diff --git a/packages/nc-gui/lib/acl.ts b/packages/nc-gui/lib/acl.ts
index 8835b2f4c5..fe25967890 100644
--- a/packages/nc-gui/lib/acl.ts
+++ b/packages/nc-gui/lib/acl.ts
@@ -72,7 +72,6 @@ const rolePermissions = {
jsonImport: true,
excelImport: true,
settingsPage: true,
- newUser: true,
webhook: true,
fieldEdit: true,
fieldAlter: true,
@@ -119,6 +118,7 @@ const rolePermissions = {
commentList: true,
commentCount: true,
auditListRow: true,
+ newUser: true,
},
},
[ProjectRoles.NO_ACCESS]: {
diff --git a/packages/nc-gui/store/bases.ts b/packages/nc-gui/store/bases.ts
index 4345160bb1..73948a467a 100644
--- a/packages/nc-gui/store/bases.ts
+++ b/packages/nc-gui/store/bases.ts
@@ -7,6 +7,10 @@ import { isString } from '@vue/shared'
export const useBases = defineStore('basesStore', () => {
const { $api } = useNuxtApp()
+ const { user: currentUser } = useGlobal()
+
+ const { loadRoles } = useRoles()
+
const { isUIAllowed } = useRoles()
const bases = ref>(new Map())
@@ -89,6 +93,13 @@ export const useBases = defineStore('basesStore', () => {
const updateProjectUser = async (baseId: string, user: User) => {
await api.auth.baseUserUpdate(baseId, user.id, user as ProjectUserReqType)
+
+ // reload roles if updating roles of current user
+ if (user.id === currentUser.value?.id) {
+ loadRoles(baseId).catch(() => {
+ // ignore
+ })
+ }
}
const removeProjectUser = async (baseId: string, user: User) => {
diff --git a/packages/nocodb-sdk/src/lib/enums.ts b/packages/nocodb-sdk/src/lib/enums.ts
index 89ea771ee1..8e5c0a9a5b 100644
--- a/packages/nocodb-sdk/src/lib/enums.ts
+++ b/packages/nocodb-sdk/src/lib/enums.ts
@@ -22,9 +22,9 @@ export enum ProjectRoles {
export enum WorkspaceUserRoles {
OWNER = 'workspace-level-owner',
CREATOR = 'workspace-level-creator',
- VIEWER = 'workspace-level-viewer',
EDITOR = 'workspace-level-editor',
COMMENTER = 'workspace-level-commenter',
+ VIEWER = 'workspace-level-viewer',
NO_ACCESS = 'workspace-level-no-access',
}
diff --git a/packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts b/packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts
index 9dc9587e1f..8acca8cfe8 100644
--- a/packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts
+++ b/packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts
@@ -45,6 +45,7 @@ import * as nc_055_junction_pk from '~/meta/migrations/v2/nc_055_junction_pk';
import * as nc_056_integration from '~/meta/migrations/v2/nc_056_integration';
import * as nc_057_file_references from '~/meta/migrations/v2/nc_057_file_references';
import * as nc_058_button_colum from '~/meta/migrations/v2/nc_058_button_colum';
+import * as nc_059_invited_by from '~/meta/migrations/v2/nc_059_invited_by';
// Create a custom migration source class
export default class XcMigrationSourcev2 {
@@ -101,6 +102,7 @@ export default class XcMigrationSourcev2 {
'nc_056_integration',
'nc_057_file_references',
'nc_058_button_colum',
+ 'nc_059_invited_by',
]);
}
@@ -204,6 +206,8 @@ export default class XcMigrationSourcev2 {
return nc_057_file_references;
case 'nc_058_button_colum':
return nc_058_button_colum;
+ case 'nc_059_invited_by':
+ return nc_059_invited_by;
}
}
}
diff --git a/packages/nocodb/src/meta/migrations/v2/nc_059_invited_by.ts b/packages/nocodb/src/meta/migrations/v2/nc_059_invited_by.ts
new file mode 100644
index 0000000000..1320de4e9b
--- /dev/null
+++ b/packages/nocodb/src/meta/migrations/v2/nc_059_invited_by.ts
@@ -0,0 +1,16 @@
+import type { Knex } from 'knex';
+import { MetaTable } from '~/utils/globals';
+
+const up = async (knex: Knex) => {
+ await knex.schema.alterTable(MetaTable.PROJECT_USERS, (table) => {
+ table.string('invited_by', 20).index();
+ });
+};
+
+const down = async (knex: Knex) => {
+ await knex.schema.alterTable(MetaTable.PROJECT_USERS, (table) => {
+ table.dropColumn('invited_by');
+ });
+};
+
+export { up, down };
diff --git a/packages/nocodb/src/models/BaseUser.ts b/packages/nocodb/src/models/BaseUser.ts
index 762be4aee6..61fce6220d 100644
--- a/packages/nocodb/src/models/BaseUser.ts
