feat: greepy review

backend/src/ee/routes/v1/sub-org-router.ts

@@ -4,11 +4,11 @@ import { OrganizationsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, SUB_ORGANIZATIONS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { GenericResourceNameSchema } from "@app/server/lib/schemas";
 
-const sanitiziedSubOrganizationSchema = OrganizationsSchema.pick({
+const sanitizedSubOrganizationSchema = OrganizationsSchema.pick({
   id: true,
   name: true,
   slug: true,
@@ -26,7 +26,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     schema: {
       hide: false,
       tags: [ApiDocsTags.SubOrganizations],
-      description: "Create a child organization",
+      description: "Create a sub organization",
       security: [
         {
           bearerAuth: []
@@ -37,7 +37,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          organization: sanitiziedSubOrganizationSchema
+          organization: sanitizedSubOrganizationSchema
         })
       }
     },
@@ -45,21 +45,14 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     handler: async (req) => {
       const { organization } = await server.services.subOrganization.createSubOrg({
         name: req.body.name,
-        permissionActor: {
-          id: req.permission.id,
-          type: req.permission.type,
-          authMethod: req.permission.authMethod,
-          orgId: req.permission.orgId,
-          parentOrgId: req.permission.parentOrgId,
-          rootOrgId: req.permission.rootOrgId
-        }
+        permissionActor: req.permission
       });
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         orgId: req.permission.orgId,
         event: {
-          type: EventType.CREATE_CHILD_ORGANIZATION,
+          type: EventType.CREATE_SUB_ORGANIZATION,
           metadata: {
             name: req.body.name,
             organizationId: organization.id
@@ -80,7 +73,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
     schema: {
       hide: false,
       tags: [ApiDocsTags.SubOrganizations],
-      description: "List child organizations",
+      description: "List of sub organizations",
       security: [
         {
           bearerAuth: []
@@ -97,21 +90,14 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          organizations: sanitiziedSubOrganizationSchema.array()
+          organizations: sanitizedSubOrganizationSchema.array()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const { organizations } = await server.services.subOrganization.listSubOrgs({
-        permissionActor: {
-          id: req.permission.id,
-          type: req.permission.type,
-          authMethod: req.permission.authMethod,
-          orgId: req.permission.orgId,
-          parentOrgId: req.permission.orgId,
-          rootOrgId: req.permission.rootOrgId
-        },
+        permissionActor: req.permission,
         data: {
           limit: req.query.limit,
           offset: req.query.offset,

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -173,7 +173,7 @@ export enum EventType {
   UPDATE_TOKEN_IDENTITY_TOKEN_AUTH = "update-token-identity-token-auth",
   GET_TOKENS_IDENTITY_TOKEN_AUTH = "get-tokens-identity-token-auth",
 
-  CREATE_CHILD_ORGANIZATION = "create-child-organization",
+  CREATE_SUB_ORGANIZATION = "create-child-organization",
 
   ADD_IDENTITY_TOKEN_AUTH = "add-identity-token-auth",
   UPDATE_IDENTITY_TOKEN_AUTH = "update-identity-token-auth",
@@ -609,8 +609,8 @@ interface GetSecretsEvent {
   };
 }
 
-interface CreateChildOrganizationEvent {
-  type: EventType.CREATE_CHILD_ORGANIZATION;
+interface CreateSubOrganizationEvent {
+  type: EventType.CREATE_SUB_ORGANIZATION;
   metadata: {
     name: string;
     organizationId: string;
@@ -3873,7 +3873,7 @@ interface PamResourceDeleteEvent {
 }
 
 export type Event =
-  | CreateChildOrganizationEvent
+  | CreateSubOrganizationEvent
   | GetSecretsEvent
   | GetSecretEvent
   | CreateSecretEvent

backend/src/ee/services/permission/permission-service.ts

@@ -212,9 +212,9 @@ export const permissionServiceFactory = ({
     const rootOrgId = permissionData?.[0]?.rootOrgId;
     const isChild = Boolean(rootOrgId);
     if (scope === OrganizationActionScope.ParentOrganization && isChild) {
-      throw new BadRequestError({ message: `Child organization cannot do this operation` });
+      throw new ForbiddenRequestError({ message: `Child organization cannot do this operation` });
     } else if (scope === OrganizationActionScope.ChildOrganization && !isChild) {
-      throw new BadRequestError({ message: `Parent organization cannot do this operation` });
+      throw new ForbiddenRequestError({ message: `Parent organization cannot do this operation` });
     }
 
     const permissionFromRoles = permissionData.flatMap((membership) => {