@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/checks/dashboards.ts

@@ -0,0 +1,14 @@
+import { DashboardContext, UserContext } from '../domain/context.js'
+import { AuthCheckContextLoaderKeys } from '../domain/loaders.js'
+import { AuthPolicyCheck } from '../domain/policies.js'
+
+export const isDashboardOwner: AuthPolicyCheck<
+  typeof AuthCheckContextLoaderKeys.getDashboard,
+  UserContext & DashboardContext
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return false
+    return dashboard.ownerId === userId
+  }

package/src/authz/domain/authErrors.ts

@@ -94,6 +94,15 @@ export const WorkspaceNotEnoughPermissionsError = defineAuthError({
   message: 'You do not have enough permissions in the workspace to perform this action'
 })
 
+export const EligibleForExclusiveWorkspaceError = defineAuthError({
+  code: 'UserEligibleForExclusiveWorkspace',
+  message:
+    'Cannot create workspace: ' +
+    'You are a member or eligible to become a member of an exclusive workspace. ' +
+    'This is due to you having received an invite to the workspace ' +
+    'or having a matching verified email.'
+})
+
 export const WorkspaceReadOnlyError = defineAuthError({
   code: 'WorkspaceReadOnly',
   message: 'The workspace is in a read only mode, upgrade your plan to unlock it'
@@ -107,8 +116,8 @@ export const WorkspaceLimitsReachedError = defineAuthError<
   message: 'Workspace limits have been reached'
 })
 
-export const WorkspaceNoFeatureAccessError = defineAuthError({
-  code: 'WorkspaceNoFeatureAccess',
+export const WorkspacePlanNoFeatureAccessError = defineAuthError({
+  code: 'WorkspacePlanNoFeatureAccessError',
   message: 'Your workspace plan does not have access to this feature.'
 })
 
@@ -172,6 +181,82 @@ export const VersionNotFoundError = defineAuthError({
   message: 'Version not found'
 })
 
+export const AutomateNotEnabledError = defineAuthError({
+  code: 'AutomateNotEnabled',
+  message: 'Automate is not enabled on this server'
+})
+
+export const AutomateFunctionNotFoundError = defineAuthError({
+  code: 'AutomateFunctionNotFound',
+  message: 'Function not found'
+})
+
+export const AutomateFunctionNotCreatorError = defineAuthError({
+  code: 'AutomateFunctionNotCreator',
+  message: 'You are not the function creator and cannot make changes to it.'
+})
+
+export const AccIntegrationNotEnabledError = defineAuthError({
+  code: 'AccIntegrationNotEnabled',
+  message: 'The ACC Integration is not enabled on this server or project'
+})
+
+export const SavedViewNotFoundError = defineAuthError({
+  code: 'SavedViewNotFound',
+  message: 'Saved view not found'
+})
+
+export const SavedViewNoAccessError = defineAuthError({
+  code: 'SavedViewNoAccess',
+  message: 'You do not have access to this saved view'
+})
+
+export const SavedViewInvalidUpdateError = defineAuthError({
+  code: 'SavedViewInvalidUpdate',
+  message: 'The requested update is invalid'
+})
+
+export const SavedViewGroupNotFoundError = defineAuthError({
+  code: 'SavedViewGroupNotFound',
+  message: 'Saved view group not found'
+})
+
+export const UngroupedSavedViewGroupLockError = defineAuthError({
+  code: 'UngroupedSavedViewGroupLock',
+  message: 'The default/ungrouped group cannot be modified.'
+})
+
+export const DashboardsNotEnabledError = defineAuthError({
+  code: 'DashboardsNotEnabled',
+  message: 'Dashboards are not enabled for this server or workspaces.'
+})
+
+export const DashboardNotFoundError = defineAuthError({
+  code: 'DashboardNotFound',
+  message: 'Dashboard not found'
+})
+
+export const DashboardNoProjectsError = defineAuthError({
+  code: 'DashboardNoProjects',
+  message:
+    'Dashboard has no projects added to it. You need to add at least one project before sharing.'
+})
+
+export const DashboardProjectsNotEnoughPermissionsError = defineAuthError<
+  'DashboardProjectsNotEnoughPermissions',
+  {
+    projectIds: string[]
+  }
+>({
+  code: 'DashboardProjectsNotEnoughPermissions',
+  message: 'You do not have sufficient access to some projects in this workspace.'
+})
+
+export const DashboardNotOwnerError = defineAuthError({
+  code: 'DashboardNotOwner',
+  message: 'You must be a dashboard owner to perform this action'
+})
+
 // Resolve all exported error types
 export type AllAuthErrors = ValueOf<{
   [key in keyof typeof import('./authErrors.js')]: typeof import('./authErrors.js')[key] extends new (

