mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-09 05:26:24 +09:00
Ivan Starkov
6b2c50a183
## Description Add authorization layer to a project. 1. It introduces AppContext type inside `trpc-interface` project. As this type can be shared across all projects. 2. `createContext(request):AppContext` is placed inside the designer app it creates context and passes all params known on `remix/server` side into authorization context. 3. Depending on env variables or SAAS trpc can be used or local so `authorizationRouter` is a small wrapper around Zanzibar Ory Keto at SaaS, and implements some subset of ORY operations here. 4. Checks are done on `db` level scripts. 5. On the saas side trpc wrapper around ory is already implemented and can be checked after this will be merged. Not everything is checked right now. Should be added later with some caching at least during single request. Also not this for this PR. UI should be different for users with read/edit permissions. Also non owners can't share links etc TODO: - [ ] - Migration - preview token creation for existing projects. OSS Permission emulates following ORY schema, but without implementing adding viewers editors etc. ```ts /** * !!! THIS IS NOT typescript code !!! * This is Ory permission language (small subset of typescript) * https://www.ory.sh/docs/keto/guides/userset-rewrites * https://www.ory.sh/docs/keto/reference/ory-permission-language * * See .prettierrc semicolons are disabled, as it breaks ory language parser (fixed but not in cloud) **/ import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types" class User implements Namespace {} class Token implements Namespace {} class Email implements Namespace { related: { owner: User[] } } class Project implements Namespace { related: { owner: User[] editors: (Token | User | SubjectSet<Email, "owner">)[] viewers: (Token | User | SubjectSet<Email, "owner">)[] } /** * Relation rewrites: * For example if User:AliceUUID is owner of Project:AliceProjectUUID, then * we return Allowed for all 3 checks * `keto check User:"AliceUUID" own Project "AliceProjectUUID"` * `keto check User:"AliceUUID" edit Project "AliceProjectUUID"` * `keto check User:"AliceUUID" view Project "AliceProjectUUID"` * But if User:"BobUUID" is viewers of Project:AliceProjectUUID, then * `keto check User:"BobUUID" view Project "AliceProjectUUID"` returns Allowed * * `keto check User:"BobUUID" edit Project "AliceProjectUUID"` returns Denied * `keto check User:"BobUUID" own Project "AliceProjectUUID"` returns Denied **/ permits = { view: (ctx: Context): boolean => this.related.viewers.includes(ctx.subject) || this.related.editors.includes(ctx.subject) || this.related.owner.includes(ctx.subject), edit: (ctx: Context): boolean => this.related.editors.includes(ctx.subject) || this.related.owner.includes(ctx.subject), own: (ctx: Context): boolean => this.related.owner.includes(ctx.subject), } } ``` ## Steps for reproduction 1. click button 6. expect xyz ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - [ ] hi @TrySound , I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) ## Before requesting a review - [x] made a self-review - [x] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [x] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio-designer/blob/main/apps/designer/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env.example` and the `designer/env-check.js` if mandatory
Webstudio Project
Project related functionalities. This was temporarily placed here to reuse between other packages, but we need to split this into separate packages and probably remove this package entirely or keep it only for "project" specific functionality.