feat(users): add support for tenant level users (#6708)

Co-authored-by: hyperswitch-bot[bot] <148525504+hyperswitch-bot[bot]@users.noreply.github.com>

crates/api_models/src/events/user.rs

@@ -12,15 +12,15 @@ use crate::user::{
     },
     AcceptInviteFromEmailRequest, AuthSelectRequest, AuthorizeResponse, BeginTotpResponse,
     ChangePasswordRequest, ConnectAccountRequest, CreateInternalUserRequest,
-    CreateUserAuthenticationMethodRequest, ForgotPasswordRequest, GetSsoAuthUrlRequest,
-    GetUserAuthenticationMethodsRequest, GetUserDetailsResponse, GetUserRoleDetailsRequest,
-    GetUserRoleDetailsResponseV2, InviteUserRequest, ReInviteUserRequest, RecoveryCodes,
-    ResetPasswordRequest, RotatePasswordRequest, SendVerifyEmailRequest, SignUpRequest,
-    SignUpWithMerchantIdRequest, SsoSignInRequest, SwitchMerchantRequest,
-    SwitchOrganizationRequest, SwitchProfileRequest, TokenResponse, TwoFactorAuthStatusResponse,
-    TwoFactorStatus, UpdateUserAccountDetailsRequest, UpdateUserAuthenticationMethodRequest,
-    UserFromEmailRequest, UserMerchantCreate, VerifyEmailRequest, VerifyRecoveryCodeRequest,
-    VerifyTotpRequest,
+    CreateTenantUserRequest, CreateUserAuthenticationMethodRequest, ForgotPasswordRequest,
+    GetSsoAuthUrlRequest, GetUserAuthenticationMethodsRequest, GetUserDetailsResponse,
+    GetUserRoleDetailsRequest, GetUserRoleDetailsResponseV2, InviteUserRequest,
+    ReInviteUserRequest, RecoveryCodes, ResetPasswordRequest, RotatePasswordRequest,
+    SendVerifyEmailRequest, SignUpRequest, SignUpWithMerchantIdRequest, SsoSignInRequest,
+    SwitchMerchantRequest, SwitchOrganizationRequest, SwitchProfileRequest, TokenResponse,
+    TwoFactorAuthStatusResponse, TwoFactorStatus, UpdateUserAccountDetailsRequest,
+    UpdateUserAuthenticationMethodRequest, UserFromEmailRequest, UserMerchantCreate,
+    UserOrgMerchantCreateRequest, VerifyEmailRequest, VerifyRecoveryCodeRequest, VerifyTotpRequest,
 };
 
 common_utils::impl_api_event_type!(
@@ -37,6 +37,8 @@ common_utils::impl_api_event_type!(
         SwitchMerchantRequest,
         SwitchProfileRequest,
         CreateInternalUserRequest,
+        CreateTenantUserRequest,
+        UserOrgMerchantCreateRequest,
         UserMerchantCreate,
         AuthorizeResponse,
         ConnectAccountRequest,

crates/api_models/src/user.rs

@@ -115,6 +115,21 @@ pub struct CreateInternalUserRequest {
     pub password: Secret<String>,
 }
 
+#[derive(serde::Deserialize, Debug, serde::Serialize)]
+pub struct CreateTenantUserRequest {
+    pub name: Secret<String>,
+    pub email: pii::Email,
+    pub password: Secret<String>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize, Clone)]
+pub struct UserOrgMerchantCreateRequest {
+    pub organization_name: Secret<String>,
+    pub organization_details: Option<pii::SecretSerdeValue>,
+    pub metadata: Option<pii::SecretSerdeValue>,
+    pub merchant_name: Secret<String>,
+}
+
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct UserMerchantCreate {
     pub company_name: String,

crates/common_enums/src/enums.rs

@@ -3207,6 +3207,7 @@ pub enum ApiVersion {
 #[strum(serialize_all = "snake_case")]
 #[serde(rename_all = "snake_case")]
 pub enum EntityType {
+    Tenant = 3,
     Organization = 2,
     Merchant = 1,
     Profile = 0,

crates/common_utils/src/consts.rs

@@ -119,6 +119,8 @@ pub const MAX_ALLOWED_MERCHANT_NAME_LENGTH: usize = 64;
 /// Default locale
 pub const DEFAULT_LOCALE: &str = "en";
 
+/// Role ID for Tenant Admin
+pub const ROLE_ID_TENANT_ADMIN: &str = "tenant_admin";
 /// Role ID for Org Admin
 pub const ROLE_ID_ORGANIZATION_ADMIN: &str = "org_admin";
 /// Role ID for Internal View Only

crates/diesel_models/src/query/merchant_account.rs

@@ -121,6 +121,26 @@ impl MerchantAccount {
         .await
     }
 
+    pub async fn list_all_merchant_accounts(
+        conn: &PgPooledConn,
+        limit: u32,
+        offset: Option<u32>,
+    ) -> StorageResult<Vec<Self>> {
+        generics::generic_filter::<
+            <Self as HasTable>::Table,
+            _,
+            <<Self as HasTable>::Table as Table>::PrimaryKey,
+            _,
+        >(
+            conn,
+            dsl_identifier.ne_all(vec![""]),
+            Some(i64::from(limit)),
+            offset.map(i64::from),
+            None,
+        )
+        .await
+    }
+
     pub async fn update_all_merchant_accounts(
         conn: &PgPooledConn,
         merchant_account: MerchantAccountUpdateInternal,

crates/router/src/analytics.rs

@@ -1931,6 +1931,9 @@ pub mod routes {
                                 EntityType::Organization => Some(AuthInfo::OrgLevel {
                                     org_id: user_role.org_id.clone()?,
                                 }),
+                                EntityType::Tenant => Some(AuthInfo::OrgLevel {
+                                    org_id: auth.org_id.clone(),
+                                }),
                             })
                     })
                     .collect();
@@ -2054,6 +2057,9 @@ pub mod routes {
                                 EntityType::Organization => Some(AuthInfo::OrgLevel {
                                     org_id: user_role.org_id.clone()?,
                                 }),
+                                EntityType::Tenant => Some(AuthInfo::OrgLevel {
+                                    org_id: auth.org_id.clone(),
+                                }),
                             })
                     })
                     .collect();

crates/router/src/consts/user.rs

@@ -19,6 +19,8 @@ pub const TOTP_TOLERANCE: u8 = 1;
 pub const TOTP_MAX_ATTEMPTS: u8 = 4;
 /// Number of maximum attempts user has for recovery code
 pub const RECOVERY_CODE_MAX_ATTEMPTS: u8 = 4;
+/// The default number of organizations to fetch for a tenant-level user
+pub const ORG_LIST_LIMIT_FOR_TENANT: u32 = 20;
 
 pub const MAX_PASSWORD_LENGTH: usize = 70;
 pub const MIN_PASSWORD_LENGTH: usize = 8;