrustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-types";
 import { TAuthMode } from "@app/server/plugins/auth/inject-identity";
 import { TApiKeyServiceFactory } from "@app/services/api-key/api-key-service";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";

backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts

@@ -1,7 +1,7 @@
 import { EnforcementLevel, TProjectPermission } from "@app/lib/types";
 import { ActorAuthMethod } from "@app/services/auth/auth-type";
 
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 
 export type TIsApproversValid = {
   userIds: string[];

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -9,16 +9,229 @@ import {
   TUsers
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
+import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter, TOrmify } from "@app/lib/knex";
 
 import { ApprovalStatus } from "./access-approval-request-types";
 
-export type TAccessApprovalRequestDALFactory = ReturnType<typeof accessApprovalRequestDALFactory>;
+export interface TAccessApprovalRequestDALFactory extends Omit<TOrmify<TableName.AccessApprovalRequest>, "findById"> {
+  findById: (
+    id: string,
+    tx?: Knex
+  ) => Promise<
+    | {
+        policy: {
+          approvers: (
+            | {
+                userId: string | null | undefined;
+                email: string | null | undefined;
+                firstName: string | null | undefined;
+                lastName: string | null | undefined;
+                username: string;
+                sequence: number | null | undefined;
+                approvalsRequired: number | null | undefined;
+              }
+            | {
+                userId: string;
+                email: string | null | undefined;
+                firstName: string | null | undefined;
+                lastName: string | null | undefined;
+                username: string;
+                sequence: number | null | undefined;
+                approvalsRequired: number | null | undefined;
+              }
+          )[];
+          bypassers: (
+            | {
+                userId: string | null | undefined;
+                email: string | null | undefined;
+                firstName: string | null | undefined;
+                lastName: string | null | undefined;
+                username: string;
+              }
+            | {
+                userId: string;
+                email: string | null | undefined;
+                firstName: string | null | undefined;
+                lastName: string | null | undefined;
+                username: string;
+              }
+          )[];
+          id: string;
+          name: string;
+          approvals: number;
+          secretPath: string | null | undefined;
+          enforcementLevel: string;
+          allowedSelfApprovals: boolean;
+          deletedAt: Date | null | undefined;
+        };
+        projectId: string;
+        environment: string;
+        requestedByUser: {
+          userId: string;
+          email: string | null | undefined;
+          firstName: string | null | undefined;
+          lastName: string | null | undefined;
+          username: string;
+        };
+        status: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        policyId: string;
+        isTemporary: boolean;
+        requestedByUserId: string;
+        privilegeId?: string | null | undefined;
+        requestedBy?: string | null | undefined;
+        temporaryRange?: string | null | undefined;
+        permissions?: unknown;
+        note?: string | null | undefined;
+        privilegeDeletedAt?: Date | null | undefined;
+        reviewers: {
+          userId: string;
+          status: string;
+          email: string | null | undefined;
+          firstName: string | null | undefined;
+          lastName: string | null | undefined;
+          username: string;
+        }[];
+        approvers: (
+          | {
+              userId: string | null | undefined;
+              email: string | null | undefined;
+              firstName: string | null | undefined;
+              lastName: string | null | undefined;
+              username: string;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+            }
+          | {
+              userId: string;
+              email: string | null | undefined;
+              firstName: string | null | undefined;
+              lastName: string | null | undefined;
+              username: string;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+            }
+        )[];
+        bypassers: (
+          | {
+              userId: string | null | undefined;
+              email: string | null | undefined;
+              firstName: string | null | undefined;
+              lastName: string | null | undefined;
+              username: string;
+            }
+          | {
+              userId: string;
+              email: string | null | undefined;
+              firstName: string | null | undefined;
+              lastName: string | null | undefined;
+              username: string;
+            }
+        )[];
+      }
+    | undefined
+  >;
+  findRequestsWithPrivilegeByPolicyIds: (policyIds: string[]) => Promise<
+    {
+      policy: {
+        approvers: (
+          | {
+              userId: string | null | undefined;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+              email: string | null | undefined;
+              username: string;
+            }
+          | {
+              userId: string;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+              email: string | null | undefined;
+              username: string;
+            }
+        )[];
+        bypassers: string[];
+        id: string;
+        name: string;
+        approvals: number;
+        secretPath: string | null | undefined;
+        enforcementLevel: string;
+        allowedSelfApprovals: boolean;
+        envId: string;
+        deletedAt: Date | null | undefined;
+      };
+      projectId: string;
+      environment: string;
+      environmentName: string;
+      requestedByUser: {
+        userId: string;
+        email: string | null | undefined;
+        firstName: string | null | undefined;
+        lastName: string | null | undefined;
+        username: string;
+      };
+      privilege: {
+        membershipId: string;
+        userId: string;
+        projectId: string;
+        isTemporary: boolean;
+        temporaryMode: string | null | undefined;
+        temporaryRange: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        permissions: unknown;
+      } | null;
+      isApproved: boolean;
+      status: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      policyId: string;
+      isTemporary: boolean;
+      requestedByUserId: string;
+      privilegeId?: string | null | undefined;
+      requestedBy?: string | null | undefined;
+      temporaryRange?: string | null | undefined;
+      permissions?: unknown;
+      note?: string | null | undefined;
+      privilegeDeletedAt?: Date | null | undefined;
+      reviewers: {
+        userId: string;
+        status: string;
+      }[];
+      approvers: (
+        | {
+            userId: string | null | undefined;
+            sequence: number | null | undefined;
+            approvalsRequired: number | null | undefined;
+            email: string | null | undefined;
+            username: string;
+          }
+        | {
+            userId: string;
+            sequence: number | null | undefined;
+            approvalsRequired: number | null | undefined;
+            email: string | null | undefined;
+            username: string;
+          }
+      )[];
+      bypassers: string[];
+    }[]
+  >;
+  getCount: ({ projectId }: { projectId: string }) => Promise<{
+    pendingCount: number;
+    finalizedCount: number;
+  }>;
+  resetReviewByPolicyId: (policyId: string, tx?: Knex) => Promise<void>;
+}
 
-export const accessApprovalRequestDALFactory = (db: TDbClient) => {
+export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalRequestDALFactory => {
   const accessApprovalRequestOrm = ormify(db, TableName.AccessApprovalRequest);
 
-  const findRequestsWithPrivilegeByPolicyIds = async (policyIds: string[]) => {
+  const findRequestsWithPrivilegeByPolicyIds: TAccessApprovalRequestDALFactory["findRequestsWithPrivilegeByPolicyIds"] =
+    async (policyIds) => {
       try {
         const docs = await db
           .replicaNode()(TableName.AccessApprovalRequest)
@@ -354,7 +567,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         tx.ref("deletedAt").withSchema(TableName.AccessApprovalPolicy).as("policyDeletedAt")
       );
 
-  const findById = async (id: string, tx?: Knex) => {
+  const findById: TAccessApprovalRequestDALFactory["findById"] = async (id, tx) => {
     try {
       const sql = findQuery({ [`${TableName.AccessApprovalRequest}.id` as "id"]: id }, tx || db.replicaNode());
       const docs = await sql;
@@ -489,7 +702,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getCount = async ({ projectId }: { projectId: string }) => {
+  const getCount: TAccessApprovalRequestDALFactory["getCount"] = async ({ projectId }) => {
     try {
       const accessRequests = await db
         .replicaNode()(TableName.AccessApprovalRequest)
@@ -555,7 +768,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
     }
   };
 
-  const resetReviewByPolicyId = async (policyId: string, tx?: Knex) => {
+  const resetReviewByPolicyId: TAccessApprovalRequestDALFactory["resetReviewByPolicyId"] = async (policyId, tx) => {
     try {
       await (tx || db)(TableName.AccessApprovalRequestReviewer)
         .leftJoin(

backend/src/ee/services/access-approval-request/access-approval-request-reviewer-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TAccessApprovalRequestReviewerDALFactory = ReturnType<typeof accessApprovalRequestReviewerDALFactory>;
+export type TAccessApprovalRequestReviewerDALFactory = TOrmify<TableName.AccessApprovalRequestReviewer>;
 
-export const accessApprovalRequestReviewerDALFactory = (db: TDbClient) => {
+export const accessApprovalRequestReviewerDALFactory = (db: TDbClient): TAccessApprovalRequestReviewerDALFactory => {
   const secretApprovalRequestReviewerOrm = ormify(db, TableName.AccessApprovalRequestReviewer);
   return secretApprovalRequestReviewerOrm;
 };

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -23,19 +23,13 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-policy/access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "../project-user-additional-privilege/project-user-additional-privilege-types";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
 import { verifyRequestedPermissions } from "./access-approval-request-fns";
 import { TAccessApprovalRequestReviewerDALFactory } from "./access-approval-request-reviewer-dal";
-import {
+import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-approval-request-types";
-  ApprovalStatus,
-  TCreateAccessApprovalRequestDTO,
-  TGetAccessRequestCountDTO,
-  TListApprovalRequestsDTO,
-  TReviewAccessRequestDTO
-} from "./access-approval-request-types";
 
 type TSecretApprovalRequestServiceFactoryDep = {
   additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "create" | "findById">;
@@ -75,8 +69,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
 };
 
-export type TAccessApprovalRequestServiceFactory = ReturnType<typeof accessApprovalRequestServiceFactory>;
-
 export const accessApprovalRequestServiceFactory = ({
   groupDAL,
   projectDAL,
@@ -93,8 +85,8 @@ export const accessApprovalRequestServiceFactory = ({
   microsoftTeamsService,
   projectMicrosoftTeamsConfigDAL,
   projectSlackConfigDAL
-}: TSecretApprovalRequestServiceFactoryDep) => {
+}: TSecretApprovalRequestServiceFactoryDep): TAccessApprovalRequestServiceFactory => {
-  const createAccessApprovalRequest = async ({
+  const createAccessApprovalRequest: TAccessApprovalRequestServiceFactory["createAccessApprovalRequest"] = async ({
     isTemporary,
     temporaryRange,
     actorId,
@@ -104,7 +96,7 @@ export const accessApprovalRequestServiceFactory = ({
     actorAuthMethod,
     projectSlug,
     note
-  }: TCreateAccessApprovalRequestDTO) => {
+  }) => {
     const cfg = getConfig();
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
@@ -281,7 +273,7 @@ export const accessApprovalRequestServiceFactory = ({
     return { request: approval };
   };
 
-  const listApprovalRequests = async ({
+  const listApprovalRequests: TAccessApprovalRequestServiceFactory["listApprovalRequests"] = async ({
     projectSlug,
     authorProjectMembershipId,
     envSlug,
@@ -289,7 +281,7 @@ export const accessApprovalRequestServiceFactory = ({
     actorOrgId,
     actorId,
     actorAuthMethod
-  }: TListApprovalRequestsDTO) => {
+  }) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
 
@@ -319,7 +311,7 @@ export const accessApprovalRequestServiceFactory = ({
     return { requests };
   };
 
-  const reviewAccessRequest = async ({
+  const reviewAccessRequest: TAccessApprovalRequestServiceFactory["reviewAccessRequest"] = async ({
     requestId,
     actor,
     status,
@@ -327,7 +319,7 @@ export const accessApprovalRequestServiceFactory = ({
     actorAuthMethod,
     actorOrgId,
     bypassReason
-  }: TReviewAccessRequestDTO) => {
+  }) => {
     const accessApprovalRequest = await accessApprovalRequestDAL.findById(requestId);
     if (!accessApprovalRequest) {
       throw new NotFoundError({ message: `Secret approval request with ID '${requestId}' not found` });
@@ -566,7 +558,13 @@ export const accessApprovalRequestServiceFactory = ({
     return reviewStatus;
   };
 
