Add policies layer in between roles and permissions

packages/back-end/src/middleware/authenticateApiRequestMiddleware.ts

@@ -6,11 +6,7 @@ import { getOrganizationById } from "../services/organizations";
 import { getCustomLogProps } from "../util/logger";
 import { EventAuditUserApiKey } from "../events/event-types";
 import { isApiKeyForUserInOrganization } from "../util/api-key.util";
-import {
- MemberRole,
- OrganizationInterface,
- Permission,
-} from "../../types/organization";
+import { OrganizationInterface, Permission } from "../../types/organization";
 import {
  getUserPermissions,
  roleToPermissionMap,
@@ -126,7 +122,7 @@ export default function authenticateApiRequestMiddleware(
  auditUser: eventAudit,
  teams,
  user: req.user,
- role: role as MemberRole | undefined,
+ role: role,
  apiKey: id,
  req,
  });
@@ -252,7 +248,7 @@ export function verifyApiKeyPermission({
  // Because of the JIT migration, `role` will always be set here, even for old secret keys
  // This will check a valid role is provided.
  const rolePermissions = roleToPermissionMap(
- apiKey.role as MemberRole,
+ apiKey.role as string,
  organization
  );
 

packages/back-end/src/models/OrganizationModel.ts

@@ -1,11 +1,16 @@
 import mongoose from "mongoose";
 import uniqid from "uniqid";
 import { cloneDeep } from "lodash";
+import { POLICIES, RESERVED_ROLE_IDS } from "shared/permissions";
+import { z } from "zod";
+import { TeamInterface } from "@back-end/types/team";
 import {
  Invite,
  Member,
+ MemberRoleWithProjects,
  OrganizationInterface,
  OrganizationMessage,
+ Role,
 } from "../../types/organization";
 import { upgradeOrganizationDoc } from "../util/migrations";
 import { ApiOrganization } from "../../types/openapi";
@@ -117,6 +122,7 @@ const organizationSchema = new mongoose.Schema({
  },
  },
  settings: {},
+ customRoles: {},
 });
 
 organizationSchema.index({ "members.id": 1 });
@@ -434,3 +440,106 @@ export async function updateMember(
  }),
  });
 }
+
+export const customRoleValidator = z
+ .object({
+ id: z.string().min(2).max(64),
+ description: z.string().max(100),
+ policies: z.array(z.enum(POLICIES)),
+ })
+ .strict();
+
+export async function addCustomRole(org: OrganizationInterface, role: Role) {
+ // Basic Validation
+ role = customRoleValidator.parse(role);
+
+ // Make sure role id is not reserved
+ if (RESERVED_ROLE_IDS.includes(role.id)) {
+ throw new Error("That role id is reserved and cannot be used");
+ }
+
+ // Make sure role id is not already in use
+ if (org.customRoles?.find((r) => r.id === role.id)) {
+ throw new Error("That role id already exists");
+ }
+
+ // Validate custom role id format
+ if (!/^[a-zA-Z0-9_]+$/.test(role.id)) {
+ throw new Error(
+ "Role id must only include letters, numbers, and underscores."
+ );
+ }
+
+ const customRoles = [...(org.customRoles || [])];
+ customRoles.push(role);
+
+ await updateOrganization(org.id, { customRoles });
+}
+
+export async function editCustomRole(
+ org: OrganizationInterface,
+ id: string,
+ updates: Omit<Role, "id">
+) {
+ // Validation
+ updates = customRoleValidator.omit({ id: true }).parse(updates);
+
+ let found = false;
+ const newCustomRoles = (org.customRoles || []).map((role) => {
+ if (role.id === id) {
+ found = true;
+ return {
+ ...role,
+ ...updates,
+ };
+ }
+ return role;
+ });
+
+ if (!found) {
+ throw new Error("Role not found");
+ }
+
+ await updateOrganization(org.id, { customRoles: newCustomRoles });
+}
+
+function usingRole(member: MemberRoleWithProjects, role: string): boolean {
+ return (
+ member.role === role ||
+ (member.projectRoles || []).some((pr) => pr.role === role)
+ );
+}
+
+export async function removeCustomRole(
+ org: OrganizationInterface,
+ teams: TeamInterface[],
+ id: string
+) {
+ // Make sure no members, invites, pending members, or teams are using the role
+ if (org.members.some((m) => usingRole(m, id))) {
+ throw new Error("Role is currently being used by at least one member");
+ }
+ if (org.pendingMembers?.some((m) => usingRole(m, id))) {
+ throw new Error(
+ "Role is currently being used by at least one pending member"
+ );
+ }
+ if (org.invites?.some((m) => usingRole(m, id))) {
+ throw new Error(
+ "Role is currently being used by at least one invited member"
+ );
+ }
+ if (teams.some((team) => usingRole(team, id))) {
+ throw new Error("Role is currently being used by at least one team");
+ }
+
+ const newCustomRoles = (org.customRoles || []).filter(
+ (role) => role.id !== id
+ );
+
+ if (newCustomRoles.length === (org.customRoles || []).length) {
+ throw new Error("Role not found");
+ }
+
+ await updateOrganization(org.id, { customRoles: newCustomRoles });
+}

