@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/fragments/projects.spec.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   checkIfPubliclyReadableProjectFragment,
+  ensureCanUseProjectWorkspacePlanFeatureFragment,
   ensureImplicitProjectMemberWithReadAccessFragment,
   ensureImplicitProjectMemberWithWriteAccessFragment,
   ensureMinimumProjectRoleFragment,
@@ -16,12 +17,23 @@ import {
   ServerNoSessionError,
   ServerNotEnoughPermissionsError,
   WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
   WorkspaceSsoSessionNoAccessError
 } from '../domain/authErrors.js'
 import { OverridesOf } from '../../tests/helpers/types.js'
-import { getProjectFake } from '../../tests/fakes.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../tests/fakes.js'
 import { TIME_MS } from '../../core/index.js'
 import { ProjectVisibility } from '../domain/projects/types.js'
+import {
+  PaidWorkspacePlans,
+  PaidWorkspacePlanStatuses,
+  WorkspacePlanFeatures
+} from '../../workspaces/index.js'
 
 describe('ensureMinimumProjectRoleFragment', () => {
   const buildSUT = (overrides?: OverridesOf<typeof ensureMinimumProjectRoleFragment>) =>
@@ -38,7 +50,8 @@ describe('ensureMinimumProjectRoleFragment', () => {
       getProjectRole: async () => Roles.Stream.Contributor,
       getEnv: async () =>
         parseFeatureFlags({
-          FF_WORKSPACES_MODULE_ENABLED: 'true'
+          FF_WORKSPACES_MODULE_ENABLED: 'true',
+          FF_SAVED_VIEWS_ENABLED: 'true'
         }),
       ...overrides
     })
@@ -52,7 +65,7 @@ describe('ensureMinimumProjectRoleFragment', () => {
         workspaceId: 'workspaceId',
         visibility: ProjectVisibility.Workspace
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspaceId',
         slug: 'workspaceSlug'
       }),
@@ -210,7 +223,8 @@ describe('checkIfPubliclyReadableProjectFragment', () => {
       }),
       getEnv: async () =>
         parseFeatureFlags({
-          FF_WORKSPACES_MODULE_ENABLED: 'true'
+          FF_WORKSPACES_MODULE_ENABLED: 'true',
+          FF_SAVED_VIEWS_ENABLED: 'true'
         }),
       ...overrides
     })
@@ -274,7 +288,11 @@ describe('ensureProjectWorkspaceAccessFragment', () => {
         id: 'projectId',
         workspaceId: null
       }),
-      getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'true',
+          FF_SAVED_VIEWS_ENABLED: 'true'
+        }),
       getWorkspace: async () => null,
       getWorkspaceSsoProvider: async () => null,
       getWorkspaceSsoSession: async () => null,
@@ -290,7 +308,7 @@ describe('ensureProjectWorkspaceAccessFragment', () => {
         id: 'projectId',
         workspaceId: 'workspaceId'
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspaceId',
         slug: 'workspaceSlug'
       }),
@@ -431,7 +449,8 @@ describe('ensureImplicitProjectMemberWithReadAccessFragment', async () => {
       getProjectRole: async () => Roles.Stream.Contributor,
       getEnv: async () =>
         parseFeatureFlags({
-          FF_WORKSPACES_MODULE_ENABLED: 'true'
+          FF_WORKSPACES_MODULE_ENABLED: 'true',
+          FF_SAVED_VIEWS_ENABLED: 'true'
         }),
       getWorkspace: async () => null,
       getWorkspaceSsoProvider: async () => null,
@@ -450,7 +469,7 @@ describe('ensureImplicitProjectMemberWithReadAccessFragment', async () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspaceId',
         slug: 'workspaceSlug'
       }),
@@ -670,7 +689,11 @@ describe('ensureImplicitProjectMemberWithWriteAccessFragment', () => {
       }),
       getServerRole: async () => Roles.Server.User,
       getProjectRole: async () => Roles.Stream.Contributor,
-      getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'true',
+          FF_SAVED_VIEWS_ENABLED: 'true'
+        }),
       getWorkspace: async () => null,
       getWorkspaceSsoProvider: async () => null,
       getWorkspaceSsoSession: async () => null,
@@ -688,7 +711,7 @@ describe('ensureImplicitProjectMemberWithWriteAccessFragment', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspaceId',
         slug: 'workspaceSlug'
       }),
@@ -927,3 +950,105 @@ describe('ensureImplicitProjectMemberWithWriteAccessFragment', () => {
     })
   })
 })
+
+describe('ensureCanUseProjectWorkspacePlanFeatureFragment', () => {
+  const buildSUT = (
+    overrides?: OverridesOf<typeof ensureCanUseProjectWorkspacePlanFeatureFragment>
+  ) =>
+    ensureCanUseProjectWorkspacePlanFeatureFragment({
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: 'workspace-id'
+      }),
+      getWorkspacePlan: getWorkspacePlanFake({
+        workspaceId: 'workspace-id',
+        name: PaidWorkspacePlans.Pro,
+        status: PaidWorkspacePlanStatuses.Valid
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      ...overrides
+    })
+
+  it('succeeds if project has workspace and feature is enabled', async () => {
+    const sut = buildSUT()
+
+    const result = await sut({
+      projectId: 'project-id',
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthOKResult()
+  })
+
+  it('fails if project not found', async () => {
+    const sut = buildSUT({
+      getProject: async () => null
+    })
+
+    const result = await sut({
+      projectId: 'project-id',
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: ProjectNotFoundError.code
+    })
+  })
+
+  it('fails if project w/o a workspace', async () => {
+    const sut = buildSUT({
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      })
+    })
+
+    const result = await sut({
+      projectId: 'project-id',
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  it('succeeds if project w/o a workspace, but allowUnworkspaced === true', async () => {
+    const sut = buildSUT({
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      })
+    })
+
+    const result = await sut({
+      projectId: 'project-id',
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding,
+      allowUnworkspaced: true
+    })
+
+    expect(result).toBeAuthOKResult()
+  })
+
+  it('fails if projects plan does not have access to feature', async () => {
+    const sut = buildSUT({
+      getWorkspacePlan: getWorkspacePlanFake({
+        workspaceId: 'workspace-id',
+        name: PaidWorkspacePlans.Team,
+        status: PaidWorkspacePlanStatuses.Valid
+      })
+    })
+
+    const result = await sut({
+      projectId: 'project-id',
+      feature: WorkspacePlanFeatures.HideSynchronizedBranding
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+})

