feat: resolved all missing things

backend/src/services/identity/identity-service.ts

@@ -273,7 +273,7 @@ export const identityServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Read, OrgPermissionSubjects.Identity);
 
-    // TODO(simp): check this in identity service
+    // TODO(namespace): check this in identity service
     const activeLockouts = await keyStore.getKeysByPattern(`lockout:identity:${id}:*`);
 
     const activeLockoutAuthMethods = new Set<string>();

backend/src/services/membership-identity/membership-identity-service.ts

@@ -5,6 +5,7 @@ import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { SearchResourceOperators } from "@app/lib/search-resource/search";
 
+import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TRoleDALFactory } from "../role/role-dal";
@@ -29,6 +30,7 @@ type TMembershipIdentityServiceFactoryDep = {
     "getOrgPermission" | "getProjectPermission" | "getProjectPermissionByRoles" | "getOrgPermissionByRoles"
   >;
   orgDAL: Pick<TOrgDALFactory, "findById">;
+  additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "delete">;
 };
 
 export type TMembershipIdentityServiceFactory = ReturnType<typeof membershipIdentityServiceFactory>;
@@ -38,7 +40,8 @@ export const membershipIdentityServiceFactory = ({
   roleDAL,
   membershipRoleDAL,
   permissionService,
-  orgDAL
+  orgDAL,
+  additionalPrivilegeDAL
 }: TMembershipIdentityServiceFactoryDep) => {
   const scopeFactory = {
     [AccessScope.Organization]: newOrgMembershipIdentityFactory({
@@ -255,6 +258,7 @@ export const membershipIdentityServiceFactory = ({
 
     await factory.onDeleteMembershipIdentityGuard(dto);
 
+    const scopeField = factory.getScopeField(scopeData);
     const scopeDatabaseFields = factory.getScopeDatabaseFields(dto.scopeData);
     const existingMembership = await membershipIdentityDAL.findOne({
       scope: scopeData.scope,
@@ -272,6 +276,13 @@ export const membershipIdentityServiceFactory = ({
       });
 
     const membershipDoc = await membershipIdentityDAL.transaction(async (tx) => {
+      await additionalPrivilegeDAL.delete(
+        {
+          actorIdentityId: dto.selector.identityId,
+          [scopeField.key]: scopeField.value
+        },
+        tx
+      );
       await membershipRoleDAL.delete({ membershipId: existingMembership.id }, tx);
       const doc = await membershipIdentityDAL.deleteById(existingMembership.id, tx);
       return doc;

backend/src/services/membership-user/membership-user-service.ts

@@ -13,6 +13,7 @@ import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { SearchResourceOperators } from "@app/lib/search-resource/search";
 
+import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 import { AuthMethod } from "../auth/auth-type";
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
@@ -53,6 +54,7 @@ type TMembershipUserServiceFactoryDep = {
   tokenService: TAuthTokenServiceFactory;
   userGroupMembershipDAL: TUserGroupMembershipDALFactory;
   projectDAL: TProjectDALFactory;
+  additionalPrivilegeDAL: TAdditionalPrivilegeDALFactory;
 };
 
 export type TMembershipUserServiceFactory = ReturnType<typeof membershipUserServiceFactory>;
@@ -70,7 +72,8 @@ export const membershipUserServiceFactory = ({
   smtpService,
   tokenService,
   userGroupMembershipDAL,
-  projectDAL
+  projectDAL,
+  additionalPrivilegeDAL
 }: TMembershipUserServiceFactoryDep) => {
   const scopeFactory = {
     [AccessScope.Organization]: newOrgMembershipUserFactory({
@@ -410,11 +413,22 @@ export const membershipUserServiceFactory = ({
           userId: dto.permission.id,
           membershipUserDAL,
           userGroupMembershipDAL,
-          membershipRoleDAL
+          membershipRoleDAL,
+          additionalPrivilegeDAL
         });
         return doc;
       }
 
+      if (dto.scopeData.scope === AccessScope.Project) {
+        await additionalPrivilegeDAL.delete(
+          {
+            actorUserId: dto.selector.userId,
+            projectId: dto.scopeData.projectId
+          },
+          tx
+        );
+      }
+
       await membershipRoleDAL.delete({ membershipId: existingMembership.id }, tx);
       const doc = await membershipUserDAL.deleteById(existingMembership.id, tx);
       return doc;

backend/src/services/org/org-fns.ts

@@ -6,6 +6,7 @@ import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TProjectKeyDALFactory } from "@app/services/project-key/project-key-dal";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
 
+import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 import { TMembershipRoleDALFactory } from "../membership/membership-role-dal";
 import { TMembershipUserDALFactory } from "../membership-user/membership-user-dal";
 
@@ -20,6 +21,7 @@ type TDeleteOrgMemberships = {
   userAliasDAL: Pick<TUserAliasDALFactory, "delete">;
   licenseService: Pick<TLicenseServiceFactory, "updateSubscriptionOrgMemberCount">;
   userId?: string;
+  additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "delete">;
 };
 
 export const deleteOrgMembershipsFn = async ({
@@ -32,7 +34,8 @@ export const deleteOrgMembershipsFn = async ({
   userId,
   membershipUserDAL,
   userGroupMembershipDAL,
-  membershipRoleDAL
+  membershipRoleDAL,
+  additionalPrivilegeDAL
 }: TDeleteOrgMemberships) => {
   const deletedMemberships = await orgDAL.transaction(async (tx) => {
     await membershipRoleDAL.delete(
@@ -112,6 +115,16 @@ export const deleteOrgMembershipsFn = async ({
       .filter((el) => el.scope === AccessScope.Project && el.scopeProjectId)
       .map((el) => el.scopeProjectId as string);
 
