New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(users): add support for tenant level users #6708

Open

apoorvdixit88 wants to merge 8 commits into main from tenant-entity-and-apis

Contributor

apoorvdixit88 commented Dec 1, 2024 •

edited

Loading

Type of Change

Description

Add api to create tenant users
Add api to create orgs
Support tenant level entity for the user hierarchy

Additional Changes

This PR modifies the API contract
This PR modifies the database schema
This PR modifies application configuration/environment variables

Motivation and Context

Closes #6707

How did you test it?

Api for create tenant:

curl --location 'http://localhost:8080/user/create_tenant' \
--header 'api-key: test_admin' \
--header 'Content-Type: application/json' \
--header 'x-tenant-id: test' \
--header 'Cookie: login_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNTJhMmViYzItOWZiZS00MDI0LThjODEtOWYwMzMyZTJlZDMxIiwicHVycG9zZSI6InRvdHAiLCJvcmlnaW4iOiJzaWduX3VwIiwicGF0aCI6W10sImV4cCI6MTczMzMwOTI2NSwidGVuYW50X2lkIjoicHVibGljIn0.3B918rdY_XM0dRH4yx9O7Nujd3FbLdmKUmBY52KVKAo' \
--data-raw '{
    "name" : "tf2",
    "email" : "[email protected]",
    "password": "Pass@321"
}'

Response: 200 Ok, if tenant_admin got created successfully
A tenant can login with email and password and continue with 2FA, he will land into any one of organization existing for tenant.

Create Org Api, (works for tenant users only)

curl --location 'http://localhost:8080/user/create_org' \
--header 'x-tenant-id: test' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer JWT' \
--header 'Cookie: Cookie' \
--data '{
    "organization_name": "ten",
    "merchant_name": "pp_ten"
}'

Response will be 200 OK if the org got created success fully (1 org with 1 merchant and 1 profile)

After getting the login token tenant admin can switch to any org in the tenancy.

Checklist

I formatted the code cargo +nightly fmt --all
I addressed lints thrown by cargo clippy
I reviewed the submitted code
I added unit tests for my changes where possible


          feat(users): add support for tenant level users

d539dbd

apoorvdixit88 added C-feature A-users labels

apoorvdixit88 self-assigned this

apoorvdixit88 requested review from a team as code owners

December 1, 2024 21:16

semanticdiff-com bot commented Dec 1, 2024 •

edited

Loading

Review changes with

Changed Files

File	Status
crates/router/src/routes/lock_utils.rs	41% smaller
crates/router/src/core/user.rs	39% smaller
crates/api_models/src/events/user.rs	35% smaller
crates/router/src/utils/user_role.rs	18% smaller
crates/router/src/routes/app.rs	15% smaller
crates/router/src/types/domain/user/decision_manager.rs	12% smaller
crates/router/src/core/user_role/role.rs	5% smaller
crates/router/src/services/authorization/roles/predefined_roles.rs	4% smaller
crates/router/src/types/domain/user.rs	3% smaller
crates/router/src/core/user_role.rs	1% smaller
crates/api_models/src/user.rs	0% smaller
crates/common_enums/src/enums.rs	0% smaller
crates/common_utils/src/consts.rs	0% smaller
crates/diesel_models/src/query/merchant_account.rs	0% smaller
crates/router/src/analytics.rs	0% smaller
crates/router/src/db/kafka_store.rs	0% smaller
crates/router/src/db/merchant_account.rs	0% smaller
crates/router/src/routes/user.rs	0% smaller
crates/router/src/services/authorization/permissions.rs	0% smaller
crates/router/src/types/transformers.rs	0% smaller
crates/router/src/utils/user.rs	0% smaller
crates/router_env/src/logger/types.rs	0% smaller

hyperswitch-bot bot and others added 6 commits

December 1, 2024 21:16


          chore: run formatter

8a56ce5


          fix: address failing checks

3ebd47e


          Merge branch 'main' into tenant-entity-and-apis

a0300e5


          Merge branch 'main' into tenant-entity-and-apis

40a5e96


          fix: v2 check for req create

e2ab37b


          fix: token changes

2d7abe3

ThisIsMani reviewed

View reviewed changes

crates/router/src/core/user.rs Outdated

+                  state: SessionState,
+                  req: user_api::UserOrgCreateRequest,
+              ) -> UserResponse<()> {
+                  let db_organization = crate::types::transformers::ForeignFrom::foreign_from(req.clone());

Contributor

ThisIsMani Dec 2, 2024

Clean up import.

crates/router/src/core/user.rs Outdated

Comment on lines 2563 to 2595

+                  let orgs = if matches!(role_info.get_entity_type(), EntityType::Tenant) {
+                      let key_manager_state = &(&state).into();
+                      state
+                          .store
+                          .list_all_merchant_accounts(key_manager_state, None, None)
+                          .await
+                          .change_context(UserErrors::InternalServerError)?
+                          .into_iter()
+                          .map(|merchant_account| merchant_account.get_org_id().to_owned())
+                          .collect::<HashSet<_>>()
+                  } else {
+                      state
+                          .global_store
+                          .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
+                              user_id: user_from_token.user_id.as_str(),
+                              tenant_id: user_from_token
+                                  .tenant_id
+                                  .as_ref()
+                                  .unwrap_or(&state.tenant.tenant_id),
+                              org_id: None,
+                              merchant_id: None,
+                              profile_id: None,
+                              entity_id: None,
+                              version: None,
+                              status: Some(UserStatus::Active),
+                              limit: None,
+                          })
+                          .await
+                          .change_context(UserErrors::InternalServerError)?
+                          .into_iter()
+                          .filter_map(|user_role| user_role.org_id)
+                          .collect::<HashSet<_>>()
+                  };

