Add separate privilege for application approval

src/common/constants/authorization/policy.rule.constants.ts

@@ -27,3 +27,5 @@ export const PRIVILEGE_RULE_READ_USER_SETTINGS =
 export const POLICY_RULE_COMMUNITY_INVITE_MEMBER = 'policyRule-communityInvite';
 export const POLICY_RULE_COMMUNITY_ADD_VC =
   'policyRule-communityAddVirtualContributor';
+export const POLICY_RULE_COMMUNITY_APPROVE_APPLICATION =
+  'policyRule-communityApproveApplication';

src/common/enums/authorization.privilege.ts

@@ -30,6 +30,7 @@ export enum AuthorizationPrivilege {
   UPDATE_INNOVATION_FLOW = 'update-innovation-flow',
   COMMUNITY_JOIN = 'community-join',
   COMMUNITY_APPLY = 'community-apply',
+  COMMUNITY_APPLY_ACCEPT = 'community-apply-accept',
   COMMUNITY_INVITE = 'community-invite',
   COMMUNITY_INVITE_ACCEPT = 'community-invite-accept',
   COMMUNITY_ADD_MEMBER = 'community-add-member', // only for global admins

src/domain/access/application/application.service.authorization.ts

@@ -6,6 +6,8 @@ import { IAuthorizationPolicy } from '@domain/common/authorization-policy/author
 import { IApplication } from './application.interface';
 import { IAuthorizationPolicyRuleCredential } from '@core/authorization/authorization.policy.rule.credential.interface';
 import { CREDENTIAL_RULE_COMMUNITY_USER_APPLICATION } from '@common/constants/authorization/credential.rule.constants';
+import { AuthorizationPolicyRulePrivilege } from '@core/authorization/authorization.policy.rule.privilege';
+import { POLICY_RULE_COMMUNITY_APPROVE_APPLICATION } from '@common/constants';
 
 @Injectable()
 export class ApplicationAuthorizationService {
@@ -24,6 +26,10 @@ export class ApplicationAuthorizationService {
         parentAuthorization
       );
 
+    application.authorization = this.appendPrivilegeRules(
+      application.authorization
+    );
+
     application.authorization =
       await this.extendAuthorizationPolicy(application);
 
@@ -61,4 +67,19 @@ export class ApplicationAuthorizationService {
       newRules
     );
   }
+
+  private appendPrivilegeRules(
+    authorization: IAuthorizationPolicy
+  ): IAuthorizationPolicy {
+    const approveApplicationPrivilege = new AuthorizationPolicyRulePrivilege(
+      [AuthorizationPrivilege.COMMUNITY_APPLY_ACCEPT],
+      AuthorizationPrivilege.GRANT,
+      POLICY_RULE_COMMUNITY_APPROVE_APPLICATION
+    );
+
+    return this.authorizationPolicyService.appendPrivilegeAuthorizationRules(
+      authorization,
+      [approveApplicationPrivilege]
+    );
+  }
 }

src/domain/access/application/application.service.lifecycle.ts

@@ -60,7 +60,7 @@ export const applicationLifecycleMachine: ILifecycleDefinition = {
     new: {
       on: {
         APPROVE: {
-          guards: 'hasUpdatePrivilege',
+          guards: 'hasApplicationAcceptPrivilege',
           target: ApplicationLifecycleState.APPROVING,
         },
         REJECT: {
@@ -72,7 +72,7 @@ export const applicationLifecycleMachine: ILifecycleDefinition = {
     approving: {
       on: {
         APPROVED: {
-          guards: 'hasUpdatePrivilege',
+          guards: 'hasApplicationAcceptPrivilege',
           target: ApplicationLifecycleState.APPROVED,
         },
       },

src/domain/access/role-set/role.set.resolver.mutations.ts

@@ -692,10 +692,12 @@ export class RoleSetResolverMutations {
     let application = await this.applicationService.getApplicationOrFail(
       eventData.applicationID
     );
+
+    //toDo fix this temporary fix. Patches the immediate issue but doesn't solve the design issue of guards not being triggered on transitions
     this.authorizationService.grantAccessOrFail(
       agentInfo,
       application.authorization,
-      AuthorizationPrivilege.UPDATE,
+      AuthorizationPrivilege.COMMUNITY_APPLY_ACCEPT,
       `event on application: ${application.id}`
     );
 

src/domain/access/role-set/role.set.service.lifecycle.application.ts

@@ -33,6 +33,15 @@ export class RoleSetServiceLifecycleApplication {
             AuthorizationPrivilege.UPDATE
           );
         },
+        hasApplicationAcceptPrivilege: ({ event }) => {
+          const agentInfo: AgentInfo = event.agentInfo;
+          const authorizationPolicy: IAuthorizationPolicy = event.authorization;
+          return this.authorizationService.isAccessGranted(
+            agentInfo,
+            authorizationPolicy,
+            AuthorizationPrivilege.COMMUNITY_APPLY_ACCEPT
+          );
+        },
       },
     });
     return machine.createMachine(applicationLifecycleMachine);