-  const getCount = async ({ projectSlug, actor, actorAuthMethod, actorId, actorOrgId }: TGetAccessRequestCountDTO) => {
+  const getCount: TAccessApprovalRequestServiceFactory["getCount"] = async ({
+    projectSlug,
+    actor,
+    actorAuthMethod,
+    actorId,
+    actorOrgId
+  }) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
 

backend/src/ee/services/access-approval-request/access-approval-request-types.ts

@@ -34,3 +34,124 @@ export type TListApprovalRequestsDTO = {
   authorProjectMembershipId?: string;
   envSlug?: string;
 } & Omit<TProjectPermission, "projectId">;
+
+export interface TAccessApprovalRequestServiceFactory {
+  createAccessApprovalRequest: (arg: TCreateAccessApprovalRequestDTO) => Promise<{
+    request: {
+      status: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      policyId: string;
+      isTemporary: boolean;
+      requestedByUserId: string;
+      privilegeId?: string | null | undefined;
+      requestedBy?: string | null | undefined;
+      temporaryRange?: string | null | undefined;
+      permissions?: unknown;
+      note?: string | null | undefined;
+      privilegeDeletedAt?: Date | null | undefined;
+    };
+  }>;
+  listApprovalRequests: (arg: TListApprovalRequestsDTO) => Promise<{
+    requests: {
+      policy: {
+        approvers: (
+          | {
+              userId: string | null | undefined;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+              email: string | null | undefined;
+              username: string;
+            }
+          | {
+              userId: string;
+              sequence: number | null | undefined;
+              approvalsRequired: number | null | undefined;
+              email: string | null | undefined;
+              username: string;
+            }
+        )[];
+        bypassers: string[];
+        id: string;
+        name: string;
+        approvals: number;
+        secretPath: string | null | undefined;
+        enforcementLevel: string;
+        allowedSelfApprovals: boolean;
+        envId: string;
+        deletedAt: Date | null | undefined;
+      };
+      projectId: string;
+      environment: string;
+      environmentName: string;
+      requestedByUser: {
+        userId: string;
+        email: string | null | undefined;
+        firstName: string | null | undefined;
+        lastName: string | null | undefined;
+        username: string;
+      };
+      privilege: {
+        membershipId: string;
+        userId: string;
+        projectId: string;
+        isTemporary: boolean;
+        temporaryMode: string | null | undefined;
+        temporaryRange: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        permissions: unknown;
+      } | null;
+      isApproved: boolean;
+      status: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      policyId: string;
+      isTemporary: boolean;
+      requestedByUserId: string;
+      privilegeId?: string | null | undefined;
+      requestedBy?: string | null | undefined;
+      temporaryRange?: string | null | undefined;
+      permissions?: unknown;
+      note?: string | null | undefined;
+      privilegeDeletedAt?: Date | null | undefined;
+      reviewers: {
+        userId: string;
+        status: string;
+      }[];
+      approvers: (
+        | {
+            userId: string | null | undefined;
+            sequence: number | null | undefined;
+            approvalsRequired: number | null | undefined;
+            email: string | null | undefined;
+            username: string;
+          }
+        | {
+            userId: string;
+            sequence: number | null | undefined;
+            approvalsRequired: number | null | undefined;
+            email: string | null | undefined;
+            username: string;
+          }
+      )[];
+      bypassers: string[];
+    }[];
+  }>;
+  reviewAccessRequest: (arg: TReviewAccessRequestDTO) => Promise<{
+    id: string;
+    requestId: string;
+    reviewerUserId: string;
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+  }>;
+  getCount: (arg: TGetAccessRequestCountDTO) => Promise<{
+    count: {
+      pendingCount: number;
+      finalizedCount: number;
+    };
+  }>;
+}

backend/src/ee/services/assume-privilege/assume-privilege-service.ts

@@ -7,29 +7,30 @@ import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
   ProjectPermissionIdentityActions,
   ProjectPermissionMemberActions,
   ProjectPermissionSub
 } from "../permission/project-permission";
-import { TAssumeProjectPrivilegeDTO } from "./assume-privilege-types";
+import { TAssumePrivilegeServiceFactory } from "./assume-privilege-types";
 
 type TAssumePrivilegeServiceFactoryDep = {
   projectDAL: Pick<TProjectDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
-export type TAssumePrivilegeServiceFactory = ReturnType<typeof assumePrivilegeServiceFactory>;
+export const assumePrivilegeServiceFactory = ({
-
+  projectDAL,
-export const assumePrivilegeServiceFactory = ({ projectDAL, permissionService }: TAssumePrivilegeServiceFactoryDep) => {
+  permissionService
-  const assumeProjectPrivileges = async ({
+}: TAssumePrivilegeServiceFactoryDep): TAssumePrivilegeServiceFactory => {
+  const assumeProjectPrivileges: TAssumePrivilegeServiceFactory["assumeProjectPrivileges"] = async ({
     targetActorType,
     targetActorId,
     projectId,
     actorPermissionDetails,
     tokenVersionId
-  }: TAssumeProjectPrivilegeDTO) => {
+  }) => {
     const project = await projectDAL.findById(projectId);
     if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
     const { permission } = await permissionService.getProjectPermission({
@@ -79,7 +80,10 @@ export const assumePrivilegeServiceFactory = ({ projectDAL, permissionService }:
     return { actorType: targetActorType, actorId: targetActorId, projectId, assumePrivilegesToken };
   };
 
-  const verifyAssumePrivilegeToken = (token: string, tokenVersionId: string) => {
+  const verifyAssumePrivilegeToken: TAssumePrivilegeServiceFactory["verifyAssumePrivilegeToken"] = (
+    token,
+    tokenVersionId
+  ) => {
     const appCfg = getConfig();
     const decodedToken = jwt.verify(token, appCfg.AUTH_SECRET) as {
       tokenVersionId: string;

backend/src/ee/services/assume-privilege/assume-privilege-types.ts

@@ -8,3 +8,28 @@ export type TAssumeProjectPrivilegeDTO = {
   tokenVersionId: string;
   actorPermissionDetails: OrgServiceActor;
 };
+
+export interface TAssumePrivilegeServiceFactory {
+  assumeProjectPrivileges: ({
+    targetActorType,
+    targetActorId,
+    projectId,
+    actorPermissionDetails,
+    tokenVersionId
+  }: TAssumeProjectPrivilegeDTO) => Promise<{
+    actorType: ActorType.USER | ActorType.IDENTITY;
+    actorId: string;
+    projectId: string;
+    assumePrivilegesToken: string;
+  }>;
+  verifyAssumePrivilegeToken: (
+    token: string,
+    tokenVersionId: string
+  ) => {
+    tokenVersionId: string;
+    projectId: string;
+    requesterId: string;
+    actorType: ActorType;
+    actorId: string;
+  };
+}

backend/src/ee/services/audit-log-stream/audit-log-stream-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TAuditLogStreamDALFactory = ReturnType<typeof auditLogStreamDALFactory>;
+export type TAuditLogStreamDALFactory = TOrmify<TableName.AuditLogStream>;
 
-export const auditLogStreamDALFactory = (db: TDbClient) => {
+export const auditLogStreamDALFactory = (db: TDbClient): TAuditLogStreamDALFactory => {
   const orm = ormify(db, TableName.AuditLogStream);
 
   return orm;

backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts

@@ -11,16 +11,9 @@ import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { AUDIT_LOG_STREAM_TIMEOUT } from "../audit-log/audit-log-queue";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TAuditLogStreamDALFactory } from "./audit-log-stream-dal";
-import {
+import { LogStreamHeaders, TAuditLogStreamServiceFactory } from "./audit-log-stream-types";
-  LogStreamHeaders,
-  TCreateAuditLogStreamDTO,
-  TDeleteAuditLogStreamDTO,
-  TGetDetailsAuditLogStreamDTO,
-  TListAuditLogStreamDTO,
-  TUpdateAuditLogStreamDTO
-} from "./audit-log-stream-types";
 
 type TAuditLogStreamServiceFactoryDep = {
   auditLogStreamDAL: TAuditLogStreamDALFactory;
@@ -28,21 +21,19 @@ type TAuditLogStreamServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
-export type TAuditLogStreamServiceFactory = ReturnType<typeof auditLogStreamServiceFactory>;
-
 export const auditLogStreamServiceFactory = ({
   auditLogStreamDAL,
   permissionService,
   licenseService
-}: TAuditLogStreamServiceFactoryDep) => {
+}: TAuditLogStreamServiceFactoryDep): TAuditLogStreamServiceFactory => {
-  const create = async ({
+  const create: TAuditLogStreamServiceFactory["create"] = async ({
     url,
     actor,
     headers = [],
     actorId,
     actorOrgId,
     actorAuthMethod
-  }: TCreateAuditLogStreamDTO) => {
+  }) => {
     if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" });
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -110,7 +101,7 @@ export const auditLogStreamServiceFactory = ({
     return logStream;
   };
 
-  const updateById = async ({
+  const updateById: TAuditLogStreamServiceFactory["updateById"] = async ({
     id,
     url,
     actor,
@@ -118,7 +109,7 @@ export const auditLogStreamServiceFactory = ({
     actorId,
     actorOrgId,
     actorAuthMethod
-  }: TUpdateAuditLogStreamDTO) => {
+  }) => {
     if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" });
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -175,7 +166,13 @@ export const auditLogStreamServiceFactory = ({
     return updatedLogStream;
   };
 
-  const deleteById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TDeleteAuditLogStreamDTO) => {
+  const deleteById: TAuditLogStreamServiceFactory["deleteById"] = async ({
+    id,
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod
+  }) => {
     if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" });
 
     const logStream = await auditLogStreamDAL.findById(id);
@@ -189,7 +186,13 @@ export const auditLogStreamServiceFactory = ({
     return deletedLogStream;
   };
 
-  const getById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TGetDetailsAuditLogStreamDTO) => {
+  const getById: TAuditLogStreamServiceFactory["getById"] = async ({
+    id,
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod
+  }) => {
     const logStream = await auditLogStreamDAL.findById(id);
     if (!logStream) throw new NotFoundError({ message: `Audit log stream with ID '${id}' not found` });
 
@@ -212,7 +215,7 @@ export const auditLogStreamServiceFactory = ({
     return { ...logStream, headers };
   };
 
-  const list = async ({ actor, actorId, actorOrgId, actorAuthMethod }: TListAuditLogStreamDTO) => {
+  const list: TAuditLogStreamServiceFactory["list"] = async ({ actor, actorId, actorOrgId, actorAuthMethod }) => {
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,

backend/src/ee/services/audit-log-stream/audit-log-stream-types.ts

@@ -1,3 +1,4 @@
+import { TAuditLogStreams } from "@app/db/schemas";
 import { TOrgPermission } from "@app/lib/types";
 
 export type LogStreamHeaders = {
@@ -25,3 +26,23 @@ export type TListAuditLogStreamDTO = Omit<TOrgPermission, "orgId">;
 export type TGetDetailsAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
   id: string;
 };
+
+export type TAuditLogStreamServiceFactory = {
+  create: (arg: TCreateAuditLogStreamDTO) => Promise<TAuditLogStreams>;
+  updateById: (arg: TUpdateAuditLogStreamDTO) => Promise<TAuditLogStreams>;
+  deleteById: (arg: TDeleteAuditLogStreamDTO) => Promise<TAuditLogStreams>;
+  getById: (arg: TGetDetailsAuditLogStreamDTO) => Promise<{
+    headers: LogStreamHeaders[] | undefined;
+    orgId: string;
+    url: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    encryptedHeadersCiphertext?: string | null | undefined;
+    encryptedHeadersIV?: string | null | undefined;
+    encryptedHeadersTag?: string | null | undefined;
+    encryptedHeadersAlgorithm?: string | null | undefined;
+    encryptedHeadersKeyEncoding?: string | null | undefined;
+  }>;
+  list: (arg: TListAuditLogStreamDTO) => Promise<TAuditLogStreams[]>;
+};

backend/src/ee/services/audit-log/audit-log-dal.ts

@@ -2,16 +2,29 @@
 import knex from "knex";
 
 import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
+import { TableName, TAuditLogs } from "@app/db/schemas";
 import { DatabaseError, GatewayTimeoutError } from "@app/lib/errors";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { ormify, selectAllTableCols, TOrmify } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
 
 import { EventType, filterableSecretEvents } from "./audit-log-types";
 
-export type TAuditLogDALFactory = ReturnType<typeof auditLogDALFactory>;
+export interface TAuditLogDALFactory extends Omit<TOrmify<TableName.AuditLog>, "find"> {
+  pruneAuditLog: (tx?: knex.Knex) => Promise<void>;
+  find: (
+    arg: Omit<TFindQuery, "actor" | "eventType"> & {
+      actorId?: string | undefined;
+      actorType?: ActorType | undefined;
+      secretPath?: string | undefined;
+      secretKey?: string | undefined;
+      eventType?: EventType[] | undefined;
+      eventMetadata?: Record<string, string> | undefined;
+    },
+    tx?: knex.Knex
+  ) => Promise<TAuditLogs[]>;
+}
 
 type TFindQuery = {
   actor?: string;
@@ -29,7 +42,7 @@ type TFindQuery = {
 export const auditLogDALFactory = (db: TDbClient) => {
   const auditLogOrm = ormify(db, TableName.AuditLog);
 
-  const find = async (
+  const find: TAuditLogDALFactory["find"] = async (
     {
       orgId,
       projectId,
@@ -45,15 +58,8 @@ export const auditLogDALFactory = (db: TDbClient) => {
       secretKey,
       eventType,
       eventMetadata
-    }: Omit<TFindQuery, "actor" | "eventType"> & {
-      actorId?: string;
-      actorType?: ActorType;
-      secretPath?: string;
-      secretKey?: string;
-      eventType?: EventType[];
-      eventMetadata?: Record<string, string>;
     },
-    tx?: knex.Knex
+    tx
   ) => {
     if (!orgId && !projectId) {
       throw new Error("Either orgId or projectId must be provided");
@@ -154,7 +160,7 @@ export const auditLogDALFactory = (db: TDbClient) => {
   };
 
   // delete all audit log that have expired
-  const pruneAuditLog = async (tx?: knex.Knex) => {
+  const pruneAuditLog: TAuditLogDALFactory["pruneAuditLog"] = async (tx) => {
     const AUDIT_LOG_PRUNE_BATCH_SIZE = 10000;
     const MAX_RETRY_ON_FAILURE = 3;
 

backend/src/ee/services/audit-log/audit-log-queue.ts

@@ -21,7 +21,9 @@ type TAuditLogQueueServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
-export type TAuditLogQueueServiceFactory = Awaited<ReturnType<typeof auditLogQueueServiceFactory>>;
+export type TAuditLogQueueServiceFactory = {
+  pushToLog: (data: TCreateAuditLogDTO) => Promise<void>;
+};
 
 // keep this timeout 5s it must be fast because else the queue will take time to finish
 // audit log is a crowded queue thus needs to be fast
@@ -33,7 +35,7 @@ export const auditLogQueueServiceFactory = async ({
   projectDAL,
   licenseService,
   auditLogStreamDAL
-}: TAuditLogQueueServiceFactoryDep) => {
+}: TAuditLogQueueServiceFactoryDep): Promise<TAuditLogQueueServiceFactory> => {
   const appCfg = getConfig();
 
   const pushToLog = async (data: TCreateAuditLogDTO) => {

backend/src/ee/services/audit-log/audit-log-service.ts

@@ -7,11 +7,11 @@ import { BadRequestError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
 
