Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-27 00:52:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
Michael Abebe
2026-06-02 12:12:28 +03:00
parent 88219ee9b8
commit 2a489ca18d
6 changed files with 353 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/edr-freight-api/src/app.module.ts
View File

@@ -21,6 +21,10 @@ import { OtpModule } from './modules/otp/otp.module';
import { RuleEngineModule } from "./modules/rule-engine/rule-engine.module";
import { BackofficeModule } from "./modules/backoffice/backoffice.module";
import { DemoPermissionsModule } from "./modules/demo-permissions/demo-permissions.module";
import {
EDR_FREIGHT_APPLICATION,
EDR_FREIGHT_PERMISSIONS,
} from "./seed/edr-freight.seed";
import { EdrOrgSeeder } from "./seed/edr-org.seeder";
import { DemoUsersSeeder } from "./seed/demo-users.seeder";
@@ -36,7 +40,10 @@ import { DemoUsersSeeder } from "./seed/demo-users.seeder";
config.get<TypeOrmModuleOptions>("database")!,
}),
SharedAuthModule,
IamModule.forRoot(),
IamModule.forRoot({
applications: [EDR_FREIGHT_APPLICATION],
permissions: EDR_FREIGHT_PERMISSIONS,
}),
BookingsModule,
FilesModule,
ConsignmentsModule,

68
apps/edr-freight-api/src/modules/backoffice/backoffice.service.ts
View File

@@ -6,7 +6,7 @@ import {
import { InjectRepository } from "@nestjs/typeorm";
import { hashPassword } from "@tria-plc/api-common/utils/argon";
import { EUserStatus } from "@tria-plc/api-common/utils/enums/user.enum";
import { DataSource, In, IsNull, Repository } from "typeorm";
import { DataSource, EntityManager, In, IsNull, Repository } from "typeorm";
import { Employee, Organization, UserCredential } from "@tria-plc/iamapi-common";
import { Role } from "@tria-plc/iamapi-common/entities/iam/user/role.entity";
@@ -21,6 +21,8 @@ const RESERVED_ROLE_KEYS = new Set([
"unit_admin",
]);
const DEFAULT_USER_PASSWORD = "12345678";
const ORGANIZATION_ADMIN_ROLE_KEY = "organization_admin";
const EDR_ORG_MANAGER_ROLE_KEY = "edr_org_manager";
@Injectable()
export class BackofficeService {
@@ -51,6 +53,7 @@ export class BackofficeService {
const email = dto.email.trim().toLowerCase();
const username = dto.username.trim().toLowerCase();
const phoneNumber = dto.phoneNumber?.trim() || undefined;
const assignOrganizationAdmin = dto.assignOrganizationAdmin === true;
const name = {
en: dto.name.en.trim(),
...(dto.name.am?.trim() ? { am: dto.name.am.trim() } : {}),
@@ -168,6 +171,16 @@ export class BackofficeService {
throw new NotFoundException("employee_create_failed");
}
const userId = user.id;
if (!userId) {
throw new NotFoundException("user_create_failed");
}
if (assignOrganizationAdmin) {
await this.ensureOrganizationAdminAccess(manager, organizationId, userId);
}
return employee;
});
}
@@ -268,4 +281,57 @@ export class BackofficeService {
throw new NotFoundException("user_not_found_in_organization");
}
}
private async ensureOrganizationAdminAccess(
manager: EntityManager,
organizationId: string,
userId: string,
) {
const roles = await manager.getRepository(Role).find({
where: [
{ key: ORGANIZATION_ADMIN_ROLE_KEY },
{ key: EDR_ORG_MANAGER_ROLE_KEY },
],
select: { id: true, key: true },
});
const requiredRoles = [ORGANIZATION_ADMIN_ROLE_KEY, EDR_ORG_MANAGER_ROLE_KEY].map((key) => {
const role = roles.find((item) => item.key === key);
if (!role?.id) {
throw new NotFoundException(`required_role_not_seeded:${key}`);
}
return {
id: role.id,
key: role.key,
};
});
const existingRoleIds = new Set(
(
await manager.getRepository(UserRole).find({
where: {
userId,
organizationId,
},
select: { roleId: true },
})
).map((userRole) => userRole.roleId),
);
const rolesToInsert = requiredRoles
.filter((role) => !existingRoleIds.has(role.id))
.map((role) => ({
userId,
roleId: role.id,
organizationId,
}));
if (!rolesToInsert.length) {
return;
}
await manager.getRepository(UserRole).insert(rolesToInsert);
}
}

