add final changes

keyshade-xyz · Jan 7, 2025 · 31e74cb · 31e74cb
1 parent 7e007db
commit 31e74cb
Show file tree

Hide file tree

Showing 9 changed files with 218 additions and 81 deletions.
diff --git a/apps/api/src/common/collective-authorities.ts b/apps/api/src/common/collective-authorities.ts
@@ -121,16 +121,6 @@ export const getCollectiveEnvironmentAuthorities = async (
         },
         role: {
           OR: [
-            {
-              projects: {
-                some: {
-                  projectId: environment.project.id,
-                  environments: {
-                    none: {}
-                  }
-                }
-              }
-            },
             {
               projects: {
                 some: {
@@ -142,6 +132,12 @@ export const getCollectiveEnvironmentAuthorities = async (
                   }
                 }
               }
+            },
+            // Check if the user has the WORKSPACE_ADMIN authority
+            {
+              authorities: {
+                has: Authority.WORKSPACE_ADMIN
+              }
             }
           ]
         }

diff --git a/apps/api/src/event/event.e2e.spec.ts b/apps/api/src/event/event.e2e.spec.ts
@@ -438,9 +438,7 @@ describe('Event Controller Tests', () => {
         description: 'Some description',
         colorCode: '#000000',
         authorities: [],
-        projectEnvironments: [
-          { projectSlug: project.slug, environmentSlugs: [] }
-        ]
+        projectEnvironments: [{ projectSlug: project.slug }]
       }
     )
 

diff --git a/apps/api/src/workspace-role/dto/create-workspace-role/create-workspace-role.ts b/apps/api/src/workspace-role/dto/create-workspace-role/create-workspace-role.ts
@@ -6,6 +6,18 @@ import {
   IsString,
   ValidateNested
 } from 'class-validator'
+import { Type } from 'class-transformer'
+
+class ProjectEnvironments {
+  @IsString()
+  @IsNotEmpty()
+  readonly projectSlug: string
+
+  @IsArray()
+  @IsOptional()
+  @IsNotEmpty({ each: true })
+  readonly environmentSlugs?: string[]
+}
 
 export class CreateWorkspaceRole {
   @IsString()
@@ -26,15 +38,6 @@ export class CreateWorkspaceRole {
   @IsArray()
   @IsOptional()
   @ValidateNested({ each: true })
+  @Type(() => ProjectEnvironments)
   readonly projectEnvironments?: ProjectEnvironments[]
 }
-
-class ProjectEnvironments {
-  @IsString()
-  @IsNotEmpty()
-  readonly projectSlug: string
-
-  @IsArray()
-  @IsNotEmpty({ each: true })
-  readonly environmentSlugs: string[]
-}
diff --git a/apps/api/src/workspace-role/service/workspace-role.service.ts b/apps/api/src/workspace-role/service/workspace-role.service.ts
@@ -107,46 +107,73 @@ export class WorkspaceRoleService {
     if (dto.projectEnvironments) {
       // Create the project associations
       const projectSlugToIdMap = await this.getProjectSlugToIdMap(
-        dto.projectEnvironments
-          .map((pe) => pe.projectSlug)
-          .filter((slug) => slug)
+        dto.projectEnvironments.map((pe) => pe.projectSlug)
       )
 
       for (const pe of dto.projectEnvironments) {
         const projectId = projectSlugToIdMap.get(pe.projectSlug)
         if (projectId) {
-          //Check if all environments are part of the project
-          const project = await this.prisma.project.findFirst({
-            where: {
-              id: projectId,
-              AND: pe.environmentSlugs.map((slug) => ({
-                environments: {
-                  some: {
-                    slug: slug
+          if (pe.environmentSlugs && pe.environmentSlugs.length === 0)
+            throw new BadRequestException(
+              `EnvironmentSlugs in the project ${pe.projectSlug} are required`
+            )
+          if (pe.environmentSlugs) {
+            //Check if all environments are part of the project
+            const project = await this.prisma.project.findFirst({
+              where: {
+                id: projectId,
+                AND: pe.environmentSlugs.map((slug) => ({
+                  environments: {
+                    some: {
+                      slug: slug
+                    }
                   }
-                }
-              }))
+                }))
+              }
+            })
+
+            if (!project) {
+              throw new BadRequestException(
+                `All environmentSlugs in the project ${pe.projectSlug} are not part of the project`
+              )
             }
-          })
 
