chore: Refactor and remove new tables

backend/src/@types/knex.d.ts

@@ -6,7 +6,6 @@ import {
   TAccessApprovalPoliciesApprovers,
   TAccessApprovalPoliciesApproversInsert,
   TAccessApprovalPoliciesApproversUpdate,
-  TAccessApprovalPoliciesGroupApprovers,
   TAccessApprovalPoliciesInsert,
   TAccessApprovalPoliciesUpdate,
   TAccessApprovalRequests,
@@ -801,15 +800,5 @@ declare module "knex/types/tables" {
       TWorkflowIntegrationsInsert,
       TWorkflowIntegrationsUpdate
     >;
-    [TableName.AccessApprovalPolicyGroupApprover]: KnexOriginal.CompositeTableType<
-      TAccessApprovalPoliciesGroupApprovers,
-      TAccessApprovalPoliciesGroupApproversInsert,
-      TAccessApprovalPoliciesGroupApproversUpdate
-    >;
-    [TableName.SecretApprovalPolicyGroupApprover]: KnexOriginal.CompositeTableType<
-      TSecretApprovalPoliciesGroupApprovers,
-      TSecretApprovalPoliciesGroupApproversInsert,
-      TSecretApprovalPoliciesGroupApproversUpdate
-    >;
   }
 }

backend/src/db/migrations/20240918005344_add-group-approvals.ts

@@ -1,22 +1,36 @@
 import { Knex } from "knex";
 
 import { TableName } from "../schemas";
-import { createOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.AccessApprovalPolicyGroupApprover))) {
+  if (await knex.schema.hasTable(TableName.AccessApprovalPolicyApprover)) {
-    await knex.schema.createTable(TableName.AccessApprovalPolicyGroupApprover, (t) => {
+    // add column approverGroupId to AccessApprovalPolicyApprover
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+    await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (table) => {
-      t.uuid("approverGroupId").notNullable();
+      // make nullable
-      t.foreign("approverGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
+      table.uuid("approverGroupId").nullable().references("id").inTable(TableName.Groups).onDelete("CASCADE");
-      t.uuid("policyId").notNullable();
+      // make approverUserId nullable
-      t.foreign("policyId").references("id").inTable(TableName.AccessApprovalPolicy).onDelete("CASCADE");
+      table.uuid("approverUserId").nullable().alter();
-      t.timestamps(true, true, true);
+    });
+    // add column approverGroupId to SecretApprovalPolicyApprover
+    await knex.schema.alterTable(TableName.SecretApprovalPolicyApprover, (table) => {
+      table.uuid("approverGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
+      table.uuid("approverUserId").nullable().alter();
     });
-    await createOnUpdateTrigger(knex, TableName.AccessApprovalPolicyGroupApprover);
   }
 }
 
 export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.AccessApprovalPolicyGroupApprover);
+  if (await knex.schema.hasTable(TableName.AccessApprovalPolicyApprover)) {
+    // remove
+    await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (table) => {
+      table.dropColumn("approverGroupId");
+      table.uuid("approverUserId").notNullable().alter();
+    });
+
+    // remove
+    await knex.schema.alterTable(TableName.SecretApprovalPolicyApprover, (table) => {
+      table.dropColumn("approverGroupId");
+      table.uuid("approverUserId").notNullable().alter();
+    });
+  }
 }

backend/src/db/migrations/20240919205505_add-group-approvals-secrets.ts

@@ -1,22 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyGroupApprover))) {
-    await knex.schema.createTable(TableName.SecretApprovalPolicyGroupApprover, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.uuid("approverGroupId").notNullable();
-      t.foreign("approverGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
-      t.uuid("policyId").notNullable();
-      t.foreign("policyId").references("id").inTable(TableName.SecretApprovalPolicy).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyGroupApprover);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyGroupApprover);
-}

backend/src/db/schemas/access-approval-policies-approvers.ts

@@ -12,7 +12,8 @@ export const AccessApprovalPoliciesApproversSchema = z.object({
   policyId: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  approverUserId: z.string().uuid()
+  approverUserId: z.string().uuid().nullable().optional(),
+  approverGroupId: z.string().uuid().nullable().optional()
 });
 
 export type TAccessApprovalPoliciesApprovers = z.infer<typeof AccessApprovalPoliciesApproversSchema>;

backend/src/db/schemas/access-approval-policies-group-approvers.ts

@@ -1,25 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const AccessApprovalPoliciesGroupApproversSchema = z.object({
-  id: z.string().uuid(),
-  approverGroupId: z.string().uuid(),
-  policyId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TAccessApprovalPoliciesGroupApprovers = z.infer<typeof AccessApprovalPoliciesGroupApproversSchema>;
-export type TAccessApprovalPoliciesGroupApproversInsert = Omit<
-  z.input<typeof AccessApprovalPoliciesGroupApproversSchema>,
-  TImmutableDBKeys
->;
-export type TAccessApprovalPoliciesGroupApproversUpdate = Partial<
-  Omit<z.input<typeof AccessApprovalPoliciesGroupApproversSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/index.ts

@@ -1,6 +1,5 @@
 export * from "./access-approval-policies";
 export * from "./access-approval-policies-approvers";
-export * from "./access-approval-policies-group-approvers";
 export * from "./access-approval-requests";
 export * from "./access-approval-requests-reviewers";
 export * from "./api-keys";
@@ -72,7 +71,6 @@ export * from "./saml-configs";
 export * from "./scim-tokens";
 export * from "./secret-approval-policies";
 export * from "./secret-approval-policies-approvers";
-export * from "./secret-approval-policies-group-approvers";
 export * from "./secret-approval-request-secret-tags";
 export * from "./secret-approval-request-secret-tags-v2";
 export * from "./secret-approval-requests";

backend/src/db/schemas/models.ts

@@ -73,12 +73,10 @@ export enum TableName {
   ScimToken = "scim_tokens",
   AccessApprovalPolicy = "access_approval_policies",
   AccessApprovalPolicyApprover = "access_approval_policies_approvers",
-  AccessApprovalPolicyGroupApprover = "access_approval_policies_group_approvers",
   AccessApprovalRequest = "access_approval_requests",
   AccessApprovalRequestReviewer = "access_approval_requests_reviewers",
   SecretApprovalPolicy = "secret_approval_policies",
   SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
-  SecretApprovalPolicyGroupApprover = "secret_approval_policies_group_approvers",
   SecretApprovalRequest = "secret_approval_requests",
   SecretApprovalRequestReviewer = "secret_approval_requests_reviewers",
   SecretApprovalRequestSecret = "secret_approval_requests_secrets",

backend/src/db/schemas/secret-approval-policies-approvers.ts

@@ -12,7 +12,8 @@ export const SecretApprovalPoliciesApproversSchema = z.object({
   policyId: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  approverUserId: z.string().uuid()
+  approverUserId: z.string().uuid().nullable().optional(),
+  approverGroupId: z.string().uuid().nullable().optional()
 });
 
 export type TSecretApprovalPoliciesApprovers = z.infer<typeof SecretApprovalPoliciesApproversSchema>;

backend/src/db/schemas/secret-approval-policies-group-approvers.ts

@@ -1,25 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretApprovalPoliciesGroupApproversSchema = z.object({
-  id: z.string().uuid(),
-  approverGroupId: z.string().uuid(),
-  policyId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretApprovalPoliciesGroupApprovers = z.infer<typeof SecretApprovalPoliciesGroupApproversSchema>;
-export type TSecretApprovalPoliciesGroupApproversInsert = Omit<
-  z.input<typeof SecretApprovalPoliciesGroupApproversSchema>,
-  TImmutableDBKeys
->;
-export type TSecretApprovalPoliciesGroupApproversUpdate = Partial<
-  Omit<z.input<typeof SecretApprovalPoliciesGroupApproversSchema>, TImmutableDBKeys>
->;

