Merge pull request #5770 from nocodb/fix/revoked-user-permission

fix: revoked user permission

packages/nc-gui/pages/index/index/index.vue

@@ -308,6 +308,7 @@ const copyProjectMeta = async () => {
           <div v-if="record.status !== ProjectStatus.JOB" class="flex items-center gap-2">
             <component
               :is="iconMap.edit"
+              v-if="isUIAllowed('projectUpdate', true)"
               v-e="['c:project:edit:rename']"
               class="nc-action-btn"
               @click.stop="navigateTo(`/${text}`)"
@@ -315,12 +316,18 @@ const copyProjectMeta = async () => {
 
             <component
               :is="iconMap.delete"
+              v-if="isUIAllowed('projectDelete', true)"
               class="nc-action-btn"
               :data-testid="`delete-project-${record.title}`"
               @click.stop="deleteProject(record)"
             />
 
-            <a-dropdown :trigger="['click']" overlay-class-name="nc-dropdown-import-menu" @click.stop>
+            <a-dropdown
+              v-if="isUIAllowed('duplicateProject', true)"
+              :trigger="['click']"
+              overlay-class-name="nc-dropdown-import-menu"
+              @click.stop
+            >
               <GeneralIcon
                 icon="threeDotVertical"
                 class="nc-import-menu outline-0"

packages/nocodb/src/cache/RedisCacheMgr.ts

@@ -135,7 +135,7 @@ export default class RedisCacheMgr extends CacheMgr {
     // e.g. arr = ["nc:<orgs>:<scope>:<model_id_1>", "nc:<orgs>:<scope>:<model_id_2>"]
     const arr = (await this.get(key, CacheGetType.TYPE_ARRAY)) || [];
     log(`RedisCacheMgr::getList: getting list with key ${key}`);
-    const isNoneList = arr.length && arr[0] === 'NONE';
+    const isNoneList = arr.length && arr.includes('NONE');
 
     if (isNoneList) {
       return Promise.resolve({
@@ -248,7 +248,7 @@ export default class RedisCacheMgr extends CacheMgr {
         : `${this.prefix}:${scope}:${subListKeys.join(':')}:list`;
     log(`RedisCacheMgr::appendToList: append key ${key} to ${listKey}`);
     let list = (await this.get(listKey, CacheGetType.TYPE_ARRAY)) || [];
-    if (list.length && list[0] === 'NONE') {
+    if (list.length && list.includes('NONE')) {
       list = [];
       await this.del(listKey);
     }

packages/nocodb/src/controllers/projects.controller.ts

@@ -11,15 +11,13 @@ import {
   Request,
   UseGuards,
 } from '@nestjs/common';
-import { AuthGuard } from '@nestjs/passport';
 import isDocker from 'is-docker';
 import { ProjectReqType } from 'nocodb-sdk';
 import { GlobalGuard } from '../guards/global/global.guard';
 import { PagedResponseImpl } from '../helpers/PagedResponse';
 import {
   ExtractProjectIdMiddleware,
-  UseAclMiddleware,
-  UseProjectIdMiddleware,
+  Acl,
 } from '../middlewares/extract-project-id/extract-project-id.middleware';
 import Noco from '../Noco';
 import { packageVersion } from '../utils/packageVersion';
@@ -31,9 +29,7 @@ import type { ProjectType } from 'nocodb-sdk';
 export class ProjectsController {
   constructor(private readonly projectsService: ProjectsService) {}
 
-  @UseAclMiddleware({
-    permissionName: 'projectList',
-  })
+  @Acl('projectList')
   @Get('/api/v1/db/meta/projects/')
   async list(@Query() queryParams: Record<string, any>, @Request() req) {
     const projects = await this.projectsService.projectList({
@@ -57,7 +53,7 @@ export class ProjectsController {
       PackageVersion: packageVersion,
     };
   }
-
+  @Acl('projectGet')
   @Get('/api/v1/db/meta/projects/:projectId')
   async projectGet(@Param('projectId') projectId: string) {
     const project = await this.projectsService.getProjectWithInfo({
@@ -68,7 +64,7 @@ export class ProjectsController {
 
     return project;
   }
-
+  @Acl('projectUpdate')
   @Patch('/api/v1/db/meta/projects/:projectId')
   async projectUpdate(
     @Param('projectId') projectId: string,
@@ -82,6 +78,7 @@ export class ProjectsController {
     return project;
   }
 
