Merge pull request #4711 from alkem-io/server-4710-spaceAuth

* first pass at two new modules for TemplatesManager, TemplateDefault

* added templates manager to space; removed the SpaceDefaults entity (module still present until move all data to be via defaults

* added templatesManager to platform

* moved creating of default innovatin flow input to space defaults

* back out space type on Template; tidy up Template module to use switch statements

* created template applier module

* tidy up naming

* updated set of default template types

* fixed circular dependency; moved logic for creating collaboration input to space defaults

* removed loading of defaults from files for collaboration content

* removed code based addition of callouts, innovation flow states

* tidy up naming

* added loading of default templates at platform level in to bootstrap

* removed option to create new innovation flow template

* added in migration:

* loading in templates on bootstrap

* added field for collaboration templates on templatesSet; added lookup for templatesManager

* added mutation to create template from collaboration; added logic to prevent template used as default to be deleted; fixed removal of template set on template manager

* initial creation of license + entitlements modules

* add license into account

* updated account to have license service + use that in mutations checking limits, removing notion of soft limits

* ensure data is loaded properly on account for license checking

* added mutation to reset the license calculations on account, including new auth privilege to be able to do so

* renamed Licensing module to LicensingFramework module; trigger license reset on Account after assigning / removing license

* removed usage of LicenseEngine outside of license services on space or account

* renamed entitlement to licenseEntitlement as entity; first pass at migration

* fixed issues in migration

* fixed issues related to auth reset; tidied up loader creator imports

* fixed auth cascade for templates of type post

* license reset running

* reset licenses on space after adding / removing license plans

* removed need for license check in community; added entitlement check in roleset when adding a VC

* remove auth reset when assigning / removing license plans

* added License to RoleSet

* added license to collaboration

* tidied up retrieval of license for whiteboard; added license to collaboration in migration

* fix typo; fix space spec file

* fix additional tests

* moved tempaltesManager to last migration in the list

* fixed retrieval of template when creating collaboration

* added logging

* fixed bootstrap setting of templates

* refactored inputCreator to do the data loading closer to usage; fixed picking up of templates; fixed bootstrap usage of templates

* added ability to retrieve limits on entitlements + current usage

* updated field names on entitlements

* updated field names on entitlements

* fixed account mutaiton logic bug

* ensure that licenses are reset when assigning beta tester or vc campaign role to a user

* added reset all account licenses mutation

* fixed bug on space entitlements; refactored code to reduce duplication

* fixed url generation for templates inside of TempaltesManager

* fixed bootstrap order to create forum earlier

* ensure collaboration creation on template provides some defaults for callouts

* fix deletion of templates of type post

* ensure more data is defaulted inside of template service for collaboration; add setting of isTemplate field on Collaboration, and also on contained Callouts

* ensure isTempalte is passed to Collaboration entity

* fixed groups in bootstrap space template; updated signature for creating callout from collaboration

* fixed missing field

* fixed type on mutation to create from collaboration

* fixed typo

* fixed groups in bootstrap space template; updated signature for creating callout from collaboration

* fixed missing field

* fixed type on mutation to create from collaboration

* fixed typo

* reworked applying collaboraiton template to collaboration

* improved error message in wrong type of ID passed in

* fixed build

* made migration last in the list

* rename migration to be last

* removed read check when looking up collaboration

* track free / plus / premium space entitlements separately

* updated migration order

* removed duplicate migration

* moved auth reset to mutation for applying the template to another collaboration

* extend lookup of entitlement usage to cover new types

* updaed license policy to reflect new entitlements; made license engine work with entitlements, not license privileges; removed license privilege (no longer relevant)

* updated migration to not drop indexes already removed

* fix for license reset on space

* added license policy rule for free space credential

* ensure license entitlements are reset as part of the bootstrap

* fixed typo

* extended reset all to include resetting licenses on accounts + AI server; moved migration to be last

* Address pr comment

* Address PR feedback

* Address PR comment

* Address PR comments

* Address PR comments

* Address PR comment

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Improved types & naming

* Address PR comments

* Fixed switch-case logic in entitlements

* Converge entitlements schema

* Remove unused AuthorizationPrivilege

* pass in spaceID on space authorization as reload the entity

* initial rework of the space authorization to clean up logic so that the Space does not know about the parent account authorization

* removed privileges on space that are no longer used there

* minor tidy up

* fixed logic check: space auth does need license entitlements

* take rabbit suggestion

* Propagate anonymousReadAccess from parentAuthorization for Space

---------

Co-authored-by: Carlos Cano <[email protected]>
Co-authored-by: Valentin Yanakiev <[email protected]>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

src/core/bootstrap/bootstrap.service.ts

@@ -520,7 +520,7 @@ export class BootstrapService {
 
       const space = await this.accountService.createSpaceOnAccount(spaceInput);
       const spaceAuthorizations =
-        await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+        await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
       await this.authorizationPolicyService.saveAll(spaceAuthorizations);
 
       const accountEntitlements =

src/domain/common/authorization-policy/authorization.policy.entity.ts

@@ -1,5 +1,5 @@
 import { BaseAlkemioEntity } from '@domain/common/entity/base-entity';
-import { Column, Entity } from 'typeorm';
+import { Column, Entity, ManyToOne } from 'typeorm';
 import { IAuthorizationPolicy } from './authorization.policy.interface';
 import { AuthorizationPolicyType } from '@common/enums/authorization.policy.type';
 import { ENUM_LENGTH } from '@common/constants';
@@ -24,6 +24,16 @@ export class AuthorizationPolicy
   @Column('varchar', { length: ENUM_LENGTH, nullable: false })
   type!: AuthorizationPolicyType;
 