backend/src/ee/routes/v1/access-approval-policy-router.ts

@@ -1,6 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
+import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { EnforcementLevel } from "@app/lib/types";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { sapPubSchema } from "@app/server/routes/sanitizedSchemas";
@@ -11,21 +12,18 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
     url: "/",
     method: "POST",
     schema: {
-      body: z
+      body: z.object({
-        .object({
+        projectSlug: z.string().trim(),
-          projectSlug: z.string().trim(),
+        name: z.string().optional(),
-          name: z.string().optional(),
+        secretPath: z.string().trim().default("/"),
-          secretPath: z.string().trim().default("/"),
+        environment: z.string(),
-          environment: z.string(),
+        approvers: z
-          approvers: z.string().array().default([]),
+          .object({ type: z.nativeEnum(ApproverType), id: z.string() })
-          groupApprovers: z.string().array().default([]),
+          .array()
-          approvals: z.number().min(1).default(1),
+          .min(1),
-          enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
+        approvals: z.number().min(1).default(1),
-        })
+        enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
-        .refine((data) => data.approvers.length > 0 || data.groupApprovers.length > 0, {
+      }),
-          path: ["approvers", "groupApprovers"],
-          message: "At least one approver should be provided."
-        }),
       response: {
         200: z.object({
           approval: sapPubSchema
@@ -59,19 +57,15 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         200: z.object({
           approvals: sapPubSchema
             .extend({
-              userApprovers: z
+              approvers: z
-                .object({
+                .object({ type: z.nativeEnum(ApproverType), id: z.string().nullable().optional() })
-                  userId: z.string()
+                .array()
-                })
+                .nullable()
-                .array(),
+                .optional()
-              groupApprovers: z
-                .object({
-                  groupId: z.string()
-                })
-                .array(),
-              secretPath: z.string().optional().nullable()
             })
             .array()
+            .nullable()
+            .optional()
         })
       }
     },
@@ -84,7 +78,7 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         actorOrgId: req.permission.orgId,
         projectSlug: req.query.projectSlug
       });
-
+      
       return { approvals };
     }
   });
@@ -125,23 +119,20 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
       params: z.object({
         policyId: z.string()
       }),
-      body: z
+      body: z.object({
-        .object({
+        name: z.string().optional(),
-          name: z.string().optional(),
+        secretPath: z
-          secretPath: z
+          .string()
-            .string()
+          .trim()
-            .trim()
+          .optional()
-            .optional()
+          .transform((val) => (val === "" ? "/" : val)),
-            .transform((val) => (val === "" ? "/" : val)),
+        approvers: z
-          approvers: z.string().array().optional().default([]),
+          .object({ type: z.nativeEnum(ApproverType), id: z.string() })
-          approvals: z.number().min(1).optional(),
+          .array()
-          groupApprovers: z.string().array().optional().default([]),
+          .min(1),
-          enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
+        approvals: z.number().min(1).optional(),
-        })
+        enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
-        .refine((data) => data.approvers || data.groupApprovers, {
+      }),
-          path: ["approvers", "groupApprovers"],
-          message: "At least one approver should be provided."
-        }),
       response: {
         200: z.object({
           approval: sapPubSchema

backend/src/ee/routes/v1/secret-approval-policy-router.ts

@@ -1,6 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
+import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { EnforcementLevel } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -16,26 +17,23 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
       rateLimit: writeLimit
     },
     schema: {
-      body: z
+      body: z.object({
-        .object({
+        workspaceId: z.string(),
-          workspaceId: z.string(),
+        name: z.string().optional(),
-          name: z.string().optional(),
+        environment: z.string(),
-          environment: z.string(),
+        secretPath: z
-          secretPath: z
+          .string()
-            .string()
+          .optional()
-            .optional()
+          .nullable()
-            .nullable()
+          .default("/")
-            .default("/")
+          .transform((val) => (val ? removeTrailingSlash(val) : val)),
-            .transform((val) => (val ? removeTrailingSlash(val) : val)),
+        approvers: z
-          approvers: z.string().array().optional().default([]),
+          .object({ type: z.nativeEnum(ApproverType), id: z.string() })
-          groupApprovers: z.string().array().optional().default([]),
+          .array()
-          approvals: z.number().min(1).default(1),
+          .min(1),
-          enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
+        approvals: z.number().min(1).default(1),
-        })
+        enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
-        .refine((data) => data.approvers || data.groupApprovers, {
+      }),
-          path: ["approvers", "groupApprovers"],
-          message: "At least one approver should be provided."
-        }),
       response: {
         200: z.object({
           approval: sapPubSchema
@@ -68,24 +66,21 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
       params: z.object({
         sapId: z.string()
       }),
-      body: z
+      body: z.object({
-        .object({
+        name: z.string().optional(),
-          name: z.string().optional(),
+        approvers: z
-          approvers: z.string().array().optional().default([]),
+          .object({ type: z.nativeEnum(ApproverType), id: z.string() })
-          approvals: z.number().min(1).default(1),
+          .array()
-          groupApprovers: z.string().array().optional().default([]),
+          .min(1),
-          secretPath: z
+        approvals: z.number().min(1).default(1),
-            .string()
+        secretPath: z
-            .optional()
+          .string()
-            .nullable()
+          .optional()
-            .transform((val) => (val ? removeTrailingSlash(val) : val))
+          .nullable()
-            .transform((val) => (val === "" ? "/" : val)),
+          .transform((val) => (val ? removeTrailingSlash(val) : val))
-          enforcementLevel: z.nativeEnum(EnforcementLevel).optional()
+          .transform((val) => (val === "" ? "/" : val)),
-        })
+        enforcementLevel: z.nativeEnum(EnforcementLevel).optional()
-        .refine((data) => data.approvers.length > 0 || data.groupApprovers.length > 0, {
+      }),
-          path: ["approvers", "groupApprovers"],
-          message: "At least one approver should be provided."
-        }),
       response: {
         200: z.object({
           approval: sapPubSchema
@@ -149,14 +144,10 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         200: z.object({
           approvals: sapPubSchema
             .extend({
-              userApprovers: z
+              approvers: z
                 .object({
-                  userId: z.string()
+                  id: z.string().nullable().optional(),
-                })
+                  type: z.nativeEnum(ApproverType)
-                .array(),
-              groupApprovers: z
-                .object({
-                  groupId: z.string()
                 })
                 .array()
             })
@@ -193,7 +184,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         200: z.object({
           policy: sapPubSchema
             .extend({
-              userApprovers: z.object({ userId: z.string() }).array()
+              userApprovers: z.object({ userId: z.string().nullable().optional() }).array()
             })
             .optional()
         })

backend/src/ee/routes/v1/secret-approval-request-router.ts

@@ -13,7 +13,7 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
-const approvalRequestUser = z.object({ userId: z.string() }).merge(
+const approvalRequestUser = z.object({ userId: z.string().nullable().optional() }).merge(
   UsersSchema.pick({
     email: true,
     firstName: true,
@@ -48,7 +48,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
               approvals: z.number(),
               approvers: z
                 .object({
-                  userId: z.string()
+                  userId: z.string().nullable().optional()
                 })
                 .array(),
               secretPath: z.string().optional().nullable(),
@@ -60,7 +60,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
             reviewers: z.object({ userId: z.string(), status: z.string() }).array(),
             approvers: z
               .object({
-                userId: z.string()
+                userId: z.string().nullable().optional()
               })
               .array()
           }).array()

backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts

@@ -5,6 +5,8 @@ import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies } from
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
+import { ApproverType } from "./access-approval-policy-types";
+
 export type TAccessApprovalPolicyDALFactory = ReturnType<typeof accessApprovalPolicyDALFactory>;
 
 export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
@@ -20,13 +22,8 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicy}.id`,
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
-      .leftJoin(
-        TableName.AccessApprovalPolicyGroupApprover,
-        `${TableName.AccessApprovalPolicy}.id`,
-        `${TableName.AccessApprovalPolicyGroupApprover}.policyId`
-      )
       .select(tx.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
-      .select(tx.ref("approverGroupId").withSchema(TableName.AccessApprovalPolicyGroupApprover))
+      .select(tx.ref("approverGroupId").withSchema(TableName.AccessApprovalPolicyApprover))
       .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
       .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
       .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
@@ -36,10 +33,10 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
     return result;
   };
 
