feat: greepy review

backend/src/db/migrations/20251018061215_sub-org.ts

@@ -14,8 +14,14 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("rootOrgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
 
       t.dropUnique(["slug"]);
-      t.unique(["rootOrgId", "parentOrgId", "slug"]);
     });
+
+    // had to switch to raw for null not distinct
+    await knex.raw(`
+ALTER TABLE "organization"
+ADD CONSTRAINT "organization_root_parent_slug_unique"
+UNIQUE ("rootOrgId", "parentOrgId", "slug") NULLS NOT DISTINCT;
+`);
   }
 
   const hasIdentityOrgCol = await knex.schema.hasColumn(TableName.Identity, "orgId");

backend/src/db/seeds/5-machine-identity.ts

@@ -24,7 +24,8 @@ export async function seed(knex: Knex): Promise<void> {
       // @ts-ignore
       id: seedData1.machineIdentity.id,
       name: seedData1.machineIdentity.name,
-      authMethod: IdentityAuthMethod.UNIVERSAL_AUTH
+      authMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
+      orgId: seedData1.organization.id
     }
   ]);
   const identityUa = await knex(TableName.IdentityUniversalAuth)

backend/src/ee/routes/v1/sub-org-router.ts

@@ -4,11 +4,11 @@ import { OrganizationsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, SUB_ORGANIZATIONS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 
-const sanitiziedSubOrganizationSchema = OrganizationsSchema.pick({
+const sanitizedSubOrganizationSchema = OrganizationsSchema.pick({
   id: true,
   name: true,
   slug: true,
@@ -26,7 +26,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     schema: {
       hide: false,
       tags: [ApiDocsTags.SubOrganizations],
-      description: "Create a child organization",
+      description: "Create a sub organization",
       security: [
         {
           bearerAuth: []
@@ -37,7 +37,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          organization: sanitiziedSubOrganizationSchema
+          organization: sanitizedSubOrganizationSchema
         })
       }
     },
@@ -45,21 +45,14 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     handler: async (req) => {
       const { organization } = await server.services.subOrganization.createSubOrg({
         name: req.body.name,
-        permissionActor: {
-          id: req.permission.id,
-          type: req.permission.type,
-          authMethod: req.permission.authMethod,
-          orgId: req.permission.orgId,
-          parentOrgId: req.permission.parentOrgId,
-          rootOrgId: req.permission.rootOrgId
-        }
+        permissionActor: req.permission
       });
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         orgId: req.permission.orgId,
         event: {
-          type: EventType.CREATE_CHILD_ORGANIZATION,
+          type: EventType.CREATE_SUB_ORGANIZATION,
           metadata: {
             name: req.body.name,
             organizationId: organization.id
@@ -80,7 +73,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     schema: {
       hide: false,
       tags: [ApiDocsTags.SubOrganizations],
-      description: "List child organizations",
+      description: "List of sub organizations",
       security: [
         {
           bearerAuth: []
@@ -97,21 +90,14 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          organizations: sanitiziedSubOrganizationSchema.array()
+          organizations: sanitizedSubOrganizationSchema.array()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const { organizations } = await server.services.subOrganization.listSubOrgs({
-        permissionActor: {
-          id: req.permission.id,
-          type: req.permission.type,
-          authMethod: req.permission.authMethod,
-          orgId: req.permission.orgId,
-          parentOrgId: req.permission.orgId,
-          rootOrgId: req.permission.rootOrgId
-        },
+        permissionActor: req.permission,
         data: {
           limit: req.query.limit,
           offset: req.query.offset,

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -173,7 +173,7 @@ export enum EventType {
   UPDATE_TOKEN_IDENTITY_TOKEN_AUTH = "update-token-identity-token-auth",
   GET_TOKENS_IDENTITY_TOKEN_AUTH = "get-tokens-identity-token-auth",
 
-  CREATE_CHILD_ORGANIZATION = "create-child-organization",
+  CREATE_SUB_ORGANIZATION = "create-child-organization",
 
   ADD_IDENTITY_TOKEN_AUTH = "add-identity-token-auth",
   UPDATE_IDENTITY_TOKEN_AUTH = "update-identity-token-auth",
@@ -609,8 +609,8 @@ interface GetSecretsEvent {
   };
 }
 
-interface CreateChildOrganizationEvent {
-  type: EventType.CREATE_CHILD_ORGANIZATION;
+interface CreateSubOrganizationEvent {
+  type: EventType.CREATE_SUB_ORGANIZATION;
   metadata: {
     name: string;
     organizationId: string;
@@ -3873,7 +3873,7 @@ interface PamResourceDeleteEvent {
 }
 
 export type Event =
-  | CreateChildOrganizationEvent
+  | CreateSubOrganizationEvent
   | GetSecretsEvent
   | GetSecretEvent
   | CreateSecretEvent

backend/src/ee/services/permission/permission-service.ts

@@ -212,9 +212,9 @@ export const permissionServiceFactory = ({
     const rootOrgId = permissionData?.[0]?.rootOrgId;
     const isChild = Boolean(rootOrgId);
     if (scope === OrganizationActionScope.ParentOrganization && isChild) {
-      throw new BadRequestError({ message: `Child organization cannot do this operation` });
+      throw new ForbiddenRequestError({ message: `Child organization cannot do this operation` });
     } else if (scope === OrganizationActionScope.ChildOrganization && !isChild) {
-      throw new BadRequestError({ message: `Parent organization cannot do this operation` });
+      throw new ForbiddenRequestError({ message: `Parent organization cannot do this operation` });
     }
 
