EZQMS-729: Restrict spaces operations

models/board/src/index.ts

@@ -505,7 +505,11 @@ export function createModel (builder: Builder): void {
       description: board.string.ManageBoardStatuses,
       icon: board.icon.Board,
       baseClass: board.class.Board,
-      availablePermissions: [core.permission.ForbidDeleteObject],
+      availablePermissions: [
+        core.permission.UpdateSpace,
+        core.permission.ArchiveSpace,
+        core.permission.ForbidDeleteObject
+      ],
       allowedTaskTypeDescriptors: [board.descriptors.Card]
     },
     board.descriptors.BoardType

models/core/src/index.ts

@@ -103,6 +103,7 @@ import {
   TTxUpdateDoc,
   TTxWorkspaceEvent
 } from './tx'
+import { defineSpaceType } from './spaceType'
 
 export { coreId } from '@hcengineering/core'
 export * from './core'
@@ -328,4 +329,5 @@ export function createModel (builder: Builder): void {
   })
 
   definePermissions(builder)
+  defineSpaceType(builder)
 }

models/core/src/migration.ts

@@ -22,7 +22,8 @@ import core, {
   TxOperations,
   generateId,
   DOMAIN_TX,
-  type TxCreateDoc
+  type TxCreateDoc,
+  type Space
 } from '@hcengineering/core'
 import {
   tryMigrate,
@@ -31,6 +32,7 @@ import {
   type MigrationClient,
   type MigrationUpgradeClient
 } from '@hcengineering/model'
+import { DOMAIN_SPACE } from './security'
 
 async function migrateStatusesToModel (client: MigrationClient): Promise<void> {
   // Move statuses to model:
@@ -75,6 +77,44 @@ async function migrateStatusesToModel (client: MigrationClient): Promise<void> {
   }
 }
 
+async function migrateAllSpaceToTyped (client: MigrationClient): Promise<void> {
+  await client.update(
+    DOMAIN_SPACE,
+    {
+      _id: core.space.Space,
+      _class: core.class.Space
+    },
+    {
+      $set: {
+        _class: core.class.TypedSpace,
+        type: core.spaceType.SpacesType
+      }
+    }
+  )
+}
+
+async function migrateSpacesOwner (client: MigrationClient): Promise<void> {
+  const targetClasses = client.hierarchy.getDescendants(core.class.Space)
+  const targetSpaces = await client.find<Space>(DOMAIN_SPACE, {
+    _class: { $in: targetClasses },
+    owners: { $exists: false }
+  })
+
+  for (const space of targetSpaces) {
+    await client.update(
+      DOMAIN_SPACE,
+      {
+        _id: space._id
+      },
+      {
+        $set: {
+          owners: [space.createdBy]
+        }
+      }
+    )
+  }
+}
+
 export const coreOperation: MigrateOperation = {
   async migrate (client: MigrationClient): Promise<void> {
     // We need to delete all documents in doc index state for missing classes
@@ -95,6 +135,14 @@ export const coreOperation: MigrateOperation = {
       {
         state: 'statuses-to-model',
         func: migrateStatusesToModel
+      },
+      {
+        state: 'all-space-to-typed',
+        func: migrateAllSpaceToTyped
+      },
+      {
+        state: 'add-spaces-owner',
+        func: migrateSpacesOwner
       }
     ])
   },
@@ -110,14 +158,15 @@ export const coreOperation: MigrateOperation = {
           })
           if (spaceSpace === undefined) {
             await tx.createDoc(
-              core.class.Space,
+              core.class.TypedSpace,
               core.space.Space,
               {
                 name: 'Space for all spaces',
                 description: 'Spaces',
                 private: false,
                 archived: false,
-                members: []
+                members: [],
+                type: core.spaceType.SpacesType
               },
               core.space.Space
             )

models/core/src/permissions.ts

@@ -22,7 +22,8 @@ export function definePermissions (builder: Builder): void {
     core.class.Permission,
     core.space.Model,
     {
-      label: core.string.CreateObject
+      label: core.string.CreateObject,
+      description: core.string.CreateObjectDescription
     },
     core.permission.CreateObject
   )
@@ -31,7 +32,8 @@ export function definePermissions (builder: Builder): void {
     core.class.Permission,
     core.space.Model,
     {
-      label: core.string.UpdateObject
+      label: core.string.UpdateObject,
+      description: core.string.UpdateObjectDescription
     },
     core.permission.UpdateObject
   )
@@ -55,4 +57,44 @@ export function definePermissions (builder: Builder): void {
     },
     core.permission.ForbidDeleteObject
   )
+
+  builder.createDoc(
+    core.class.Permission,
+    core.space.Model,
+    {
+      label: core.string.UpdateObject,
+      description: core.string.UpdateObjectDescription
+    },
+    core.permission.UpdateObject
+  )
+
+  builder.createDoc(
+    core.class.Permission,
+    core.space.Model,
+    {
+      label: core.string.DeleteObject,
+      description: core.string.DeleteObjectDescription
+    },
+    core.permission.DeleteObject
+  )
+
+  builder.createDoc(
+    core.class.Permission,
+    core.space.Model,
+    {
+      label: core.string.UpdateSpace,
+      description: core.string.UpdateSpaceDescription
+    },
+    core.permission.UpdateSpace
+  )
+
+  builder.createDoc(
+    core.class.Permission,
+    core.space.Model,
+    {
+      label: core.string.ArchiveSpace,
+      description: core.string.ArchiveSpaceDescription
+    },
+    core.permission.ArchiveSpace
+  )
 }

models/core/src/security.ts

@@ -28,21 +28,23 @@ import {
   type Role,
   type Class,
   type Permission,
-  type CollectionSize
+  type CollectionSize,
+  type RolesAssignment
 } from '@hcengineering/core'
 import {
   ArrOf,
   Collection,
   Hidden,
   Index,
+  Mixin,
   Model,
   Prop,
   TypeBoolean,
   TypeRef,
   TypeString,
   UX
 } from '@hcengineering/model'
-import type { Asset, IntlString } from '@hcengineering/platform'
+import { getEmbeddedLabel, type Asset, type IntlString } from '@hcengineering/platform'
 import core from './component'
 import { TDoc, TAttachedDoc } from './core'
 
