Remove role and roleId from group project membership

backend/src/db/migrations/20240318183910_group.ts

@@ -37,9 +37,6 @@ export async function up(knex: Knex): Promise<void> {
   if (!(await knex.schema.hasTable(TableName.GroupProjectMembership))) {
     await knex.schema.createTable(TableName.GroupProjectMembership, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("role").notNullable();
-      t.uuid("roleId");
-      t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
       t.string("projectId").notNullable();
       t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
       t.uuid("groupId").notNullable();

backend/src/db/schemas/group-project-memberships.ts

@@ -9,8 +9,6 @@ import { TImmutableDBKeys } from "./models";
 
 export const GroupProjectMembershipsSchema = z.object({
   id: z.string().uuid(),
-  role: z.string(),
-  roleId: z.string().uuid().nullable().optional(),
   projectId: z.string(),
   groupId: z.string().uuid(),
   createdAt: z.date(),

backend/src/ee/services/license/__mocks__/licence-fns.ts

@@ -12,7 +12,7 @@ export const getDefaultOnPremFeatures = () => {
     secretVersioning: true,
     pitRecovery: false,
     ipAllowlisting: true,
-    rbac: false,
+    rbac: true,
     customRateLimits: false,
     customAlerts: false,
     auditLogs: false,

backend/src/ee/services/license/licence-fns.ts

@@ -19,7 +19,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   secretVersioning: true,
   pitRecovery: false,
   ipAllowlisting: false,
-  rbac: false,
+  rbac: true,
   customRateLimits: false,
   customAlerts: false,
   auditLogs: false,

backend/src/ee/services/license/license-types.ts

@@ -35,7 +35,7 @@ export type TFeatureSet = {
   secretVersioning: true;
   pitRecovery: false;
   ipAllowlisting: false;
-  rbac: false;
+  rbac: true;
   customRateLimits: false;
   customAlerts: false;
   auditLogs: false;

backend/src/ee/services/permission/permission-dal.ts

@@ -73,7 +73,6 @@ export const permissionDALFactory = (db: TDbClient) => {
         .select(
           db.ref("id").withSchema(TableName.GroupProjectMembership).as("membershipId"),
           // TODO(roll-forward-migration): remove this field when we drop this in next migration after a week
-          db.ref("role").withSchema(TableName.GroupProjectMembership).as("oldRoleField"),
           db.ref("createdAt").withSchema(TableName.GroupProjectMembership).as("membershipCreatedAt"),
           db.ref("updatedAt").withSchema(TableName.GroupProjectMembership).as("membershipUpdatedAt"),
           db.ref("projectId").withSchema(TableName.GroupProjectMembership),
@@ -102,7 +101,6 @@ export const permissionDALFactory = (db: TDbClient) => {
         .select(
           db.ref("id").withSchema(TableName.ProjectMembership).as("membershipId"),
           // TODO(roll-forward-migration): remove this field when we drop this in next migration after a week
-          db.ref("role").withSchema(TableName.ProjectMembership).as("oldRoleField"),
           db.ref("createdAt").withSchema(TableName.ProjectMembership).as("membershipCreatedAt"),
           db.ref("updatedAt").withSchema(TableName.ProjectMembership).as("membershipUpdatedAt"),
           db.ref("projectId").withSchema(TableName.ProjectMembership),
@@ -115,18 +113,11 @@ export const permissionDALFactory = (db: TDbClient) => {
       const permission = sqlNestRelationships({
         data: docs.concat(groupDocs),
         key: "projectId",
-        parentMapper: ({
+        parentMapper: ({ orgId, orgAuthEnforced, membershipId, membershipCreatedAt, membershipUpdatedAt, role }) => ({
-          orgId,
-          orgAuthEnforced,
-          membershipId,
-          membershipCreatedAt,
-          membershipUpdatedAt,
-          oldRoleField
-        }) => ({
           orgId,
           orgAuthEnforced,
           userId,
-          role: oldRoleField,
+          role,
           id: membershipId,
           projectId,
           createdAt: membershipCreatedAt,

backend/src/services/group-project/group-project-service.ts

@@ -102,9 +102,7 @@ export const groupProjectServiceFactory = ({
       const groupProjectMembership = await groupProjectDAL.create(
         {
           groupId: group.id,
-          projectId: project.id,
+          projectId: project.id
-          role: isCustomRole ? ProjectMembershipRole.Custom : role,
-          roleId: customRole?.id
         },
         tx
       );
@@ -212,14 +210,6 @@ export const groupProjectServiceFactory = ({
     const projectGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id });
     if (!projectGroup) throw new BadRequestError({ message: `Failed to find group with slug ${groupSlug}` });
 
-    const { permission: groupRolePermission } = await permissionService.getProjectPermissionByRole(
-      projectGroup.role,
-      project.id
-    );
-
-    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
-    if (!hasRequiredPriviledges) throw new ForbiddenRequestError({ message: "Failed to delete more privileged group" });
-
     // validate custom roles input
     const customInputRoles = roles.filter(
       ({ role }) => !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole)
@@ -295,12 +285,6 @@ export const groupProjectServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Groups);
-    const { permission: groupRolePermission } = await permissionService.getProjectPermissionByRole(
-      groupProjectMembership.role,
-      project.id
-    );
-    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, groupRolePermission);
-    if (!hasRequiredPriviledges) throw new ForbiddenRequestError({ message: "Failed to delete more privileged group" });
 
     const groupMembers = await userGroupMembershipDAL.findGroupMembersNotInProject(group.id, project.id);