-          if (!project) {
-            throw new BadRequestException(
-              `All environmentSlugs in the project ${pe.projectSlug} are not part of the project`
-            )
+            // Check if the user has read authority over all the environments
+            for (const environmentSlug of pe.environmentSlugs) {
+              try {
+                await this.authorityCheckerService.checkAuthorityOverEnvironment(
+                  {
+                    userId: user.id,
+                    entity: {
+                      slug: environmentSlug
+                    },
+                    authorities: [Authority.READ_ENVIRONMENT],
+                    prisma: this.prisma
+                  }
+                )
+              } catch {
+                throw new UnauthorizedException(
+                  `User does not have read authority over environment ${environmentSlug}`
+                )
+              }
+            }
           }
-
           // Create the project workspace role association with the environments accessible on the project
           op.push(
             this.prisma.projectWorkspaceRoleAssociation.create({
               data: {
                 roleId: workspaceRoleId,
                 projectId: projectId,
-                environments: {
+                environments: pe.environmentSlugs && {
                   connect: pe.environmentSlugs.map((slug) => ({ slug }))
                 }
               }
             })
           )
+        } else {
+          throw new NotFoundException(
+            `Project with slug ${pe.projectSlug} not found`
+          )
         }
       }
     }
@@ -264,34 +291,57 @@ export class WorkspaceRoleService {
       })
 
       const projectSlugToIdMap = await this.getProjectSlugToIdMap(
-        dto.projectEnvironments
-          .map((pe) => pe.projectSlug)
-          .filter((slug) => slug)
+        dto.projectEnvironments.map((pe) => pe.projectSlug)
       )
 
       for (const pe of dto.projectEnvironments) {
         const projectId = projectSlugToIdMap.get(pe.projectSlug)
         if (projectId) {
-          //Check if all environments are part of the project
-          const project = await this.prisma.project.findFirst({
-            where: {
-              id: projectId,
-              AND: pe.environmentSlugs.map((slug) => ({
-                environments: {
-                  some: {
-                    slug: slug
+          if (pe.environmentSlugs && pe.environmentSlugs.length === 0)
+            throw new BadRequestException(
+              `EnvironmentSlugs in the project ${pe.projectSlug} are required`
+            )
+          if (pe.environmentSlugs) {
+            //Check if all environments are part of the project
+            const project = await this.prisma.project.findFirst({
+              where: {
+                id: projectId,
+                AND: pe.environmentSlugs.map((slug) => ({
+                  environments: {
+                    some: {
+                      slug: slug
+                    }
                   }
-                }
-              }))
+                }))
+              }
+            })
+
+            if (!project) {
+              throw new BadRequestException(
+                `All environmentSlugs in the project ${pe.projectSlug} are not part of the project`
+              )
             }
-          })
 
-          if (!project) {
-            throw new BadRequestException(
-              `All environmentSlugs in the project ${pe.projectSlug} are not part of the project`
-            )
+            // Check if the user has read authority over all the environments
+            for (const environmentSlug of pe.environmentSlugs) {
+              try {
+                await this.authorityCheckerService.checkAuthorityOverEnvironment(
+                  {
+                    userId: user.id,
+                    entity: {
+                      slug: environmentSlug
+                    },
+                    authorities: [Authority.READ_ENVIRONMENT],
+                    prisma: this.prisma
+                  }
+                )
+              } catch {
+                throw new UnauthorizedException(
+                  `User does not have update authority over environment ${environmentSlug}`
+                )
+              }
+            }
           }
-
           // Create or Update the project workspace role association with the environments accessible on the project
           await this.prisma.projectWorkspaceRoleAssociation.upsert({
             where: {
@@ -301,19 +351,23 @@ export class WorkspaceRoleService {
               }
             },
             update: {
-              environments: {
+              environments: pe.environmentSlugs && {
                 set: [],
                 connect: pe.environmentSlugs.map((slug) => ({ slug }))
               }
             },
             create: {
               roleId: workspaceRoleId,
               projectId: projectId,
-              environments: {
+              environments: pe.environmentSlugs && {
                 connect: pe.environmentSlugs.map((slug) => ({ slug }))
               }
             }
           })
+        } else {
+          throw new NotFoundException(
+            `Project with slug ${pe.projectSlug} not found`
+          )
         }
       }
     }