[server] Fix permission issue for collaborators in listenForPrebuildUpdates

Incl. tests that exercise OrganizationService.listOrganizations()

Author: geropl

components/server/src/orgs/organization-service.spec.ts

@@ -4,14 +4,14 @@
  * See License.AGPL.txt in the project root for license information.
  */
 
-import { TeamDB, testContainer } from "@gitpod/gitpod-db/lib";
+import { resetDB, TeamDB, testContainer, TypeORM } from "@gitpod/gitpod-db/lib";
 import * as chai from "chai";
 import { Container } from "inversify";
 import "mocha";
 import { OrganizationService } from "./organization-service";
 import { InstallationService } from "../auth/installation-service";
 import { ProjectsService } from "../projects/projects-service";
-import { Authorizer } from "../authorization/authorizer";
+import { Authorizer, SYSTEM_USER } from "../authorization/authorizer";
 import { IAnalyticsWriter } from "@gitpod/gitpod-protocol/lib/analytics";
 import { DefaultWorkspaceImageValidator } from "./default-workspace-image-validator";
 import { UserService } from "../user/user-service";
@@ -24,6 +24,9 @@ import { EntitlementService, EntitlementServiceImpl } from "../billing/entitleme
 import { EntitlementServiceUBP, LazyOrganizationService } from "../billing/entitlement-service-ubp";
 import { BillingModes } from "../billing/billing-mode";
 import { VerificationService } from "../auth/verification-service";
+import { Organization, User } from "@gitpod/gitpod-protocol";
+import { Experiments } from "@gitpod/gitpod-protocol/lib/experiments/configcat-server";
+import { createTestContainer, withTestCtx } from "../test/service-testing-container-module";
 
 const expect = chai.expect;
 
@@ -197,4 +200,104 @@ describe("OrganizationService", async () => {
             expect(settings.allowedWorkspaceClasses).to.eql(["unknown"]);
         });
     });
+
+    describe("listOrganizations", async () => {
+        let container: Container;
+        let os: OrganizationService;
+        let userService: UserService;
+        let owner: User;
+        let member: User;
+        let collaborator: User;
+        let stranger: User;
+        let org1: Organization;
+        let org2: Organization;
+
+        beforeEach(async () => {
+            container = createTestContainer();
+            Experiments.configureTestingClient({});
+
+            userService = container.get<UserService>(UserService);
+            os = container.get<OrganizationService>(OrganizationService);
+
+            // Create test users
+            owner = await userService.createUser({
+                identity: {
+                    authId: "github|owner",
+                    authName: "owner",
+                    authProviderId: "github",
+                },
+            });
+
+            member = await userService.createUser({
+                identity: {
+                    authId: "github|member",
+                    authName: "member",
+                    authProviderId: "github",
+                },
+            });
+
+            collaborator = await userService.createUser({
+                identity: {
+                    authId: "github|collaborator",
+                    authName: "collaborator",
+                    authProviderId: "github",
+                },
+            });
+
+            stranger = await userService.createUser({
+                identity: {
+                    authId: "github|stranger",
+                    authName: "stranger",
+                    authProviderId: "github",
+                },
+            });
+
+            // Create organizations
+            org1 = await os.createOrganization(owner.id, "First Org");
+            org2 = await os.createOrganization(owner.id, "Second Org");
+
+            // Add members with different roles
+            const invite1 = await os.getOrCreateInvite(owner.id, org1.id);
+            await withTestCtx(SYSTEM_USER, () => os.joinOrganization(member.id, invite1.id));
+            await os.addOrUpdateMember(owner.id, org1.id, collaborator.id, "collaborator");
+
+            // Create an org-owned user
+            await os.createOrgOwnedUser({
+                organizationId: org1.id,
+                identity: {
+                    authId: "github|orgowned",
+                    authName: "orgowned",
+                    authProviderId: "github",
+                },
+            });
+        });
+
+        afterEach(async () => {
+            // Clean up DB
+            await resetDB(container.get(TypeORM));
+            // Deactivate all services
+            await container.unbindAllAsync();
+        });
+
+        it("should list only organizations the user is a member of", async () => {
+            // Owner is member of both orgs
+            const ownerResult = await os.listOrganizations(owner.id, {}, "member");
+            expect(ownerResult.rows.map((o) => o.id)).to.include(org1.id);
+            expect(ownerResult.rows.map((o) => o.id)).to.include(org2.id);
+
+            // Member is only in org1
+            const memberResult = await os.listOrganizations(member.id, {}, "member");
+            expect(memberResult.rows.map((o) => o.id)).to.include(org1.id);
+            expect(memberResult.rows.map((o) => o.id)).to.not.include(org2.id);
+
+            // Collaborator is only in org1
+            const collaboratorResults = await os.listOrganizations(collaborator.id, {}, "member");
+            expect(collaboratorResults.rows.map((o) => o.id)).to.include(org1.id);
+            expect(collaboratorResults.rows.map((o) => o.id)).to.not.include(org2.id);
+
+            // Stranger is in no orgs
+            const strangerResult = await os.listOrganizations(stranger.id, {}, "member");
+            expect(strangerResult.total).to.equal(0);
+        });
+    });
 });

components/server/src/workspace/gitpod-server-impl.ts

@@ -268,7 +268,11 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable {
                     subjectId: SubjectId.fromUserId(userId),
                 },
                 async () => {
-                    const organizations = await this.getTeams(ctx ?? {});
+                    const { rows: organizations } = await this.organizationService.listOrganizations(
+                        userId,
+                        { limit: 10 },
+                        "member",
+                    );
                     for (const organization of organizations) {
                         const hasPermission = await this.auth.hasPermissionOnOrganization(
                             userId,