feat: more review comments

backend/src/ee/services/group/user-group-membership-dal.ts

@@ -189,7 +189,7 @@ export const userGroupMembershipDALFactory = (db: TDbClient) => {
       const docs = await db
         .replicaNode()(TableName.UserGroupMembership)
         .join(TableName.Groups, `${TableName.UserGroupMembership}.groupId`, `${TableName.Groups}.id`)
-        .join(TableName.Membership, `${TableName.UserGroupMembership}.userId`, `${TableName.Membership}.actorGroupId`)
+        .join(TableName.Membership, `${TableName.UserGroupMembership}.userId`, `${TableName.Membership}.actorUserId`)
         .join(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
         .where(`${TableName.Groups}.id`, groupId)
         .where(`${TableName.Membership}.scope`, AccessScope.Organization)

backend/src/ee/services/permission/permission-dal.ts

@@ -5,7 +5,7 @@ import { TDbClient } from "@app/db";
 import {
   AccessScope,
   AccessScopeData,
-  IdentityProjectMembershipRoleSchema,
+  MembershipRolesSchema,
   MembershipsSchema,
   TableName,
   TMemberships,
@@ -95,7 +95,6 @@ export interface TPermissionDALFactory {
         updatedAt: Date;
         isTemporary: boolean;
         role: string;
-        projectMembershipId: string;
         temporaryRange?: string | null | undefined;
         permissions?: unknown;
         customRoleId?: string | null | undefined;
@@ -382,7 +381,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
           }
         })
         .select(
-          db.ref("id").withSchema(TableName.GroupProjectMembership).as("membershipId"),
+          db.ref("id").withSchema(TableName.Membership).as("membershipId"),
           db.ref("id").withSchema(TableName.Groups).as("groupId"),
           db.ref("name").withSchema(TableName.Groups).as("groupName"),
           db.ref("slug").withSchema("groupCustomRoles").as("groupProjectMembershipRoleCustomRoleSlug"),
@@ -474,6 +473,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
       const docs = await db
         .replicaNode()(TableName.Users)
         .where("isGhost", "=", false)
+        .join(TableName.Membership, `${TableName.Users}.id`, `${TableName.Membership}.actorUserId`)
         .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`)
         .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
         .leftJoin(TableName.AdditionalPrivilege, (qb) => {
@@ -661,12 +661,14 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
             `${TableName.AdditionalPrivilege}.orgId`
           );
         })
+        .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.Membership}.actorIdentityId`)
         .leftJoin(TableName.IdentityMetadata, (queryBuilder) => {
           void queryBuilder
             .on(`${TableName.Membership}.actorIdentityId`, `${TableName.IdentityMetadata}.identityId`)
             .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
         })
         .where(`${TableName.Membership}.scopeOrgId`, orgId)
+        .whereNotNull(`${TableName.Membership}.actorIdentityId`)
         .where(`${TableName.Membership}.scope`, AccessScope.Project)
         .where(`${TableName.Membership}.scopeProjectId`, projectId)
         .select(selectAllTableCols(TableName.MembershipRole))
@@ -715,7 +717,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
             key: "id",
             label: "roles" as const,
             mapper: (data) =>
-              IdentityProjectMembershipRoleSchema.extend({
+              MembershipRolesSchema.extend({
                 permissions: z.unknown(),
                 customRoleSlug: z.string().optional().nullable()
               }).parse(data)

backend/src/server/routes/v1/identity-project-router.ts

@@ -383,7 +383,6 @@ export const registerIdentityProjectRouter = async (server: FastifyZodProvider)
     }
   });
 
-  // TODO(simp): look into how to handle projects
   server.route({
     method: "GET",
     url: "/identity-memberships/:identityMembershipId",

backend/src/services/membership-group/membership-group-service.ts

@@ -265,7 +265,7 @@ export const membershipGroupServiceFactory = ({
 
     if (existingMembership.actorGroupId === dto.permission.id)
       throw new BadRequestError({
-        message: "You can't delete you own membership"
+        message: "You can't delete your own membership"
       });
 
     const membershipDoc = await membershipGroupDAL.transaction(async (tx) => {

backend/src/services/membership-group/org/org-membership-group-factory.ts

@@ -40,7 +40,7 @@ export const newOrgMembershipGroupFactory = ({
 
   const onCreateMembershipGroupGuard: TMembershipGroupScopeFactory["onCreateMembershipGroupGuard"] = async () => {
     throw new BadRequestError({
-      message: "Organizatin membership cannot be created for groups"
+      message: "Organization membership cannot be created for groups"
     });
   };
 
