Organizations (#712)

* untested, unformatted, un-refactored

* minor simplification

* simplification fix

* refactoring, changes

* some fixes

* fixes, refactoring

* missed cache

* revs

* revs - more!

* removed donation links; added all org members to route

* renamed slug to title

---------

Co-authored-by: Geometrically <18202329+Geometrically@users.noreply.github.com>

src/database/models/ids.rs

@@ -62,6 +62,13 @@ generate_ids!(
     "SELECT EXISTS(SELECT 1 FROM teams WHERE id=$1)",
     TeamId
 );
+generate_ids!(
+    pub generate_organization_id,
+    OrganizationId,
+    8,
+    "SELECT EXISTS(SELECT 1 FROM organizations WHERE id=$1)",
+    OrganizationId
+);
 generate_ids!(
     pub generate_collection_id,
     CollectionId,
@@ -145,17 +152,21 @@ generate_ids!(
     ImageId
 );
 
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Type, Serialize, Deserialize)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Type, Hash, Serialize, Deserialize)]
 #[sqlx(transparent)]
 pub struct UserId(pub i64);
 
-#[derive(Copy, Clone, Debug, Type, Eq, PartialEq, Serialize, Deserialize)]
+#[derive(Copy, Clone, Debug, Type, Eq, Hash, PartialEq, Serialize, Deserialize)]
 #[sqlx(transparent)]
 pub struct TeamId(pub i64);
 #[derive(Copy, Clone, Debug, Type, Serialize, Deserialize)]
 #[sqlx(transparent)]
 pub struct TeamMemberId(pub i64);
 
+#[derive(Copy, Clone, Debug, Type, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[sqlx(transparent)]
+pub struct OrganizationId(pub i64);
+
 #[derive(Copy, Clone, Debug, Type, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[sqlx(transparent)]
 pub struct ProjectId(pub i64);
@@ -259,6 +270,16 @@ impl From<TeamId> for ids::TeamId {
         ids::TeamId(id.0 as u64)
     }
 }
+impl From<ids::OrganizationId> for OrganizationId {
+    fn from(id: ids::OrganizationId) -> Self {
+        OrganizationId(id.0 as i64)
+    }
+}
+impl From<OrganizationId> for ids::OrganizationId {
+    fn from(id: OrganizationId) -> Self {
+        ids::OrganizationId(id.0 as u64)
+    }
+}
 impl From<ids::VersionId> for VersionId {
     fn from(id: ids::VersionId) -> Self {
         VersionId(id.0 as i64)

src/database/models/mod.rs

@@ -6,6 +6,7 @@ pub mod flow_item;
 pub mod ids;
 pub mod image_item;
 pub mod notification_item;
+pub mod organization_item;
 pub mod pat_item;
 pub mod project_item;
 pub mod report_item;
@@ -18,6 +19,7 @@ pub mod version_item;
 pub use collection_item::Collection;
 pub use ids::*;
 pub use image_item::Image;
+pub use organization_item::Organization;
 pub use project_item::Project;
 pub use team_item::Team;
 pub use team_item::TeamMember;

