@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/project/savedViews/canCreateSavedViewGroupToken.ts

@@ -0,0 +1,117 @@
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewGroupNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  UngroupedSavedViewGroupLockError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewGroupContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureImplicitProjectMemberWithWriteAccessFragment,
+  ensureMinimumProjectRoleFragment
+} from '../../../fragments/projects.js'
+import { ensureCanAccessSavedViewGroupFragment } from '../../../fragments/savedViews.js'
+import { err, ok } from 'true-myth/result'
+
+export const canCreateSavedViewGroupTokenPolicy: AuthPolicy<
+  | typeof Loaders.getSavedViewGroup
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewGroupContext,
+  InstanceType<
+    | typeof SavedViewGroupNotFoundError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+    | typeof UngroupedSavedViewGroupLockError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewGroupId }) => {
+    const canUseSavedViews = await ensureCanAccessSavedViewGroupFragment(loaders)({
+      userId,
+      projectId,
+      savedViewGroupId,
+      access: 'write'
+    })
+
+    if (canUseSavedViews.isErr) return err(canUseSavedViews.error)
+
+    const env = await loaders.getEnv()
+    const project = await loaders.getProject({ projectId })
+
+    if (!!project?.workspaceId && env.FF_WORKSPACES_MODULE_ENABLED) {
+      // Ensure owner-level access and valid plan
+      const ensuredProjectRole =
+        await ensureImplicitProjectMemberWithWriteAccessFragment(loaders)({
+          userId,
+          projectId,
+          role: Roles.Stream.Owner
+        })
+      if (ensuredProjectRole.isErr) {
+        return err(ensuredProjectRole.error)
+      }
+
+      const plan = await loaders.getWorkspacePlan({ workspaceId: project.workspaceId })
+
+      switch (plan?.name) {
+        case 'academia':
+        case 'enterprise':
+        case 'pro':
+        case 'proUnlimited':
+        case 'proUnlimitedInvoiced':
+        case 'team':
+        case 'teamUnlimited':
+        case 'teamUnlimitedInvoiced':
+        case 'unlimited':
+          return ok()
+        case 'free':
+        default:
+          return err(new WorkspacePlanNoFeatureAccessError())
+      }
+    } else {
+      // Ensure project owner
+      const isProjectOwner = await ensureMinimumProjectRoleFragment(loaders)({
+        userId: userId!,
+        projectId,
+        role: Roles.Stream.Owner
+      })
+      if (isProjectOwner.isErr) {
+        return err(isProjectOwner.error)
+      }
+
+      return ok()
+    }
+  }

package/src/authz/policies/project/savedViews/canEditDescription.spec.ts

@@ -0,0 +1,206 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canEditSavedViewDescriptionPolicy } from './canEditDescription.js'
+
+describe('canEditSavedViewDescriptionPolicy', () => {
+  const buildSUT = (
+    overrides?: OverridesOf<typeof canEditSavedViewDescriptionPolicy>
+  ) =>
+    canEditSavedViewDescriptionPolicy({
+      getSavedView: getSavedViewFake({
+        projectId: 'project-id',
+        authorId: 'user-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getAdminOverrideEnabled: async () => false,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewId: 'saved-view-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canEditSavedViewDescriptionPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works for non-author if user is workspace admin', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Admin
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('works for non-author if user is contributor', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds if view author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canEditDescription.ts

@@ -0,0 +1,67 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanAccessSavedViewFragment,
+  WriteTypes
+} from '../../../fragments/savedViews.js'
+
+export const canEditSavedViewDescriptionPolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewContext,
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: WriteTypes.EditDescription
+    })
+  }

package/src/authz/policies/project/savedViews/canEditTitle.spec.ts

@@ -0,0 +1,204 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canEditSavedViewTitlePolicy } from './canEditTitle.js'
+
+describe('canEditSavedViewTitlePolicy', () => {
+  const buildSUT = (overrides?: OverridesOf<typeof canEditSavedViewTitlePolicy>) =>
+    canEditSavedViewTitlePolicy({
+      getSavedView: getSavedViewFake({
+        projectId: 'project-id',
+        authorId: 'user-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getAdminOverrideEnabled: async () => false,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewId: 'saved-view-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canEditSavedViewTitlePolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works for non-author if user is workspace admin', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Admin
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('works for non-author if user is contributor', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds if view author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canEditTitle.ts

@@ -0,0 +1,67 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanAccessSavedViewFragment,
+  WriteTypes
+} from '../../../fragments/savedViews.js'
+
+export const canEditSavedViewTitlePolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewContext,
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: WriteTypes.EditTitle
+    })
+  }