From faaa26c4e8a361d4ffc252552808147def2c76e2 Mon Sep 17 00:00:00 2001
From: giancarlo <giancarlopsk@gmail.com>
Date: Mon, 29 Apr 2024 21:14:33 +0700
Subject: [PATCH] Remove account id dependencies from role management

This commit refactor the role management, removing the dependencies on account ids throughout our system. Changes include removing account id related attributes in the roles table schema and functions, modifying seed data and simplifying the role data provider code. This makes role structure more generic and simplifies the role handling process.
---
 .../home/[account]/members/page.tsx           |  1 -
 apps/web/lib/database.types.ts                | 27 +------
 .../migrations/20221215192558_schema.sql      | 81 ++-----------------
 apps/web/supabase/seed.sql                    |  4 +-
 .../database/account-permissions.test.sql     |  9 +--
 .../invitations/update-invitation-dialog.tsx  |  5 +-
 .../invite-members-dialog-container.tsx       |  7 +-
 .../members/roles-data-provider.tsx           |  4 +-
 .../members/update-member-role-dialog.tsx     |  5 +-
 packages/supabase/src/database.types.ts       | 27 +------
 10 files changed, 20 insertions(+), 150 deletions(-)

diff --git a/apps/web/app/(dashboard)/home/[account]/members/page.tsx b/apps/web/app/(dashboard)/home/[account]/members/page.tsx
index ee398a1c6..9256e6efd 100644
--- a/apps/web/app/(dashboard)/home/[account]/members/page.tsx
+++ b/apps/web/app/(dashboard)/home/[account]/members/page.tsx
@@ -78,7 +78,6 @@ async function TeamAccountMembersPage({ params }: Params) {
               <If condition={canManageInvitations && canAddMember}>
                 <InviteMembersDialogContainer
                   userRoleHierarchy={currentUserRoleHierarchy}
-                  accountId={account.id}
                   accountSlug={account.slug}
                 >
                   <Button size={'sm'} data-test={'invite-members-form-trigger'}>
diff --git a/apps/web/lib/database.types.ts b/apps/web/lib/database.types.ts
index 9fde44908..320274e2c 100644
--- a/apps/web/lib/database.types.ts
+++ b/apps/web/lib/database.types.ts
@@ -512,43 +512,18 @@ export type Database = {
       }
       roles: {
         Row: {
-          account_id: string | null
           hierarchy_level: number
           name: string
         }
         Insert: {
-          account_id?: string | null
           hierarchy_level: number
           name: string
         }
         Update: {
-          account_id?: string | null
           hierarchy_level?: number
           name?: string
         }
-        Relationships: [
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "accounts"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "user_account_workspace"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "user_accounts"
-            referencedColumns: ["id"]
-          },
-        ]
+        Relationships: []
       }
       subscription_items: {
         Row: {
diff --git a/apps/web/supabase/migrations/20221215192558_schema.sql b/apps/web/supabase/migrations/20221215192558_schema.sql
index fea6710b1..63f5d4b04 100644
--- a/apps/web/supabase/migrations/20221215192558_schema.sql
+++ b/apps/web/supabase/migrations/20221215192558_schema.sql
@@ -490,8 +490,7 @@ declare
     role varchar(50);
 begin
     select name from public.roles
-      where account_id is null and
-      hierarchy_level = 1 into role;
+      where hierarchy_level = 1 into role;
 
     return role;
 end;
@@ -568,9 +567,8 @@ create table if not exists
   public.roles (
     name varchar(50) not null,
     hierarchy_level int not null check (hierarchy_level > 0),
-    account_id uuid references public.accounts (id) on delete cascade,
-    unique (name, account_id),
-    primary key (name)
+    primary key (name),
+    unique (hierarchy_level)
   );
 
 -- Revoke all on roles table from authenticated and service_role
@@ -582,69 +580,9 @@ from
 -- Open up access to roles table for authenticated users and service_role
 grant
 select
-,
-  insert,
-  delete,
-update on table public.roles to authenticated,
+on table public.roles to authenticated,
 service_role;
 
