Skip to content

Commit 1f37384

Browse files
fomalhautbfomalhautb
authored
System team permissions (stack-auth#82)
* added default permissions to prisma * added system team permission * fixed permission update * added system permission UI * fixed permission update * added create team client * added client create team * added client team create endpoint * fixed user.createTeam, updated demo * added default permissions for team creators and members * added createTeamForUser * added permission id format check * updated db schema for default permission, added default perms when project is created * fixed merge errors
1 parent b79bee6 commit 1f37384

File tree

39 files changed

+1596
-739
lines changed

39 files changed

+1596
-739
lines changed

‎apps/backend/prisma/migrations/20240618150845_system_team_permission/migration.sql‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/*
2+
Warnings:
3+
4+
- The primary key for the `TeamMemberDirectPermission` table will be changed. If it partially fails, the table could be left without primary key constraint.
5+
- A unique constraint covering the columns `[projectId,projectUserId,teamId,permissionDbId]` on the table `TeamMemberDirectPermission` will be added. If there are existing duplicate values, this will fail.
6+
- A unique constraint covering the columns `[projectId,projectUserId,teamId,systemPermission]` on the table `TeamMemberDirectPermission` will be added. If there are existing duplicate values, this will fail.
7+
- The required column `id` was added to the `TeamMemberDirectPermission` table with a prisma-level default value. This is not possible if the table is not empty. Please add this column as optional, then populate it before making it required.
8+
9+
*/
10+
-- CreateEnum
11+
CREATE TYPE "TeamSystemPermission" AS ENUM ('UPDATE_TEAM', 'DELETE_TEAM', 'READ_MEMBERS', 'REMOVE_MEMBERS', 'INVITE_MEMBERS');
12+
13+
-- AlterTable
14+
ALTER TABLE "Permission" ADD COLUMN "isDefaultTeamCreatorPermission" BOOLEAN NOT NULL DEFAULT false,
15+
ADD COLUMN "isDefaultTeamMemberPermission" BOOLEAN NOT NULL DEFAULT false;
16+
17+
-- AlterTable
18+
ALTER TABLE "PermissionEdge" ADD COLUMN "parentTeamSystemPermission" "TeamSystemPermission",
19+
ALTER COLUMN "parentPermissionDbId" DROP NOT NULL;
20+
21+
-- AlterTable
22+
ALTER TABLE "ProjectConfig" ADD COLUMN "teamCreateDefaultSystemPermissions" "TeamSystemPermission"[],
23+
ADD COLUMN "teamMemberDefaultSystemPermissions" "TeamSystemPermission"[];
24+
25+
26+
-- -- AlterTable
27+
-- ALTER TABLE "TeamMemberDirectPermission" DROP CONSTRAINT "TeamMemberDirectPermission_pkey",
28+
-- ADD COLUMN "id" UUID NOT NULL,
29+
-- ADD COLUMN "systemPermission" "TeamSystemPermission",
30+
-- ALTER COLUMN "permissionDbId" DROP NOT NULL,
31+
-- ADD CONSTRAINT "TeamMemberDirectPermission_pkey" PRIMARY KEY ("id");
32+
33+
-- -- CreateIndex
34+
-- CREATE UNIQUE INDEX "TeamMemberDirectPermission_projectId_projectUserId_teamId_p_key" ON "TeamMemberDirectPermission"("projectId", "projectUserId", "teamId", "permissionDbId");
35+
36+
-- -- CreateIndex
37+
-- CREATE UNIQUE INDEX "TeamMemberDirectPermission_projectId_projectUserId_teamId_s_key" ON "TeamMemberDirectPermission"("projectId", "projectUserId", "teamId", "systemPermission");
38+
39+
40+
-- Step 1: Add `id` as an optional column
41+
ALTER TABLE "TeamMemberDirectPermission"
42+
ADD COLUMN "id" UUID,
43+
ADD COLUMN "systemPermission" "TeamSystemPermission";
44+
45+
-- Step 2: Populate the `id` column with UUID values
46+
UPDATE "TeamMemberDirectPermission" SET "id" = gen_random_uuid();
47+
48+
-- Step 3: Make the `id` column required
49+
ALTER TABLE "TeamMemberDirectPermission" ALTER COLUMN "id" SET NOT NULL;
50+
51+
-- Step 4: Ensure there are no duplicate values for the unique constraints
52+
-- There should be no duplicates for the unique constraints
53+
54+
-- Step 5: Drop the existing primary key constraint
55+
ALTER TABLE "TeamMemberDirectPermission" DROP CONSTRAINT "TeamMemberDirectPermission_pkey",
56+
ALTER COLUMN "permissionDbId" DROP NOT NULL;
57+
58+
-- Step 6: Add the unique constraints
59+
CREATE UNIQUE INDEX "TeamMemberDirectPermission_projectId_projectUserId_teamId_p_key" ON "TeamMemberDirectPermission"("projectId", "projectUserId", "teamId", "permissionDbId");
60+
CREATE UNIQUE INDEX "TeamMemberDirectPermission_projectId_projectUserId_teamId_s_key" ON "TeamMemberDirectPermission"("projectId", "projectUserId", "teamId", "systemPermission");
61+
62+
-- Step 7: Add the new primary key constraint
63+
ALTER TABLE "TeamMemberDirectPermission" ADD CONSTRAINT "TeamMemberDirectPermission_pkey" PRIMARY KEY ("id");

