@lightdash/common 0.1369.3 → 0.1370.0

package/dist/authorization/index.d.ts

@@ -1,6 +1,13 @@
 import { AbilityBuilder } from '@casl/ability';
 import { type ProjectMemberProfile } from '../types/projectMemberProfile';
 import { type LightdashUser } from '../types/user';
+import { type OrganizationMemberAbilitiesArgs } from './organizationMemberAbility';
 import { type MemberAbility } from './types';
-export declare const getUserAbilityBuilder: (user: Pick<LightdashUser, 'role' | 'organizationUuid' | 'userUuid'>, projectProfiles: Pick<ProjectMemberProfile, 'projectUuid' | 'role' | 'userUuid'>[]) => AbilityBuilder<MemberAbility>;
+type UserAbilityBuilderArgs = {
+    user: Pick<LightdashUser, 'role' | 'organizationUuid' | 'userUuid'>;
+    projectProfiles: Pick<ProjectMemberProfile, 'projectUuid' | 'role' | 'userUuid'>[];
+    permissionsConfig: OrganizationMemberAbilitiesArgs['permissionsConfig'];
+};
+export declare const getUserAbilityBuilder: ({ user, projectProfiles, permissionsConfig, }: UserAbilityBuilderArgs) => AbilityBuilder<MemberAbility>;
 export declare const defineUserAbility: (user: Pick<LightdashUser, 'role' | 'organizationUuid' | 'userUuid'>, projectProfiles: Pick<ProjectMemberProfile, 'projectUuid' | 'role' | 'userUuid'>[]) => MemberAbility;
+export {};

package/dist/authorization/index.js

@@ -1,16 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defineUserAbility = exports.getUserAbilityBuilder = void 0;
+const tslib_1 = require("tslib");
 const ability_1 = require("@casl/ability");
-const organizationMemberAbility_1 = require("./organizationMemberAbility");
+const organizationMemberAbility_1 = tslib_1.__importDefault(require("./organizationMemberAbility"));
 const projectMemberAbility_1 = require("./projectMemberAbility");
-const getUserAbilityBuilder = (user, projectProfiles) => {
+const getUserAbilityBuilder = ({ user, projectProfiles, permissionsConfig, }) => {
     const builder = new ability_1.AbilityBuilder(ability_1.Ability);
     if (user.role && user.organizationUuid) {
-        organizationMemberAbility_1.organizationMemberAbilities[user.role]({
-            organizationUuid: user.organizationUuid,
-            userUuid: user.userUuid,
-        }, builder);
+        (0, organizationMemberAbility_1.default)({
+            role: user.role,
+            member: {
+                organizationUuid: user.organizationUuid,
+                userUuid: user.userUuid,
+            },
+            builder,
+            permissionsConfig,
+        });
         projectProfiles.forEach((projectProfile) => {
             projectMemberAbility_1.projectMemberAbilities[projectProfile.role](projectProfile, builder);
         });
@@ -18,8 +24,18 @@ const getUserAbilityBuilder = (user, projectProfiles) => {
     return builder;
 };
 exports.getUserAbilityBuilder = getUserAbilityBuilder;
+// Defines user ability for test purposes
 const defineUserAbility = (user, projectProfiles) => {
-    const builder = (0, exports.getUserAbilityBuilder)(user, projectProfiles);
+    const builder = (0, exports.getUserAbilityBuilder)({
+        user,
+        projectProfiles,
+        permissionsConfig: {
+            pat: {
+                enabled: false,
+                allowedOrgRoles: [],
+            },
+        },
+    });
     return builder.build();
 };
 exports.defineUserAbility = defineUserAbility;

package/dist/authorization/organizationMemberAbility.d.ts

@@ -1,4 +1,15 @@
 import { type AbilityBuilder } from '@casl/ability';
 import { type OrganizationMemberProfile, type OrganizationMemberRole } from '../types/organizationMemberProfile';
 import { type MemberAbility } from './types';
-export declare const organizationMemberAbilities: Record<OrganizationMemberRole, (member: Pick<OrganizationMemberProfile, 'organizationUuid' | 'userUuid'>, builder: Pick<AbilityBuilder<MemberAbility>, 'can'>) => void>;
+export type OrganizationMemberAbilitiesArgs = {
+    role: OrganizationMemberRole;
+    member: Pick<OrganizationMemberProfile, 'organizationUuid' | 'userUuid'>;
+    builder: Pick<AbilityBuilder<MemberAbility>, 'can'>;
+    permissionsConfig: {
+        pat: {
+            enabled: boolean;
+            allowedOrgRoles: OrganizationMemberRole[];
+        };
+    };
+};
+export default function applyOrganizationMemberAbilities({ role, member, builder, permissionsConfig, }: OrganizationMemberAbilitiesArgs): void;

