misc: review comments

backend/src/ee/services/group/group-service.ts

@@ -3,7 +3,7 @@ import slugify from "@sindresorhus/slugify";
 
 import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
@@ -90,19 +90,18 @@ export const groupServiceFactory = ({
 
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      OrgPermissionGroupActions.ManagePrivileges,
+      OrgPermissionGroupActions.GrantPrivileges,
       OrgPermissionSubjects.Groups,
       permission,
       rolePermission
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to create group",
           membership.shouldUseNewPrivilegeSystem,
-          OrgPermissionGroupActions.ManagePrivileges,
+          OrgPermissionGroupActions.GrantPrivileges,
           OrgPermissionSubjects.Groups
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -176,18 +175,17 @@ export const groupServiceFactory = ({
       const isCustomRole = Boolean(customOrgRole);
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        OrgPermissionGroupActions.ManagePrivileges,
+        OrgPermissionGroupActions.GrantPrivileges,
         OrgPermissionSubjects.Groups,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to update group",
             membership.shouldUseNewPrivilegeSystem,
-            OrgPermissionGroupActions.ManagePrivileges,
+            OrgPermissionGroupActions.GrantPrivileges,
             OrgPermissionSubjects.Groups
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -371,8 +369,7 @@ export const groupServiceFactory = ({
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to add user to more privileged group",
           membership.shouldUseNewPrivilegeSystem,
@@ -453,8 +450,7 @@ export const groupServiceFactory = ({
       groupRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to delete user from more privileged group",
           membership.shouldUseNewPrivilegeSystem,

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { packRules } from "@casl/ability/extra";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -81,18 +81,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -178,18 +177,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -271,18 +269,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     });
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       identityRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf, subject } from "@casl/ability"
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -95,18 +95,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -194,18 +193,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -305,18 +303,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     });
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       identityRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to edit more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/ee/services/permission/org-permission.ts

@@ -49,7 +49,7 @@ export enum OrgPermissionIdentityActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges",
+  GrantPrivileges = "grant-privileges",
   RevokeAuth = "revoke-auth",
   CreateToken = "create-token",
   GetToken = "get-token",
@@ -61,7 +61,7 @@ export enum OrgPermissionGroupActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges",
+  GrantPrivileges = "grant-privileges",
   AddMembers = "add-members",
   RemoveMembers = "remove-members"
 }
@@ -282,7 +282,7 @@ const buildAdminPermission = () => {
   can(OrgPermissionGroupActions.Create, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.Edit, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.Delete, OrgPermissionSubjects.Groups);
-  can(OrgPermissionGroupActions.ManagePrivileges, OrgPermissionSubjects.Groups);
+  can(OrgPermissionGroupActions.GrantPrivileges, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.AddMembers, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.RemoveMembers, OrgPermissionSubjects.Groups);
 
@@ -295,7 +295,7 @@ const buildAdminPermission = () => {
   can(OrgPermissionIdentityActions.Create, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.Edit, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.Delete, OrgPermissionSubjects.Identity);
-  can(OrgPermissionIdentityActions.ManagePrivileges, OrgPermissionSubjects.Identity);
+  can(OrgPermissionIdentityActions.GrantPrivileges, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.RevokeAuth, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.CreateToken, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.GetToken, OrgPermissionSubjects.Identity);

backend/src/ee/services/permission/project-permission.ts

@@ -48,7 +48,7 @@ export enum ProjectPermissionIdentityActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionMemberActions {
@@ -56,7 +56,7 @@ export enum ProjectPermissionMemberActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionGroupActions {
@@ -64,7 +64,7 @@ export enum ProjectPermissionGroupActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionSecretSyncActions {
@@ -590,7 +590,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionMemberActions.Edit,
       ProjectPermissionMemberActions.Delete,
       ProjectPermissionMemberActions.Read,
-      ProjectPermissionMemberActions.ManagePrivileges
+      ProjectPermissionMemberActions.GrantPrivileges
     ],
     ProjectPermissionSub.Member
   );
@@ -601,7 +601,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionGroupActions.Edit,
       ProjectPermissionGroupActions.Delete,
       ProjectPermissionGroupActions.Read,
-      ProjectPermissionGroupActions.ManagePrivileges
+      ProjectPermissionGroupActions.GrantPrivileges
     ],
     ProjectPermissionSub.Groups
   );
@@ -612,7 +612,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionIdentityActions.Edit,
       ProjectPermissionIdentityActions.Delete,
       ProjectPermissionIdentityActions.Read,
-      ProjectPermissionIdentityActions.ManagePrivileges
+      ProjectPermissionIdentityActions.GrantPrivileges
     ],
     ProjectPermissionSub.Identity
   );

