chore: import upstream snapshot with attribution

apps/sim/app/api/organizations/[id]/permission-groups/route.ts

@@ -0,0 +1,280 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import {
+  permissionGroup,
+  permissionGroupMember,
+  permissionGroupWorkspace,
+  user,
+} from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
+import { generateId } from '@sim/utils/id'
+import { and, count, desc, eq, inArray } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { createPermissionGroupContract } from '@/lib/api/contracts/permission-groups'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import {
+  DEFAULT_PERMISSION_GROUP_CONFIG,
+  PERMISSION_GROUP_CONSTRAINTS,
+  type PermissionGroupConfig,
+  parsePermissionGroupConfig,
+} from '@/lib/permission-groups/types'
+import {
+  type AllMembersConflict,
+  acquirePermissionGroupOrgLock,
+  authorizeOrgAccessControl,
+  findAllMembersWorkspaceConflict,
+  findWorkspacesNotInOrganization,
+  formatAllMembersConflictError,
+  getWorkspacesForGroups,
+} from '@/app/api/organizations/[id]/permission-groups/utils'
+
+const logger = createLogger('OrganizationPermissionGroups')
+
+export const GET = withRouteHandler(
+  async (_req: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: organizationId } = await params
+
+    const denied = await authorizeOrgAccessControl(session.user.id, organizationId)
+    if (denied) return denied
+
+    const groups = await db
+      .select({
+        id: permissionGroup.id,
+        name: permissionGroup.name,
+        description: permissionGroup.description,
+        config: permissionGroup.config,
+        createdBy: permissionGroup.createdBy,
+        createdAt: permissionGroup.createdAt,
+        updatedAt: permissionGroup.updatedAt,
+        isDefault: permissionGroup.isDefault,
+        creatorName: user.name,
+        creatorEmail: user.email,
+      })
+      .from(permissionGroup)
+      .leftJoin(user, eq(permissionGroup.createdBy, user.id))
+      .where(eq(permissionGroup.organizationId, organizationId))
+      .orderBy(desc(permissionGroup.createdAt))
+
+    const groupIds = groups.map((group) => group.id)
+    const memberCounts = groupIds.length
+      ? await db
+          .select({
+            permissionGroupId: permissionGroupMember.permissionGroupId,
+            count: count(),
+          })
+          .from(permissionGroupMember)
+          .where(inArray(permissionGroupMember.permissionGroupId, groupIds))
+          .groupBy(permissionGroupMember.permissionGroupId)
+      : []
+    const countByGroupId = new Map(memberCounts.map((row) => [row.permissionGroupId, row.count]))
+    const workspacesByGroupId = await getWorkspacesForGroups(groupIds)
+
+    const groupsWithCounts = groups.map((group) => ({
+      ...group,
+      config: parsePermissionGroupConfig(group.config),
+      memberCount: countByGroupId.get(group.id) ?? 0,
+      workspaces: workspacesByGroupId.get(group.id) ?? [],
+    }))
+
+    return NextResponse.json({ permissionGroups: groupsWithCounts })
+  }
+)
+
+export const POST = withRouteHandler(
+  async (req: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: organizationId } = await context.params
+
+    // Populated inside the transaction when an all-members scope conflict is
+    // detected, so the catch can format the 409 after the rollback.
+    let allMembersConflict: AllMembersConflict | null = null
+
+    try {
+      const denied = await authorizeOrgAccessControl(session.user.id, organizationId)
+      if (denied) return denied
+
+      const parsed = await parseRequest(createPermissionGroupContract, req, context, {
+        validationErrorResponse: (error) =>
+          NextResponse.json({ error: getValidationErrorMessage(error) }, { status: 400 }),
+      })
+      if (!parsed.success) return parsed.response
+      const { name, description, config, isDefault } = parsed.data.body
+
+      // Only the organization default group is org-wide; every other group
+      // targets specific workspaces. "Org-wide" is definitionally `isDefault`.
