awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 21:51:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add org-scoped auth to project-level endpoints

Browse Source
This commit is contained in:
Tuan Dang
2024-02-05 14:48:02 -08:00
parent 410476ecb5
commit c1aa5c840c
55 changed files with 821 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/project-role/project-role-service.ts
+22 -10
View File
@@ -28,9 +28,10 @@ export const projectRoleServiceFactory = ({ projectRoleDAL, permissionService }:
actor: ActorType,
actorId: string,
projectId: string,
data: Omit<TProjectRolesInsert, "projectId">
data: Omit<TProjectRolesInsert, "projectId">,
actorOrgScope?: string
) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Role);
const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId });
if (existingRole) throw new BadRequestError({ name: "Create Role", message: "Duplicate role" });
@@ -47,9 +48,10 @@ export const projectRoleServiceFactory = ({ projectRoleDAL, permissionService }:
actorId: string,
projectId: string,
roleId: string,
data: Omit<TOrgRolesUpdate, "orgId">
data: Omit<TOrgRolesUpdate, "orgId">,
actorOrgScope?: string
) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Role);
if (data?.slug) {
const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId });
@@ -64,8 +66,14 @@ export const projectRoleServiceFactory = ({ projectRoleDAL, permissionService }:
return updatedRole;
};
const deleteRole = async (actor: ActorType, actorId: string, projectId: string, roleId: string) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const deleteRole = async (
actor: ActorType,
actorId: string,
projectId: string,
roleId: string,
actorOrgScope?: string
) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Role);
const [deletedRole] = await projectRoleDAL.delete({ id: roleId, projectId });
if (!deleteRole) throw new BadRequestError({ message: "Role not found", name: "Update role" });
@@ -73,8 +81,8 @@ export const projectRoleServiceFactory = ({ projectRoleDAL, permissionService }:
return deletedRole;
};
const listRoles = async (actor: ActorType, actorId: string, projectId: string) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const listRoles = async (actor: ActorType, actorId: string, projectId: string, actorOrgScope?: string) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
const customRoles = await projectRoleDAL.find({ projectId });
const roles = [
@@ -127,8 +135,12 @@ export const projectRoleServiceFactory = ({ projectRoleDAL, permissionService }:
return roles;
};
const getUserPermission = async (userId: string, projectId: string) => {
const { permission, membership } = await permissionService.getUserProjectPermission(userId, projectId);
const getUserPermission = async (userId: string, projectId: string, actorOrgScope?: string) => {
const { permission, membership } = await permissionService.getUserProjectPermission(
userId,
projectId,
actorOrgScope
);
return { permissions: packRules(permission.rules), membership };
};