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -82,18 +82,17 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     targetUserPermission.update(targetUserPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionMemberActions.ManagePrivileges,
+      ProjectPermissionMemberActions.GrantPrivileges,
       ProjectPermissionSub.Member,
       permission,
       targetUserPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged user",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionMemberActions.ManagePrivileges,
+          ProjectPermissionMemberActions.GrantPrivileges,
           ProjectPermissionSub.Member
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -184,18 +183,17 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     targetUserPermission.update(targetUserPermission.rules.concat(dto.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionMemberActions.ManagePrivileges,
+      ProjectPermissionMemberActions.GrantPrivileges,
       ProjectPermissionSub.Member,
       permission,
       targetUserPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged user",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionMemberActions.ManagePrivileges,
+          ProjectPermissionMemberActions.GrantPrivileges,
           ProjectPermissionSub.Member
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/lib/errors/index.ts

@@ -68,6 +68,23 @@ export class ForbiddenRequestError extends Error {
   }
 }
 
+export class PermissionBoundaryError extends ForbiddenRequestError {
+  constructor({
+    message,
+    name,
+    error,
+    details
+  }: {
+    message?: string;
+    name?: string;
+    error?: unknown;
+    details?: unknown;
+  }) {
+    super({ message, name, error, details });
+    this.name = "PermissionBoundaryError";
+  }
+}
+
 export class BadRequestError extends Error {
   name: string;
 

backend/src/server/plugins/error-handler.ts

@@ -13,6 +13,7 @@ import {
   InternalServerError,
   NotFoundError,
   OidcAuthError,
+  PermissionBoundaryError,
   RateLimitError,
   ScimRequestError,
   UnauthorizedError
@@ -117,7 +118,7 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
           conditions: el.conditions
         }))
       });
-    } else if (error instanceof ForbiddenRequestError) {
+    } else if (error instanceof ForbiddenRequestError || error instanceof PermissionBoundaryError) {
       void res.status(HttpStatusCodes.Forbidden).send({
         reqId: req.id,
         statusCode: HttpStatusCodes.Forbidden,

backend/src/services/group-project/group-project-service.ts

@@ -9,7 +9,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionGroupActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { isUuidV4 } from "@app/lib/validator";
@@ -107,18 +107,17 @@ export const groupProjectServiceFactory = ({
 
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        ProjectPermissionGroupActions.ManagePrivileges,
+        ProjectPermissionGroupActions.GrantPrivileges,
         ProjectPermissionSub.Groups,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to assign group to role",
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionGroupActions.ManagePrivileges,
+            ProjectPermissionGroupActions.GrantPrivileges,
             ProjectPermissionSub.Groups
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -285,18 +284,17 @@ export const groupProjectServiceFactory = ({
       );
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        ProjectPermissionGroupActions.ManagePrivileges,
+        ProjectPermissionGroupActions.GrantPrivileges,
         ProjectPermissionSub.Groups,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to assign group to role",
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionGroupActions.ManagePrivileges,
+            ProjectPermissionGroupActions.GrantPrivileges,
             ProjectPermissionSub.Groups
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -12,7 +12,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -355,8 +355,7 @@ export const identityAwsAuthServiceFactory = ({
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke aws auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -10,7 +10,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -327,8 +327,7 @@ export const identityAzureAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke azure auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -10,7 +10,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -373,8 +373,7 @@ export const identityGcpAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke gcp auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -12,7 +12,13 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import {
+  BadRequestError,
+  ForbiddenRequestError,
+  NotFoundError,
+  PermissionBoundaryError,
+  UnauthorizedError
+} from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { getStringValueByDot } from "@app/lib/template/dot-access";
 
@@ -533,8 +539,7 @@ export const identityJwtAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke jwt auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -12,7 +12,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -503,8 +503,7 @@ export const identityKubernetesAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke kubernetes auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -13,7 +13,13 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import {
+  BadRequestError,
+  ForbiddenRequestError,
+  NotFoundError,
+  PermissionBoundaryError,
+  UnauthorizedError
+} from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { getStringValueByDot } from "@app/lib/template/dot-access";
 
@@ -472,8 +478,7 @@ export const identityOidcAuthServiceFactory = ({
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke oidc auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-project/identity-project-service.ts

@@ -7,7 +7,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 
@@ -95,18 +95,17 @@ export const identityProjectServiceFactory = ({
 
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        ProjectPermissionIdentityActions.ManagePrivileges,
+        ProjectPermissionIdentityActions.GrantPrivileges,
         ProjectPermissionSub.Identity,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to assign to role",
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionIdentityActions.ManagePrivileges,
+            ProjectPermissionIdentityActions.GrantPrivileges,
             ProjectPermissionSub.Identity
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -202,19 +201,18 @@ export const identityProjectServiceFactory = ({
 