--- define the system role uuid as a static UUID to be used as a default
--- account_id for system roles when the account_id is null. Useful for constraints.
-create
-or replace function kit.get_system_role_uuid () returns uuid
-set
-  search_path = '' as $$
-begin
-    return 'fd4f287c-762e-42b7-8207-b1252f799670';
-end; $$ language plpgsql immutable;
-
-grant
-execute on function kit.get_system_role_uuid () to authenticated,
-service_role;
-
--- we create a unique index on the roles table to ensure that the
--- can there be a unique hierarchy_level per account (or system role)
-create unique index idx_unique_hierarchy_per_account on public.roles (
-  hierarchy_level,
-  coalesce(account_id, kit.get_system_role_uuid ())
-);
-
--- we create a unique index on the roles table to ensure that the
--- can there be a unique name per account (or system role)
-create unique index idx_unique_name_per_account on public.roles (
-  name,
-  coalesce(account_id, kit.get_system_role_uuid ())
-);
-
--- Indexes on the roles table
-create index idx_roles_account_id on public.roles (account_id);
-
--- Function "kit.check_non_personal_account_roles"
--- Trigger to prevent roles from being created for personal accounts
-create
-or replace function kit.check_non_personal_account_roles () returns trigger
-set
-  search_path = '' as $$
-begin
-    if new.account_id is not null and(
-        select
-            is_personal_account
-        from
-            public.accounts
-        where
-            id = new.account_id) then
-        raise exception 'Roles cannot be created for personal accounts';
-    end if;
-
-    return new;
-end; $$ language plpgsql;
-
-create constraint trigger tr_check_non_personal_account_roles
-after insert
-or
-update on public.roles for each row
-execute procedure kit.check_non_personal_account_roles ();
-
 -- RLS
 alter table public.roles enable row level security;
 
@@ -796,12 +734,11 @@ service_role;
 
 -- RLS
 -- SELECT(roles)
--- authenticated users can query roles if the role is public or the user has a role on the account the role is for
+-- authenticated users can query roles
 create policy roles_read on public.roles for
 select
   to authenticated using (
-    account_id is null
-    or public.has_role_on_account (account_id)
+    true
   );
 
 -- Function "public.can_action_account_member"
@@ -1094,8 +1031,7 @@ begin
     from
         public.roles
     where
-        name = role_name
-        and (account_id = target_account_id or account_id is null);
+        name = role_name;
 
     -- If the target role does not exist, the user cannot perform the action
     if target_role_hierarchy_level is null then
@@ -1171,8 +1107,7 @@ begin
     from
         public.roles
     where
-        name = role_name
-        and (account_id = target_account_id or account_id is null);
+        name = role_name;
 
     -- If the target role does not exist, the user cannot perform the action
     if target_role_hierarchy_level is null then
diff --git a/apps/web/supabase/seed.sql b/apps/web/supabase/seed.sql
index 455e02a82..4aa86f0e4 100644
--- a/apps/web/supabase/seed.sql
+++ b/apps/web/supabase/seed.sql
@@ -141,8 +141,8 @@ INSERT INTO "public"."accounts" ("id", "primary_owner_user_id", "name", "slug",
 -- Data for Name: roles; Type: TABLE DATA; Schema: public; Owner: postgres
 --
 
-INSERT INTO "public"."roles" ("name", "hierarchy_level", "account_id") VALUES
-        ('custom-role', 4, '5deaa894-2094-4da3-b4fd-1fada0809d1c');
+INSERT INTO "public"."roles" ("name", "hierarchy_level") VALUES
+        ('custom-role', 4);
 
 --
 -- Data for Name: accounts_memberships; Type: TABLE DATA; Schema: public; Owner: postgres
diff --git a/apps/web/supabase/tests/database/account-permissions.test.sql b/apps/web/supabase/tests/database/account-permissions.test.sql
index 605abade6..3cb766a5a 100644
--- a/apps/web/supabase/tests/database/account-permissions.test.sql
+++ b/apps/web/supabase/tests/database/account-permissions.test.sql
@@ -45,7 +45,7 @@ select row_eq(
 -- Custom roles
 -- New roles created for the app
 
-set local role service_role;
+set local role postgres;
 
 -- the name should be unique
 
@@ -57,17 +57,16 @@ select throws_ok(
 -- the hierarchy level should be unique
 select throws_ok(
   $$ insert into public.roles (name, hierarchy_level) values ('custom-role-2', 1) $$,
-  'duplicate key value violates unique constraint "idx_unique_hierarchy_per_account"'
+  'duplicate key value violates unique constraint "roles_hierarchy_level_key"'
 );
 
 -- Custom Account Role
--- Roles created specifically for the account
 
-set local role service_role;
+set local role postgres;
 
 -- the names should be unique
 select throws_ok(
-  $$ insert into public.roles (name, hierarchy_level, account_id) values ('owner', 1, makerkit.get_account_id_by_slug('test')) $$,
+  $$ insert into public.roles (name, hierarchy_level) values ('owner', 1) $$,
   'duplicate key value violates unique constraint "roles_pkey"'
 );
 
diff --git a/packages/features/team-accounts/src/components/invitations/update-invitation-dialog.tsx b/packages/features/team-accounts/src/components/invitations/update-invitation-dialog.tsx
index f2a43c4f6..e3f953c50 100644
--- a/packages/features/team-accounts/src/components/invitations/update-invitation-dialog.tsx
+++ b/packages/features/team-accounts/src/components/invitations/update-invitation-dialog.tsx
@@ -144,10 +144,7 @@ function UpdateInvitationForm({
                 </FormLabel>
 