packages/back-end/src/routers/organizations/organizations.controller.ts

@@ -9,6 +9,12 @@ import {
  getLicenseError,
 } from "enterprise";
 import { experimentHasLinkedChanges } from "shared/util";
+import {
+ getRoles,
+ areProjectRolesValid,
+ isRoleValid,
+ getDefaultRole,
+} from "shared/permissions";
 import {
  UpdateSdkWebhookProps,
  deleteLegacySdkWebhookById,
@@ -46,11 +52,11 @@ import { getAllTags } from "../../models/TagModel";
 import {
  Environment,
  Invite,
- MemberRole,
  MemberRoleWithProjects,
  NamespaceUsage,
  OrganizationInterface,
  OrganizationSettings,
+ Role,
  SDKAttribute,
 } from "../../../types/organization";
 import {
@@ -84,6 +90,9 @@ import {
  findOrganizationsByMemberId,
  hasOrganization,
  updateOrganization,
+ addCustomRole,
+ editCustomRole,
+ removeCustomRole,
 } from "../../models/OrganizationModel";
 import { findAllProjectsByOrganization } from "../../models/ProjectModel";
 import { ConfigFile } from "../../init/config";
@@ -99,11 +108,7 @@ import {
  getApiKeyByIdOrKey,
  getUnredactedSecretKey,
 } from "../../models/ApiKeyModel";
-import {
- getDefaultRole,
- getRoles,
- getUserPermissions,
-} from "../../util/organization.util";
+import { getUserPermissions } from "../../util/organization.util";
 import { deleteUser, findUserById, getAllUsers } from "../../models/UserModel";
 import {
  getAllExperiments,
@@ -326,6 +331,13 @@ export async function putMemberRole(
  });
  }
 
+ if (!isRoleValid(role, org) || !areProjectRolesValid(projectRoles, org)) {
+ return res.status(400).json({
+ status: 400,
+ message: "Invalid role",
+ });
+ }
+
  let found = false;
  org.members.forEach((m) => {
  if (m.id === id) {
@@ -571,6 +583,13 @@ export async function putInviteRole(
  const { key } = req.params;
  const originalInvites: Invite[] = cloneDeep(org.invites);
 
+ if (!isRoleValid(role, org) || !areProjectRolesValid(projectRoles, org)) {
+ return res.status(400).json({
+ status: 400,
+ message: "Invalid role",
+ });
+ }
+
  let found = false;
 
  org.invites.forEach((m) => {
@@ -970,7 +989,7 @@ export async function deleteNamespace(
 
 export async function getInviteInfo(
  req: AuthRequest<unknown, { key: string }>,
- res: ResponseWithStatusAndError<{ organization: string; role: MemberRole }>
+ res: ResponseWithStatusAndError<{ organization: string; role: string }>
 ) {
  const { key } = req.params;
 
