Requested changes

backend/src/services/group-project/group-project-dal.ts

@@ -106,100 +106,14 @@ export const groupProjectDALFactory = (db: TDbClient) => {
             db.raw("?", [orgId])
           );
         })
-        .leftJoin(
-          TableName.GroupProjectMembership,
-          `${TableName.GroupProjectMembership}.groupId`,
-          `${TableName.Groups}.id`
-        )
-        .leftJoin(
-          TableName.GroupProjectMembershipRole,
-          `${TableName.GroupProjectMembershipRole}.projectMembershipId`,
-          `${TableName.GroupProjectMembership}.id`
-        )
-        .leftJoin(
-          TableName.ProjectRoles,
-          `${TableName.GroupProjectMembershipRole}.customRoleId`,
-          `${TableName.ProjectRoles}.id`
-        )
-        .leftJoin(TableName.Project, `${TableName.GroupProjectMembership}.projectId`, `${TableName.Project}.id`)
         .select(
-          db.ref("id").withSchema(TableName.Groups).as("groupId"),
-          db.ref("name").withSchema(TableName.Groups).as("groupName"),
-          db.ref("slug").withSchema(TableName.Groups).as("groupSlug"),
-          db.ref("orgId").withSchema(TableName.Groups),
-          db.ref("id").withSchema(TableName.GroupProjectMembership).as("projectMembershipId"),
-          db.ref("id").withSchema(TableName.Project).as("projectId"),
-          db.ref("name").withSchema(TableName.Project).as("projectName"),
-          db.ref("slug").withSchema(TableName.Project).as("projectSlug"),
-          db.ref("role").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("id").withSchema(TableName.GroupProjectMembershipRole).as("membershipRoleId"),
-          db.ref("customRoleId").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("name").withSchema(TableName.ProjectRoles).as("customRoleName"),
-          db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug"),
-          db.ref("temporaryMode").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("isTemporary").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("temporaryRange").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("temporaryAccessStartTime").withSchema(TableName.GroupProjectMembershipRole),
-          db.ref("temporaryAccessEndTime").withSchema(TableName.GroupProjectMembershipRole)
+          db.ref("id").withSchema(TableName.Groups),
+          db.ref("name").withSchema(TableName.Groups),
+          db.ref("slug").withSchema(TableName.Groups),
+          db.ref("orgId").withSchema(TableName.Groups)
         );
 
-      const groupsWithProjects = sqlNestRelationships({
-        data: docs,
-        parentMapper: ({ groupId, groupName, groupSlug, orgId: organizationId }) => ({
-          id: groupId,
-          name: groupName,
-          slug: groupSlug,
-          orgId: organizationId,
-          projectMemberships: []
-        }),
-        key: "groupId",
-        childrenMapper: [
-          {
-            label: "projectMemberships" as const,
-            key: "projectMembershipId",
-            mapper: ({ projectId, projectName, projectSlug, projectMembershipId }) => ({
-              id: projectMembershipId,
-              project: {
-                id: projectId,
-                name: projectName,
-                slug: projectSlug
-              },
-              roles: []
-            }),
-            childrenMapper: [
-              {
-                label: "roles" as const,
-                key: "membershipRoleId",
-                mapper: ({
-                  role,
-                  customRoleId,
-                  customRoleName,
-                  customRoleSlug,
-                  membershipRoleId,
-                  temporaryRange,
-                  temporaryMode,
-                  temporaryAccessEndTime,
-                  temporaryAccessStartTime,
-                  isTemporary
-                }) => ({
-                  id: membershipRoleId,
-                  role,
-                  customRoleId,
-                  customRoleName,
-                  customRoleSlug,
-                  temporaryRange,
-                  temporaryMode,
-                  temporaryAccessEndTime,
-                  temporaryAccessStartTime,
-                  isTemporary
-                })
-              }
-            ]
-          }
-        ]
-      });
-
-      return groupsWithProjects;
+      return docs;
     } catch (error) {
       throw new DatabaseError({ error, name: "FindByUserId" });
     }

backend/src/services/user/user-service.ts

@@ -1,4 +1,8 @@
+import { ForbiddenError } from "@casl/ability";
+
 import { SecretKeyEncoding } from "@app/db/schemas";
+import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
@@ -11,6 +15,7 @@ import { AuthMethod } from "../auth/auth-type";
 import { TGroupProjectDALFactory } from "../group-project/group-project-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
 import { TUserDALFactory } from "./user-dal";
+import { TListUserGroupsDTO } from "./user-types";
 
 type TUserServiceFactoryDep = {
   userDAL: Pick<
@@ -33,6 +38,7 @@ type TUserServiceFactoryDep = {
   tokenService: Pick<TAuthTokenServiceFactory, "createTokenForUser" | "validateTokenForUser">;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
   smtpService: Pick<TSmtpService, "sendMail">;
+  permissionService: TPermissionServiceFactory;
 };
 
 export type TUserServiceFactory = ReturnType<typeof userServiceFactory>;
@@ -44,7 +50,8 @@ export const userServiceFactory = ({
   projectMembershipDAL,
   groupProjectDAL,
   tokenService,
-  smtpService
+  smtpService,
+  permissionService
 }: TUserServiceFactoryDep) => {
   const sendEmailVerificationCode = async (username: string) => {
     const user = await userDAL.findOne({ username });
@@ -298,13 +305,24 @@ export const userServiceFactory = ({
     return updatedOrgMembership.projectFavorites;
   };
 
-  const listUserGroups = async (username: string, orgId: string) => {
+  const listUserGroups = async ({ username, actorOrgId, actor, actorId, actorAuthMethod }: TListUserGroupsDTO) => {
     const user = await userDAL.findOne({
       username
     });
 
-    const memberships = await groupProjectDAL.findByUserId(user.id, orgId);
+    // This makes it so the user can always read information about themselves, but no one else if they don't have the Members Read permission.
+    if (user.id !== actorId) {
+      const { permission } = await permissionService.getOrgPermission(
+        actor,
+        actorId,
+        actorOrgId,
+        actorAuthMethod,
+        actorOrgId
+      );
+      ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+    }
 
+    const memberships = await groupProjectDAL.findByUserId(user.id, actorOrgId);
     return memberships;
   };
 

backend/src/services/user/user-types.ts

@@ -0,0 +1,5 @@
+import { TOrgPermission } from "@app/lib/types";
+
+export type TListUserGroupsDTO = {
+  username: string;
+} & Omit<TOrgPermission, "orgId">;