-  const findById = async (id: string, tx?: Knex) => {
+  const findById = async (policyId: string, tx?: Knex) => {
     try {
       const doc = await accessApprovalPolicyFindQuery(tx || db.replicaNode(), {
-        [`${TableName.AccessApprovalPolicy}.id` as "id"]: id
+        [`${TableName.AccessApprovalPolicy}.id` as "id"]: policyId
       });
       const formattedDoc = sqlNestRelationships({
         data: doc,
@@ -56,16 +53,18 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "approverUserId",
-            label: "userApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverUserId }) => ({
+            mapper: ({ approverUserId: id }) => ({
-              userId: approverUserId
+              id,
+              type: "user"
             })
           },
           {
             key: "approverGroupId",
-            label: "groupApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverGroupId }) => ({
+            mapper: ({ approverGroupId: id }) => ({
-              groupId: approverGroupId
+              id,
+              type: "group"
             })
           }
         ]
@@ -97,16 +96,18 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "approverUserId",
-            label: "userApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverUserId }) => ({
+            mapper: ({ approverUserId: id }) => ({
-              userId: approverUserId
+              id,
+              type: ApproverType.User
             })
           },
           {
             key: "approverGroupId",
-            label: "groupApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverGroupId }) => ({
+            mapper: ({ approverGroupId: id }) => ({
-              groupId: approverGroupId
+              id,
+              type: ApproverType.Group
             })
           }
         ]

backend/src/ee/services/access-approval-policy/access-approval-policy-group-approver-dal.ts

@@ -1,12 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TAccessApprovalPolicyGroupApproverDALFactory = ReturnType<
-  typeof accessApprovalPolicyGroupApproverDALFactory
->;
-
-export const accessApprovalPolicyGroupApproverDALFactory = (db: TDbClient) => {
-  const accessApprovalPolicyGroupApproverOrm = ormify(db, TableName.AccessApprovalPolicyGroupApprover);
-  return { ...accessApprovalPolicyGroupApproverOrm };
-};

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -11,8 +11,8 @@ import { TGroupDALFactory } from "../group/group-dal";
 import { TAccessApprovalPolicyApproverDALFactory } from "./access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "./access-approval-policy-dal";
 import { verifyApprovers } from "./access-approval-policy-fns";
-import { TAccessApprovalPolicyGroupApproverDALFactory } from "./access-approval-policy-group-approver-dal";
 import {
+  ApproverType,
   TCreateAccessApprovalPolicy,
   TDeleteAccessApprovalPolicy,
   TGetAccessPolicyCountByEnvironmentDTO,
@@ -28,14 +28,12 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   accessApprovalPolicyApproverDAL: TAccessApprovalPolicyApproverDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
   groupDAL: TGroupDALFactory;
-  accessApprovalPolicyGroupApproverDAL: TAccessApprovalPolicyGroupApproverDALFactory;
 };
 
 export type TAccessApprovalPolicyServiceFactory = ReturnType<typeof accessApprovalPolicyServiceFactory>;
 
 export const accessApprovalPolicyServiceFactory = ({
   accessApprovalPolicyDAL,
-  accessApprovalPolicyGroupApproverDAL,
   accessApprovalPolicyApproverDAL,
   groupDAL,
   permissionService,
@@ -51,7 +49,6 @@ export const accessApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
-    groupApprovers,
     projectSlug,
     environment,
     enforcementLevel
@@ -59,11 +56,15 @@ export const accessApprovalPolicyServiceFactory = ({
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
 
-    if (!groupApprovers && !approvers)
-      throw new BadRequestError({ message: "Either of approvers or group approvers must be provided" });
-
     // If there is a group approver people might be added to the group later to meet the approvers quota
-    if (!groupApprovers && approvals > approvers.length)
+    const groupApprovers = approvers
+      .filter((approver) => approver.type === ApproverType.Group)
+      .map((approver) => approver.id);
+    const userApprovers = approvers
+      .filter((approver) => approver.type === ApproverType.User)
+      .map((approver) => approver.id);
+
+    if (!groupApprovers && approvals > userApprovers.length)
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -80,7 +81,7 @@ export const accessApprovalPolicyServiceFactory = ({
     const env = await projectEnvDAL.findOne({ slug: environment, projectId: project.id });
     if (!env) throw new BadRequestError({ message: "Environment not found" });
 
-    const verifyAllApprovers = approvers;
+    const verifyAllApprovers = userApprovers;
     const usersPromises: Promise<
       {
         id: string;
@@ -119,21 +120,25 @@ export const accessApprovalPolicyServiceFactory = ({
         },
         tx
       );
-      await accessApprovalPolicyApproverDAL.insertMany(
+      if (userApprovers) {
-        approvers.map((userId) => ({
+        await accessApprovalPolicyApproverDAL.insertMany(
-          approverUserId: userId,
+          userApprovers.map((userId) => ({
-          policyId: doc.id
+            approverUserId: userId,
-        })),
+            policyId: doc.id
-        tx
+          })),
-      );
+          tx
+        );
+      }
 
-      await accessApprovalPolicyGroupApproverDAL.insertMany(
+      if (groupApprovers) {
-        groupApprovers.map((groupId) => ({
+        await accessApprovalPolicyApproverDAL.insertMany(
-          approverGroupId: groupId,
+          groupApprovers.map((groupId) => ({
-          policyId: doc.id
+            approverGroupId: groupId,
-        })),
+            policyId: doc.id
-        tx
+          })),
-      );
+          tx
+        );
+      }
 
       return doc;
     });
@@ -167,7 +172,6 @@ export const accessApprovalPolicyServiceFactory = ({
   const updateAccessApprovalPolicy = async ({
     policyId,
     approvers,
-    groupApprovers,
     secretPath,
     name,
     actorId,
@@ -177,7 +181,19 @@ export const accessApprovalPolicyServiceFactory = ({
     approvals,
     enforcementLevel
   }: TUpdateAccessApprovalPolicy) => {
+    const groupApprovers = approvers
+      ?.filter((approver) => approver.type === ApproverType.Group)
+      .map((approver) => approver.id);
+    const userApprovers = approvers
+      ?.filter((approver) => approver.type === ApproverType.User)
+      .map((approver) => approver.id);
+
     const accessApprovalPolicy = await accessApprovalPolicyDAL.findById(policyId);
+    const currentAppovals = approvals || accessApprovalPolicy.approvals;
+    if (groupApprovers?.length === 0 && userApprovers && currentAppovals > userApprovers.length) {
+      throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
+    }
+
     if (!accessApprovalPolicy) throw new BadRequestError({ message: "Secret approval policy not found" });
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -200,7 +216,10 @@ export const accessApprovalPolicyServiceFactory = ({
         },
         tx
       );
-      if (approvers) {
+
+      await accessApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
+
+      if (userApprovers) {
         await verifyApprovers({
           projectId: accessApprovalPolicy.projectId,
           orgId: actorOrgId,
@@ -208,11 +227,10 @@ export const accessApprovalPolicyServiceFactory = ({
           secretPath: doc.secretPath!,
           actorAuthMethod,
           permissionService,
-          userIds: approvers
+          userIds: userApprovers
         });
-        await accessApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
         await accessApprovalPolicyApproverDAL.insertMany(
-          approvers.map((userId) => ({
+          userApprovers.map((userId) => ({
             approverUserId: userId,
             policyId: doc.id
           })),
@@ -246,8 +264,7 @@ export const accessApprovalPolicyServiceFactory = ({
           permissionService,
           userIds: verifyGroupApprovers
         });
-        await accessApprovalPolicyGroupApproverDAL.delete({ policyId: doc.id }, tx);
+        await accessApprovalPolicyApproverDAL.insertMany(
-        await accessApprovalPolicyGroupApproverDAL.insertMany(
           groupApprovers.map((groupId) => ({
             approverGroupId: groupId,
             policyId: doc.id

backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts

@@ -13,12 +13,16 @@ export type TVerifyApprovers = {
   orgId: string;
 };
 