@@ -1049,6 +1068,14 @@ export async function postInvite(
  projectRoles,
  } = req.body;
 
+ // Make sure role is valid
+ if (!isRoleValid(role, org) || !areProjectRolesValid(projectRoles, org)) {
+ return res.status(400).json({
+ status: 400,
+ message: "Invalid role",
+ });
+ }
+
  const license = getLicense();
  if (
  license &&
@@ -1848,6 +1875,14 @@ export async function addOrphanedUser(
  });
  }
 
+ // Make sure role is valid
+ if (!isRoleValid(role, org) || !areProjectRolesValid(projectRoles, org)) {
+ return res.status(400).json({
+ status: 400,
+ message: "Invalid role",
+ });
+ }
+
  const license = getLicense();
  if (
  license &&
@@ -2019,7 +2054,7 @@ export async function putLicenseKey(
 }
 
 export async function putDefaultRole(
- req: AuthRequest<{ defaultRole: MemberRole }>,
+ req: AuthRequest<{ defaultRole: string }>,
  res: Response
 ) {
  const context = getContextFromReq(req);
@@ -2034,6 +2069,10 @@ export async function putDefaultRole(
  );
  }
 
+ if (!isRoleValid(defaultRole, org)) {
+ throw new Error("Invalid role");
+ }
+
  if (!context.permissions.canManageTeam()) {
  context.permissions.throwPermissionError();
  }
@@ -2053,3 +2092,67 @@ export async function putDefaultRole(
  status: 200,
  });
 }
+
+export async function postCustomRole(req: AuthRequest<Role>, res: Response) {
+ const context = getContextFromReq(req);
+ const roleToAdd = req.body;
+
+ if (!context.hasPremiumFeature("custom-roles")) {
+ throw new Error("Must have an Enterprise License Key to use custom roles.");
+ }
+
+ if (!context.permissions.canManageCustomRoles()) {
+ context.permissions.throwPermissionError();
+ }
+
+ await addCustomRole(context.org, roleToAdd);
+
+ res.status(200).json({
+ status: 200,
+ });
+}
+
+export async function putCustomRole(
+ req: AuthRequest<Omit<Role, "id">, { id: string }>,
+ res: Response
+) {
+ const context = getContextFromReq(req);
+ const roleToUpdate = req.body;
+ const { id } = req.params;
+
+ if (!context.hasPremiumFeature("custom-roles")) {
+ throw new Error("Must have an Enterprise License Key to use custom roles.");
+ }
+
+ if (!context.permissions.canManageCustomRoles()) {
+ context.permissions.throwPermissionError();
+ }
+
+ await editCustomRole(context.org, id, roleToUpdate);
+
+ res.status(200).json({
+ status: 200,
+ });
+}
+
+export async function deleteCustomRole(
+ req: AuthRequest<null, { id: string }>,
+ res: Response
+) {
+ const context = getContextFromReq(req);
+ const { id } = req.params;
+
+ if (!context.hasPremiumFeature("custom-roles")) {
+ throw new Error("Must have an Enterprise License Key to use custom roles.");
+ }
+
+ if (!context.permissions.canManageCustomRoles()) {
+ context.permissions.throwPermissionError();
+ }
+
+ await removeCustomRole(context.org, context.teams, id);
+
+ res.status(200).json({
+ status: 200,
+ });
+}

packages/back-end/src/routers/organizations/organizations.router.ts

@@ -88,4 +88,9 @@ if (!IS_CLOUD) {
  );
 }
 
+// Custom Roles
+router.post("/custom-roles", organizationsController.postCustomRole);
+router.put("/custom-roles/:id", organizationsController.putCustomRole);
+router.delete("/custom-roles/:id", organizationsController.deleteCustomRole);
+
 export { router as organizationsRouter };