src/database/models/organization_item.rs

@@ -0,0 +1,352 @@
+use crate::models::ids::base62_impl::{parse_base62, to_base62};
+
+use super::{ids::*, TeamMember};
+use redis::cmd;
+use serde::{Deserialize, Serialize};
+
+const ORGANIZATIONS_NAMESPACE: &str = "organizations";
+const ORGANIZATIONS_TITLES_NAMESPACE: &str = "organizations_titles";
+
+const DEFAULT_EXPIRY: i64 = 1800;
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+/// An organization of users who together control one or more projects and organizations.
+pub struct Organization {
+    /// The id of the organization
+    pub id: OrganizationId,
+
+    /// The title (and slug) of the organization
+    pub title: String,
+
+    /// The associated team of the organization
+    pub team_id: TeamId,
+
+    /// The description of the organization
+    pub description: String,
+
+    /// The display icon for the organization
+    pub icon_url: Option<String>,
+    pub color: Option<u32>,
+}
+
+impl Organization {
+    pub async fn insert(
+        self,
+        transaction: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    ) -> Result<(), super::DatabaseError> {
+        sqlx::query!(
+            "
+            INSERT INTO organizations (id, title, team_id, description, icon_url, color)
+            VALUES ($1, $2, $3, $4, $5, $6)
+            ",
+            self.id.0,
+            self.title,
+            self.team_id as TeamId,
+            self.description,
+            self.icon_url,
+            self.color.map(|x| x as i32),
+        )
+        .execute(&mut *transaction)
+        .await?;
+
+        Ok(())
+    }
+
+    pub async fn get<'a, E>(
+        string: &str,
+        exec: E,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<Option<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        Self::get_many(&[string], exec, redis)
+            .await
+            .map(|x| x.into_iter().next())
+    }
+
+    pub async fn get_id<'a, 'b, E>(
+        id: OrganizationId,
+        exec: E,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<Option<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        Self::get_many_ids(&[id], exec, redis)
+            .await
+            .map(|x| x.into_iter().next())
+    }
+
+    pub async fn get_many_ids<'a, 'b, E>(
+        organization_ids: &[OrganizationId],
+        exec: E,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<Vec<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        let ids = organization_ids
+            .iter()
+            .map(|x| crate::models::ids::OrganizationId::from(*x))
+            .collect::<Vec<_>>();
+        Self::get_many(&ids, exec, redis).await
+    }
+
+    pub async fn get_many<'a, E, T: ToString>(
+        organization_strings: &[T],
+        exec: E,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<Vec<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        use futures::stream::TryStreamExt;
+
+        if organization_strings.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let mut redis = redis.get().await?;
+
+        let mut found_organizations = Vec::new();
+        let mut remaining_strings = organization_strings
+            .iter()
+            .map(|x| x.to_string())
+            .collect::<Vec<_>>();
+
+        let mut organization_ids = organization_strings
+            .iter()
+            .flat_map(|x| parse_base62(&x.to_string()).map(|x| x as i64))
+            .collect::<Vec<_>>();
+
+        organization_ids.append(
+            &mut cmd("MGET")
+                .arg(
+                    organization_strings
+                        .iter()
+                        .map(|x| {
+                            format!(
+                                "{}:{}",
+                                ORGANIZATIONS_TITLES_NAMESPACE,
+                                x.to_string().to_lowercase()
+                            )
+                        })
+                        .collect::<Vec<_>>(),
+                )
+                .query_async::<_, Vec<Option<i64>>>(&mut redis)
+                .await?
+                .into_iter()
+                .flatten()
+                .collect(),
+        );
+
+        if !organization_ids.is_empty() {
+            let organizations = cmd("MGET")
+                .arg(
+                    organization_ids
+                        .iter()
+                        .map(|x| format!("{}:{}", ORGANIZATIONS_NAMESPACE, x))
+                        .collect::<Vec<_>>(),
+                )
+                .query_async::<_, Vec<Option<String>>>(&mut redis)
+                .await?;
+
+            for organization in organizations {
+                if let Some(organization) =
+                    organization.and_then(|x| serde_json::from_str::<Organization>(&x).ok())
+                {
+                    remaining_strings.retain(|x| {
+                        &to_base62(organization.id.0 as u64) != x
+                            && organization.title.to_lowercase() != x.to_lowercase()
+                    });
+                    found_organizations.push(organization);
+                    continue;
+                }
+            }
+        }
+
+        if !remaining_strings.is_empty() {
+            let organization_ids_parsed: Vec<i64> = remaining_strings
+                .iter()
+                .flat_map(|x| parse_base62(&x.to_string()).ok())
+                .map(|x| x as i64)
+                .collect();
+
+            let organizations: Vec<Organization> = sqlx::query!(
+                "
