diff --git a/server/routers/role/createRole.ts b/server/routers/role/createRole.ts index 5ad6cd435..6d1ecb503 100644 --- a/server/routers/role/createRole.ts +++ b/server/routers/role/createRole.ts @@ -34,7 +34,9 @@ const createRoleSchema = z.strictObject({ export const defaultRoleAllowedActions: ActionsEnum[] = [ ActionsEnum.getOrg, ActionsEnum.getResource, - ActionsEnum.listResources + ActionsEnum.listResources, + ActionsEnum.getSiteResource, + ActionsEnum.listSiteResources ]; export type CreateRoleBody = z.infer; diff --git a/server/routers/siteResource/listAllSiteResourcesByOrg.ts b/server/routers/siteResource/listAllSiteResourcesByOrg.ts index 50acbeb4f..50bbca6b4 100644 --- a/server/routers/siteResource/listAllSiteResourcesByOrg.ts +++ b/server/routers/siteResource/listAllSiteResourcesByOrg.ts @@ -3,11 +3,13 @@ import { DB_TYPE, Label, SiteResource, + roleSiteResources, siteNetworks, siteResourceLabels, siteResources, sites, - labels + labels, + userSiteResources } from "@server/db"; import response from "@server/lib/response"; import logger from "@server/logger"; @@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg( labels: labelFilter } = parsedQuery.data; - const conditions = [and(eq(siteResources.orgId, orgId))]; + let accessibleSiteResourceIds: number[]; + if (req.user) { + const accessibleSiteResources = await db + .select({ + siteResourceId: sql`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})` + }) + .from(userSiteResources) + .fullJoin( + roleSiteResources, + eq( + userSiteResources.siteResourceId, + roleSiteResources.siteResourceId + ) + ) + .where( + or( + eq(userSiteResources.userId, req.user.userId), + inArray( + roleSiteResources.roleId, + req.userOrgRoleIds ?? [] + ) + ) + ); + accessibleSiteResourceIds = accessibleSiteResources.map( + (row) => row.siteResourceId + ); + } else { + const allOrgSiteResources = await db + .select({ siteResourceId: siteResources.siteResourceId }) + .from(siteResources) + .where(eq(siteResources.orgId, orgId)); + accessibleSiteResourceIds = allOrgSiteResources.map( + (row) => row.siteResourceId + ); + } + + const conditions = [ + and( + eq(siteResources.orgId, orgId), + inArray(siteResources.siteResourceId, accessibleSiteResourceIds) + ) + ]; if (siteId != null) { // Keep inner joins here: filtering by a specific site implies the diff --git a/server/routers/siteResource/listSiteResources.ts b/server/routers/siteResource/listSiteResources.ts index da0ba9a49..7b8686a53 100644 --- a/server/routers/siteResource/listSiteResources.ts +++ b/server/routers/siteResource/listSiteResources.ts @@ -1,11 +1,17 @@ import { Request, Response, NextFunction } from "express"; import { z } from "zod"; -import { db, networks, siteNetworks } from "@server/db"; +import { + db, + networks, + roleSiteResources, + siteNetworks, + userSiteResources +} from "@server/db"; import { siteResources, sites, SiteResource } from "@server/db"; import response from "@server/lib/response"; import HttpCode from "@server/types/HttpCode"; import createHttpError from "http-errors"; -import { and, asc, desc, eq } from "drizzle-orm"; +import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm"; import { fromError } from "zod-validation-error"; import logger from "@server/logger"; import { OpenAPITags, registry } from "@server/openApi"; @@ -159,10 +165,47 @@ export async function listSiteResources( return next(createHttpError(HttpCode.NOT_FOUND, "Site not found")); } + let accessibleSiteResourceIds: number[]; + if (req.user) { + const accessibleSiteResources = await db + .select({ + siteResourceId: sql`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})` + }) + .from(userSiteResources) + .fullJoin( + roleSiteResources, + eq( + userSiteResources.siteResourceId, + roleSiteResources.siteResourceId + ) + ) + .where( + or( + eq(userSiteResources.userId, req.user.userId), + inArray( + roleSiteResources.roleId, + req.userOrgRoleIds ?? [] + ) + ) + ); + accessibleSiteResourceIds = accessibleSiteResources.map( + (row) => row.siteResourceId + ); + } else { + const allOrgSiteResources = await db + .select({ siteResourceId: siteResources.siteResourceId }) + .from(siteResources) + .where(eq(siteResources.orgId, orgId)); + accessibleSiteResourceIds = allOrgSiteResources.map( + (row) => row.siteResourceId + ); + } + // Get site resources by joining networks to siteResources via siteNetworks const conditions = [ eq(siteNetworks.siteId, siteId), - eq(siteResources.orgId, orgId) + eq(siteResources.orgId, orgId), + inArray(siteResources.siteResourceId, accessibleSiteResourceIds) ]; if (typeof status !