@@ -84,7 +84,7 @@ export const newOrgMembershipGroupFactory = ({
 
   const onDeleteMembershipGroupGuard: TMembershipGroupScopeFactory["onDeleteMembershipGroupGuard"] = async () => {
     throw new BadRequestError({
-      message: "Organizatin membership cannot be created for organization scoped group"
+      message: "Organization membership cannot be created for organization scoped group"
     });
   };
 

backend/src/services/membership-identity/membership-identity-dal.ts

@@ -41,7 +41,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
         .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
         .leftJoin(TableName.IdentityMetadata, (queryBuilder) => {
           void queryBuilder
-            .on(`${TableName.Membership}.actorIdentityId`, `${TableName.IdentityMetadata}.userId`)
+            .on(`${TableName.Membership}.actorIdentityId`, `${TableName.IdentityMetadata}.identityId`)
             .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
         })
         .where(`${TableName.Membership}.scopeOrgId`, scopeData.orgId)

backend/src/services/membership-identity/membership-identity-service.ts

@@ -272,7 +272,7 @@ export const membershipIdentityServiceFactory = ({
 
     if (existingMembership.actorIdentityId === dto.permission.id)
       throw new BadRequestError({
-        message: "You can't delete you own membership"
+        message: "You can't delete your own membership"
       });
 
     const membershipDoc = await membershipIdentityDAL.transaction(async (tx) => {

backend/src/services/membership-identity/org/org-membership-identity-factory.ts

@@ -41,7 +41,7 @@ export const newOrgMembershipIdentityFactory = ({
   const onCreateMembershipIdentityGuard: TMembershipIdentityScopeFactory["onCreateMembershipIdentityGuard"] =
     async () => {
       throw new BadRequestError({
-        message: "Organizatin membership cannot be created for organization scoped identity"
+        message: "Organization membership cannot be created for organization scoped identity"
       });
     };
 
@@ -88,7 +88,7 @@ export const newOrgMembershipIdentityFactory = ({
   const onDeleteMembershipIdentityGuard: TMembershipIdentityScopeFactory["onDeleteMembershipIdentityGuard"] =
     async () => {
       throw new BadRequestError({
-        message: "Organizatin membership cannot be created for organization scoped identity"
+        message: "Organization membership cannot be created for organization scoped identity"
       });
     };
 

backend/src/services/membership-user/membership-user-service.ts

@@ -398,7 +398,7 @@ export const membershipUserServiceFactory = ({
 
     if (existingMembership.actorUserId === dto.permission.id)
       throw new BadRequestError({
-        message: "You can't delete you own membership"
+        message: "You can't delete your own membership"
       });
 
     const membershipDoc = await membershipUserDAL.transaction(async (tx) => {

backend/src/services/org/org-service.ts

@@ -762,7 +762,7 @@ export const orgServiceFactory = ({
       throw new NotFoundError({ message: `Organization membership with ID ${membershipId} not found` });
     if (foundMembership.scopeOrgId !== orgId)
       throw new UnauthorizedError({ message: "Updated org member doesn't belong to the organization" });
-    if (foundMembership.scopeOrgId === userId)
+    if (foundMembership.actorUserId === userId)
       throw new UnauthorizedError({ message: "Cannot update own organization membership" });
 
     const isCustomRole = !Object.values(OrgMembershipRole).includes(role as OrgMembershipRole);

backend/src/services/project-membership/project-membership-dal.ts

@@ -106,6 +106,8 @@ export const projectMembershipDALFactory = (db: TDbClient) => {
             firstName,
             lastName,
             id: userId,
+            // akhilmhdh: if we do user encryption based join this would fail for scim user who haven't logged in yet
+            // public key is not used anymore as well
             publicKey: "",
             isGhost,
             isOrgMembershipActive: isActive
@@ -249,7 +251,17 @@ export const projectMembershipDALFactory = (db: TDbClient) => {
           id,
           userId,
           projectId,
-          user: { email, username, firstName, lastName, id: userId, isGhost, publicKey: "" },
+          user: {
+            email,
+            username,
+            firstName,
+            lastName,
+            id: userId,
+            isGhost,
+            // akhilmhdh: if we do user encryption based join this would fail for scim user who haven't logged in yet
+            // public key is not used anymore as well
+            publicKey: ""
+          },
           project: {
             id: projectId,
             name: projectName,

backend/src/services/role/org/org-role-factory.ts

@@ -15,7 +15,6 @@ import { isCustomOrgRole } from "@app/services/org/org-role-fns";
 
 import { TRoleScopeFactory } from "../role-types";
 
-// TODO(simp): missing external group checking
 type TOrgRoleScopeFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   externalGroupOrgRoleMappingDAL: Pick<TExternalGroupOrgRoleMappingDALFactory, "findOne">;

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -2395,8 +2395,8 @@ export const secretV2BridgeServiceFactory = ({
       projectId: folder.projectId,
       secretVersions: secretVersionsFilter,
       findOpt: {
-        offset,
         limit,
+        offset,
         sort: [["createdAt", "desc"]]
       }
     });

backend/src/services/secret-v2-bridge/secret-version-dal.ts

@@ -221,7 +221,7 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
         })
         .orWhere((qb) => {
           void qb.where(`${TableName.SecretVersionV2}.secretId`, secretId);
-          void qb.whereNull(`${TableName.Membership}.actorProjectId`);
+          void qb.whereNull(`${TableName.Membership}.scopeProjectId`);
           if (secretVersions?.length) void qb.whereIn(`${TableName.SecretVersionV2}.version`, secretVersions);
         })
         .select(

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthTemplatesTable.tsx

@@ -272,7 +272,7 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
           />
         )}
         {!subscription.machineIdentityAuthTemplates && (
-          <EmptyState title="This feature is not yet activated for your license." icon={faBan} />
+          <EmptyState title="This feature is not been activated for your license." icon={faBan} />
         )}
         {!isPending && templates.length === 0 && (
           <EmptyState