@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/project/savedViews/canMove.spec.ts

@@ -0,0 +1,204 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canMoveSavedViewPolicy } from './canMove.js'
+
+describe('canMoveSavedViewPolicy', () => {
+  const buildSUT = (overrides?: OverridesOf<typeof canMoveSavedViewPolicy>) =>
+    canMoveSavedViewPolicy({
+      getSavedView: getSavedViewFake({
+        projectId: 'project-id',
+        authorId: 'user-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getAdminOverrideEnabled: async () => false,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewId: 'saved-view-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canMoveSavedViewPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works for non-author if user is workspace admin', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Admin
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('works for non-author if user is contributor', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds if view author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canMove.ts

@@ -0,0 +1,67 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanAccessSavedViewFragment,
+  WriteTypes
+} from '../../../fragments/savedViews.js'
+
+export const canMoveSavedViewPolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewContext,
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: WriteTypes.MoveView
+    })
+  }

package/src/authz/policies/project/savedViews/canRead.ts

@@ -0,0 +1,72 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import { ensureCanAccessSavedViewFragment } from '../../../fragments/savedViews.js'
+
+export const canReadSavedViewPolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext &
+    ProjectContext &
+    SavedViewContext & {
+      /**
+       * In some cases we want to just ignore a view being non-existant, instead of throwing
+       */
+      allowNonExistent?: boolean
+    },
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId, allowNonExistent }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: 'read',
+      allowNonExistent
+    })
+  }

package/src/authz/policies/project/savedViews/canSetAsHomeView.spec.ts

@@ -0,0 +1,248 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  SavedViewInvalidUpdateError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canSetSavedViewAsHomeViewPolicy } from './canSetAsHomeView.js'
+import { SavedViewVisibility } from '../../../domain/savedViews/types.js'
+
+describe('canSetSavedViewAsHomeViewPolicy', () => {
+  const buildSUT = (overrides?: OverridesOf<typeof canSetSavedViewAsHomeViewPolicy>) =>
+    canSetSavedViewAsHomeViewPolicy({
+      getSavedView: getSavedViewFake({
+        projectId: 'project-id',
+        authorId: 'user-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getAdminOverrideEnabled: async () => false,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewId: 'saved-view-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canSetSavedViewAsHomeViewPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works for non-author if user is workspace admin', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Admin
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('works for non-author if user is contributor', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds if view author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if view is author-only', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id',
+          visibility: SavedViewVisibility.authorOnly
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: SavedViewInvalidUpdateError.code,
+        message: /home view/
+      })
+    })
+
+    it('fails if view is federated', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id',
+          resourceIds: ['aaaa', 'bbb']
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: SavedViewInvalidUpdateError.code,
+        message: /single model/
+      })
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canSetAsHomeView.ts

@@ -0,0 +1,108 @@
+import { err, ok } from 'true-myth/result'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewInvalidUpdateError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanAccessSavedViewFragment,
+  WriteTypes
+} from '../../../fragments/savedViews.js'
+import { SavedViewVisibility } from '../../../domain/savedViews/types.js'
+import { isModelResource, resourceBuilder } from '../../../../viewer/helpers/route.js'
+
+export const canSetSavedViewAsHomeViewPolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewContext,
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+    | typeof SavedViewInvalidUpdateError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId }) => {
+    const canDoUpdate = await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: WriteTypes.SetHomeView
+    })
+    if (canDoUpdate.isErr) {
+      return err(canDoUpdate.error)
+    }
+
+    const view = await loaders.getSavedView({
+      projectId,
+      savedViewId
+    })
+    if (!view) return err(new SavedViewNotFoundError())
+
+    // Must be a shared view to be set as home view
+    const isAuthorOnly = view.visibility === SavedViewVisibility.authorOnly
+    if (isAuthorOnly) {
+      return err(
+        new SavedViewInvalidUpdateError({
+          message: 'A view must be shared to be set as a home view'
+        })
+      )
+    }
+
+    // Must not be federated
+    const resourceIds = resourceBuilder().addResources(view.resourceIds)
+    const firstResource = resourceIds.toResources().at(0)
+    const modelResource =
+      firstResource && isModelResource(firstResource) ? firstResource : undefined
+
+    const isSingleModelView = resourceIds.length === 1 && modelResource
+    if (!isSingleModelView) {
+      return err(
+        new SavedViewInvalidUpdateError({
+          message: 'Only single model views can be set as home views'
+        })
+      )
+    }
+
+    return ok()
+  }