feat: changed req.auth.userId to permission.id to satisfy type error

backend-pg/src/ee/routes/v1/org-role-router.ts

@@ -26,8 +26,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const role = await server.services.orgRole.createRole(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.body
       );
@@ -57,8 +58,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const role = await server.services.orgRole.updateRole(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.params.roleId,
         req.body
@@ -83,8 +85,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const role = await server.services.orgRole.deleteRole(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.params.roleId
       );
@@ -111,8 +114,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const roles = await server.services.orgRole.listRoles(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { data: { roles } };
@@ -135,8 +139,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const { permissions, membership } = await server.services.orgRole.getUserPermission(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { permissions, membership };

backend-pg/src/ee/routes/v1/project-role-router.ts

@@ -141,8 +141,9 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      
       const { permissions, membership } = await server.services.projectRole.getUserPermission(
-        req.auth.userId,
+        req.permission.id,
         req.params.projectId
       );
       return { data: { permissions, membership } };

backend-pg/src/ee/services/permission/permission-dal.ts

@@ -78,7 +78,6 @@ export const permissionDalFactory = (db: TDbClient) => {
         .select(selectAllTableCols(TableName.IdentityProjectMembership))
         .select("permissions")
         .first();
-
       return membership;
     } catch (error) {
       throw new DatabaseError({ error, name: "GetProjectIdentityPermission" });

backend-pg/src/ee/services/permission/permission-service.ts

@@ -1,7 +1,14 @@
 import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, unpackRules } from "@casl/ability/extra";
+import { MongoQuery } from "@ucast/mongo2js";
 
-import { OrgMembershipRole, ProjectMembershipRole, ServiceTokenScopes } from "@app/db/schemas";
+import {
+  OrgMembershipRole,
+  ProjectMembershipRole,
+  ServiceTokenScopes,
+  TIdentityProjectMemberships,
+  TProjectMemberships
+} from "@app/db/schemas";
 import { conditionsMatcher } from "@app/lib/casl";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -170,18 +177,31 @@ export const permissionServiceFactory = ({
     const scopes = ServiceTokenScopes.parse(serviceToken.scopes || []);
     return {
       permission: buildServiceTokenProjectPermission(scopes, serviceToken.permissions),
-      member: undefined
+      membership: undefined
     };
   };
 
-  const getProjectPermission = async (type: ActorType, id: string, projectId: string) => {
+  type TProjectPermissionRT<T extends ActorType> = T extends ActorType.SERVICE
+    ? { permission: MongoAbility<ProjectPermissionSet, MongoQuery>; membership: undefined }
+    : {
+        permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
+        membership: (T extends ActorType.USER
+          ? TProjectMemberships
+          : TIdentityProjectMemberships) & { permissions?: unknown };
+      };
+
+  const getProjectPermission = async <T extends ActorType>(
+    type: T,
+    id: string,
+    projectId: string
+  ): Promise<TProjectPermissionRT<T>> => {
     switch (type) {
       case ActorType.USER:
-        return getUserProjectPermission(id, projectId);
+        return getUserProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
       case ActorType.SERVICE:
-        return getServiceTokenProjectPermission(id, projectId);
+        return getServiceTokenProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
       case ActorType.IDENTITY:
-        return getIdentityProjectPermission(id, projectId);
+        return getIdentityProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
       default:
         throw new UnauthorizedError({
           message: "Permission not defined",

backend-pg/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -73,7 +73,14 @@ export const secretApprovalRequestServiceFactory = ({
   secretQueueService
 }: TSecretApprovalRequestServiceFactoryDep) => {
   const requestCount = async ({ projectId, actor, actorId }: TApprovalRequestCountDTO) => {
-    const { membership } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    if (actor === ActorType.SERVICE)
+      throw new BadRequestError({ message: "Cannot use service token" });
+
+    const { membership } = await permissionService.getProjectPermission(
+      actor as ActorType.USER,
+      actorId,
+      projectId
+    );
     const count = await secretApprovalRequestDal.findProjectRequestCount(projectId, membership.id);
     return count;
   };
@@ -86,6 +93,9 @@ export const secretApprovalRequestServiceFactory = ({
     environment,
     committer
   }: TListApprovalsDTO) => {
+    if (actor === ActorType.SERVICE)
+      throw new BadRequestError({ message: "Cannot use service token" });
+
     const { membership } = await permissionService.getProjectPermission(actor, actorId, projectId);
     const approvals = await secretApprovalRequestDal.findByProjectId({
       projectId,
@@ -98,6 +108,9 @@ export const secretApprovalRequestServiceFactory = ({
   };
 
   const getSecretApprovalDetails = async ({ actor, actorId, id }: TSecretApprovalDetailsDTO) => {
+    if (actor === ActorType.SERVICE)
+      throw new BadRequestError({ message: "Cannot use service token" });
+
     const secretApprovalRequest = await secretApprovalRequestDal.findById(id);
     if (!secretApprovalRequest)
       throw new BadRequestError({ message: "Secret approval request not found" });
@@ -393,6 +406,9 @@ export const secretApprovalRequestServiceFactory = ({
     secretPath,
     environment
   }: TGenerateSecretApprovalRequestDTO) => {
+    if (actor === ActorType.SERVICE)
+      throw new BadRequestError({ message: "Cannot use service token" });
+
     const { permission, membership } = await permissionService.getProjectPermission(
       actor,
       actorId,