package/src/authz/domain/automate/operations.ts

@@ -0,0 +1,5 @@
+import { AutomateFunction } from './types.js'
+
+export type GetAutomateFunction = (args: {
+  functionId: string
+}) => Promise<AutomateFunction | null>

package/src/authz/domain/automate/types.ts

@@ -0,0 +1,9 @@
+export type AutomateFunction = {
+  id: string
+  name: string
+  functionCreator: {
+    synchronizedUserId: string
+    synchronizedServerOrigin: string
+  } | null
+  workspaceIds: string[]
+}

package/src/authz/domain/context.ts

@@ -7,8 +7,16 @@ export type MaybeUserContext = { userId?: string }
 export type WorkspaceContext = { workspaceId: string }
 export type MaybeWorkspaceContext = { workspaceId?: string }
 
+export type DashboardContext = { dashboardId: string }
+
 export type CommentContext = { commentId: string }
 
 export type ModelContext = { modelId: string }
 
 export type VersionContext = { versionId: string }
+
+export type AutomateFunctionContext = { functionId: string }
+
+export type SavedViewContext = { savedViewId: string }
+
+export type SavedViewGroupContext = { savedViewGroupId: string }

package/src/authz/domain/dashboards/operations.ts

@@ -0,0 +1,3 @@
+import { Dashboard } from './types.js'
+
+export type GetDashboard = (args: { dashboardId: string }) => Promise<Dashboard | null>

package/src/authz/domain/dashboards/types.ts

@@ -0,0 +1,6 @@
+export type Dashboard = {
+  id: string
+  ownerId: string
+  workspaceId: string
+  projectIds: string[]
+}

package/src/authz/domain/loaders.ts

@@ -1,5 +1,5 @@
 import { OverrideProperties } from 'type-fest'
-import { MaybeAsync } from '../../core/index.js'
+import { MaybeAsync, StringEnum, StringEnumValues } from '../../core/index.js'
 import type { GetServerRole } from './core/operations.js'
 import type {
   GetProject,
@@ -10,6 +10,7 @@ import type {
 import type {
   GetAdminOverrideEnabled,
   GetEnv,
+  GetUserWorkspaces,
   GetWorkspace,
   GetWorkspaceLimits,
   GetWorkspaceModelCount,
@@ -23,6 +24,9 @@ import type {
 import { GetComment } from './comments/operations.js'
 import { GetModel } from './models/operations.js'
 import { GetVersion } from './versions/operations.js'
+import { GetAutomateFunction } from './automate/operations.js'
+import { GetSavedView, GetSavedViewGroup } from './savedViews/operations.js'
+import { GetDashboard } from './dashboards/operations.js'
 
 // utility type that ensures all properties functions that return promises
 type PromiseAll<T> = {
@@ -52,42 +56,52 @@ type AuthContextLoaderMappingDefinition<
  */
 
 /* v8 ignore start  */
-export const AuthCheckContextLoaderKeys = <const>{
-  getEnv: 'getEnv',
-  getProject: 'getProject',
-  getProjectRoleCounts: 'getProjectRoleCounts',
-  getProjectRole: 'getProjectRole',
-  getProjectModelCount: 'getProjectModelCount',
-  getServerRole: 'getServerRole',
-  getWorkspace: 'getWorkspace',
-  getWorkspaceRole: 'getWorkspaceRole',
-  getWorkspaceSeat: 'getWorkspaceSeat',
-  getWorkspaceModelCount: 'getWorkspaceModelCount',
-  getWorkspaceProjectCount: 'getWorkspaceProjectCount',
-  getWorkspacePlan: 'getWorkspacePlan',
-  getWorkspaceLimits: 'getWorkspaceLimits',
-  getWorkspaceSsoProvider: 'getWorkspaceSsoProvider',
-  getWorkspaceSsoSession: 'getWorkspaceSsoSession',
-  getAdminOverrideEnabled: 'getAdminOverrideEnabled',
-  getComment: 'getComment',
-  getModel: 'getModel',
-  getVersion: 'getVersion'
-}
+export const AuthCheckContextLoaderKeys = StringEnum([
+  'getEnv',
+  'getAutomateFunction',
+  'getDashboard',
+  'getProject',
+  'getProjectRoleCounts',
+  'getProjectRole',
+  'getProjectModelCount',
+  'getServerRole',
+  'getWorkspace',
+  'getUsersCurrentAndEligibleToBecomeAMemberWorkspaces',
+  'getWorkspaceRole',
+  'getWorkspaceSeat',
+  'getWorkspaceModelCount',
+  'getWorkspaceProjectCount',
+  'getWorkspacePlan',
+  'getWorkspaceLimits',
+  'getWorkspaceSsoProvider',
+  'getWorkspaceSsoSession',
+  'getAdminOverrideEnabled',
+  'getComment',
+  'getModel',
+  'getVersion',
+  'getSavedView',
+  'getSavedViewGroup'
+])
+
 export const Loaders = AuthCheckContextLoaderKeys // shorter alias
 /* v8 ignore end  */
 