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TAuditLogDALFactory } from "./audit-log-dal";
 import { TAuditLogQueueServiceFactory } from "./audit-log-queue";
-import { EventType, TCreateAuditLogDTO, TListProjectAuditLogDTO } from "./audit-log-types";
+import { EventType, TAuditLogServiceFactory } from "./audit-log-types";
 
 type TAuditLogServiceFactoryDep = {
   auditLogDAL: TAuditLogDALFactory;
@@ -19,14 +19,18 @@ type TAuditLogServiceFactoryDep = {
   auditLogQueue: TAuditLogQueueServiceFactory;
 };
 
-export type TAuditLogServiceFactory = ReturnType<typeof auditLogServiceFactory>;
-
 export const auditLogServiceFactory = ({
   auditLogDAL,
   auditLogQueue,
   permissionService
-}: TAuditLogServiceFactoryDep) => {
+}: TAuditLogServiceFactoryDep): TAuditLogServiceFactory => {
-  const listAuditLogs = async ({ actorAuthMethod, actorId, actorOrgId, actor, filter }: TListProjectAuditLogDTO) => {
+  const listAuditLogs: TAuditLogServiceFactory["listAuditLogs"] = async ({
+    actorAuthMethod,
+    actorId,
+    actorOrgId,
+    actor,
+    filter
+  }) => {
     // Filter logs for specific project
     if (filter.projectId) {
       const { permission } = await permissionService.getProjectPermission({
@@ -75,7 +79,7 @@ export const auditLogServiceFactory = ({
     }));
   };
 
-  const createAuditLog = async (data: TCreateAuditLogDTO) => {
+  const createAuditLog: TAuditLogServiceFactory["createAuditLog"] = async (data) => {
     const appCfg = getConfig();
     if (appCfg.DISABLE_AUDIT_LOG_GENERATION) {
       return;

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -82,6 +82,32 @@ export type TCreateAuditLogDTO = {
   projectId?: string;
 } & BaseAuthData;
 
+export type TAuditLogServiceFactory = {
+  createAuditLog: (data: TCreateAuditLogDTO) => Promise<void>;
+  listAuditLogs: (arg: TListProjectAuditLogDTO) => Promise<
+    {
+      event: {
+        type: string;
+        metadata: unknown;
+      };
+      actor: {
+        type: string;
+        metadata: unknown;
+      };
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      orgId?: string | null | undefined;
+      userAgent?: string | null | undefined;
+      expiresAt?: Date | null | undefined;
+      ipAddress?: string | null | undefined;
+      userAgentType?: string | null | undefined;
+      projectId?: string | null | undefined;
+      projectName?: string | null | undefined;
+    }[]
+  >;
+};
+
 export type AuditLogInfo = Pick<TCreateAuditLogDTO, "userAgent" | "userAgentType" | "ipAddress" | "actor">;
 
 interface BaseAuthData {

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TCertificateAuthorityCrlDALFactory = ReturnType<typeof certificateAuthorityCrlDALFactory>;
+export type TCertificateAuthorityCrlDALFactory = TOrmify<TableName.CertificateAuthorityCrl>;
 
-export const certificateAuthorityCrlDALFactory = (db: TDbClient) => {
+export const certificateAuthorityCrlDALFactory = (db: TDbClient): TCertificateAuthorityCrlDALFactory => {
   const caCrlOrm = ormify(db, TableName.CertificateAuthorityCrl);
   return caCrlOrm;
 };

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts

@@ -3,7 +3,7 @@ import * as x509 from "@peculiar/x509";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { NotFoundError } from "@app/lib/errors";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
@@ -12,7 +12,7 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
-import { TGetCaCrlsDTO, TGetCrlById } from "./certificate-authority-crl-types";
+import { TCertificateAuthorityCrlServiceFactory } from "./certificate-authority-crl-types";
 
 type TCertificateAuthorityCrlServiceFactoryDep = {
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
@@ -22,19 +22,17 @@ type TCertificateAuthorityCrlServiceFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
-export type TCertificateAuthorityCrlServiceFactory = ReturnType<typeof certificateAuthorityCrlServiceFactory>;
-
 export const certificateAuthorityCrlServiceFactory = ({
   certificateAuthorityDAL,
   certificateAuthorityCrlDAL,
   projectDAL,
   kmsService,
   permissionService // licenseService
-}: TCertificateAuthorityCrlServiceFactoryDep) => {
+}: TCertificateAuthorityCrlServiceFactoryDep): TCertificateAuthorityCrlServiceFactory => {
   /**
    * Return CRL with id [crlId]
    */
-  const getCrlById = async (crlId: TGetCrlById) => {
+  const getCrlById: TCertificateAuthorityCrlServiceFactory["getCrlById"] = async (crlId) => {
     const caCrl = await certificateAuthorityCrlDAL.findById(crlId);
     if (!caCrl) throw new NotFoundError({ message: `CRL with ID '${crlId}' not found` });
 
@@ -65,7 +63,13 @@ export const certificateAuthorityCrlServiceFactory = ({
   /**
    * Returns a list of CRL ids for CA with id [caId]
    */
-  const getCaCrls = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCrlsDTO) => {
+  const getCaCrls: TCertificateAuthorityCrlServiceFactory["getCaCrls"] = async ({
+    caId,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId
+  }) => {
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
     if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
 

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts

@@ -5,3 +5,137 @@ export type TGetCrlById = string;
 export type TGetCaCrlsDTO = {
   caId: string;
 } & Omit<TProjectPermission, "projectId">;
+
+export type TCertificateAuthorityCrlServiceFactory = {
+  getCrlById: (crlId: TGetCrlById) => Promise<{
+    ca: {
+      readonly requireTemplateForIssuance: boolean;
+      readonly internalCa:
+        | {
+            id: string;
+            parentCaId: string | null | undefined;
+            type: string;
+            friendlyName: string;
+            organization: string;
+            ou: string;
+            country: string;
+            province: string;
+            locality: string;
+            commonName: string;
+            dn: string;
+            serialNumber: string | null | undefined;
+            maxPathLength: number | null | undefined;
+            keyAlgorithm: string;
+            notBefore: string | undefined;
+            notAfter: string | undefined;
+            activeCaCertId: string | null | undefined;
+          }
+        | undefined;
+      readonly externalCa:
+        | {
+            id: string;
+            type: string;
+            configuration: unknown;
+            dnsAppConnectionId: string | null | undefined;
+            appConnectionId: string | null | undefined;
+            credentials: Buffer | null | undefined;
+          }
+        | undefined;
+      readonly name: string;
+      readonly status: string;
+      readonly id: string;
+      readonly createdAt: Date;
+      readonly updatedAt: Date;
+      readonly projectId: string;
+      readonly enableDirectIssuance: boolean;
+      readonly parentCaId: string | null | undefined;
+      readonly type: string;
+      readonly friendlyName: string;
+      readonly organization: string;
+      readonly ou: string;
+      readonly country: string;
+      readonly province: string;
+      readonly locality: string;
+      readonly commonName: string;
+      readonly dn: string;
+      readonly serialNumber: string | null | undefined;
+      readonly maxPathLength: number | null | undefined;
+      readonly keyAlgorithm: string;
+      readonly notBefore: string | undefined;
+      readonly notAfter: string | undefined;
+      readonly activeCaCertId: string | null | undefined;
+    };
+    caCrl: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      caId: string;
+      caSecretId: string;
+      encryptedCrl: Buffer;
+    };
+    crl: ArrayBuffer;
+  }>;
+  getCaCrls: ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCrlsDTO) => Promise<{
+    ca: {
+      readonly requireTemplateForIssuance: boolean;
+      readonly internalCa:
+        | {
+            id: string;
+            parentCaId: string | null | undefined;
+            type: string;
+            friendlyName: string;
+            organization: string;
+            ou: string;
+            country: string;
+            province: string;
+            locality: string;
+            commonName: string;
+            dn: string;
+            serialNumber: string | null | undefined;
+            maxPathLength: number | null | undefined;
+            keyAlgorithm: string;
+            notBefore: string | undefined;
+            notAfter: string | undefined;
+            activeCaCertId: string | null | undefined;
+          }
+        | undefined;
+      readonly externalCa:
+        | {
+            id: string;
+            type: string;
+            configuration: unknown;
+            dnsAppConnectionId: string | null | undefined;
+            appConnectionId: string | null | undefined;
+            credentials: Buffer | null | undefined;
+          }
+        | undefined;
+      readonly name: string;
+      readonly status: string;
+      readonly id: string;
+      readonly createdAt: Date;
+      readonly updatedAt: Date;
+      readonly projectId: string;
+      readonly enableDirectIssuance: boolean;
+      readonly parentCaId: string | null | undefined;
+      readonly type: string;
+      readonly friendlyName: string;
+      readonly organization: string;
+      readonly ou: string;
+      readonly country: string;
+      readonly province: string;
+      readonly locality: string;
+      readonly commonName: string;
+      readonly dn: string;
+      readonly serialNumber: string | null | undefined;
+      readonly maxPathLength: number | null | undefined;
+      readonly keyAlgorithm: string;
+      readonly notBefore: string | undefined;
+      readonly notAfter: string | undefined;
+      readonly activeCaCertId: string | null | undefined;
+    };
+    crls: {
+      id: string;
+      crl: string;
+    }[];
+  }>;
+};

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -3,7 +3,7 @@ import RE2 from "re2";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub

backend/src/ee/services/external-kms/external-kms-service.ts

@@ -11,7 +11,7 @@ import { KmsDataKey, KmsKeyUsage } from "@app/services/kms/kms-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TExternalKmsDALFactory } from "./external-kms-dal";
 import {
   TCreateExternalKmsDTO,

backend/src/ee/services/gateway/gateway-service.ts

@@ -21,7 +21,7 @@ import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TGatewayDALFactory } from "./gateway-dal";
 import {
   TExchangeAllocatedRelayAddressDTO,

backend/src/ee/services/github-org-sync/github-org-sync-service.ts

@@ -14,7 +14,7 @@ import { TGroupDALFactory } from "../group/group-dal";
 import { TUserGroupMembershipDALFactory } from "../group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TGithubOrgSyncDALFactory } from "./github-org-sync-dal";
 import { TCreateGithubOrgSyncDTO, TDeleteGithubOrgSyncDTO, TUpdateGithubOrgSyncDTO } from "./github-org-sync-types";
 

backend/src/ee/services/group/group-service.ts

@@ -15,7 +15,7 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionGroupActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TGroupDALFactory } from "./group-dal";
 import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "./group-fns";
 import {

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -11,7 +11,7 @@ import { TIdentityProjectDALFactory } from "@app/services/identity-project/ident
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TIdentityProjectAdditionalPrivilegeV2DALFactory } from "./identity-project-additional-privilege-v2-dal";
 import {

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -11,7 +11,7 @@ import { TIdentityProjectDALFactory } from "@app/services/identity-project/ident
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
   ProjectPermissionIdentityActions,
   ProjectPermissionSet,

backend/src/ee/services/kmip/kmip-operation-service.ts

@@ -7,7 +7,7 @@ import { KmsKeyUsage } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { OrgPermissionKmipActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TKmipClientDALFactory } from "./kmip-client-dal";
 import { KmipPermission } from "./kmip-enum";
 import {

backend/src/ee/services/kmip/kmip-service.ts

@@ -18,7 +18,7 @@ import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionKmipActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { ProjectPermissionKmipActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TKmipClientCertificateDALFactory } from "./kmip-client-certificate-dal";
 import { TKmipClientDALFactory } from "./kmip-client-dal";

backend/src/ee/services/ldap-config/ldap-config-service.ts

@@ -29,7 +29,7 @@ import { UserAliasType } from "@app/services/user-alias/user-alias-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TLdapConfigDALFactory } from "./ldap-config-dal";
 import {
   TCreateLdapCfgDTO,

backend/src/ee/services/license/license-service.ts

@@ -18,7 +18,7 @@ import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { OrgPermissionBillingActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { BillingPlanRows, BillingPlanTableHead } from "./licence-enums";
 import { TLicenseDALFactory } from "./license-dal";
 import { getDefaultOnPremFeatures, setupLicenseRequestWithStore } from "./license-fns";