+  // An authorization can optionally choose to store a reference to the parent authorization from which it inherits
+  // This is useful for when the entity wants to adjust its settings + may no longer have access without hacky code
+  // to the authorization of the containing entity
+  @ManyToOne(() => AuthorizationPolicy, {
+    eager: false,
+    cascade: false, // MUST not cascade
+    onDelete: 'SET NULL',
+  })
+  parentAuthorizationPolicy?: AuthorizationPolicy;
+
   constructor(type: AuthorizationPolicyType) {
     super();
     this.anonymousReadAccess = false;

src/domain/common/authorization-policy/authorization.policy.interface.ts

@@ -12,6 +12,8 @@ export abstract class IAuthorizationPolicy extends IBaseAlkemio {
   verifiedCredentialRules!: string;
   privilegeRules!: string;
 
+  parentAuthorizationPolicy?: IAuthorizationPolicy;
+
   @Field(() => AuthorizationPolicyType, {
     nullable: true,
     description:

src/domain/common/authorization-policy/authorization.policy.service.ts

@@ -151,7 +151,7 @@ export class AuthorizationPolicyService {
     return authorization;
   }
 
-  reset(
+  public reset(
     authorizationPolicy: IAuthorizationPolicy | undefined
   ): IAuthorizationPolicy {
     if (!authorizationPolicy) {

src/domain/space/account/account.resolver.mutations.ts

@@ -101,7 +101,7 @@ export class AccountResolverMutations {
     space = await this.spaceService.save(space);
 
     const spaceAuthorizations =
-      await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+      await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
     await this.authorizationPolicyService.saveAll(spaceAuthorizations);
 
     const updatedLicenses = await this.spaceLicenseService.applyLicensePolicy(
@@ -424,7 +424,7 @@ export class AccountResolverMutations {
     space = await this.spaceService.save(space);
 
     const spaceAuthorizations =
-      await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+      await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
     await this.authorizationPolicyService.saveAll(spaceAuthorizations);
     // TODO: check if still needed later
     return await this.spaceService.getSpaceOrFail(space.id);

src/domain/space/account/account.service.authorization.ts

@@ -144,12 +144,9 @@ export class AccountAuthorizationService {
     }
     const updatedAuthorizations: IAuthorizationPolicy[] = [];
 
-    const clonedAccountAuth =
-      await this.getClonedAccountAuthExtendedForChildEntities(account);
-
     for (const space of account.spaces) {
       const spaceAuthorizations =
-        await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+        await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
       this.logger.verbose?.(
         `space nameID ${space.nameID}: authorizations to reset count = ${spaceAuthorizations.length}`,
         LogContext.AUTH
@@ -178,6 +175,10 @@ export class AccountAuthorizationService {
       );
     updatedAuthorizations.push(...storageAggregatorAuthorizations);
 
+    // For the VCs, InnovationPacks + InnovationHubs use a cloned + extended authorization
+    const clonedAccountAuth =
+      await this.getClonedAccountAuthExtendedForChildEntities(account);
+
     for (const vc of account.virtualContributors) {
       const updatedVcAuthorizations =
         await this.virtualContributorAuthorizationService.applyAuthorizationPolicy(
@@ -281,7 +282,6 @@ export class AccountAuthorizationService {
     accountHostManage.cascade = true;
     newRules.push(accountHostManage);
 
-    // If the user is a beta tester or part of VC campaign then can create the resources
     const createSpace = this.authorizationPolicyService.createCredentialRule(
       [AuthorizationPrivilege.CREATE_SPACE],
       [...hostCredentials],

src/domain/space/space/space.resolver.mutations.ts

@@ -138,7 +138,7 @@ export class SpaceResolverMutations {
     // but not all settings will require this, so only update if necessary
     if (shouldUpdateAuthorization) {
       const updatedAuthorizations =
-        await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+        await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
       await this.authorizationPolicyService.saveAll(updatedAuthorizations);
     }
 
@@ -168,7 +168,7 @@ export class SpaceResolverMutations {
     );
     space = await this.spaceService.save(space);
     const updatedAuthorizations =
-      await this.spaceAuthorizationService.applyAuthorizationPolicy(space);
+      await this.spaceAuthorizationService.applyAuthorizationPolicy(space.id);
     await this.authorizationPolicyService.saveAll(updatedAuthorizations);
 
     return await this.spaceService.getSpaceOrFail(space.id);
@@ -200,7 +200,10 @@ export class SpaceResolverMutations {
     // Save here so can reuse it later without another load
     const displayName = subspace.profile.displayName;
     const updatedAuthorizations =
-      await this.spaceAuthorizationService.applyAuthorizationPolicy(subspace);
+      await this.spaceAuthorizationService.applyAuthorizationPolicy(
+        subspace.id,
+        space.authorization // Important, and will be stored
+      );
 
     await this.authorizationPolicyService.saveAll(updatedAuthorizations);