+export enum ApproverType {
+  Group = "group",
+  User = "user"
+}
+
 export type TCreateAccessApprovalPolicy = {
   approvals: number;
   secretPath: string;
   environment: string;
-  approvers: string[];
+  approvers: { type: ApproverType; id: string }[];
-  groupApprovers: string[];
   projectSlug: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -27,8 +31,7 @@ export type TCreateAccessApprovalPolicy = {
 export type TUpdateAccessApprovalPolicy = {
   policyId: string;
   approvals?: number;
-  approvers?: string[];
+  approvers?: { type: ApproverType; id: string }[];
-  groupApprovers?: string[];
   secretPath?: string;
   name?: string;
   enforcementLevel?: EnforcementLevel;

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -39,14 +39,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.AccessApprovalPolicy}.id`,
           `${TableName.AccessApprovalPolicyApprover}.policyId`
         )
-        .leftJoin(
-          TableName.AccessApprovalPolicyGroupApprover,
-          `${TableName.AccessApprovalPolicy}.id`,
-          `${TableName.AccessApprovalPolicyGroupApprover}.policyId`
-        )
         .leftJoin(
           TableName.UserGroupMembership,
-          `${TableName.AccessApprovalPolicyGroupApprover}.approverGroupId`,
+          `${TableName.AccessApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
         .leftJoin(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
@@ -200,16 +195,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
         "accessApprovalPolicyApproverUser.id"
       )
-
-      .leftJoin(
-        TableName.AccessApprovalPolicyGroupApprover,
-        `${TableName.AccessApprovalPolicy}.id`,
-        `${TableName.AccessApprovalPolicyGroupApprover}.policyId`
-      )
-
       .leftJoin(
         TableName.UserGroupMembership,
-        `${TableName.AccessApprovalPolicyGroupApprover}.approverGroupId`,
+        `${TableName.AccessApprovalPolicyApprover}.approverGroupId`,
         `${TableName.UserGroupMembership}.groupId`
       )
 

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -18,7 +18,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-policy/access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { verifyApprovers } from "../access-approval-policy/access-approval-policy-fns";
-import { TAccessApprovalPolicyGroupApproverDALFactory } from "../access-approval-policy/access-approval-policy-group-approver-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -38,7 +37,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "create" | "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
-  accessApprovalPolicyGroupApproverDAL: Pick<TAccessApprovalPolicyGroupApproverDALFactory, "find">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   projectDAL: Pick<
     TProjectDALFactory,
@@ -83,7 +81,6 @@ export const accessApprovalRequestServiceFactory = ({
   projectMembershipDAL,
   accessApprovalPolicyDAL,
   accessApprovalPolicyApproverDAL,
-  accessApprovalPolicyGroupApproverDAL,
   additionalPrivilegeDAL,
   smtpService,
   userDAL,
@@ -130,26 +127,28 @@ export const accessApprovalRequestServiceFactory = ({
     });
     if (!policy) throw new UnauthorizedError({ message: "No policy matching criteria was found." });
 
-    const approverIds = [];
+    const approverIds: string[] = [];
+    const approverGroupIds: string[] = [];
 
     const approvers = await accessApprovalPolicyApproverDAL.find({
       policyId: policy.id
     });
 
     approvers.forEach((approver) => {
-      approverIds.push(approver.approverUserId);
+      if (approver.approverUserId) {
-    });
+        approverIds.push(approver.approverUserId);
-
+      }
-    const groupApprovers = await accessApprovalPolicyGroupApproverDAL.find({
+      else if (approver.approverGroupId) {
-      policyId: policy.id
+        approverGroupIds.push(approver.approverGroupId);
+      }
     });
 
     const groupUsers = (
       await Promise.all(
-        groupApprovers.map((groupApprover) =>
+        approverGroupIds.map((groupApproverId) =>
           groupDAL.findAllGroupMembers({
             orgId: actorOrgId,
-            groupId: groupApprover.id
+            groupId: groupApproverId
           })
         )
       )

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -1,10 +1,12 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { SecretApprovalPoliciesSchema, TableName, TSecretApprovalPolicies } from "@app/db/schemas";
+import { SecretApprovalPoliciesSchema, TableName, TSecretApprovalPolicies, TUsers } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
+
 export type TSecretApprovalPolicyDALFactory = ReturnType<typeof secretApprovalPolicyDALFactory>;
 
 export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
@@ -20,26 +22,25 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicy}.id`,
         `${TableName.SecretApprovalPolicyApprover}.policyId`
       )
-
-      .leftJoin(TableName.Users, `${TableName.SecretApprovalPolicyApprover}.approverUserId`, `${TableName.Users}.id`)
-      .leftJoin(
-        TableName.SecretApprovalPolicyGroupApprover,
-        `${TableName.SecretApprovalPolicy}.id`,
-        `${TableName.SecretApprovalPolicyGroupApprover}.policyId`
-      )
       .leftJoin(
         TableName.UserGroupMembership,
-        `${TableName.SecretApprovalPolicyGroupApprover}.approverGroupId`,
+        `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
-        `${TableName.UserGroupMembership}.userId`
+        `${TableName.UserGroupMembership}.groupId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("secretApprovalPolicyApproverUser"),
+        `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
+        "secretApprovalPolicyApproverUser.id"
+      )
+      .leftJoin<TUsers>(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
+      .select(
+        tx.ref("id").withSchema("secretApprovalPolicyApproverUser").as("approverUserId"),
+        tx.ref("email").withSchema("secretApprovalPolicyApproverUser").as("approverEmail"),
+        tx.ref("firstName").withSchema("secretApprovalPolicyApproverUser").as("approverFirstName"),
+        tx.ref("lastName").withSchema("secretApprovalPolicyApproverUser").as("approverLastName")
       )
       .select(
-        tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
+        tx.ref("approverGroupId").withSchema(TableName.SecretApprovalPolicyApprover),
-        tx.ref("email").withSchema(TableName.Users).as("approverEmail"),
-        tx.ref("firstName").withSchema(TableName.Users).as("approverFirstName"),
-        tx.ref("lastName").withSchema(TableName.Users).as("approverLastName")
-      )
-      .select(
-        tx.ref("approverGroupId").withSchema(TableName.SecretApprovalPolicyGroupApprover),
         tx.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
         tx.ref("email").withSchema(TableName.Users).as("approverGroupEmail"),
         tx.ref("firstName").withSchema(TableName.Users).as("approverGroupFirstName"),
@@ -71,21 +72,31 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
           {
             key: "approverUserId",
             label: "userApprovers" as const,
-            mapper: ({ approverUserId, approverEmail, approverFirstName, approverLastName }) => ({
+            mapper: ({
-              userId: approverUserId,
+              approverUserId: userId,
-              email: approverEmail,
+              approverEmail: email,
-              firstName: approverFirstName,
+              approverFirstName: firstName,
-              lastName: approverLastName
+              approverLastName: lastName
+            }) => ({
+              userId,
+              email,
+              firstName,
+              lastName
             })
           },
           {
             key: "approverGroupUserId",
             label: "userApprovers" as const,
-            mapper: ({ approverGroupUserId, approverGroupEmail, approverGroupFirstName, approverGroupLastName }) => ({
+            mapper: ({
-              userId: approverGroupUserId,
+              approverGroupUserId: userId,
-              email: approverGroupEmail,
+              approverGroupEmail: email,
-              firstName: approverGroupFirstName,
+              approverGroupFirstName: firstName,
-              lastName: approverGroupLastName
+              approverGroupLastName: lastName
+            }) => ({
+              userId,
+              email,
+              firstName,
+              lastName
             })
           }
         ]
@@ -111,16 +122,32 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "approverUserId",
-            label: "userApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverUserId }) => ({
+            mapper: ({ approverUserId: id }) => ({
-              userId: approverUserId
+              type: ApproverType.User,
+              id
             })
           },
           {
             key: "approverGroupId",
-            label: "groupApprovers" as const,
+            label: "approvers" as const,
-            mapper: ({ approverGroupId }) => ({
+            mapper: ({ approverGroupId: id }) => ({
-              groupId: approverGroupId
+              type: ApproverType.Group,
+              id
+            })
+          },
+          {
+            key: "approverUserId",
+            label: "userApprovers" as const,
+            mapper: ({ approverUserId: userId }) => ({
+              userId
+            })
+          },
+          {
+            key: "approverGroupUserId",
+            label: "userApprovers" as const,
+            mapper: ({ approverGroupUserId: userId }) => ({
+              userId
             })
           }
         ]