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -5,14 +5,13 @@ import { Issuer, Issuer as OpenIdIssuer, Strategy as OpenIdStrategy, TokenSet }
 
 import { OrgMembershipStatus, TableName, TUsers } from "@app/db/schemas";
 import { TOidcConfigsUpdate } from "@app/db/schemas/oidc-configs";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-types";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, OidcAuthError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";

backend/src/ee/services/permission/permission-dal.ts

@@ -6,16 +6,312 @@ import {
   OrgMembershipRole,
   OrgMembershipsSchema,
   TableName,
+  TIdentityOrgMemberships,
   TProjectRoles,
   TProjects
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
-export type TPermissionDALFactory = ReturnType<typeof permissionDALFactory>;
+export interface TPermissionDALFactory {
+  getOrgPermission: (
+    userId: string,
+    orgId: string
+  ) => Promise<
+    {
+      status: string;
+      orgId: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      role: string;
+      isActive: boolean;
+      shouldUseNewPrivilegeSystem: boolean;
+      bypassOrgAuthEnabled: boolean;
+      permissions?: unknown;
+      userId?: string | null | undefined;
+      roleId?: string | null | undefined;
+      inviteEmail?: string | null | undefined;
+      projectFavorites?: string[] | null | undefined;
+      customRoleSlug?: string | null | undefined;
+      orgAuthEnforced?: boolean | null | undefined;
+    } & {
+      groups: {
+        id: string;
+        updatedAt: Date;
+        createdAt: Date;
+        role: string;
+        roleId: string | null | undefined;
+        customRolePermission: unknown;
+        name: string;
+        slug: string;
+        orgId: string;
+      }[];
+    }
+  >;
+  getOrgIdentityPermission: (
+    identityId: string,
+    orgId: string
+  ) => Promise<
+    | (TIdentityOrgMemberships & {
+        orgAuthEnforced: boolean | null | undefined;
+        shouldUseNewPrivilegeSystem: boolean;
+        permissions?: unknown;
+      })
+    | undefined
+  >;
+  getProjectPermission: (
+    userId: string,
+    projectId: string
+  ) => Promise<
+    | {
+        roles: {
+          id: string;
+          role: string;
+          customRoleSlug: string;
+          permissions: unknown;
+          temporaryRange: string | null | undefined;
+          temporaryMode: string | null | undefined;
+          temporaryAccessStartTime: Date | null | undefined;
+          temporaryAccessEndTime: Date | null | undefined;
+          isTemporary: boolean;
+        }[];
+        additionalPrivileges: {
+          id: string;
+          permissions: unknown;
+          temporaryRange: string | null | undefined;
+          temporaryMode: string | null | undefined;
+          temporaryAccessStartTime: Date | null | undefined;
+          temporaryAccessEndTime: Date | null | undefined;
+          isTemporary: boolean;
+        }[];
+        orgId: string;
+        orgAuthEnforced: boolean | null | undefined;
+        orgRole: OrgMembershipRole;
+        userId: string;
+        projectId: string;
+        username: string;
+        projectType: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        shouldUseNewPrivilegeSystem: boolean;
+        bypassOrgAuthEnabled: boolean;
+        metadata: {
+          id: string;
+          key: string;
+          value: string;
+        }[];
+        userGroupRoles: {
+          id: string;
+          role: string;
+          customRoleSlug: string;
+          permissions: unknown;
+          temporaryRange: string | null | undefined;
+          temporaryMode: string | null | undefined;
+          temporaryAccessStartTime: Date | null | undefined;
+          temporaryAccessEndTime: Date | null | undefined;
+          isTemporary: boolean;
+        }[];
+        projecMembershiptRoles: {
+          id: string;
+          role: string;
+          customRoleSlug: string;
+          permissions: unknown;
+          temporaryRange: string | null | undefined;
+          temporaryMode: string | null | undefined;
+          temporaryAccessStartTime: Date | null | undefined;
+          temporaryAccessEndTime: Date | null | undefined;
+          isTemporary: boolean;
+        }[];
+      }
+    | undefined
+  >;
+  getProjectIdentityPermission: (
+    identityId: string,
+    projectId: string
+  ) => Promise<
+    | {
+        roles: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          isTemporary: boolean;
+          role: string;
+          projectMembershipId: string;
+          temporaryRange?: string | null | undefined;
+          permissions?: unknown;
+          customRoleId?: string | null | undefined;
+          temporaryMode?: string | null | undefined;
+          temporaryAccessStartTime?: Date | null | undefined;
+          temporaryAccessEndTime?: Date | null | undefined;
+          customRoleSlug?: string | null | undefined;
+        }[];
+        additionalPrivileges: {
+          id: string;
+          permissions: unknown;
+          temporaryRange: string | null | undefined;
+          temporaryMode: string | null | undefined;
+          temporaryAccessEndTime: Date | null | undefined;
+          temporaryAccessStartTime: Date | null | undefined;
+          isTemporary: boolean;
+        }[];
+        id: string;
+        identityId: string;
+        username: string;
+        projectId: string;
+        createdAt: Date;
+        updatedAt: Date;
+        orgId: string;
+        projectType: string;
+        shouldUseNewPrivilegeSystem: boolean;
+        orgAuthEnforced: boolean;
+        metadata: {
+          id: string;
+          key: string;
+          value: string;
+        }[];
+      }
+    | undefined
+  >;
+  getProjectUserPermissions: (projectId: string) => Promise<
+    {
+      roles: {
+        id: string;
+        role: string;
+        customRoleSlug: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+      additionalPrivileges: {
+        id: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+      orgId: string;
+      orgAuthEnforced: boolean | null | undefined;
+      userId: string;
+      projectId: string;
+      username: string;
+      projectType: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      metadata: {
+        id: string;
+        key: string;
+        value: string;
+      }[];
+      userGroupRoles: {
+        id: string;
+        role: string;
+        customRoleSlug: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+      projectMembershipRoles: {
+        id: string;
+        role: string;
+        customRoleSlug: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+    }[]
+  >;
+  getProjectIdentityPermissions: (projectId: string) => Promise<
+    {
+      roles: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        isTemporary: boolean;
+        role: string;
+        projectMembershipId: string;
+        temporaryRange?: string | null | undefined;
+        permissions?: unknown;
+        customRoleId?: string | null | undefined;
+        temporaryMode?: string | null | undefined;
+        temporaryAccessStartTime?: Date | null | undefined;
+        temporaryAccessEndTime?: Date | null | undefined;
+        customRoleSlug?: string | null | undefined;
+      }[];
+      additionalPrivileges: {
+        id: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+      id: string;
+      identityId: string;
+      username: string;
+      projectId: string;
+      createdAt: Date;
+      updatedAt: Date;
+      orgId: string;
+      projectType: string;
+      orgAuthEnforced: boolean;
+      metadata: {
+        id: string;
+        key: string;
+        value: string;
+      }[];
+    }[]
+  >;
+  getProjectGroupPermissions: (
+    projectId: string,
+    filterGroupId?: string
+  ) => Promise<
+    {
+      roles: {
+        id: string;
+        role: string;
+        customRoleSlug: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+      groupId: string;
+      username: string;
+      id: string;
+      groupRoles: {
+        id: string;
+        role: string;
+        customRoleSlug: string;
+        permissions: unknown;
+        temporaryRange: string | null | undefined;
+        temporaryMode: string | null | undefined;
+        temporaryAccessStartTime: Date | null | undefined;
+        temporaryAccessEndTime: Date | null | undefined;
+        isTemporary: boolean;
+      }[];
+    }[]
+  >;
+}
 
-export const permissionDALFactory = (db: TDbClient) => {
+export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
-  const getOrgPermission = async (userId: string, orgId: string) => {
+  const getOrgPermission: TPermissionDALFactory["getOrgPermission"] = async (userId: string, orgId: string) => {
     try {
       const groupSubQuery = db(TableName.Groups)
         .where(`${TableName.Groups}.orgId`, orgId)
@@ -112,7 +408,10 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getOrgIdentityPermission = async (identityId: string, orgId: string) => {
+  const getOrgIdentityPermission: TPermissionDALFactory["getOrgIdentityPermission"] = async (
+    identityId: string,
+    orgId: string
+  ) => {
     try {
       const membership = await db
         .replicaNode()(TableName.IdentityOrgMembership)
@@ -132,7 +431,10 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProjectGroupPermissions = async (projectId: string, filterGroupId?: string) => {
+  const getProjectGroupPermissions: TPermissionDALFactory["getProjectGroupPermissions"] = async (
+    projectId: string,
+    filterGroupId?: string
+  ) => {
     try {
       const docs = await db
         .replicaNode()(TableName.GroupProjectMembership)
@@ -245,7 +547,7 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProjectUserPermissions = async (projectId: string) => {
+  const getProjectUserPermissions: TPermissionDALFactory["getProjectUserPermissions"] = async (projectId: string) => {
     try {
       const docs = await db
         .replicaNode()(TableName.Users)
@@ -535,7 +837,10 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProjectPermission = async (userId: string, projectId: string) => {
+  const getProjectPermission: TPermissionDALFactory["getProjectPermission"] = async (
+    userId: string,
+    projectId: string
+  ) => {
     try {
       const subQueryUserGroups = db(TableName.UserGroupMembership).where("userId", userId).select("groupId");
       const docs = await db
@@ -838,7 +1143,9 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProjectIdentityPermissions = async (projectId: string) => {
+  const getProjectIdentityPermissions: TPermissionDALFactory["getProjectIdentityPermissions"] = async (
+    projectId: string
+  ) => {
     try {
       const docs = await db
         .replicaNode()(TableName.IdentityProjectMembership)
@@ -995,7 +1302,10 @@ export const permissionDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProjectIdentityPermission = async (identityId: string, projectId: string) => {
+  const getProjectIdentityPermission: TPermissionDALFactory["getProjectIdentityPermission"] = async (
+    identityId,
+    projectId
+  ) => {
     try {
       const docs = await db
         .replicaNode()(TableName.IdentityProjectMembership)

backend/src/ee/services/permission/permission-service-types.ts

@@ -1,6 +1,12 @@
+import { MongoAbility, RawRuleOf } from "@casl/ability";
+import { MongoQuery } from "@ucast/mongo2js";
+
 import { ActionProjectType } from "@app/db/schemas";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 
+import { OrgPermissionSet } from "./org-permission";
+import { ProjectPermissionSet } from "./project-permission";
+
 export type TBuildProjectPermissionDTO = {
   permissions?: unknown;
   role: string;
@@ -41,3 +47,240 @@ export type TGetProjectPermissionArg = {
   actorOrgId?: string;
   actionProjectType: ActionProjectType;
 };
+
+export type TPermissionServiceFactory = {
+  getUserOrgPermission: (
+    userId: string,
+    orgId: string,
+    authMethod: ActorAuthMethod,
+    userOrgId?: string
+  ) => Promise<{
+    permission: MongoAbility<OrgPermissionSet, MongoQuery>;
+    membership: {
+      status: string;
+      orgId: string;
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      role: string;
+      isActive: boolean;
+      shouldUseNewPrivilegeSystem: boolean;
+      bypassOrgAuthEnabled: boolean;
+      permissions?: unknown;
+      userId?: string | null | undefined;
+      roleId?: string | null | undefined;
+      inviteEmail?: string | null | undefined;
+      projectFavorites?: string[] | null | undefined;
+      customRoleSlug?: string | null | undefined;
+      orgAuthEnforced?: boolean | null | undefined;
+    } & {
+      groups: {
+        id: string;
+        updatedAt: Date;
+        createdAt: Date;
+        role: string;
+        roleId: string | null | undefined;
+        customRolePermission: unknown;
+        name: string;
+        slug: string;
+        orgId: string;
+      }[];
+    };
+  }>;
+  getOrgPermission: (
+    type: ActorType,
+    id: string,
+    orgId: string,
+    authMethod: ActorAuthMethod,
+    actorOrgId: string | undefined
+  ) => Promise<
+    | {
+        permission: MongoAbility<OrgPermissionSet, MongoQuery>;
+        membership: {
+          status: string;
+          orgId: string;
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          role: string;
+          isActive: boolean;
+          shouldUseNewPrivilegeSystem: boolean;
+          bypassOrgAuthEnabled: boolean;
+          permissions?: unknown;
+          userId?: string | null | undefined;
+          roleId?: string | null | undefined;
+          inviteEmail?: string | null | undefined;
+          projectFavorites?: string[] | null | undefined;
+          customRoleSlug?: string | null | undefined;
+          orgAuthEnforced?: boolean | null | undefined;
+        } & {
+          groups: {
+            id: string;
+            updatedAt: Date;
+            createdAt: Date;
+            role: string;
+            roleId: string | null | undefined;
+            customRolePermission: unknown;
+            name: string;
+            slug: string;
+            orgId: string;
+          }[];
+        };
+      }
+    | {
+        permission: MongoAbility<OrgPermissionSet, MongoQuery>;
+        membership: {
+          id: string;
+          role: string;
+          createdAt: Date;
+          updatedAt: Date;
+          orgId: string;
+          roleId?: string | null | undefined;
+          permissions?: unknown;
+          identityId: string;
+          orgAuthEnforced: boolean | null | undefined;
+          shouldUseNewPrivilegeSystem: boolean;
+        };
+      }
+  >;
+  getUserProjectPermission: ({
+    userId,
+    projectId,
+    authMethod,
+    userOrgId,
+    actionProjectType
+  }: TGetUserProjectPermissionArg) => Promise<{
+    permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+    membership: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      projectId: string;
+    } & {
+      orgAuthEnforced: boolean | null | undefined;
+      orgId: string;
+      roles: Array<{
+        role: string;
+      }>;
+      shouldUseNewPrivilegeSystem: boolean;
+    };
+    hasRole: (role: string) => boolean;
+  }>;
+  getProjectPermission: <T extends ActorType>(
+    arg: TGetProjectPermissionArg
+  ) => Promise<
+    T extends ActorType.SERVICE
+      ? {
+          permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+          membership: {
+            shouldUseNewPrivilegeSystem: boolean;
+          };
+          hasRole: (arg: string) => boolean;
+        }
+      : {
+          permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+          membership: (T extends ActorType.USER
+            ? {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                projectId: string;
+              }
+            : {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                projectId: string;
+                identityId: string;
+              }) & {
+            orgAuthEnforced: boolean | null | undefined;
+            orgId: string;
+            roles: Array<{
+              role: string;
+            }>;
+            shouldUseNewPrivilegeSystem: boolean;
+          };
+          hasRole: (role: string) => boolean;
+        }
+  >;
+  getProjectPermissions: (projectId: string) => Promise<{
+    userPermissions: {
+      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+      id: string;
+      name: string;
+      membershipId: string;
+    }[];
+    identityPermissions: {
+      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+      id: string;
+      name: string;
+      membershipId: string;
+    }[];
+    groupPermissions: {
+      permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+      id: string;
+      name: string;
+      membershipId: string;
+    }[];
+  }>;
+  getOrgPermissionByRole: (
+    role: string,
+    orgId: string
+  ) => Promise<
+    | {
+        permission: MongoAbility<OrgPermissionSet, MongoQuery>;
+        role: {
+          name: string;
+          orgId: string;
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          slug: string;
+          permissions?: unknown;
+          description?: string | null | undefined;
+        };
+      }
+    | {
+        permission: MongoAbility<OrgPermissionSet, MongoQuery>;
+        role?: undefined;
+      }
+  >;
+  getProjectPermissionByRole: (
+    role: string,
+    projectId: string
+  ) => Promise<
+    | {
+        permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+        role: {
+          name: string;
+          version: number;
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          projectId: string;
+          slug: string;
+          permissions?: unknown;
+          description?: string | null | undefined;
+        };
+      }
+    | {
+        permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+        role?: undefined;
+      }
+  >;
+  buildOrgPermission: (orgUserRoles: TBuildOrgPermissionDTO) => MongoAbility<OrgPermissionSet, MongoQuery>;
+  buildProjectPermissionRules: (
+    projectUserRoles: TBuildProjectPermissionDTO
+  ) => RawRuleOf<MongoAbility<ProjectPermissionSet>>[];
+  checkGroupProjectPermission: ({
+    groupId,
+    projectId,
+    checkPermissions
+  }: {
+    groupId: string;
+    projectId: string;
+    checkPermissions: ProjectPermissionSet;
+  }) => Promise<boolean>;
+};

