Add multi-tenant and organization_code scoping and related updates

.coderabbit.yaml

@@ -0,0 +1,152 @@
+# yaml-language-server: $schema=https://storage.googleapis.com/coderabbit_public_assets/schema.v2.json
+
+language: en-US
+tone_instructions: ''
+early_access: false
+enable_free_tier: true
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: '@coderabbitai summary'
+  high_level_summary_in_walkthrough: false
+  auto_title_placeholder: '@coderabbitai'
+  auto_title_instructions: ''
+  review_status: true
+  commit_status: true
+  fail_commit_status: false
+  collapse_walkthrough: false
+  changed_files_summary: true
+  sequence_diagrams: true
+  estimate_code_review_effort: true
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  auto_apply_labels: false
+  suggested_reviewers: true
+  auto_assign_reviewers: false
+  poem: true
+  labeling_instructions: []
+
+  #Exclude non-source code directories from reviews.
+  path_filters:
+    - "!deployment/**"
+    - "!dev-ops/**"
+    - "!release-notes/**"
+    - "!src/api-doc/**"
+    - "!src/assets/**"
+    - "!src/configs/**"
+    - "!src/public/**"
+    - "!src/temp/**"
+    - "!**/*.md"
+
+  # Add specific review instructions for critical paths.
+  path_instructions:
+    - path: "src/services/**"
+      instructions: "This is core business logic. Please check for correctness, efficiency, and potential edge cases."
+    - path: "src/controllers/**"
+      instructions: "These are API controllers. Focus on request/response handling, security (auth middleware usage), and proper status codes."
+    - path: "src/database/queries/**"
+      instructions: "Review database queries for performance. Check for N+1 problems and ensure indexes can be used."
+    - path: "src/validators/**"
+      instructions: "Validate all incoming data thoroughly. Check for missing or incomplete validation rules."
+    - path: "src/middlewares/**"
+      instructions: "This is security-sensitive middleware. Scrutinize for potential vulnerabilities."
+
+  abort_on_close: true
+  disable_cache: false
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    ignore_title_keywords: ["WIP", "skip-review"]
+    labels: []
+    drafts: false
+    # Target reviews to development branches.
+    base_branches:
+      - "develop"
+
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: true
+  pre_merge_checks:
+    docstrings:
+      mode: warning
+      threshold: 80
+    title:
+      mode: warning
+      requirements: ''
+    description:
+      mode: warning
+    issue_assessment:
+      mode: warning
+  tools:
+    eslint:
+      enabled: true
+    semgrep:
+      enabled: true
+    dotenvLint:
+      enabled: true
+    sqlfluff:
+      enabled: true
+    checkov:
+      enabled: true
+    gitleaks:
+      enabled: true
+    hadolint:
+      enabled: true
+    shellcheck:
+      enabled: true
+    actionlint:
+      enabled: true
+    circleci:
+      enabled: true
+    github-checks:
+      enabled: true
+    markdownlint:
+      enabled: true
+    yamllint:
+      enabled: true
+    biome:
+      enabled: true
+    languagetool:
+      enabled: false  # optional
+    ast-grep:
+      essential_rules: true
+      rule_dirs: []
+      util_dirs: []
+      packages: []
+chat:
+  auto_reply: true
+  integrations:
+    jira:
+      usage: auto
+    linear:
+      usage: auto
+knowledge_base:
+  opt_out: false
+  web_search:
+    enabled: true
+  code_guidelines:
+    enabled: true
+    filePatterns: []
+  learnings:
+    scope: auto
+  issues:
+    scope: auto
+  jira:
+    usage: auto
+    project_keys: []
+  linear:
+    usage: auto
+    team_keys: []
+  pull_requests:
+    scope: auto
+code_generation:
+  docstrings:
+    language: en-US
+    path_instructions: []
+  unit_tests:
+    path_instructions: []

src/controllers/v1/account.js

@@ -184,7 +184,7 @@ module.exports = class Account {
 		try {
 			const result = await accountService.acceptTermsAndCondition(
 				req.decodedToken.id,
-				req.decodedToken.organization_id
+				req.decodedToken.tenant_code
 			)
 			return result
 		} catch (error) {

src/controllers/v1/admin.js

@@ -120,12 +120,28 @@ module.exports = class Admin {
 	}
 
 	/**
-	 * Deactivate Org
-	 * @method
-	 * @name deactivateOrg
-	 * @param {String} req.params.id - org Id.
-	 * @returns {JSON} - deactivated org response
+	 * Deactivate an organization by its ID.
+	 *
+	 * Validates that the requesting user has admin access before deactivating
+	 * the specified organization and all associated users.
+	 *
+	 * @async
+	 * @method deactivateOrg
+	 * @param {Object} req - Express request object.
+	 * @param {string} req.params.id - The unique identifier (ID or code) of the organization to deactivate.
+	 * @param {Object} req.decodedToken - Decoded JWT token of the authenticated user.
+	 * @param {string[]} req.decodedToken.roles - Roles assigned to the logged-in user.
+	 * @param {number} req.decodedToken.id - ID of the logged-in user.
+	 * @param {Object} req.headers - HTTP request headers.
+	 * @param {string} req.headers.tenant-id - Tenant code associated with the request.
+	 * @returns {Promise<Object>} Response object from `adminService.deactivateOrg`,
+	 * containing status, message, and deactivated user count.
+	 *
+	 * @throws {Object} Failure response if:
+	 *  - The user is not an admin.
+	 *  - The organization cannot be deactivated.
 	 */
+
 	async deactivateOrg(req) {
 		try {
 			if (!utilsHelper.validateRoleAccess(req.decodedToken.roles, common.ADMIN_ROLE)) {
@@ -136,7 +152,11 @@ module.exports = class Admin {
 				})
 			}
 
