Merge pull request #6071 from logto-io/gao-org-app-role-apis

feat(core): organization app role apis

packages/core/src/queries/organization/index.ts

@@ -33,6 +33,7 @@ import SchemaQueries from '#src/utils/SchemaQueries.js';
 import { conditionalSql, convertToIdentifiers } from '#src/utils/sql.js';
 
 import { EmailDomainQueries } from './email-domains.js';
+import { RoleApplicationRelationQueries } from './role-application-relations.js';
 import { RoleUserRelationQueries } from './role-user-relations.js';
 import { SsoConnectorQueries } from './sso-connectors.js';
 import { UserRelationQueries } from './user-relations.js';
@@ -284,6 +285,7 @@ export default class OrganizationQueries extends SchemaQueries<
     ),
     /** Queries for organization - user relations. */
     users: new UserRelationQueries(this.pool),
+    // TODO: Rename to `usersRoles`
     /** Queries for organization - organization role - user relations. */
     rolesUsers: new RoleUserRelationQueries(this.pool),
     /** Queries for organization - application relations. */
@@ -293,6 +295,9 @@ export default class OrganizationQueries extends SchemaQueries<
       Organizations,
       Applications
     ),
+    // TODO: Rename to `appsRoles`
+    /** Queries for organization - organization role - application relations. */
+    rolesApps: new RoleApplicationRelationQueries(this.pool),
     invitationsRoles: new TwoRelationsQueries(
       this.pool,
       OrganizationInvitationRoleRelations.table,

packages/core/src/queries/organization/role-application-relations.ts

@@ -0,0 +1,64 @@
+import {
+  Organizations,
+  OrganizationRoles,
+  Applications,
+  OrganizationRoleApplicationRelations,
+} from '@logto/schemas';
+import { type CommonQueryMethods, sql } from '@silverhand/slonik';
+
+import RelationQueries from '#src/utils/RelationQueries.js';
+import { convertToIdentifiers } from '#src/utils/sql.js';
+
+export class RoleApplicationRelationQueries extends RelationQueries<
+  [typeof Organizations, typeof OrganizationRoles, typeof Applications]
+> {
+  constructor(pool: CommonQueryMethods) {
+    super(
+      pool,
+      OrganizationRoleApplicationRelations.table,
+      Organizations,
+      OrganizationRoles,
+      Applications
+    );
+  }
+
+  /** Replace the roles of an application in an organization. */
+  async replace(organizationId: string, applicationId: string, roleIds: readonly string[]) {
+    const applications = convertToIdentifiers(Applications);
+    const relations = convertToIdentifiers(OrganizationRoleApplicationRelations);
+
+    return this.pool.transaction(async (transaction) => {
+      // Lock application
+      await transaction.query(sql`
+        select 1
+        from ${applications.table}
+        where ${applications.fields.id} = ${applicationId}
+        for update
+      `);
+
+      // Delete old relations
+      await transaction.query(sql`
+        delete from ${relations.table}
+        where ${relations.fields.organizationId} = ${organizationId}
+        and ${relations.fields.applicationId} = ${applicationId}
+      `);
+
+      // Insert new relations
+      if (roleIds.length === 0) {
+        return;
+      }
+
+      await transaction.query(sql`
+        insert into ${relations.table} (
+          ${relations.fields.organizationId},
+          ${relations.fields.applicationId},
+          ${relations.fields.organizationRoleId}
+        )
+        values ${sql.join(
+          roleIds.map((roleId) => sql`(${organizationId}, ${applicationId}, ${roleId})`),
+          sql`, `
+        )}
+      `);
+    });
+  }
+}

packages/core/src/queries/organization/role-user-relations.ts

@@ -83,7 +83,7 @@ export class RoleUserRelationQueries extends RelationQueries<
     return this.pool.transaction(async (transaction) => {
       // Lock user
       await transaction.query(sql`
-        select id
+        select 1
         from ${users.table}
         where ${users.fields.id} = ${userId}
         for update
@@ -92,8 +92,8 @@ export class RoleUserRelationQueries extends RelationQueries<
       // Delete old relations
       await transaction.query(sql`
         delete from ${relations.table}
-        where ${relations.fields.userId} = ${userId}
-        and ${relations.fields.organizationId} = ${organizationId}
+        where ${relations.fields.organizationId} = ${organizationId}
+        and ${relations.fields.userId} = ${userId}
       `);
 
