fix: admin access only entities are not listing for owner users

Signed-off-by: Alessandro Yuichi Okimoto <yuichijpn@gmail.com>

Author: cre8ivejp

pkg/account/api/account.go

@@ -204,7 +204,7 @@ func (s *AccountService) createAccountV2NoCommand(
 			if err != nil {
 				return err
 			}
-			// Store the event to publish after transaction
+			// Store the event to publish after the transaction commits to ensure consistency
 			createAccountEvent = updateAccountEvent
 			return nil
 		}

pkg/account/api/admin_account.go

@@ -170,10 +170,11 @@ func (s *AccountService) GetMe(
 		return nil, err
 	}
 	var envRoles []*accountproto.ConsoleAccount_EnvironmentRole
-	if account.OrganizationRole == accountproto.AccountV2_Role_Organization_ADMIN {
-		envRoles = s.getAdminConsoleAccountEnvironmentRoles(environments, projects)
-	} else {
+	if account.OrganizationRole == accountproto.AccountV2_Role_Organization_MEMBER {
 		envRoles = s.getConsoleAccountEnvironmentRoles(account.EnvironmentRoles, environments, projects)
+	} else {
+		// If the account is an organization admin or organization owner can view all environments
+		envRoles = s.getAdminConsoleAccountEnvironmentRoles(environments, projects)
 	}
 
 	// update user last seen
@@ -417,9 +418,10 @@ func (s *AccountService) getMyOrganizations(
 		if accWithOrg.AccountV2.Disabled || accWithOrg.Organization.Disabled || accWithOrg.Organization.Archived {
 			continue
 		}
-		// If the account is an admin account, we append the organization.
+		// If the account is an organization admin or organization owner, we append the organization.
 		// Otherwise, we check if the account is enabled in any environment in this organization.
-		if accWithOrg.AccountV2.OrganizationRole == accountproto.AccountV2_Role_Organization_ADMIN {
+		if accWithOrg.AccountV2.OrganizationRole == accountproto.AccountV2_Role_Organization_ADMIN ||
+			accWithOrg.AccountV2.OrganizationRole == accountproto.AccountV2_Role_Organization_OWNER {
 			myOrgs = append(myOrgs, accWithOrg.Organization)
 			continue
 		}

pkg/account/api/api_key.go

@@ -634,10 +634,7 @@ func (s *AccountService) getAllowedEnvironments(
 	editor *eventproto.Editor,
 ) []string {
 	filterEnvironmentIDs := make([]string, 0)
-	if editor.OrganizationRole == proto.AccountV2_Role_Organization_ADMIN || editor.IsAdmin {
-		// if the user is an admin, no need to filter environments.
-		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
-	} else {
+	if editor.OrganizationRole == proto.AccountV2_Role_Organization_MEMBER {
 		// only show API keys in allowed environments for member.
 		if len(reqEnvironmentIDs) > 0 {
 			for _, id := range reqEnvironmentIDs {
@@ -653,6 +650,9 @@ func (s *AccountService) getAllowedEnvironments(
 				filterEnvironmentIDs = append(filterEnvironmentIDs, e.EnvironmentId)
 			}
 		}
+	} else {
+		// if the user is an admin, no need to filter environments.
+		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
 	}
 	return filterEnvironmentIDs
 }

pkg/account/domain/account.go

@@ -144,7 +144,8 @@ func (a *AccountV2) Update(
 	if len(environmentRoles) > 0 {
 		updated.EnvironmentRoles = environmentRoles
 	}
-	if updated.OrganizationRole == proto.AccountV2_Role_Organization_ADMIN {
+	if updated.OrganizationRole == proto.AccountV2_Role_Organization_ADMIN ||
+		updated.OrganizationRole == proto.AccountV2_Role_Organization_OWNER {
 		updated.EnvironmentRoles = []*proto.AccountV2_EnvironmentRole{}
 	}
 	if isDisabled != nil {

pkg/notification/api/subscription.go

@@ -771,10 +771,7 @@ func (s *NotificationService) getAllowedEnvironments(
 	editor *eventproto.Editor,
 ) []string {
 	filterEnvironmentIDs := make([]string, 0)
-	if editor.OrganizationRole == accountproto.AccountV2_Role_Organization_ADMIN || editor.IsAdmin {
-		// if the user is an admin, no need to filter environments.
-		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
-	} else {
+	if editor.OrganizationRole == accountproto.AccountV2_Role_Organization_MEMBER {
 		// only show API keys in allowed environments for member.
 		if len(reqEnvironmentIDs) > 0 {
 			for _, id := range reqEnvironmentIDs {
@@ -790,6 +787,9 @@ func (s *NotificationService) getAllowedEnvironments(
 				filterEnvironmentIDs = append(filterEnvironmentIDs, e.EnvironmentId)
 			}
 		}
+	} else {
+		// if the user is an admin or owner, no need to filter environments.
+		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
 	}
 	return filterEnvironmentIDs
 }

pkg/push/api/api.go

@@ -1095,10 +1095,7 @@ func (s *PushService) getAllowedEnvironments(
 	editor *eventproto.Editor,
 ) []string {
 	filterEnvironmentIDs := make([]string, 0)
-	if editor.OrganizationRole == accountproto.AccountV2_Role_Organization_ADMIN || editor.IsAdmin {
-		// if the user is an admin, no need to filter environments.
-		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
-	} else {
+	if editor.OrganizationRole == accountproto.AccountV2_Role_Organization_MEMBER {
 		// only show API keys in allowed environments for member.
 		if len(reqEnvironmentIDs) > 0 {
 			for _, id := range reqEnvironmentIDs {
@@ -1114,6 +1111,9 @@ func (s *PushService) getAllowedEnvironments(
 				filterEnvironmentIDs = append(filterEnvironmentIDs, e.EnvironmentId)
 			}
 		}
+	} else {
+		// if the user is an admin, no need to filter environments.
+		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
 	}
 	return filterEnvironmentIDs
 }

pkg/tag/api/api.go

@@ -645,10 +645,7 @@ func (s *TagService) getAllowedEnvironments(
 	editor *eventproto.Editor,
 ) []string {
 	filterEnvironmentIDs := make([]string, 0)
-	if editor.OrganizationRole == accproto.AccountV2_Role_Organization_ADMIN || editor.IsAdmin {
-		// if the user is an admin, no need to filter environments.
-		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
-	} else {
+	if editor.OrganizationRole == accproto.AccountV2_Role_Organization_MEMBER {
 		// only show API keys in allowed environments for member.
 		if len(reqEnvironmentIDs) > 0 {
 			for _, id := range reqEnvironmentIDs {
@@ -664,6 +661,9 @@ func (s *TagService) getAllowedEnvironments(
 				filterEnvironmentIDs = append(filterEnvironmentIDs, e.EnvironmentId)
 			}
 		}
+	} else {
+		// if the user is an admin, no need to filter environments.
+		filterEnvironmentIDs = append(filterEnvironmentIDs, reqEnvironmentIDs...)
 	}
 	return filterEnvironmentIDs
 }