org-policy.service.ts

org-policy.service.tsapps/api/src/modules/org/org-policy.service.tsraw ← org10,035 B← Back to the app
1/**
2 * TASK-0133 — org policy: admin read/write + the FIVE enforcement points.
3 *
4 * Two layers (kept separate to avoid module cycles, the same pattern as
5 * `sso/enforcement.ts`):
6 *
7 *  - The Injectable {@link OrgPolicyService} (Prisma + Redis + Audit) serves
8 *    the ADMIN endpoints (`GET/PATCH /orgs/:orgId/admin/policy`), owns the
9 *    60 s Redis cache + invalidation, and writes the `org.policy.updated`
10 *    audit (old+new of changed keys only).
11 *  - The exported FREE FUNCTIONS (take a Prisma client, no Nest DI) are the
12 *    enforcement hooks called from `auth` (2FA + session lifetime), `share`
13 *    (guest-public-share block), `files` (max-file-size cap) and the new
14 *    embed preview endpoint. They read the policy FRESH (no cache) — a
15 *    security check must never ride a 60 s stale cache (recorded decision).
16 *
17 * PLAN CAP: `maxFileSizeMB` is stored as the admin set it; the EFFECTIVE cap
18 * is `min(stored, PLAN_USAGE_LIMITS[plan].maxFileSize, LIMITS.MAX_FILE_SIZE)`
19 * (org policy ∩ plan limits) — the plan ceiling is a floor on security, so
20 * an admin can only tighten, never raise above the plan.
21 */
22import { Inject, Injectable } from "@nestjs/common";
23import type { Request } from "express";
24import type { PrismaClient } from "@prisma/client";
25import { LIMITS } from "@factory/shared";
26import { PrismaService } from "../../common/prisma.service.js";
27import { RedisService } from "../../common/redis.service.js";
28import { AuditService } from "../../common/audit.service.js";
29import { requireUser } from "../../common/types.js";
30import { assertOrgAdmin } from "./guards.js";
31import { PLAN_USAGE_LIMITS } from "../files/quota.js";
32import {
33  OrgPolicySchema,
34  parseStoredPolicy,
35  type OrgPolicy
36} from "./policy.schema.js";
37 
38const CACHE_TTL_SEC = 60;
39const cacheKey = (orgId: string) => `org:policy:${orgId}`;
40 
41/** The plan ceiling for a single-file upload (bytes). */
42export function planMaxFileBytes(billingPlan: string): number {
43  return (PLAN_USAGE_LIMITS[billingPlan] ?? PLAN_USAGE_LIMITS.free!).maxFileSize;
44}
45 
46/**
47 * Effective max single-file size (bytes) = min(stored policy MB, plan cap,
48 * hard cap). `stored` is the org policy (or null for a non-org workspace →
49 * plan cap only, preserving current behavior).
50 */
51export function effectiveMaxFileBytes(stored: OrgPolicy | null, billingPlan: string): number {
52  const storedBytes = stored?.maxFileSizeMB != null ? stored.maxFileSizeMB * 1024 * 1024 : Infinity;
53  return Math.min(storedBytes, planMaxFileBytes(billingPlan), LIMITS.MAX_FILE_SIZE);
54}
55 
56// ─────────────────────────── free resolution (enforcement) ──────────────────
57 
58type PolicyPrisma = Pick<PrismaClient, "organization" | "organizationMember" | "workspace" | "user">;
59 
60/** Fresh org policy (defaults applied). `null` org → permissive baseline. */
61export async function resolveOrgPolicy(prisma: PolicyPrisma, orgId: string): Promise<OrgPolicy> {
62  const org = await prisma.organization.findUnique({ where: { id: orgId }, select: { policy: true } });
63  return parseStoredPolicy(org?.policy);
64}
65 
66/**
67 * The policy for a WORKSPACE's org (`null` when the workspace has no org —
68 * personal workspaces are outside org policy). Used by share/upload/embed.
69 */
70export async function workspaceOrgPolicy(
71  prisma: PolicyPrisma,
72  workspaceId: string
73): Promise<{ orgId: string | null; policy: OrgPolicy | null }> {
74  const ws = await prisma.workspace.findUnique({
75    where: { id: workspaceId },
76    select: { organizationId: true }
77  });
78  if (!ws?.organizationId) return { orgId: null, policy: null };
79  return { orgId: ws.organizationId, policy: await resolveOrgPolicy(prisma, ws.organizationId) };
80}
81 
82export interface UserPolicyResolution {
83  /** True if ANY of the user's orgs requires 2FA (login gate). */
84  require2FA: boolean;
85  /** Max `sessionLifetimeHours` across the user's orgs (null = platform
86   *  refresh TTL — no org set it). "Per-user max across their orgs". */
87  sessionLifetimeHours: number | null;
88}
89 
90/**
91 * Resolve the login-relevant policy flags for a user by email (the login
92 * path has the email before the user row; mirrors `sso/enforcement.ts`).
93 * Unknown email / no orgs → permissive (normal login).