+                SELECT o.id, o.title, o.team_id, o.description, o.icon_url, o.color
+                FROM organizations o
+                WHERE o.id = ANY($1) OR o.title = ANY($2)
+                GROUP BY o.id;
+                ",
+                &organization_ids_parsed,
+                &remaining_strings
+                    .into_iter()
+                    .map(|x| x.to_string().to_lowercase())
+                    .collect::<Vec<_>>(),
+            )
+            .fetch_many(exec)
+            .try_filter_map(|e| async {
+                Ok(e.right().map(|m| Organization {
+                    id: OrganizationId(m.id),
+                    title: m.title,
+                    team_id: TeamId(m.team_id),
+                    description: m.description,
+                    icon_url: m.icon_url,
+                    color: m.color.map(|x| x as u32),
+                }))
+            })
+            .try_collect::<Vec<Organization>>()
+            .await?;
+
+            for organization in organizations {
+                cmd("SET")
+                    .arg(format!("{}:{}", ORGANIZATIONS_NAMESPACE, organization.id.0))
+                    .arg(serde_json::to_string(&organization)?)
+                    .arg("EX")
+                    .arg(DEFAULT_EXPIRY)
+                    .query_async::<_, ()>(&mut redis)
+                    .await?;
+
+                cmd("SET")
+                    .arg(format!(
+                        "{}:{}",
+                        ORGANIZATIONS_TITLES_NAMESPACE,
+                        organization.title.to_lowercase()
+                    ))
+                    .arg(organization.id.0)
+                    .arg("EX")
+                    .arg(DEFAULT_EXPIRY)
+                    .query_async::<_, ()>(&mut redis)
+                    .await?;
+                found_organizations.push(organization);
+            }
+        }
+
+        Ok(found_organizations)
+    }
+
+    // Gets organization associated with a project ID, if it exists and there is one
+    pub async fn get_associated_organization_project_id<'a, 'b, E>(
+        project_id: ProjectId,
+        exec: E,
+    ) -> Result<Option<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        let result = sqlx::query!(
+            "
+            SELECT o.id, o.title, o.team_id, o.description, o.icon_url, o.color
+            FROM organizations o
+            LEFT JOIN mods m ON m.organization_id = o.id
+            WHERE m.id = $1
+            GROUP BY o.id;
+            ",
+            project_id as ProjectId,
+        )
+        .fetch_optional(exec)
+        .await?;
+
+        if let Some(result) = result {
+            Ok(Some(Organization {
+                id: OrganizationId(result.id),
+                title: result.title,
+                team_id: TeamId(result.team_id),
+                description: result.description,
+                icon_url: result.icon_url,
+                color: result.color.map(|x| x as u32),
+            }))
+        } else {
+            Ok(None)
+        }
+    }
+
+    pub async fn remove(
+        id: OrganizationId,
+        transaction: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<Option<()>, super::DatabaseError> {
+        use futures::TryStreamExt;
+
+        let organization = Self::get_id(id, &mut *transaction, redis).await?;
+
+        if let Some(organization) = organization {
+            let projects: Vec<ProjectId> = sqlx::query!(
+                "
+                SELECT m.id
+                FROM mods m
+                WHERE m.organization_id = $1
+                ",
+                id as OrganizationId,
+            )
+            .fetch_many(&mut *transaction)
+            .try_filter_map(|e| async { Ok(e.right().map(|m| ProjectId(m.id))) })
+            .try_collect::<Vec<ProjectId>>()
+            .await?;
+
+            for project_id in projects {
+                let _result =
+                    super::project_item::Project::remove(project_id, transaction, redis).await?;
+            }
+
+            Organization::clear_cache(id, Some(organization.title), redis).await?;
+
+            sqlx::query!(
+                "
+                DELETE FROM organizations
+                WHERE id = $1
+                ",
+                id as OrganizationId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            TeamMember::clear_cache(organization.team_id, redis).await?;
+
+            sqlx::query!(
+                "
+                DELETE FROM team_members
+                WHERE team_id = $1
+                ",
+                organization.team_id as TeamId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            sqlx::query!(
+                "
+                DELETE FROM teams
+                WHERE id = $1
+                ",
+                organization.team_id as TeamId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            Ok(Some(()))
+        } else {
+            Ok(None)
+        }
+    }
+
+    pub async fn clear_cache(
+        id: OrganizationId,
+        title: Option<String>,
+        redis: &deadpool_redis::Pool,
+    ) -> Result<(), super::DatabaseError> {
+        let mut redis = redis.get().await?;
+        let mut cmd = cmd("DEL");
+        cmd.arg(format!("{}:{}", ORGANIZATIONS_NAMESPACE, id.0));
+        if let Some(title) = title {
+            cmd.arg(format!(
+                "{}:{}",
+                ORGANIZATIONS_TITLES_NAMESPACE,
+                title.to_lowercase()
+            ));
+        }
+        cmd.query_async::<_, ()>(&mut redis).await?;
+
+        Ok(())
+    }
+}

