Add Cedar policy editor to group creation and edit dialogs

Expose cedarPolicy through backend API (DTOs, responses, use cases) and
add Monaco-based code editor to group-add-dialog and group-name-edit-dialog
in the Angular frontend, allowing users to write Cedar authorization policies
when creating or editing user groups.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gugu

backend/src/entities/connection/application/data-structures/create-group-in-connection.ds.ts

@@ -2,6 +2,7 @@ export class CreateGroupInConnectionDs {
 	group_parameters: {
 		title: string;
 		connectionId: string;
+		cedarPolicy?: string | null;
 	};
 	creation_info: {
 		cognitoUserName: string;

backend/src/entities/connection/application/dto/create-group-in-connection.dto.ts

@@ -1,9 +1,14 @@
 import { ApiProperty } from '@nestjs/swagger';
-import { IsNotEmpty, IsString } from 'class-validator';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 export class CreateGroupInConnectionDTO {
 	@IsNotEmpty()
 	@IsString()
 	@ApiProperty()
 	title: string;
+
+	@IsOptional()
+	@IsString()
+	@ApiProperty({ required: false, nullable: true })
+	cedarPolicy?: string | null;
 }

backend/src/entities/connection/application/dto/found-user-groups-in-connection.dto.ts

@@ -12,6 +12,9 @@ export class FoundGroupInConnectionDTO {
 	@ApiProperty()
 	isMain: boolean;
 
+	@ApiProperty({ required: false, nullable: true })
+	cedarPolicy?: string | null;
+
 	@ApiProperty({ required: false, isArray: true, type: SimpleFoundUserInfoDs })
 	users?: Array<SimpleFoundUserInfoDs>;
 }

backend/src/entities/connection/connection.controller.ts

@@ -22,11 +22,7 @@ import { AmplitudeEventTypeEnum, InTransactionEnum } from '../../enums/index.js'
 import { Messages } from '../../exceptions/text/messages.js';
 import { processExceptionMessage } from '../../exceptions/utils/process-exception-message.js';
 import { ConnectionEditGuard, ConnectionReadGuard } from '../../guards/index.js';
-import {
-	isConnectionTypeAgent,
-	slackPostMessage,
-	toPrettyErrorsMsg,
-} from '../../helpers/index.js';
+import { isConnectionTypeAgent, slackPostMessage, toPrettyErrorsMsg } from '../../helpers/index.js';
 import { SentryInterceptor } from '../../interceptors/index.js';
 import { SuccessResponse } from '../../microservices/saas-microservice/data-structures/common-responce.ds.js';
 import { AmplitudeService } from '../amplitude/amplitude.service.js';
@@ -413,14 +409,15 @@ export class ConnectionController {
 		@SlugUuid('connectionId') connectionId: string,
 		@UserId() userId: string,
 	): Promise<FoundGroupResponseDto> {
-		const { title } = groupData;
+		const { title, cedarPolicy } = groupData;
 		if (!title) {
 			throw new BadRequestException(Messages.GROUP_TITLE_MISSING);
 		}
 		const inputData: CreateGroupInConnectionDs = {
 			group_parameters: {
 				title: title,
 				connectionId: connectionId,
+				cedarPolicy: cedarPolicy,
 			},
 			creation_info: {
 				cognitoUserName: userId,
@@ -689,5 +686,4 @@ export class ConnectionController {
 		}
 		return await this.unfreezeConnectionUseCase.execute({ connectionId, userId }, InTransactionEnum.ON);
 	}
-
 }

backend/src/entities/connection/use-cases/create-group-in-connection.use.case.ts

@@ -26,7 +26,7 @@ export class CreateGroupInConnectionUseCase
 
 	protected async implementation(inputData: CreateGroupInConnectionDs): Promise<FoundGroupResponseDto> {
 		const {
-			group_parameters: { connectionId, title },
+			group_parameters: { connectionId, title, cedarPolicy },
 			creation_info: { cognitoUserName },
 		} = inputData;
 		const connectionToUpdate = await this._dbContext.connectionRepository.findConnectionWithGroups(connectionId);
@@ -36,15 +36,13 @@ export class CreateGroupInConnectionUseCase
 		const foundUser = await this._dbContext.userRepository.findOneUserById(cognitoUserName);
 		const newGroupEntity = buildNewGroupEntityForConnectionWithUser(connectionToUpdate, foundUser, title);
 		const savedGroup = await this._dbContext.groupRepository.saveNewOrUpdatedGroup(newGroupEntity);
-		savedGroup.cedarPolicy = generateCedarPolicyForGroup(
-			connectionId,
-			false,
-			{
+		savedGroup.cedarPolicy =
+			cedarPolicy ??
+			generateCedarPolicyForGroup(connectionId, false, {
 				connection: { connectionId, accessLevel: AccessLevelEnum.none },
 				group: { groupId: savedGroup.id, accessLevel: AccessLevelEnum.none },
 				tables: [],
-			},
-		);
+			});
 		await this._dbContext.groupRepository.saveNewOrUpdatedGroup(savedGroup);
 		Cacher.invalidateCedarPolicyCache(connectionId);
 		return buildFoundGroupResponseDto(savedGroup);

backend/src/entities/connection/utils/build-found-user-group-in-connection-dto.util.ts