7
apps/edr-freight-api/src/modules/backoffice/dto/create-organization-user.dto.ts
View File

@@ -1,5 +1,5 @@
import { ApiProperty } from "@nestjs/swagger";
import { IsEmail, IsObject, IsOptional, IsString, MinLength } from "class-validator";
import { IsBoolean, IsEmail, IsObject, IsOptional, IsString, MinLength } from "class-validator";
class CreateOrganizationUserNameDto {
@ApiProperty()
@@ -31,4 +31,9 @@ export class CreateOrganizationUserDto {
@ApiProperty({ type: CreateOrganizationUserNameDto })
@IsObject()
name!: CreateOrganizationUserNameDto;
@ApiProperty({ required: false, default: false })
@IsOptional()
@IsBoolean()
assignOrganizationAdmin?: boolean;
}

227
apps/edr-freight-api/src/seed/edr-freight.seed.ts Normal file
View File

@@ -0,0 +1,227 @@
export type FreightSeedRole = {
key: string;
name: { en: string };
permissionKeys: string[];
};
const IAM_PERMISSION_KEYS = {
activateEmployee: "can:activateEmployee",
activateUser: "can:activateUser",
createEmployee: "can:createEmployee",
createPositionPermission: "can:create:position_permission",
createUnit: "can:create:unit",
createUserRole: "can:create:user_role",
deactivateEmployee: "can:deactivateEmployee",
deletePositionPermission: "can:delete:position_permission",
deleteUnit: "can:delete:unit",
deleteUserRole: "can:delete:user_role",
manageOrganizationAdmin: "manage:organizationAdmin",
manageUnitAdmin: "manage:unitAdmin",
updateUnit: "can:update:unit",
viewPositionPermission: "can:view:position_permission",
viewUserRole: "can:view:user_role",
} as const;
export const EDR_FREIGHT_APPLICATION = {
id: "7f5a2175-c270-495b-bec9-d59ddbdab5d1",
key: "edr_freight_app",
name: {
am: "EDR Freight App",
en: "EDR Freight App",
},
} as const;
const EMPLOYEE_REGISTRATION_PERMISSIONS = [
{
id: "62b5aa2d-4ef6-474d-913a-994568dce1c8",
key: "edr_freight_app:employee_registration:view",
name: { am: "View employee registration", en: "View employee registration" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "8072204d-26de-4e62-88aa-74afd916a0cb",
key: "edr_freight_app:employee_registration:create",
name: { am: "Create employee registration", en: "Create employee registration" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "b7dc55a6-ae7c-4558-8c4e-7d8ce5c7fa08",
key: "edr_freight_app:employee_registration:update",
name: { am: "Update employee registration", en: "Update employee registration" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "7ef06121-bd31-4c0d-b36d-5401b4bfd05c",
key: "edr_freight_app:employee_registration:activate",
name: { am: "Activate employee registration", en: "Activate employee registration" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "2688e144-7f0c-4704-8d59-e92b0c08117a",
key: "edr_freight_app:employee_registration:deactivate",
name: { am: "Deactivate employee registration", en: "Deactivate employee registration" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
const ROLE_ASSIGNMENT_PERMISSIONS = [
{
id: "4de87873-e00d-4330-9b4f-f4fb065f49e0",
key: "edr_freight_app:role_assignment:view",
name: { am: "View role assignment", en: "View role assignment" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "36f022b4-4b94-4220-a46c-df7bd1a1b184",
key: "edr_freight_app:role_assignment:assign",
name: { am: "Assign role", en: "Assign role" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "c1f34177-a0ae-4a46-a24a-3281b9137bab",
key: "edr_freight_app:role_assignment:replace",
name: { am: "Replace role assignment", en: "Replace role assignment" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
const HIERARCHY_UNIT_PERMISSIONS = [
{
id: "2bfa2428-ec40-4588-9b01-dfacce6a2b82",
key: "edr_freight_app:hierarchy_units:view",
name: { am: "View hierarchy units", en: "View hierarchy units" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "1e92daff-9cc7-4a67-9994-879f34bfda16",
key: "edr_freight_app:hierarchy_units:create",
name: { am: "Create hierarchy unit", en: "Create hierarchy unit" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "4ef2d8ad-c627-4448-b4b6-dd6b8b602dc1",
