-
Notifications
You must be signed in to change notification settings - Fork 19
add(role): migration to create tenant_admin role and assign permissions #851
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
81b1915
add(role): migration to create tenant_admin role and assign permissions
nevil-mathew 25f2b4c
feat(auth): add tenant_admin role and update permission checks in aut…
nevil-mathew 0862663
fix(auth): update error messages for tenant admin organization checks
nevil-mathew d23f99d
fix(auth): rename organization variable to overrideOrg for clarity in…
nevil-mathew 4f8a947
fix(locales): correct formatting of organization code header message …
nevil-mathew 8cdc839
fix(auth): update role access validation to include tenant_admin in n…
nevil-mathew 7ea3863
fix(account): include tenant_code in role query for accurate role ret…
nevil-mathew 899e99b
feat(admin): add assignRole method for user role assignment with toke…
nevil-mathew c47f705
fix(admin): handle UniqueConstraintError in user role assignment
nevil-mathew 6a13a69
fix(admin): streamline user session termination process in deleteUser…
nevil-mathew 10cab5f
fix(admin): add error handling for post-assignment operations in user…
nevil-mathew 33a2150
fix(admin): correct user ID assignment in user organization role crea…
nevil-mathew File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
139 changes: 139 additions & 0 deletions
139
src/database/migrations/20251022160602-add-tenant-admin-role.js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| 'use strict' | ||
|
|
||
| module.exports = { | ||
| up: async (queryInterface, Sequelize) => { | ||
| const transaction = await queryInterface.sequelize.transaction() | ||
|
|
||
| try { | ||
| // Step 1: Get all unique organization_ids per tenant from existing user_roles | ||
| const [orgsByTenant] = await queryInterface.sequelize.query( | ||
| `SELECT DISTINCT tenant_code, organization_id | ||
| FROM user_roles | ||
| WHERE deleted_at IS NULL | ||
| AND tenant_code IN ( | ||
| SELECT code FROM tenants WHERE deleted_at IS NULL | ||
| ) | ||
| ORDER BY tenant_code, organization_id`, | ||
| { transaction } | ||
| ) | ||
|
|
||
| if (orgsByTenant.length === 0) { | ||
| console.log('No active organizations found. Skipping migration.') | ||
| await transaction.commit() | ||
| return | ||
| } | ||
|
|
||
| console.log(`Found ${orgsByTenant.length} organization-tenant combinations`) | ||
|
|
||
| // Step 2: Insert tenant_admin role for each tenant-organization combination | ||
| const userRoleInserts = orgsByTenant.map((org) => ({ | ||
| title: 'tenant_admin', | ||
| label: 'Tenant Admin', | ||
| user_type: 1, // Adjust this value based on your user_type convention | ||
| status: 'ACTIVE', | ||
| organization_id: org.organization_id, | ||
| visibility: 'PUBLIC', | ||
| tenant_code: org.tenant_code, | ||
| translations: null, | ||
| created_at: new Date(), | ||
| updated_at: new Date(), | ||
| })) | ||
|
|
||
| await queryInterface.bulkInsert('user_roles', userRoleInserts, { | ||
| transaction, | ||
| ignoreDuplicates: true, // In case role already exists | ||
| }) | ||
|
|
||
| console.log(`Inserted tenant_admin role for ${userRoleInserts.length} organization-tenant combinations`) | ||
|
|
||
| // Step 3: Get all admin permissions except admin module and admin-only permissions | ||
| // Excluding: | ||
| // - module = 'admin' (permission_ids: 22, 23, 26) | ||
| // - Admin-only feature permission (40) | ||
| // - Admin-only tenant permission (35) | ||
| // Including organization permissions (8, 28, 29, 30) as per requirement | ||
| const [adminPermissions] = await queryInterface.sequelize.query( | ||
| `SELECT DISTINCT | ||
| permission_id, | ||
| module, | ||
| request_type, | ||
| api_path, | ||
| created_at, | ||
| updated_at, | ||
| created_by | ||
| FROM role_permission_mapping | ||
| WHERE role_title = 'admin' | ||
| AND module != 'admin' | ||
| AND permission_id NOT IN (35, 40) | ||
| ORDER BY permission_id`, | ||
| { transaction } | ||
| ) | ||
|
|
||
| console.log(`Found ${adminPermissions.length} permissions to copy for tenant_admin`) | ||
|
|
||
| // Step 4: Insert permissions for tenant_admin role | ||
| if (adminPermissions.length > 0) { | ||
| const permissionInserts = adminPermissions.map((perm) => ({ | ||
| role_title: 'tenant_admin', | ||
| permission_id: perm.permission_id, | ||
| module: perm.module, | ||
| request_type: perm.request_type, | ||
| api_path: perm.api_path, | ||
| created_at: new Date(), | ||
| updated_at: new Date(), | ||
| created_by: perm.created_by, | ||
| })) | ||
|
|
||
| await queryInterface.bulkInsert('role_permission_mapping', permissionInserts, { | ||
| transaction, | ||
| ignoreDuplicates: true, | ||
| }) | ||
|
|
||
| console.log(`Inserted ${permissionInserts.length} permissions for tenant_admin role`) | ||
| } | ||
|
|
||
| // Commit transaction | ||
| await transaction.commit() | ||
| console.log('Migration completed successfully') | ||
| console.log('Summary:') | ||
| console.log(`- Created tenant_admin roles: ${userRoleInserts.length}`) | ||
| console.log(`- Assigned permissions: ${adminPermissions.length}`) | ||
| console.log('- Excluded modules: admin') | ||
| console.log('- Excluded permissions: 35 (tenant), 40 (feature full CRUD)') | ||
| } catch (error) { | ||
| // Rollback transaction on error | ||
| await transaction.rollback() | ||
| console.error('Migration failed, rolled back:', error) | ||
| throw error | ||
| } | ||
| }, | ||
|
|
||
| down: async (queryInterface, Sequelize) => { | ||
| const transaction = await queryInterface.sequelize.transaction() | ||
|
|
||
| try { | ||
| // Step 1: Delete all tenant_admin permissions from role_permission_mapping | ||
| const [deletePermResult] = await queryInterface.sequelize.query( | ||
| `DELETE FROM role_permission_mapping WHERE role_title = 'tenant_admin'`, | ||
| { transaction } | ||
| ) | ||
|
|
||
| console.log('Deleted all tenant_admin permissions') | ||
|
|
||
| // Step 2: Delete all tenant_admin roles from user_roles (soft delete if paranoid) | ||
| const [deleteRoleResult] = await queryInterface.sequelize.query( | ||
| `DELETE FROM user_roles WHERE title = 'tenant_admin'`, | ||
| { transaction } | ||
| ) | ||
|
|
||
| console.log('Deleted all tenant_admin roles') | ||
|
|
||
| await transaction.commit() | ||
| console.log('Rollback completed successfully') | ||
| } catch (error) { | ||
| await transaction.rollback() | ||
| console.error('Rollback failed:', error) | ||
| throw error | ||
| } | ||
| }, | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.