awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove role and roleId from group project membership

Browse Source
This commit is contained in:
Tuan Dang
2024-04-03 20:30:14 -07:00
parent 457edef5fe
commit e1d9f779b2
7 changed files with 6 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/src/db/migrations/20240318183910_group.ts
View File

@@ -37,9 +37,6 @@ export async function up(knex: Knex): Promise<void> {
if (!(await knex.schema.hasTable(TableName.GroupProjectMembership))) {
await knex.schema.createTable(TableName.GroupProjectMembership, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.string("role").notNullable();
t.uuid("roleId");
t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("groupId").notNullable();

2
backend/src/db/schemas/group-project-memberships.ts
View File

@@ -9,8 +9,6 @@ import { TImmutableDBKeys } from "./models";
export const GroupProjectMembershipsSchema = z.object({
id: z.string().uuid(),
role: z.string(),
roleId: z.string().uuid().nullable().optional(),
projectId: z.string(),
groupId: z.string().uuid(),
createdAt: z.date(),

2
backend/src/ee/services/license/__mocks__/licence-fns.ts
View File

@@ -12,7 +12,7 @@ export const getDefaultOnPremFeatures = () => {
secretVersioning: true,
pitRecovery: false,
ipAllowlisting: true,
rbac: false,
rbac: true,
customRateLimits: false,
customAlerts: false,
auditLogs: false,

2
backend/src/ee/services/license/licence-fns.ts
View File

@@ -19,7 +19,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
secretVersioning: true,
pitRecovery: false,
ipAllowlisting: false,
rbac: false,
rbac: true,
customRateLimits: false,
customAlerts: false,
auditLogs: false,

2
backend/src/ee/services/license/license-types.ts
View File

@@ -35,7 +35,7 @@ export type TFeatureSet = {
secretVersioning: true;
pitRecovery: false;
ipAllowlisting: false;
rbac: false;
rbac: true;
customRateLimits: false;
customAlerts: false;
auditLogs: false;

13
backend/src/ee/services/permission/permission-dal.ts
View File

@@ -73,7 +73,6 @@ export const permissionDALFactory = (db: TDbClient) => {
.select(
db.ref("id").withSchema(TableName.GroupProjectMembership).as("membershipId"),
// TODO(roll-forward-migration): remove this field when we drop this in next migration after a week
db.ref("role").withSchema(TableName.GroupProjectMembership).as("oldRoleField"),
db.ref("createdAt").withSchema(TableName.GroupProjectMembership).as("membershipCreatedAt"),
db.ref("updatedAt").withSchema(TableName.GroupProjectMembership).as("membershipUpdatedAt"),
db.ref("projectId").withSchema(TableName.GroupProjectMembership),
@@ -102,7 +101,6 @@ export const permissionDALFactory = (db: TDbClient) => {
.select(
db.ref("id").withSchema(TableName.ProjectMembership).as("membershipId"),
// TODO(roll-forward-migration): remove this field when we drop this in next migration after a week
db.ref("role").withSchema(TableName.ProjectMembership).as("oldRoleField"),
db.ref("createdAt").withSchema(TableName.ProjectMembership).as("membershipCreatedAt"),
db.ref("updatedAt").withSchema(TableName.ProjectMembership).as("membershipUpdatedAt"),
db.ref("projectId").withSchema(TableName.ProjectMembership),
@@ -115,18 +113,11 @@ export const permissionDALFactory = (db: TDbClient) => {
const permission = sqlNestRelationships({
data: docs.concat(groupDocs),
key: "projectId",
parentMapper: ({
orgId,
orgAuthEnforced,
membershipId,
membershipCreatedAt,
membershipUpdatedAt,
oldRoleField
}) => ({
parentMapper: ({ orgId, orgAuthEnforced, membershipId, membershipCreatedAt, membershipUpdatedAt, role }) => ({
orgId,
orgAuthEnforced,
userId,
role: oldRoleField,
role,
id: membershipId,
projectId,
createdAt: membershipCreatedAt,

18
backend/src/services/group-project/group-project-service.ts
View File

@@ -102,9 +102,7 @@ export const groupProjectServiceFactory = ({
const groupProjectMembership = await groupProjectDAL.create(
{
groupId: group.id,
projectId: project.id,
role: isCustomRole ? ProjectMembershipRole.Custom : role,
roleId: customRole?.id
projectId: project.id
},
tx
);
@@ -212,14 +210,6 @@ export const groupProjectServiceFactory = ({
const projectGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id });
if (!projectGroup) throw new BadRequestError({ message: `Failed to find group with slug ${groupSlug}` });
const { permission: groupRolePermission } = await permissionService.getProjectPermissionByRole(
projectGroup.role,
project.id
);
const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
if (!hasRequiredPriviledges) throw new ForbiddenRequestError({ message: "Failed to delete more privileged group" });
// validate custom roles input
const customInputRoles = roles.filter(
({ role }) => !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole)
@@ -295,12 +285,6 @@ export const groupProjectServiceFactory = ({
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Groups);
const { permission: groupRolePermission } = await permissionService.getProjectPermissionByRole(
groupProjectMembership.role,
project.id
);
const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
if (!hasRequiredPriviledges) throw new ForbiddenRequestError({ message: "Failed to delete more privileged group" });
const groupMembers = await userGroupMembershipDAL.findGroupMembersNotInProject(group.id, project.id);