key: "edr_freight_app:hierarchy_units:update",
name: { am: "Update hierarchy unit", en: "Update hierarchy unit" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "15353ac5-246b-42e6-9ac3-eb61c4f1cd22",
key: "edr_freight_app:hierarchy_units:delete",
name: { am: "Delete hierarchy unit", en: "Delete hierarchy unit" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
const HIERARCHY_POSITION_PERMISSIONS = [
{
id: "37ff6f5b-9fb0-4139-af99-22fe54703029",
key: "edr_freight_app:hierarchy_positions:view",
name: { am: "View hierarchy positions", en: "View hierarchy positions" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "af6c091a-6448-4459-a635-c2181efd1de0",
key: "edr_freight_app:hierarchy_positions:create",
name: { am: "Create hierarchy position", en: "Create hierarchy position" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "e78f624d-b570-4cd6-8f16-12090a4a9d31",
key: "edr_freight_app:hierarchy_positions:update",
name: { am: "Update hierarchy position", en: "Update hierarchy position" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "7fba7887-a365-4281-96ea-fb14582b047e",
key: "edr_freight_app:hierarchy_positions:delete",
name: { am: "Delete hierarchy position", en: "Delete hierarchy position" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "a33905ff-f2b8-40b9-a8cf-e2968f6f46fb",
key: "edr_freight_app:hierarchy_positions:change_parent",
name: { am: "Change hierarchy position parent", en: "Change hierarchy position parent" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
const HIERARCHY_EMPLOYEE_ASSIGNMENT_PERMISSIONS = [
{
id: "b6ca90ff-3e95-4af2-bac8-fb298ca62080",
key: "edr_freight_app:hierarchy_employee_assignment:view",
name: { am: "View hierarchy employee assignment", en: "View hierarchy employee assignment" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "0637472f-d6b7-4332-85bb-eaa6a02205c1",
key: "edr_freight_app:hierarchy_employee_assignment:invite",
name: { am: "Invite hierarchy employee assignment", en: "Invite hierarchy employee assignment" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
{
id: "de366c81-b6d1-4cf9-a5f1-a5c8a6fb5e7b",
key: "edr_freight_app:hierarchy_employee_assignment:assign",
name: { am: "Assign hierarchy employee assignment", en: "Assign hierarchy employee assignment" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
const POSITION_TYPE_PERMISSIONS = [
{
id: "f258fb51-2890-4c93-b024-271b09d705d0",
key: "edr_freight_app:position_types:view",
name: { am: "View position types", en: "View position types" },
applicationKey: EDR_FREIGHT_APPLICATION.key,
},
] as const;
export const EDR_FREIGHT_PERMISSIONS = [
...EMPLOYEE_REGISTRATION_PERMISSIONS,
...ROLE_ASSIGNMENT_PERMISSIONS,
...HIERARCHY_UNIT_PERMISSIONS,
...HIERARCHY_POSITION_PERMISSIONS,
...HIERARCHY_EMPLOYEE_ASSIGNMENT_PERMISSIONS,
...POSITION_TYPE_PERMISSIONS,
];
export const EDR_FREIGHT_ROLES: FreightSeedRole[] = [
{
key: "edr_employee",
name: { en: "EDR Employee" },
permissionKeys: [
"edr_freight_app:employee_registration:view",
"edr_freight_app:role_assignment:view",
"edr_freight_app:hierarchy_units:view",
"edr_freight_app:hierarchy_positions:view",
"edr_freight_app:hierarchy_employee_assignment:view",
"edr_freight_app:position_types:view",
],
},
{
key: "edr_org_manager",
name: { en: "EDR Org Manager" },
permissionKeys: [
...EDR_FREIGHT_PERMISSIONS.map((permission) => permission.key),
IAM_PERMISSION_KEYS.createEmployee,
IAM_PERMISSION_KEYS.deactivateEmployee,
IAM_PERMISSION_KEYS.activateEmployee,
IAM_PERMISSION_KEYS.activateUser,
IAM_PERMISSION_KEYS.createUserRole,
IAM_PERMISSION_KEYS.deleteUserRole,
IAM_PERMISSION_KEYS.viewUserRole,
IAM_PERMISSION_KEYS.manageOrganizationAdmin,
IAM_PERMISSION_KEYS.manageUnitAdmin,
IAM_PERMISSION_KEYS.createUnit,
IAM_PERMISSION_KEYS.updateUnit,
IAM_PERMISSION_KEYS.deleteUnit,
IAM_PERMISSION_KEYS.createPositionPermission,
IAM_PERMISSION_KEYS.deletePositionPermission,
IAM_PERMISSION_KEYS.viewPositionPermission,
],
},
{
key: "edr_customer",
name: { en: "EDR Customer" },
permissionKeys: [],
},
];