+    await additionalPrivilegeDAL.delete(
+      {
+        $in: {
+          projectId: projectIds,
+          actorUserId: membershipUserIds
+        }
+      },
+      tx
+    );
+
     // Delete all the project keys of the user in the organization
     await projectKeyDAL.delete(
       {

backend/src/services/org/org-service.ts

@@ -36,6 +36,7 @@ import { getDefaultOrgMembershipRoleForUpdateOrg } from "@app/services/org/org-r
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
 
+import { TAdditionalPrivilegeDALFactory } from "../additional-privilege/additional-privilege-dal";
 import { TAuthLoginFactory } from "../auth/auth-login-service";
 import { ActorAuthMethod, ActorType, AuthMethod, AuthModeJwtTokenPayload, AuthTokenType } from "../auth/auth-type";
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
@@ -112,6 +113,7 @@ type TOrgServiceFactoryDep = {
   loginService: Pick<TAuthLoginFactory, "generateUserTokens">;
   reminderService: Pick<TReminderServiceFactory, "deleteReminderBySecretId">;
   userGroupMembershipDAL: TUserGroupMembershipDALFactory;
+  additionalPrivilegeDAL: TAdditionalPrivilegeDALFactory;
 };
 
 export type TOrgServiceFactory = ReturnType<typeof orgServiceFactory>;
@@ -144,7 +146,8 @@ export const orgServiceFactory = ({
   reminderService,
   membershipRoleDAL,
   membershipUserDAL,
-  userGroupMembershipDAL
+  userGroupMembershipDAL,
+  additionalPrivilegeDAL
 }: TOrgServiceFactoryDep) => {
   /*
    * Get organization details by the organization id
@@ -1004,7 +1007,8 @@ export const orgServiceFactory = ({
       userId,
       membershipUserDAL,
       membershipRoleDAL,
-      userGroupMembershipDAL
+      userGroupMembershipDAL,
+      additionalPrivilegeDAL
     });
 
     return deletedMembership;
@@ -1040,7 +1044,8 @@ export const orgServiceFactory = ({
       userId,
       membershipUserDAL,
       membershipRoleDAL,
-      userGroupMembershipDAL
+      userGroupMembershipDAL,
+      additionalPrivilegeDAL
     });
 
     return deletedMemberships;

backend/src/services/role/org/org-role-factory.ts

@@ -10,6 +10,7 @@ import {
 } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError } from "@app/lib/errors";
+import { TExternalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { isCustomOrgRole } from "@app/services/org/org-role-fns";
 
 import { TRoleScopeFactory } from "../role-types";
@@ -17,9 +18,13 @@ import { TRoleScopeFactory } from "../role-types";
 // TODO(simp): missing external group checking
 type TOrgRoleScopeFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
+  externalGroupOrgRoleMappingDAL: Pick<TExternalGroupOrgRoleMappingDALFactory, "findOne">;
 };
 
-export const newOrgRoleFactory = ({ permissionService }: TOrgRoleScopeFactoryDep): TRoleScopeFactory => {
+export const newOrgRoleFactory = ({
+  permissionService,
+  externalGroupOrgRoleMappingDAL
+}: TOrgRoleScopeFactoryDep): TRoleScopeFactory => {
   const getScopeField: TRoleScopeFactory["getScopeField"] = (dto) => {
     if (dto.scope === AccessScope.Organization) {
       return { key: "orgId" as const, value: dto.orgId };
@@ -60,6 +65,17 @@ export const newOrgRoleFactory = ({ permissionService }: TOrgRoleScopeFactoryDep
       dto.permission.orgId
     );
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Role);
+
+    const externalGroupMapping = await externalGroupOrgRoleMappingDAL.findOne({
+      orgId: dto.permission.orgId,
+      roleId: dto.selector.id
+    });
+
+    if (externalGroupMapping)
+      throw new BadRequestError({
+        message:
+          "Cannot delete role assigned to external group organization role mapping. Please re-assign external mapping and try again."
+      });
   };
 
   const onListRoleGuard: TRoleScopeFactory["onListRoleGuard"] = async (dto) => {

backend/src/services/role/role-service.ts

@@ -8,6 +8,7 @@ import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars
 import { UnpackedPermissionSchema, unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 
 import { ActorType } from "../auth/auth-type";
+import { TExternalGroupOrgRoleMappingDALFactory } from "../external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TUserDALFactory } from "../user/user-dal";
@@ -31,6 +32,7 @@ type TRoleServiceFactoryDep = {
   userDAL: Pick<TUserDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
   projectDAL: Pick<TProjectDALFactory, "findById">;
+  externalGroupOrgRoleMappingDAL: Pick<TExternalGroupOrgRoleMappingDALFactory, "findOne">;
 };
 
 export type TRoleServiceFactory = ReturnType<typeof roleServiceFactory>;
@@ -40,10 +42,12 @@ export const roleServiceFactory = ({
   permissionService,
   projectDAL,
   identityDAL,
-  userDAL
+  userDAL,
+  externalGroupOrgRoleMappingDAL
 }: TRoleServiceFactoryDep) => {
   const orgRoleFactory = newOrgRoleFactory({
-    permissionService
+    permissionService,
+    externalGroupOrgRoleMappingDAL
   });
   const projectRoleFactory = newProjectRoleFactory({
     permissionService,