feat: Introduce advanced permissions (#7844)

This PR introduces the possibility of inviting new users with an `admin`
role and changing the role of already invited users.
Also using scoped permission checks where applicable instead of using
user role checks.

---------

Co-authored-by: Val <68596159+valya@users.noreply.github.com>
Co-authored-by: Alex Grozav <alex@grozav.com>
Co-authored-by: Iván Ovejero <ivov.src@gmail.com>

cypress/e2e/17-sharing.cy.ts

@@ -1,4 +1,4 @@
-import { INSTANCE_MEMBERS, INSTANCE_OWNER } from '../constants';
+import { INSTANCE_MEMBERS, INSTANCE_OWNER, INSTANCE_ADMIN } from '../constants';
 import {
 	CredentialsModal,
 	CredentialsPage,
@@ -7,6 +7,7 @@ import {
 	WorkflowSharingModal,
 	WorkflowsPage,
 } from '../pages';
+import { getVisibleSelect } from '../utils';
 
 /**
  * User U1 - Instance owner
@@ -129,4 +130,38 @@ describe('Sharing', { disableAutoLogin: true }, () => {
 		credentialsPage.getters.credentialCard('Credential C2').click();
 		credentialsModal.getters.testSuccessTag().should('be.visible');
 	});
+
+	it.only('should work for admin role on credentials created by others (also can share it with themselves)', () => {
+		cy.signin(INSTANCE_MEMBERS[0]);
+
+		cy.visit(credentialsPage.url);
+		credentialsPage.getters.createCredentialButton().click();
+		credentialsModal.getters.newCredentialTypeOption('Notion API').click();
+		credentialsModal.getters.newCredentialTypeButton().click({ force: true });
+		credentialsModal.getters.connectionParameter('Internal Integration Secret').type('1234567890');
+		credentialsModal.actions.setName('Credential C3');
+		credentialsModal.actions.save();
+		credentialsModal.actions.close();
+
+		cy.signout();
+		cy.signin(INSTANCE_ADMIN);
+		cy.visit(credentialsPage.url);
+		credentialsPage.getters.credentialCard('Credential C3').click();
+		credentialsModal.getters.testSuccessTag().should('be.visible');
+		cy.get('input').should('not.have.length');
+		credentialsModal.actions.changeTab('Sharing');
+
+		credentialsModal.getters.usersSelect().click();
+		cy.getByTestId('user-email')
+			.filter(':visible')
+			.should('have.length', 3)
+			.contains(INSTANCE_ADMIN.email)
+			.should('have.length', 1);
+		getVisibleSelect().contains(INSTANCE_OWNER.email.toLowerCase()).click();
+
+		credentialsModal.actions.addUser(INSTANCE_MEMBERS[1].email);
+		credentialsModal.actions.addUser(INSTANCE_ADMIN.email);
+		credentialsModal.actions.saveSharing();
+		credentialsModal.actions.close();
+	});
 });

cypress/e2e/18-user-management.cy.ts

@@ -1,6 +1,7 @@
 import { INSTANCE_MEMBERS, INSTANCE_OWNER, INSTANCE_ADMIN } from '../constants';
 import { MainSidebar, SettingsSidebar, SettingsUsersPage, WorkflowPage } from '../pages';
 import { PersonalSettingsPage } from '../pages/settings-personal';
+import { getVisibleSelect } from '../utils';
 
 /**
  * User A - Instance owner
@@ -29,7 +30,9 @@ const settingsSidebar = new SettingsSidebar();
 const mainSidebar = new MainSidebar();
 
 describe('User Management', { disableAutoLogin: true }, () => {
-	before(() => cy.enableFeature('sharing'));
+	before(() => {
+		cy.enableFeature('sharing');
+	});
 
 	it('should prevent non-owners to access UM settings', () => {
 		usersSettingsPage.actions.loginAndVisit(
@@ -58,6 +61,67 @@ describe('User Management', { disableAutoLogin: true }, () => {
 		usersSettingsPage.getters.userActionsToggle(INSTANCE_ADMIN.email).should('exist');
 	});
 