package/src/authz/fragments/projects.ts

@@ -14,17 +14,24 @@ import {
   ServerNotEnoughPermissionsError,
   WorkspaceNoAccessError,
   WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
   WorkspaceSsoSessionNoAccessError
 } from '../domain/authErrors.js'
 import { Roles, StreamRoles } from '../../core/constants.js'
 import { isMinimumProjectRole } from '../domain/logic/roles.js'
 import { hasMinimumProjectRole, isPubliclyReadableProject } from '../checks/projects.js'
-import { ensureWorkspaceRoleAndSessionFragment } from './workspaces.js'
+import {
+  ensureCanUseWorkspacePlanFeatureFragment,
+  ensureWorkspaceRoleAndSessionFragment
+} from './workspaces.js'
 import {
   checkIfAdminOverrideEnabledFragment,
   ensureMinimumServerRoleFragment
 } from './server.js'
 import { ProjectVisibility } from '../domain/projects/types.js'
+import { WorkspacePlanFeatures } from '../../workspaces/index.js'
 
 const workspaceRoleImplicitProjectRoleMap = (projectVisibility: ProjectVisibility) => {
   const isFullyPrivate = projectVisibility === ProjectVisibility.Private
@@ -321,3 +328,48 @@ export const ensureImplicitProjectMemberWithWriteAccessFragment: AuthPolicyEnsur
 
     return ok()
   }
+
+/**
+ * Ensure project is workspaced and has access to a specific plan feature
+ */
+export const ensureCanUseProjectWorkspacePlanFeatureFragment: AuthPolicyEnsureFragment<
+  typeof Loaders.getEnv | typeof Loaders.getProject | typeof Loaders.getWorkspacePlan,
+  ProjectContext & {
+    feature: WorkspacePlanFeatures
+    /**
+     * Whether to also allow if project is not workspaced at all
+     * Default: false
+     */
+    allowUnworkspaced?: boolean
+  },
+  InstanceType<
+    | typeof WorkspacesNotEnabledError
+    | typeof ProjectNotFoundError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ projectId, feature, allowUnworkspaced = false }) => {
+    const project = await loaders.getProject({ projectId })
+    if (!project) return err(new ProjectNotFoundError())
+
+    const workspaceId = project.workspaceId
+    if (!workspaceId) {
+      if (allowUnworkspaced) return ok()
+
+      return err(
+        new WorkspaceNoAccessError({
+          message: 'The project must be in a workspace'
+        })
+      )
+    }
+
+    const canUseFeature = await ensureCanUseWorkspacePlanFeatureFragment(loaders)({
+      workspaceId,
+      feature
+    })
+    if (canUseFeature.isErr) return err(canUseFeature.error)
+    return ok()
+  }