backend-pg/src/ee/services/secret-scanning/secret-scanning-service.ts

@@ -1,7 +1,7 @@
 import crypto from "node:crypto";
 
 import { ForbiddenError } from "@casl/ability";
-import { PushEvent } from "@octokit/webhooks-types";
+import { WebhookEventMap } from "@octokit/webhooks-types";
 import { ProbotOctokit } from "probot";
 
 import {
@@ -146,7 +146,7 @@ export const secretScanningServiceFactory = ({
     return { risk };
   };
 
-  const handleRepoPushEvent = async (payload: PushEvent) => {
+  const handleRepoPushEvent = async (payload: WebhookEventMap["push"]) => {
     const { commits, repository, installation, pusher } = payload;
     if (!commits || !repository || !installation || !pusher) {
       return;

backend-pg/src/server/plugins/audit-log.ts

@@ -44,7 +44,7 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
         type: ActorType.USER,
         metadata: {
           email: req.auth.user.email,
-          userId: req.auth.userId
+          userId: req.permission.id
         }
       };
     } else if (req.auth.actor === ActorType.SERVICE) {

backend-pg/src/server/plugins/auth/superAdmin.ts

@@ -1,9 +1,10 @@
 import { FastifyRequest } from "fastify";
 
 import { UnauthorizedError } from "@app/lib/errors";
+import { ActorType } from "@app/services/auth/auth-type";
 
 export const verifySuperAdmin = async <T extends FastifyRequest>(req: T) => {
-  if (!req.auth.user.superAdmin)
+  if (req.auth.actor !== ActorType.USER || !req.auth.user.superAdmin)
     throw new UnauthorizedError({
       name: "Unauthorized access",
       message: "Requires superadmin access"

backend-pg/src/server/plugins/secret-scanner.ts

@@ -22,7 +22,7 @@ export const registerSecretScannerGhApp = async (server: FastifyZodProvider) =>
 
     app.on("push", async (context) => {
       const { payload } = context;
-      await server.services.secretScanning.handleRepoPushEvent(payload);
+      await server.services.secretScanning.handleRepoPushEvent(payload as any);
     });
   };
 

backend-pg/src/server/routes/v1/auth-router.ts

@@ -25,7 +25,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
     handler: async (req, res) => {
       const appCfg = getConfig();
       if (req.auth.authMode === AuthMode.JWT) {
-        await server.services.login.logout(req.auth.userId, req.auth.tokenVersionId);
+        await server.services.login.logout(req.permission.id, req.auth.tokenVersionId);
       }
       res.cookie("jid", "", {
         httpOnly: true,

backend-pg/src/server/routes/v1/invite-org-router.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 
 import { UsersSchema } from "@app/db/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
+import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
 export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -22,9 +22,10 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
       const completeInviteLink = await server.services.org.inviteUserToOrganization({
         orgId: req.body.organizationId,
-        userId: req.auth.userId,
+        userId: req.permission.id,
         inviteeEmail: req.body.inviteeEmail
       });
 

backend-pg/src/server/routes/v1/organization-router.ts

@@ -22,7 +22,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const organizations = await server.services.org.findAllOrganizationOfUser(req.auth.userId);
+      const organizations = await server.services.org.findAllOrganizationOfUser(req.permission.id);
       return { organizations };
     }
   });
@@ -43,7 +43,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const organization = await server.services.org.findOrganizationById(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { organization };
@@ -77,7 +77,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const users = await server.services.org.findAllOrgMembers(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { users };
@@ -102,7 +102,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const organization = await server.services.org.updateOrgName(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.body.name
       );
@@ -127,7 +127,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const incidentContactsOrg = await req.server.services.org.findIncidentContacts(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { incidentContactsOrg };
@@ -149,7 +149,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const incidentContactsOrg = await req.server.services.org.createIncidentContact(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.body.email
       );
@@ -172,7 +172,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const incidentContactsOrg = await req.server.services.org.deleteIncidentContact(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId,
         req.params.incidentContactId
       );

backend-pg/src/server/routes/v1/password-router.ts

@@ -23,7 +23,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const { salt, serverPublicKey } = await server.services.password.generateServerPubKey(
-        req.auth.userId,
+        req.permission.id,
         req.body.clientPublicKey
       );
       return { salt, serverPublicKey };
@@ -54,7 +54,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req, res) => {
       const appCfg = getConfig();
-      await server.services.password.changePassword({ ...req.body, userId: req.auth.userId });
+      await server.services.password.changePassword({ ...req.body, userId: req.permission.id });
 
       res.cookie("jid", appCfg.COOKIE_SECRET_SIGN_KEY, {
         httpOnly: true,
@@ -89,7 +89,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
     handler: async (req) => {
       const backupPrivateKey = await server.services.password.createBackupPrivateKey({
         ...req.body,
-        userId: req.auth.userId
+        userId: req.permission.id
       });
       if (!backupPrivateKey) throw new Error("Failed to create backup key");
 
