Support for change approval

[rajdip-b]

Description

Currently, anyone with the permissions can change anything they want. While this is good for small projects, as and when they grow, we would appreciate a little bit more control over how our data is modified.

That's when approvals can help us. Every workspace will have the option to opt in to approvals. If enabled, every change will go through a process of the workspace admins verifying the changes by themselves before they go live.

The target entities of change would be these:

• Secret
• Project
• Environment
• Configuration
• Workspace role
• Workspace Membership

Doing any sorts of update, creation or deletion will trigger these approval requests.

Solution

To implement this feature, we would need to add another entity in the prisma.schema file. Although we are open to discussions about the structure, we would really like to emphasize on the factor of accountability. An example schema might look something like this:

id    String
title    String
createdOn    Date
approvedOn    Date
rejectedOn    Date
status    PENDING|APPROVED|REJECTED
approvedBy    User
rejectedBy    User

project    Project?
environment    Environment?
workspaceRole    WorkspaceRole?
workspaceMembershiopp    WorkspaceMember?
secret    Secret?
configuration    Configuration?

After this, we would need a fully working CRUD API under /api/approval to manage the approvals. Note that only users with MANAGE_APPROVAL can act (approve/reject/view) the approvals of other users. Although, users can view their own approval requests.

Additional context

• Add new entity in prisma.schema
• Add module, controller and service
• Add helper functions if required
• Update existing UPDATE, CREATE, DELETE functionalities of the target entities to send in an approval request if workspace has approval flow enabled
• Add appropriate unit tests
• Add appropriate e2e tests

[rajdip-b]

Change approval support

[rajdip-b]

Fixed by #158