chore: add authorization to server actions for Actions (#868)

* poc: use server session and api key validation on deletion

* feat: use server session and api key validation on deletion and creation

* feat: packages/lib/apiKey for apiKey services and auth

* shubham/auth-for-api-key

* fix: caching

* feat: handle authorization for action creation, update, delete

* feat: use cached method across and wrapper for authzn check

* fix: club caching methods and use authzn errors

* feat: add caching in canUserAccessApiKey

* feat: add caching in canUserAccessAction and use Authzn error

* fix: rename action to actionClass wherever needed

* fix: use cache getActionClass

* fix: make changes

* fix: import

---------

Co-authored-by: Matthias Nannt <mail@matthiasnannt.com>

apps/web/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/ActionSettingsTab.tsx

@@ -9,11 +9,14 @@ import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "react-hot-toast";
 import { testURLmatch } from "./testURLmatch";
-import { deleteActionClass, updateActionClass } from "@formbricks/lib/services/actionClass";
 import { TActionClassInput, TActionClassNoCodeConfig } from "@formbricks/types/v1/actionClasses";
 import { CssSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/CssSelector";
 import { PageUrlSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/PageUrlSelector";
 import { InnerHtmlSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/InnerHtmlSelector";
+import {
+  deleteActionClassAction,
+  updateActionClassAction,
+} from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/actions";
 
 interface ActionSettingsTabProps {
   environmentId: string;
@@ -77,10 +80,11 @@ export default function ActionSettingsTab({ environmentId, actionClass, setOpen
       const filteredNoCodeConfig = filterNoCodeConfig(data.noCodeConfig as NoCodeConfig);
       const updatedData: TActionClassInput = {
         ...data,
+        environmentId,
         noCodeConfig: filteredNoCodeConfig,
         type: "noCode",
       } as TActionClassInput;
-      await updateActionClass(environmentId, actionClass.id, updatedData);
+      await updateActionClassAction(environmentId, actionClass.id, updatedData);
       setOpen(false);
       router.refresh();
       toast.success("Action updated successfully");
@@ -94,7 +98,7 @@ export default function ActionSettingsTab({ environmentId, actionClass, setOpen
   const handleDeleteAction = async () => {
     try {
       setIsDeletingAction(true);
-      await deleteActionClass(environmentId, actionClass.id);
+      await deleteActionClassAction(environmentId, actionClass.id);
       router.refresh();
       toast.success("Action deleted successfully");
       setOpen(false);

apps/web/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/AddNoCodeActionModal.tsx

@@ -7,7 +7,6 @@ import { useState } from "react";
 import { useForm } from "react-hook-form";
 import toast from "react-hot-toast";
 import { testURLmatch } from "./testURLmatch";
-import { createActionClass } from "@formbricks/lib/services/actionClass";
 import {
   TActionClassInput,
   TActionClassNoCodeConfig,
@@ -16,6 +15,7 @@ import {
 import { CssSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/CssSelector";
 import { PageUrlSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/PageUrlSelector";
 import { InnerHtmlSelector } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/(selectors)/InnerHtmlSelector";
+import { createActionClassAction } from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/actions";
 
 interface AddNoCodeActionModalProps {
   environmentId: string;
@@ -84,7 +84,7 @@ export default function AddNoCodeActionModal({
         type: "noCode",
       } as TActionClassInput;
 
-      const newActionClass: TActionClass = await createActionClass(environmentId, updatedData);
+      const newActionClass: TActionClass = await createActionClassAction(updatedData);
       if (setActionClassArray) {
         setActionClassArray((prevActionClassArray: TActionClass[]) => [
           ...prevActionClassArray,

apps/web/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/actions.ts

@@ -1,27 +1,93 @@
 "use server";
 
+import { authOptions } from "@/app/api/auth/[...nextauth]/authOptions";
+import { hasUserEnvironmentAccess } from "@formbricks/lib/environment/auth";
+import { createActionClass, deleteActionClass, updateActionClass } from "@formbricks/lib/actionClass/service";
+import { canUserAccessActionClass } from "@formbricks/lib/actionClass/auth";
+import { getServerSession } from "next-auth";
+import { TActionClassInput } from "@formbricks/types/v1/actionClasses";
+
 import {
   getActionCountInLast24Hours,
   getActionCountInLast7Days,
   getActionCountInLastHour,
 } from "@formbricks/lib/services/actions";
 import { getSurveysByActionClassId } from "@formbricks/lib/services/survey";
+import { AuthorizationError } from "@formbricks/types/v1/errors";
+
+export async function deleteActionClassAction(environmentId, actionClassId: string) {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
+  await deleteActionClass(environmentId, actionClassId);
+}
+
+export async function updateActionClassAction(
+  environmentId: string,
+  actionClassId: string,
+  updatedAction: Partial<TActionClassInput>
+) {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
+  return await updateActionClass(environmentId, actionClassId, updatedAction);
+}
+
+export async function createActionClassAction(action: TActionClassInput) {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await hasUserEnvironmentAccess(session.user.id, action.environmentId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
+  return await createActionClass(action.environmentId, action);
+}
 
 export const getActionCountInLastHourAction = async (actionClassId: string) => {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
   return await getActionCountInLastHour(actionClassId);
 };
 
 export const getActionCountInLast24HoursAction = async (actionClassId: string) => {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
   return await getActionCountInLast24Hours(actionClassId);
 };
 
 export const getActionCountInLast7DaysAction = async (actionClassId: string) => {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
   return await getActionCountInLast7Days(actionClassId);
 };
 