@@ -12,6 +12,7 @@ export function buildFoundUserGroupInConnectionDto(
 			id: group.id,
 			title: group.title,
 			isMain: group.isMain,
+			cedarPolicy: group.cedarPolicy,
 			users: group.users?.length ? group.users.map((user) => buildSimpleUserInfoDs(user)) : undefined,
 		},
 		accessLevel,

backend/src/entities/group/application/data-sctructures/found-user-groups.ds.ts

@@ -11,6 +11,9 @@ export class FoundGroupDataInfoDs {
 
 	@ApiProperty()
 	isMain: boolean;
+
+	@ApiProperty({ required: false, nullable: true })
+	cedarPolicy?: string | null;
 }
 
 export class FoundGroupDataWithUsersDs extends FoundGroupDataInfoDs {

backend/src/entities/group/dto/found-group-response.dto.ts

@@ -11,6 +11,9 @@ export class FoundGroupResponseDto {
 	@ApiProperty()
 	isMain: boolean;
 
+	@ApiProperty({ required: false, nullable: true })
+	cedarPolicy?: string | null;
+
 	@ApiProperty({ required: false, isArray: true, type: SimpleFoundUserInfoDs })
 	users?: Array<SimpleFoundUserInfoDs>;
 }

backend/src/entities/group/dto/update-group-title.dto.ts

@@ -1,5 +1,5 @@
 import { ApiProperty } from '@nestjs/swagger';
-import { IsNotEmpty, IsString, IsUUID } from 'class-validator';
+import { IsNotEmpty, IsOptional, IsString, IsUUID } from 'class-validator';
 
 export class UpdateGroupTitleDto {
 	@ApiProperty()
@@ -12,4 +12,9 @@ export class UpdateGroupTitleDto {
 	@IsNotEmpty()
 	@IsUUID()
 	groupId: string;
+
+	@IsOptional()
+	@IsString()
+	@ApiProperty({ required: false, nullable: true })
+	cedarPolicy?: string | null;
 }

backend/src/entities/group/use-cases/update-group-title.use.case.ts

@@ -3,6 +3,7 @@ import AbstractUseCase from '../../../common/abstract-use.case.js';
 import { IGlobalDatabaseContext } from '../../../common/application/global-database-context.interface.js';
 import { BaseType } from '../../../common/data-injection.tokens.js';
 import { Messages } from '../../../exceptions/text/messages.js';
+import { Cacher } from '../../../helpers/cache/cacher.js';
 import { FoundGroupDataInfoDs } from '../application/data-sctructures/found-user-groups.ds.js';
 import { UpdateGroupTitleDto } from '../dto/update-group-title.dto.js';
 import { IUpdateGroupTitle } from './use-cases.interfaces.js';
@@ -20,7 +21,7 @@ export class UpdateGroupTitleUseCase
 	}
 
 	protected async implementation(groupData: UpdateGroupTitleDto): Promise<FoundGroupDataInfoDs> {
-		const { groupId, title } = groupData;
+		const { groupId, title, cedarPolicy } = groupData;
 		const groupToUpdate = await this._dbContext.groupRepository.findGroupByIdWithConnectionAndUsers(groupId);
 		if (!groupToUpdate) {
 			throw new HttpException(
@@ -34,16 +35,21 @@ export class UpdateGroupTitleUseCase
 			groupToUpdate.connection.id,
 		);
 
-		if (connectionWithGroups.groups.find((group) => group.title === title)) {
+		if (connectionWithGroups.groups.find((group) => group.title === title && group.id !== groupId)) {
 			throw new BadRequestException(Messages.GROUP_NAME_UNIQUE);
 		}
 
 		groupToUpdate.title = title;
+		if (cedarPolicy !== undefined) {
+			groupToUpdate.cedarPolicy = cedarPolicy;
+			Cacher.invalidateCedarPolicyCache(groupToUpdate.connection.id);
+		}
 		const updatedGroup = await this._dbContext.groupRepository.saveNewOrUpdatedGroup(groupToUpdate);
 		return {
 			id: updatedGroup.id,
 			title: updatedGroup.title,
 			isMain: updatedGroup.isMain,
+			cedarPolicy: updatedGroup.cedarPolicy,
 		};
 	}
 }