‎apps/backend/prisma/schema.prisma‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,16 +39,20 @@ model ProjectConfig {
3939
createdAt DateTime @default(now())
4040
updatedAt DateTime @updatedAt
4141
42-
allowLocalhost Boolean
43-
credentialEnabled Boolean
44-
magicLinkEnabled Boolean
42+
allowLocalhost Boolean
43+
credentialEnabled Boolean
44+
magicLinkEnabled Boolean
45+
4546
createTeamOnSignUp Boolean
4647
4748
projects Project[]
4849
oauthProviderConfigs OAuthProviderConfig[]
4950
emailServiceConfig EmailServiceConfig?
5051
domains ProjectDomain[]
5152
permissions Permission[]
53+
54+
teamCreateDefaultSystemPermissions TeamSystemPermission[]
55+
teamMemberDefaultSystemPermissions TeamSystemPermission[]
5256
}
5357

5458
model ProjectDomain {
@@ -115,18 +119,23 @@ model TeamMember {
115119
}
116120

117121
model TeamMemberDirectPermission {
122+
id String @id @default(uuid()) @db.Uuid
118123
projectId String
119-
projectUserId String @db.Uuid
120-
teamId String @db.Uuid
121-
permissionDbId String @db.Uuid
124+
projectUserId String @db.Uuid
125+
teamId String @db.Uuid
126+
permissionDbId String? @db.Uuid
122127
123128
createdAt DateTime @default(now())
124129
updatedAt DateTime @updatedAt
125130
126131
teamMember TeamMember @relation(fields: [projectId, projectUserId, teamId], references: [projectId, projectUserId, teamId], onDelete: Cascade)
127-
permission Permission @relation(fields: [permissionDbId], references: [dbId], onDelete: Cascade)
128132
129-
@@id([projectId, projectUserId, teamId, permissionDbId])
133+
// exactly one of [permissionId && permission] or [systemPermission] must be set
134+
permission Permission? @relation(fields: [permissionDbId], references: [dbId], onDelete: Cascade)
135+
systemPermission TeamSystemPermission?
136+
137+
@@unique([projectId, projectUserId, teamId, permissionDbId])
138+
@@unique([projectId, projectUserId, teamId, systemPermission])
130139
}
131140

132141
model Permission {
@@ -153,6 +162,9 @@ model Permission {
153162
childEdges PermissionEdge[] @relation("ParentPermission")
154163
teamMemberDirectPermission TeamMemberDirectPermission[]
155164
165+
isDefaultTeamCreatorPermission Boolean @default(false)
166+
isDefaultTeamMemberPermission Boolean @default(false)
167+
156168
@@unique([projectConfigId, queryableId])
157169
@@unique([projectId, teamId, queryableId])
158170
}
@@ -162,16 +174,27 @@ enum PermissionScope {
162174
TEAM
163175
}
164176

177+
enum TeamSystemPermission {
178+
UPDATE_TEAM
179+
DELETE_TEAM
180+
READ_MEMBERS
181+
REMOVE_MEMBERS
182+
INVITE_MEMBERS
183+
}
184+
165185
model PermissionEdge {
166186
edgeId String @id @default(uuid()) @db.Uuid
167187
168188
createdAt DateTime @default(now())
169189
updatedAt DateTime @updatedAt
170190
171-
parentPermissionDbId String @db.Uuid
172-
parentPermission Permission @relation("ParentPermission", fields: [parentPermissionDbId], references: [dbId], onDelete: Cascade)
173-
childPermissionDbId String @db.Uuid
174-
childPermission Permission @relation("ChildPermission", fields: [childPermissionDbId], references: [dbId], onDelete: Cascade)
191+
// exactly one of [parentPermissionDbId && parentPermission] or [parentTeamSystemPermission] must be set
192+
parentPermissionDbId String? @db.Uuid
193+
parentPermission Permission? @relation("ParentPermission", fields: [parentPermissionDbId], references: [dbId], onDelete: Cascade)
194+
parentTeamSystemPermission TeamSystemPermission?
195+
196+
childPermissionDbId String @db.Uuid
197+
childPermission Permission @relation("ChildPermission", fields: [childPermissionDbId], references: [dbId], onDelete: Cascade)
175198
}
176199

177200
model ProjectUser {

0 commit comments

Comments
 (0)