feat(controlplane): scope invitation system (#553)

migmartri · web-flow · commit 1b6c0aa7699a · 2024-03-01T17:50:39.000+01:00
Signed-off-by: Miguel Martinez Trivino &lt;miguel@chainloop.dev&gt;
diff --git a/app/cli/cmd/organization_invitation_create.go b/app/cli/cmd/organization_invitation_create.go
@@ -23,13 +23,13 @@ import (
 )
 
 func newOrganizationInvitationCreateCmd() *cobra.Command {
-	var receiverEmail, organizationID string
+	var receiverEmail string
 	cmd := &cobra.Command{
 		Use:   "create",
 		Short: "Invite a User to an Organization",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			res, err := action.NewOrgInvitationCreate(actionOpts).Run(
-				context.Background(), organizationID, receiverEmail)
+				context.Background(), receiverEmail)
 			if err != nil {
 				return err
 			}
@@ -42,9 +42,5 @@ func newOrganizationInvitationCreateCmd() *cobra.Command {
 	err := cmd.MarkFlagRequired("receiver")
 	cobra.CheckErr(err)
 
-	cmd.Flags().StringVar(&organizationID, "organization", "", "ID of the organization to invite the user to")
-	err = cmd.MarkFlagRequired("organization")
-	cobra.CheckErr(err)
-
 	return cmd
 }
diff --git a/app/cli/cmd/organization_invitation_list_sent.go b/app/cli/cmd/organization_invitation_list_sent.go
@@ -50,10 +50,10 @@ func orgInvitationTableOutput(items []*action.OrgInvitationItem) error {
 	}
 
 	t := newTableWriter()
-	t.AppendHeader(table.Row{"ID", "Org Name", "Receiver Email", "Status", "Created At"})
+	t.AppendHeader(table.Row{"ID", "Receiver Email", "Status", "Created At"})
 
 	for _, i := range items {
-		t.AppendRow(table.Row{i.ID, i.Organization.Name, i.ReceiverEmail, i.Status, i.CreatedAt.Format(time.RFC822)})
+		t.AppendRow(table.Row{i.ID, i.ReceiverEmail, i.Status, i.CreatedAt.Format(time.RFC822)})
 		t.AppendSeparator()
 	}
 
diff --git a/app/cli/internal/action/org_invitation_create.go b/app/cli/internal/action/org_invitation_create.go
@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2024 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -29,11 +29,10 @@ func NewOrgInvitationCreate(cfg *ActionsOpts) *OrgInvitationCreate {
 	return &OrgInvitationCreate{cfg}
 }
 
-func (action *OrgInvitationCreate) Run(ctx context.Context, organization, receiver string) (*OrgInvitationItem, error) {
+func (action *OrgInvitationCreate) Run(ctx context.Context, receiver string) (*OrgInvitationItem, error) {
 	client := pb.NewOrgInvitationServiceClient(action.cfg.CPConnection)
 	resp, err := client.Create(ctx, &pb.OrgInvitationServiceCreateRequest{
-		OrganizationId: organization,
-		ReceiverEmail:  receiver,
+		ReceiverEmail: receiver,
 	})
 
 	if err != nil {
diff --git a/app/controlplane/api/controlplane/v1/org_invitation.pb.go b/app/controlplane/api/controlplane/v1/org_invitation.pb.go
diff --git a/app/controlplane/api/controlplane/v1/org_invitation.pb.validate.go b/app/controlplane/api/controlplane/v1/org_invitation.pb.validate.go
diff --git a/app/controlplane/api/controlplane/v1/org_invitation.proto b/app/controlplane/api/controlplane/v1/org_invitation.proto
@@ -17,9 +17,9 @@ syntax = "proto3";
 
 package controlplane.v1;
 
+import "controlplane/v1/response_messages.proto";
 import "google/protobuf/timestamp.proto";
 import "validate/validate.proto";
-import "controlplane/v1/response_messages.proto";
 
 option go_package = "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1;v1";
 