package/dist/authorization/organizationMemberAbility.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.organizationMemberAbilities = void 0;
 const projects_1 = require("../types/projects");
 const space_1 = require("../types/space");
-// eslint-disable-next-line import/prefer-default-export
-exports.organizationMemberAbilities = {
+const applyOrganizationMemberDynamicAbilities = ({ role, builder: { can }, permissionsConfig, }) => {
+    if (permissionsConfig.pat.enabled &&
+        permissionsConfig.pat.allowedOrgRoles.includes(role)) {
+        can('manage', 'PersonalAccessToken', {});
+    }
+};
+const applyOrganizationMemberStaticAbilities = {
     member(member, { can }) {
         can('view', 'OrganizationMemberProfile', {
             organizationUuid: member.organizationUuid,
@@ -17,7 +21,7 @@ exports.organizationMemberAbilities = {
         });
     },
     viewer(member, { can }) {
-        exports.organizationMemberAbilities.member(member, { can });
+        applyOrganizationMemberStaticAbilities.member(member, { can });
         can('view', 'Dashboard', {
             organizationUuid: member.organizationUuid,
             isPrivate: false,
@@ -65,7 +69,7 @@ exports.organizationMemberAbilities = {
         });
     },
     interactive_viewer(member, { can }) {
-        exports.organizationMemberAbilities.viewer(member, { can });
+        applyOrganizationMemberStaticAbilities.viewer(member, { can });
         can('create', 'Job');
         can('view', 'Job', { userUuid: member.userUuid });
         can('view', 'UnderlyingData', {
@@ -142,7 +146,9 @@ exports.organizationMemberAbilities = {
         });
     },
     editor(member, { can }) {
-        exports.organizationMemberAbilities.interactive_viewer(member, { can });
+        applyOrganizationMemberStaticAbilities.interactive_viewer(member, {
+            can,
+        });
         can('create', 'Space', {
             organizationUuid: member.organizationUuid,
         });
@@ -167,7 +173,7 @@ exports.organizationMemberAbilities = {
         });
     },
     developer(member, { can }) {
-        exports.organizationMemberAbilities.editor(member, { can });
+        applyOrganizationMemberStaticAbilities.editor(member, { can });
         can('manage', 'VirtualView', {
             organizationUuid: member.organizationUuid,
         });
@@ -211,7 +217,7 @@ exports.organizationMemberAbilities = {
         });
     },
     admin(member, { can }) {
-        exports.organizationMemberAbilities.developer(member, { can });
+        applyOrganizationMemberStaticAbilities.developer(member, { can });
         can('manage', 'Dashboard', {
             organizationUuid: member.organizationUuid,
         });
@@ -251,3 +257,13 @@ exports.organizationMemberAbilities = {
         });
     },
 };
+function applyOrganizationMemberAbilities({ role, member, builder, permissionsConfig, }) {
+    applyOrganizationMemberStaticAbilities[role](member, builder);
+    applyOrganizationMemberDynamicAbilities({
+        role,
+        member,
+        builder,
+        permissionsConfig,
+    });
+}
+exports.default = applyOrganizationMemberAbilities;

package/dist/authorization/organizationMemberAbility.test.js

@@ -1,14 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
 const ability_1 = require("@casl/ability");
+const organizationMemberProfile_1 = require("../types/organizationMemberProfile");
 const projects_1 = require("../types/projects");
 const space_1 = require("../types/space");
-const organizationMemberAbility_1 = require("./organizationMemberAbility");
+const organizationMemberAbility_1 = tslib_1.__importDefault(require("./organizationMemberAbility"));
 const organizationMemberAbility_mock_1 = require("./organizationMemberAbility.mock");
-const defineAbilityForOrganizationMember = (member) => {
+const defineAbilityForOrganizationMember = (member, permissionsConfig) => {
     const builder = new ability_1.AbilityBuilder(ability_1.Ability);
     if (member) {
-        organizationMemberAbility_1.organizationMemberAbilities[member.role](member, builder);
+        (0, organizationMemberAbility_1.default)({
+            role: member.role,
+            member,
+            builder,
+            permissionsConfig: permissionsConfig ?? {
+                pat: {
+                    enabled: true,
+                    allowedOrgRoles: Object.values(organizationMemberProfile_1.OrganizationMemberRole),
+                },
+            },
+        });
     }
     return builder.build();
 };
@@ -1001,4 +1013,43 @@ describe('Organization member permissions', () => {
             });
         });
     });
+    // test permissionsConfig
+    describe('Personal Access Tokens permissions', () => {
+        it('cannot create a personal access token as PAT is disabled', () => {
+            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_ADMIN, {
+                pat: {
+                    enabled: false,
+                    allowedOrgRoles: Object.values(organizationMemberProfile_1.OrganizationMemberRole),
+                },
+            });
+            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
+                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
+                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
+            }))).toEqual(false);
+        });
+        it('cannot create a personal access token as PAT allowed roles dont match', () => {
+            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER, {
+                pat: {
+                    enabled: true,
+                    allowedOrgRoles: [organizationMemberProfile_1.OrganizationMemberRole.ADMIN],
+                },
+            });
+            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
+                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
+                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
+            }))).toEqual(false);
+        });
+        it('can create a personal access token as PAT is enabled', () => {
+            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_ADMIN, {
+                pat: {
+                    enabled: true,
+                    allowedOrgRoles: [organizationMemberProfile_1.OrganizationMemberRole.ADMIN],
+                },
+            });
+            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
+                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
+                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
+            }))).toEqual(true);
+        });
+    });
 });

