feat(rbac): added frontend permission validation for missing pages and merged new features

frontend/src/views/IntegrationsPage/IntegrationsPage.tsx

@@ -4,7 +4,8 @@ import { useRouter } from "next/router";
 
 import { useNotificationContext } from "@app/components/context/Notifications/NotificationProvider";
 import { Button, Modal, ModalContent } from "@app/components/v2";
-import { useWorkspace } from "@app/context";
+import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context";
+import { withProjectPermission } from "@app/hoc";
 import { usePopUp } from "@app/hooks";
 import {
   useDeleteIntegration,
@@ -31,191 +32,194 @@ type Props = {
   frameworkIntegrations: Array<{ name: string; slug: string; image: string; docsLink: string }>;
 };
 
-export const IntegrationsPage = ({ frameworkIntegrations }: Props) => {
-  const { t } = useTranslation();
-  const { createNotification } = useNotificationContext();
-  const router = useRouter();
+export const IntegrationsPage = withProjectPermission(
+  ({ frameworkIntegrations }: Props) => {
+    const { t } = useTranslation();
+    const { createNotification } = useNotificationContext();
+    const router = useRouter();
 
-  const { currentWorkspace } = useWorkspace();
-  const workspaceId = currentWorkspace?._id || "";
-  const environments = currentWorkspace?.environments || [];
+    const { currentWorkspace } = useWorkspace();
+    const workspaceId = currentWorkspace?._id || "";
+    const environments = currentWorkspace?.environments || [];
 
-  const { data: latestWsKey } = useGetUserWsKey(workspaceId);
+    const { data: latestWsKey } = useGetUserWsKey(workspaceId);
 
-  const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
-    "activeBot"
-  ] as const);
+    const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
+      "activeBot"
+    ] as const);
 
-  const { data: cloudIntegrations, isLoading: isCloudIntegrationsLoading } =
-    useGetCloudIntegrations();
+    const { data: cloudIntegrations, isLoading: isCloudIntegrationsLoading } =
+      useGetCloudIntegrations();
 
-  const { data: integrationAuths, isLoading: isIntegrationAuthLoading } =
-    useGetWorkspaceAuthorizations(
-      workspaceId,
-      useCallback((data: IntegrationAuth[]) => {
-        const groupBy: Record<string, IntegrationAuth> = {};
-        data.forEach((el) => {
-          groupBy[el.integration] = el;
-        });
-        return groupBy;
-      }, [])
-    );
-  // mutation
-  const {
-    data: integrations,
-    isLoading: isIntegrationLoading,
-    isFetching: isIntegrationFetching
-  } = useGetWorkspaceIntegrations(workspaceId);
+    const { data: integrationAuths, isLoading: isIntegrationAuthLoading } =
+      useGetWorkspaceAuthorizations(
+        workspaceId,
+        useCallback((data: IntegrationAuth[]) => {
+          const groupBy: Record<string, IntegrationAuth> = {};
+          data.forEach((el) => {
+            groupBy[el.integration] = el;
+          });
+          return groupBy;
+        }, [])
+      );
+    // mutation
+    const {
+      data: integrations,
+      isLoading: isIntegrationLoading,
+      isFetching: isIntegrationFetching
+    } = useGetWorkspaceIntegrations(workspaceId);
 
-  const { data: bot } = useGetWorkspaceBot(workspaceId);
+    const { data: bot } = useGetWorkspaceBot(workspaceId);
 
-  // mutation
-  const { mutateAsync: updateBotActiveStatus, mutate: updateBotActiveStatusSync } =
-    useUpdateBotActiveStatus();
-  const { mutateAsync: deleteIntegration } = useDeleteIntegration();
-  const {
-    mutateAsync: deleteIntegrationAuth,
-    isLoading: isDeleteIntegrationAuthSuccess,
-    reset: resetDeleteIntegrationAuth
-  } = useDeleteIntegrationAuth();
+    // mutation
+    const { mutateAsync: updateBotActiveStatus, mutate: updateBotActiveStatusSync } =
+      useUpdateBotActiveStatus();
+    const { mutateAsync: deleteIntegration } = useDeleteIntegration();
+    const {
+      mutateAsync: deleteIntegrationAuth,
+      isLoading: isDeleteIntegrationAuthSuccess,
+      reset: resetDeleteIntegrationAuth
+    } = useDeleteIntegrationAuth();
 