@@ -70,6 +72,9 @@ export class TSpace extends TDoc implements Space {
   @Prop(ArrOf(TypeRef(core.class.Account)), core.string.Members)
   @Hidden()
     members!: Arr<Ref<Account>>
+
+  @Prop(ArrOf(TypeRef(core.class.Account)), core.string.Owners)
+    owners?: Ref<Account>[]
 }
 
 @Model(core.class.TypedSpace, core.class.Space)
@@ -86,6 +91,7 @@ export class TSpaceTypeDescriptor extends TDoc implements SpaceTypeDescriptor {
   icon!: Asset
   baseClass!: Ref<Class<Space>>
   availablePermissions!: Ref<Permission>[]
+  system?: boolean
 }
 
 @Model(core.class.SpaceType, core.class.Doc, DOMAIN_MODEL)
@@ -141,6 +147,12 @@ export class TPermission extends TDoc implements Permission {
   icon?: Asset
 }
 
+@Mixin(core.mixin.SpacesTypeData, core.class.Space)
+@UX(getEmbeddedLabel("All spaces' type")) // TODO: add icon?
+export class TSpacesTypeData extends TSpace implements RolesAssignment {
+  [key: Ref<Role>]: Ref<Account>[]
+}
+
 @Model(core.class.Account, core.class.Doc, DOMAIN_MODEL)
 @UX(core.string.Account)
 export class TAccount extends TDoc implements Account {

models/core/src/spaceType.ts

@@ -0,0 +1,81 @@
+//
+// Copyright © 2024 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import { ArrOf, Prop, TypeRef, type Builder } from '@hcengineering/model'
+import { type Asset } from '@hcengineering/platform'
+import { getRoleAttributeBaseProps } from '@hcengineering/core'
+
+import { TSpacesTypeData } from './security'
+import core from './component'
+
+const roles = [
+  {
+    _id: core.role.Admin,
+    name: 'Admin',
+    permissions: [core.permission.UpdateObject, core.permission.DeleteObject]
+  }
+]
+
+export function defineSpaceType (builder: Builder): void {
+  for (const role of roles) {
+    const { label, id } = getRoleAttributeBaseProps(role, role._id)
+    const roleAssgtType = ArrOf(TypeRef(core.class.Account))
+
+    Prop(roleAssgtType, label)(TSpacesTypeData.prototype, id)
+  }
+
+  builder.createModel(TSpacesTypeData)
+
+  builder.createDoc(
+    core.class.SpaceTypeDescriptor,
+    core.space.Model,
+    {
+      name: core.string.Spaces,
+      description: core.string.SpacesDescription,
+      icon: '' as Asset, // FIXME
+      baseClass: core.class.Space,
+      availablePermissions: [core.permission.UpdateObject, core.permission.DeleteObject],
+      system: true
+    },
+    core.descriptor.SpacesType
+  )
+
+  builder.createDoc(
+    core.class.SpaceType,
+    core.space.Model,
+    {
+      name: "All spaces' space type",
+      descriptor: core.descriptor.SpacesType,
+      roles: roles.length,
+      targetClass: core.mixin.SpacesTypeData
+    },
+    core.spaceType.SpacesType
+  )
+
+  for (const role of roles) {
+    builder.createDoc(
+      core.class.Role,
+      core.space.Model,
+      {
+        attachedTo: core.spaceType.SpacesType,
+        attachedToClass: core.class.SpaceType,
+        collection: 'roles',
+        name: role.name,
+        permissions: role.permissions
+      },
+      role._id
+    )
+  }
+}

models/document/src/index.ts

@@ -180,7 +180,11 @@ function defineTeamspace (builder: Builder): void {
       description: document.string.Description,
       icon: document.icon.Document,
       baseClass: document.class.Teamspace,
-      availablePermissions: [core.permission.ForbidDeleteObject]
+      availablePermissions: [
+        core.permission.UpdateSpace,
+        core.permission.ArchiveSpace,
+        core.permission.ForbidDeleteObject
+      ]
     },
     document.descriptor.TeamspaceType
   )
@@ -218,6 +222,7 @@ function defineTeamspace (builder: Builder): void {
       input: 'focus',
       category: document.category.Document,
       target: document.class.Teamspace,
+      visibilityTester: view.function.CanEditSpace,
       query: {},
       context: {
         mode: ['context', 'browser'],

models/lead/src/index.ts

@@ -599,6 +599,7 @@ export function createModel (builder: Builder): void {
     input: 'focus',
     category: lead.category.Lead,
     target: lead.class.Funnel,
+    visibilityTester: view.function.CanEditSpace,
     override: [view.action.Open],
     context: {
       mode: ['context', 'browser'],