       // Insert new relations
@@ -103,14 +103,14 @@ export class RoleUserRelationQueries extends RelationQueries<
 
       await transaction.query(sql`
         insert into ${relations.table} (
-          ${relations.fields.userId},
           ${relations.fields.organizationId},
+          ${relations.fields.userId},
           ${relations.fields.organizationRoleId}
         )
-         values ${sql.join(
-           roleIds.map((roleId) => sql`(${userId}, ${organizationId}, ${roleId})`),
-           sql`, `
-         )}
+        values ${sql.join(
+          roleIds.map((roleId) => sql`(${organizationId}, ${userId}, ${roleId})`),
+          sql`, `
+        )}
       `);
     });
   }

packages/core/src/routes/organization/index.application-role-relations.ts

@@ -0,0 +1,126 @@
+import { OrganizationRoles } from '@logto/schemas';
+import type Router from 'koa-router';
+import { z } from 'zod';
+
+import RequestError from '#src/errors/RequestError/index.js';
+import koaGuard from '#src/middleware/koa-guard.js';
+import { type WithHookContext } from '#src/middleware/koa-management-api-hooks.js';
+import koaPagination from '#src/middleware/koa-pagination.js';
+import type OrganizationQueries from '#src/queries/organization/index.js';
+
+// Consider building a class to handle these relations. See `index.user-role-relations.ts` for more information.
+export default function applicationRoleRelationRoutes(
+  router: Router<unknown, WithHookContext>,
+  organizations: OrganizationQueries
+) {
+  const params = Object.freeze({
+    id: z.string().min(1),
+    applicationId: z.string().min(1),
+  } as const);
+  const pathname = '/:id/applications/:applicationId/roles';
+
+  // The pathname of `.use()` will not match the end of the path, for example:
+  // `.use('/foo', ...)` will match both `/foo` and `/foo/bar`.
+  // See https://github.com/koajs/router/blob/02ad6eedf5ced6ec1eab2138380fd67c63e3f1d7/lib/router.js#L330-L333
+  router.use(pathname, koaGuard({ params: z.object(params) }), async (ctx, next) => {
+    const { id, applicationId } = ctx.guard.params;
+
+    // Ensure membership
+    if (!(await organizations.relations.apps.exists({ organizationId: id, applicationId }))) {
+      throw new RequestError({ code: 'organization.require_membership', status: 422 });
+    }
+
+    return next();
+  });
+
+  router.get(
+    pathname,
+    koaPagination(),
+    koaGuard({
+      params: z.object(params),
+      response: OrganizationRoles.guard.array(),
+      status: [200, 422],
+    }),
+    async (ctx, next) => {
+      const { id, applicationId } = ctx.guard.params;
+
+      const [totalCount, entities] = await organizations.relations.rolesApps.getEntities(
+        OrganizationRoles,
+        {
+          organizationId: id,
+          applicationId,
+        }
+      );
+
+      ctx.pagination.totalCount = totalCount;
+      ctx.body = entities;
+      return next();
+    }
+  );
+
+  router.post(
+    pathname,
+    koaGuard({
+      params: z.object(params),
+      body: z.object({
+        organizationRoleIds: z.string().min(1).array().nonempty(),
+      }),
+      status: [201, 422],
+    }),
+    async (ctx, next) => {
+      const { id, applicationId } = ctx.guard.params;
+      const { organizationRoleIds } = ctx.guard.body;
+
+      await organizations.relations.rolesApps.insert(
+        ...organizationRoleIds.map((organizationRoleId) => ({
+          organizationId: id,
+          applicationId,
+          organizationRoleId,
+        }))
+      );
+
+      ctx.status = 201;
+      return next();
+    }
+  );
+
+  router.put(
+    pathname,
+    koaGuard({
+      params: z.object(params),
+      body: z.object({
+        organizationRoleIds: z.string().min(1).array().nonempty(),
+      }),
+      status: [204, 422],
+    }),
+    async (ctx, next) => {
+      const { id, applicationId } = ctx.guard.params;
+      const { organizationRoleIds } = ctx.guard.body;
+
+      await organizations.relations.rolesApps.replace(id, applicationId, organizationRoleIds);
+
+      ctx.status = 204;
+      return next();
+    }
+  );
+
+  router.delete(
+    `${pathname}/:organizationRoleId`,
+    koaGuard({
+      params: z.object({ ...params, organizationRoleId: z.string().min(1) }),
+      status: [204, 422, 404],
+    }),
+    async (ctx, next) => {
+      const { id, applicationId, organizationRoleId } = ctx.guard.params;
+
+      await organizations.relations.rolesApps.delete({
+        organizationId: id,
+        applicationId,
+        organizationRoleId,
+      });
+
+      ctx.status = 204;
+      return next();
+    }
+  );
+}