package/dist/authorization/types.d.ts

@@ -8,7 +8,7 @@ interface Project {
 interface Organization {
     organizationUuid: string;
 }
-type Subject = Project | Organization | OrganizationMemberProfile | 'Project' | 'Organization' | 'OrganizationMemberProfile' | 'Dashboard' | 'Space' | 'SavedChart' | 'InviteLink' | 'Job' | 'SqlRunner' | 'Analytics' | 'Explore' | 'UnderlyingData' | 'ExportCsv' | 'CsvJobResult' | 'PinnedItems' | 'Validation' | 'Group' | 'ChangeCsvResults' | 'ScheduledDeliveries' | 'DashboardComments' | 'CustomSql' | 'CompileProject' | 'SemanticViewer' | 'VirtualView' | 'Tags' | 'all';
+type Subject = Project | Organization | OrganizationMemberProfile | 'Project' | 'Organization' | 'OrganizationMemberProfile' | 'Dashboard' | 'Space' | 'SavedChart' | 'InviteLink' | 'Job' | 'SqlRunner' | 'Analytics' | 'Explore' | 'UnderlyingData' | 'ExportCsv' | 'CsvJobResult' | 'PinnedItems' | 'Validation' | 'Group' | 'ChangeCsvResults' | 'ScheduledDeliveries' | 'DashboardComments' | 'CustomSql' | 'CompileProject' | 'SemanticViewer' | 'VirtualView' | 'Tags' | 'PersonalAccessToken' | 'all';
 type PossibleAbilities = [
     AbilityAction,
     Subject | ForcedSubject<Exclude<Subject, 'all'>>

package/dist/index.d.ts

@@ -468,6 +468,9 @@ export type HealthState = {
             enabled: boolean;
             loginPath: string;
         };
+        pat: {
+            maxExpirationTimeInDays: number | undefined;
+        };
     };
     posthog: {
         projectApiKey: string;

package/dist/types/organizationMemberProfile.d.ts

@@ -8,6 +8,7 @@ export declare enum OrganizationMemberRole {
     DEVELOPER = "developer",
     ADMIN = "admin"
 }
+export declare const isOrganizationMemberRole: (x: string) => x is OrganizationMemberRole;
 /**
  * Profile for a user's membership in an organization
  */

package/dist/types/organizationMemberProfile.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getRoleDescription = exports.isOrganizationMemberProfileWithGroups = exports.OrganizationMemberRole = void 0;
+exports.getRoleDescription = exports.isOrganizationMemberProfileWithGroups = exports.isOrganizationMemberRole = exports.OrganizationMemberRole = void 0;
 var OrganizationMemberRole;
 (function (OrganizationMemberRole) {
     OrganizationMemberRole["MEMBER"] = "member";
@@ -10,6 +10,8 @@ var OrganizationMemberRole;
     OrganizationMemberRole["DEVELOPER"] = "developer";
     OrganizationMemberRole["ADMIN"] = "admin";
 })(OrganizationMemberRole = exports.OrganizationMemberRole || (exports.OrganizationMemberRole = {}));
+const isOrganizationMemberRole = (x) => Object.values(OrganizationMemberRole).includes(x);
+exports.isOrganizationMemberRole = isOrganizationMemberRole;
 const isOrganizationMemberProfileWithGroups = (obj) => 'groups' in obj;
 exports.isOrganizationMemberProfileWithGroups = isOrganizationMemberProfileWithGroups;
 const getRoleDescription = (role) => {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lightdash/common",
-    "version": "0.1369.3",
+    "version": "0.1370.0",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "files": [