-  // summary: this use effect is trigger when all integration auths are removed thus deactivate bot
-  // details: so onsuccessfully deleting an integration auth, immediately integration list is refeteched
-  // After the refetch is completed check if its empty. Then set bot active and reset the submit hook
-  useEffect(() => {
-    if (isDeleteIntegrationAuthSuccess && !isIntegrationFetching && !integrations?.length) {
-      if (bot?._id)
-        updateBotActiveStatusSync({
-          isActive: false,
-          botId: bot._id,
-          workspaceId
-        });
-      resetDeleteIntegrationAuth();
-    }
-  }, [isIntegrationFetching, isDeleteIntegrationAuthSuccess, integrations?.length]);
-
-  const handleProviderIntegration = async (provider: string) => {
-    const selectedCloudIntegration = cloudIntegrations?.find(({ slug }) => provider === slug);
-    if (!selectedCloudIntegration) return;
-
-    try {
-      if (bot && !bot.isActive) {
-        const botKey = generateBotKey(bot.publicKey, latestWsKey!);
-        await updateBotActiveStatus({
-          workspaceId,
-          botKey,
-          isActive: true,
-          botId: bot._id
-        });
+    // summary: this use effect is trigger when all integration auths are removed thus deactivate bot
+    // details: so onsuccessfully deleting an integration auth, immediately integration list is refeteched
+    // After the refetch is completed check if its empty. Then set bot active and reset the submit hook
+    useEffect(() => {
+      if (isDeleteIntegrationAuthSuccess && !isIntegrationFetching && !integrations?.length) {
+        if (bot?._id)
+          updateBotActiveStatusSync({
+            isActive: false,
+            botId: bot._id,
+            workspaceId
+          });
+        resetDeleteIntegrationAuth();
       }
-      const integrationAuthForProvider = integrationAuths?.[provider];
-      if (!integrationAuthForProvider) {
-        redirectForProviderAuth(selectedCloudIntegration);
+    }, [isIntegrationFetching, isDeleteIntegrationAuthSuccess, integrations?.length]);
+
+    const handleProviderIntegration = async (provider: string) => {
+      const selectedCloudIntegration = cloudIntegrations?.find(({ slug }) => provider === slug);
+      if (!selectedCloudIntegration) return;
+
+      try {
+        if (bot && !bot.isActive) {
+          const botKey = generateBotKey(bot.publicKey, latestWsKey!);
+          await updateBotActiveStatus({
+            workspaceId,
+            botKey,
+            isActive: true,
+            botId: bot._id
+          });
+        }
+        const integrationAuthForProvider = integrationAuths?.[provider];
+        if (!integrationAuthForProvider) {
+          redirectForProviderAuth(selectedCloudIntegration);
+          return;
+        }
+
+        const url = redirectToIntegrationAppConfigScreen(provider, integrationAuthForProvider._id);
+        router.push(url);
+      } catch (error) {
+        console.error(error);
+      }
+    };
+
+    // function to strat integration for a provider
+    // confirmation to user passing the bot key for provider to get secret access
+    const handleProviderIntegrationStart = (provider: string) => {
+      if (!bot?.isActive) {
+        handlePopUpOpen("activeBot", { provider });
         return;
       }
+      handleProviderIntegration(provider);
+    };
 
-      const url = redirectToIntegrationAppConfigScreen(provider, integrationAuthForProvider._id);
-      router.push(url);
-    } catch (error) {
-      console.error(error);
-    }
-  };
+    const handleUserAcceptBotCondition = () => {
+      const { provider } = popUp.activeBot?.data as { provider: string };
+      handleProviderIntegration(provider);
+      handlePopUpClose("activeBot");
+    };
 
-  // function to strat integration for a provider
-  // confirmation to user passing the bot key for provider to get secret access
-  const handleProviderIntegrationStart = (provider: string) => {
-    if (!bot?.isActive) {
-      handlePopUpOpen("activeBot", { provider });
-      return;
-    }
-    handleProviderIntegration(provider);
-  };
+    const handleIntegrationDelete = async (integrationId: string, cb: () => void) => {
+      try {
+        await deleteIntegration({ id: integrationId, workspaceId });
+        if (cb) cb();
+        createNotification({
+          type: "success",
+          text: "Deleted integration"
+        });
+      } catch (err) {
+        console.log(err);
+        createNotification({
+          type: "error",
+          text: "Failed to delete integration"
+        });
+      }
+    };
 