packages/core/src/routes/organization/index.applications.openapi.json

@@ -77,6 +77,81 @@
           }
         }
       }
+    },
+    "/api/organizations/{id}/applications/{applicationId}/roles": {
+      "get": {
+        "summary": "Get organization application roles",
+        "description": "Get roles associated with the application in the organization.",
+        "responses": {
+          "200": {
+            "description": "A list of roles."
+          }
+        }
+      },
+      "post": {
+        "summary": "Add organization application role",
+        "description": "Add a role to the application in the organization.",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "organizationRoleIds": {
+                    "description": "The role ID to add."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "The role was added successfully."
+          },
+          "422": {
+            "description": "The role could not be added. Some of the roles may not exist."
+          }
+        }
+      },
+      "put": {
+        "summary": "Replace organization application roles",
+        "description": "Replace all roles associated with the application in the organization with the given data.",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "organizationRoleIds": {
+                    "description": "An array of role IDs to replace existing roles."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "204": {
+            "description": "The roles were replaced successfully."
+          },
+          "422": {
+            "description": "The roles could not be replaced. Some of the roles may not exist."
+          }
+        }
+      }
+    },
+    "/api/organizations/{id}/applications/{applicationId}/roles/{organizationRoleId}": {
+      "delete": {
+        "summary": "Remove organization application role",
+        "description": "Remove a role from the application in the organization.",
+        "responses": {
+          "204": {
+            "description": "The role was removed from the application in the organization successfully."
+          },
+          "422": {
+            "description": "The role could not be removed. The role may not exist."
+          }
+        }
+      }
     }
   }
 }

packages/core/src/routes/organization/index.ts

@@ -17,6 +17,7 @@ import { parseSearchOptions } from '#src/utils/search.js';
 
 import { type ManagementApiRouter, type RouterInitArgs } from '../types.js';
 
+import applicationRoleRelationRoutes from './index.application-role-relations.js';
 import emailDomainRoutes from './index.jit.email-domains.js';
 import userRoleRelationRoutes from './index.user-role-relations.js';
 import organizationInvitationRoutes from './invitations.js';
@@ -113,6 +114,7 @@ export default function organizationRoutes<T extends ManagementApiRouter>(
     }
   );
 
+  // MARK: Organization - user role relation routes
   router.post(
     '/:id/users/roles',
     koaGuard({
@@ -140,11 +142,14 @@ export default function organizationRoutes<T extends ManagementApiRouter>(
 
   userRoleRelationRoutes(router, organizations);
 
-  // MARK: Organization - application relation routes
   if (EnvSet.values.isDevFeaturesEnabled) {
+    // MARK: Organization - application relation routes
     router.addRelationRoutes(organizations.relations.apps, undefined, {
       hookEvent: 'Organization.Membership.Updated',
     });
+
+    // MARK: Organization - application role relation routes
+    applicationRoleRelationRoutes(router, organizations);
   }
 
   // MARK: Just-in-time provisioning