                 <FormControl>
-                  <RolesDataProvider
-                    accountId={account}
-                    maxRoleHierarchy={userRoleHierarchy}
-                  >
+                  <RolesDataProvider maxRoleHierarchy={userRoleHierarchy}>
                     {(roles) => (
                       <MembershipRoleSelector
                         roles={roles}
diff --git a/packages/features/team-accounts/src/components/members/invite-members-dialog-container.tsx b/packages/features/team-accounts/src/components/members/invite-members-dialog-container.tsx
index a57b9ed61..3efbf1730 100644
--- a/packages/features/team-accounts/src/components/members/invite-members-dialog-container.tsx
+++ b/packages/features/team-accounts/src/components/members/invite-members-dialog-container.tsx
@@ -52,12 +52,10 @@ const MAX_INVITES = 5;
 
 export function InviteMembersDialogContainer({
   accountSlug,
-  accountId,
   userRoleHierarchy,
   children,
 }: React.PropsWithChildren<{
   accountSlug: string;
-  accountId: string;
   userRoleHierarchy: number;
 }>) {
   const [pending, startTransition] = useTransition();
@@ -79,10 +77,7 @@ export function InviteMembersDialogContainer({
           </DialogDescription>
         </DialogHeader>
 
-        <RolesDataProvider
-          accountId={accountId}
-          maxRoleHierarchy={userRoleHierarchy}
-        >
+        <RolesDataProvider maxRoleHierarchy={userRoleHierarchy}>
           {(roles) => (
             <InviteMembersForm
               pending={pending}
diff --git a/packages/features/team-accounts/src/components/members/roles-data-provider.tsx b/packages/features/team-accounts/src/components/members/roles-data-provider.tsx
index bcd8063a4..1075e5b4b 100644
--- a/packages/features/team-accounts/src/components/members/roles-data-provider.tsx
+++ b/packages/features/team-accounts/src/components/members/roles-data-provider.tsx
@@ -5,7 +5,6 @@ import { LoadingOverlay } from '@kit/ui/loading-overlay';
 
 export function RolesDataProvider(props: {
   maxRoleHierarchy: number;
-  accountId: string;
   children: (roles: string[]) => React.ReactNode;
 }) {
   const rolesQuery = useFetchRoles(props);
@@ -21,7 +20,7 @@ export function RolesDataProvider(props: {
   return <>{props.children(rolesQuery.data ?? [])}</>;
 }
 
-function useFetchRoles(props: { maxRoleHierarchy: number; accountId: string }) {
+function useFetchRoles(props: { maxRoleHierarchy: number }) {
   const supabase = useSupabase();
 
   return useQuery({
@@ -31,7 +30,6 @@ function useFetchRoles(props: { maxRoleHierarchy: number; accountId: string }) {
         .from('roles')
         .select('name')
         .gte('hierarchy_level', props.maxRoleHierarchy)
-        .or(`account_id.eq.${props.accountId}, account_id.is.null`)
         .order('hierarchy_level', { ascending: true });
 
       if (error) {
diff --git a/packages/features/team-accounts/src/components/members/update-member-role-dialog.tsx b/packages/features/team-accounts/src/components/members/update-member-role-dialog.tsx
index 5df3ca6b0..ffac333dc 100644
--- a/packages/features/team-accounts/src/components/members/update-member-role-dialog.tsx
+++ b/packages/features/team-accounts/src/components/members/update-member-role-dialog.tsx
@@ -60,10 +60,7 @@ export const UpdateMemberRoleDialog: React.FC<{
           </DialogDescription>
         </DialogHeader>
 
-        <RolesDataProvider
-          accountId={teamAccountId}
-          maxRoleHierarchy={userRoleHierarchy}
-        >
+        <RolesDataProvider maxRoleHierarchy={userRoleHierarchy}>
           {(data) => (
             <UpdateMemberForm
               setIsOpen={setIsOpen}
diff --git a/packages/supabase/src/database.types.ts b/packages/supabase/src/database.types.ts
index 9fde44908..320274e2c 100644
--- a/packages/supabase/src/database.types.ts
+++ b/packages/supabase/src/database.types.ts
@@ -512,43 +512,18 @@ export type Database = {
       }
       roles: {
         Row: {
-          account_id: string | null
           hierarchy_level: number
           name: string
         }
         Insert: {
-          account_id?: string | null
           hierarchy_level: number
           name: string
         }
         Update: {
-          account_id?: string | null
           hierarchy_level?: number
           name?: string
         }
-        Relationships: [
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "accounts"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "user_account_workspace"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "roles_account_id_fkey"
-            columns: ["account_id"]
-            isOneToOne: false
-            referencedRelation: "user_accounts"
-            referencedColumns: ["id"]
-          },
-        ]
+        Relationships: []
       }
       subscription_items: {
         Row: {