@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/project/comment/canCreate.spec.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { OverridesOf } from '../../../../tests/helpers/types.js'
 import { canCreateProjectCommentPolicy } from './canCreate.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getProjectFake } from '../../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../../tests/fakes.js'
 import { Roles } from '../../../../core/constants.js'
 import {
   ProjectNoAccessError,
@@ -42,7 +42,7 @@ describe('canCreateProjectCommentPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/comment/canEdit.spec.ts

@@ -1,7 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { OverridesOf } from '../../../../tests/helpers/types.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getCommentFake, getProjectFake } from '../../../../tests/fakes.js'
+import {
+  getCommentFake,
+  getProjectFake,
+  getWorkspaceFake
+} from '../../../../tests/fakes.js'
 import { Roles } from '../../../../core/constants.js'
 import {
   CommentNoAccessError,
@@ -49,10 +53,7 @@ describe('canEditProjectCommentPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
-        id: 'workspace-id',
-        slug: 'workspace-slug'
-      }),
+      getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
       getWorkspaceRole: async () => Roles.Workspace.Member,
       getWorkspaceSsoProvider: async () => ({
         providerId: 'provider-id'

package/src/authz/policies/project/model/canDelete.spec.ts

@@ -1,7 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { Roles } from '../../../../core/constants.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getModelFake, getProjectFake } from '../../../../tests/fakes.js'
+import {
+  getModelFake,
+  getProjectFake,
+  getWorkspaceFake
+} from '../../../../tests/fakes.js'
 import {
   ModelNotFoundError,
   ProjectNoAccessError,
@@ -45,7 +49,7 @@ const buildWorkspaceSUT = (
       id: 'project-id',
       workspaceId: 'workspace-id'
     }),
-    getWorkspace: async () => ({
+    getWorkspace: getWorkspaceFake({
       id: 'workspace-id',
       slug: 'workspace-slug'
     }),

package/src/authz/policies/project/model/canUpdate.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { Roles } from '../../../../core/constants.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getProjectFake } from '../../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../../tests/fakes.js'
 import { canUpdateModelPolicy } from './canUpdate.js'
 import {
   ProjectNoAccessError,
@@ -37,10 +37,7 @@ const buildWorkspaceSUT = (
       id: 'project-id',
       workspaceId: 'workspace-id'
     }),
-    getWorkspace: async () => ({
-      id: 'workspace-id',
-      slug: 'workspace-slug'
-    }),
+    getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
     getWorkspaceRole: async () => Roles.Workspace.Member,
     getWorkspaceSsoProvider: async () => ({
       providerId: 'provider-id'

package/src/authz/policies/project/savedViews/canCreate.spec.ts

@@ -0,0 +1,186 @@
+import { describe, expect, it } from 'vitest'
+import { Roles } from '../../../../core/constants.js'
+import { parseFeatureFlags } from '../../../../environment/index.js'
+import {
+  getProjectFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake
+} from '../../../../tests/fakes.js'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import { canCreateSavedViewPolicy } from './canCreate.js'
+import { TIME_MS } from '../../../../core/index.js'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspaceReadOnlyError
+} from '../../../domain/authErrors.js'
+import { WorkspacePlans } from '../../../../workspaces/index.js'
+
+const buildSUT = (overrides?: OverridesOf<typeof canCreateSavedViewPolicy>) =>
+  canCreateSavedViewPolicy({
+    getProject: getProjectFake({
+      id: 'project-id'
+    }),
+    getEnv: async () =>
+      parseFeatureFlags({
+        FF_SAVED_VIEWS_ENABLED: 'true'
+      }),
+    getServerRole: async () => Roles.Server.User,
+    getWorkspaceRole: async () => null,
+    getWorkspace: async () => null,
+    getWorkspaceSsoProvider: async () => null,
+    getWorkspaceSsoSession: async () => null,
+    getWorkspacePlan: async () => null,
+    getProjectRole: async () => Roles.Stream.Contributor,
+    ...overrides
+  })
+
+describe('canCreateSavedViewPolicy', () => {
+  it('fails when not workspaced project', async () => {
+    const canCreate = buildSUT()
+
+    const result = await canCreate({
+      userId: 'user-id',
+      projectId: 'project-id'
+    })
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaces', () => {
+    const buildWorkspaceSUT = (
+      overrides?: OverridesOf<typeof canCreateSavedViewPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getEnv: async () =>
+          parseFeatureFlags({
+            FF_WORKSPACES_MODULE_ENABLED: 'true',
+            FF_SAVED_VIEWS_ENABLED: 'true'
+          }),
+        getWorkspaceRole: async () => Roles.Workspace.Admin,
+        getProjectRole: async () => null,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          name: WorkspacePlans.Pro
+        }),
+        getWorkspaceSsoProvider: async () => ({
+          providerId: 'provider-id'
+        }),
+        getWorkspaceSsoSession: async () => ({
+          userId: 'user-id',
+          providerId: 'provider-id',
+          validUntil: new Date(Date.now() + TIME_MS.day)
+        }),
+        ...overrides
+      })
+
+    it('succeeds for workspace admin', async () => {
+      const canCreate = buildWorkspaceSUT()
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeOKResult()
+    })
+
+    it('succeeds for project contributor', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if not contributor+', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if no project access', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getProjectRole: async () => null
+      })
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNoAccessError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await canCreate({
+        userId: 'aaa',
+        projectId: 'project-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds even on free plan', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspacePlan: getWorkspacePlanFake({
+          name: WorkspacePlans.Free
+        })
+      })
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeAuthOKResult()
+    })
+
+    it('fails if workspace readonly', async () => {
+      const canCreate = buildWorkspaceSUT({
+        getWorkspacePlan: getWorkspacePlanFake({
+          name: WorkspacePlans.Pro,
+          status: 'canceled'
+        })
+      })
+
+      const result = await canCreate({
+        userId: 'user-id',
+        projectId: 'project-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: WorkspaceReadOnlyError.code
+      })
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canCreate.ts