+	it('should be able to change user role to Admin and back', () => {
+		cy.enableFeature('advancedPermissions');
+
+		usersSettingsPage.actions.loginAndVisit(INSTANCE_OWNER.email, INSTANCE_OWNER.password, true);
+
+		// Change role from Member to Admin
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_MEMBERS[0].email)
+			.find('input')
+			.should('contain.value', 'Member');
+		usersSettingsPage.getters.userRoleSelect(INSTANCE_MEMBERS[0].email).click();
+		getVisibleSelect().find('li').contains('Admin').click();
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_MEMBERS[0].email)
+			.find('input')
+			.should('contain.value', 'Admin');
+
+		usersSettingsPage.actions.loginAndVisit(
+			INSTANCE_MEMBERS[0].email,
+			INSTANCE_MEMBERS[0].password,
+			true,
+		);
+
+		// Change role from Admin to Member, then back to Admin
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_ADMIN.email)
+			.find('input')
+			.should('contain.value', 'Admin');
+
+		usersSettingsPage.getters.userRoleSelect(INSTANCE_ADMIN.email).click();
+		getVisibleSelect().find('li').contains('Member').click();
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_ADMIN.email)
+			.find('input')
+			.should('contain.value', 'Member');
+
+		usersSettingsPage.actions.loginAndVisit(INSTANCE_ADMIN.email, INSTANCE_ADMIN.password, false);
+		usersSettingsPage.actions.loginAndVisit(
+			INSTANCE_MEMBERS[0].email,
+			INSTANCE_MEMBERS[0].password,
+			true,
+		);
+
+		usersSettingsPage.getters.userRoleSelect(INSTANCE_ADMIN.email).click();
+		getVisibleSelect().find('li').contains('Admin').click();
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_ADMIN.email)
+			.find('input')
+			.should('contain.value', 'Admin');
+
+		usersSettingsPage.actions.loginAndVisit(INSTANCE_ADMIN.email, INSTANCE_ADMIN.password, true);
+		usersSettingsPage.getters.userRoleSelect(INSTANCE_MEMBERS[0].email).click();
+		getVisibleSelect().find('li').contains('Member').click();
+		usersSettingsPage.getters
+			.userRoleSelect(INSTANCE_MEMBERS[0].email)
+			.find('input')
+			.should('contain.value', 'Member');
+
+		cy.disableFeature('advancedPermissions');
+	});
+
 	it('should be able to change theme', () => {
 		personalSettingsPage.actions.loginAndVisit(INSTANCE_OWNER.email, INSTANCE_OWNER.password);
 

cypress/e2e/35-admin-user-smoke-test.cy.ts

@@ -0,0 +1,23 @@
+import { INSTANCE_ADMIN, INSTANCE_OWNER } from '../constants';
+import { SettingsPage } from '../pages/settings';
+
+const settingsPage = new SettingsPage();
+
+describe('Admin user', { disableAutoLogin: true }, () => {
+	it('should see same Settings sub menu items as instance owner', () => {
+		cy.signin(INSTANCE_OWNER);
+		cy.visit(settingsPage.url);
+
+		let ownerMenuItems = 0;
+
+		settingsPage.getters.menuItems().then(($el) => {
+			ownerMenuItems = $el.length;
+		});
+
+		cy.signout();
+		cy.signin(INSTANCE_ADMIN);
+		cy.visit(settingsPage.url);
+
+		settingsPage.getters.menuItems().should('have.length', ownerMenuItems);
+	});
+});

cypress/pages/modals/credentials-modal.ts

@@ -1,4 +1,5 @@
 import { BasePage } from '../base';
+import { getVisibleSelect } from '../../utils';
 
 export class CredentialsModal extends BasePage {
 	getters = {
@@ -30,11 +31,7 @@ export class CredentialsModal extends BasePage {
 	actions = {
 		addUser: (email: string) => {
 			this.getters.usersSelect().click();
-			this.getters
-				.usersSelect()
-				.get('.el-select-dropdown__item')
-				.contains(email.toLowerCase())
-				.click();
+			getVisibleSelect().contains(email.toLowerCase()).click();
 		},
 		setName: (name: string) => {
 			this.getters.name().click();
@@ -48,6 +45,12 @@ export class CredentialsModal extends BasePage {
 			if (test) cy.wait('@testCredential');
 			this.getters.saveButton().should('contain.text', 'Saved');
 		},
+		saveSharing: (test = false) => {
+			cy.intercept('PUT', '/rest/credentials/*/share').as('shareCredential');
+			this.getters.saveButton().click({ force: true });
+			cy.wait('@shareCredential');
+			this.getters.saveButton().should('contain.text', 'Saved');
+		},
 		close: () => {
 			this.getters.closeButton().click();
 		},

cypress/pages/settings-users.ts

@@ -20,6 +20,8 @@ export class SettingsUsersPage extends BasePage {
 		userItem: (email: string) => cy.getByTestId(`user-list-item-${email.toLowerCase()}`),
 		userActionsToggle: (email: string) =>
 			this.getters.userItem(email).find('[data-test-id="action-toggle"]'),
+		userRoleSelect: (email: string) =>
+			this.getters.userItem(email).find('[data-test-id="user-role-select"]'),
 		deleteUserAction: () =>
 			cy.getByTestId('action-toggle-dropdown').find('li:contains("Delete"):visible'),
 		confirmDeleteModal: () => cy.getByTestId('deleteUser-modal').last(),

cypress/pages/settings.ts

@@ -0,0 +1,9 @@
+import { BasePage } from './base';
+
+export class SettingsPage extends BasePage {
+	url = '/settings';
+	getters = {
+		menuItems: () => cy.getByTestId('menu-item'),
+	};
+	actions = {};
+}