Skip to content

Commit 239da90

Browse files
javirlnjavirln
authored
chore(rbac): Set organization ID in all project memberships (#2184)
Signed-off-by: Javier Rodriguez <[email protected]>
1 parent 822d2a1 commit 239da90

File tree

3 files changed

+20
-15
lines changed

3 files changed

+20
-15
lines changed

‎app/controlplane/pkg/biz/project.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ type ProjectsRepo interface {
4545
// UpdateMemberRoleInProject updates the role of a user or group in a project.
4646
UpdateMemberRoleInProject(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType, newRole authz.Role) (*ProjectMembership, error)
4747
// FindProjectMembershipByProjectAndID finds a project membership by project ID and member ID (user or group).
48-
FindProjectMembershipByProjectAndID(ctx context.Context, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) (*ProjectMembership, error)
48+
FindProjectMembershipByProjectAndID(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) (*ProjectMembership, error)
4949
}
5050

5151
// ProjectUseCase is a use case for projects
@@ -252,7 +252,7 @@ func (uc *ProjectUseCase) addUserToProject(ctx context.Context, orgID uuid.UUID,
252252
userUUID := uuid.MustParse(userMembership.User.ID)
253253

254254
// Check if the user is already a member of the project
255-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, userUUID, authz.MembershipTypeUser)
255+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, userUUID, authz.MembershipTypeUser)
256256
if err != nil && !IsNotFound(err) {
257257
return nil, fmt.Errorf("failed to check existing membership: %w", err)
258258
}
@@ -289,7 +289,7 @@ func (uc *ProjectUseCase) addGroupToProject(ctx context.Context, orgID uuid.UUID
289289
}
290290

291291
// Check if the group already has membership in the project
292-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, resolvedGroupID, authz.MembershipTypeGroup)
292+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, resolvedGroupID, authz.MembershipTypeGroup)
293293
if err != nil && !IsNotFound(err) {
294294
return nil, fmt.Errorf("failed to check existing group membership: %w", err)
295295
}
@@ -371,7 +371,7 @@ func (uc *ProjectUseCase) removeUserFromProject(ctx context.Context, orgID uuid.
371371
userUUID := uuid.MustParse(userMembership.User.ID)
372372

373373
// Check if the user is a member of the project
374-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, userUUID, authz.MembershipTypeUser)
374+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, userUUID, authz.MembershipTypeUser)
375375
if err != nil && !IsNotFound(err) {
376376
return fmt.Errorf("failed to check existing membership: %w", err)
377377
}
@@ -406,7 +406,7 @@ func (uc *ProjectUseCase) removeGroupFromProject(ctx context.Context, orgID uuid
406406
}
407407

408408
// Check if the group has membership in the project
409-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, resolvedGroupID, authz.MembershipTypeGroup)
409+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, resolvedGroupID, authz.MembershipTypeGroup)
410410
if err != nil && !IsNotFound(err) {
411411
return fmt.Errorf("failed to check existing group membership: %w", err)
412412
}
@@ -526,7 +526,8 @@ func (uc *ProjectUseCase) verifyRequesterHasPermissions(ctx context.Context, org
526526
for _, m := range requesterMemberships {
527527
if m.ResourceType == authz.ResourceTypeProject &&
528528
m.ResourceID == projectID &&
529-
m.Role == authz.RoleProjectAdmin {
529+
m.Role == authz.RoleProjectAdmin &&
530+
m.OrganizationID == orgID {
530531
hasProjectAdminRole = true
531532
break
532533
}
@@ -610,7 +611,7 @@ func (uc *ProjectUseCase) updateUserRoleInProject(ctx context.Context, orgID uui
610611
userUUID := uuid.MustParse(userMembership.User.ID)
611612

612613
// Check if the user is a member of the project
613-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, userUUID, authz.MembershipTypeUser)
614+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, userUUID, authz.MembershipTypeUser)
614615
if err != nil && !IsNotFound(err) {
615616
return fmt.Errorf("failed to check existing membership: %w", err)
616617
}
@@ -652,7 +653,7 @@ func (uc *ProjectUseCase) updateGroupRoleInProject(ctx context.Context, orgID uu
652653
}
653654