@@ -33,7 +33,8 @@ service OrgInvitationService {
 }
 
 message OrgInvitationServiceCreateRequest {
-  string organization_id = 1 [(validate.rules).string.uuid = true];
+  // organization is deprecated and not used anymore
+  string organization_id = 1 [deprecated = true];
   string receiver_email = 2 [(validate.rules).string.email = true];
 }
 
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/org_invitation.ts b/app/controlplane/api/gen/frontend/controlplane/v1/org_invitation.ts
diff --git a/app/controlplane/internal/biz/orginvitation.go b/app/controlplane/internal/biz/orginvitation.go
@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2024 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -48,7 +48,7 @@ type OrgInvitationRepo interface {
 	PendingInvitation(ctx context.Context, orgID uuid.UUID, receiverEmail string) (*OrgInvitation, error)
 	PendingInvitations(ctx context.Context, receiverEmail string) ([]*OrgInvitation, error)
 	SoftDelete(ctx context.Context, id uuid.UUID) error
-	ListBySender(ctx context.Context, sender uuid.UUID) ([]*OrgInvitation, error)
+	ListBySenderAndOrg(ctx context.Context, sender, org uuid.UUID) ([]*OrgInvitation, error)
 	ChangeStatus(ctx context.Context, ID uuid.UUID, status OrgInvitationStatus) error
 }
 
@@ -87,14 +87,15 @@ func (uc *OrgInvitationUseCase) Create(ctx context.Context, orgID, senderID, rec
 		return nil, NewErrValidationStr("sender and receiver emails cannot be the same")
 	}
 
-	// 3 - Check if the user has permissions to invite to the org
+	// 3 - Check that the user is a member of the given org
+	// NOTE: this check is not necessary, as the user is already a member of the org
 	if membership, err := uc.mRepo.FindByOrgAndUser(ctx, orgUUID, senderUUID); err != nil {
 		return nil, fmt.Errorf("failed to find memberships: %w", err)
 	} else if membership == nil {
 		return nil, NewErrNotFound("user does not have permission to invite to this org")
 	}
 
-	// 4 - The receiver does not exist in the org already
+	// 4 - The receiver does exist in the org already
 	memberships, err := uc.mRepo.FindByOrg(ctx, orgUUID)
 	if err != nil {
 		return nil, fmt.Errorf("error finding memberships for user %s: %w", senderUUID.String(), err)
@@ -116,7 +117,7 @@ func (uc *OrgInvitationUseCase) Create(ctx context.Context, orgID, senderID, rec
 		return nil, NewErrValidationStr("invitation already exists for this user and org")
 	}
 
-	// 5 - Create the invitation
+	// 6 - Create the invitation
 	invitation, err := uc.repo.Create(ctx, orgUUID, senderUUID, receiverEmail)
 	if err != nil {
 		return nil, fmt.Errorf("error creating invitation: %w", err)
@@ -125,13 +126,18 @@ func (uc *OrgInvitationUseCase) Create(ctx context.Context, orgID, senderID, rec
 	return invitation, nil
 }
 
-func (uc *OrgInvitationUseCase) ListBySender(ctx context.Context, senderID string) ([]*OrgInvitation, error) {
+func (uc *OrgInvitationUseCase) ListBySenderAndOrg(ctx context.Context, senderID, orgID string) ([]*OrgInvitation, error) {
 	senderUUID, err := uuid.Parse(senderID)
 	if err != nil {
 		return nil, NewErrInvalidUUID(err)
 	}
 
-	return uc.repo.ListBySender(ctx, senderUUID)
+	orgUUID, err := uuid.Parse(orgID)
+	if err != nil {
+		return nil, NewErrInvalidUUID(err)
+	}
+
+	return uc.repo.ListBySenderAndOrg(ctx, senderUUID, orgUUID)
 }
 
 // Revoke an invitation by ID only if the user is the one who created it
diff --git a/app/controlplane/internal/biz/orginvitation_integration_test.go b/app/controlplane/internal/biz/orginvitation_integration_test.go
@@ -30,6 +30,46 @@ import (
 
 const receiverEmail = "sarah@cyberdyne.io"
 