== "undefined") { diff --git a/server/setup/migrationsPg.ts b/server/setup/migrationsPg.ts index 4a6d4861c..59811cc55 100644 --- a/server/setup/migrationsPg.ts +++ b/server/setup/migrationsPg.ts @@ -28,6 +28,7 @@ import m19 from "./scriptsPg/1.18.4"; import m20 from "./scriptsPg/1.19.0"; import m21 from "./scriptsPg/1.20.0"; import m22 from "./scriptsPg/1.21.0"; +import m23 from "./scriptsPg/1.21.1"; // THIS CANNOT IMPORT ANYTHING FROM THE SERVER // EXCEPT FOR THE DATABASE AND THE SCHEMA @@ -55,7 +56,8 @@ const migrations = [ { version: "1.18.4", run: m19 }, { version: "1.19.0", run: m20 }, { version: "1.20.0", run: m21 }, - { version: "1.21.0", run: m22 } + { version: "1.21.0", run: m22 }, + { version: "1.21.1", run: m23 } // Add new migrations here as they are created ] as { version: string; diff --git a/server/setup/migrationsSqlite.ts b/server/setup/migrationsSqlite.ts index c6b4debef..54808ad3a 100644 --- a/server/setup/migrationsSqlite.ts +++ b/server/setup/migrationsSqlite.ts @@ -47,6 +47,7 @@ import m41 from "./scriptsSqlite/1.19.0"; import m42 from "./scriptsSqlite/1.19.1"; import m43 from "./scriptsSqlite/1.20.0"; import m44 from "./scriptsSqlite/1.21.0"; +import m45 from "./scriptsSqlite/1.21.1"; // THIS CANNOT IMPORT ANYTHING FROM THE SERVER // EXCEPT FOR THE DATABASE AND THE SCHEMA @@ -91,7 +92,8 @@ const migrations = [ { version: "1.19.0", run: m41 }, { version: "1.19.1", run: m42 }, { version: "1.20.0", run: m43 }, - { version: "1.21.0", run: m44 } + { version: "1.21.0", run: m44 }, + { version: "1.21.1", run: m45 } // Add new migrations here as they are created ] as const; diff --git a/server/setup/scriptsPg/1.21.1.ts b/server/setup/scriptsPg/1.21.1.ts new file mode 100644 index 000000000..d4c375bd8 --- /dev/null +++ b/server/setup/scriptsPg/1.21.1.ts @@ -0,0 +1,37 @@ +import { db } from "@server/db/pg/driver"; +import { sql } from "drizzle-orm"; + +const version = "1.21.1"; + +const actionsToGrant = ["getSiteResource", "listSiteResources"] as const; + +export default async function migration() { + console.log(`Running setup script ${version}...`); + + try { + await db.execute(sql`BEGIN`); + + for (const actionId of actionsToGrant) { + await db.execute(sql` + INSERT INTO "roleActions" ("roleId", "actionId", "orgId") + SELECT r."roleId", ${actionId}, r."orgId" + FROM "roles" r + WHERE COALESCE(r."isAdmin", false) = false + AND NOT EXISTS ( + SELECT 1 FROM "roleActions" ra + WHERE ra."roleId" = r."roleId" + AND ra."actionId" = ${actionId} + AND ra."orgId" = r."orgId" + ); + `); + } + + await db.execute(sql`COMMIT`); + console.log(`Finished setup script ${version}`); + } catch (e) { + await db.execute(sql`ROLLBACK`); + console.log("Unable to migrate database"); + console.log(e); + throw e; + } +} diff --git a/server/setup/scriptsSqlite/1.21.1.ts b/server/setup/scriptsSqlite/1.21.1.ts new file mode 100644 index 000000000..405749dfd --- /dev/null +++ b/server/setup/scriptsSqlite/1.21.1.ts @@ -0,0 +1,43 @@ +import { APP_PATH } from "@server/lib/consts"; +import Database from "better-sqlite3"; +import path from "path"; + +const version = "1.21.1"; + +const actionsToGrant = ["getSiteResource", "listSiteResources"] as const; + +export default async function migration() { + console.log(`Running setup script ${version}...`); + + const location = path.join(APP_PATH, "db", "db.sqlite"); + const db = new Database(location); + + try { + db.transaction(() => { + const insertRoleAction = db.prepare(` + INSERT INTO 'roleActions' ("roleId", "actionId", "orgId") + SELECT r."roleId", ?, r."orgId" + FROM 'roles' r + WHERE COALESCE(r."isAdmin", 0) = 0 + AND NOT EXISTS ( + SELECT 1 FROM 'roleActions' ra + WHERE ra."roleId" = r."roleId" + AND ra."actionId" = ? + AND ra."orgId" = r."orgId" + ); + `); + + for (const actionId of actionsToGrant) { + insertRoleAction.run(actionId, actionId); + } + })(); + + console.log(`Finished setup script ${version}`); + } catch (e) { + console.log("Unable to migrate database"); + console.log(e); + throw e; + } finally { + db.close(); + } +} diff --git a/src/components/ContactSalesBanner.tsx b/src/components/ContactSalesBanner.tsx index e5cb87d83..38b9d21ed 100644 --- a/src/components/ContactSalesBanner.tsx +++ b/src/components/ContactSalesBanner.tsx @@ -24,19 +24,21 @@ export function ContactSalesBanner() { {" " + t("contactSalesOr") + " "} - - {t("contactSalesContactUs")} - - - . + + + {t("contactSalesContactUs")} + + + . + ); -} \ No newline at end of file +} diff --git a/src/components/MfaInputForm.tsx b/src/components/MfaInputForm.tsx index e80c730fc..6a2fdc55a 100644 --- a/src/components/MfaInputForm.tsx +++ b/src/components/MfaInputForm.tsx @@ -13,7 +13,7 @@ import { import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp"; import { Alert, AlertDescription } from "@app/components/ui/alert"; import { useTranslations } from "next-intl"; -import { REGEXP_ONLY_DIGITS } from "input-otp"; +import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp"; const MFA_OTP_INPUT_ID = "mfa-otp-code"; @@ -82,9 +82,11 @@ export default function MfaInputForm({ maxLength={6} {...field} autoComplete="one-time-code" - inputMode="numeric" + inputMode="text" autoFocus - pattern={REGEXP_ONLY_DIGITS} + pattern={ + REGEXP_ONLY_DIGITS_AND_CHARS + } onChange={(value: string) => { field.onChange(value); if (value.length === 6) {