+      const isDefaultGroup = isDefault === true
+      const workspaceIds = isDefaultGroup
+        ? []
+        : Array.from(new Set(parsed.data.body.workspaceIds ?? []))
+
+      if (!isDefaultGroup && workspaceIds.length === 0) {
+        return NextResponse.json(
+          { error: 'Select at least one workspace when the group targets specific workspaces' },
+          { status: 400 }
+        )
+      }
+
+      if (!isDefaultGroup) {
+        const invalid = await findWorkspacesNotInOrganization(workspaceIds, organizationId)
+        if (invalid.length > 0) {
+          return NextResponse.json(
+            { error: 'One or more selected workspaces do not belong to this organization' },
+            { status: 400 }
+          )
+        }
+      }
+
+      const existingGroup = await db
+        .select({ id: permissionGroup.id })
+        .from(permissionGroup)
+        .where(
+          and(eq(permissionGroup.organizationId, organizationId), eq(permissionGroup.name, name))
+        )
+        .limit(1)
+
+      if (existingGroup.length > 0) {
+        return NextResponse.json(
+          { error: 'A permission group with this name already exists' },
+          { status: 409 }
+        )
+      }
+
+      const groupConfig: PermissionGroupConfig = {
+        ...DEFAULT_PERMISSION_GROUP_CONFIG,
+        ...config,
+      }
+
+      const now = new Date()
+      const newGroup = {
+        id: generateId(),
+        organizationId,
+        name,
+        description: description || null,
+        config: groupConfig,
+        createdBy: session.user.id,
+        createdAt: now,
+        updatedAt: now,
+        isDefault: isDefault || false,
+      }
+
+      await db.transaction(async (tx) => {
+        await acquirePermissionGroupOrgLock(tx, organizationId)
+
+        // A new non-default group has no members, so it governs all members of
+        // its workspaces; reject when another all-members group already does.
+        if (!isDefaultGroup) {
+          const conflict = await findAllMembersWorkspaceConflict(
+            { organizationId, excludeGroupId: newGroup.id, workspaceIds },
+            tx
+          )
+          if (conflict) {
+            allMembersConflict = conflict
+            throw new Error('ALL_MEMBERS_CONFLICT')
+          }
+        }
+
+        if (isDefault) {
+          // Demote the prior default to a non-default group (only the default may
+          // be org-wide); it ends up with no workspaces (inert) until an admin
+          // re-scopes it.
+          await tx
+            .update(permissionGroup)
+            .set({ isDefault: false, updatedAt: now })
+            .where(
+              and(
+                eq(permissionGroup.organizationId, organizationId),
+                eq(permissionGroup.isDefault, true)
+              )
+            )
+        }
+        await tx.insert(permissionGroup).values(newGroup)
+        if (workspaceIds.length > 0) {
+          await tx.insert(permissionGroupWorkspace).values(
+            workspaceIds.map((workspaceId) => ({
+              id: generateId(),
+              permissionGroupId: newGroup.id,
+              workspaceId,
+              organizationId,
+              createdAt: now,
+            }))
+          )
+        }
+      })
+
+      logger.info('Created permission group', {
+        permissionGroupId: newGroup.id,
+        organizationId,
+        userId: session.user.id,
+        workspaceCount: workspaceIds.length,
+      })
+
+      recordAudit({
+        actorId: session.user.id,
+        action: AuditAction.PERMISSION_GROUP_CREATED,
+        resourceType: AuditResourceType.PERMISSION_GROUP,
+        resourceId: newGroup.id,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        resourceName: name,
+        description: `Created permission group "${name}"`,
+        metadata: {
+          organizationId,
+          isDefault: isDefault || false,
+          workspaceCount: workspaceIds.length,
+        },
+        request: req,
+      })
+
+      return NextResponse.json({ permissionGroup: { ...newGroup, workspaceIds } }, { status: 201 })
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        error.message === 'ALL_MEMBERS_CONFLICT' &&
+        allMembersConflict
+      ) {
+        return NextResponse.json(
+          { error: formatAllMembersConflictError(allMembersConflict) },
+          { status: 409 }
+        )
+      }
+      if (getPostgresErrorCode(error) === '55P03') {
+        return NextResponse.json(
+          { error: 'This organization is being updated by another request. Please try again.' },
+          { status: 503 }
+        )
+      }
+      if (getPostgresErrorCode(error) === '23505') {
+        const constraint = getPostgresConstraintName(error)
+        if (constraint === PERMISSION_GROUP_CONSTRAINTS.organizationName) {
+          return NextResponse.json(
+            { error: 'A permission group with this name already exists' },
+            { status: 409 }
+          )
+        }
+        if (constraint === PERMISSION_GROUP_CONSTRAINTS.organizationDefault) {
+          return NextResponse.json(
+            {
+              error:
+                'Another group was concurrently set as the default. Please refresh and try again.',
+            },
+            { status: 409 }
+          )
+        }
+      }
+      logger.error('Error creating permission group', error)
+      return NextResponse.json({ error: 'Failed to create permission group' }, { status: 500 })
+    }
+  }
+)