refactor(server): permission (#10449)

packages/backend/server/src/plugins/payment/manager/workspace.ts

@@ -11,6 +11,7 @@ import {
   SubscriptionPlanNotFound,
   URLHelper,
 } from '../../../base';
+import { Models } from '../../../models';
 import {
   KnownStripeInvoice,
   KnownStripePrice,
@@ -48,7 +49,8 @@ export class WorkspaceSubscriptionManager extends SubscriptionManager {
     stripe: Stripe,
     db: PrismaClient,
     private readonly url: URLHelper,
-    private readonly event: EventBus
+    private readonly event: EventBus,
+    private readonly models: Models
   ) {
     super(stripe, db);
   }
@@ -101,11 +103,7 @@ export class WorkspaceSubscriptionManager extends SubscriptionManager {
       return { allow_promotion_codes: true };
     })();
 
-    const count = await this.db.workspaceUserPermission.count({
-      where: {
-        workspaceId: args.workspaceId,
-      },
-    });
+    const count = await this.models.workspaceUser.count(args.workspaceId);
 
     return this.stripe.checkout.sessions.create({
       customer: customer.stripeCustomerId,

packages/backend/server/src/plugins/payment/quota.ts

@@ -1,7 +1,6 @@
 import { Injectable } from '@nestjs/common';
 
 import { OnEvent } from '../../base';
-import { PermissionService } from '../../core/permission';
 import { WorkspaceService } from '../../core/workspaces/resolvers';
 import { Models } from '../../models';
 import { SubscriptionPlan } from './types';
@@ -9,7 +8,6 @@ import { SubscriptionPlan } from './types';
 @Injectable()
 export class QuotaOverride {
   constructor(
-    private readonly permission: PermissionService,
     private readonly workspace: WorkspaceService,
     private readonly models: Models
   ) {}
@@ -32,7 +30,7 @@ export class QuotaOverride {
             memberLimit: quantity,
           }
         );
-        await this.permission.refreshSeatStatus(workspaceId, quantity);
+        await this.models.workspaceUser.refresh(workspaceId, quantity);
         if (!isTeam) {
           // this event will triggered when subscription is activated or changed
           // we only send emails when the team workspace is activated

packages/backend/server/src/plugins/payment/resolver.ts

@@ -27,7 +27,7 @@ import {
   WorkspaceIdRequiredToUpdateTeamSubscription,
 } from '../../base';
 import { CurrentUser, Public } from '../../core/auth';
-import { PermissionService, WorkspaceRole } from '../../core/permission';
+import { AccessController } from '../../core/permission';
 import { UserType } from '../../core/user';
 import { WorkspaceType } from '../../core/workspaces';
 import { Invoice, Subscription, WorkspaceSubscriptionManager } from './manager';
@@ -520,7 +520,7 @@ export class WorkspaceSubscriptionResolver {
   constructor(
     private readonly service: WorkspaceSubscriptionManager,
     private readonly db: PrismaClient,
-    private readonly permission: PermissionService
+    private readonly ac: AccessController
   ) {}
 
   @ResolveField(() => SubscriptionType, {
@@ -542,11 +542,11 @@ export class WorkspaceSubscriptionResolver {
     @CurrentUser() me: CurrentUser,
     @Parent() workspace: WorkspaceType
   ) {
-    await this.permission.checkWorkspace(
-      workspace.id,
-      me.id,
-      WorkspaceRole.Owner
-    );
+    await this.ac
+      .user(me.id)
+      .workspace(workspace.id)
+      .assert('Workspace.Payment.Manage');
+
     return this.db.invoice.count({
       where: {
         targetId: workspace.id,
@@ -562,11 +562,10 @@ export class WorkspaceSubscriptionResolver {
     take: number,
     @Args('skip', { type: () => Int, nullable: true }) skip?: number
   ) {
-    await this.permission.checkWorkspace(
-      workspace.id,
-      me.id,
-      WorkspaceRole.Owner
-    );
+    await this.ac
+      .user(me.id)
+      .workspace(workspace.id)
+      .assert('Workspace.Payment.Manage');
 
     return this.db.invoice.findMany({
       where: {