-export type AuthCheckContextLoaderKeys =
-  (typeof AuthCheckContextLoaderKeys)[keyof typeof AuthCheckContextLoaderKeys]
+export type AuthCheckContextLoaderKeys = StringEnumValues<
+  typeof AuthCheckContextLoaderKeys
+>
 
 export type AllAuthCheckContextLoaders = AuthContextLoaderMappingDefinition<{
   getEnv: GetEnv
   getAdminOverrideEnabled: GetAdminOverrideEnabled
+  getAutomateFunction: GetAutomateFunction
+  getDashboard: GetDashboard
   getProject: GetProject
   getProjectRole: GetProjectRole
   getProjectRoleCounts: GetProjectRoleCounts
   getProjectModelCount: GetProjectModelCount
   getServerRole: GetServerRole
   getWorkspace: GetWorkspace
+  getUsersCurrentAndEligibleToBecomeAMemberWorkspaces: GetUserWorkspaces
   getWorkspaceRole: GetWorkspaceRole
   getWorkspaceLimits: GetWorkspaceLimits
   getWorkspacePlan: GetWorkspacePlan
@@ -99,6 +113,8 @@ export type AllAuthCheckContextLoaders = AuthContextLoaderMappingDefinition<{
   getComment: GetComment
   getModel: GetModel
   getVersion: GetVersion
+  getSavedView: GetSavedView
+  getSavedViewGroup: GetSavedViewGroup
 }>
 
 export type AuthCheckContextLoaders<

package/src/authz/domain/savedViews/operations.ts

@@ -0,0 +1,11 @@
+import { SavedView, SavedViewGroup } from './types.js'
+
+export type GetSavedView = (args: {
+  projectId: string
+  savedViewId: string
+}) => Promise<SavedView | null>
+
+export type GetSavedViewGroup = (args: {
+  projectId: string
+  groupId: string
+}) => Promise<SavedViewGroup | null>

package/src/authz/domain/savedViews/types.ts

@@ -0,0 +1,25 @@
+import { StringEnum, StringEnumValues } from '../../../core/helpers/utility.js'
+
+export const SavedViewVisibility = StringEnum(['public', 'authorOnly'])
+export type SavedViewVisibility = StringEnumValues<typeof SavedViewVisibility>
+
+export type SavedView = {
+  id: string
+  name: string
+  authorId: string | null
+  groupId: string | null
+  projectId: string
+  visibility: SavedViewVisibility
+  resourceIds: string[]
+}
+
+export type SavedViewGroup = {
+  id: string
+  projectId: string
+  /**
+   * null means default/ungrouped group
+   */
+  name: string | null
+  authorId: string | null
+  resourceIds: string[]
+}

package/src/authz/domain/workspaces/operations.ts

@@ -1,5 +1,5 @@
 import { WorkspaceRoles, WorkspaceSeatType } from '../../../core/constants.js'
-import { FeatureFlags } from '../../../environment/index.js'
+import { FeatureFlags } from '../../../environment/featureFlags.js'
 import { WorkspaceLimits } from '../../../workspaces/helpers/limits.js'
 import { WorkspacePlan } from '../../../workspaces/index.js'
 import { UserContext, WorkspaceContext } from '../context.js'
@@ -7,6 +7,8 @@ import { Workspace, WorkspaceSsoProvider, WorkspaceSsoSession } from './types.js
 
 export type GetWorkspace = (args: WorkspaceContext) => Promise<Workspace | null>
 
+export type GetUserWorkspaces = (args: UserContext) => Promise<Workspace[]>
+
 export type GetWorkspaceRole = (
   args: UserContext & WorkspaceContext
 ) => Promise<WorkspaceRoles | null>