 export const GetActiveInactiveSurveysAction = async (
   actionClassId: string
 ): Promise<{ activeSurveys: string[]; inactiveSurveys: string[] }> => {
+  const session = await getServerSession(authOptions);
+  if (!session) throw new AuthorizationError("Not authorized");
+
+  const isAuthorized = await canUserAccessActionClass(session.user.id, actionClassId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
   const surveys = await getSurveysByActionClassId(actionClassId);
   const response = {
     activeSurveys: surveys.filter((s) => s.status === "inProgress").map((survey) => survey.name),

apps/web/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/page.tsx

@@ -4,7 +4,7 @@ import ActionClassesTable from "@/app/(app)/environments/[environmentId]/(action
 import ActionClassDataRow from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/ActionRowData";
 import ActionTableHeading from "@/app/(app)/environments/[environmentId]/(actionsAndAttributes)/actions/ActionTableHeading";
 import { REVALIDATION_INTERVAL } from "@formbricks/lib/constants";
-import { getActionClasses } from "@formbricks/lib/services/actionClass";
+import { getActionClasses } from "@formbricks/lib/actionClass/service";
 import { Metadata } from "next";
 
 export const metadata: Metadata = {

apps/web/app/(app)/environments/[environmentId]/settings/api-keys/actions.ts

@@ -11,22 +11,18 @@ import { AuthorizationError } from "@formbricks/types/v1/errors";
 export async function deleteApiKeyAction(id: string) {
   const session = await getServerSession(authOptions);
   if (!session) throw new AuthorizationError("Not authorized");
-  const isAuthorized = await canUserAccessApiKey(session.user.id, id);
 
-  if (isAuthorized) {
-    return await deleteApiKey(id);
-  } else {
-    throw new AuthorizationError("Not authorized");
-  }
+  const isAuthorized = await canUserAccessApiKey(session.user.id, id);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
+  return await deleteApiKey(id);
 }
 export async function createApiKeyAction(environmentId: string, apiKeyData: TApiKeyCreateInput) {
   const session = await getServerSession(authOptions);
   if (!session) throw new AuthorizationError("Not authorized");
-  const isAuthorized = await hasUserEnvironmentAccess(session.user.id, environmentId);
 
-  if (isAuthorized) {
-    return await createApiKey(environmentId, apiKeyData);
-  } else {
-    throw new AuthorizationError("Not authorized");
-  }
+  const isAuthorized = await hasUserEnvironmentAccess(session.user.id, environmentId);
+  if (!isAuthorized) throw new AuthorizationError("Not authorized");
+
+  return await createApiKey(environmentId, apiKeyData);
 }

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/edit/page.tsx

@@ -5,7 +5,7 @@ import SurveyEditor from "./SurveyEditor";
 import { getSurveyWithAnalytics } from "@formbricks/lib/services/survey";
 import { getProductByEnvironmentId } from "@formbricks/lib/services/product";
 import { getEnvironment } from "@formbricks/lib/services/environment";
-import { getActionClasses } from "@formbricks/lib/services/actionClass";
+import { getActionClasses } from "@formbricks/lib/actionClass/service";
 import { getAttributeClasses } from "@formbricks/lib/services/attributeClass";
 import { ErrorComponent } from "@formbricks/ui";
 

apps/web/app/api/v1/js/sync/lib/sync.ts

@@ -1,6 +1,6 @@
 import { getSurveysCached } from "@/app/api/v1/js/surveys";
 import { MAU_LIMIT } from "@formbricks/lib/constants";
-import { getActionClassesCached } from "@formbricks/lib/services/actionClass";
+import { getActionClasses } from "@formbricks/lib/actionClass/service";
 import { getEnvironment } from "@formbricks/lib/services/environment";
 import { createPerson, getMonthlyActivePeopleCount, getPersonCached } from "@formbricks/lib/services/person";
 import { getProductByEnvironmentIdCached } from "@formbricks/lib/services/product";
@@ -101,7 +101,7 @@ export const getUpdatedState = async (
   // get/create rest of the state
   const [surveys, noCodeActionClasses, product] = await Promise.all([
     getSurveysCached(environmentId, person),
-    getActionClassesCached(environmentId),
+    getActionClasses(environmentId),
     getProductByEnvironmentIdCached(environmentId),
   ]);
 

apps/web/app/api/v1/management/action-classes/[actionClassId]/route.ts

@@ -1,6 +1,6 @@
 import { responses } from "@/lib/api/response";
 import { NextResponse } from "next/server";
-import { deleteActionClass, getActionClass, updateActionClass } from "@formbricks/lib/services/actionClass";
+import { deleteActionClass, getActionClass, updateActionClass } from "@formbricks/lib/actionClass/service";
 import { TActionClass, ZActionClassInput } from "@formbricks/types/v1/actionClasses";
 import { authenticateRequest } from "@/app/api/v1/auth";
 import { transformErrorToDetails } from "@/lib/api/validator";

apps/web/app/api/v1/management/action-classes/route.ts

@@ -3,7 +3,7 @@ import { DatabaseError } from "@formbricks/types/v1/errors";
 import { authenticateRequest } from "@/app/api/v1/auth";
 import { NextResponse } from "next/server";
 import { TActionClass, ZActionClassInput } from "@formbricks/types/v1/actionClasses";
-import { createActionClass, getActionClasses } from "@formbricks/lib/services/actionClass";
+import { createActionClass, getActionClasses } from "@formbricks/lib/actionClass/service";
 import { transformErrorToDetails } from "@/lib/api/validator";
 
 export async function GET(request: Request) {