backend/src/ee/services/permission/permission-service.ts

@@ -23,7 +23,7 @@ import {
 import { conditionsMatcher } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { objectify } from "@app/lib/fn";
-import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
+import { ActorType } from "@app/services/auth/auth-type";
 import { TOrgRoleDALFactory } from "@app/services/org/org-role-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectRoleDALFactory } from "@app/services/project-role/project-role-dal";
@@ -38,7 +38,8 @@ import {
   TGetIdentityProjectPermissionArg,
   TGetProjectPermissionArg,
   TGetServiceTokenProjectPermissionArg,
-  TGetUserProjectPermissionArg
+  TGetUserProjectPermissionArg,
+  TPermissionServiceFactory
 } from "./permission-service-types";
 import { buildServiceTokenProjectPermission, ProjectPermissionSet } from "./project-permission";
 
@@ -50,15 +51,13 @@ type TPermissionServiceFactoryDep = {
   permissionDAL: TPermissionDALFactory;
 };
 
-export type TPermissionServiceFactory = ReturnType<typeof permissionServiceFactory>;
-
 export const permissionServiceFactory = ({
   permissionDAL,
   orgRoleDAL,
   projectRoleDAL,
   serviceTokenDAL,
   projectDAL
-}: TPermissionServiceFactoryDep) => {
+}: TPermissionServiceFactoryDep): TPermissionServiceFactory => {
   const buildOrgPermission = (orgUserRoles: TBuildOrgPermissionDTO) => {
     const rules = orgUserRoles
       .map(({ role, permissions }) => {
@@ -120,11 +119,11 @@ export const permissionServiceFactory = ({
   /*
    * Get user permission in an organization
    */
-  const getUserOrgPermission = async (
+  const getUserOrgPermission: TPermissionServiceFactory["getUserOrgPermission"] = async (
-    userId: string,
+    userId,
-    orgId: string,
+    orgId,
-    authMethod: ActorAuthMethod,
+    authMethod,
-    userOrgId?: string
+    userOrgId
   ) => {
     // when token is scoped, ensure the passed org id is same as user org id
     if (userOrgId && userOrgId !== orgId)
@@ -172,12 +171,12 @@ export const permissionServiceFactory = ({
     };
   };
 
-  const getOrgPermission = async (
+  const getOrgPermission: TPermissionServiceFactory["getOrgPermission"] = async (
-    type: ActorType,
+    type,
-    id: string,
+    id,
-    orgId: string,
+    orgId,
-    authMethod: ActorAuthMethod,
+    authMethod,
-    actorOrgId: string | undefined
+    actorOrgId
   ) => {
     switch (type) {
       case ActorType.USER:
@@ -194,7 +193,7 @@ export const permissionServiceFactory = ({
 
   // instead of actor type this will fetch by role slug. meaning it can be the pre defined slugs like
   // admin member or user defined ones like biller etc
-  const getOrgPermissionByRole = async (role: string, orgId: string) => {
+  const getOrgPermissionByRole: TPermissionServiceFactory["getOrgPermissionByRole"] = async (role, orgId) => {
     const isCustomRole = !Object.values(OrgMembershipRole).includes(role as OrgMembershipRole);
     if (isCustomRole) {
       const orgRole = await orgRoleDAL.findOne({ slug: role, orgId });
@@ -437,7 +436,7 @@ export const permissionServiceFactory = ({
         hasRole: (role: string) => boolean;
       };
 
-  const getProjectPermissions = async (projectId: string) => {
+  const getProjectPermissions: TPermissionServiceFactory["getProjectPermissions"] = async (projectId) => {
     // fetch user permissions
     const rawUserProjectPermissions = await permissionDAL.getProjectUserPermissions(projectId);
     const userPermissions = rawUserProjectPermissions.map((userProjectPermission) => {
@@ -607,7 +606,10 @@ export const permissionServiceFactory = ({
     }
   };
 
-  const getProjectPermissionByRole = async (role: string, projectId: string) => {
+  const getProjectPermissionByRole: TPermissionServiceFactory["getProjectPermissionByRole"] = async (
+    role,
+    projectId
+  ) => {
     const isCustomRole = !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole);
     if (isCustomRole) {
       const projectRole = await projectRoleDAL.findOne({ slug: role, projectId });
@@ -630,14 +632,10 @@ export const permissionServiceFactory = ({
     return { permission };
   };
 
-  const checkGroupProjectPermission = async ({
+  const checkGroupProjectPermission: TPermissionServiceFactory["checkGroupProjectPermission"] = async ({
     groupId,
     projectId,
     checkPermissions
-  }: {
-    groupId: string;
-    projectId: string;
-    checkPermissions: ProjectPermissionSet;
   }) => {
     const rawGroupProjectPermissions = await permissionDAL.getProjectGroupPermissions(projectId, groupId);
     const groupPermissions = rawGroupProjectPermissions.map((groupProjectPermission) => {

backend/src/ee/services/pit/pit-service.ts

@@ -16,7 +16,7 @@ import { TSecretServiceFactory } from "@app/services/secret/secret-service";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service";
 
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 
 type TPitServiceFactoryDep = {
   folderCommitService: TFolderCommitServiceFactory;

backend/src/ee/services/project-template/project-template-dal.ts

@@ -1,7 +1,8 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TProjectTemplateDALFactory = ReturnType<typeof projectTemplateDALFactory>;
+export type TProjectTemplateDALFactory = TOrmify<TableName.ProjectTemplates>;
 
-export const projectTemplateDALFactory = (db: TDbClient) => ormify(db, TableName.ProjectTemplates);
+export const projectTemplateDALFactory = (db: TDbClient): TProjectTemplateDALFactory =>
+  ormify(db, TableName.ProjectTemplates);

backend/src/ee/services/project-template/project-template-service.ts

@@ -4,18 +4,16 @@ import { packRules } from "@casl/ability/extra";
 import { ProjectType, TProjectTemplates } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectTemplateDefaultEnvironments } from "@app/ee/services/project-template/project-template-constants";
 import { getDefaultProjectTemplate } from "@app/ee/services/project-template/project-template-fns";
 import {
-  TCreateProjectTemplateDTO,
   TProjectTemplateEnvironment,
   TProjectTemplateRole,
-  TUnpackedPermission,
+  TProjectTemplateServiceFactory,
-  TUpdateProjectTemplateDTO
+  TUnpackedPermission
 } from "@app/ee/services/project-template/project-template-types";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
-import { OrgServiceActor } from "@app/lib/types";
 import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 import { getPredefinedRoles } from "@app/services/project-role/project-role-fns";
 
@@ -27,8 +25,6 @@ type TProjectTemplatesServiceFactoryDep = {
   projectTemplateDAL: TProjectTemplateDALFactory;
 };
 
-export type TProjectTemplateServiceFactory = ReturnType<typeof projectTemplateServiceFactory>;
-
 const $unpackProjectTemplate = ({ roles, environments, ...rest }: TProjectTemplates) => ({
   ...rest,
   environments: environments as TProjectTemplateEnvironment[],
@@ -51,8 +47,11 @@ export const projectTemplateServiceFactory = ({
   licenseService,
   permissionService,
   projectTemplateDAL
-}: TProjectTemplatesServiceFactoryDep) => {
+}: TProjectTemplatesServiceFactoryDep): TProjectTemplateServiceFactory => {
-  const listProjectTemplatesByOrg = async (actor: OrgServiceActor, type?: ProjectType) => {
+  const listProjectTemplatesByOrg: TProjectTemplateServiceFactory["listProjectTemplatesByOrg"] = async (
+    actor,
+    type
+  ) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
     if (!plan.projectTemplates)
@@ -83,7 +82,10 @@ export const projectTemplateServiceFactory = ({
     ];
   };
 
-  const findProjectTemplateByName = async (name: string, actor: OrgServiceActor) => {
+  const findProjectTemplateByName: TProjectTemplateServiceFactory["findProjectTemplateByName"] = async (
+    name,
+    actor
+  ) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
     if (!plan.projectTemplates)
@@ -111,7 +113,7 @@ export const projectTemplateServiceFactory = ({
     };
   };
 
-  const findProjectTemplateById = async (id: string, actor: OrgServiceActor) => {
+  const findProjectTemplateById: TProjectTemplateServiceFactory["findProjectTemplateById"] = async (id, actor) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
     if (!plan.projectTemplates)
@@ -139,9 +141,9 @@ export const projectTemplateServiceFactory = ({
     };
   };
 
-  const createProjectTemplate = async (
+  const createProjectTemplate: TProjectTemplateServiceFactory["createProjectTemplate"] = async (
-    { roles, environments, type, ...params }: TCreateProjectTemplateDTO,
+    { roles, environments, type, ...params },
-    actor: OrgServiceActor
+    actor
   ) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
@@ -195,10 +197,10 @@ export const projectTemplateServiceFactory = ({
     return $unpackProjectTemplate(projectTemplate);
   };
 
-  const updateProjectTemplateById = async (
+  const updateProjectTemplateById: TProjectTemplateServiceFactory["updateProjectTemplateById"] = async (
-    id: string,
+    id,
-    { roles, environments, ...params }: TUpdateProjectTemplateDTO,
+    { roles, environments, ...params },
-    actor: OrgServiceActor
+    actor
   ) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
@@ -259,7 +261,7 @@ export const projectTemplateServiceFactory = ({
     return $unpackProjectTemplate(updatedProjectTemplate);
   };
 
-  const deleteProjectTemplateById = async (id: string, actor: OrgServiceActor) => {
+  const deleteProjectTemplateById: TProjectTemplateServiceFactory["deleteProjectTemplateById"] = async (id, actor) => {
     const plan = await licenseService.getPlan(actor.orgId);
 
     if (!plan.projectTemplates)