package/src/authz/domain/workspaces/types.ts

@@ -1,6 +1,10 @@
+import { WorkspaceRoles } from '../../../core/constants.js'
+
 export type Workspace = {
   id: string
   slug: string
+  isExclusive: boolean
+  role?: WorkspaceRoles | null
 }
 
 export type WorkspaceSsoProvider = {

package/src/authz/fragments/automate.spec.ts

@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest'
+import {
+  ensureAutomateEnabledFragment,
+  ensureAutomateFunctionCreatorFragment
+} from './automate.js'
+import { OverridesOf } from '../../tests/helpers/types.js'
+import { parseFeatureFlags } from '../../environment/index.js'
+import cryptoRandomString from 'crypto-random-string'
+import {
+  AutomateFunctionNotCreatorError,
+  AutomateFunctionNotFoundError,
+  AutomateNotEnabledError
+} from '../domain/authErrors.js'
+
+describe('ensureAutomateEnabledFragment', () => {
+  const buildFragment = (
+    overrides?: OverridesOf<typeof ensureAutomateEnabledFragment>
+  ) =>
+    ensureAutomateEnabledFragment({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_AUTOMATE_MODULE_ENABLED: 'true'
+        }),
+      ...overrides
+    })
+
+  it('returns ok when automate is enabled', async () => {
+    const result = await buildFragment()({})
+    expect(result).toBeAuthOKResult()
+  })
+
+  it('returns err when automate is disabled', async () => {
+    const result = await buildFragment({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_AUTOMATE_MODULE_ENABLED: 'false'
+        })
+    })({})
+    expect(result).toBeAuthErrorResult({
+      code: AutomateNotEnabledError.code
+    })
+  })
+})
+
+describe('ensureAutomateFunctionCreatorFragment', () => {
+  const buildFragment = (
+    overrides?: OverridesOf<typeof ensureAutomateFunctionCreatorFragment>
+  ) =>
+    ensureAutomateFunctionCreatorFragment({
+      getAutomateFunction: async ({ functionId }) => {
+        return {
+          id: functionId,
+          name: cryptoRandomString({ length: 9 }),
+          functionCreator: {
+            synchronizedUserId: 'foo',
+            synchronizedServerOrigin: 'example.org'
+          },
+          workspaceIds: []
+        }
+      },
+      ...overrides
+    })
+
+  it('returns ok when user is function creator', async () => {
+    const userId = cryptoRandomString({ length: 9 })
+
+    const result = await buildFragment({
+      getAutomateFunction: async ({ functionId }) => {
+        return {
+          id: functionId,
+          name: cryptoRandomString({ length: 9 }),
+          functionCreator: {
+            synchronizedUserId: userId,
+            synchronizedServerOrigin: 'example.org'
+          },
+          workspaceIds: []
+        }
+      }
+    })({
+      userId,
+      functionId: cryptoRandomString({ length: 9 })
+    })
+
+    expect(result).toBeAuthOKResult()
+  })
+
+  it('return err if function is not found', async () => {
+    const result = await buildFragment({
+      getAutomateFunction: async () => null
+    })({
+      userId: cryptoRandomString({ length: 9 }),
+      functionId: cryptoRandomString({ length: 9 })
+    })
+    expect(result).toBeAuthErrorResult({
+      code: AutomateFunctionNotFoundError.code
+    })
+  })
+
+  it('returns err if user is not function creator', async () => {
+    const result = await buildFragment({
+      getAutomateFunction: async ({ functionId }) => {
+        return {
+          id: functionId,
+          name: cryptoRandomString({ length: 9 }),
+          functionCreator: {
+            synchronizedUserId: cryptoRandomString({ length: 9 }),
+            synchronizedServerOrigin: 'example.org'
+          },
+          workspaceIds: []
+        }
+      }
+    })({
+      userId: cryptoRandomString({ length: 9 }),
+      functionId: cryptoRandomString({ length: 9 })
+    })
+    expect(result).toBeAuthErrorResult({
+      code: AutomateFunctionNotCreatorError.code
+    })
+  })
+})

