[_] feat: workspace role guard

src/modules/workspaces/domains/workspace-team-user.domain.ts

@@ -0,0 +1,48 @@
+import { User } from '../../user/user.domain';
+import { WorkspaceTeam } from './workspace-team.domain';
+import { WorkspaceTeamUserAttributes } from '../attributes/workspace-team-users.attributes';
+
+export class WorkspaceTeamUser implements WorkspaceTeamUserAttributes {
+  id: string;
+  teamId: string;
+  memberId: string;
+  team?: WorkspaceTeam;
+  createdAt: Date;
+  updatedAt: Date;
+
+  constructor({
+    id,
+    teamId,
+    memberId,
+    team,
+    createdAt,
+    updatedAt,
+  }: WorkspaceTeamUserAttributes & { team?: WorkspaceTeam }) {
+    this.id = id;
+    this.teamId = teamId;
+    this.memberId = memberId;
+    this.team = team;
+    this.createdAt = createdAt;
+    this.updatedAt = updatedAt;
+  }
+
+  static build(
+    workspaceTeamUser: WorkspaceTeamUserAttributes & {
+      team?: WorkspaceTeam;
+      member?: User;
+    },
+  ): WorkspaceTeamUser {
+    return new WorkspaceTeamUser(workspaceTeamUser);
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      teamId: this.teamId,
+      memberId: this.memberId,
+      team: this.team ? this.team.toJSON() : undefined,
+      createdAt: this.createdAt,
+      updatedAt: this.updatedAt,
+    };
+  }
+}

src/modules/workspaces/domains/workspace-team.domain.ts

@@ -1,3 +1,4 @@
+import { User } from '../../user/user.domain';
 import { WorkspaceTeamAttributes } from '../attributes/workspace-team.attributes';
 
 export class WorkspaceTeam implements WorkspaceTeamAttributes {
@@ -24,6 +25,10 @@ export class WorkspaceTeam implements WorkspaceTeamAttributes {
     this.updatedAt = updatedAt;
   }
 
+  isUserManager(userUuid: User['uuid']) {
+    return userUuid === this.managerId;
+  }
+
   static build(teamAttributes: WorkspaceTeamAttributes): WorkspaceTeam {
     return new WorkspaceTeam(teamAttributes);
   }

src/modules/workspaces/domains/workspace-user.domain.ts

@@ -0,0 +1,57 @@
+import { WorkspaceUserAttributes } from '../attributes/workspace-users.attributes';
+
+export class WorkspaceUser implements WorkspaceUserAttributes {
+  id: string;
+  memberId: string;
+  key: string;
+  workspaceId: string;
+  spaceLimit: bigint;
+  driveUsage: bigint;
+  backupsUsage: bigint;
+  deactivated: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+
+  constructor({
+    id,
+    memberId,
+    key,
+    workspaceId,
+    spaceLimit,
+    driveUsage,
+    backupsUsage,
+    deactivated,
+    createdAt,
+    updatedAt,
+  }: WorkspaceUserAttributes) {
+    this.id = id;
+    this.memberId = memberId;
+    this.key = key;
+    this.workspaceId = workspaceId;
+    this.spaceLimit = spaceLimit;
+    this.driveUsage = driveUsage;
+    this.backupsUsage = backupsUsage;
+    this.deactivated = deactivated;
+    this.createdAt = createdAt;
+    this.updatedAt = updatedAt;
+  }
+
+  static build(workspaceUser: WorkspaceUserAttributes): WorkspaceUser {
+    return new WorkspaceUser(workspaceUser);
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      memberId: this.memberId,
+      key: this.key,
+      workspaceId: this.workspaceId,
+      spaceLimit: this.spaceLimit.toString(),
+      driveUsage: this.driveUsage.toString(),
+      backupsUsage: this.backupsUsage.toString(),
+      deactivated: this.deactivated,
+      createdAt: this.createdAt,
+      updatedAt: this.updatedAt,
+    };
+  }
+}

src/modules/workspaces/domains/workspaces.domain.ts

@@ -1,3 +1,4 @@
+import { UserAttributes } from '../../user/user.attributes';
 import { WorkspaceAttributes } from '../attributes/workspace.attributes';
 
 export class Workspace implements WorkspaceAttributes {
@@ -40,6 +41,10 @@ export class Workspace implements WorkspaceAttributes {
     return new Workspace(user);
   }
 
+  isUserOwner(userUuid: UserAttributes['uuid']) {
+    return userUuid === this.ownerId;
+  }
+
   toJSON() {
     return {
       id: this.id,

src/modules/workspaces/guards/workspace-required-access.decorator.ts

@@ -0,0 +1,29 @@
+import { SetMetadata } from '@nestjs/common';
+
+export enum WorkspaceRole {
+  OWNER = 'owner',
+  MANAGER = 'manager',
+  MEMBER = 'member',
+}
+
+export enum AccessContext {
+  WORKSPACE = 'workspace',
+  TEAM = 'team',
+}
+
+export const WorkspaceContextIdFieldName = {
+  [AccessContext.WORKSPACE]: 'workspaceId',
+  [AccessContext.TEAM]: 'teamId',
+};
+
+export interface AccessOptions {
+  accessContext: AccessContext;
+  requiredRole: WorkspaceRole;
+  idSource: 'params' | 'body' | 'query';
+}
+
+export const WorkspaceRequiredAccess = (
+  accessContext: AccessContext,
+  requiredRole: WorkspaceRole,
+  idSource: 'params' | 'body' | 'query' = 'params',
+) => SetMetadata('accessControl', { accessContext, requiredRole, idSource });