backend/src/ee/services/secret-approval-policy/secret-approval-policy-group-approver-dal.ts

@@ -1,12 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TSecretApprovalPolicyGroupApproverDALFactory = ReturnType<
-  typeof secretApprovalPolicyGroupApproverDALFactory
->;
-
-export const secretApprovalPolicyGroupApproverDALFactory = (db: TDbClient) => {
-  const sapGroupApproverOrm = ormify(db, TableName.SecretApprovalPolicyGroupApprover);
-  return sapGroupApproverOrm;
-};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -8,10 +8,10 @@ import { removeTrailingSlash } from "@app/lib/fn";
 import { containsGlobPatterns } from "@app/lib/picomatch";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
 import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
-import { TSecretApprovalPolicyGroupApproverDALFactory } from "./secret-approval-policy-group-approver-dal";
 import {
   TCreateSapDTO,
   TDeleteSapDTO,
@@ -30,7 +30,6 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
-  secretApprovalPolicyGroupApproverDAL: TSecretApprovalPolicyGroupApproverDALFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
@@ -40,7 +39,6 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyDAL,
   permissionService,
   secretApprovalPolicyApproverDAL,
-  secretApprovalPolicyGroupApproverDAL,
   projectEnvDAL,
   licenseService
 }: TSecretApprovalPolicyServiceFactoryDep) => {
@@ -52,14 +50,17 @@ export const secretApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
-    groupApprovers,
     projectId,
     secretPath,
     environment,
     enforcementLevel
   }: TCreateSapDTO) => {
-    if (!groupApprovers && !approvers)
+    const groupApprovers = approvers
-      throw new BadRequestError({ message: "Either of approvers or group approvers must be provided" });
+      ?.filter((approver) => approver.type === ApproverType.Group)
+      .map((approver) => approver.id);
+    const userApprovers = approvers
+      ?.filter((approver) => approver.type === ApproverType.User)
+      .map((approver) => approver.id);
 
     if (!groupApprovers && approvals > approvers.length)
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
@@ -100,14 +101,14 @@ export const secretApprovalPolicyServiceFactory = ({
       );
 
       await secretApprovalPolicyApproverDAL.insertMany(
-        approvers.map((approverUserId) => ({
+        userApprovers.map((approverUserId) => ({
           approverUserId,
           policyId: doc.id
         })),
         tx
       );
 
-      await secretApprovalPolicyGroupApproverDAL.insertMany(
+      await secretApprovalPolicyApproverDAL.insertMany(
         groupApprovers.map((approverGroupId) => ({
           approverGroupId,
           policyId: doc.id
@@ -121,7 +122,6 @@ export const secretApprovalPolicyServiceFactory = ({
 
   const updateSecretApprovalPolicy = async ({
     approvers,
-    groupApprovers,
     secretPath,
     name,
     actorId,
@@ -132,6 +132,13 @@ export const secretApprovalPolicyServiceFactory = ({
     secretPolicyId,
     enforcementLevel
   }: TUpdateSapDTO) => {
+    const groupApprovers = approvers
+      ?.filter((approver) => approver.type === ApproverType.Group)
+      .map((approver) => approver.id);
+    const userApprovers = approvers
+      ?.filter((approver) => approver.type === ApproverType.User)
+      .map((approver) => approver.id);
+
     const secretApprovalPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
     if (!secretApprovalPolicy) throw new BadRequestError({ message: "Secret approval policy not found" });
 
@@ -163,19 +170,21 @@ export const secretApprovalPolicyServiceFactory = ({
         },
         tx
       );
+
+      await secretApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
+
       if (approvers) {
-        await secretApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
         await secretApprovalPolicyApproverDAL.insertMany(
-          approvers.map((approverUserId) => ({
+          userApprovers.map((approverUserId) => ({
             approverUserId,
             policyId: doc.id
           })),
           tx
         );
       }
+
       if (groupApprovers) {
-        await secretApprovalPolicyGroupApproverDAL.delete({ policyId: doc.id }, tx);
+        await secretApprovalPolicyApproverDAL.insertMany(
-        await secretApprovalPolicyGroupApproverDAL.insertMany(
           groupApprovers.map((approverGroupId) => ({
             approverGroupId,
             policyId: doc.id

backend/src/ee/services/secret-approval-policy/secret-approval-policy-types.ts

@@ -1,11 +1,12 @@
 import { EnforcementLevel, TProjectPermission } from "@app/lib/types";
 
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
+
 export type TCreateSapDTO = {
   approvals: number;
   secretPath?: string | null;
   environment: string;
-  approvers: string[];
+  approvers: { type: ApproverType; id: string }[];
-  groupApprovers: string[];
   projectId: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -15,8 +16,7 @@ export type TUpdateSapDTO = {
   secretPolicyId: string;
   approvals?: number;
   secretPath?: string | null;
-  approvers?: string[];
+  approvers: { type: ApproverType; id: string }[];
-  groupApprovers?: string[];
   name?: string;
   enforcementLevel?: EnforcementLevel;
 } & Omit<TProjectPermission, "projectId">;