backend/src/ee/services/project-template/project-template-types.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 
-import { ProjectType, TProjectEnvironments } from "@app/db/schemas";
+import { ProjectMembershipRole, ProjectType, TProjectEnvironments } from "@app/db/schemas";
 import { TProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
+import { OrgServiceActor } from "@app/lib/types";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 
 export type TProjectTemplateEnvironment = Pick<TProjectEnvironments, "name" | "slug" | "position">;
@@ -27,3 +28,177 @@ export type TUnpackedPermission = z.infer<typeof UnpackedPermissionSchema>;
 export enum InfisicalProjectTemplate {
   Default = "default"
 }
+
+export type TProjectTemplateServiceFactory = {
+  listProjectTemplatesByOrg: (
+    actor: OrgServiceActor,
+    type?: ProjectType
+  ) => Promise<
+    (
+      | {
+          id: string;
+          type: ProjectType;
+          name: InfisicalProjectTemplate;
+          createdAt: Date;
+          updatedAt: Date;
+          description: string;
+          environments:
+            | {
+                name: string;
+                slug: string;
+                position: number;
+              }[]
+            | null;
+          roles: {
+            name: string;
+            slug: ProjectMembershipRole;
+            permissions: {
+              action: string[];
+              subject?: string | undefined;
+              conditions?: unknown;
+              inverted?: boolean | undefined;
+            }[];
+          }[];
+          orgId: string;
+        }
+      | {
+          environments: TProjectTemplateEnvironment[];
+          roles: {
+            permissions: {
+              action: string[];
+              subject?: string | undefined;
+              conditions?: unknown;
+              inverted?: boolean | undefined;
+            }[];
+            slug: string;
+            name: string;
+          }[];
+          name: string;
+          type: string;
+          orgId: string;
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          description?: string | null | undefined;
+        }
+    )[]
+  >;
+  createProjectTemplate: (
+    arg: TCreateProjectTemplateDTO,
+    actor: OrgServiceActor
+  ) => Promise<{
+    environments: TProjectTemplateEnvironment[];
+    roles: {
+      permissions: {
+        action: string[];
+        subject?: string | undefined;
+        conditions?: unknown;
+        inverted?: boolean | undefined;
+      }[];
+      slug: string;
+      name: string;
+    }[];
+    name: string;
+    type: string;
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description?: string | null | undefined;
+  }>;
+  updateProjectTemplateById: (
+    id: string,
+    { roles, environments, ...params }: TUpdateProjectTemplateDTO,
+    actor: OrgServiceActor
+  ) => Promise<{
+    environments: TProjectTemplateEnvironment[];
+    roles: {
+      permissions: {
+        action: string[];
+        subject?: string | undefined;
+        conditions?: unknown;
+        inverted?: boolean | undefined;
+      }[];
+      slug: string;
+      name: string;
+    }[];
+    name: string;
+    type: string;
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description?: string | null | undefined;
+  }>;
+  deleteProjectTemplateById: (
+    id: string,
+    actor: OrgServiceActor
+  ) => Promise<{
+    environments: TProjectTemplateEnvironment[];
+    roles: {
+      permissions: {
+        action: string[];
+        subject?: string | undefined;
+        conditions?: unknown;
+        inverted?: boolean | undefined;
+      }[];
+      slug: string;
+      name: string;
+    }[];
+    name: string;
+    type: string;
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description?: string | null | undefined;
+  }>;
+  findProjectTemplateById: (
+    id: string,
+    actor: OrgServiceActor
+  ) => Promise<{
+    packedRoles: TProjectTemplateRole[];
+    environments: TProjectTemplateEnvironment[];
+    roles: {
+      permissions: {
+        action: string[];
+        subject?: string | undefined;
+        conditions?: unknown;
+        inverted?: boolean | undefined;
+      }[];
+      slug: string;
+      name: string;
+    }[];
+    name: string;
+    type: string;
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description?: string | null | undefined;
+  }>;
+  findProjectTemplateByName: (
+    name: string,
+    actor: OrgServiceActor
+  ) => Promise<{
+    packedRoles: TProjectTemplateRole[];
+    environments: TProjectTemplateEnvironment[];
+    roles: {
+      permissions: {
+        action: string[];
+        subject?: string | undefined;
+        conditions?: unknown;
+        inverted?: boolean | undefined;
+      }[];
+      slug: string;
+      name: string;
+    }[];
+    name: string;
+    type: string;
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description?: string | null | undefined;
+  }>;
+};

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TProjectUserAdditionalPrivilegeDALFactory = ReturnType<typeof projectUserAdditionalPrivilegeDALFactory>;
+export type TProjectUserAdditionalPrivilegeDALFactory = TOrmify<TableName.ProjectUserAdditionalPrivilege>;
 
-export const projectUserAdditionalPrivilegeDALFactory = (db: TDbClient) => {
+export const projectUserAdditionalPrivilegeDALFactory = (db: TDbClient): TProjectUserAdditionalPrivilegeDALFactory => {
   const orm = ormify(db, TableName.ProjectUserAdditionalPrivilege);
   return orm;
 };

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -11,7 +11,7 @@ import { TProjectMembershipDALFactory } from "@app/services/project-membership/p
 
 import { TAccessApprovalRequestDALFactory } from "../access-approval-request/access-approval-request-dal";
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
   ProjectPermissionMemberActions,
   ProjectPermissionSet,
@@ -21,11 +21,7 @@ import { ApprovalStatus } from "../secret-approval-request/secret-approval-reque
 import { TProjectUserAdditionalPrivilegeDALFactory } from "./project-user-additional-privilege-dal";
 import {
   ProjectUserAdditionalPrivilegeTemporaryMode,
-  TCreateUserPrivilegeDTO,
+  TProjectUserAdditionalPrivilegeServiceFactory
-  TDeleteUserPrivilegeDTO,
-  TGetUserPrivilegeDetailsDTO,
-  TListUserPrivilegesDTO,
-  TUpdateUserPrivilegeDTO
 } from "./project-user-additional-privilege-types";
 
 type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
@@ -35,10 +31,6 @@ type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
   accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
 };
 
-export type TProjectUserAdditionalPrivilegeServiceFactory = ReturnType<
-  typeof projectUserAdditionalPrivilegeServiceFactory
->;
-
 const unpackPermissions = (permissions: unknown) =>
   UnpackedPermissionSchema.array().parse(
     unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
@@ -49,8 +41,8 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
   projectMembershipDAL,
   permissionService,
   accessApprovalRequestDAL
-}: TProjectUserAdditionalPrivilegeServiceFactoryDep) => {
+}: TProjectUserAdditionalPrivilegeServiceFactoryDep): TProjectUserAdditionalPrivilegeServiceFactory => {
-  const create = async ({
+  const create: TProjectUserAdditionalPrivilegeServiceFactory["create"] = async ({
     slug,
     actor,
     actorId,
@@ -59,7 +51,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     actorAuthMethod,
     projectMembershipId,
     ...dto
-  }: TCreateUserPrivilegeDTO) => {
+  }) => {
     const projectMembership = await projectMembershipDAL.findById(projectMembershipId);
     if (!projectMembership)
       throw new NotFoundError({ message: `Project membership with ID ${projectMembershipId} found` });
@@ -147,14 +139,14 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     };
   };
 
-  const updateById = async ({
+  const updateById: TProjectUserAdditionalPrivilegeServiceFactory["updateById"] = async ({
     privilegeId,
     actorOrgId,
     actor,
     actorId,
     actorAuthMethod,
     ...dto
-  }: TUpdateUserPrivilegeDTO) => {
+  }) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege)
       throw new NotFoundError({ message: `User additional privilege with ID ${privilegeId} not found` });
@@ -259,7 +251,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     };
   };
 
-  const deleteById = async ({ actorId, actor, actorOrgId, actorAuthMethod, privilegeId }: TDeleteUserPrivilegeDTO) => {
+  const deleteById: TProjectUserAdditionalPrivilegeServiceFactory["deleteById"] = async ({
+    actorId,
+    actor,
+    actorOrgId,
+    actorAuthMethod,
+    privilegeId
+  }) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege)
       throw new NotFoundError({ message: `User additional privilege with ID ${privilegeId} not found` });
@@ -299,13 +297,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     };
   };
 
-  const getPrivilegeDetailsById = async ({
+  const getPrivilegeDetailsById: TProjectUserAdditionalPrivilegeServiceFactory["getPrivilegeDetailsById"] = async ({
     privilegeId,
     actorOrgId,
     actor,
     actorId,
     actorAuthMethod
-  }: TGetUserPrivilegeDetailsDTO) => {
+  }) => {
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege)
       throw new NotFoundError({ message: `User additional privilege with ID  ${privilegeId} not found` });
@@ -335,13 +333,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     };
   };
 
-  const listPrivileges = async ({
+  const listPrivileges: TProjectUserAdditionalPrivilegeServiceFactory["listPrivileges"] = async ({
     projectMembershipId,
     actorOrgId,
     actor,
     actorId,
     actorAuthMethod
-  }: TListUserPrivilegesDTO) => {
+  }) => {
     const projectMembership = await projectMembershipDAL.findById(projectMembershipId);
     if (!projectMembership)
       throw new NotFoundError({ message: `Project membership with ID ${projectMembershipId} not found` });

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-types.ts

@@ -1,3 +1,4 @@
+import { TProjectUserAdditionalPrivilege } from "@app/db/schemas";
 import { TProjectPermission } from "@app/lib/types";
 
 import { TProjectPermissionV2Schema } from "../permission/project-permission";
@@ -40,3 +41,20 @@ export type TDeleteUserPrivilegeDTO = Omit<TProjectPermission, "projectId"> & {
 export type TGetUserPrivilegeDetailsDTO = Omit<TProjectPermission, "projectId"> & { privilegeId: string };
 
 export type TListUserPrivilegesDTO = Omit<TProjectPermission, "projectId"> & { projectMembershipId: string };
+
+interface TAdditionalPrivilege extends TProjectUserAdditionalPrivilege {
+  permissions: {
+    action: string[];
+    subject?: string | undefined;
+    conditions?: unknown;
+    inverted?: boolean | undefined;
+  }[];
+}
+
+export type TProjectUserAdditionalPrivilegeServiceFactory = {
+  create: (arg: TCreateUserPrivilegeDTO) => Promise<TAdditionalPrivilege>;
+  updateById: (arg: TUpdateUserPrivilegeDTO) => Promise<TAdditionalPrivilege>;
+  deleteById: (arg: TDeleteUserPrivilegeDTO) => Promise<TAdditionalPrivilege>;
+  getPrivilegeDetailsById: (arg: TGetUserPrivilegeDetailsDTO) => Promise<TAdditionalPrivilege>;
+  listPrivileges: (arg: TListUserPrivilegesDTO) => Promise<TProjectUserAdditionalPrivilege[]>;
+};

backend/src/ee/services/rate-limit/rate-limit-dal.ts

@@ -1,7 +1,7 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TRateLimitDALFactory = ReturnType<typeof rateLimitDALFactory>;
+export type TRateLimitDALFactory = TOrmify<TableName.RateLimit>;
 
-export const rateLimitDALFactory = (db: TDbClient) => ormify(db, TableName.RateLimit, {});
+export const rateLimitDALFactory = (db: TDbClient): TRateLimitDALFactory => ormify(db, TableName.RateLimit, {});

backend/src/ee/services/rate-limit/rate-limit-service.ts

@@ -4,7 +4,7 @@ import { logger } from "@app/lib/logger";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TRateLimitDALFactory } from "./rate-limit-dal";
-import { RateLimitConfiguration, TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types";
+import { RateLimitConfiguration, TRateLimit, TRateLimitServiceFactory } from "./rate-limit-types";
 
 let rateLimitMaxConfiguration: RateLimitConfiguration = {
   readLimit: 60,
@@ -27,12 +27,13 @@ type TRateLimitServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "onPremFeatures">;
 };
 
-export type TRateLimitServiceFactory = ReturnType<typeof rateLimitServiceFactory>;
+export const rateLimitServiceFactory = ({
-
+  rateLimitDAL,
-export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateLimitServiceFactoryDep) => {
+  licenseService
+}: TRateLimitServiceFactoryDep): TRateLimitServiceFactory => {
   const DEFAULT_RATE_LIMIT_CONFIG_ID = "00000000-0000-0000-0000-000000000000";
 
-  const getRateLimits = async (): Promise<TRateLimit | undefined> => {
+  const getRateLimits: TRateLimitServiceFactory["getRateLimits"] = async () => {
     let rateLimit: TRateLimit;
 
     try {
@@ -51,11 +52,11 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL
     }
   };
 
-  const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise<TRateLimit> => {
+  const updateRateLimit: TRateLimitServiceFactory["updateRateLimit"] = async (updates) => {
     return rateLimitDAL.updateById(DEFAULT_RATE_LIMIT_CONFIG_ID, updates);
   };
 
-  const syncRateLimitConfiguration = async () => {
+  const syncRateLimitConfiguration: TRateLimitServiceFactory["syncRateLimitConfiguration"] = async () => {
     try {
       const rateLimit = await getRateLimits();
       if (rateLimit) {
@@ -78,7 +79,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL
     }
   };
 
-  const initializeBackgroundSync = async () => {
+  const initializeBackgroundSync: TRateLimitServiceFactory["initializeBackgroundSync"] = async () => {
     if (!licenseService.onPremFeatures.customRateLimits) {
       logger.info("Current license does not support custom rate limit configuration");
       return;

backend/src/ee/services/rate-limit/rate-limit-types.ts

@@ -1,3 +1,5 @@
+import { CronJob } from "cron";
+
 export type TRateLimitUpdateDTO = {
   readRateLimit: number;
   writeRateLimit: number;
@@ -23,3 +25,10 @@ export type RateLimitConfiguration = {
   inviteUserRateLimit: number;
   mfaRateLimit: number;
 };
+
+export type TRateLimitServiceFactory = {
+  getRateLimits: () => Promise<TRateLimit | undefined>;
+  updateRateLimit: (updates: TRateLimitUpdateDTO) => Promise<TRateLimit>;
+  initializeBackgroundSync: () => Promise<CronJob<null, null> | undefined>;
+  syncRateLimitConfiguration: () => Promise<void>;
+};

backend/src/ee/services/saml-config/saml-config-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TSamlConfigDALFactory = ReturnType<typeof samlConfigDALFactory>;
+export type TSamlConfigDALFactory = TOrmify<TableName.SamlConfig>;
 
-export const samlConfigDALFactory = (db: TDbClient) => {
+export const samlConfigDALFactory = (db: TDbClient): TSamlConfigDALFactory => {
   const samlCfgOrm = ormify(db, TableName.SamlConfig);
 
   return samlCfgOrm;