src/modules/workspaces/guards/workspaces.guard.ts

@@ -0,0 +1,114 @@
+// flexible-access.guard.ts
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { WorkspacesUsecases } from '../workspaces.usecase';
+import {
+  AccessContext,
+  AccessOptions,
+  WorkspaceContextIdFieldName,
+  WorkspaceRole,
+} from './workspace-required-access.decorator';
+
+@Injectable()
+export class WorkspaceGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    private workspaceUseCases: WorkspacesUsecases,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const accessOptions: AccessOptions = this.reflector.get(
+      'accessControl',
+      context.getHandler(),
+    );
+
+    if (!accessOptions) {
+      return true;
+    }
+
+    const { requiredRole, accessContext, idSource } = accessOptions;
+
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+
+    const id = this.getIdFromRequest(
+      request,
+      idSource,
+      WorkspaceContextIdFieldName[accessContext],
+    );
+
+    if (accessContext === AccessContext.WORKSPACE) {
+      return this.checkUserWorkspaceRole(user.uuid, id, requiredRole);
+    } else if (accessContext === AccessContext.TEAM) {
+      return this.checkUserTeamRole(user.uuid, id, requiredRole);
+    }
+
+    return false;
+  }
+
+  private async checkUserWorkspaceRole(
+    userUuid: string,
+    workspaceId: string,
+    role: WorkspaceRole,
+  ) {
+    const { workspace, workspaceUser } =
+      await this.workspaceUseCases.findUserInWorkspace(userUuid, workspaceId);
+
+    if (!workspace) {
+      throw new NotFoundException('Workspace not found');
+    }
+
+    if (
+      !workspaceUser ||
+      !(role === WorkspaceRole.OWNER && workspace.isUserOwner(userUuid))
+    ) {
+      Logger.log(
+        `[WORKSPACES/GUARD]: user has no requiered access to workspace. id: ${workspaceId} userUuid: ${userUuid} `,
+      );
+      throw new ForbiddenException('You have no access to this workspace');
+    }
+
+    return !!workspaceUser;
+  }
+
+  private async checkUserTeamRole(
+    userUuid: string,
+    teamId: string,
+    role: WorkspaceRole,
+  ) {
+    const { team, teamUser } = await this.workspaceUseCases.findUserInTeam(
+      userUuid,
+      teamId,
+    );
+
+    const workspace = await this.workspaceUseCases.findById(team.workspaceId);
+    if (workspace.isUserOwner(userUuid)) {
+      return true;
+    }
+
+    if (teamUser && role === WorkspaceRole.MANAGER) {
+      return team.isUserManager(userUuid);
+    }
+
+    if (teamUser && role === WorkspaceRole.MEMBER) {
+      return true;
+    }
+
+    throw new ForbiddenException('You have no access to this team');
+  }
+
+  private getIdFromRequest(
+    request,
+    source: 'params' | 'body' | 'query',
+    field: string,
+  ): string | undefined {
+    return request[source]?.[field];
+  }
+}

src/modules/workspaces/models/workspace-team-users.model.ts

@@ -14,7 +14,7 @@ import { WorkspaceTeamUserAttributes } from '../attributes/workspace-team-users.
 @Table({
   underscored: true,
   timestamps: true,
-  tableName: 'teams_users',
+  tableName: 'workspace_teams_users',
 })
 export class WorkspaceTeamUserModel
   extends Model

src/modules/workspaces/models/workspace.model.ts

@@ -6,6 +6,7 @@ import {
   PrimaryKey,
   ForeignKey,
   BelongsTo,
+  HasMany,
 } from 'sequelize-typescript';
 import { UserModel } from '../../user/user.model';
 import { WorkspaceUserModel } from './workspace-users.model';
@@ -60,6 +61,9 @@ export class WorkspaceModel extends Model implements WorkspaceAttributes {
   @Column(DataType.UUID)
   workspaceUserId: string;
 
+  @HasMany(() => WorkspaceUserModel)
+  workspaceUsers: WorkspaceUserModel[];
+
   @Column
   createdAt: Date;
 

src/modules/workspaces/repositories/team.repository.ts

@@ -8,6 +8,8 @@ import { WorkspaceTeamModel } from '../models/workspace-team.model';
 import { WorkspaceTeamUserModel } from '../models/workspace-team-users.model';
 import { WorkspaceTeam } from '../domains/workspace-team.domain';
 import { WorkspaceTeamAttributes } from '../attributes/workspace-team.attributes';
+import { UserAttributes } from '../../user/user.attributes';
+import { WorkspaceTeamUser } from '../domains/workspace-team-user.domain';
 
 @Injectable()
 export class SequelizeWorkspaceTeamRepository {
@@ -44,6 +46,26 @@ export class SequelizeWorkspaceTeamRepository {
     return result.map((teamUser) => User.build({ ...teamUser.member }));
   }
 
+  async getTeamUserAndTeamByTeamId(
+    userUuid: UserAttributes['uuid'],
+    teamId: WorkspaceTeamAttributes['id'],
+  ) {
+    const team = await this.teamModel.findOne({
+      where: { id: teamId },
+      include: {
+        required: false,
+        model: WorkspaceTeamUserModel,
+        where: { memberId: userUuid },
+      },
+    });
+    return {
+      team: team ? this.toDomain(team) : null,
+      teamUser: team.teamUsers[0]
+        ? this.teamUserToDomain(team.teamUsers[0])
+        : null,
+    };
+  }
+
   async getTeamById(
     teamId: WorkspaceTeamAttributes['id'],
   ): Promise<WorkspaceTeam | null> {
@@ -85,4 +107,10 @@ export class SequelizeWorkspaceTeamRepository {
       ...model.toJSON(),
     });
   }
+
+  teamUserToDomain(model: WorkspaceTeamUserModel): WorkspaceTeamUser {
+    return WorkspaceTeamUser.build({
+      ...model.toJSON(),
+    });
+  }
 }