feat(server): multi role with temporary support for identity

backend/src/db/migrations/20240308154949_temp-roles.ts

@@ -21,37 +21,37 @@ export async function up(knex: Knex): Promise<void> {
       t.datetime("temporaryAccessEndTime");
       t.timestamps(true, true, true);
     });
-
-    await createOnUpdateTrigger(knex, TableName.ProjectUserMembershipRole);
-
-    const projectMembershipStream = knex.select("*").from(TableName.ProjectMembership).stream();
-    const chunkSize = 1000;
-    let rows: TProjectUserMembershipRolesInsert[] = [];
-    for await (const row of projectMembershipStream) {
-      // disabling eslint just this part because the latest ts type doesn't have these values after migration as they are removed
-      /* eslint-disable  */
-      // @ts-ignore - created at is inserted from old data
-      rows = rows.concat({
-        // @ts-ignore - missing in ts type post migration
-        role: row.role,
-        // @ts-ignore - missing in ts type post migration
-        customRoleId: row.roleId,
-        projectMembershipId: row.id,
-        createdAt: row.createdAt,
-        updatedAt: row.updatedAt
-      });
-      /* eslint-disable */
-      if (rows.length >= chunkSize) {
-        await knex(TableName.ProjectUserMembershipRole).insert(rows);
-        rows.splice(0, rows.length);
-      }
-    }
-    await knex(TableName.ProjectUserMembershipRole).insert(rows);
-    await knex.schema.alterTable(TableName.ProjectMembership, (t) => {
-      t.dropColumn("roleId");
-      t.dropColumn("role");
-    });
   }
+
+  await createOnUpdateTrigger(knex, TableName.ProjectUserMembershipRole);
+
+  const projectMembershipStream = knex.select("*").from(TableName.ProjectMembership).stream();
+  const chunkSize = 1000;
+  let rows: TProjectUserMembershipRolesInsert[] = [];
+  for await (const row of projectMembershipStream) {
+    // disabling eslint just this part because the latest ts type doesn't have these values after migration as they are removed
+    /* eslint-disable  */
+    // @ts-ignore - created at is inserted from old data
+    rows = rows.concat({
+      // @ts-ignore - missing in ts type post migration
+      role: row.role,
+      // @ts-ignore - missing in ts type post migration
+      customRoleId: row.roleId,
+      projectMembershipId: row.id,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt
+    });
+    /* eslint-disable */
+    if (rows.length >= chunkSize) {
+      await knex(TableName.ProjectUserMembershipRole).insert(rows);
+      rows.splice(0, rows.length);
+    }
+  }
+  if (rows.length) await knex(TableName.ProjectUserMembershipRole).insert(rows);
+  await knex.schema.alterTable(TableName.ProjectMembership, (t) => {
+    t.dropColumn("roleId");
+    t.dropColumn("role");
+  });
 }
 
 export async function down(knex: Knex): Promise<void> {

backend/src/db/migrations/20240311093939_temp-role-identity.ts

@@ -0,0 +1,80 @@
+import { Knex } from "knex";
+
+import { TableName, TIdentityProjectMembershipRoleInsert } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const doesTableExist = await knex.schema.hasTable(TableName.IdentityProjectMembershipRole);
+  if (!doesTableExist) {
+    await knex.schema.createTable(TableName.IdentityProjectMembershipRole, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.uuid("projectMembershipId").notNullable();
+      t.foreign("projectMembershipId")
+        .references("id")
+        .inTable(TableName.IdentityProjectMembership)
+        .onDelete("CASCADE");
+      // until role is changed/removed the role should not deleted
+      t.uuid("customRoleId");
+      t.foreign("customRoleId").references("id").inTable(TableName.ProjectRoles);
+      t.boolean("isTemporary").notNullable().defaultTo(false);
+      t.string("temporaryMode");
+      t.string("temporaryRange"); // could be cron or relative time like 1H or 1minute etc
+      t.datetime("temporaryAccessStartTime");
+      t.datetime("temporaryAccessEndTime");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.IdentityProjectMembershipRole);
+
+  const projectMembershipStream = knex.select("*").from(TableName.IdentityProjectMembership).stream();
+  const chunkSize = 1000;
+  let rows: TIdentityProjectMembershipRoleInsert[] = [];
+  for await (const row of projectMembershipStream) {
+    // disabling eslint just this part because the latest ts type doesn't have these values after migration as they are removed
+    /* eslint-disable  */
+    // @ts-ignore - created at is inserted from old data
+    rows = rows.concat({
+      // @ts-ignore - missing in ts type post migration
+      role: row.role,
+      // @ts-ignore - missing in ts type post migration
+      customRoleId: row.roleId,
+      projectMembershipId: row.id,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt
+    });
+    /* eslint-disable */
+    if (rows.length >= chunkSize) {
+      await knex(TableName.IdentityProjectMembershipRole).insert(rows);
+      rows.splice(0, rows.length);
+    }
+  }
+  if(rows.length) await knex(TableName.IdentityProjectMembershipRole).insert(rows);
+  await knex.schema.alterTable(TableName.IdentityProjectMembership, (t) => {
+    t.dropColumn("roleId");
+    t.dropColumn("role");
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const projectIdentityMembershipRoleStream = knex.select("*").from(TableName.IdentityProjectMembershipRole).stream();
+  await knex.schema.alterTable(TableName.IdentityProjectMembership, (t) => {
+    t.string("role");
+    t.uuid("roleId");
+    t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
+  });
+  for await (const row of projectIdentityMembershipRoleStream) {
+    await knex(TableName.IdentityProjectMembership).where({ id: row.projectMembershipId }).update({
+      // @ts-ignore - since the latest one doesn't have roleId anymore there will be type error here
+      roleId: row.customRoleId,
+      role: row.role
+    });
+  }
+  await knex.schema.alterTable(TableName.IdentityProjectMembership, (t) => {
+    t.string("role").notNullable().alter({ alterNullable: true });
+  });
+
+  await knex.schema.dropTableIfExists(TableName.IdentityProjectMembershipRole);
+  await dropOnUpdateTrigger(knex, TableName.IdentityProjectMembershipRole);
+}

