Guard core rbac consuming workflows

Author: NicolasGorga

integration-tests/modules/__tests__/rbac/rbac-workflows.spec.ts

@@ -4,12 +4,7 @@ import {
 } from "@medusajs/core-flows"
 import { medusaIntegrationTestRunner } from "@medusajs/test-utils"
 import { IRbacModuleService, MedusaContainer } from "@medusajs/types"
-import {
-  ContainerRegistrationKeys,
-  definePolicies,
-  Modules,
-  Policy,
-} from "@medusajs/utils"
+import { definePolicies, Modules, Policy } from "@medusajs/utils"
 
 jest.setTimeout(60000)
 
@@ -834,9 +829,6 @@ medusaIntegrationTestRunner({
 
         it("should prevent user from assigning policies they don't have access to", async () => {
           const userModule = appContainer.resolve(Modules.USER)
-          const remoteLink = appContainer.resolve(
-            ContainerRegistrationKeys.LINK
-          )
 
           // Create policies
           const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
@@ -887,14 +879,13 @@ medusaIntegrationTestRunner({
             },
           ])
 
-          await remoteLink.create({
-            [Modules.USER]: {
-              user_id: user.id,
-            },
-            [Modules.RBAC]: {
-              rbac_role_id: limitedRoles[0].id,
+          await rbacService.createRbacRoleAssignments([
+            {
+              role_id: limitedRoles[0].id,
+              reference: "user",
+              reference_id: user.id,
             },
-          })
+          ])
 
           // Try to create a role with write permission
           let error: any
@@ -922,9 +913,6 @@ medusaIntegrationTestRunner({
 
         it("should allow user to create roles with policies they have access to", async () => {
           const userModule = appContainer.resolve(Modules.USER)
-          const remoteLink = appContainer.resolve(
-            ContainerRegistrationKeys.LINK
-          )
 
           // Create policies
           const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
@@ -969,14 +957,13 @@ medusaIntegrationTestRunner({
             },
           ])
 
-          await remoteLink.create({
-            [Modules.USER]: {
-              user_id: user.id,
-            },
-            [Modules.RBAC]: {
-              rbac_role_id: adminRoles[0].id,
+          await rbacService.createRbacRoleAssignments([
+            {
+              role_id: adminRoles[0].id,
+              reference: "user",
+              reference_id: user.id,
             },
-          })
+          ])
 
           // User should be able to create a role with read permission (which they have)
           const { result: newRoles } = await rolesWorkflow.run({
@@ -1004,9 +991,6 @@ medusaIntegrationTestRunner({
 
         it("should allow user with inherited permissions to create roles", async () => {
           const userModule = appContainer.resolve(Modules.USER)
-          const remoteLink = appContainer.resolve(
-            ContainerRegistrationKeys.LINK
-          )
 
           // Create policies
           const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
@@ -1064,14 +1048,13 @@ medusaIntegrationTestRunner({
             },
           ])
 
-          await remoteLink.create({
-            [Modules.USER]: {
-              user_id: user.id,
-            },
-            [Modules.RBAC]: {
-              rbac_role_id: managerRoles[0].id,
+          await rbacService.createRbacRoleAssignments([
+            {
+              role_id: managerRoles[0].id,
+              reference: "user",
+              reference_id: user.id,
             },
-          })
+          ])
 
           // User should be able to create a role with read permission (inherited)
           const { result: newRoles } = await rolesWorkflow.run({

packages/core/core-flows/src/invite/steps/get-invite-roles.ts

@@ -1,3 +1,4 @@
+import { MedusaModule } from "@medusajs/framework/modules-sdk"
 import { IRbacModuleService } from "@medusajs/framework/types"
 import { Modules } from "@medusajs/framework/utils"
 import { StepResponse, createStep } from "@medusajs/framework/workflows-sdk"
@@ -28,6 +29,10 @@ export const getInviteRolesStepId = "get-invite-roles-step"
 export const getInviteRolesStep = createStep(
   getInviteRolesStepId,
   async (input: GetInviteRolesStepInput, { container }) => {
+    if (!MedusaModule.isInstalled(Modules.RBAC)) {
+      return new StepResponse([])
+    }
+
     const service = container.resolve<IRbacModuleService>(Modules.RBAC)
 
     const assignments = await service.listRbacRoleAssignments({

packages/core/core-flows/src/rbac/steps/create-role-assignments.ts

@@ -2,6 +2,7 @@ import { IRbacModuleService } from "@medusajs/framework/types"
 import { Modules } from "@medusajs/framework/utils"
 import { StepResponse, createStep } from "@medusajs/framework/workflows-sdk"
 import { invalidateRoleAssignmentCache } from "../utils/invalidate-role-assignment-cache"
+import { MedusaModule } from "@medusajs/framework/modules-sdk"
 
 /**
  * A single role assignment to create.
@@ -38,12 +39,12 @@ export const createRoleAssignmentsStepId = "create-role-assignments"
 export const createRoleAssignmentsStep = createStep(
   createRoleAssignmentsStepId,
   async (data: CreateRoleAssignmentsStepInput, { container }) => {
-    const service = container.resolve<IRbacModuleService>(Modules.RBAC)
-
-    if (!data?.length) {
+    if (!data?.length || !MedusaModule.isInstalled(Modules.RBAC)) {
       return new StepResponse([], [])
     }
 
+    const service = container.resolve<IRbacModuleService>(Modules.RBAC)
+
     const created = await service.createRbacRoleAssignments(
       data.map((assignment) => ({
         role_id: assignment.role_id,

packages/core/core-flows/src/rbac/steps/delete-role-assignments.ts

@@ -2,6 +2,7 @@ import { IRbacModuleService } from "@medusajs/framework/types"
 import { Modules } from "@medusajs/framework/utils"
 import { StepResponse, createStep } from "@medusajs/framework/workflows-sdk"
 import { invalidateRoleAssignmentCache } from "../utils/invalidate-role-assignment-cache"
+import { MedusaModule } from "@medusajs/framework/modules-sdk"
 
 /**
  * The filters identifying the role assignments to delete.
@@ -32,12 +33,15 @@ export const deleteRoleAssignmentsStepId = "delete-role-assignments"
 export const deleteRoleAssignmentsStep = createStep(
   deleteRoleAssignmentsStepId,
   async (data: DeleteRoleAssignmentsStepInput, { container }) => {
-    const service = container.resolve<IRbacModuleService>(Modules.RBAC)
-
-    if (!data?.reference_id?.length) {
+    if (
+      !data?.reference_id?.length ||
+      !MedusaModule.isInstalled(Modules.RBAC)
+    ) {
       return new StepResponse([], [])
     }
 
+    const service = container.resolve<IRbacModuleService>(Modules.RBAC)
+
     const filters: {
       reference: string
       reference_id: string[]

packages/core/core-flows/src/rbac/steps/validate-roles-exist.ts

@@ -1,3 +1,4 @@
+import { MedusaModule } from "@medusajs/framework/modules-sdk"
 import { MedusaError, Modules } from "@medusajs/framework/utils"
 import { createStep, StepResponse } from "@medusajs/framework/workflows-sdk"
 
@@ -19,7 +20,7 @@ export const validateRolesExistStepId = "validate-roles-exist-step"
 export const validateRolesExistStep = createStep(
   validateRolesExistStepId,
   async (roleIds: string[], { container }) => {
-    if (!roleIds.length) {
+    if (!roleIds.length || !MedusaModule.isInstalled(Modules.RBAC)) {
       return new StepResponse(undefined)
     }