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -58,14 +58,9 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
         "secretApprovalPolicyApproverUser.id"
       )
-      .leftJoin(
-        TableName.SecretApprovalPolicyGroupApprover,
-        `${TableName.SecretApprovalPolicy}.id`,
-        `${TableName.SecretApprovalPolicyGroupApprover}.policyId`
-      )
       .leftJoin(
         TableName.UserGroupMembership,
-        `${TableName.SecretApprovalPolicyGroupApprover}.approverGroupId`,
+        `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
         `${TableName.UserGroupMembership}.groupId`
       )
       .leftJoin<TUsers>(
@@ -172,13 +167,13 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverUserId",
             label: "approvers" as const,
             mapper: ({
-              approverUserId,
+              approverUserId: userId,
               approverEmail: email,
               approverUsername: username,
               approverLastName: lastName,
               approverFirstName: firstName
             }) => ({
-              userId: approverUserId,
+              userId,
               email,
               firstName,
               lastName,
@@ -189,13 +184,13 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverGroupUserId",
             label: "approvers" as const,
             mapper: ({
-              approverGroupUserId,
+              approverGroupUserId: userId,
               approverGroupEmail: email,
               approverGroupUsername: username,
               approverGroupLastName: lastName,
               approverGroupFirstName: firstName
             }) => ({
-              userId: approverGroupUserId,
+              userId,
               email,
               firstName,
               lastName,
@@ -278,14 +273,9 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicy}.id`,
           `${TableName.SecretApprovalPolicyApprover}.policyId`
         )
-        .leftJoin(
-          TableName.SecretApprovalPolicyGroupApprover,
-          `${TableName.SecretApprovalPolicy}.id`,
-          `${TableName.SecretApprovalPolicyGroupApprover}.policyId`
-        )
         .leftJoin(
           TableName.UserGroupMembership,
-          `${TableName.SecretApprovalPolicyGroupApprover}.approverGroupId`,
+          `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
         .join<TUsers>(
@@ -383,7 +373,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           {
             key: "approverUserId",
             label: "approvers" as const,
-            mapper: ({ approverUserI: userId }) => ({ userId })
+            mapper: ({ approverUserId }) => ({ userId: approverUserId })
           },
           {
             key: "commitId",
@@ -397,7 +387,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           {
             key: "approverGroupUserId",
             label: "approvers" as const,
-            mapper: ({ approverGroupUserId: userId }) => ({ userId })
+            mapper: ({ approverGroupUserId }) => ({ userId: approverGroupUserId })
           }
         ]
       });
@@ -430,14 +420,9 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicy}.id`,
           `${TableName.SecretApprovalPolicyApprover}.policyId`
         )
-        .leftJoin(
-          TableName.SecretApprovalPolicyGroupApprover,
-          `${TableName.SecretApprovalPolicy}.id`,
-          `${TableName.SecretApprovalPolicyGroupApprover}.policyId`
-        )
         .leftJoin(
           TableName.UserGroupMembership,
-          `${TableName.SecretApprovalPolicyGroupApprover}.approverGroupId`,
+          `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
         .join<TUsers>(
@@ -535,7 +520,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           {
             key: "approverUserId",
             label: "approvers" as const,
-            mapper: ({ approverUserId: userId }) => ({ userId })
+            mapper: ({ approverUserId }) => ({ userId: approverUserId })
           },
           {
             key: "commitId",
@@ -549,8 +534,8 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           {
             key: "approverGroupUserId",
             label: "approvers" as const,
-            mapper: ({ approverGroupUserId: userId }) => ({
+            mapper: ({ approverGroupUserId }) => ({
-              userId
+              userId: approverGroupUserId
             })
           }
         ]

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -447,8 +447,8 @@ export const secretApprovalRequestServiceFactory = ({
     );
     const hasMinApproval =
       secretApprovalRequest.policy.approvals <=
-      secretApprovalRequest.policy.approvers.filter(
+      secretApprovalRequest.policy.approvers.filter(({ userId: approverId }) =>
-        ({ userId: approverId }) => reviewers[approverId.toString()] === ApprovalStatus.APPROVED
+        approverId ? reviewers[approverId.toString()] === ApprovalStatus.APPROVED : null
       ).length;
     const isSoftEnforcement = secretApprovalRequest.policy.enforcementLevel === EnforcementLevel.Soft;
 
@@ -805,7 +805,7 @@ export const secretApprovalRequestServiceFactory = ({
       const requestedByUser = await userDAL.findOne({ id: actorId });
       const approverUsers = await userDAL.find({
         $in: {
-          id: policy.approvers.map((approver: { userId: string }) => approver.userId)
+          id: policy.approvers.map((approver: { userId: string | null | undefined }) => approver.userId!)
         }
       });
 

backend/src/server/routes/index.ts

@@ -7,7 +7,6 @@ import { registerCertificateEstRouter } from "@app/ee/routes/est/certificate-est
 import { registerV1EERoutes } from "@app/ee/routes/v1";
 import { accessApprovalPolicyApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
 import { accessApprovalPolicyDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-dal";
-import { accessApprovalPolicyGroupApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-group-approver-dal";
 import { accessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
 import { accessApprovalRequestDALFactory } from "@app/ee/services/access-approval-request/access-approval-request-dal";
 import { accessApprovalRequestReviewerDALFactory } from "@app/ee/services/access-approval-request/access-approval-request-reviewer-dal";
@@ -52,7 +51,6 @@ import { scimDALFactory } from "@app/ee/services/scim/scim-dal";
 import { scimServiceFactory } from "@app/ee/services/scim/scim-service";
 import { secretApprovalPolicyApproverDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-approver-dal";
 import { secretApprovalPolicyDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-dal";
-import { secretApprovalPolicyGroupApproverDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-group-approver-dal";
 import { secretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { secretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { secretApprovalRequestReviewerDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-reviewer-dal";
@@ -301,7 +299,6 @@ export const registerRoutes = async (
   const accessApprovalRequestReviewerDAL = accessApprovalRequestReviewerDALFactory(db);
 
   const sapApproverDAL = secretApprovalPolicyApproverDALFactory(db);
-  const sapGroupApproverDAL = secretApprovalPolicyGroupApproverDALFactory(db);
   const secretApprovalPolicyDAL = secretApprovalPolicyDALFactory(db);
   const secretApprovalRequestDAL = secretApprovalRequestDALFactory(db);
   const secretApprovalRequestReviewerDAL = secretApprovalRequestReviewerDALFactory(db);
@@ -381,7 +378,6 @@ export const registerRoutes = async (
   const secretApprovalPolicyService = secretApprovalPolicyServiceFactory({
     projectEnvDAL,
     secretApprovalPolicyApproverDAL: sapApproverDAL,
-    secretApprovalPolicyGroupApproverDAL: sapGroupApproverDAL,
     permissionService,
     secretApprovalPolicyDAL,
     licenseService
@@ -630,7 +626,6 @@ export const registerRoutes = async (
   const pkiAlertDAL = pkiAlertDALFactory(db);
   const pkiCollectionDAL = pkiCollectionDALFactory(db);
   const pkiCollectionItemDAL = pkiCollectionItemDALFactory(db);
-  const accessApprovalPolicyGroupApproverDAL = accessApprovalPolicyGroupApproverDALFactory(db);
 
   const certificateService = certificateServiceFactory({
     certificateDAL,
@@ -928,7 +923,6 @@ export const registerRoutes = async (
   const accessApprovalPolicyService = accessApprovalPolicyServiceFactory({
     accessApprovalPolicyDAL,
     accessApprovalPolicyApproverDAL,
-    accessApprovalPolicyGroupApproverDAL,
     groupDAL,
     permissionService,
     projectEnvDAL,
@@ -950,7 +944,6 @@ export const registerRoutes = async (
     accessApprovalPolicyApproverDAL,
     projectSlackConfigDAL,
     kmsService,
-    accessApprovalPolicyGroupApproverDAL,
     groupDAL
   });
 

frontend/src/hooks/api/accessApproval/mutation.tsx

@@ -21,7 +21,6 @@ export const useCreateAccessApprovalPolicy = () => {
       projectSlug,
       approvals,
       approvers,
-      groupApprovers,
       name,
       secretPath,
       enforcementLevel
@@ -31,7 +30,6 @@ export const useCreateAccessApprovalPolicy = () => {
         projectSlug,
         approvals,
         approvers,
-        groupApprovers,
         secretPath,
         name,
         enforcementLevel
@@ -48,11 +46,10 @@ export const useUpdateAccessApprovalPolicy = () => {
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TUpdateAccessPolicyDTO>({
-    mutationFn: async ({ id, approvers, groupApprovers, approvals, name, secretPath, enforcementLevel }) => {
+    mutationFn: async ({ id, approvers, approvals, name, secretPath, enforcementLevel }) => {
       const { data } = await apiRequest.patch(`/api/v1/access-approvals/policies/${id}`, {
         approvals,
         approvers,
-        groupApprovers,
         secretPath,
         name,
         enforcementLevel

frontend/src/hooks/api/accessApproval/types.ts

@@ -11,15 +11,23 @@ export type TAccessApprovalPolicy = {
   workspace: string;
   environment: WorkspaceEnv;
   projectId: string;
-  approvers: string[];
   policyType: PolicyType;
   approversRequired: boolean;
   enforcementLevel: EnforcementLevel;
   updatedAt: Date;
-  userApprovers?: { userId: string }[];
+  approvers?: Approver[];
-  groupApprovers?: { groupId: string }[];
 };
 
