Feat/casl

infra/k6/package.json

@@ -5,10 +5,10 @@
     "scripts": {
         "test:all": "k6 run scenarios/stress-full.js",
         "test:auth": "k6 run scenarios/auth.js",
-        "test:teams": "k6 run scenarios/teams.js",
-        "test:teams-members": "k6 run scenarios/teams-members.js",
-        "test:teams-invitations": "k6 run scenarios/teams-invitations.js",
-        "test:teams-me": "k6 run scenarios/teams-me.js",
+        "test:team": "k6 run scenarios/team.js",
+        "test:team-members": "k6 run scenarios/team-members.js",
+        "test:team-invitations": "k6 run scenarios/team-invitations.js",
+        "test:team-me": "k6 run scenarios/team-me.js",
         "test:projects": "k6 run scenarios/projects.js",
         "test:users": "k6 run scenarios/users.js",
         "test:boards:all": "k6 run scenarios/boards.js && k6 run scenarios/boards-columns.js && k6 run scenarios/boards-views.js",

libs/bootstrap/src/bootstrap.ts

@@ -67,7 +67,7 @@
          * хука для Node.js HTTP-слоя (this.raw). Приведение к 'any' здесь является легитимным решением
          * для динамического monkey-patching-а.
          */
         .addHook('onRequest', (request: any, reply: any, done) => {
             reply.setHeader = function (key: string, value: string) {
                 return this.raw.setHeader(key, value);
             };
@@ -100,6 +100,10 @@
         },
     });
 
+    const isProduction = configService.get('NODE_ENV') === 'production';
+    const domain = configService.get('DOMAIN');
+    const stage = configService.get('STAGE_DOMAIN');
+
     if (apiPrefix) {
         app.setGlobalPrefix(apiPrefix);
     }
@@ -118,9 +122,6 @@
     if (swaggerOptions) {
         const { path = 'docs', ...metadata } = swaggerOptions;
 
-        const domain = configService.get('DOMAIN');
-        const stage = configService.get('STAGE_DOMAIN');
-
         const fullOptions = {
             ...metadata,
             path,
@@ -135,14 +136,26 @@
     }
     if (useCookieParser) {
         const secret = configService.getOrThrow('COOKIE_SECRET');
-        await app.register(fastifyCookie, { secret });
+        await app.register(fastifyCookie, {
+            secret,
+            parseOptions: {
+                httpOnly: true,
+                sameSite: 'lax',
+                signed: true,
+                secure: isProduction,
+                path: '/',
+                domain: domain ? `.${domain}` : undefined,
+            },
+        });
         await app.register(fastifyCsrf, {
             cookieOpts: {
-                signed: true,
                 httpOnly: true,
-                sameSite: 'strict',
-                secure: configService.getOrThrow('NODE_ENV') === 'production',
+                sameSite: 'lax',
+                secure: isProduction,
+                path: '/',
+                domain: domain ? `.${domain}` : undefined,
             },
+            sessionPlugin: '@fastify/cookie',
         });
     }
     if (setupApp) {

migrations/0006_opposite_pet_avengers.sql

@@ -0,0 +1,6 @@
+ALTER TABLE "base"."team_members" ALTER COLUMN "role" SET DATA TYPE text;
+ALTER TABLE "base"."team_members" ALTER COLUMN "role" SET DEFAULT 'member'::text;
+DROP TYPE "base"."team_role";
+CREATE TYPE "base"."team_role" AS ENUM('owner', 'admin', 'member', 'viewer');
+ALTER TABLE "base"."team_members" ALTER COLUMN "role" SET DEFAULT 'member'::"base"."team_role";
+ALTER TABLE "base"."team_members" ALTER COLUMN "role" SET DATA TYPE "base"."team_role" USING "role"::"base"."team_role";