src/database/models/project_item.rs

@@ -21,7 +21,7 @@ pub struct DonationUrl {
 }
 
 impl DonationUrl {
-    pub async fn insert(
+    pub async fn insert_project(
         &self,
         project_id: ProjectId,
         transaction: &mut sqlx::Transaction<'_, sqlx::Postgres>,
@@ -90,6 +90,7 @@ pub struct ProjectBuilder {
     pub project_id: ProjectId,
     pub project_type_id: ProjectTypeId,
     pub team_id: TeamId,
+    pub organization_id: Option<OrganizationId>,
     pub title: String,
     pub description: String,
     pub body: String,
@@ -123,6 +124,7 @@ impl ProjectBuilder {
             id: self.project_id,
             project_type: self.project_type_id,
             team_id: self.team_id,
+            organization_id: self.organization_id,
             title: self.title,
             description: self.description,
             body: self.body,
@@ -165,7 +167,9 @@ impl ProjectBuilder {
         }
 
         for donation in self.donation_urls {
-            donation.insert(self.project_id, &mut *transaction).await?;
+            donation
+                .insert_project(self.project_id, &mut *transaction)
+                .await?;
         }
 
         for gallery in self.gallery_items {
@@ -209,6 +213,7 @@ pub struct Project {
     pub id: ProjectId,
     pub project_type: ProjectTypeId,
     pub team_id: TeamId,
+    pub organization_id: Option<OrganizationId>,
     pub title: String,
     pub description: String,
     pub body: String,
@@ -553,7 +558,7 @@ impl Project {
                 m.icon_url icon_url, m.body body, m.published published,
                 m.updated updated, m.approved approved, m.queued, m.status status, m.requested_status requested_status,
                 m.issues_url issues_url, m.source_url source_url, m.wiki_url wiki_url, m.discord_url discord_url, m.license_url license_url,
-                m.team_id team_id, m.client_side client_side, m.server_side server_side, m.license license, m.slug slug, m.moderation_message moderation_message, m.moderation_message_body moderation_message_body,
+                m.team_id team_id, m.organization_id organization_id, m.client_side client_side, m.server_side server_side, m.license license, m.slug slug, m.moderation_message moderation_message, m.moderation_message_body moderation_message_body,
                 cs.name client_side_type, ss.name server_side_type, pt.name project_type_name, m.webhook_sent, m.color,
                 t.id thread_id, m.monetization_status monetization_status, m.loaders loaders, m.game_versions game_versions,
                 ARRAY_AGG(DISTINCT c.category) filter (where c.category is not null and mc.is_additional is false) categories,
@@ -589,6 +594,7 @@ impl Project {
                             id: ProjectId(id),
                             project_type: ProjectTypeId(m.project_type),
                             team_id: TeamId(m.team_id),
+                            organization_id: m.organization_id.map(OrganizationId),
                             title: m.title.clone(),
                             description: m.description.clone(),
                             downloads: m.downloads,

src/database/models/team_item.rs

@@ -1,5 +1,5 @@
-use super::ids::*;
-use crate::models::teams::Permissions;
+use super::{ids::*, Organization, Project};
+use crate::models::teams::{OrganizationPermissions, ProjectPermissions};
 use itertools::Itertools;
 use redis::cmd;
 use rust_decimal::Decimal;
@@ -14,7 +14,8 @@ pub struct TeamBuilder {
 pub struct TeamMemberBuilder {
     pub user_id: UserId,
     pub role: String,
-    pub permissions: Permissions,
+    pub permissions: ProjectPermissions,
+    pub organization_permissions: Option<OrganizationPermissions>,
     pub accepted: bool,
     pub payouts_split: Decimal,
     pub ordering: i64,
@@ -41,30 +42,20 @@ impl TeamBuilder {
 