-  const handleUserAcceptBotCondition = () => {
-    const { provider } = popUp.activeBot?.data as { provider: string };
-    handleProviderIntegration(provider);
-    handlePopUpClose("activeBot");
-  };
+    const handleIntegrationAuthRevoke = async (provider: string, cb?: () => void) => {
+      const integrationAuthForProvider = integrationAuths?.[provider];
+      if (!integrationAuthForProvider) return;
+      try {
+        await deleteIntegrationAuth({
+          id: integrationAuthForProvider._id,
+          workspaceId
+        });
+        if (cb) cb();
+        createNotification({
+          type: "success",
+          text: "Revoked provider authentication"
+        });
+      } catch (err) {
+        console.error(err);
+        createNotification({
+          type: "error",
+          text: "Failed to revoke provider authentication"
+        });
+      }
+    };
 
-  const handleIntegrationDelete = async (integrationId: string, cb: () => void) => {
-    try {
-      await deleteIntegration({ id: integrationId, workspaceId });
-      if (cb) cb();
-      createNotification({
-        type: "success",
-        text: "Deleted integration"
-      });
-    } catch (err) {
-      console.log(err);
-      createNotification({
-        type: "error",
-        text: "Failed to delete integration"
-      });
-    }
-  };
-
-  const handleIntegrationAuthRevoke = async (provider: string, cb?: () => void) => {
-    const integrationAuthForProvider = integrationAuths?.[provider];
-    if (!integrationAuthForProvider) return;
-    try {
-      await deleteIntegrationAuth({
-        id: integrationAuthForProvider._id,
-        workspaceId
-      });
-      if (cb) cb();
-      createNotification({
-        type: "success",
-        text: "Revoked provider authentication"
-      });
-    } catch (err) {
-      console.error(err);
-      createNotification({
-        type: "error",
-        text: "Failed to revoke provider authentication"
-      });
-    }
-  };
-
-  return (
-    <div className="container mx-auto max-w-7xl pb-12 text-white">
-      <IntegrationsSection
-        isLoading={isIntegrationLoading}
-        integrations={integrations}
-        environments={environments}
-        onIntegrationDelete={({ _id: id }, cb) => handleIntegrationDelete(id, cb)}
-      />
-      <CloudIntegrationSection
-        isLoading={isCloudIntegrationsLoading || isIntegrationAuthLoading}
-        cloudIntegrations={cloudIntegrations}
-        integrationAuths={integrationAuths}
-        onIntegrationStart={handleProviderIntegrationStart}
-        onIntegrationRevoke={handleIntegrationAuthRevoke}
-      />
-      <Modal
-        isOpen={popUp.activeBot?.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle("activeBot", isOpen)}
-      >
-        <ModalContent
-          title={t("integrations.grant-access-to-secrets") as string}
-          footerContent={
-            <div className="flex items-center space-x-2">
-              <Button onClick={() => handleUserAcceptBotCondition()}>
-                {t("integrations.grant-access-button") as string}
-              </Button>
-              <Button
-                onClick={() => handlePopUpClose("activeBot")}
-                variant="outline_bg"
-                colorSchema="secondary"
-              >
-                Cancel
-              </Button>
-            </div>
-          }
+    return (
+      <div className="container mx-auto max-w-7xl pb-12 text-white">
+        <IntegrationsSection
+          isLoading={isIntegrationLoading}
+          integrations={integrations}
+          environments={environments}
+          onIntegrationDelete={({ _id: id }, cb) => handleIntegrationDelete(id, cb)}
+        />
+        <CloudIntegrationSection
+          isLoading={isCloudIntegrationsLoading || isIntegrationAuthLoading}
+          cloudIntegrations={cloudIntegrations}
+          integrationAuths={integrationAuths}
+          onIntegrationStart={handleProviderIntegrationStart}
+          onIntegrationRevoke={handleIntegrationAuthRevoke}
+        />
+        <Modal
+          isOpen={popUp.activeBot?.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle("activeBot", isOpen)}
         >
-          {t("integrations.why-infisical-needs-access")}
-        </ModalContent>
-      </Modal>
-      <FrameworkIntegrationSection frameworks={frameworkIntegrations} />
-    </div>
-  );
-};
+          <ModalContent
+            title={t("integrations.grant-access-to-secrets") as string}
+            footerContent={
+              <div className="flex items-center space-x-2">
+                <Button onClick={() => handleUserAcceptBotCondition()}>
+                  {t("integrations.grant-access-button") as string}
+                </Button>
+                <Button
+                  onClick={() => handlePopUpClose("activeBot")}
+                  variant="outline_bg"
+                  colorSchema="secondary"
+                >
+                  Cancel
+                </Button>
+              </div>
+            }
+          >
+            {t("integrations.why-infisical-needs-access")}
+          </ModalContent>
+        </Modal>
+        <FrameworkIntegrationSection frameworks={frameworkIntegrations} />
+      </div>
+    );
+  },
+  { action: ProjectPermissionActions.Read, subject: ProjectPermissionSub.Integrations }
+);