84
apps/edr-freight-api/src/seed/edr-org.seeder.ts
View File

@@ -8,45 +8,17 @@ import {
} from "@tria-plc/iamapi-common";
import { DataSource, EntityManager, In } from "typeorm";
import { EDR_FREIGHT_ROLES, type FreightSeedRole } from "./edr-freight.seed";
const EDR_ORG_KEY = "edr_freight";
const EDR_ORG_NAME = { en: "EDR Freight" };
const SEED_FLAG = "SEED_EDR_ORG";
type SeedPermission = {
key: string;
name: { en: string };
};
type SeedRole = {
key: string;
name: { en: string };
permissions: SeedPermission[];
};
type SeedOrganization = {
id: string;
key: string;
};
const SEED_ROLES: SeedRole[] = [
{
key: "edr_employee",
name: { en: "EDR Employee" },
permissions: [
// { key: "permission:key", name: { en: "Permission Name" } },
{ key: "permission:key", name: { en: "Permission Name" } },
],
},
{
key: "edr_customer",
name: { en: "EDR Customer" },
permissions: [
// { key: "permission:key", name: { en: "Permission Name" } },
{ key: "permission:key", name: { en: "Permission Name" } },
],
},
];
@Injectable()
export class EdrOrgSeeder {
private readonly logger = new Logger(EdrOrgSeeder.name);
@@ -63,9 +35,8 @@ export class EdrOrgSeeder {
const organization = await this.ensureOrganization(manager);
await this.ensureOrganizationConfiguration(manager, organization.id);
await this.ensurePermissions(manager, SEED_ROLES);
await this.ensureRoles(manager, SEED_ROLES);
await this.ensureRolePermissions(manager, SEED_ROLES);
await this.ensureRoles(manager, EDR_FREIGHT_ROLES);
await this.ensureRolePermissions(manager, EDR_FREIGHT_ROLES);
});
this.logger.log(`Ensured EDR organization seed for '${EDR_ORG_KEY}'`);
@@ -127,34 +98,7 @@ export class EdrOrgSeeder {
);
}
private collectPermissions(seedRoles: SeedRole[]) {
const permissionByKey = new Map<string, SeedPermission>();
for (const role of seedRoles) {
for (const permission of role.permissions) {
permissionByKey.set(permission.key, permission);
}
}
return [...permissionByKey.values()];
}
private async ensurePermissions(manager: EntityManager, seedRoles: SeedRole[]) {
const permissions = this.collectPermissions(seedRoles);
if (!permissions.length) {
this.logger.log("No EDR role permissions configured; skipping permission seed");
return;
}
await manager.getRepository(Permission).upsert(permissions, {
conflictPaths: { key: true },
});
this.logger.log(`Ensured ${permissions.length} EDR permissions`);
}
private async ensureRoles(manager: EntityManager, seedRoles: SeedRole[]) {
private async ensureRoles(manager: EntityManager, seedRoles: FreightSeedRole[]) {
await manager.getRepository(Role).upsert(
seedRoles.map(({ key, name }) => ({ key, name })),
{
@@ -169,24 +113,24 @@ export class EdrOrgSeeder {
private async ensureRolePermissions(
manager: EntityManager,
seedRoles: SeedRole[],
seedRoles: FreightSeedRole[],
) {
const permissions = this.collectPermissions(seedRoles);
const permissionKeys = [...new Set(seedRoles.flatMap((role) => role.permissionKeys))];
if (!permissions.length) {
if (!permissionKeys.length) {
this.logger.log("No EDR role permissions configured; skipping role-permission links");
return;
}
const roleRepository = manager.getRepository(Role);
const permissionRepository = manager.getRepository(Permission);
const rolePermissionRepository = manager.getRepository(RolePermission);
const roles = await roleRepository.find({
where: { key: In(seedRoles.map((role) => role.key)) },
select: { id: true, key: true },
});
const seededPermissions = await permissionRepository.find({
where: { key: In(permissions.map((permission) => permission.key)) },
const seededPermissions = await manager.getRepository(Permission).find({
where: { key: In(permissionKeys) },
select: { id: true, key: true },
});
@@ -202,11 +146,11 @@ export class EdrOrgSeeder {
throw new Error(`missing_role:${role.key}`);
}
return role.permissions.map((permission) => {
const seededPermission = permissionByKey.get(permission.key);
return role.permissionKeys.map((permissionKey) => {
const seededPermission = permissionByKey.get(permissionKey);
if (!seededPermission) {
throw new Error(`missing_permission:${permission.key}`);
throw new Error(`missing_permission:${permissionKey}`);
}
return {