         for member in self.members {
             let team_member_id = generate_team_member_id(&mut *transaction).await?;
-            let team_member = TeamMember {
-                id: team_member_id,
-                team_id,
-                user_id: member.user_id,
-                role: member.role,
-                permissions: member.permissions,
-                accepted: member.accepted,
-                payouts_split: member.payouts_split,
-                ordering: member.ordering,
-            };
-
             sqlx::query!(
                 "
-                INSERT INTO team_members (id, team_id, user_id, role, permissions, accepted, payouts_split, ordering)
-                VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+                INSERT INTO team_members (id, team_id, user_id, role, permissions, organization_permissions, accepted, payouts_split, ordering)
+                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
                 ",
-                team_member.id as TeamMemberId,
-                team_member.team_id as TeamId,
-                team_member.user_id as UserId,
-                team_member.role,
-                team_member.permissions.bits() as i64,
-                team_member.accepted,
-                team_member.payouts_split,
-                team_member.ordering,
+                team_member_id as TeamMemberId,
+                team.id as TeamId,
+                member.user_id as UserId,
+                member.role,
+                member.permissions.bits() as i64,
+                member.organization_permissions.map(|p| p.bits() as i64),
+                member.accepted,
+                member.payouts_split,
+                member.ordering,
             )
             .execute(&mut *transaction)
             .await?;
@@ -80,15 +71,70 @@ pub struct Team {
     pub id: TeamId,
 }
 
+#[derive(Deserialize, Serialize, Clone, Debug, Copy)]
+pub enum TeamAssociationId {
+    Project(ProjectId),
+    Organization(OrganizationId),
+}
+
+impl Team {
+    pub async fn get_association<'a, 'b, E>(
+        id: TeamId,
+        executor: E,
+    ) -> Result<Option<TeamAssociationId>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        let result = sqlx::query!(
+            "
+            SELECT m.id AS pid, NULL AS oid
+            FROM mods m
+            WHERE m.team_id = $1
+            
+            UNION ALL
+             
+            SELECT NULL AS pid, o.id AS oid
+            FROM organizations o
+            WHERE o.team_id = $1    
+            ",
+            id as TeamId
+        )
+        .fetch_optional(executor)
+        .await?;
+
+        if let Some(t) = result {
+            // Only one of project_id or organization_id will be set
+            let mut team_association_id = None;
+            if let Some(pid) = t.pid {
+                team_association_id = Some(TeamAssociationId::Project(ProjectId(pid)));
+            }
+            if let Some(oid) = t.oid {
+                team_association_id = Some(TeamAssociationId::Organization(OrganizationId(oid)));
+            }
+            return Ok(team_association_id);
+        }
+        Ok(None)
+    }
+}
+
 /// A member of a team
-#[derive(Deserialize, Serialize)]
+#[derive(Deserialize, Serialize, Clone, Debug)]
 pub struct TeamMember {
     pub id: TeamMemberId,
     pub team_id: TeamId,
+
     /// The ID of the user associated with the member
     pub user_id: UserId,
     pub role: String,
-    pub permissions: Permissions,
+
+    // The permissions of the user in this project team
+    // For an organization team, these are the fallback permissions for any project in the organization
+    pub permissions: ProjectPermissions,
+
+    // The permissions of the user in this organization team
+    // For a project team, this is None
+    pub organization_permissions: Option<OrganizationPermissions>,
+
     pub accepted: bool,
     pub payouts_split: Decimal,
     pub ordering: i64,
@@ -154,31 +200,34 @@ impl TeamMember {
         if !team_ids_parsed.is_empty() {
             let teams: Vec<TeamMember> = sqlx::query!(
                 "
-                SELECT tm.id id, tm.team_id team_id, tm.role member_role, tm.permissions permissions, tm.accepted accepted, tm.payouts_split payouts_split, tm.ordering,
-                tm.user_id user_id
-                FROM team_members tm
-                WHERE tm.team_id = ANY($1)
-                ORDER BY tm.team_id, tm.ordering
+                SELECT id, team_id, role AS member_role, permissions, organization_permissions,
+                accepted, payouts_split, 
+                ordering, user_id
+                FROM team_members
+                WHERE team_id = ANY($1)
+                ORDER BY team_id, ordering;
                 ",
                 &team_ids_parsed
             )
-                .fetch_many(exec)
-                .try_filter_map(|e| async {
-                    Ok(e.right().map(|m|
-                        TeamMember {
-                            id: TeamMemberId(m.id),
-                            team_id: TeamId(m.team_id),
-                            role: m.member_role,
-                            permissions: Permissions::from_bits(m.permissions as u64).unwrap_or_default(),
-                            accepted: m.accepted,
-                            user_id: UserId(m.user_id),
-                            payouts_split: m.payouts_split,
-                            ordering: m.ordering,
-                        }
-                    ))
-                })
-                .try_collect::<Vec<TeamMember>>()
-                .await?;
+            .fetch_many(exec)
+            .try_filter_map(|e| async {
+                Ok(e.right().map(|m| TeamMember {
+                    id: TeamMemberId(m.id),
+                    team_id: TeamId(m.team_id),
+                    role: m.member_role,
+                    permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                        .unwrap_or_default(),
+                    organization_permissions: m
+                        .organization_permissions
+                        .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
+                    accepted: m.accepted,
+                    user_id: UserId(m.user_id),
+                    payouts_split: m.payouts_split,
+                    ordering: m.ordering,
+                }))
+            })
+            .try_collect::<Vec<TeamMember>>()
+            .await?;
 
