-
Notifications
You must be signed in to change notification settings - Fork 107
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
expose membership permissions via GraphQL API
- Loading branch information
Showing
7 changed files
with
413 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
311 changes: 311 additions & 0 deletions
311
packages/services/api/src/modules/auth/lib/organization-member-permissions.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,311 @@ | ||
| import { allPermissions, Permission } from './authz'; | ||
|
|
||
| export type PermissionRecord = { | ||
| id: Permission; | ||
| title: string; | ||
| description: string; | ||
| dependsOn?: Permission; | ||
| readOnly?: true; | ||
| }; | ||
|
|
||
| export type PermissionGroup = { | ||
| id: string; | ||
| title: string; | ||
| permissions: Array<PermissionRecord>; | ||
| }; | ||
|
|
||
| export const allPermissionGroups: Array<PermissionGroup> = [ | ||
| { | ||
| id: 'organization', | ||
| title: 'Organization', | ||
| permissions: [ | ||
| { | ||
| id: 'organization:describe', | ||
| title: 'View organization', | ||
| description: 'Member can see the organization. Permission can not be modified.', | ||
| readOnly: true, | ||
| }, | ||
| { | ||
| id: 'support:manageTickets', | ||
| title: 'Access support tickets', | ||
| description: 'Member can access, create and reply to support tickets.', | ||
| }, | ||
| { | ||
| id: 'organization:modifySlug', | ||
| title: 'Update organization slug', | ||
| description: 'Member can modify the organization slug.', | ||
| }, | ||
| { | ||
| id: 'auditLog:export', | ||
| title: 'Export audit log', | ||
| description: 'Member can access and export the audit log.', | ||
| }, | ||
| { | ||
| id: 'organization:delete', | ||
| title: 'Delete organization', | ||
| description: 'Member can delete the Organization.', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'members', | ||
| title: 'Members', | ||
| permissions: [ | ||
| { | ||
| id: 'member:describe', | ||
| title: 'View members', | ||
| description: 'Member can access the organization member overview.', | ||
| }, | ||
| { | ||
| id: 'member:assignRole', | ||
| title: 'Assign member role', | ||
| description: 'Member can assign roles to users.', | ||
| dependsOn: 'member:describe', | ||
| }, | ||
| { | ||
| id: 'member:modifyRole', | ||
| title: 'Modify member role', | ||
| description: 'Member can modify, create and delete roles.', | ||
| dependsOn: 'member:describe', | ||
| }, | ||
| { | ||
| id: 'member:removeMember', | ||
| title: 'Remove member', | ||
| description: 'Member can remove users from the organization.', | ||
| dependsOn: 'member:describe', | ||
| }, | ||
| { | ||
| id: 'member:manageInvites', | ||
| title: 'Manage invites', | ||
| description: 'Member can invite users via email and modify or delete pending invites.', | ||
| dependsOn: 'member:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'billing', | ||
| title: 'Billing', | ||
| permissions: [ | ||
| { | ||
| id: 'billing:describe', | ||
| title: 'View billing', | ||
| description: 'Member can view the billing information.', | ||
| }, | ||
| { | ||
| id: 'billing:update', | ||
| title: 'Update billing', | ||
| description: 'Member can change the organization plan.', | ||
| dependsOn: 'billing:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'oidc', | ||
| title: 'OpenID Connect', | ||
| permissions: [ | ||
| { | ||
| id: 'oidc:modify', | ||
| title: 'Manage OpenID Connect integration', | ||
| description: 'Member can connect, modify, and remove an OIDC provider to the connection.', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'github', | ||
| title: 'GitHub Integration', | ||
| permissions: [ | ||
| { | ||
| id: 'gitHubIntegration:modify', | ||
| title: 'Manage GitHub integration', | ||
| description: | ||
| 'Member can connect, modify, and remove access for the GitHub integration and repository access.', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'slack', | ||
| title: 'Slack Integration', | ||
| permissions: [ | ||
| { | ||
| id: 'slackIntegration:modify', | ||
| title: 'Manage Slack integration', | ||
| description: | ||
| 'Member can connect, modify, and remove access for the Slack integration and repository access.', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'project', | ||
| title: 'Project', | ||
| permissions: [ | ||
| { | ||
| id: 'project:create', | ||
| title: 'Create project', | ||
| description: 'Member can create new projects.', | ||
| }, | ||
| { | ||
| id: 'project:describe', | ||
| title: 'View project', | ||
| description: 'Member can access the specified projects.', | ||
