rise-deploy 0.16.1

A simple and powerful CLI for deploying containerized applications
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158

use anyhow::{Context, Result};
use uuid::Uuid;

/// Add a user to project's app users (view-only access to deployed app)
pub async fn add_user<'a, E>(executor: E, project_id: Uuid, user_id: Uuid) -> Result<()>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    sqlx::query!(
        r#"
        INSERT INTO project_app_users (project_id, user_id)
        VALUES ($1, $2)
        ON CONFLICT (project_id, user_id) DO NOTHING
        "#,
        project_id,
        user_id
    )
    .execute(executor)
    .await
    .context("Failed to add app user to project")?;

    Ok(())
}

/// Remove a user from project's app users
pub async fn remove_user<'a, E>(executor: E, project_id: Uuid, user_id: Uuid) -> Result<()>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    sqlx::query!(
        r#"
        DELETE FROM project_app_users
        WHERE project_id = $1 AND user_id = $2
        "#,
        project_id,
        user_id
    )
    .execute(executor)
    .await
    .context("Failed to remove app user from project")?;

    Ok(())
}

/// Add a team to project's app teams (view-only access to deployed app)
pub async fn add_team<'a, E>(executor: E, project_id: Uuid, team_id: Uuid) -> Result<()>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    sqlx::query!(
        r#"
        INSERT INTO project_app_teams (project_id, team_id)
        VALUES ($1, $2)
        ON CONFLICT (project_id, team_id) DO NOTHING
        "#,
        project_id,
        team_id
    )
    .execute(executor)
    .await
    .context("Failed to add app team to project")?;

    Ok(())
}

/// Remove a team from project's app teams
pub async fn remove_team<'a, E>(executor: E, project_id: Uuid, team_id: Uuid) -> Result<()>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    sqlx::query!(
        r#"
        DELETE FROM project_app_teams
        WHERE project_id = $1 AND team_id = $2
        "#,
        project_id,
        team_id
    )
    .execute(executor)
    .await
    .context("Failed to remove app team from project")?;

    Ok(())
}

/// List user IDs who are app users for a project
pub async fn list_users<'a, E>(executor: E, project_id: Uuid) -> Result<Vec<Uuid>>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    let records = sqlx::query!(
        r#"
        SELECT user_id
        FROM project_app_users
        WHERE project_id = $1
        ORDER BY created_at ASC
        "#,
        project_id
    )
    .fetch_all(executor)
    .await
    .context("Failed to list app users")?;

    Ok(records.into_iter().map(|r| r.user_id).collect())
}

/// List team IDs that are app teams for a project
pub async fn list_teams<'a, E>(executor: E, project_id: Uuid) -> Result<Vec<Uuid>>
where
    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
{
    let records = sqlx::query!(
        r#"
        SELECT team_id
        FROM project_app_teams
        WHERE project_id = $1
        ORDER BY created_at ASC
        "#,
        project_id
    )
    .fetch_all(executor)
    .await
    .context("Failed to list app teams")?;

    Ok(records.into_iter().map(|r| r.team_id).collect())
}

/// Check if a user can access the deployed application (via app users or app teams)
/// This is for ingress auth only - it does NOT grant project management permissions
pub async fn user_can_access_app(
    pool: &sqlx::PgPool,
    project_id: Uuid,
    user_id: Uuid,
) -> Result<bool> {
    let result = sqlx::query!(
        r#"
        SELECT EXISTS(
            -- Direct app user
            SELECT 1 FROM project_app_users pau
            WHERE pau.project_id = $1 AND pau.user_id = $2

            UNION

            -- Team member of an app team
            SELECT 1 FROM project_app_teams pat
            INNER JOIN team_members tm ON tm.team_id = pat.team_id
            WHERE pat.project_id = $1 AND tm.user_id = $2
        ) as "exists!"
        "#,
        project_id,
        user_id
    )
    .fetch_one(pool)
    .await
    .context("Failed to check app user access")?;

    Ok(result.exists)
}