## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-designer/blob/main/apps/designer/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `designer/env-check.js` if mandatory
## Description
ref #548
Add shared links with builder/viewer permissions.
`editor` permission is now disabled as we don't know a simple way to
allow editing images and text only cc @TrySound would need your opinion
on this.
createTrpcRemixProxy now wraps input in `JSON.stringify` and unwraps
before the TRPC call. Otherwise, all params are FormData string entries
and may cause errors.
createTrpcRemixProxy useQuery/useMutation now returns Remix useFetcher
state parameter.
**`patch` auth call added, we must do any Auth mutate operations in a
single call, otherwise if some call failed we are in troubles.**
Example on token relation update.
Remove viewer relation.
Add editor relation. <- If the call failed here user just loses all
permissions.
In case of patch both operations are completed in a single transaction -
(delete+insert)
## Steps for reproduction
Having migrations works locally only with
`isFeatureEnabled("share2")` flag.
Click the share button then add/rename/update/copy share links.
The previous Share button is removed.
**TODO In Next PR:**
Different UI for builder and viewer links i.e.
[this](https://github.com/webstudio-is/webstudio-designer/issues/548#issuecomment-1406947059).
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- [ ] hi @TrySound , I need you to do
- detailed review (read every line)
## Before requesting a review
- [x] made a self-review
- [x] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-designer/blob/main/apps/designer/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `designer/env-check.js` if mandatory
## Description
Add authorization layer to a project.
1. It introduces AppContext type inside `trpc-interface` project. As
this type can be shared across all projects.
2. `createContext(request):AppContext` is placed inside the designer app
it creates context and passes all params known on `remix/server` side
into authorization context.
3. Depending on env variables or SAAS trpc can be used or local so
`authorizationRouter` is a small wrapper around Zanzibar Ory Keto at
SaaS, and implements some subset of ORY operations here.
4. Checks are done on `db` level scripts.
5. On the saas side trpc wrapper around ory is already implemented and
can be checked after this will be merged.
Not everything is checked right now. Should be added later with some
caching at least during single request.
Also not this for this PR.
UI should be different for users with read/edit permissions. Also non
owners can't share links etc
TODO:
- [ ] - Migration - preview token creation for existing projects.
OSS Permission emulates following ORY schema, but without implementing
adding viewers editors etc.
```ts
/**
* !!! THIS IS NOT typescript code !!!
* This is Ory permission language (small subset of typescript)
* https://www.ory.sh/docs/keto/guides/userset-rewrites
* https://www.ory.sh/docs/keto/reference/ory-permission-language
*
* See .prettierrc semicolons are disabled, as it breaks ory language parser (fixed but not in cloud)
**/
import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types"
class User implements Namespace {}
class Token implements Namespace {}
class Email implements Namespace {
related: {
owner: User[]
}
}
class Project implements Namespace {
related: {
owner: User[]
editors: (Token | User | SubjectSet<Email, "owner">)[]
viewers: (Token | User | SubjectSet<Email, "owner">)[]
}
/**
* Relation rewrites:
* For example if User:AliceUUID is owner of Project:AliceProjectUUID, then
* we return Allowed for all 3 checks
* `keto check User:"AliceUUID" own Project "AliceProjectUUID"`
* `keto check User:"AliceUUID" edit Project "AliceProjectUUID"`
* `keto check User:"AliceUUID" view Project "AliceProjectUUID"`
* But if User:"BobUUID" is viewers of Project:AliceProjectUUID, then
* `keto check User:"BobUUID" view Project "AliceProjectUUID"` returns Allowed
*
* `keto check User:"BobUUID" edit Project "AliceProjectUUID"` returns Denied
* `keto check User:"BobUUID" own Project "AliceProjectUUID"` returns Denied
**/
permits = {
view: (ctx: Context): boolean =>
this.related.viewers.includes(ctx.subject) ||
this.related.editors.includes(ctx.subject) ||
this.related.owner.includes(ctx.subject),
edit: (ctx: Context): boolean =>
this.related.editors.includes(ctx.subject) ||
this.related.owner.includes(ctx.subject),
own: (ctx: Context): boolean => this.related.owner.includes(ctx.subject),
}
}
```
## Steps for reproduction
1. click button
6. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- [ ] hi @TrySound , I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
## Before requesting a review
- [x] made a self-review
- [x] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-designer/blob/main/apps/designer/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `designer/env-check.js` if mandatory
## Description
ref #548
New `trpc-interface` package.
It's intended to implement various TRPC services we are going to use.
But it can act as a proxy for TRPC services implemented at SAAS and at
open source.
Exposes: `createTRPCProxyServiceClient` method, and `SharedRouter` type.
`createTRPCProxyServiceClient` creates
[createTRPCProxyClient](https://trpc.io/docs/vanilla#initialize-a-trpc-client)
for the local TRCP router, or for a remote TRPC server.
`SharedRouter` type information would be used at SAAS to check that SAAS
services have the same API interface as open-source TRPC.
The current implementation has just an example call `authorize.check`,
without any logic. And used just to check that everything works.
## Steps for reproduction
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- [ ] hi @TrySound , I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-designer/blob/main/apps/designer/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `designer/env-check.js` if mandatory
Ivan Starkov