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        ProjectPermissionIdentityActions.ManagePrivileges,
+        ProjectPermissionIdentityActions.GrantPrivileges,
         ProjectPermissionSub.Identity,
         permission,
         rolePermission
       );
 
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to change role",
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionIdentityActions.ManagePrivileges,
+            ProjectPermissionIdentityActions.GrantPrivileges,
             ProjectPermissionSub.Identity
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -10,7 +10,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -266,8 +266,7 @@ export const identityTokenAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke token auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,
@@ -333,8 +332,7 @@ export const identityTokenAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to create token for identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,
@@ -472,8 +470,7 @@ export const identityTokenAuthServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update token for identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity-ua/identity-ua-service.ts

@@ -13,7 +13,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -382,8 +382,7 @@ export const identityUaServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke universal auth of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,
@@ -443,8 +442,7 @@ export const identityUaServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to create client secret for identity.",
           membership.shouldUseNewPrivilegeSystem,
@@ -517,8 +515,7 @@ export const identityUaServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to get identity client secret with more privileged role",
           membership.shouldUseNewPrivilegeSystem,
@@ -580,8 +577,7 @@ export const identityUaServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to read identity client secret of identity with more privileged role",
           membership.shouldUseNewPrivilegeSystem,
@@ -637,8 +633,7 @@ export const identityUaServiceFactory = ({
       rolePermission
     );
     if (!permissionBoundary.isValid) {
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to revoke identity client secret with more privileged role",
           membership.shouldUseNewPrivilegeSystem,

backend/src/services/identity/identity-service.ts

@@ -8,7 +8,7 @@ import {
   validatePrivilegeChangeOperation
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";
@@ -69,18 +69,17 @@ export const identityServiceFactory = ({
     const isCustomRole = Boolean(customRole);
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      OrgPermissionIdentityActions.ManagePrivileges,
+      OrgPermissionIdentityActions.GrantPrivileges,
       OrgPermissionSubjects.Identity,
       permission,
       rolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to create identity",
           membership.shouldUseNewPrivilegeSystem,
-          OrgPermissionIdentityActions.ManagePrivileges,
+          OrgPermissionIdentityActions.GrantPrivileges,
           OrgPermissionSubjects.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -159,18 +158,17 @@ export const identityServiceFactory = ({
       const isCustomRole = Boolean(customOrgRole);
       const appliedRolePermissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        OrgPermissionIdentityActions.ManagePrivileges,
+        OrgPermissionIdentityActions.GrantPrivileges,
         OrgPermissionSubjects.Identity,
         permission,
         rolePermission
       );
       if (!appliedRolePermissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to update identity",
             membership.shouldUseNewPrivilegeSystem,
-            OrgPermissionIdentityActions.ManagePrivileges,
+            OrgPermissionIdentityActions.GrantPrivileges,
             OrgPermissionSubjects.Identity
           ),
           details: { missingPermissions: appliedRolePermissionBoundary.missingPermissions }

backend/src/services/org/org-service.ts

@@ -37,7 +37,13 @@ import { getConfig } from "@app/lib/config/env";
 import { generateAsymmetricKeyPair } from "@app/lib/crypto";
 import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys } from "@app/lib/crypto/srp";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import {
+  BadRequestError,
+  ForbiddenRequestError,
+  NotFoundError,
+  PermissionBoundaryError,
+  UnauthorizedError
+} from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { isDisposableEmail } from "@app/lib/validator";
@@ -941,19 +947,18 @@ export const orgServiceFactory = ({
 
           const permissionBoundary = validatePrivilegeChangeOperation(
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionMemberActions.ManagePrivileges,
+            ProjectPermissionMemberActions.GrantPrivileges,
             ProjectPermissionSub.Member,
             projectPermission,
             rolePermission
           );
 
           if (!permissionBoundary.isValid)
-            throw new ForbiddenRequestError({
-              name: "PermissionBoundaryError",
+            throw new PermissionBoundaryError({
               message: constructPermissionErrorMessage(
                 "Failed to invite user to the project",
                 membership.shouldUseNewPrivilegeSystem,
-                ProjectPermissionMemberActions.ManagePrivileges,
+                ProjectPermissionMemberActions.GrantPrivileges,
                 ProjectPermissionSub.Member
               ),
               details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/services/project-membership/project-membership-service.ts

@@ -11,7 +11,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 
@@ -279,18 +279,17 @@ export const projectMembershipServiceFactory = ({
 
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        ProjectPermissionMemberActions.ManagePrivileges,
+        ProjectPermissionMemberActions.GrantPrivileges,
         ProjectPermissionSub.Member,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             `Failed to change role ${requestedRoleChange}`,
             membership.shouldUseNewPrivilegeSystem,
-            ProjectPermissionMemberActions.ManagePrivileges,
+            ProjectPermissionMemberActions.GrantPrivileges,
             ProjectPermissionSub.Member
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }