@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/project/savedViews/canUpdate.spec.ts

@@ -0,0 +1,191 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import { canUpdateSavedViewPolicy } from './canUpdate.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  SavedViewNoAccessError,
+  ServerNoAccessError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+
+describe('canUpdateSavedViewPolicy', () => {
+  const buildSUT = (overrides?: OverridesOf<typeof canUpdateSavedViewPolicy>) =>
+    canUpdateSavedViewPolicy({
+      getSavedView: getSavedViewFake({
+        projectId: 'project-id',
+        authorId: 'user-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      getAdminOverrideEnabled: async () => false,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewId: 'saved-view-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canUpdateSavedViewPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('doesnt work for non-author even if user is project owner', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => Roles.Workspace.Admin
+      })
+
+      const result = await sut({
+        userId: 'user-idx',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({ code: SavedViewNoAccessError.code })
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('succeeds if view author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedView: getSavedViewFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewId: 'saved-view-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canUpdate.ts

@@ -0,0 +1,67 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewNoAccessError,
+  SavedViewNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureCanAccessSavedViewFragment,
+  WriteTypes
+} from '../../../fragments/savedViews.js'
+
+export const canUpdateSavedViewPolicy: AuthPolicy<
+  | typeof Loaders.getSavedView
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getAdminOverrideEnabled
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewContext,
+  InstanceType<
+    | typeof SavedViewNotFoundError
+    | typeof SavedViewNoAccessError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewId }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+      userId,
+      projectId,
+      savedViewId,
+      access: WriteTypes.UpdateGeneral
+    })
+  }

package/src/authz/policies/project/savedViews/canUpdateGroup.spec.ts

@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import {
+  getEnvFake,
+  getProjectFake,
+  getSavedViewGroupFake,
+  getWorkspaceFake,
+  getWorkspacePlanFake,
+  getWorkspaceSsoProviderFake,
+  getWorkspaceSsoSessionFake
+} from '../../../../tests/fakes.js'
+import { Roles } from '../../../../core/constants.js'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  UngroupedSavedViewGroupLockError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspacesNotEnabledError
+} from '../../../domain/authErrors.js'
+import { canUpdateSavedViewGroupPolicy } from './canUpdateGroup.js'
+
+describe('canUpdateSavedViewGroupPolicy', () => {
+  const buildSUT = (overrides?: OverridesOf<typeof canUpdateSavedViewGroupPolicy>) =>
+    canUpdateSavedViewGroupPolicy({
+      getSavedViewGroup: getSavedViewGroupFake({
+        projectId: 'project-id'
+      }),
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getEnv: getEnvFake({
+        FF_WORKSPACES_MODULE_ENABLED: true,
+        FF_SAVED_VIEWS_ENABLED: true
+      }),
+      getServerRole: async () => Roles.Server.User,
+      getProjectRole: async () => Roles.Stream.Owner,
+      getWorkspaceRole: async () => null,
+      getWorkspace: async () => null,
+      getWorkspaceSsoProvider: async () => null,
+      getWorkspacePlan: async () => null,
+      getWorkspaceSsoSession: async () => null,
+      ...overrides
+    })
+
+  it('fails in non-workspaced project, even if project owner', async () => {
+    const policy = buildSUT()
+
+    const result = await policy({
+      userId: 'user-id',
+      projectId: 'project-id',
+      savedViewGroupId: 'saved-group-id'
+    })
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspaceNoAccessError.code
+    })
+  })
+
+  describe('w/ workspaced project', async () => {
+    const buildWorkspacedSUT = (
+      overrides?: OverridesOf<typeof canUpdateSavedViewGroupPolicy>
+    ) =>
+      buildSUT({
+        getProject: getProjectFake({
+          id: 'project-id',
+          workspaceId: 'workspace-id'
+        }),
+        getWorkspaceRole: async () => Roles.Workspace.Member,
+        getWorkspace: getWorkspaceFake({
+          id: 'workspace-id'
+        }),
+        getWorkspacePlan: getWorkspacePlanFake({
+          workspaceId: 'workspace-id',
+          name: 'pro'
+        }),
+        getWorkspaceSsoProvider: getWorkspaceSsoProviderFake({
+          providerId: 'sso-provider-id'
+        }),
+        getWorkspaceSsoSession: getWorkspaceSsoSessionFake({
+          providerId: 'sso-provider-id'
+        }),
+        ...overrides
+      })
+
+    it('works if user is project owner', async () => {
+      const sut = buildWorkspacedSUT()
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+
+    it('fails if workspaces disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: false,
+          FF_SAVED_VIEWS_ENABLED: true
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacesNotEnabledError.code
+      })
+    })
+
+    it('fails if saved views disabled', async () => {
+      const sut = buildWorkspacedSUT({
+        getEnv: getEnvFake({
+          FF_WORKSPACES_MODULE_ENABLED: true,
+          FF_SAVED_VIEWS_ENABLED: false
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: WorkspacePlanNoFeatureAccessError.code
+      })
+    })
+
+    it('fails if just reviewer', async () => {
+      const sut = buildWorkspacedSUT({
+        getProjectRole: async () => Roles.Stream.Reviewer
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if logged out', async () => {
+      const sut = buildWorkspacedSUT({
+        getWorkspaceRole: async () => null,
+        getServerRole: async () => null,
+        getProjectRole: async () => null
+      })
+
+      const result = await sut({
+        userId: 'aaa',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+      expect(result).toBeAuthErrorResult({
+        code: ServerNoAccessError.code
+      })
+    })
+
+    it('fails if not owner and not the author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          authorId: 'another-user-id'
+        }),
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: ProjectNotEnoughPermissionsError.code
+      })
+    })
+
+    it('fails if updating default group', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          id: 'default-XXX'
+        })
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'default-XXX'
+      })
+
+      expect(result).toBeAuthErrorResult({
+        code: UngroupedSavedViewGroupLockError.code
+      })
+    })
+
+    it('succeeds if not owner but author', async () => {
+      const sut = buildWorkspacedSUT({
+        getSavedViewGroup: getSavedViewGroupFake({
+          projectId: 'project-id',
+          authorId: 'user-id'
+        }),
+        getProjectRole: async () => Roles.Stream.Contributor
+      })
+
+      const result = await sut({
+        userId: 'user-id',
+        projectId: 'project-id',
+        savedViewGroupId: 'saved-group-id'
+      })
+
+      expect(result).toBeOKResult()
+    })
+  })
+})

package/src/authz/policies/project/savedViews/canUpdateGroup.ts

@@ -0,0 +1,63 @@
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  SavedViewGroupNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  UngroupedSavedViewGroupLockError,
+  WorkspaceNoAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceReadOnlyError,
+  WorkspacesNotEnabledError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../../domain/authErrors.js'
+import {
+  MaybeUserContext,
+  ProjectContext,
+  SavedViewGroupContext
+} from '../../../domain/context.js'
+import { Loaders } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import { ensureCanAccessSavedViewGroupFragment } from '../../../fragments/savedViews.js'
+
+export const canUpdateSavedViewGroupPolicy: AuthPolicy<
+  | typeof Loaders.getSavedViewGroup
+  | typeof Loaders.getProject
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspacePlan
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole,
+  MaybeUserContext & ProjectContext & SavedViewGroupContext,
+  InstanceType<
+    | typeof SavedViewGroupNotFoundError
+    | typeof ProjectNotFoundError
+    | typeof ServerNoAccessError
+    | typeof ServerNoSessionError
+    | typeof ProjectNoAccessError
+    | typeof WorkspaceNoAccessError
+    | typeof WorkspaceSsoSessionNoAccessError
+    | typeof ServerNotEnoughPermissionsError
+    | typeof ProjectNotEnoughPermissionsError
+    | typeof WorkspaceNotEnoughPermissionsError
+    | typeof WorkspacesNotEnabledError
+    | typeof WorkspaceReadOnlyError
+    | typeof WorkspacePlanNoFeatureAccessError
+    | typeof UngroupedSavedViewGroupLockError
+  >
+> =
+  (loaders) =>
+  async ({ userId, projectId, savedViewGroupId }) => {
+    return await ensureCanAccessSavedViewGroupFragment(loaders)({
+      userId,
+      projectId,
+      savedViewGroupId,
+      access: 'write'
+    })
+  }

package/src/authz/policies/project/version/canUpdate.spec.ts

@@ -1,7 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { Roles } from '../../../../core/constants.js'
 import { parseFeatureFlags } from '../../../../environment/index.js'
-import { getProjectFake, getVersionFake } from '../../../../tests/fakes.js'
+import {
+  getProjectFake,
+  getVersionFake,
+  getWorkspaceFake
+} from '../../../../tests/fakes.js'
 import { OverridesOf } from '../../../../tests/helpers/types.js'
 import { canUpdateProjectVersionPolicy } from './canUpdate.js'
 import {
@@ -46,10 +50,7 @@ const buildWorkspaceSUT = (
       id: 'project-id',
       workspaceId: 'workspace-id'
     }),
-    getWorkspace: async () => ({
-      id: 'workspace-id',
-      slug: 'workspace-slug'
-    }),
+    getWorkspace: getWorkspaceFake({ id: 'workspace-id', slug: 'workspace-slug' }),
     getWorkspaceRole: async () => Roles.Workspace.Member,
     getWorkspaceSsoProvider: async () => ({
       providerId: 'provider-id'

package/src/authz/policies/workspace/canCreateDashboards.ts

@@ -0,0 +1,71 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js'
+import {
+  DashboardsNotEnabledError,
+  WorkspaceNoEditorSeatError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat
+
+type PolicyArgs = MaybeUserContext & WorkspaceContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+  | typeof WorkspaceNoEditorSeatError
+>
+
+export const canCreateDashboardsPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, workspaceId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Member
+    })
+    if (!isWorkspaceMember) return err(new WorkspaceNotEnoughPermissionsError())
+
+    const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
+      userId: userId!,
+      workspaceId
+    })
+    if (!isWorkspaceEditorSeat) return err(new WorkspaceNoEditorSeatError())
+
+    return ok()
+  }