misc: review comments

backend/src/ee/services/group/group-service.ts

@@ -3,7 +3,7 @@ import slugify from "@sindresorhus/slugify";
 
 import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
@@ -90,19 +90,18 @@ export const groupServiceFactory = ({
 
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      OrgPermissionGroupActions.ManagePrivileges,
+      OrgPermissionGroupActions.GrantPrivileges,
       OrgPermissionSubjects.Groups,
       permission,
       rolePermission
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to create group",
           membership.shouldUseNewPrivilegeSystem,
-          OrgPermissionGroupActions.ManagePrivileges,
+          OrgPermissionGroupActions.GrantPrivileges,
           OrgPermissionSubjects.Groups
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -176,18 +175,17 @@ export const groupServiceFactory = ({
       const isCustomRole = Boolean(customOrgRole);
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
-        OrgPermissionGroupActions.ManagePrivileges,
+        OrgPermissionGroupActions.GrantPrivileges,
         OrgPermissionSubjects.Groups,
         permission,
         rolePermission
       );
       if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
+        throw new PermissionBoundaryError({
           message: constructPermissionErrorMessage(
             "Failed to update group",
             membership.shouldUseNewPrivilegeSystem,
-            OrgPermissionGroupActions.ManagePrivileges,
+            OrgPermissionGroupActions.GrantPrivileges,
             OrgPermissionSubjects.Groups
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -371,8 +369,7 @@ export const groupServiceFactory = ({
     );
 
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to add user to more privileged group",
           membership.shouldUseNewPrivilegeSystem,
@@ -453,8 +450,7 @@ export const groupServiceFactory = ({
       groupRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to delete user from more privileged group",
           membership.shouldUseNewPrivilegeSystem,

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { packRules } from "@casl/ability/extra";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -81,18 +81,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -178,18 +177,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -271,18 +269,17 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     });
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       identityRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf, subject } from "@casl/ability"
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -95,18 +95,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -194,18 +193,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       targetIdentityPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -305,18 +303,17 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     });
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionIdentityActions.ManagePrivileges,
+      ProjectPermissionIdentityActions.GrantPrivileges,
       ProjectPermissionSub.Identity,
       permission,
       identityRolePermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to edit more privileged identity",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionIdentityActions.ManagePrivileges,
+          ProjectPermissionIdentityActions.GrantPrivileges,
           ProjectPermissionSub.Identity
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }

backend/src/ee/services/permission/org-permission.ts

@@ -49,7 +49,7 @@ export enum OrgPermissionIdentityActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges",
+  GrantPrivileges = "grant-privileges",
   RevokeAuth = "revoke-auth",
   CreateToken = "create-token",
   GetToken = "get-token",
@@ -61,7 +61,7 @@ export enum OrgPermissionGroupActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges",
+  GrantPrivileges = "grant-privileges",
   AddMembers = "add-members",
   RemoveMembers = "remove-members"
 }
@@ -282,7 +282,7 @@ const buildAdminPermission = () => {
   can(OrgPermissionGroupActions.Create, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.Edit, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.Delete, OrgPermissionSubjects.Groups);
-  can(OrgPermissionGroupActions.ManagePrivileges, OrgPermissionSubjects.Groups);
+  can(OrgPermissionGroupActions.GrantPrivileges, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.AddMembers, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.RemoveMembers, OrgPermissionSubjects.Groups);
 
@@ -295,7 +295,7 @@ const buildAdminPermission = () => {
   can(OrgPermissionIdentityActions.Create, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.Edit, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.Delete, OrgPermissionSubjects.Identity);
-  can(OrgPermissionIdentityActions.ManagePrivileges, OrgPermissionSubjects.Identity);
+  can(OrgPermissionIdentityActions.GrantPrivileges, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.RevokeAuth, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.CreateToken, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.GetToken, OrgPermissionSubjects.Identity);

backend/src/ee/services/permission/project-permission.ts

@@ -48,7 +48,7 @@ export enum ProjectPermissionIdentityActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionMemberActions {
@@ -56,7 +56,7 @@ export enum ProjectPermissionMemberActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionGroupActions {
@@ -64,7 +64,7 @@ export enum ProjectPermissionGroupActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  ManagePrivileges = "manage-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionSecretSyncActions {
@@ -590,7 +590,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionMemberActions.Edit,
       ProjectPermissionMemberActions.Delete,
       ProjectPermissionMemberActions.Read,
-      ProjectPermissionMemberActions.ManagePrivileges
+      ProjectPermissionMemberActions.GrantPrivileges
     ],
     ProjectPermissionSub.Member
   );
@@ -601,7 +601,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionGroupActions.Edit,
       ProjectPermissionGroupActions.Delete,
       ProjectPermissionGroupActions.Read,
-      ProjectPermissionGroupActions.ManagePrivileges
+      ProjectPermissionGroupActions.GrantPrivileges
     ],
     ProjectPermissionSub.Groups
   );
@@ -612,7 +612,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionIdentityActions.Edit,
       ProjectPermissionIdentityActions.Delete,
       ProjectPermissionIdentityActions.Read,
-      ProjectPermissionIdentityActions.ManagePrivileges
+      ProjectPermissionIdentityActions.GrantPrivileges
     ],
     ProjectPermissionSub.Identity
   );

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -82,18 +82,17 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     targetUserPermission.update(targetUserPermission.rules.concat(customPermission));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionMemberActions.ManagePrivileges,
+      ProjectPermissionMemberActions.GrantPrivileges,
       ProjectPermissionSub.Member,
       permission,
       targetUserPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged user",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionMemberActions.ManagePrivileges,
+          ProjectPermissionMemberActions.GrantPrivileges,
           ProjectPermissionSub.Member
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }
@@ -184,18 +183,17 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     targetUserPermission.update(targetUserPermission.rules.concat(dto.permissions || []));
     const permissionBoundary = validatePrivilegeChangeOperation(
       membership.shouldUseNewPrivilegeSystem,
-      ProjectPermissionMemberActions.ManagePrivileges,
+      ProjectPermissionMemberActions.GrantPrivileges,
       ProjectPermissionSub.Member,
       permission,
       targetUserPermission
     );
     if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
+      throw new PermissionBoundaryError({
         message: constructPermissionErrorMessage(
           "Failed to update more privileged user",
           membership.shouldUseNewPrivilegeSystem,
-          ProjectPermissionMemberActions.ManagePrivileges,
+          ProjectPermissionMemberActions.GrantPrivileges,
           ProjectPermissionSub.Member
         ),
         details: { missingPermissions: permissionBoundary.missingPermissions }