package/src/authz/fragments/automate.ts

@@ -0,0 +1,36 @@
+import { err, ok } from 'true-myth/result'
+import {
+  AutomateFunctionNotCreatorError,
+  AutomateFunctionNotFoundError,
+  AutomateNotEnabledError
+} from '../domain/authErrors.js'
+import { Loaders } from '../domain/loaders.js'
+import { AuthPolicyEnsureFragment } from '../domain/policies.js'
+import { AutomateFunctionContext, MaybeUserContext } from '../domain/context.js'
+
+export const ensureAutomateEnabledFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getEnv,
+  // eslint-disable-next-line @typescript-eslint/no-empty-object-type
+  {},
+  InstanceType<typeof AutomateNotEnabledError>
+> = (loaders) => async () => {
+  const env = await loaders.getEnv()
+  if (!env.FF_AUTOMATE_MODULE_ENABLED) return err(new AutomateNotEnabledError())
+  return ok()
+}
+
+export const ensureAutomateFunctionCreatorFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getAutomateFunction,
+  MaybeUserContext & AutomateFunctionContext,
+  InstanceType<
+    typeof AutomateFunctionNotFoundError | typeof AutomateFunctionNotCreatorError
+  >
+> =
+  (loaders) =>
+  async ({ userId, functionId }) => {
+    const automateFunction = await loaders.getAutomateFunction({ functionId })
+    if (!automateFunction) return err(new AutomateFunctionNotFoundError())
+    if (!userId || automateFunction.functionCreator?.synchronizedUserId !== userId)
+      return err(new AutomateFunctionNotCreatorError())
+    return ok()
+  }

package/src/authz/fragments/dashboards.ts

@@ -0,0 +1,90 @@
+import { err, ok } from 'true-myth/result'
+import {
+  DashboardNotFoundError,
+  DashboardProjectsNotEnoughPermissionsError,
+  DashboardsNotEnabledError,
+  WorkspacePlanNoFeatureAccessError
+} from '../domain/authErrors.js'
+import { Loaders } from '../domain/loaders.js'
+import { AuthPolicyEnsureFragment } from '../domain/policies.js'
+import { DashboardContext, UserContext, WorkspaceContext } from '../domain/context.js'
+import {
+  isWorkspaceFeatureFlagOn,
+  WorkspaceFeatureFlags
+} from '../../workspaces/index.js'
+import { ensureMinimumProjectRoleFragment } from './projects.js'
+
+export const ensureDashboardsEnabledFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getEnv,
+  // eslint-disable-next-line @typescript-eslint/no-empty-object-type
+  {},
+  InstanceType<typeof DashboardsNotEnabledError>
+> = (loaders) => async () => {
+  const env = await loaders.getEnv()
+  if (!env.FF_DASHBOARDS_MODULE_ENABLED) return err(new DashboardsNotEnabledError())
+  return ok()
+}
+
+export const ensureWorkspaceDashboardsFeatureAccessFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getWorkspacePlan,
+  WorkspaceContext,
+  InstanceType<typeof WorkspacePlanNoFeatureAccessError>
+> =
+  (loaders) =>
+  async ({ workspaceId }) => {
+    const plan = await loaders.getWorkspacePlan({ workspaceId })
+    if (!plan) return err(new WorkspacePlanNoFeatureAccessError())
+
+    const isFlagOn = isWorkspaceFeatureFlagOn({
+      workspaceFeatureFlags: plan.featureFlags,
+      feature: WorkspaceFeatureFlags.dashboards
+    })
+    if (!isFlagOn) return err(new WorkspacePlanNoFeatureAccessError())
+
+    return ok()
+  }
+
+export const ensureDashboardProjectsReadAccess: AuthPolicyEnsureFragment<
+  | typeof Loaders.getDashboard
+  | typeof Loaders.getProjectRole
+  | typeof Loaders.getProject
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getEnv
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession,
+  DashboardContext & UserContext,
+  InstanceType<
+    typeof DashboardNotFoundError | typeof DashboardProjectsNotEnoughPermissionsError
+  >
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return err(new DashboardNotFoundError())
+
+    const allProjectResults: [
+      string,
+      Awaited<ReturnType<ReturnType<typeof ensureMinimumProjectRoleFragment>>>
+    ][] = await Promise.all(
+      dashboard.projectIds.map(async (projectId) => {
+        return [
+          projectId,
+          await ensureMinimumProjectRoleFragment(loaders)({ projectId, userId })
+        ]
+      })
+    )
+
+    const projectAccessErrors = allProjectResults.filter(([, e]) => e.isErr)
+
+    return projectAccessErrors.length
+      ? err(
+          new DashboardProjectsNotEnoughPermissionsError({
+            payload: {
+              projectIds: projectAccessErrors.map(([projectId]) => projectId)
+            }
+          })
+        )
+      : ok()
+  }