@@ -111,7 +111,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const backupPrivateKey = await server.services.password.getBackupPrivateKeyOfUser(
-        req.auth.userId
+        req.permission.id
       );
       if (!backupPrivateKey) throw new Error("Failed to find backup key");
 

backend-pg/src/server/routes/v1/user-action-router.ts

@@ -22,7 +22,7 @@ export const registerUserActionRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const userAction = await server.services.user.createUserAction(
-        req.auth.userId,
+        req.permission.id,
         req.body.action
       );
       return { userAction, message: "Successfully recorded user action" };
@@ -45,7 +45,7 @@ export const registerUserActionRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const userAction = await server.services.user.getUserAction(
-        req.auth.userId,
+        req.permission.id,
         req.query.action
       );
       return { userAction };

backend-pg/src/server/routes/v1/user-router.ts

@@ -17,7 +17,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const user = await server.services.user.getMe(req.auth.userId);
+      const user = await server.services.user.getMe(req.permission.id);
       return { user };
     }
   });

backend-pg/src/server/routes/v2/organization-router.ts

@@ -7,7 +7,7 @@ import {
   UsersSchema
 } from "@app/db/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
+import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
 export const registerOrgRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -36,8 +36,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
+
       const users = await server.services.org.findAllOrgMembers(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { users };
@@ -60,8 +62,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
+
       const membership = await server.services.org.updateOrgMembership({
-        userId: req.auth.userId,
+        userId: req.permission.id,
         role: req.body.role,
         orgId: req.params.organizationId,
         membershipId: req.params.membershipId
@@ -83,8 +87,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
+      
       const membership = await server.services.org.deleteOrgMembership({
-        userId: req.auth.userId,
+        userId: req.permission.id,
         orgId: req.params.organizationId,
         membershipId: req.params.membershipId
       });
@@ -107,8 +113,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
+
       const organization = await server.services.org.createOrganization(
-        req.auth.userId,
+        req.permission.id,
         req.body.name
       );
       return { organization };
@@ -130,8 +138,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
+      if (req.auth.actor !== ActorType.USER) return;
+
       const organization = await server.services.org.deleteOrganizationById(
-        req.auth.userId,
+        req.permission.id,
         req.params.organizationId
       );
       return { organization };

backend-pg/src/server/routes/v2/user-router.ts

@@ -26,7 +26,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
-      const user = await server.services.user.toggleUserMfa(req.auth.userId, req.body.isMfaEnabled);
+      const user = await server.services.user.toggleUserMfa(req.permission.id, req.body.isMfaEnabled);
       return { user };
     }
   });
@@ -48,7 +48,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
       const user = await server.services.user.updateUserName(
-        req.auth.userId,
+        req.permission.id,
         req.body.firstName,
         req.body.lastName
       );
@@ -72,7 +72,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
       const user = await server.services.user.updateAuthMethods(
-        req.auth.userId,
+        req.permission.id,
         req.body.authMethods
       );
       return { user };
@@ -91,7 +91,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
-      const organizations = await server.services.org.findAllOrganizationOfUser(req.auth.userId);
+      const organizations = await server.services.org.findAllOrganizationOfUser(req.permission.id);
       return { organizations };
     }
   });
@@ -106,7 +106,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const apiKeys = await server.services.apiKey.getMyApiKeys(req.auth.userId);
+      const apiKeys = await server.services.apiKey.getMyApiKeys(req.permission.id);
       return apiKeys;
     }
   });
@@ -129,7 +129,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const apiKeys = await server.services.apiKey.createApiKey(
-        req.auth.userId,
+        req.permission.id,
         req.body.name,
         req.body.expiresIn
       );
@@ -153,7 +153,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const apiKeyData = await server.services.apiKey.deleteApiKey(
-        req.auth.userId,
+        req.permission.id,
         req.params.apiKeyDataId
       );
       return { apiKeyData };
@@ -170,7 +170,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const sessions = await server.services.authToken.getTokenSessionByUser(req.auth.userId);
+      const sessions = await server.services.authToken.getTokenSessionByUser(req.permission.id);
       return sessions;
     }
   });
@@ -187,7 +187,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      await server.services.authToken.revokeAllMySessions(req.auth.userId);
+      await server.services.authToken.revokeAllMySessions(req.permission.id);
       return {
         message: "Successfully revoked all sessions"
       };
@@ -206,7 +206,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const user = await server.services.user.getMe(req.auth.userId);
+      const user = await server.services.user.getMe(req.permission.id);
       return { user };
     }
   });
@@ -223,7 +223,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const user = await server.services.user.deleteMe(req.auth.userId);
+      const user = await server.services.user.deleteMe(req.permission.id);
       return { user };
     }
   });

backend-pg/src/server/routes/v3/user-router.ts

@@ -17,7 +17,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const apiKeyData = await server.services.apiKey.getMyApiKeys(req.auth.userId);
+      const apiKeyData = await server.services.apiKey.getMyApiKeys(req.permission.id);
       return { apiKeyData };
     }
   });