+func (s *OrgInvitationIntegrationTestSuite) TestList() {
+	ctx := context.Background()
+	inviteOrg1A, err := s.OrgInvitation.Create(ctx, s.org1.ID, s.user.ID, receiverEmail)
+	s.NoError(err)
+	inviteOrg1B, err := s.OrgInvitation.Create(ctx, s.org1.ID, s.user.ID, "another-email@cyberdyne.io")
+	s.NoError(err)
+	inviteOrg2A, err := s.OrgInvitation.Create(ctx, s.org2.ID, s.user.ID, receiverEmail)
+	s.NoError(err)
+
+	testCases := []struct {
+		name     string
+		orgID    string
+		expected []*biz.OrgInvitation
+	}{
+		{
+			name:     "org1",
+			orgID:    s.org1.ID,
+			expected: []*biz.OrgInvitation{inviteOrg1A, inviteOrg1B},
+		},
+		{
+			name:     "org2",
+			orgID:    s.org2.ID,
+			expected: []*biz.OrgInvitation{inviteOrg2A},
+		},
+		{
+			name:     "org3",
+			orgID:    s.org3.ID,
+			expected: []*biz.OrgInvitation{},
+		},
+	}
+
+	for _, tc := range testCases {
+		s.T().Run(tc.name, func(t *testing.T) {
+			invites, err := s.OrgInvitation.ListBySenderAndOrg(ctx, s.user.ID, tc.orgID)
+			s.NoError(err)
+			s.Equal(tc.expected, invites)
+		})
+	}
+}
+
 func (s *OrgInvitationIntegrationTestSuite) TestCreate() {
 	s.T().Run("invalid org ID", func(t *testing.T) {
 		invite, err := s.OrgInvitation.Create(context.Background(), "deadbeef", s.user.ID, receiverEmail)
diff --git a/app/controlplane/internal/data/ent/migrate/migrations/20240229202352.sql b/app/controlplane/internal/data/ent/migrate/migrations/20240229202352.sql
@@ -2,7 +2,7 @@
 ALTER TABLE "memberships" ADD COLUMN "role" character varying;
 
 -- Set the existing memberships to the role "role:admin" to not to break compatibility
-UPDATE "memberships" SET "role" = 'role:admin';
+UPDATE "memberships" SET "role" = 'role:org:admin';
 
 -- enable the not null constraint
 ALTER TABLE "memberships" ALTER COLUMN "role" SET NOT NULL;
diff --git a/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum b/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum
@@ -1,4 +1,4 @@
-h1:NDHFGuZrveyPwm51HEFX0jjZLE9OuPnboF9gWEAPJ8Q=
+h1:mf+rCMij2DFHC9ogu8h+ktB0OPUSBAanvHQeIAoPfc4=
 20230706165452_init-schema.sql h1:VvqbNFEQnCvUVyj2iDYVQQxDM0+sSXqocpt/5H64k8M=
 20230710111950-cas-backend.sql h1:A8iBuSzZIEbdsv9ipBtscZQuaBp3V5/VMw7eZH6GX+g=
 20230712094107-cas-backends-workflow-runs.sql h1:a5rzxpVGyd56nLRSsKrmCFc9sebg65RWzLghKHh5xvI=
@@ -22,4 +22,4 @@ h1:NDHFGuZrveyPwm51HEFX0jjZLE9OuPnboF9gWEAPJ8Q=
 20240223100036.sql h1:5cO/X4RmVWD2RVzPESTAHH5Z0rUKd7Wd6xyDa5hDA6A=
 20240226145219.sql h1:m90QJxxZjOC7CjMPijxc3vf5pzX1X6Ac9M8Ms0lJ0gQ=
 20240228152445.sql h1:+F9k29PxJCv4CuwoMcnO24y0a+mxqaWsJr2zgI8XDx0=
-20240229202352.sql h1:8QXj8CCMbjBV+UgZeDY1YFx87VERrbAPiDYZINzW9Mc=
+20240229202352.sql h1:1oSaJh+gNJ8cc+9AGBizFG4uk6GkHph0R3hsjjz9w4g=
diff --git a/app/controlplane/internal/data/orginvitation.go b/app/controlplane/internal/data/orginvitation.go
@@ -110,8 +110,8 @@ func (r *OrgInvitation) SoftDelete(ctx context.Context, id uuid.UUID) error {
 	return r.data.db.OrgInvitation.UpdateOneID(id).SetDeletedAt(time.Now()).Exec(ctx)
 }
 