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -23,9 +23,9 @@ import { UserAliasType } from "@app/services/user-alias/user-alias-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TSamlConfigDALFactory } from "./saml-config-dal";
-import { TCreateSamlCfgDTO, TGetSamlCfgDTO, TSamlLoginDTO, TUpdateSamlCfgDTO } from "./saml-config-types";
+import { TSamlConfigServiceFactory } from "./saml-config-types";
 
 type TSamlConfigServiceFactoryDep = {
   samlConfigDAL: Pick<TSamlConfigDALFactory, "create" | "findOne" | "update" | "findById">;
@@ -47,8 +47,6 @@ type TSamlConfigServiceFactoryDep = {
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
-export type TSamlConfigServiceFactory = ReturnType<typeof samlConfigServiceFactory>;
-
 export const samlConfigServiceFactory = ({
   samlConfigDAL,
   orgDAL,
@@ -61,8 +59,8 @@ export const samlConfigServiceFactory = ({
   smtpService,
   identityMetadataDAL,
   kmsService
-}: TSamlConfigServiceFactoryDep) => {
+}: TSamlConfigServiceFactoryDep): TSamlConfigServiceFactory => {
-  const createSamlCfg = async ({
+  const createSamlCfg: TSamlConfigServiceFactory["createSamlCfg"] = async ({
     idpCert,
     actor,
     actorAuthMethod,
@@ -73,7 +71,7 @@ export const samlConfigServiceFactory = ({
     isActive,
     entryPoint,
     authProvider
-  }: TCreateSamlCfgDTO) => {
+  }) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);
 
@@ -101,7 +99,7 @@ export const samlConfigServiceFactory = ({
     return samlConfig;
   };
 
-  const updateSamlCfg = async ({
+  const updateSamlCfg: TSamlConfigServiceFactory["updateSamlCfg"] = async ({
     orgId,
     actor,
     actorOrgId,
@@ -112,7 +110,7 @@ export const samlConfigServiceFactory = ({
     isActive,
     entryPoint,
     authProvider
-  }: TUpdateSamlCfgDTO) => {
+  }) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
     const plan = await licenseService.getPlan(orgId);
@@ -146,7 +144,7 @@ export const samlConfigServiceFactory = ({
     return ssoConfig;
   };
 
-  const getSaml = async (dto: TGetSamlCfgDTO) => {
+  const getSaml: TSamlConfigServiceFactory["getSaml"] = async (dto) => {
     let samlConfig: TSamlConfigs | undefined;
     if (dto.type === "org") {
       samlConfig = await samlConfigDAL.findOne({ orgId: dto.orgId });
@@ -221,7 +219,7 @@ export const samlConfigServiceFactory = ({
     };
   };
 
-  const samlLogin = async ({
+  const samlLogin: TSamlConfigServiceFactory["samlLogin"] = async ({
     externalId,
     email,
     firstName,
@@ -230,7 +228,7 @@ export const samlConfigServiceFactory = ({
     orgId,
     relayState,
     metadata
-  }: TSamlLoginDTO) => {
+  }) => {
     const appCfg = getConfig();
     const serverCfg = await getServerCfg();
 

backend/src/ee/services/saml-config/saml-config-types.ts

@@ -1,3 +1,4 @@
+import { TSamlConfigs } from "@app/db/schemas";
 import { TOrgPermission } from "@app/lib/types";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 
@@ -56,3 +57,26 @@ export type TSamlLoginDTO = {
   relayState?: string;
   metadata?: { key: string; value: string }[];
 };
+
+export type TSamlConfigServiceFactory = {
+  createSamlCfg: (arg: TCreateSamlCfgDTO) => Promise<TSamlConfigs>;
+  updateSamlCfg: (arg: TUpdateSamlCfgDTO) => Promise<TSamlConfigs>;
+  getSaml: (arg: TGetSamlCfgDTO) => Promise<
+    | {
+        id: string;
+        organization: string;
+        orgId: string;
+        authProvider: string;
+        isActive: boolean;
+        entryPoint: string;
+        issuer: string;
+        cert: string;
+        lastUsed: Date | null | undefined;
+      }
+    | undefined
+  >;
+  samlLogin: (arg: TSamlLoginDTO) => Promise<{
+    isUserCompleted: boolean;
+    providerAuthToken: string;
+  }>;
+};

backend/src/ee/services/scim/scim-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TScimDALFactory = ReturnType<typeof scimDALFactory>;
+export type TScimDALFactory = TOrmify<TableName.ScimToken>;
 
-export const scimDALFactory = (db: TDbClient) => {
+export const scimDALFactory = (db: TDbClient): TScimDALFactory => {
   const scimTokenOrm = ormify(db, TableName.ScimToken);
   return scimTokenOrm;
 };

backend/src/ee/services/scim/scim-service.ts

@@ -11,7 +11,6 @@ import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { TOrgPermission } from "@app/lib/types";
 import { AuthTokenType } from "@app/services/auth/auth-type";
 import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
@@ -33,28 +32,10 @@ import { UserAliasType } from "@app/services/user-alias/user-alias-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { buildScimGroup, buildScimGroupList, buildScimUser, buildScimUserList, parseScimFilter } from "./scim-fns";
-import {
+import { TScimGroup, TScimServiceFactory } from "./scim-types";
-  TCreateScimGroupDTO,
-  TCreateScimTokenDTO,
-  TCreateScimUserDTO,
-  TDeleteScimGroupDTO,
-  TDeleteScimTokenDTO,
-  TDeleteScimUserDTO,
-  TGetScimGroupDTO,
-  TGetScimUserDTO,
-  TListScimGroupsDTO,
-  TListScimUsers,
-  TListScimUsersDTO,
-  TReplaceScimUserDTO,
-  TScimGroup,
-  TScimTokenJwtPayload,
-  TUpdateScimGroupNamePatchDTO,
-  TUpdateScimGroupNamePutDTO,
-  TUpdateScimUserDTO
-} from "./scim-types";
 
 type TScimServiceFactoryDep = {
   scimDAL: Pick<TScimDALFactory, "create" | "find" | "findById" | "deleteById">;
@@ -111,8 +92,6 @@ type TScimServiceFactoryDep = {
   externalGroupOrgRoleMappingDAL: TExternalGroupOrgRoleMappingDALFactory;
 };
 
-export type TScimServiceFactory = ReturnType<typeof scimServiceFactory>;
-
 export const scimServiceFactory = ({
   licenseService,
   scimDAL,
@@ -131,8 +110,8 @@ export const scimServiceFactory = ({
   projectUserAdditionalPrivilegeDAL,
   smtpService,
   externalGroupOrgRoleMappingDAL
-}: TScimServiceFactoryDep) => {
+}: TScimServiceFactoryDep): TScimServiceFactory => {
-  const createScimToken = async ({
+  const createScimToken: TScimServiceFactory["createScimToken"] = async ({
     actor,
     actorId,
     actorOrgId,
@@ -140,7 +119,7 @@ export const scimServiceFactory = ({
     orgId,
     description,
     ttlDays
-  }: TCreateScimTokenDTO) => {
+  }) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Scim);
 
@@ -169,7 +148,13 @@ export const scimServiceFactory = ({
     return { scimToken };
   };
 
-  const listScimTokens = async ({ actor, actorId, actorOrgId, actorAuthMethod, orgId }: TOrgPermission) => {
+  const listScimTokens: TScimServiceFactory["listScimTokens"] = async ({
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    orgId
+  }) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Scim);
 
@@ -183,7 +168,13 @@ export const scimServiceFactory = ({
     return scimTokens;
   };
 
-  const deleteScimToken = async ({ scimTokenId, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteScimTokenDTO) => {
+  const deleteScimToken: TScimServiceFactory["deleteScimToken"] = async ({
+    scimTokenId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId
+  }) => {
     let scimToken = await scimDAL.findById(scimTokenId);
     if (!scimToken) throw new NotFoundError({ message: `SCIM token with ID '${scimTokenId}' not found` });
 
@@ -208,12 +199,12 @@ export const scimServiceFactory = ({
   };
 
   // SCIM server endpoints
-  const listScimUsers = async ({
+  const listScimUsers: TScimServiceFactory["listScimUsers"] = async ({
     startIndex = 0,
     limit = 100,
     filter,
     orgId
-  }: TListScimUsersDTO): Promise<TListScimUsers> => {
+  }) => {
     const org = await orgDAL.findById(orgId);
 
     if (!org.scimEnabled)
@@ -250,7 +241,7 @@ export const scimServiceFactory = ({
     });
   };
 
-  const getScimUser = async ({ orgMembershipId, orgId }: TGetScimUserDTO) => {
+  const getScimUser: TScimServiceFactory["getScimUser"] = async ({ orgMembershipId, orgId }) => {
     const [membership] = await orgDAL
       .findMembership({
         [`${TableName.OrgMembership}.id` as "id"]: orgMembershipId,
@@ -287,7 +278,13 @@ export const scimServiceFactory = ({
     });
   };
 
-  const createScimUser = async ({ externalId, email, firstName, lastName, orgId }: TCreateScimUserDTO) => {
+  const createScimUser: TScimServiceFactory["createScimUser"] = async ({
+    externalId,
+    email,
+    firstName,
+    lastName,
+    orgId
+  }) => {
     if (!email) throw new ScimRequestError({ detail: "Invalid request. Missing email.", status: 400 });
 
     const org = await orgDAL.findOrgById(orgId);
@@ -467,7 +464,7 @@ export const scimServiceFactory = ({
   };
 
   // partial
-  const updateScimUser = async ({ orgMembershipId, orgId, operations }: TUpdateScimUserDTO) => {
+  const updateScimUser: TScimServiceFactory["updateScimUser"] = async ({ orgMembershipId, orgId, operations }) => {
     const org = await orgDAL.findOrgById(orgId);
     if (!org.orgAuthMethod) {
       throw new ScimRequestError({
@@ -540,7 +537,7 @@ export const scimServiceFactory = ({
     return scimUser;
   };
 
-  const replaceScimUser = async ({
+  const replaceScimUser: TScimServiceFactory["replaceScimUser"] = async ({
     orgMembershipId,
     active,
     orgId,
@@ -548,7 +545,7 @@ export const scimServiceFactory = ({
     firstName,
     email,
     externalId
-  }: TReplaceScimUserDTO) => {
+  }) => {
     const org = await orgDAL.findOrgById(orgId);
     if (!org.orgAuthMethod) {
       throw new ScimRequestError({
@@ -627,7 +624,7 @@ export const scimServiceFactory = ({
     });
   };
 
-  const deleteScimUser = async ({ orgMembershipId, orgId }: TDeleteScimUserDTO) => {
+  const deleteScimUser: TScimServiceFactory["deleteScimUser"] = async ({ orgMembershipId, orgId }) => {
     const [membership] = await orgDAL.findMembership({
       [`${TableName.OrgMembership}.id` as "id"]: orgMembershipId,
       [`${TableName.OrgMembership}.orgId` as "orgId"]: orgId
@@ -660,7 +657,13 @@ export const scimServiceFactory = ({
     return {}; // intentionally return empty object upon success
   };
 
-  const listScimGroups = async ({ orgId, startIndex, limit, filter, isMembersExcluded }: TListScimGroupsDTO) => {
+  const listScimGroups: TScimServiceFactory["listScimGroups"] = async ({
+    orgId,
+    startIndex,
+    limit,
+    filter,
+    isMembersExcluded
+  }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -768,7 +771,7 @@ export const scimServiceFactory = ({
     );
   };
 
-  const createScimGroup = async ({ displayName, orgId, members }: TCreateScimGroupDTO) => {
+  const createScimGroup: TScimServiceFactory["createScimGroup"] = async ({ displayName, orgId, members }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -863,7 +866,7 @@ export const scimServiceFactory = ({
     });
   };
 
-  const getScimGroup = async ({ groupId, orgId }: TGetScimGroupDTO) => {
+  const getScimGroup: TScimServiceFactory["getScimGroup"] = async ({ groupId, orgId }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -1011,7 +1014,12 @@ export const scimServiceFactory = ({
     return updatedGroup;
   };
 
-  const replaceScimGroup = async ({ groupId, orgId, displayName, members }: TUpdateScimGroupNamePutDTO) => {
+  const replaceScimGroup: TScimServiceFactory["replaceScimGroup"] = async ({
+    groupId,
+    orgId,
+    displayName,
+    members
+  }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -1043,7 +1051,7 @@ export const scimServiceFactory = ({
     });
   };
 
-  const updateScimGroup = async ({ groupId, orgId, operations }: TUpdateScimGroupNamePatchDTO) => {
+  const updateScimGroup: TScimServiceFactory["updateScimGroup"] = async ({ groupId, orgId, operations }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -1101,7 +1109,7 @@ export const scimServiceFactory = ({
     };
   };
 
-  const deleteScimGroup = async ({ groupId, orgId }: TDeleteScimGroupDTO) => {
+  const deleteScimGroup: TScimServiceFactory["deleteScimGroup"] = async ({ groupId, orgId }) => {
     const plan = await licenseService.getPlan(orgId);
     if (!plan.groups)
       throw new BadRequestError({
@@ -1137,7 +1145,7 @@ export const scimServiceFactory = ({
     return {}; // intentionally return empty object upon success
   };
 
-  const fnValidateScimToken = async (token: TScimTokenJwtPayload) => {
+  const fnValidateScimToken: TScimServiceFactory["fnValidateScimToken"] = async (token) => {
     const scimToken = await scimDAL.findById(token.scimTokenId);
     if (!scimToken) throw new UnauthorizedError();
 

backend/src/ee/services/scim/scim-types.ts

@@ -1,5 +1,6 @@
 import { ScimPatchOperation } from "scim-patch";
 
