feat(users): add support for tenant level users #6708

apoorvdixit88 · 2024-12-01T21:16:10Z

Type of Change

Description

Add api to create tenant users
Add api to create orgs
Support tenant level entity for the user hierarchy

Additional Changes

This PR modifies the API contract
This PR modifies the database schema
This PR modifies application configuration/environment variables

Motivation and Context

Closes #6707

How did you test it?

Api for create tenant:

curl --location 'http://localhost:8080/user/tenant_signup' \
--header 'api-key: test_admin' \
--header 'Content-Type: application/json' \
--header 'x-tenant-id: test' \
--header 'Cookie: login_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNTJhMmViYzItOWZiZS00MDI0LThjODEtOWYwMzMyZTJlZDMxIiwicHVycG9zZSI6InRvdHAiLCJvcmlnaW4iOiJzaWduX3VwIiwicGF0aCI6W10sImV4cCI6MTczMzMwOTI2NSwidGVuYW50X2lkIjoicHVibGljIn0.3B918rdY_XM0dRH4yx9O7Nujd3FbLdmKUmBY52KVKAo' \
--data-raw '{
    "name" : "tf2",
    "email" : "[email protected]",
    "password": "Pass@321"
}'

Response: 200 Ok, if tenant_admin got created successfully
A tenant can login with email and password and continue with 2FA, he will land into any one of organization existing for tenant.

Create Org Api, (works for tenant users only)

curl --location 'http://localhost:8080/user/create_org' \
--header 'x-tenant-id: test' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer JWT' \
--header 'Cookie: Cookie' \
--data '{
    "organization_name": "ten",
    "merchant_name": "pp_ten"
}'

Response will be 200 OK if the org got created success fully (1 org with 1 merchant and 1 profile)

After getting the login token tenant admin can switch to any org in the tenancy.

Checklist

I formatted the code cargo +nightly fmt --all
I addressed lints thrown by cargo clippy
I reviewed the submitted code
I added unit tests for my changes where possible

semanticdiff-com · 2024-12-01T21:16:12Z

Review changes with

Changed Files

File	Status
crates/api_models/src/events/user.rs	71% smaller
crates/router/src/core/user.rs	37% smaller
crates/router/src/routes/lock_utils.rs	37% smaller
crates/router/src/types/domain/user/decision_manager.rs	24% smaller
crates/router/src/utils/user_role.rs	15% smaller
crates/router/src/routes/app.rs	15% smaller
crates/router/src/core/user_role/role.rs	5% smaller
crates/router/src/services/authorization/roles/predefined_roles.rs	4% smaller
crates/router/src/types/domain/user.rs	2% smaller
crates/router/src/core/user_role.rs	1% smaller
crates/api_models/src/user.rs	0% smaller
crates/common_enums/src/enums.rs	0% smaller
crates/common_utils/src/consts.rs	0% smaller
crates/diesel_models/src/query/merchant_account.rs	0% smaller
crates/router/src/analytics.rs	0% smaller
crates/router/src/consts/user.rs	0% smaller
crates/router/src/db/kafka_store.rs	0% smaller
crates/router/src/db/merchant_account.rs	0% smaller
crates/router/src/routes/user.rs	0% smaller
crates/router/src/services/authorization/permissions.rs	0% smaller
crates/router/src/utils/user.rs	0% smaller
crates/router_env/src/logger/types.rs	0% smaller

crates/router/src/core/user.rs

ThisIsMani · 2024-12-02T12:04:16Z

crates/router/src/core/user_role.rs

+                EntityType::Tenant => {
+                    return Err(UserErrors::InvalidRoleOperationWithMessage(
+                        "Tenant roles are not allowed for this operation".to_string(),
+                    )
+                    .into());
+                }


Should we throw error here? Is dashboard handling this?

The query above it will fetch 0 user_roles for entity type tenant where status is invitation_sent, so we should throw error here instead of sending empty vector, if we have such user role.

status should be 500

crates/diesel_models/src/query/merchant_account.rs

crates/router/src/services/authorization/roles/predefined_roles.rs

crates/router/src/types/transformers.rs

crates/router/src/types/domain/user/decision_manager.rs

crates/diesel_models/src/query/merchant_account.rs

crates/router/src/types/domain/user/decision_manager.rs

racnan · 2024-12-03T12:55:20Z

crates/api_models/src/user.rs

+    pub organization_name: String,
+    pub organization_details: Option<pii::SecretSerdeValue>,
+    pub metadata: Option<pii::SecretSerdeValue>,
+    pub merchant_name: String,


this can be a secret.

