requested changes

backend/src/services/org/org-service.ts

@@ -1,5 +1,6 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, MongoAbility } from "@casl/ability";
 import slugify from "@sindresorhus/slugify";
+import { MongoQuery } from "@ucast/mongo2js";
 import crypto from "crypto";
 import jwt from "jsonwebtoken";
 import { Knex } from "knex";
@@ -19,7 +20,11 @@ import { TProjects } from "@app/db/schemas/projects";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import {
+  OrgPermissionActions,
+  OrgPermissionSet,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -487,11 +492,17 @@ export const orgServiceFactory = ({
     organizationRoleSlug,
     projects: invitedProjects,
     actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    tx: trx,
+    verifyPermissions = true
   }: TInviteUserToOrgDTO) => {
     const appCfg = getConfig();
 
-    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
+    let permission: MongoAbility<OrgPermissionSet, MongoQuery> | undefined;
+    if (verifyPermissions) {
+      permission = (await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId))
+        .permission;
+    }
 
     const org = await orgDAL.findOrgById(orgId);
 
@@ -512,12 +523,15 @@ export const orgServiceFactory = ({
     }
 
     const projectsToInvite = invitedProjects?.length
-      ? await projectDAL.find({
-          orgId,
-          $in: {
-            id: invitedProjects?.map(({ id }) => id)
-          }
-        })
+      ? await projectDAL.find(
+          {
+            orgId,
+            $in: {
+              id: invitedProjects?.map(({ id }) => id)
+            }
+          },
+          { tx: trx }
+        )
       : [];
     if (projectsToInvite.length !== invitedProjects?.length) {
       throw new ForbiddenRequestError({
@@ -534,7 +548,7 @@ export const orgServiceFactory = ({
     const mailsForOrgInvitation: { email: string; userId: string; firstName: string; lastName: string }[] = [];
     const mailsForProjectInvitation: { email: string[]; projectName: string }[] = [];
     const newProjectMemberships: TProjectMemberships[] = [];
-    await orgDAL.transaction(async (tx) => {
+    await (trx || orgDAL).transaction(async (tx) => {
       const users: Pick<TUsers, "id" | "firstName" | "lastName" | "email" | "username">[] = [];
 
       for await (const inviteeEmail of inviteeEmails) {
@@ -620,8 +634,16 @@ export const orgServiceFactory = ({
             });
           }
 
-          // as its used by project invite also
-          ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+          if (verifyPermissions) {
+            if (!permission) {
+              throw new ForbiddenRequestError({
+                name: "InviteUser",
+                message: "Failed to invite user because no permission was found"
+              });
+            }
+            // as its used by project invite also
+            ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+          }
           let roleId;
           const orgRole = isCustomOrgRole ? OrgMembershipRole.Custom : organizationRoleSlug;
           if (isCustomOrgRole) {
@@ -662,17 +684,19 @@ export const orgServiceFactory = ({
       // if there exist no project membership we set is as given by the request
       for await (const project of projectsToInvite) {
         const projectId = project.id;
-        const { permission: projectPermission } = await permissionService.getProjectPermission(
-          actor,
-          actorId,
-          projectId,
-          actorAuthMethod,
-          actorOrgId
-        );
-        ForbiddenError.from(projectPermission).throwUnlessCan(
-          ProjectPermissionActions.Create,
-          ProjectPermissionSub.Member
-        );
+        if (verifyPermissions) {
+          const { permission: projectPermission } = await permissionService.getProjectPermission(
+            actor,
+            actorId,
+            projectId,
+            actorAuthMethod,
+            actorOrgId
+          );
+          ForbiddenError.from(projectPermission).throwUnlessCan(
+            ProjectPermissionActions.Create,
+            ProjectPermissionSub.Member
+          );
+        }
         const existingMembers = await projectMembershipDAL.find(
           {
             projectId: project.id,

backend/src/services/org/org-types.ts

@@ -1,3 +1,5 @@
+import { Knex } from "knex";
+
 import { TOrgPermission } from "@app/lib/types";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
@@ -26,18 +28,15 @@ export type TDeleteOrgMembershipDTO = {
 };
 
 export type TInviteUserToOrgDTO = {
-  actorId: string;
-  actor: ActorType;
-  orgId: string;
-  actorOrgId: string | undefined;
-  actorAuthMethod: ActorAuthMethod;
   inviteeEmails: string[];
   organizationRoleSlug: string;
+  tx?: Knex;
+  verifyPermissions?: boolean;
   projects?: {
     id: string;
     projectRoleSlug?: string[];
   }[];
-};
+} & TOrgPermission;
 
 export type TVerifyUserToOrgDTO = {
   email: string;