+import { TScimTokens } from "@app/db/schemas";
 import { TOrgPermission } from "@app/lib/types";
 
 export type TCreateScimTokenDTO = {
@@ -156,3 +157,47 @@ export type TScimGroup = {
     lastModified: Date;
   };
 };
+
+export type TScimServiceFactory = {
+  createScimToken: (arg: TCreateScimTokenDTO) => Promise<{
+    scimToken: string;
+  }>;
+  listScimTokens: (arg: TOrgPermission) => Promise<TScimTokens[]>;
+  deleteScimToken: (arg: TDeleteScimTokenDTO) => Promise<{
+    orgId: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    description: string;
+    ttlDays: number;
+  }>;
+  listScimUsers: (arg: TListScimUsersDTO) => Promise<TListScimUsers>;
+  getScimUser: (arg: TGetScimUserDTO) => Promise<TScimUser>;
+  createScimUser: (arg: TCreateScimUserDTO) => Promise<TScimUser>;
+  updateScimUser: (arg: TUpdateScimUserDTO) => Promise<TScimUser>;
+  replaceScimUser: (arg: TReplaceScimUserDTO) => Promise<TScimUser>;
+  deleteScimUser: (arg: TDeleteScimUserDTO) => Promise<object>;
+  listScimGroups: (arg: TListScimGroupsDTO) => Promise<TListScimGroups>;
+  createScimGroup: (arg: TCreateScimGroupDTO) => Promise<TScimGroup>;
+  getScimGroup: (arg: TGetScimGroupDTO) => Promise<TScimGroup>;
+  deleteScimGroup: (arg: TDeleteScimGroupDTO) => Promise<object>;
+  replaceScimGroup: (arg: TUpdateScimGroupNamePutDTO) => Promise<TScimGroup>;
+  updateScimGroup: (arg: TUpdateScimGroupNamePatchDTO) => Promise<{
+    members: {
+      value: string;
+      display: string;
+    }[];
+    schemas: string[];
+    id: string;
+    displayName: string;
+    meta: {
+      resourceType: string;
+      created: Date;
+      lastModified: Date;
+    };
+  }>;
+  fnValidateScimToken: (token: TScimTokenJwtPayload) => Promise<{
+    scimTokenId: string;
+    orgId: string;
+  }>;
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 import picomatch from "picomatch";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -63,7 +63,7 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { throwIfMissingSecretReadValueOrDescribePermission } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { ProjectPermissionSecretActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TSecretApprovalPolicyDALFactory } from "../secret-approval-policy/secret-approval-policy-dal";
 import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts

@@ -3,11 +3,10 @@ import { Knex } from "knex";
 import isEqual from "lodash.isequal";
 
 import { ActionProjectType, SecretType, TableName } from "@app/db/schemas";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-types";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { hasSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionSecretActions,
   ProjectPermissionSecretRotationActions,

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -14,7 +14,7 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold
 import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
   ProjectPermissionSecretActions,
   ProjectPermissionSecretRotationActions,

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-queue.ts

@@ -1,8 +1,7 @@
 import { join } from "path";
 
 import { ProjectMembershipRole, TSecretScanningFindings } from "@app/db/schemas";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-types";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import {
   createTempFolder,
   deleteTempFolder,

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-service.ts

@@ -3,7 +3,7 @@ import { join } from "path";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionSecretScanningConfigActions,
   ProjectPermissionSecretScanningDataSourceActions,

backend/src/ee/services/secret-scanning/secret-scanning-service.ts

@@ -5,7 +5,7 @@ import { WebhookEventMap } from "@octokit/webhooks-types";
 import { ProbotOctokit } from "probot";
 
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { NotFoundError } from "@app/lib/errors";
 

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -28,7 +28,7 @@ import {
   hasSecretReadValueOrDescribePermission,
   throwIfMissingSecretReadValueOrDescribePermission
 } from "../permission/permission-fns";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
   ProjectPermissionActions,
   ProjectPermissionSecretActions,

backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";

backend/src/ee/services/ssh-host-group/ssh-host-group-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSshHostDALFactory } from "@app/ee/services/ssh-host/ssh-host-dal";
 import { TSshHostLoginUserMappingDALFactory } from "@app/ee/services/ssh-host/ssh-host-login-user-mapping-dal";

backend/src/ee/services/ssh-host/ssh-host-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, ProjectType } from "@app/db/schemas";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionSshHostActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
 import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal";

backend/src/ee/services/ssh-host/ssh-host-types.ts

@@ -1,6 +1,6 @@
 import { Knex } from "knex";
 
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { TSshHostLoginUserMappingDALFactory } from "@app/ee/services/ssh-host/ssh-host-login-user-mapping-dal";
 import { TSshHostLoginUserDALFactory } from "@app/ee/services/ssh-host/ssh-login-user-dal";
 import { TProjectPermission } from "@app/lib/types";

backend/src/ee/services/ssh/ssh-certificate-authority-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
 import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal";

backend/src/ee/services/trusted-ip/trusted-ip-dal.ts

@@ -1,10 +1,10 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
+import { ormify, TOrmify } from "@app/lib/knex";
 
-export type TTrustedIpDALFactory = ReturnType<typeof trustedIpDALFactory>;
+export type TTrustedIpDALFactory = TOrmify<TableName.TrustedIps>;
 
-export const trustedIpDALFactory = (db: TDbClient) => {
+export const trustedIpDALFactory = (db: TDbClient): TTrustedIpDALFactory => {
   const trustedIpOrm = ormify(db, TableName.TrustedIps);
   return trustedIpOrm;
 };

backend/src/ee/services/trusted-ip/trusted-ip-service.ts

@@ -3,14 +3,13 @@ import { ForbiddenError } from "@casl/ability";
 import { ActionProjectType } from "@app/db/schemas";
 import { BadRequestError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
-import { TProjectPermission } from "@app/lib/types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
-import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TTrustedIpDALFactory } from "./trusted-ip-dal";
-import { TCreateIpDTO, TDeleteIpDTO, TUpdateIpDTO } from "./trusted-ip-types";
+import { TTrustedIpServiceFactory } from "./trusted-ip-types";
 
 type TTrustedIpServiceFactoryDep = {
   trustedIpDAL: TTrustedIpDALFactory;
@@ -19,15 +18,19 @@ type TTrustedIpServiceFactoryDep = {
   projectDAL: Pick<TProjectDALFactory, "findById">;
 };
 
-export type TTrustedIpServiceFactory = ReturnType<typeof trustedIpServiceFactory>;
-
 export const trustedIpServiceFactory = ({
   trustedIpDAL,
   permissionService,
   licenseService,
   projectDAL
-}: TTrustedIpServiceFactoryDep) => {
+}: TTrustedIpServiceFactoryDep): TTrustedIpServiceFactory => {
-  const listIpsByProjectId = async ({ projectId, actor, actorId, actorAuthMethod, actorOrgId }: TProjectPermission) => {
+  const listIpsByProjectId: TTrustedIpServiceFactory["listIpsByProjectId"] = async ({
+    projectId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId
+  }) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -43,7 +46,7 @@ export const trustedIpServiceFactory = ({
     return trustedIps;
   };
 
-  const addProjectIp = async ({
+  const addProjectIp: TTrustedIpServiceFactory["addProjectIp"] = async ({
     projectId,
     actorId,
     actorAuthMethod,
@@ -52,7 +55,7 @@ export const trustedIpServiceFactory = ({
     ipAddress: ip,
     comment,
     isActive
-  }: TCreateIpDTO) => {
+  }) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -89,7 +92,7 @@ export const trustedIpServiceFactory = ({
     return { trustedIp, project }; // for audit log
   };
 
-  const updateProjectIp = async ({
+  const updateProjectIp: TTrustedIpServiceFactory["updateProjectIp"] = async ({
     projectId,
     actorId,
     actor,
@@ -98,7 +101,7 @@ export const trustedIpServiceFactory = ({
     ipAddress: ip,
     comment,
     trustedIpId
-  }: TUpdateIpDTO) => {
+  }) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -137,14 +140,14 @@ export const trustedIpServiceFactory = ({
     return { trustedIp, project }; // for audit log
   };
 
-  const deleteProjectIp = async ({
+  const deleteProjectIp: TTrustedIpServiceFactory["deleteProjectIp"] = async ({
     projectId,
     actorId,
     actor,
     actorOrgId,
     actorAuthMethod,
     trustedIpId
-  }: TDeleteIpDTO) => {
+  }) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,

backend/src/ee/services/trusted-ip/trusted-ip-types.ts

@@ -1,3 +1,4 @@
+import { TProjects, TTrustedIps } from "@app/db/schemas";
 import { TProjectPermission } from "@app/lib/types";
 
 export type TCreateIpDTO = TProjectPermission & {
@@ -15,3 +16,19 @@ export type TUpdateIpDTO = TProjectPermission & {
 export type TDeleteIpDTO = TProjectPermission & {
   trustedIpId: string;
 };
+
+export type TTrustedIpServiceFactory = {
+  listIpsByProjectId: (arg: TProjectPermission) => Promise<TTrustedIps[]>;
+  addProjectIp: (arg: TCreateIpDTO) => Promise<{
+    trustedIp: TTrustedIps;
+    project: TProjects;
+  }>;
+  updateProjectIp: (arg: TUpdateIpDTO) => Promise<{
+    trustedIp: TTrustedIps;
+    project: TProjects;
+  }>;
+  deleteProjectIp: (arg: TDeleteIpDTO) => Promise<{
+    trustedIp: TTrustedIps;
+    project: TProjects;
+  }>;
+};

backend/src/services/app-connection/app-connection-service.ts

@@ -5,7 +5,7 @@ import { ociConnectionService } from "@app/ee/services/app-connections/oci/oci-c
 import { ValidateOracleDBConnectionCredentialsSchema } from "@app/ee/services/app-connections/oracledb";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionAppConnectionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { generateHash } from "@app/lib/crypto/encryption";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";

backend/src/services/auth/auth-login-service.ts

@@ -3,8 +3,7 @@ import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
 import { OrgMembershipRole, OrgMembershipStatus, TableName, TUsers, UserDeviceSchema } from "@app/db/schemas";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-types";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType, ProjectType, TableName } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -12,7 +12,7 @@ import {
   TCertificateAuthorities,
   TCertificateTemplates
 } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionActions,
   ProjectPermissionCertificateActions,

backend/src/services/certificate-template/certificate-template-service.ts

@@ -4,7 +4,7 @@ import bcrypt from "bcrypt";
 
 import { ActionProjectType, TCertificateTemplateEstConfigsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionPkiTemplateActions,
   ProjectPermissionSub

backend/src/services/certificate/certificate-service.ts

@@ -4,7 +4,7 @@ import { createPrivateKey, createPublicKey, sign, verify } from "crypto";
 
 import { ActionProjectType, ProjectType } from "@app/db/schemas";
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionCertificateActions,
   ProjectPermissionSub

backend/src/services/cmek/cmek-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType, ProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionCmekActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { SigningAlgorithm } from "@app/lib/crypto/sign";
 import { DatabaseErrorCode } from "@app/lib/error-codes";

backend/src/services/external-group-org-role-mapping/external-group-org-role-mapping-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { OrgServiceActor } from "@app/lib/types";
 import { constructGroupOrgMembershipRoleMappings } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-fns";
 import { TSyncExternalGroupOrgMembershipRoleMappingsDTO } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-types";

backend/src/services/external-migration/external-migration-service.ts

@@ -1,5 +1,5 @@
 import { OrgMembershipRole } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { ForbiddenRequestError } from "@app/lib/errors";
 

backend/src/services/folder-commit/folder-commit-service.ts

@@ -9,7 +9,7 @@ import {
   TSecretV2TagJunctionInsert,
   TSecretVersionsV2
 } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionCommitsActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";

backend/src/services/group-project/group-project-service.ts

@@ -6,7 +6,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionGroupActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";

backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts

@@ -10,7 +10,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -11,7 +11,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -8,7 +8,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -8,7 +8,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -10,7 +10,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import {
   BadRequestError,

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -17,7 +17,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { GatewayHttpProxyActions, GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";

backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts

@@ -10,7 +10,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -11,7 +11,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -11,7 +11,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import {
   BadRequestError,

backend/src/services/identity-project/identity-project-service.ts

@@ -5,7 +5,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -8,7 +8,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";

backend/src/services/identity-ua/identity-ua-service.ts

@@ -11,7 +11,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";

backend/src/services/identity/identity-service.ts

@@ -7,7 +7,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 

backend/src/services/integration-auth/integration-auth-service.ts

@@ -11,7 +11,7 @@ import {
   TIntegrationAuths,
   TIntegrationAuthsInsert
 } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";

backend/src/services/integration/integration-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { throwIfMissingSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionActions,
   ProjectPermissionSecretActions,

backend/src/services/microsoft-teams/microsoft-teams-service.ts

@@ -10,7 +10,7 @@ import { CronJob } from "cron";
 import { FastifyReply, FastifyRequest } from "fastify";
 
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 

backend/src/services/org-admin/org-admin-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 
 import { ProjectMembershipRole, ProjectVersion, SecretKeyEncoding } from "@app/db/schemas";
 import { OrgPermissionAdminConsoleAction, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 

backend/src/services/org/org-role-service.ts

@@ -9,7 +9,7 @@ import {
   OrgPermissionActions,
   OrgPermissionSubjects
 } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";

backend/src/services/org/org-service.ts

@@ -29,7 +29,7 @@ import {
   constructPermissionErrorMessage,
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { TSamlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-dal";

backend/src/services/pki-alert/pki-alert-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType, ProjectType } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";

backend/src/services/pki-collection/pki-collection-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType, ProjectType, TPkiCollectionItems } from "@app/db/schemas";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";

backend/src/services/pki-subscriber/pki-subscriber-queue.ts

@@ -1,5 +1,4 @@
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-types";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";