From 8b315c946cc5b2d8bb7b97558c2e954771097c8c Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 4 Feb 2025 19:29:34 +0800
Subject: [PATCH] feat: added kmip to project roles section

---
 .../services/permission/project-permission.ts |  6 +++
 .../ProjectRoleModifySection.utils.tsx        | 49 ++++++++++++++++++-
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/backend/src/ee/services/permission/project-permission.ts b/backend/src/ee/services/permission/project-permission.ts
index ef7ef34ae..4a4e21530 100644
--- a/backend/src/ee/services/permission/project-permission.ts
+++ b/backend/src/ee/services/permission/project-permission.ts
@@ -419,6 +419,12 @@ const GeneralPermissionSchema = [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretSyncActions).describe(
       "Describe what action an entity can take."
     )
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Kmip).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionKmipActions).describe(
+      "Describe what action an entity can take."
+    )
   })
 ];
 
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
index dc850581f..15381b32f 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
@@ -8,6 +8,7 @@ import {
 import {
   PermissionConditionOperators,
   ProjectPermissionDynamicSecretActions,
+  ProjectPermissionKmipActions,
   ProjectPermissionSecretSyncActions,
   TPermissionCondition,
   TPermissionConditionOperators
@@ -48,6 +49,13 @@ const SecretSyncPolicyActionSchema = z.object({
   [ProjectPermissionSecretSyncActions.RemoveSecrets]: z.boolean().optional()
 });
 
+const KmipPolicyActionSchema = z.object({
+  [ProjectPermissionKmipActions.ReadClients]: z.boolean().optional(),
+  [ProjectPermissionKmipActions.CreateClients]: z.boolean().optional(),
+  [ProjectPermissionKmipActions.UpdateClients]: z.boolean().optional(),
+  [ProjectPermissionKmipActions.DeleteClients]: z.boolean().optional()
+});
+
 const SecretRollbackPolicyActionSchema = z.object({
   read: z.boolean().optional(),
   create: z.boolean().optional()
@@ -162,7 +170,8 @@ export const projectRoleFormSchema = z.object({
       [ProjectPermissionSub.SecretRotation]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Kms]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Cmek]: CmekPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.SecretSyncs]: SecretSyncPolicyActionSchema.array().default([])
+      [ProjectPermissionSub.SecretSyncs]: SecretSyncPolicyActionSchema.array().default([]),
+      [ProjectPermissionSub.Kmip]: KmipPolicyActionSchema.array().default([])
     })
     .partial()
     .optional()
@@ -359,6 +368,23 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
       return;
     }
 
+    if (subject === ProjectPermissionSub.Kmip) {
+      const canReadClients = action.includes(ProjectPermissionKmipActions.ReadClients);
+      const canEditClients = action.includes(ProjectPermissionKmipActions.UpdateClients);
+      const canDeleteClients = action.includes(ProjectPermissionKmipActions.DeleteClients);
+      const canCreateClients = action.includes(ProjectPermissionKmipActions.CreateClients);
+
+      if (!formVal[subject]) formVal[subject] = [{}];
+
+      // from above statement we are sure it won't be undefined
+      if (canReadClients) formVal[subject]![0][ProjectPermissionKmipActions.ReadClients] = true;
+      if (canEditClients) formVal[subject]![0][ProjectPermissionKmipActions.UpdateClients] = true;
+      if (canCreateClients) formVal[subject]![0][ProjectPermissionKmipActions.CreateClients] = true;
+      if (canDeleteClients) formVal[subject]![0][ProjectPermissionKmipActions.DeleteClients] = true;
+
+      return;
+    }
+
     if (subject === ProjectPermissionSub.SecretSyncs) {
       const canRead = action.includes(ProjectPermissionSecretSyncActions.Read);
       const canEdit = action.includes(ProjectPermissionSecretSyncActions.Edit);
@@ -738,5 +764,26 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
         value: ProjectPermissionSecretSyncActions.RemoveSecrets
       }
     ]
+  },
+  [ProjectPermissionSub.Kmip]: {
+    title: "KMIP",
+    actions: [
+      {
+        label: "Read clients",
+        value: ProjectPermissionKmipActions.ReadClients
+      },
+      {
+        label: "Create clients",
+        value: ProjectPermissionKmipActions.CreateClients
+      },
+      {
+        label: "Modify clients",
+        value: ProjectPermissionKmipActions.UpdateClients
+      },
+      {
+        label: "Delete clients",
+        value: ProjectPermissionKmipActions.DeleteClients
+      }
+    ]
   }
 };