frontend/src/views/IntegrationsPage/components/CloudIntegrationSection/CloudIntegrationSection.tsx

@@ -2,7 +2,9 @@ import { useTranslation } from "react-i18next";
 import { faCheck, faXmark } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
-import { DeleteActionModal,Skeleton, Tooltip } from "@app/components/v2";
+import { useNotificationContext } from "@app/components/context/Notifications/NotificationProvider";
+import { DeleteActionModal, Skeleton, Tooltip } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { IntegrationAuth, TCloudIntegration } from "@app/hooks/api/types";
 
@@ -28,11 +30,13 @@ export const CloudIntegrationSection = ({
   const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
     "deleteConfirmation"
   ] as const);
+  const permission = useProjectPermission();
+  const { createNotification } = useNotificationContext();
 
   const isEmpty = !isLoading && !cloudIntegrations?.length;
 
   const sortedCloudIntegrations = cloudIntegrations.sort((a, b) => a.name.localeCompare(b.name));
-  
+
   return (
     <div>
       <div className="m-4 mt-7 flex max-w-5xl flex-col items-start justify-between px-2 text-xl">
@@ -57,6 +61,18 @@ export const CloudIntegrationSection = ({
               } flex h-32 flex-row items-center rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4`}
               onClick={() => {
                 if (!cloudIntegration.isAvailable) return;
+                if (
+                  permission.cannot(
+                    ProjectPermissionActions.Create,
+                    ProjectPermissionSub.Integrations
+                  )
+                ) {
+                  createNotification({
+                    type: "error",
+                    text: "Permission Denied. Kindly contact your project admin"
+                  });
+                  return;
+                }
                 onIntegrationStart(cloudIntegration.slug);
               }}
               key={cloudIntegration.slug}

frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx

@@ -2,6 +2,7 @@ import { faArrowRight, faXmark } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { integrationSlugNameMapping } from "public/data/frequentConstants";
 
+import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   DeleteActionModal,
   EmptyState,
@@ -13,6 +14,7 @@ import {
   Skeleton,
   Tooltip
 } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { TIntegration } from "@app/hooks/api/types";
 
@@ -125,18 +127,26 @@ export const IntegrationsSection = ({
                 )}
               </div>
               <div className="flex cursor-default items-center">
-                <div className="ml-2 opacity-80 duration-200 hover:opacity-100">
-                  <Tooltip content="Remove Integration">
-                    <IconButton
-                      onClick={() => handlePopUpOpen("deleteConfirmation", integration)}
-                      ariaLabel="delete"
-                      colorSchema="danger"
-                      variant="star"
-                    >
-                      <FontAwesomeIcon icon={faXmark} className="px-0.5" />
-                    </IconButton>
-                  </Tooltip>
-                </div>
+                <ProjectPermissionCan
+                  I={ProjectPermissionActions.Delete}
+                  a={ProjectPermissionSub.Integrations}
+                >
+                  {(isAllowed) => (
+                    <div className="ml-2 opacity-80 duration-200 hover:opacity-100">
+                      <Tooltip content="Remove Integration">
+                        <IconButton
+                          onClick={() => handlePopUpOpen("deleteConfirmation", integration)}
+                          ariaLabel="delete"
+                          isDisabled={!isAllowed}
+                          colorSchema="danger"
+                          variant="star"
+                        >
+                          <FontAwesomeIcon icon={faXmark} className="px-0.5" />
+                        </IconButton>
+                      </Tooltip>
+                    </div>
+                  )}
+                </ProjectPermissionCan>
               </div>
             </div>
           ))}