     const permissionFromRoles = permissionData.flatMap((membership) => {

backend/src/lib/api-docs/constants.ts

@@ -719,12 +719,12 @@ export const ORGANIZATIONS = {
 
 export const SUB_ORGANIZATIONS = {
   CREATE: {
-    name: "The name of the child organization to create."
+    name: "The name of the sub organization to create."
   },
   LIST: {
-    limit: "The number of child organizations to return.",
-    offset: "The offset to start from. If you enter 10, it will start from the 10th child organization.",
-    isAccessible: "Filter to only return child organizations that the actor has access to."
+    limit: "The number of sub organizations to return.",
+    offset: "The offset to start from. If you enter 10, it will start from the 10th sub organization.",
+    isAccessible: "Filter to only return sub organizations that the actor has access to."
   }
 } as const;
 

backend/src/server/plugins/auth/inject-identity.ts

@@ -8,10 +8,10 @@ import { TScimTokenJwtPayload } from "@app/ee/services/scim/scim-types";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError } from "@app/lib/errors";
+import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 import { ActorType, AuthMethod, AuthMode, AuthModeJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type";
 import { TIdentityAccessTokenJwtPayload } from "@app/services/identity-access-token/identity-access-token-types";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
-import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 
 export type TAuthMode =
   | {
@@ -243,7 +243,7 @@ export const injectIdentity = fp(
           requestContext.set("orgId", orgId);
 
           if (subOrganizationSelector)
-            throw new BadRequestError({ message: `Service token doesn't support sub organization selector` });
+            throw new BadRequestError({ message: `SCIM token doesn't support sub organization selector` });
 
           req.auth = {
             authMode: AuthMode.SCIM_TOKEN,

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -216,7 +216,7 @@ export const identityAccessTokenServiceFactory = ({
 
     if (subOrganizationSelector) {
       const subOrganization = await orgDAL.findOne({ rootOrgId, slug: subOrganizationSelector });
-      if (!subOrganizationSelector)
+      if (!subOrganization)
         throw new BadRequestError({ message: `Sub organization ${subOrganizationSelector} not found` });
 
       const identityOrgMembership = await membershipIdentityDAL.findOne({

backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts

@@ -24,9 +24,9 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
-import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -23,9 +23,9 @@ import {
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
-import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -20,9 +20,9 @@ import {
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
-import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -20,9 +20,9 @@ import {
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
-import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { validateIdentityUpdateForSuperAdminPrivileges } from "../super-admin/super-admin-fns";

backend/src/services/identity-ua/identity-ua-service.ts

@@ -23,6 +23,7 @@ import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from
 import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
+import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
 import { TMembershipIdentityDALFactory } from "../membership-identity/membership-identity-dal";
@@ -41,7 +42,6 @@ import {
   TRevokeUaDTO,
   TUpdateUaDTO
 } from "./identity-ua-types";
-import { TIdentityDALFactory } from "../identity/identity-dal";
 
 type TIdentityUaServiceFactoryDep = {
   identityDAL: Pick<TIdentityDALFactory, "findById">;
@@ -314,10 +314,6 @@ export const identityUaServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
     }
 
-    if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
-      throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
-    }
-
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
     }

backend/src/services/membership-identity/membership-identity-dal.ts

@@ -356,7 +356,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
     }
   };
 
-  // this right nwo only support sub organization
+  // this right now only support sub organization
   const listAvailableIdentities = async (orgId: string, rootOrgId: string) => {
     try {
       const usersConnectedToOrg = db
@@ -381,7 +381,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
 
       return docs;
     } catch (error) {
-      throw new DatabaseError({ error, name: "ListAvailableUsers" });
+      throw new DatabaseError({ error, name: "ListAvailableIdentities" });
     }
   };
 

backend/src/services/membership-identity/org/org-membership-identity-factory.ts

@@ -57,7 +57,7 @@ export const newOrgMembershipIdentityFactory = ({
 
     const identityDetails = await identityDAL.findById(dto.data.identityId);
     if (identityDetails.orgId !== dto.permission.rootOrgId) {
-      throw new BadRequestError({ message: "Only identites from parent organization can be invited" });
+      throw new BadRequestError({ message: "Only identities from parent organization can be invited" });
     }
 
     const permissionRoles = await permissionService.getOrgPermissionByRoles(
@@ -143,11 +143,11 @@ export const newOrgMembershipIdentityFactory = ({
       scope: OrganizationActionScope.ChildOrganization
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Create, OrgPermissionSubjects.Identity);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Delete, OrgPermissionSubjects.Identity);
 
     const identityDetails = await identityDAL.findById(dto.selector.identityId);
     if (identityDetails.orgId !== dto.permission.rootOrgId) {
-      throw new BadRequestError({ message: "Only identites from parent organization can do this operation" });
+      throw new BadRequestError({ message: "Only identities from parent organization can do this operation" });
     }
 
     if (identityDetails.orgId === dto.permission.orgId) {

backend/src/services/membership-user/membership-user-dal.ts

@@ -291,7 +291,7 @@ export const membershipUserDALFactory = (db: TDbClient) => {
     }
   };
 
-  // this right nwo only support sub organization
+  // this right now only support sub organization
   const listAvailableUsers = async (orgId: string, rootOrgId: string) => {
     try {
       const usersConnectedToOrg = db

backend/src/services/membership-user/org/org-membership-user-factory.ts

@@ -92,10 +92,15 @@ export const newOrgMembershipUserFactory = ({
         },
         scopeOrgId: org.rootOrgId
       });
-      if (rootOrgMembership.length !== newMembers.length)
+      if (rootOrgMembership.length !== newMembers.length) {
+        const emails = newMembers
+          .filter((user) => !rootOrgMembership.find((i) => i.actorUserId === user.id))
+          .map((el) => el.email)
+          .join(",");
         throw new BadRequestError({
-          message: "User doesn't have membership in root organization"
+          message: `Users with email ${emails}  doesn't have membership in root organization`
         });
+      }
     }
   };