racnan · 2024-12-03T13:02:56Z

crates/router/src/core/user_role.rs

+                EntityType::Tenant => {
+                    return Err(UserErrors::InvalidRoleOperationWithMessage(
+                        "Tenant roles are not allowed for this operation".to_string(),
+                    )
+                    .into());
+                }


status should be 500

racnan · 2024-12-03T13:15:56Z

crates/router/src/routes/app.rs

@@ -1869,6 +1869,10 @@ impl User {
            .service(
                web::resource("/internal_signup").route(web::post().to(user::internal_user_signup)),
            )
+            .service(
+                web::resource("/create_tenant").route(web::post().to(user::create_tenant_user)),


create_merchant -> creates merchant account
create_org -> creates org account
create_tenant -> creates user ??

racnan · 2024-12-03T13:25:25Z

crates/router/src/types/domain/user/decision_manager.rs

@@ -124,18 +124,34 @@ impl JWTFlow {
        next_flow: &NextFlow,
        user_role: &UserRole,
    ) -> UserResult<Secret<String>> {
-        let (merchant_id, profile_id) =
-            utils::user_role::get_single_merchant_id_and_profile_id(state, user_role).await?;
+        let (org_id, merchant_id, profile_id) = match user_role.entity_type {


can be simplified.

racnan · 2024-12-03T13:34:31Z

crates/router/src/core/user.rs

+    let key_store = state
+        .store
+        .get_merchant_key_store_by_merchant_id(
+            key_manager_state,
+            &merchant_id,
+            &state.store.get_master_key().to_vec().into(),
+        )
+        .await
+        .change_context(UserErrors::InternalServerError)
+        .attach_printable("Error while fetching the key store by merchant_id")?;
+
+    let merchant_account = state
+        .store
+        .find_merchant_account_by_merchant_id(key_manager_state, &merchant_id, &key_store)
+        .await
+        .change_context(UserErrors::InternalServerError)
+        .attach_printable("Error while fetching the merchant_account by merchant_id")?;


this can be skipped is below function only requires merchant id and org id and not the whole merchant account.

crates/api_models/src/user.rs

crates/router/src/utils/user.rs

feat(users): add support for tenant level users

d539dbd

apoorvdixit88 added C-feature Category: Feature request or enhancement A-users Area: Users labels Dec 1, 2024

apoorvdixit88 self-assigned this Dec 1, 2024

apoorvdixit88 requested review from a team as code owners December 1, 2024 21:16

hyperswitch-bot bot and others added 6 commits December 1, 2024 21:16

chore: run formatter

8a56ce5

fix: address failing checks

3ebd47e

Merge branch 'main' into tenant-entity-and-apis

a0300e5

Merge branch 'main' into tenant-entity-and-apis

40a5e96

fix: v2 check for req create

e2ab37b

fix: token changes

2d7abe3

ThisIsMani reviewed Dec 2, 2024

View reviewed changes

apoorvdixit88 and others added 3 commits December 3, 2024 04:42

fix: resolve review comments

1fc97d8

refactor: cover nitpicks

e1af16e

chore: run formatter

834dfce

ThisIsMani reviewed Dec 3, 2024

View reviewed changes

crates/diesel_models/src/query/merchant_account.rs Outdated Show resolved Hide resolved

ThisIsMani reviewed Dec 3, 2024

View reviewed changes

crates/router/src/types/domain/user/decision_manager.rs Outdated Show resolved Hide resolved

racnan reviewed Dec 3, 2024

View reviewed changes

fix: resolve review comments iter 2

e83452c

ThisIsMani previously approved these changes Dec 4, 2024

View reviewed changes

crates/api_models/src/user.rs Outdated Show resolved Hide resolved

crates/router/src/utils/user.rs Outdated Show resolved Hide resolved

crates/router/src/utils/user.rs Outdated Show resolved Hide resolved

fix: cover nitpicks

ad79f35

apoorvdixit88 dismissed ThisIsMani’s stale review via ad79f35 December 4, 2024 08:45

racnan approved these changes Dec 4, 2024

View reviewed changes

ThisIsMani approved these changes Dec 4, 2024

View reviewed changes

tsdk02 approved these changes Dec 4, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(users): add support for tenant level users #6708

feat(users): add support for tenant level users #6708

apoorvdixit88 commented Dec 1, 2024 •

edited

Loading

semanticdiff-com bot commented Dec 1, 2024 •

edited

Loading

ThisIsMani Dec 2, 2024

apoorvdixit88 Dec 2, 2024

racnan Dec 3, 2024

racnan Dec 3, 2024

racnan Dec 3, 2024

racnan Dec 3, 2024

racnan Dec 3, 2024

racnan Dec 3, 2024

feat(users): add support for tenant level users #6708

Are you sure you want to change the base?

feat(users): add support for tenant level users #6708

Conversation

apoorvdixit88 commented Dec 1, 2024 • edited Loading

Type of Change

Description

Additional Changes

Motivation and Context

How did you test it?

Checklist

semanticdiff-com bot commented Dec 1, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apoorvdixit88 commented Dec 1, 2024 •

edited

Loading

semanticdiff-com bot commented Dec 1, 2024 •

edited

Loading