+  @Acl('projectDelete')
   @Delete('/api/v1/db/meta/projects/:projectId')
   async projectDelete(@Param('projectId') projectId: string) {
     const deleted = await this.projectsService.projectSoftDelete({
@@ -91,6 +88,7 @@ export class ProjectsController {
     return deleted;
   }
 
+  @Acl('projectCreate')
   @Post('/api/v1/db/meta/projects')
   @HttpCode(200)
   async projectCreate(@Body() projectBody: ProjectReqType, @Request() req) {
@@ -102,66 +100,3 @@ export class ProjectsController {
     return project;
   }
 }
-
-/*
-// // Project CRUD
-
-
-
-export async function projectCost(req, res) {
-  let cost = 0;
-  const project = await Project.getWithInfo(req.params.projectId);
-
-  for (const base of project.bases) {
-    const sqlClient = await NcConnectionMgrv2.getSqlClient(base);
-    const userCount = await ProjectUser.getUsersCount(req.query);
-    const recordCount = (await sqlClient.totalRecords())?.data.TotalRecords;
-
-    if (recordCount > 100000) {
-      // 36,000 or $79/user/month
-      cost = Math.max(36000, 948 * userCount);
-    } else if (recordCount > 50000) {
-      // $36,000 or $50/user/month
-      cost = Math.max(36000, 600 * userCount);
-    } else if (recordCount > 10000) {
-      // $240/user/yr
-      cost = Math.min(240 * userCount, 36000);
-    } else if (recordCount > 1000) {
-      // $120/user/yr
-      cost = Math.min(120 * userCount, 36000);
-    }
-  }
-
-  T.event({
-    event: 'a:project:cost',
-    data: {
-      cost,
-    },
-  });
-
-  res.json({ cost });
-}
-
-export async function hasEmptyOrNullFilters(req, res) {
-  res.json(await Filter.hasEmptyOrNullFilters(req.params.projectId));
-}
-
-export default (router) => {
-
-
-  router.get(
-    '/api/v1/db/meta/projects/:projectId/cost',
-    metaApiMetrics,
-    ncMetaAclMw(projectCost, 'projectCost')
-  );
-
-
-
-  router.get(
-    '/api/v1/db/meta/projects/:projectId/has-empty-or-null-filters',
-    metaApiMetrics,
-    ncMetaAclMw(hasEmptyOrNullFilters, 'hasEmptyOrNullFilters')
-  );
-};
-
-* */

packages/nocodb/src/models/ProjectUser.ts

@@ -174,11 +174,6 @@ export default class ProjectUser {
   }
 
   static async delete(projectId: string, userId: string, ncMeta = Noco.ncMeta) {
-    // await NocoCache.deepDel(
-    //   CacheScope.PROJECT_USER,
-    //   `${CacheScope.PROJECT_USER}:${projectId}:${userId}`,
-    //   CacheDelDirection.CHILD_TO_PARENT
-    // );
     const { email } = await ncMeta.metaGet2(null, null, MetaTable.USERS, {
       id: userId,
     });
@@ -194,12 +189,17 @@ export default class ProjectUser {
     const { isNoneList } = cachedList;
     if (!isNoneList && cachedProjectList?.length) {
       cachedProjectList = cachedProjectList.filter((p) => p.id !== projectId);
+      // delete the whole list first so that the old one won't be included
+      await NocoCache.del(`${CacheScope.USER_PROJECT}:${userId}:list`);
+      if (cachedProjectList.length > 0) {
+        // set the updated list (i.e. excluding the to-be-deleted project id)
         await NocoCache.setList(
           CacheScope.USER_PROJECT,
           [userId],
           cachedProjectList,
         );
       }
+    }
 
     await NocoCache.del(`${CacheScope.PROJECT_USER}:${projectId}:${userId}`);
     return await ncMeta.metaDelete(null, null, MetaTable.PROJECT_USERS, {