+export enum ApproverType{
+  User = "user",
+  Group = "group"
+}
+
+export type Approver ={
+  id: string;
+  type: ApproverType;
+}
+
 export type TAccessApprovalRequest = {
   id: string;
   policyId: string;
@@ -131,8 +139,7 @@ export type TCreateAccessPolicyDTO = {
   projectSlug: string;
   name?: string;
   environment: string;
-  approvers?: string[];
+  approvers?: Approver[];
-  groupApprovers?: string[];
   approvals?: number;
   secretPath?: string;
   enforcementLevel?: EnforcementLevel;
@@ -141,8 +148,7 @@ export type TCreateAccessPolicyDTO = {
 export type TUpdateAccessPolicyDTO = {
   id: string;
   name?: string;
-  approvers?: string[];
+  approvers?: Approver[];
-  groupApprovers?: string[];
   secretPath?: string;
   environment?: string;
   approvals?: number;

frontend/src/hooks/api/secretApproval/mutation.tsx

@@ -14,7 +14,6 @@ export const useCreateSecretApprovalPolicy = () => {
       workspaceId,
       approvals,
       approvers,
-      groupApprovers,
       secretPath,
       name,
       enforcementLevel
@@ -24,7 +23,6 @@ export const useCreateSecretApprovalPolicy = () => {
         workspaceId,
         approvals,
         approvers,
-        groupApprovers,
         secretPath,
         name,
         enforcementLevel
@@ -41,11 +39,10 @@ export const useUpdateSecretApprovalPolicy = () => {
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TUpdateSecretPolicyDTO>({
-    mutationFn: async ({ id, approvers, groupApprovers, approvals, secretPath, name, enforcementLevel }) => {
+    mutationFn: async ({ id, approvers, approvals, secretPath, name, enforcementLevel }) => {
       const { data } = await apiRequest.patch(`/api/v1/secret-approvals/${id}`, {
         approvals,
         approvers,
-        groupApprovers,
         secretPath,
         name,
         enforcementLevel

frontend/src/hooks/api/secretApproval/types.ts

@@ -9,12 +9,21 @@ export type TSecretApprovalPolicy = {
   environment: WorkspaceEnv;
   secretPath?: string;
   approvals: number;
-  userApprovers: { userId: string }[];
+  approvers: Approver[];
-  groupApprovers: { groupId: string }[];
   updatedAt: Date;
   enforcementLevel: EnforcementLevel;
 };
 
+export enum ApproverType{
+  User = "user",
+  Group = "group"
+}
+
+export type Approver ={
+  id: string;
+  type: ApproverType;
+}
+
 export type TGetSecretApprovalPoliciesDTO = {
   workspaceId: string;
 };
@@ -30,8 +39,7 @@ export type TCreateSecretPolicyDTO = {
   name?: string;
   environment: string;
   secretPath?: string | null;
-  approvers?: string[];
+  approvers?: Approver[];
-  groupApprovers?: string[];
   approvals?: number;
   enforcementLevel: EnforcementLevel;
 };
@@ -39,8 +47,7 @@ export type TCreateSecretPolicyDTO = {
 export type TUpdateSecretPolicyDTO = {
   id: string;
   name?: string;
-  approvers?: string[];
+  approvers?: Approver[];
-  groupApprovers?: string[];
   secretPath?: string | null;
   approvals?: number;
   enforcementLevel?: EnforcementLevel;

frontend/src/views/SecretApprovalPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx

@@ -27,7 +27,7 @@ import {
   useCreateAccessApprovalPolicy,
   useUpdateAccessApprovalPolicy
 } from "@app/hooks/api/accessApproval";
-import { TAccessApprovalPolicy } from "@app/hooks/api/accessApproval/types";
+import { ApproverType, TAccessApprovalPolicy } from "@app/hooks/api/accessApproval/types";
 import { EnforcementLevel, PolicyType } from "@app/hooks/api/policies/enums";
 import { TWorkspaceUser } from "@app/hooks/api/users/types";
 
@@ -45,13 +45,12 @@ const formSchema = z
     name: z.string().optional(),
     secretPath: z.string().optional(),
     approvals: z.number().min(1),
-    approvers: z.string().array().optional(),
+    approvers: z.object({type: z.nativeEnum(ApproverType), id: z.string()}).array().min(1).default([]),
-    groupApprovers: z.string().array().optional(),
     policyType: z.nativeEnum(PolicyType),
     enforcementLevel: z.nativeEnum(EnforcementLevel)
   })
-  .refine((data) => data.approvers || data.groupApprovers, {
+  .refine((data) => data.approvers, {
-    path: ["approvers", "groupApprovers"],
+    path: ["approvers"],
     message: "At least one approver should be provided."
   });
 
@@ -76,8 +75,7 @@ export const AccessPolicyForm = ({
       ? {
           ...editValues,
           environment: editValues.environment.slug,
-          approvers: editValues?.userApprovers?.map((user) => user.userId) || editValues?.approvers,
+          approvers: editValues?.approvers || [],
-          groupApprovers: editValues?.groupApprovers?.map((group) => group.groupId),
           approvals: editValues?.approvals
         }
       : undefined
@@ -291,15 +289,15 @@ export const AccessPolicyForm = ({
                       </DropdownMenuLabel>
                       {members.map(({ user }) => {
                         const { id: userId } = user;
-                        const isChecked = value?.includes(userId);
+                        const isChecked = value?.filter((el: {id: string, type: ApproverType}) => el.id === userId && el.type === ApproverType.User).length > 0;
                         return (
                           <DropdownMenuItem
                             onClick={(evt) => {
                               evt.preventDefault();
                               onChange(
                                 isChecked
-                                  ? value?.filter((el: string) => el !== userId)
+                                  ? value?.filter((el: {id: string, type: ApproverType}) => el.id !== userId && el.type !== ApproverType.User)
-                                  : [...(value || []), userId]
+                                  : [...(value || []), {id:userId, type: ApproverType.User}]
                               );
                             }}
                             key={`create-policy-members-${userId}`}
@@ -317,7 +315,7 @@ export const AccessPolicyForm = ({
             />
             <Controller
               control={control}
-              name="groupApprovers"
+              name="approvers"
               render={({ field: { value, onChange }, fieldState: { error } }) => (
                 <FormControl
                   label="Required Group Approvers"
@@ -341,15 +339,16 @@ export const AccessPolicyForm = ({
                       </DropdownMenuLabel>
                       {groups && groups.map(({ group }) => {
                         const { id } = group;
-                        const isChecked = value?.includes(id);
+                        const isChecked = value?.includes({id, type: ApproverType.Group});
+
                         return (
                           <DropdownMenuItem
                             onClick={(evt) => {
                               evt.preventDefault();
                               onChange(
                                 isChecked
-                                  ? value?.filter((el: string) => el !== id)
+                                  ? value?.filter((el: {id: string, type: ApproverType}) => el.id !== id && el.type !== ApproverType.Group)
-                                  : [...(value || []), id]
+                                  : [...(value || []), {id, type: ApproverType.Group}]
                               );
                             }}
                             key={`create-policy-members-${id}`}

frontend/src/views/SecretApprovalPage/components/ApprovalPolicyList/components/ApprovalPolicyRow.tsx

