From eca36f19934eec05945f25fa6c24eced1e29c0c3 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Wed, 3 Apr 2024 16:38:52 -0700
Subject: [PATCH] Feat: Request access

---
 .../access-approval-policy-fns.ts             | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts

diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts
new file mode 100644
index 000000000..b570c32fa
--- /dev/null
+++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts
@@ -0,0 +1,37 @@
+import { ForbiddenError, subject } from "@casl/ability";
+
+import { BadRequestError } from "@app/lib/errors";
+import { ActorType } from "@app/services/auth/auth-type";
+
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { TVerifyApprovers } from "./access-approval-policy-types";
+
+export const verifyApprovers = async ({
+  approverProjectMemberships,
+  projectId,
+  orgId,
+  envSlug,
+  actorAuthMethod,
+  secretPath,
+  permissionService
+}: TVerifyApprovers) => {
+  for (const approver of approverProjectMemberships) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      const { permission: approverPermission } = await permissionService.getProjectPermission(
+        ActorType.USER,
+        approver.userId,
+        projectId,
+        actorAuthMethod,
+        orgId
+      );
+
+      ForbiddenError.from(approverPermission).throwUnlessCan(
+        ProjectPermissionActions.Create,
+        subject(ProjectPermissionSub.Secrets, { environment: envSlug, secretPath })
+      );
+    } catch (err) {
+      throw new BadRequestError({ message: "One or more approvers doesn't have access to be specified secret path" });
+    }
+  }
+};