feat: enhance role permission checks for organization member invites

Signed-off-by: rohan <[email protected]>

Author: rohan-chaturvedi

backend/api/utils/access/permissions.py

@@ -66,6 +66,28 @@ def member_can_access_org(member_id, org_id):
     ).exists()
 
 
+def role_has_permission(role, action, resource, is_app_resource=False):
+    """Check if a role has the specified permission for a resource."""
+    if not role:
+        return False  # No role assigned, hence no permissions
+
+    # Check if the role is a default role
+    if role.is_default:
+        # Get permissions from the default_roles dictionary
+        role_name = role.name.capitalize()
+        permissions = default_roles.get(role_name, {})
+    else:
+        # Use the permissions stored in the role object
+        permissions = role.permissions
+
+    # Determine the correct key to check
+    permission_key = "app_permissions" if is_app_resource else "permissions"
+
+    # Check if the resource exists and if the action is permitted
+    resource_permissions = permissions.get(permission_key, {}).get(resource, [])
+    return action in resource_permissions
+
+
 def user_has_permission(
     account,
     action,
@@ -85,25 +107,8 @@ def user_has_permission(
             org_member = OrganisationMember.objects.get(
                 user=account, organisation=organisation, deleted_at=None
             )
-        role = org_member.role
-        if not role:
-            return False  # No role assigned, hence no permissions
-
-        # Check if the role is a default role
-        if role.is_default:
-            # Get permissions from the default_roles dictionary
-            role_name = role.name.capitalize()
-            permissions = default_roles.get(role_name, {})
-        else:
-            # Use the permissions stored in the role object
-            permissions = role.permissions
-
-        # Determine the correct key to check
-        permission_key = "app_permissions" if is_app_resource else "permissions"
 
-        # Check if the resource exists and if the action is permitted
-        resource_permissions = permissions.get(permission_key, {}).get(resource, [])
-        return action in resource_permissions
+        return role_has_permission(org_member.role, action, resource, is_app_resource)
 
     except OrganisationMember.DoesNotExist:
         return False  # User is not a member of the organization

backend/backend/graphene/mutations/organisation.py

@@ -1,8 +1,8 @@
 from api.emails import send_user_joined_email, send_welcome_email
 from api.utils.access.permissions import (
     role_has_global_access,
+    role_has_permission,
     user_has_permission,
-    user_is_admin,
     user_is_org_member,
 )
 from api.utils.access.roles import default_roles
@@ -162,11 +162,20 @@ def mutate(cls, root, info, org_id, invites):
             app_scope = App.objects.filter(id__in=apps)
 
             # Restrict roles that can be assigned via invites
-            allowed_invite_roles = ["developer", "service"]
+            org_roles = Role.objects.filter(organisation=org)
+
+            allowed_invite_roles = [
+                r
+                for r in org_roles
+                if not role_has_global_access(r)
+                and not role_has_permission(r, "create", "ServiceAccountTokens")
+            ]
+
             role = Role.objects.get(organisation=org, id=role_id)
-            if role.name.lower() not in allowed_invite_roles:
+            if role not in allowed_invite_roles:
+                allowed_role_names = [r.name for r in allowed_invite_roles]
                 raise GraphQLError(
-                    f"You can only invite members with the following roles: {', '.join(allowed_invite_roles)}"
+                    f"You can only invite members with the following roles: {', '.join(allowed_role_names)}"
                 )
 
             new_invite = OrganisationMemberInvite.objects.create(