@@ -18,6 +18,7 @@ import { Badge } from "@app/components/v2/Badge";
 import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
 import { policyDetails } from "@app/helpers/policies";
 import { useUpdateAccessApprovalPolicy, useUpdateSecretApprovalPolicy } from "@app/hooks/api";
+import { Approver, ApproverType } from "@app/hooks/api/accessApproval/types";
 import { TGroupMembership } from "@app/hooks/api/groups/types";
 import { EnforcementLevel, PolicyType } from "@app/hooks/api/policies/enums";
 import { WorkspaceEnv } from "@app/hooks/api/types";
@@ -30,9 +31,7 @@ interface IPolicy {
   projectId?: string;
   secretPath?: string;
   approvals: number;
-  approvers?: string[];
+  approvers?: Approver[];
-  userApprovers?: { userId: string }[];
-  groupApprovers?: { groupId: string }[];
   updatedAt: Date;
   policyType: PolicyType;
   enforcementLevel: EnforcementLevel;
@@ -57,8 +56,8 @@ export const ApprovalPolicyRow = ({
   onEdit,
   onDelete
 }: Props) => {
-  const [selectedApprovers, setSelectedApprovers] = useState<string[]>(policy.userApprovers?.map(({ userId }) => userId) || policy.approvers || []);
+  const [selectedApprovers, setSelectedApprovers] = useState<Approver[]>(policy.approvers?.filter((approver) => approver.type === ApproverType.User) || []);
-  const [selectedGroupApprovers, setSelectedGroupApprovers] = useState<string[]>(policy.groupApprovers?.map(({ groupId }) => groupId) || []);
+  const [selectedGroupApprovers, setSelectedGroupApprovers] = useState<Approver[]>(policy.approvers?.filter((approver) => approver.type === ApproverType.Group) || []);
   const { mutate: updateAccessApprovalPolicy, isLoading: isAccessApprovalPolicyLoading } = useUpdateAccessApprovalPolicy();
   const { mutate: updateSecretApprovalPolicy, isLoading: isSecretApprovalPolicyLoading } = useUpdateSecretApprovalPolicy();
   const isLoading = isAccessApprovalPolicyLoading || isSecretApprovalPolicyLoading;
@@ -79,27 +78,30 @@ export const ApprovalPolicyRow = ({
                   {
                     projectSlug,
                     id: policy.id,
-                    approvers: selectedApprovers,
+                    approvers: selectedApprovers.concat(selectedGroupApprovers),
-                    groupApprovers: selectedGroupApprovers
                   },
-                  { onSettled: () => { } }
+                  {
+                    onError: () => {
+                      setSelectedApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.User) || []);
+                    }
+                  }
                 );
               } else {
                 updateSecretApprovalPolicy(
                   {
                     workspaceId,
                     id: policy.id,
-                    approvers: selectedApprovers,
+                    approvers: selectedApprovers.concat(selectedGroupApprovers),
-                    groupApprovers: selectedGroupApprovers
                   },
-                  { onSettled: () => { } }
+                  {
+                    onError: () => {
+                      setSelectedApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.User) || []);
+                    }
+                  }
                 );
               }
             } else {
-              setSelectedApprovers(policy.policyType === PolicyType.ChangePolicy
+              setSelectedApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.User) || []);
-                ? policy?.userApprovers?.map(({ userId }) => userId) || []
-                : policy?.approvers || []
-              );
             }
           }}
         >
@@ -125,13 +127,13 @@ export const ApprovalPolicyRow = ({
             </DropdownMenuLabel>
             {members?.map(({ user }) => {
               const userId = user.id;
-              const isChecked = selectedApprovers.includes(userId);
+              const isChecked = selectedApprovers?.filter((el: { id: string, type: ApproverType }) => el.id === userId && el.type === ApproverType.User).length > 0;
               return (
                 <DropdownMenuItem
                   onClick={(evt) => {
                     evt.preventDefault();
                     setSelectedApprovers((state) =>
-                      isChecked ? state.filter((el) => el !== userId) : [...state, userId]
+                      isChecked ? state.filter((el) => el.id !== userId || el.type !== ApproverType.User) : [...state, { id: userId, type: ApproverType.User }]
                     );
                   }}
                   key={`create-policy-members-${userId}`}
@@ -147,36 +149,39 @@ export const ApprovalPolicyRow = ({
       </Td>
       <Td>
         <DropdownMenu
-        onOpenChange={(isOpen) => {
+          onOpenChange={(isOpen) => {
-          if (!isOpen) {
+            if (!isOpen) {
-            if (policy.policyType === PolicyType.AccessPolicy) {
+              if (policy.policyType === PolicyType.AccessPolicy) {
-              updateAccessApprovalPolicy(
+                updateAccessApprovalPolicy(
-                {
+                  {
-                  projectSlug,
+                    projectSlug,
-                  id: policy.id,
+                    id: policy.id,
-                  approvers: selectedApprovers,
+                    approvers: selectedApprovers.concat(selectedGroupApprovers),
-                  groupApprovers: selectedGroupApprovers
+                  },
-                },
+                  {
-                { onSettled: () => { } }
+                    onError: () => {
-              );
+                      setSelectedGroupApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.Group) || []);
+                    }
+                  },
+                );
+              } else {
+                updateSecretApprovalPolicy(
+                  {
+                    workspaceId,
+                    id: policy.id,
+                    approvers: selectedApprovers.concat(selectedGroupApprovers),
+                  },
+                  {
+                    onError: () => {
+                      setSelectedGroupApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.Group) || []);
+                    }
+                  }
+                );
+              }
             } else {
-              updateSecretApprovalPolicy(
+              setSelectedGroupApprovers(policy?.approvers?.filter((approver) => approver.type === ApproverType.Group) || []);
-                {
-                  workspaceId,
-                  id: policy.id,
-                  approvers: selectedApprovers,
-                  groupApprovers: selectedGroupApprovers
-                },
-                { onSettled: () => { } }
-              );
             }
-          } else {
+          }}
-            setSelectedGroupApprovers(policy.policyType === PolicyType.ChangePolicy
-              ? policy?.groupApprovers?.map(({ groupId }) => groupId) || []
-              : policy?.groupApprovers?.map(({groupId}) => groupId) || []
-            );
-          }
-        }}
         >
           <DropdownMenuTrigger asChild>
             <Input
@@ -194,15 +199,15 @@ export const ApprovalPolicyRow = ({
             </DropdownMenuLabel>
             {groups && groups.map(({ group }) => {
               const { id } = group;
-              const isChecked = selectedGroupApprovers?.includes(id);
+              const isChecked = selectedGroupApprovers?.filter((el: { id: string, type: ApproverType }) => el.id === id && el.type === ApproverType.Group).length > 0;
               return (
                 <DropdownMenuItem
                   onClick={(evt) => {
                     evt.preventDefault();
                     setSelectedGroupApprovers(
                       isChecked
-                        ? selectedGroupApprovers?.filter((el: string) => el !== id)
+                        ? selectedGroupApprovers?.filter((el) => el.id !== id || el.type !== ApproverType.Group)
-                        : [...(selectedGroupApprovers || []), id]
+                        : [...(selectedGroupApprovers || []), { id, type: ApproverType.Group }]
                     );
                   }}
                   key={`create-policy-groups-${id}`}