33
apps/edr-freight-web/backoffice/src/pages/dashboard/user-management/UsersPage.tsx
View File

@@ -60,6 +60,7 @@ interface UserFormState {
email: string;
username: string;
phoneNumber: string;
assignOrganizationAdmin: boolean;
}
interface ListResponse<T> {
@@ -75,6 +76,7 @@ const emptyUserForm: UserFormState = {
email: "",
username: "",
phoneNumber: "",
assignOrganizationAdmin: false,
};
const inputClassName =
@@ -346,14 +348,23 @@ const UsersPage = () => {
am: createUserForm.nameAm.trim(),
en: createUserForm.nameEn.trim(),
},
assignOrganizationAdmin: createUserForm.assignOrganizationAdmin,
},
);
const shouldAssignOrganizationAdmin = createUserForm.assignOrganizationAdmin;
setCreateUserForm(emptyUserForm);
setIsCreateUserOpen(false);
setActionSuccess("User created. Default password: 12345678.");
setActionSuccess(
shouldAssignOrganizationAdmin
? "User created as organization admin. Default password: 12345678."
: "User created. Default password: 12345678.",
);
await loadOrgEmployees(selectedOrgId);
await openManageRolesDialog(response.data);
if (!shouldAssignOrganizationAdmin) {
await openManageRolesDialog(response.data);
}
} catch (error) {
setActionError(getErrorMessage(error, "Failed to create user."));
} finally {
@@ -669,6 +680,24 @@ const UsersPage = () => {
onChange={(event) => setCreateUserForm((current) => ({ ...current, phoneNumber: event.target.value }))}
/>
</Field>
<label className="flex items-start gap-3 rounded-2xl border border-border bg-background px-4 py-3 text-sm">
<input
type="checkbox"
checked={createUserForm.assignOrganizationAdmin}
onChange={(event) =>
setCreateUserForm((current) => ({
...current,
assignOrganizationAdmin: event.target.checked,
}))
}
/>
<div>
<div className="font-medium text-foreground">Create as organization admin</div>
<div className="text-xs text-muted-foreground">
Also assigns built-in org admin access and the freight org manager role.
</div>
</div>
</label>
<div className="flex justify-end gap-2">
<button
type="button"