backend/src/db/schemas/identity-project-membership-role.ts

@@ -0,0 +1,31 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityProjectMembershipRoleSchema = z.object({
+  id: z.string().uuid(),
+  role: z.string(),
+  projectMembershipId: z.string().uuid(),
+  customRoleId: z.string().uuid().nullable().optional(),
+  isTemporary: z.boolean().default(false),
+  temporaryMode: z.string().nullable().optional(),
+  temporaryRange: z.string().nullable().optional(),
+  temporaryAccessStartTime: z.date().nullable().optional(),
+  temporaryAccessEndTime: z.date().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TIdentityProjectMembershipRole = z.infer<typeof IdentityProjectMembershipRoleSchema>;
+export type TIdentityProjectMembershipRoleInsert = Omit<
+  z.input<typeof IdentityProjectMembershipRoleSchema>,
+  TImmutableDBKeys
+>;
+export type TIdentityProjectMembershipRoleUpdate = Partial<
+  Omit<z.input<typeof IdentityProjectMembershipRoleSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/identity-project-memberships.ts

@@ -9,8 +9,6 @@ import { TImmutableDBKeys } from "./models";
 
 export const IdentityProjectMembershipsSchema = z.object({
   id: z.string().uuid(),
-  role: z.string(),
-  roleId: z.string().uuid().nullable().optional(),
   projectId: z.string(),
   identityId: z.string().uuid(),
   createdAt: z.date(),

backend/src/db/schemas/index.ts

@@ -8,6 +8,7 @@ export * from "./git-app-org";
 export * from "./identities";
 export * from "./identity-access-tokens";
 export * from "./identity-org-memberships";
+export * from "./identity-project-membership-role";
 export * from "./identity-project-memberships";
 export * from "./identity-ua-client-secrets";
 export * from "./identity-universal-auths";

backend/src/db/schemas/models.ts

@@ -42,6 +42,7 @@ export enum TableName {
   IdentityUaClientSecret = "identity_ua_client_secrets",
   IdentityOrgMembership = "identity_org_memberships",
   IdentityProjectMembership = "identity_project_memberships",
+  IdentityProjectMembershipRole = "identity_project_membership_role",
   ScimToken = "scim_tokens",
   SecretApprovalPolicy = "secret_approval_policies",
   SecretApprovalPolicyApprover = "secret_approval_policies_approvers",

backend/src/db/seeds/4-machine-identity.ts

@@ -75,9 +75,15 @@ export async function seed(knex: Knex): Promise<void> {
     }
   ]);
 
-  await knex(TableName.IdentityProjectMembership).insert({
-    identityId: seedData1.machineIdentity.id,
+  const identityProjectMembership = await knex(TableName.IdentityProjectMembership)
+    .insert({
+      identityId: seedData1.machineIdentity.id,
+      projectId: seedData1.project.id
+    })
+    .returning("*");
+
+  await knex(TableName.IdentityProjectMembershipRole).insert({
     role: ProjectMembershipRole.Admin,
-    projectId: seedData1.project.id
+    projectMembershipId: identityProjectMembership[0].id
   });
 }