@@ -0,0 +1,81 @@
+import { Roles } from '../../../../core/constants.js'
+import { WorkspacePlanFeatures } from '../../../../workspaces/index.js'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import { MaybeUserContext, ProjectContext } from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanUseProjectWorkspacePlanFeatureFragment,
+  ensureImplicitProjectMemberWithWriteAccessFragment
+} from '../../../fragments/projects.js'
+import { err, ok } from 'true-myth/result'
+
+export const canCreateSavedViewPolicy: AuthPolicy<
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext,
+  InstanceType<
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacePlanNoFeatureAccessError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacesNotEnabledError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId }) => {
+    const canUseSavedViews = await ensureCanUseProjectWorkspacePlanFeatureFragment(
+      loaders
+    )({
+      projectId,
+      feature: WorkspacePlanFeatures.SavedViews
+    })
+    if (canUseSavedViews.isErr) return err(canUseSavedViews.error)
+
+    const ensuredWriteAccess = await ensureImplicitProjectMemberWithWriteAccessFragment(
+      loaders
+    )({
+      userId,
+      projectId,
+      role: Roles.Stream.Contributor
+    })
+    if (ensuredWriteAccess.isErr) {
+      if (ensuredWriteAccess.error.code === 'ProjectNotEnoughPermissions')
+        return err(
+          new ProjectNotEnoughPermissionsError({
+            message:
+              "Your role on this project doesn't give you permission to save views. You need the Can edit or Project owner role."
+          })
+        )
+      return err(ensuredWriteAccess.error)
+    }
+
+    return ok()
+  }

package/src/authz/policies/project/savedViews/canCreateSavedViewGroupToken.spec.ts

@@ -0,0 +1,250 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewGroupFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  UngroupedSavedViewGroupLockError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canCreateSavedViewGroupTokenPolicy } from './canCreateSavedViewGroupToken.js'
+
+describe('canCreateSavedViewGroupTokenPolicy', () => {
+  const buildSUT = (
+    overrides?: OverridesOf<typeof canCreateSavedViewGroupTokenPolicy>
+  ) =>
+    canCreateSavedViewGroupTokenPolicy({
+      getSavedViewGroup: getSavedViewGroupFake({
+        projectId: 'project-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewGroupId: 'saved-group-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canCreateSavedViewGroupTokenPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works if user is project owner', async () => {
+      const sut = buildWorkspacedSUT()
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'aaa',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('fails if not owner and not the author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          authorId: 'another-user-id'
+        }),
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if updating default group', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          id: 'default-XXX'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'default-XXX'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: UngroupedSavedViewGroupLockError.code
+      })
+    })
+
+    it('fails if workspace plan is free', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'free'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'default-XXX'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if user is author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        }),
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+  })
+})