+++ b/packages/nocodb/src/models/BaseUser.ts
@@ -20,6 +20,7 @@ export default class BaseUser {
base_id: string;
fk_user_id: string;
roles?: string;
+ invited_by?: string;
constructor(data: BaseUser) {
Object.assign(this, data);
@@ -35,7 +36,7 @@ export default class BaseUser {
ncMeta = Noco.ncMeta,
) {
const insertObj = baseUsers.map((baseUser) =>
- extractProps(baseUser, ['fk_user_id', 'base_id', 'roles']),
+ extractProps(baseUser, ['fk_user_id', 'base_id', 'roles', 'invited_by']),
);
if (!insertObj.length) {
@@ -84,6 +85,7 @@ export default class BaseUser {
'fk_user_id',
'base_id',
'roles',
+ 'invited_by',
]);
const { base_id, fk_user_id } = await ncMeta.metaInsert2(
@@ -179,13 +181,7 @@ export default class BaseUser {
let { list: baseUsers } = cachedList;
const { isNoneList } = cachedList;
- const fullVersionCols = [
- 'invite_token',
- 'main_roles',
- 'created_at',
- 'base_id',
- 'roles',
- ];
+ const fullVersionCols = ['invite_token', 'created_at'];
if (!isNoneList && !baseUsers.length) {
const queryBuilder = ncMeta
@@ -479,6 +475,7 @@ export default class BaseUser {
return await this.insert(context, {
base_id: baseId,
fk_user_id: userId,
+ invited_by: baseUser.invited_by,
});
}
}
diff --git a/packages/nocodb/src/models/Integration.ts b/packages/nocodb/src/models/Integration.ts
index 74e8257fd9..bf36c7b379 100644
--- a/packages/nocodb/src/models/Integration.ts
+++ b/packages/nocodb/src/models/Integration.ts
@@ -2,7 +2,6 @@ import CryptoJS from 'crypto-js';
import type { IntegrationsType, SourceType } from 'nocodb-sdk';
import type { BoolType, IntegrationType } from 'nocodb-sdk';
import type { NcContext } from '~/interface/config';
-import type { Condition } from '~/db/CustomKnex';
import { MetaTable, RootScopes } from '~/utils/globals';
import Noco from '~/Noco';
import { extractProps } from '~/helpers/extractProps';
diff --git a/packages/nocodb/src/models/PresignedUrl.ts b/packages/nocodb/src/models/PresignedUrl.ts
index 08aec8b752..65db77d78d 100644
--- a/packages/nocodb/src/models/PresignedUrl.ts
+++ b/packages/nocodb/src/models/PresignedUrl.ts
@@ -4,7 +4,7 @@ import NcPluginMgrv2 from '~/helpers/NcPluginMgrv2';
import Noco from '~/Noco';
import NocoCache from '~/cache/NocoCache';
import { CacheGetType, CacheScope } from '~/utils/globals';
-import { isPreviewAllowed, getPathFromUrl } from '~/helpers/attachmentHelpers';
+import { getPathFromUrl, isPreviewAllowed } from '~/helpers/attachmentHelpers';
function roundExpiry(date) {
const msInHour = 10 * 60 * 1000;
diff --git a/packages/nocodb/src/services/app-hooks/app-hooks.service.ts b/packages/nocodb/src/services/app-hooks/app-hooks.service.ts
index 99e5284db8..d41cf6438f 100644
--- a/packages/nocodb/src/services/app-hooks/app-hooks.service.ts
+++ b/packages/nocodb/src/services/app-hooks/app-hooks.service.ts
@@ -37,7 +37,6 @@ import type {
ViewColumnEvent,
ViewEvent,
WebhookEvent,
- WebhookTriggerEvent,
WelcomeEvent,
} from '~/services/app-hooks/interfaces';
import type { IntegrationEvent } from '~/services/app-hooks/interfaces';
diff --git a/packages/nocodb/src/services/base-users/base-users.service.ts b/packages/nocodb/src/services/base-users/base-users.service.ts
index a873e46e7f..35e7c8bece 100644
--- a/packages/nocodb/src/services/base-users/base-users.service.ts
+++ b/packages/nocodb/src/services/base-users/base-users.service.ts
@@ -65,6 +65,7 @@ export class BaseUsersService {
if (
![
+ ProjectRoles.OWNER,
ProjectRoles.CREATOR,
ProjectRoles.EDITOR,
ProjectRoles.COMMENTER,
@@ -122,6 +123,7 @@ export class BaseUsersService {
base_id: param.baseId,
fk_user_id: user.id,
roles: param.baseUser.roles || 'editor',
+ invited_by: param.req?.user?.id,
});
this.appHooksService.emit(AppEvents.PROJECT_INVITE, {
@@ -147,6 +149,7 @@ export class BaseUsersService {
base_id: param.baseId,
fk_user_id: user.id,
roles: param.baseUser.roles,
+ invited_by: param.req?.user?.id,
});
this.appHooksService.emit(AppEvents.PROJECT_INVITE, {
@@ -213,12 +216,9 @@ export class BaseUsersService {
return NcError.baseNotFound(param.baseId);
}