654655
// Check if the group has membership in the project
655-
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, projectID, resolvedGroupID, authz.MembershipTypeGroup)
656+
existingMembership, err := uc.projectsRepository.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, resolvedGroupID, authz.MembershipTypeGroup)
656657
if err != nil && !IsNotFound(err) {
657658
return fmt.Errorf("failed to check existing group membership: %w", err)
658659
}

‎app/controlplane/pkg/data/membership.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ func (r *MembershipRepo) ListAllByUser(ctx context.Context, userID uuid.UUID) ([
250250
mm, err := r.data.DB.Membership.Query().Where(
251251
membership.MembershipTypeEQ(authz.MembershipTypeUser),
252252
membership.MemberID(userID),
253-
).All(ctx)
253+
).WithOrganization().All(ctx)
254254

255255
if err != nil {
256256
return nil, fmt.Errorf("failed to query memberships: %w", err)

‎app/controlplane/pkg/data/project.go‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ func (r *ProjectRepo) AddMemberToProject(ctx context.Context, orgID uuid.UUID, p
198198

199199
// Create the membership
200200
if _, err := r.data.DB.Membership.Create().
201+
SetOrganizationID(orgID).
201202
SetMembershipType(membershipType).
202203
SetMemberID(memberID).
203204
SetResourceType(authz.ResourceTypeProject).
@@ -208,7 +209,7 @@ func (r *ProjectRepo) AddMemberToProject(ctx context.Context, orgID uuid.UUID, p
208209
}
209210

210211
// Return the created membership
211-
return r.FindProjectMembershipByProjectAndID(ctx, projectID, memberID, membershipType)
212+
return r.FindProjectMembershipByProjectAndID(ctx, orgID, projectID, memberID, membershipType)
212213
}
213214

214215
// RemoveMemberFromProject removes a user or group from a project
@@ -223,7 +224,7 @@ func (r *ProjectRepo) RemoveMemberFromProject(ctx context.Context, orgID uuid.UU
223224
}
224225

225226
// Find the membership to delete
226-
m, err := r.queryMembership(projectID, memberID, membershipType).Only(ctx)
227+
m, err := r.queryMembership(orgID, projectID, memberID, membershipType).Only(ctx)
227228

228229
if err != nil {
229230
if ent.IsNotFound(err) {
@@ -241,9 +242,9 @@ func (r *ProjectRepo) RemoveMemberFromProject(ctx context.Context, orgID uuid.UU
241242
}
242243

243244
// FindProjectMembershipByProjectAndID finds a project membership by project ID and member ID (user or group)
244-
func (r *ProjectRepo) FindProjectMembershipByProjectAndID(ctx context.Context, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) (*biz.ProjectMembership, error) {
245+
func (r *ProjectRepo) FindProjectMembershipByProjectAndID(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) (*biz.ProjectMembership, error) {
245246
// Find the membership
246-
m, err := r.queryMembership(projectID, memberID, membershipType).Only(ctx)
247+
m, err := r.queryMembership(orgID, projectID, memberID, membershipType).Only(ctx)
247248

248249
if err != nil {
249250
if ent.IsNotFound(err) {
@@ -302,7 +303,7 @@ func (r *ProjectRepo) UpdateMemberRoleInProject(ctx context.Context, orgID uuid.
302303
}
303304

304305
// Find the membership to update
305-
m, err := r.queryMembership(projectID, memberID, membershipType).Only(ctx)
306+
m, err := r.queryMembership(orgID, projectID, memberID, membershipType).Only(ctx)
306307

307308
if err != nil {
308309
if ent.IsNotFound(err) {
@@ -321,9 +322,12 @@ func (r *ProjectRepo) UpdateMemberRoleInProject(ctx context.Context, orgID uuid.
321322
}
322323

323324
// queryMembership is a helper function to build a common membership query
324-
func (r *ProjectRepo) queryMembership(projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) *ent.MembershipQuery {
325+
func (r *ProjectRepo) queryMembership(orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) *ent.MembershipQuery {
325326
return r.data.DB.Membership.Query().
326327
Where(
328+
membership.HasOrganizationWith(
329+
organization.ID(orgID),
330+
),
327331
membership.MembershipTypeEQ(membershipType),
328332
membership.MemberID(memberID),
329333
membership.ResourceTypeEQ(authz.ResourceTypeProject),

0 commit comments

Comments
 (0)