-			const result = await adminService.deactivateOrg(req.params.id, req.decodedToken.id)
+			const result = await adminService.deactivateOrg(
+				req.params.id,
+				req.headers?.['tenant-id'],
+				req.decodedToken.id
+			)
 			return result
 		} catch (error) {
 			return error

src/controllers/v1/entity-type.js

@@ -15,6 +15,7 @@ module.exports = class Entity {
 			return await entityTypeService.create(
 				req.body,
 				req.decodedToken.id,
+				req.decodedToken.organization_code,
 				req.decodedToken.organization_id,
 				req.decodedToken.tenant_code
 			)
@@ -37,7 +38,7 @@ module.exports = class Entity {
 				req.body,
 				req.params.id,
 				req.decodedToken.id,
-				req.decodedToken.organization_id,
+				req.decodedToken.organization_code,
 				req.decodedToken.tenant_code
 			)
 		} catch (error) {
@@ -58,14 +59,15 @@ module.exports = class Entity {
 			if (req.body.value) {
 				return await entityTypeService.readUserEntityTypes(
 					req.body,
-					req.decodedToken.id,
-					req.decodedToken.organization_id,
-					req.decodedToken.tenant_code
+					req.decodedToken.organization_code,
+					req.decodedToken.tenant_code,
+					req.decodedToken.organization_id
 				)
 			}
 			return await entityTypeService.readAllSystemEntityTypes(
-				req.decodedToken.organization_id,
-				req.decodedToken.tenant_code
+				req.decodedToken.organization_code,
+				req.decodedToken.tenant_code,
+				req.decodedToken.organization_id
 			)
 		} catch (error) {
 			return error
@@ -82,7 +84,7 @@ module.exports = class Entity {
 
 	async delete(req) {
 		try {
-			return await entityTypeService.delete(req.params.id, req.decodedToken.organization_id)
+			return await entityTypeService.delete(req.params.id, req.decodedToken.organization_code)
 		} catch (error) {
 			return error
 		}

src/controllers/v1/entity.js

@@ -22,7 +22,8 @@ module.exports = class Entity {
 			const createdEntity = await entityService.create(
 				req.body,
 				req.decodedToken.id,
-				req.decodedToken.tenant_code
+				req.decodedToken.tenant_code,
+				req.decodedToken.organization_code
 			)
 			return createdEntity
 		} catch (error) {
@@ -44,7 +45,8 @@ module.exports = class Entity {
 				req.body,
 				req.params.id,
 				req.decodedToken.id,
-				req.decodedToken.roles
+				req.decodedToken.organization_code,
+				req.decodedToken.tenant_code
 			)
 			return updatedEntity
 		} catch (error) {
@@ -63,9 +65,8 @@ module.exports = class Entity {
 	async read(req) {
 		try {
 			if (req.query.id || req.query.value) {
-				return await entityService.read(req.query, req.decodedToken.id)
+				return await entityService.read(req.query, req.decodedToken.tenant_code)
 			}
-			return await entityService.readAll(req.query, null)
 		} catch (error) {
 			return error
 		}
@@ -81,7 +82,11 @@ module.exports = class Entity {
 
 	async delete(req) {
 		try {
-			const updatedEntity = await entityService.delete(req.params.id, req.decodedToken.id)
+			const updatedEntity = await entityService.delete(
+				req.params.id,
+				req.decodedToken.organization_code,
+				req.decodedToken.tenant_code
+			)
 			return updatedEntity
 		} catch (error) {
 			return error

src/controllers/v1/org-admin.js

@@ -161,14 +161,6 @@ module.exports = class OrgAdmin {
 				})
 			}
 
-			if (!req.body.id && !req.body.email) {
-				throw responses.failureResponse({
-					message: 'EMAIL_OR_ID_REQUIRED',
-					statusCode: httpStatusCode.bad_request,
-					responseCode: 'CLIENT_ERROR',
-				})
-			}
-
 			const result = await orgAdminService.deactivateUser(req.body, req.decodedToken)
 
 			return result
@@ -193,9 +185,10 @@ module.exports = class OrgAdmin {
 					responseCode: 'CLIENT_ERROR',
 				})
 			}
-			let entityTypeDetails = orgAdminService.inheritEntityType(
+			let entityTypeDetails = await orgAdminService.inheritEntityType(
 				req.body.entity_type_value,
 				req.body.target_entity_type_label,
+				req.decodedToken.organization_code,
 				req.decodedToken.organization_id,
 				req.decodedToken.id
 			)

src/controllers/v1/organization.js

@@ -153,7 +153,8 @@ module.exports = class Organization {
 		try {
 			const result = await orgService.read(
 				req.query.organisation_id ? req.query.organisation_id : '',
-				req.query.organisation_code ? req.query.organisation_code : ''
+				req.query.organisation_code ? req.query.organisation_code : '',
+				req.query.tenant_code ? req.query.tenant_code : ''
 			)
 			return result
 		} catch (error) {