- if (param.baseUser.roles.includes(ProjectRoles.OWNER)) {
- NcError.badRequest('Owner cannot be updated');
- }
-
if (
![
+ ProjectRoles.OWNER,
ProjectRoles.CREATOR,
ProjectRoles.EDITOR,
ProjectRoles.COMMENTER,
@@ -246,9 +246,19 @@ export class BaseUsersService {
);
}
- if (
- getProjectRolePower(targetUser) >= getProjectRolePower(param.req.user)
- ) {
+ // if old role is owner and there is only one owner then restrict to update
+ if (extractRolesObj(targetUser.base_roles)?.[ProjectRoles.OWNER]) {
+ const baseUsers = await BaseUser.getUsersList(context, {
+ base_id: param.baseId,
+ });
+ if (
+ baseUsers.filter((u) => u.roles?.includes(ProjectRoles.OWNER))
+ .length === 1
+ )
+ NcError.badRequest('At least one owner is required');
+ }
+
+ if (getProjectRolePower(targetUser) > getProjectRolePower(param.req.user)) {
NcError.badRequest(`Insufficient privilege to update user`);
}
@@ -288,16 +298,49 @@ export class BaseUsersService {
NcError.badRequest("Admin can't delete themselves!");
}
+ const user = await User.get(param.userId);
+
+ if (!user) {
+ NcError.userNotFound(param.userId);
+ }
+
if (!param.req.user?.base_roles?.owner) {
- const user = await User.get(param.userId);
if (user.roles?.split(',').includes('super'))
NcError.forbidden(
'Insufficient privilege to delete a super admin user.',
);
+ }
- const baseUser = await BaseUser.get(context, base_id, param.userId);
- if (baseUser?.roles?.split(',').includes('owner'))
- NcError.forbidden('Insufficient privilege to delete a owner user.');
+ const baseUser = await User.getWithRoles(context, param.userId, {
+ baseId: base_id,
+ });
+
+ // check if user have access to delete user based on role power
+ if (
+ getProjectRolePower(baseUser.base_roles) >
+ getProjectRolePower(param.req.user)
+ ) {
+ NcError.badRequest('Insufficient privilege to delete user');
+ }
+
+ // if old role is owner and there is only one owner then restrict to delete
+ if (extractRolesObj(baseUser.base_roles)?.[ProjectRoles.OWNER]) {
+ const baseUsers = await BaseUser.getUsersList(context, {
+ base_id: param.baseId,
+ });
+ if (
+ baseUsers.filter((u) => u.roles?.includes(ProjectRoles.OWNER))
+ .length === 1
+ )
+ NcError.badRequest('At least one owner is required');
+ }
+
+ // block self delete if user is owner or super
+ if (
+ param.req.user.id === param.userId &&
+ param.req.user.roles.includes('owner')
+ ) {
+ NcError.badRequest("Admin can't delete themselves!");
}
await BaseUser.delete(context, base_id, param.userId);
diff --git a/packages/nocodb/src/services/integrations.service.ts b/packages/nocodb/src/services/integrations.service.ts
index 8c3a1daa90..84bce74f64 100644
--- a/packages/nocodb/src/services/integrations.service.ts
+++ b/packages/nocodb/src/services/integrations.service.ts
@@ -5,7 +5,7 @@ import type { NcContext, NcRequest } from '~/interface/config';
import { AppHooksService } from '~/services/app-hooks/app-hooks.service';
import { validatePayload } from '~/helpers';
import { Base, Integration } from '~/models';
-import { NcBaseError, NcError } from '~/helpers/catchError'
+import { NcBaseError, NcError } from '~/helpers/catchError';
import { Source } from '~/models';
import { CacheScope, MetaTable, RootScopes } from '~/utils/globals';
import Noco from '~/Noco';
diff --git a/tests/playwright/pages/Dashboard/ProjectView/index.ts b/tests/playwright/pages/Dashboard/ProjectView/index.ts
index bff160c808..26caa2671c 100644
--- a/tests/playwright/pages/Dashboard/ProjectView/index.ts
+++ b/tests/playwright/pages/Dashboard/ProjectView/index.ts
@@ -55,9 +55,9 @@ export class ProjectViewPage extends BasePage {
if (role.toLowerCase() === 'creator' || role.toLowerCase() === 'owner') {
await this.tab_accessSettings.waitFor({ state: 'visible' });
- expect(await this.tab_accessSettings.isVisible()).toBeTruthy();
+ expect(await this.tab_dataSources.isVisible()).toBeTruthy();
} else {
- expect(await this.tab_accessSettings.isVisible()).toBeFalsy();
+ expect(await this.tab_dataSources.isVisible()).toBeFalsy();
}
await this.tables.verifyAccess(role);