-func (r *OrgInvitation) ListBySender(ctx context.Context, userID uuid.UUID) ([]*biz.OrgInvitation, error) {
-	invite, err := r.query().Where(orginvitation.SenderID(userID)).All(ctx)
+func (r *OrgInvitation) ListBySenderAndOrg(ctx context.Context, userID, orgID uuid.UUID) ([]*biz.OrgInvitation, error) {
+	invite, err := r.query().Where(orginvitation.SenderID(userID), orginvitation.OrganizationID(orgID)).All(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("error finding invites for user %s: %w", userID.String(), err)
 	}
diff --git a/app/controlplane/internal/service/orginvitation.go b/app/controlplane/internal/service/orginvitation.go
@@ -43,8 +43,13 @@ func (s *OrgInvitationService) Create(ctx context.Context, req *pb.OrgInvitation
 		return nil, err
 	}
 
+	org, err := requireCurrentOrg(ctx)
+	if err != nil {
+		return nil, err
+	}
+
 	// Validations and rbac checks are done in the biz layer
-	i, err := s.useCase.Create(ctx, req.OrganizationId, user.ID, req.ReceiverEmail)
+	i, err := s.useCase.Create(ctx, org.ID, user.ID, req.ReceiverEmail)
 	if err != nil {
 		return nil, handleUseCaseErr("invitation", err, s.log)
 	}
@@ -71,7 +76,12 @@ func (s *OrgInvitationService) ListSent(ctx context.Context, _ *pb.OrgInvitation
 		return nil, err
 	}
 
-	invitations, err := s.useCase.ListBySender(ctx, user.ID)
+	org, err := requireCurrentOrg(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	invitations, err := s.useCase.ListBySenderAndOrg(ctx, user.ID, org.ID)
 	if err != nil {
 		return nil, handleUseCaseErr("invitation", err, s.log)
 	}

Original file line number	Diff line number	Diff line change
`@@ -50,10 +50,10 @@ func orgInvitationTableOutput(items []*action.OrgInvitationItem) error {`
`50`	`50`	`}`
`51`	`51`
`52`	`52`	`t := newTableWriter()`
`53`		`- t.AppendHeader(table.Row{"ID", "Org Name", "Receiver Email", "Status", "Created At"})`
	`53`	`+ t.AppendHeader(table.Row{"ID", "Receiver Email", "Status", "Created At"})`
`54`	`54`
`55`	`55`	`for _, i := range items {`
`56`		`- t.AppendRow(table.Row{i.ID, i.Organization.Name, i.ReceiverEmail, i.Status, i.CreatedAt.Format(time.RFC822)})`
	`56`	`+ t.AppendRow(table.Row{i.ID, i.ReceiverEmail, i.Status, i.CreatedAt.Format(time.RFC822)})`
`57`	`57`	`t.AppendSeparator()`
`58`	`58`	`}`
`59`	`59`
Original file line number	Diff line number	Diff line change
`@@ -17,9 +17,9 @@ syntax = "proto3";`
`17`	`17`
`18`	`18`	`package controlplane.v1;`
`19`	`19`
	`20`	`+import "controlplane/v1/response_messages.proto";`
`20`	`21`	`import "google/protobuf/timestamp.proto";`
`21`	`22`	`import "validate/validate.proto";`
`22`		`-import "controlplane/v1/response_messages.proto";`
`23`	`23`
`24`	`24`	`option go_package = "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1;v1";`
`25`	`25`
`@@ -33,7 +33,8 @@ service OrgInvitationService {`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`message OrgInvitationServiceCreateRequest {`
`36`		`- string organization_id = 1 [(validate.rules).string.uuid = true];`
	`36`	`+ // organization is deprecated and not used anymore`
	`37`	`+ string organization_id = 1 [deprecated = true];`
`37`	`38`	`string receiver_email = 2 [(validate.rules).string.email = true];`
`38`	`39`	`}`
`39`	`40`