Backend ceadr as default

[Artuomka]

No description provided.

[Copilot]

Pull request overview

This PR makes Cedar authorization the default backend permission system by removing legacy repository-based permission checks, introducing a Cedar-backed permissions service for use-cases, and expanding SaaS Cedar E2E coverage.

Changes:

• Removed legacy permission-check fallback paths in guards; guards now authorize exclusively via CedarAuthorizationService.
• Replaced userAccessRepository usage across multiple use-cases with a new CedarPermissionsService implementation.
• Added extensive SaaS E2E tests covering deeper Cedar permission scenarios (cross-connection isolation, admin hierarchy, table-only perms, per-action granularity).

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
backend/test/ava-tests/saas-tests/saas-cedar-permissions-e2e.test.ts	Adds many additional SaaS Cedar E2E scenarios for deep permission behavior.
backend/src/guards/table-read.guard.ts	Removes legacy permission fallback; always validates via Cedar for table read.
backend/src/guards/table-edit.guard.ts	Removes legacy permission fallback; always validates via Cedar for table edit.
backend/src/guards/table-delete.guard.ts	Removes legacy permission fallback; always validates via Cedar for table delete.
backend/src/guards/table-add.guard.ts	Removes legacy permission fallback; always validates via Cedar for table add.
backend/src/guards/group-read.guard.ts	Removes legacy permission fallback; always validates via Cedar for group read.
backend/src/guards/group-edit.guard.ts	Removes legacy permission fallback; always validates via Cedar for group edit.
backend/src/guards/dashboard-read.guard.ts	Removes legacy permission fallback; always validates via Cedar for dashboard read.
backend/src/guards/dashboard-edit.guard.ts	Removes legacy permission fallback; always validates via Cedar for dashboard edit/delete.
backend/src/guards/dashboard-create.guard.ts	Removes legacy permission fallback; always validates via Cedar for dashboard create.
backend/src/guards/connection-read.guard.ts	Removes legacy permission fallback; always validates via Cedar for connection read.
backend/src/guards/connection-edit.guard.ts	Removes legacy permission fallback; always validates via Cedar for connection edit.
backend/src/entities/table/use-cases/update-row-in-table.use.case.ts	Switches foreign-table readability checks to CedarPermissionsService.
backend/src/entities/table/use-cases/get-table-structure.use.case.ts	Switches FK readability checks to CedarPermissionsService.
backend/src/entities/table/use-cases/get-table-rows.use.case.ts	Switches table-permissions & FK readability checks to CedarPermissionsService.
backend/src/entities/table/use-cases/get-row-by-primary-key.use.case.ts	Switches table-permissions & FK/reference checks to CedarPermissionsService.
backend/src/entities/table/use-cases/find-tables-in-connection.use.case.ts	Replaces per-table permission computation with Cedar permissions batch call.
backend/src/entities/table/use-cases/find-tables-in-connection-v2.use.case.ts	Same as v1: uses Cedar permissions batch call instead of legacy logic.
backend/src/entities/table/use-cases/add-row-in-table.use.case.ts	Switches foreign-table readability checks to CedarPermissionsService.
backend/src/entities/table-logs/use-cases/find-logs.use.case.ts	Uses Cedar connection edit check for log access gating.
backend/src/entities/table-logs/use-cases/export-logs-as-csv.use.case.ts	Uses Cedar connection edit check for CSV export gating.
backend/src/entities/table-categories/use-cases/find-table-categories-with-tables.use.case.ts	Uses Cedar permissions batch call to filter visible tables.
backend/src/entities/table-actions/table-action-rules-module/use-cases/activate-actions-in-rule.use.case.ts	Uses Cedar table-read check before activating actions.
backend/src/entities/group/use-cases/find-all-user-groups.use.case.ts	Uses Cedar group access-level computation.
backend/src/entities/connection/use-cases/get-user-permissions-for-group-in-connection.use.case.ts	Uses Cedar-derived connection/group/table permissions.
backend/src/entities/connection/use-cases/get-user-groups-in-connection.use.case.ts	Uses Cedar group access-level computation.
backend/src/entities/connection/use-cases/find-one-connection.use.case.ts	Uses Cedar access checks for returned connection access level and group-read gating.
backend/src/entities/connection/use-cases/find-all-connections.use.case.ts	Uses Cedar access-level computation for connection listing.
backend/src/entities/cedar-authorization/cedar-permissions.service.ts	Introduces Cedar-backed IUserAccessRepository implementation used by use-cases.
backend/src/entities/cedar-authorization/cedar-authorization.service.ts	Makes Cedar schema initialization unconditional; removes feature-flag gating.
backend/src/entities/cedar-authorization/cedar-authorization.service.interface.ts	Removes isFeatureEnabled() from the Cedar auth service interface.
backend/src/entities/cedar-authorization/cedar-authorization.module.ts	Registers/exports CedarPermissionsService alongside CedarAuthorizationService.
backend/src/common/application/global-database-context.ts	Removes userAccessRepository from the global DB context implementation.
backend/src/common/application/global-database-context.interface.ts	Removes userAccessRepository from the global DB context interface.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.