94 */
95export async function resolveUserPolicy(
96  prisma: PolicyPrisma,
97  email: string
98): Promise<UserPolicyResolution> {
99  const user = await prisma.user.findUnique({
100    where: { email: email.toLowerCase() },
101    select: { id: true, orgMemberships: { select: { organizationId: true } } }
102  });
103  if (!user || user.orgMemberships.length === 0) return { require2FA: false, sessionLifetimeHours: null };
104  const orgs = await prisma.organization.findMany({
105    where: { id: { in: user.orgMemberships.map((m) => m.organizationId) } },
106    select: { policy: true }
107  });
108  let require2FA = false;
109  let sessionLifetimeHours: number | null = null;
110  for (const o of orgs) {
111    const p = parseStoredPolicy(o.policy);
112    if (p.require2FA) require2FA = true;
113    if (p.sessionLifetimeHours != null && (sessionLifetimeHours == null || p.sessionLifetimeHours > sessionLifetimeHours)) {
114      sessionLifetimeHours = p.sessionLifetimeHours;
115    }
116  }
117  return { require2FA, sessionLifetimeHours };
118}
119 
120/**
121 * The session-lifetime clamp for a USER (by id — the session-issuance path
122 * has the user id, not the email): the MAX `sessionLifetimeHours` across the
123 * user's orgs (null = no org set it → the platform refresh TTL applies).
124 */
125export async function resolveSessionLifetimeHours(
126  prisma: PolicyPrisma,
127  userId: string
128): Promise<number | null> {
129  const memberships = await prisma.organizationMember.findMany({
130    where: { userId },
131    select: { organizationId: true }
132  });
133  if (memberships.length === 0) return null;
134  const orgs = await prisma.organization.findMany({
135    where: { id: { in: memberships.map((m) => m.organizationId) } },
136    select: { policy: true }
137  });
138  let max: number | null = null;
139  for (const o of orgs) {
140    const p = parseStoredPolicy(o.policy);
141    if (p.sessionLifetimeHours != null && (max == null || p.sessionLifetimeHours > max)) max = p.sessionLifetimeHours;
142  }
143  return max;
144}
145 
146// ─────────────────────────── admin service (cache + audit) ──────────────────
147 
148@Injectable()
149export class OrgPolicyService {
150  constructor(
151    @Inject(PrismaService) private readonly prisma: PrismaService,
152    @Inject(RedisService) private readonly redis: RedisService,
153    @Inject(AuditService) private readonly audit: AuditService
154  ) {}
155 
156  /** Invalidate the 60 s cache (called after a policy update). */
157  async invalidate(orgId: string): Promise<void> {
158    try {
159      await this.redis.getRedis().del(cacheKey(orgId));
160    } catch {
161      /* cache is best-effort — a miss just reads fresh */
162    }
163  }
164 
165  /** Cached raw policy (admin display); `fresh` bypasses the cache. */
166  async cached(orgId: string, fresh = false): Promise<OrgPolicy> {
167    if (!fresh) {
168      try {
169        const hit = await this.redis.getRedis().get(cacheKey(orgId));
170        if (hit) return OrgPolicySchema.parse(JSON.parse(hit));
171      } catch {
172        /* fall through to a fresh read */
173      }
174    }
175    const policy = await resolveOrgPolicy(this.prisma, orgId);
176    if (!fresh) {
177      this.redis
178        .getRedis()
179        .set(cacheKey(orgId), JSON.stringify(policy), "EX", CACHE_TTL_SEC)
180        .catch(() => undefined);
181    }
182    return policy;
183  }
184 
185  /** `GET /orgs/:orgId/admin/policy` — raw + effective (plan-capped). */
186  async get(orgId: string, req: Request) {
187    const userId = requireUser(req);
188    await assertOrgAdmin(this.prisma, orgId, userId);
189    const policy = await this.cached(orgId);
190    // Plan cap uses the org's PRIMARY (oldest non-personal) workspace plan —
191    // the same workspace a file upload would land in.
192    const ws = await this.prisma.workspace.findFirst({
193      where: { organizationId: orgId, isPersonal: false },
194      orderBy: { createdAt: "asc" },
195      select: { billingPlan: true }
196    });
197    const billingPlan = ws?.billingPlan ?? "free";
198    return {
199      policy,
200      effective: {
201        maxFileSizeMB: Math.floor(effectiveMaxFileBytes(policy, billingPlan) / (1024 * 1024)),
202        billingPlan
203      }
204    };
205  }
206 
207  /** `PATCH /orgs/:orgId/admin/policy` — partial merge + audit. */
208  async update(orgId: string, body: Record<string, unknown>, req: Request) {
209    const userId = requireUser(req);
210    await assertOrgAdmin(this.prisma, orgId, userId);
211    const current = await this.cached(orgId, true);
212    const stored = (
213      await this.prisma.organization.findUnique({ where: { id: orgId }, select: { policy: true } })
214    )?.policy as Record<string, unknown> | null;
215    const next = { ...(stored ?? {}) };
216 
217    // Diff (old+new of changed keys only) for the audit + the UI summary.
218    const changes: Record<string, { from: unknown; to: unknown }> = {};
219    for (const [k, v] of Object.entries(body)) {
220      const prev = current[k as keyof OrgPolicy];
221      if (JSON.stringify(prev) !== JSON.stringify(v)) changes[k] = { from: prev, to: v };
222      if (v === null) delete next[k];
223      else next[k] = v;
224    }
225 
226    await this.prisma.organization.update({
227      where: { id: orgId },
228      data: { policy: next as object }
229    });
230    await this.invalidate(orgId);
231    // Mirror `ssoEnforced` into the SSO provider (TASK-0131 invariant: the
232    // provider's `enforce` flag is the login-time source of truth).
233    if (body.ssoEnforced !== undefined) {
234      await this.prisma.ssoProvider
235        .updateMany({ where: { organizationId: orgId }, data: { enforce: Boolean(body.ssoEnforced) } })
236        .catch(() => undefined);
237    }
238    await this.audit.audit(req, req.auth, {
239      action: "org.policy.updated",
240      resourceType: "organization",
241      resourceId: orgId,
242      metadata: { changes }
243    });
244    return { policy: await this.cached(orgId, true), changes };
245  }
246}
247