awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: completed scope service for membership

Browse Source
This commit is contained in:
=
2025-10-23 19:57:01 +05:30
parent e4be6b2f28
commit 98e2be477b
3 changed files with 35 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/src/services/membership-identity/membership-identity-service.ts
View File

@@ -55,7 +55,8 @@ export const membershipIdentityServiceFactory = ({
[AccessScope.Project]: newProjectMembershipIdentityFactory({
membershipIdentityDAL,
orgDAL,
permissionService
permissionService,
identityDAL
}),
[AccessScope.Namespace]: newNamespaceMembershipIdentityFactory({})
};

13
backend/src/services/membership-identity/org/org-membership-identity-factory.ts
View File

@@ -60,6 +60,10 @@ export const newOrgMembershipIdentityFactory = ({
throw new BadRequestError({ message: "Only identities from parent organization can be invited" });
}
if (identityDetails.projectId) {
throw new BadRequestError({ message: "Failed to create organization membership for a project scoped identity" });
}
const permissionRoles = await permissionService.getOrgPermissionByRoles(
dto.data.roles.map((el) => el.role),
dto.permission.orgId
@@ -129,6 +133,11 @@ export const newOrgMembershipIdentityFactory = ({
});
}
}
const identityDetails = await identityDAL.findById(dto.selector.identityId);
if (identityDetails.projectId) {
throw new BadRequestError({ message: "Failed to create organization membership for a project scoped identity" });
}
};
const onDeleteMembershipIdentityGuard: TMembershipIdentityScopeFactory["onDeleteMembershipIdentityGuard"] = async (
@@ -153,6 +162,10 @@ export const newOrgMembershipIdentityFactory = ({
if (identityDetails.orgId === dto.permission.orgId) {
throw new BadRequestError({ message: "Identity cannot exist as orphan" });
}
if (identityDetails.projectId) {
throw new BadRequestError({ message: "Failed to create organization membership for a project scoped identity" });
}
};
const onListMembershipIdentityGuard: TMembershipIdentityScopeFactory["onListMembershipIdentityGuard"] = async (

21
backend/src/services/membership-identity/project/project-membership-identity-factory.ts
View File

@@ -16,9 +16,12 @@ import { TOrgDALFactory } from "@app/services/org/org-dal";
import { TMembershipIdentityDALFactory } from "../membership-identity-dal";
import { TMembershipIdentityScopeFactory } from "../membership-identity-types";
import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
type TProjectMembershipIdentityScopeFactoryDep = {
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getProjectPermissionByRoles">;
identityDAL: Pick<TIdentityDALFactory, "findById">;
orgDAL: Pick<TOrgDALFactory, "findById">;
membershipIdentityDAL: Pick<TMembershipIdentityDALFactory, "findOne">;
};
@@ -26,7 +29,8 @@ type TProjectMembershipIdentityScopeFactoryDep = {
export const newProjectMembershipIdentityFactory = ({
permissionService,
orgDAL,
membershipIdentityDAL
membershipIdentityDAL,
identityDAL
}: TProjectMembershipIdentityScopeFactoryDep): TMembershipIdentityScopeFactory => {
const getScopeField: TMembershipIdentityScopeFactory["getScopeField"] = (dto) => {
if (dto.scope === AccessScope.Project) {
@@ -68,6 +72,11 @@ export const newProjectMembershipIdentityFactory = ({
if (!orgMembership)
throw new BadRequestError({ message: `Identity ${dto.data.identityId} is missing organization membership` });
const identityDetails = await identityDAL.findById(dto.data.identityId);
if (identityDetails.projectId) {
throw new BadRequestError({ message: "Failed to create project membership for a project scoped identity" });
}
const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
const permissionRoles = await permissionService.getProjectPermissionByRoles(
dto.data.roles.map((el) => el.role),
@@ -113,6 +122,11 @@ export const newProjectMembershipIdentityFactory = ({
ProjectPermissionSub.Identity
);
const identityDetails = await identityDAL.findById(dto.selector.identityId);
if (identityDetails.projectId && identityDetails.projectId !== scope.value) {
throw new BadRequestError({ message: "Failed to update project membership for a project scoped identity" });
}
const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
const permissionRoles = await permissionService.getProjectPermissionByRoles(
dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
@@ -156,6 +170,11 @@ export const newProjectMembershipIdentityFactory = ({
ProjectPermissionIdentityActions.Delete,
ProjectPermissionSub.Identity
);
const identityDetails = await identityDAL.findById(dto.selector.identityId);
if (identityDetails.projectId) {
throw new BadRequestError({ message: "Failed to delete project membership for a project scoped identity" });
}
};
const onListMembershipIdentityGuard: TMembershipIdentityScopeFactory["onListMembershipIdentityGuard"] = async (