Move Impersonate from User to Workspace (#2630)

* Fix impersonate

* align core typeorm config with metadata config + add allowImpersonation to workspace

* move allowImpersonation to workspace

* remove allowImpersonation from workspaceMember workspace table

server/src/core/auth/auth.module.ts

@@ -3,19 +3,15 @@ import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { TypeOrmModule } from '@nestjs/typeorm';
 
-import { NestjsQueryGraphQLModule } from '@ptc-org/nestjs-query-graphql';
-
 import { EnvironmentService } from 'src/integrations/environment/environment.service';
 import { FileModule } from 'src/core/file/file.module';
 import { Workspace } from 'src/core/workspace/workspace.entity';
 import { User } from 'src/core/user/user.entity';
 import { RefreshToken } from 'src/core/refresh-token/refresh-token.entity';
 import { DataSourceModule } from 'src/metadata/data-source/data-source.module';
-import { TypeORMModule } from 'src/database/typeorm/typeorm.module';
 import { UserModule } from 'src/core/user/user.module';
 import { WorkspaceManagerModule } from 'src/workspace/workspace-manager/workspace-manager.module';
-
-import config from '../../../ormconfig';
+import { TypeORMModule } from 'src/database/typeorm/typeorm.module';
 
 import { AuthResolver } from './auth.resolver';
 
@@ -44,13 +40,8 @@ const jwtModule = JwtModule.registerAsync({
     DataSourceModule,
     UserModule,
     WorkspaceManagerModule,
-    TypeOrmModule.forRoot(config),
-    NestjsQueryGraphQLModule.forFeature({
-      imports: [
-        TypeOrmModule.forFeature([Workspace, User, RefreshToken]),
-        TypeORMModule,
-      ],
-    }),
+    TypeORMModule,
+    TypeOrmModule.forFeature([Workspace, User, RefreshToken], 'core'),
   ],
   controllers: [GoogleAuthController, VerifyAuthController],
   providers: [AuthService, TokenService, JwtAuthStrategy, AuthResolver],

server/src/core/auth/auth.resolver.ts

@@ -34,7 +34,7 @@ import { ImpersonateInput } from './dto/impersonate.input';
 @Resolver()
 export class AuthResolver {
   constructor(
-    @InjectRepository(Workspace)
+    @InjectRepository(Workspace, 'core')
     private readonly workspaceRepository: Repository<Workspace>,
     private authService: AuthService,
     private tokenService: TokenService,

server/src/core/auth/controllers/google-auth.controller.ts

@@ -21,8 +21,8 @@ export class GoogleAuthController {
     private readonly environmentService: EnvironmentService,
     private readonly typeORMService: TypeORMService,
     private readonly authService: AuthService,
-    @InjectRepository(Workspace)
-    @InjectRepository(User, 'metadata')
+    @InjectRepository(Workspace, 'core')
+    @InjectRepository(User, 'core')
     private readonly userRepository: Repository<User>,
   ) {}
 

server/src/core/auth/services/auth.service.ts

@@ -44,9 +44,9 @@ export class AuthService {
     private readonly userService: UserService,
     private readonly workspaceManagerService: WorkspaceManagerService,
     private readonly fileUploadService: FileUploadService,
-    @InjectRepository(Workspace)
+    @InjectRepository(Workspace, 'core')
     private readonly workspaceRepository: Repository<Workspace>,
-    @InjectRepository(User)
+    @InjectRepository(User, 'core')
     private readonly userRepository: Repository<User>,
   ) {}
 
@@ -194,13 +194,18 @@ export class AuthService {
   }
 
   async impersonate(userId: string) {
-    const user = await this.userRepository.findOneBy({
-      id: userId,
+    const user = await this.userRepository.findOne({
+      where: {
+        id: userId,
+      },
+      relations: ['defaultWorkspace'],
     });
 
     assert(user, "This user doesn't exist", NotFoundException);
 
-    // Todo: check if workspace member can be impersonated
+    if (!user.defaultWorkspace.allowImpersonation) {
+      throw new ForbiddenException('Impersonation not allowed');
+    }
 
     const accessToken = await this.tokenService.generateAccessToken(user.id);
     const refreshToken = await this.tokenService.generateRefreshToken(user.id);

server/src/core/auth/services/token.service.ts

@@ -26,9 +26,9 @@ export class TokenService {
   constructor(
     private readonly jwtService: JwtService,
     private readonly environmentService: EnvironmentService,
-    @InjectRepository(User)
+    @InjectRepository(User, 'core')
     private readonly userRepository: Repository<User>,
-    @InjectRepository(RefreshToken)
+    @InjectRepository(RefreshToken, 'core')
     private readonly refreshTokenRepository: Repository<RefreshToken>,
   ) {}
 

server/src/core/auth/strategies/jwt.auth.strategy.ts

@@ -25,9 +25,9 @@ export class JwtAuthStrategy extends PassportStrategy(Strategy, 'jwt') {
     private readonly environmentService: EnvironmentService,
     private readonly typeORMService: TypeORMService,
     private readonly dataSourceService: DataSourceService,
-    @InjectRepository(Workspace)
+    @InjectRepository(Workspace, 'core')
     private readonly workspaceRepository: Repository<Workspace>,
-    @InjectRepository(User)
+    @InjectRepository(User, 'core')
     private readonly userRepository: Repository<User>,
   ) {
     super({