feat: fixing all ts error from membership and api changes

backend/src/services/membership-user/membership-user-service.ts

@@ -1,5 +1,6 @@
-import { ProjectMembershipRole, TemporaryPermissionMode, TMembershipRolesInsert } from "@app/db/schemas";
+import { AccessScope, ProjectMembershipRole, TemporaryPermissionMode, TMembershipRolesInsert } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
@@ -7,6 +8,7 @@ import { SearchResourceOperators } from "@app/lib/search-resource/search";
 
 import { AuthMethod } from "../auth/auth-type";
 import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
+import { TOrgDALFactory } from "../org/org-dal";
 import { TRoleDALFactory } from "../role/role-dal";
 import { TUserDALFactory } from "../user/user-dal";
 import { TMembershipUserDALFactory } from "./membership-user-dal";
@@ -15,14 +17,17 @@ import {
   TDeleteMembershipUserDTO,
   TGetMembershipUserByUserIdDTO,
   TListMembershipUserDTO,
-  TMembershipUserScopeFactory,
   TUpdateMembershipUserDTO
 } from "./membership-user-types";
+import { newNamespaceMembershipUserFactory } from "./namespace/namespace-membership-user-factory";
+import { newOrgMembershipUserFactory } from "./org/org-membership-user-factory";
+import { newProjectMembershipUserFactory } from "./project/project-membership-user-factory";
 
 type TMembershipUserServiceFactoryDep = {
   membershipUserDAL: TMembershipUserDALFactory;
   membershipRoleDAL: Pick<TMembershipRoleDALFactory, "insertMany" | "delete">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+  orgDAL: Pick<TOrgDALFactory, "findById">;
   roleDAL: Pick<TRoleDALFactory, "find">;
   userDAL: Pick<
     TUserDALFactory,
@@ -34,6 +39,10 @@ type TMembershipUserServiceFactoryDep = {
     | "findUserByEmail"
     | "findUserEncKeyByUserId"
   >;
+  permissionService: Pick<
+    TPermissionServiceFactory,
+    "getProjectPermission" | "getProjectPermissionByRoles" | "getOrgPermission"
+  >;
 };
 
 export type TMembershipUserServiceFactory = ReturnType<typeof membershipUserServiceFactory>;
@@ -43,9 +52,20 @@ export const membershipUserServiceFactory = ({
   roleDAL,
   licenseService,
   membershipRoleDAL,
-  userDAL
+  userDAL,
+  permissionService,
+  orgDAL
 }: TMembershipUserServiceFactoryDep) => {
-  const scopeFactory: Record<string, TMembershipUserScopeFactory> = {};
+  const scopeFactory = {
+    [AccessScope.Organization]: newOrgMembershipUserFactory({
+      permissionService
+    }),
+    [AccessScope.Namespace]: newNamespaceMembershipUserFactory({}),
+    [AccessScope.Project]: newProjectMembershipUserFactory({
+      orgDAL,
+      permissionService
+    })
+  };
 
   const $getUsers = async (usernames: string[]) => {
     const existingUsers = await userDAL.find({ $in: { username: usernames } });

backend/src/services/membership-user/project/project-membership-user-factory.ts

@@ -1,22 +1,29 @@
 import { ForbiddenError } from "@casl/ability";
 
-import { AccessScope, ActionProjectType } from "@app/db/schemas";
+import { AccessScope, ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
+import {
+  constructPermissionErrorMessage,
+  validatePrivilegeChangeOperation
+} from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   isCustomProjectRole,
   ProjectPermissionMemberActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
-import { InternalServerError } from "@app/lib/errors";
+import { InternalServerError, PermissionBoundaryError } from "@app/lib/errors";
+import { TOrgDALFactory } from "@app/services/org/org-dal";
 
 import { TMembershipUserScopeFactory } from "../membership-user-types";
 
 type TProjectMembershipUserScopeFactoryDep = {
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getProjectPermissionByRole">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getProjectPermissionByRoles">;
+  orgDAL: Pick<TOrgDALFactory, "findById">;
 };
 
 export const newProjectMembershipUserFactory = ({
-  permissionService
+  permissionService,
+  orgDAL
 }: TProjectMembershipUserScopeFactoryDep): TMembershipUserScopeFactory => {
   const getScopeField: TMembershipUserScopeFactory["getScopeField"] = (dto) => {
     if (dto.scope === AccessScope.Project) {
@@ -34,7 +41,6 @@ export const newProjectMembershipUserFactory = ({
 
   const isCustomRole: TMembershipUserScopeFactory["isCustomRole"] = (role) => isCustomProjectRole(role);
 
-  // TODO(simp): do rest of the shouldUsePrivilegeV2 check
   const onCreateMembershipUserGuard: TMembershipUserScopeFactory["onCreateMembershipUserGuard"] = async (dto) => {
     const scope = getScopeField(dto.scopeData);
     const { permission } = await permissionService.getProjectPermission({
@@ -46,6 +52,32 @@ export const newProjectMembershipUserFactory = ({
       actorOrgId: dto.permission.orgId
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Create, ProjectPermissionSub.Member);
+
+    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const permissionRoles = await permissionService.getProjectPermissionByRoles(
+      dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
+      scope.value
+    );
+
+    for (const permissionRole of permissionRoles) {
+      const permissionBoundary = validatePrivilegeChangeOperation(
+        shouldUseNewPrivilegeSystem,
+        ProjectPermissionMemberActions.GrantPrivileges,
+        ProjectPermissionSub.Member,
+        permission,
+        permissionRole.permission
+      );
+      if (!permissionBoundary.isValid)
+        throw new PermissionBoundaryError({
+          message: constructPermissionErrorMessage(
+            "Failed to create user project membership",
+            shouldUseNewPrivilegeSystem,
+            ProjectPermissionMemberActions.GrantPrivileges,
+            ProjectPermissionSub.Member
+          ),
+          details: { missingPermissions: permissionBoundary.missingPermissions }
+        });
+    }
   };
 
   const onCreateMembershipComplete: TMembershipUserScopeFactory["onCreateMembershipComplete"] = async () => {
@@ -63,6 +95,32 @@ export const newProjectMembershipUserFactory = ({
       actorOrgId: dto.permission.orgId
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member);
+
+    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const permissionRoles = await permissionService.getProjectPermissionByRoles(
+      dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
+      scope.value
+    );
+
+    for (const permissionRole of permissionRoles) {
+      const permissionBoundary = validatePrivilegeChangeOperation(
+        shouldUseNewPrivilegeSystem,
+        ProjectPermissionMemberActions.GrantPrivileges,
+        ProjectPermissionSub.Member,
+        permission,
+        permissionRole.permission
+      );
+      if (!permissionBoundary.isValid)
+        throw new PermissionBoundaryError({
+          message: constructPermissionErrorMessage(
+            "Failed to update user project membership",
+            shouldUseNewPrivilegeSystem,
+            ProjectPermissionMemberActions.GrantPrivileges,
+            ProjectPermissionSub.Member
+          ),
+          details: { missingPermissions: permissionBoundary.missingPermissions }
+        });
+    }
   };
 
   const onDeleteMembershipUserGuard: TMembershipUserScopeFactory["onDeleteMembershipUserGuard"] = async (dto) => {