fix(account): hasWorkspacePermission returned true for missing grants

server/account/src/__tests__/mongo.test.ts

@@ -1198,3 +1198,21 @@ describe('MongoAccountDB', () => {
     })
   })
 })
+
+describe('MongoAccountDB.hasWorkspacePermission', () => {
+  function createDb (doc: unknown): MongoAccountDB {
+    const db = new MongoAccountDB({ collection: jest.fn().mockReturnValue({}) } as unknown as Db)
+    ;(db as any).workspacePermission = { findOne: jest.fn().mockResolvedValue(doc) }
+    return db
+  }
+
+  it('returns false when no permission document exists', async () => {
+    const db = createDb(null)
+    expect(await db.hasWorkspacePermission('acc' as AccountUuid, 'ws' as WorkspaceUuid, 'perm')).toBe(false)
+  })
+
+  it('returns true when a permission document exists', async () => {
+    const db = createDb({ workspaceUuid: 'ws', accountUuid: 'acc', permission: 'perm' })
+    expect(await db.hasWorkspacePermission('acc' as AccountUuid, 'ws' as WorkspaceUuid, 'perm')).toBe(true)
+  })
+})

server/account/src/__tests__/postgres.test.ts

@@ -1029,3 +1029,21 @@ describe('PostgresAccountDB', () => {
     })
   })
 })
+
+describe('PostgresAccountDB.hasWorkspacePermission', () => {
+  function createDb (rows: any[]): PostgresAccountDB {
+    const mock: any = Object.assign(jest.fn(), { unsafe: jest.fn().mockResolvedValue(rows) })
+    mock.begin = jest.fn().mockImplementation((callback: (client: any) => Promise<any>) => callback(mock))
+    return new PostgresAccountDB(mock as Sql)
+  }
+
+  it('returns false when no permission row exists', async () => {
+    const db = createDb([])
+    expect(await db.hasWorkspacePermission('acc' as AccountUuid, 'ws' as WorkspaceUuid, 'perm')).toBe(false)
+  })
+
+  it('returns true when a permission row exists', async () => {
+    const db = createDb([{ workspace_uuid: 'ws', account_uuid: 'acc', permission: 'perm' }])
+    expect(await db.hasWorkspacePermission('acc' as AccountUuid, 'ws' as WorkspaceUuid, 'perm')).toBe(true)
+  })
+})

server/account/src/collections/mongo.ts

@@ -929,7 +929,7 @@ export class MongoAccountDB implements AccountDB {
       accountUuid: accountId,
       permission
     })
-    return result !== undefined
+    return result != null
   }
 
   async getWorkspacePermissions (accountId: AccountUuid, permission: string): Promise<WorkspaceUuid[]> {

server/account/src/collections/postgres/postgres.ts

@@ -1282,7 +1282,7 @@ export class PostgresAccountDB implements AccountDB {
       accountUuid: accountId,
       permission
     })
-    return result !== undefined
+    return result != null
   }
 
   async getWorkspacePermissions (accountId: AccountUuid, permission: string): Promise<WorkspaceUuid[]> {