Contributor

ThisIsMani Dec 2, 2024

NIT: Use match instead.

crates/router/src/core/user.rs Outdated

+                              .change_context(UserErrors::InternalServerError)
+                              .attach_printable("Failed to get merchant list for org")?
+                              .first()
+                              .ok_or(UserErrors::InternalServerError)

Contributor

ThisIsMani Dec 2, 2024

Shouldn't be InternalServerError.

crates/router/src/core/user.rs Outdated

+                              .await
+                              .change_context(UserErrors::InternalServerError)
+                              .attach_printable("Failed to get merchant list for org")?
+                              .first()

Contributor

ThisIsMani Dec 2, 2024

Use pop().

crates/router/src/core/user.rs Outdated

                   let token = utils::user::generate_jwt_auth_token_with_attributes(
                       &state,
                       user_from_token.user_id,
                       merchant_id.clone(),
                       request.org_id.clone(),
-                      user_role.role_id.clone(),
+                      user_from_token.role_id.clone(),

Contributor

ThisIsMani Dec 2, 2024

Should come from user_role.

crates/router/src/core/user_role.rs

Comment on lines +874 to +879

    
                              EntityType::Tenant => {

                                  return Err(UserErrors::InvalidRoleOperationWithMessage(

                                      "Tenant roles are not allowed for this operation".to_string(),

                                  )

                                  .into());

                              }

Contributor

ThisIsMani Dec 2, 2024

Should we throw error here? Is dashboard handling this?

Contributor Author

apoorvdixit88 Dec 2, 2024

The query above it will fetch 0 user_roles for entity type tenant where status is invitation_sent, so we should throw error here instead of sending empty vector, if we have such user role.

crates/diesel_models/src/query/merchant_account.rs

+                      conn: &PgPooledConn,
+                      limit: Option<u32>,
+                      offset: Option<u32>,
+                  ) -> StorageResult<Vec<Self>> {

Contributor

ThisIsMani Dec 2, 2024

Instead of Self, can we get only merchant_id and org_id, which we don't have to decrypt?

crates/router/src/services/authorization/roles/predefined_roles.rs Outdated

Comment on lines 91 to 93

    
                          is_invitable: true,

                          is_deletable: true,

                          is_updatable: true,

Contributor

ThisIsMani Dec 2, 2024

Should be false.

crates/router/src/types/transformers.rs

Comment on lines +1675 to +1692

+              impl ForeignFrom<api_models::user::UserOrgCreateRequest>
+                  for diesel_models::organization::OrganizationNew
+              {
+                  fn foreign_from(item: api_models::user::UserOrgCreateRequest) -> Self {
+                      let org_new = api_models::organization::OrganizationNew::new(None);
+                      let api_models::user::UserOrgCreateRequest {
+                          organization_name,
+                          organization_details,
+                          metadata,
+                          ..
+                      } = item;
+                      let mut org_new_db = Self::new(org_new.org_id, Some(organization_name));
+                      org_new_db.organization_details = organization_details;
+                      org_new_db.metadata = metadata;
+                      org_new_db
+                  }
+              }

Contributor

ThisIsMani Dec 2, 2024

Check if we should we keep it here?

crates/router/src/types/domain/user/decision_manager.rs Outdated

Comment on lines 129 to 174

+                              let key_manager_state = &(&*state).into();
+                              let merchant_account = state
+                                  .store
+                                  .list_all_merchant_accounts(key_manager_state, Some(1), None)
+                                  .await
+                                  .change_context(UserErrors::InternalServerError)?
+                                  .pop()
+                                  .ok_or(UserErrors::InternalServerError)?;
+                              let merchant_id = merchant_account.get_id().to_owned();
+                              let org_id = merchant_account.get_org_id().to_owned();
+                              let key_store = state
+                                  .store
+                                  .get_merchant_key_store_by_merchant_id(
+                                      &state.into(),
+                                      &merchant_id,
+                                      &state.store.get_master_key().to_vec().into(),
+                                  )
+                                  .await
+                                  .change_context(UserErrors::InternalServerError)?;
+                              let profile_id = state
+                                  .store
+                                  .list_profile_by_merchant_id(&state.into(), &key_store, &merchant_id)
+                                  .await
+                                  .change_context(UserErrors::InternalServerError)?
+                                  .pop()
+                                  .ok_or(UserErrors::InternalServerError)?
+                                  .get_id()
+                                  .to_owned();
+                              (org_id, merchant_id, profile_id)
+                          }
+                          _ => {
+                              let org_id = user_role
+                                  .org_id
+                                  .clone()
+                                  .ok_or(report!(UserErrors::InternalServerError))
+                                  .attach_printable("org_id not found")?;
+                              let (merchant_id, profile_id) =
+                                  utils::user_role::get_single_merchant_id_and_profile_id(state, user_role)
+                                      .await?;
+                              (org_id, merchant_id, profile_id)
+                          }

Contributor

ThisIsMani Dec 2, 2024

Try to use util function.


          fix: resolve review comments

1fc97d8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-users C-feature