| }, | ||
| { | ||
| id: 'project:delete', | ||
| title: 'Delete project', | ||
| description: 'Member can access the specified projects.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'project:modifySettings', | ||
| title: 'Modify Settings', | ||
| description: 'Member can access the specified projects.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'schema-linting', | ||
| title: 'Schema Linting', | ||
| permissions: [ | ||
| { | ||
| id: 'schemaLinting:modifyOrganizationRules', | ||
| title: 'Manage organization level schema linting', | ||
| description: 'Member can view and modify the organization schema linting rules.', | ||
| }, | ||
| { | ||
| id: 'schemaLinting:modifyProjectRules', | ||
| title: 'Manage project level schema linting', | ||
| description: 'Member can view and modify the projects schema linting rules.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'target', | ||
| title: 'Target', | ||
| permissions: [ | ||
| { | ||
| id: 'target:create', | ||
| title: 'Create target', | ||
| description: 'Member can create new projects.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'target:delete', | ||
| title: 'Delete target', | ||
| description: 'Member can access the specified projects.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'target:modifySettings', | ||
| title: 'Modify settings', | ||
| description: 'Member can access the specified projects.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'alert:modify', | ||
| title: 'Modify alerts', | ||
| description: 'Can create alerts for schema versions.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'schemaVersion:approve', | ||
| title: 'Approve schema version (legacy)', | ||
| description: 'Can approve schema versions on projects using the legacy registry model.', | ||
| }, | ||
| { | ||
| id: 'targetAccessToken:modify', | ||
| title: 'Manage registry access tokens', | ||
| description: 'Allow managing access tokens for CLI and Usage Reporting.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'cdnAccessToken:modify', | ||
| title: 'Manage CDN access tokens', | ||
| description: 'Allow managing access tokens for the CDN.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'laboratory', | ||
| title: 'Laboratory', | ||
| permissions: [ | ||
| { | ||
| id: 'laboratory:describe', | ||
| title: 'View laboratory', | ||
| description: 'Member can access the laboratory, view and execute GraphQL documents.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| { | ||
| id: 'laboratory:modify', | ||
| title: 'Modify laboratory', | ||
| description: | ||
| 'Member can create, delete and update collections and documents in the laboratory.', | ||
| dependsOn: 'laboratory:describe', | ||
| }, | ||
| { | ||
| id: 'laboratory:modifyPreflightScript', | ||
| title: 'Modify the laboratory preflight script', | ||
| description: 'Member can update the laboratory preflight script.', | ||
| dependsOn: 'laboratory:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'app-deployments', | ||
| title: 'App Deployments', | ||
| permissions: [ | ||
| { | ||
| id: 'appDeployment:describe', | ||
| title: 'View app deployments', | ||
| description: 'Member can view app deployments.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
| id: 'schema-checks', | ||
| title: 'Schema Checks', | ||
| permissions: [ | ||
| { | ||
| id: 'schemaCheck:approve', | ||
| title: 'Approve schema check', | ||
| description: 'Member can approve failed schema checks.', | ||
| dependsOn: 'project:describe', | ||
| }, | ||
| ], | ||
| }, | ||
| ] as const; | ||
|
|
||
| function assertAllRulesAreAssigned(excluded: Array<Permission>) { | ||
| const p = new Set(allPermissions); | ||
| for (const item of excluded) { | ||
| p.delete(item); | ||
| } | ||
|
|
||
| for (const group of allPermissionGroups) { | ||
| for (const per of group.permissions) { | ||
| p.delete(per.id); | ||
| } | ||
| } | ||
|
|
||
| if (p.size) { | ||
| throw new Error('The following permissions are not assigned: \n' + Array.from(p).join(`\n`)); | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * This seems like the easiest way to make sure that all the permissions we have are | ||
| * assignable and exposed via our API. | ||
| */ | ||
| assertAllRulesAreAssigned([ | ||
| /** These are CLI only actions for now. */ | ||
| 'schema:loadFromRegistry', | ||
| 'schema:compose', | ||
| 'schemaCheck:create', | ||
| 'schemaVersion:publish', | ||
| 'schemaVersion:deleteService', | ||
| 'appDeployment:create', | ||
| 'appDeployment:publish', | ||
| 'appDeployment:retire', | ||
| ]); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.