             for (id, members) in &teams.into_iter().group_by(|x| x.team_id) {
                 let mut members = members.collect::<Vec<_>>();
@@ -240,7 +289,9 @@ impl TeamMember {
 
         let team_members = sqlx::query!(
             "
-            SELECT id, team_id, user_id, role, permissions, accepted, payouts_split, ordering
+            SELECT id, team_id, role AS member_role, permissions, organization_permissions,
+            accepted, payouts_split, role,
+            ordering, user_id
             FROM team_members
             WHERE (team_id = ANY($1) AND user_id = $2 AND accepted = TRUE)
             ORDER BY ordering
@@ -256,7 +307,11 @@ impl TeamMember {
                     team_id: TeamId(m.team_id),
                     user_id,
                     role: m.role,
-                    permissions: Permissions::from_bits(m.permissions as u64).unwrap_or_default(),
+                    permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                        .unwrap_or_default(),
+                    organization_permissions: m
+                        .organization_permissions
+                        .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
                     accepted: m.accepted,
                     payouts_split: m.payouts_split,
                     ordering: m.ordering,
@@ -286,9 +341,13 @@ impl TeamMember {
     {
         let result = sqlx::query!(
             "
-            SELECT id, user_id, role, permissions, accepted, payouts_split, ordering
+            SELECT id, team_id, role AS member_role, permissions, organization_permissions,
+                accepted, payouts_split, role,
+                ordering, user_id
+                
             FROM team_members
             WHERE (team_id = $1 AND user_id = $2)
+            ORDER BY ordering
             ",
             id as TeamId,
             user_id as UserId
@@ -302,7 +361,11 @@ impl TeamMember {
                 team_id: id,
                 user_id,
                 role: m.role,
-                permissions: Permissions::from_bits(m.permissions as u64).unwrap_or_default(),
+                permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                    .unwrap_or_default(),
+                organization_permissions: m
+                    .organization_permissions
+                    .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
                 accepted: m.accepted,
                 payouts_split: m.payouts_split,
                 ordering: m.ordering,
@@ -319,10 +382,10 @@ impl TeamMember {
         sqlx::query!(
             "
             INSERT INTO team_members (
-                id, team_id, user_id, role, permissions, accepted
+                id, team_id, user_id, role, permissions, organization_permissions, accepted
             )
             VALUES (
-                $1, $2, $3, $4, $5, $6
+                $1, $2, $3, $4, $5, $6, $7
             )
             ",
             self.id as TeamMemberId,
@@ -330,6 +393,7 @@ impl TeamMember {
             self.user_id as UserId,
             self.role,
             self.permissions.bits() as i64,
+            self.organization_permissions.map(|p| p.bits() as i64),
             self.accepted,
         )
         .execute(&mut *transaction)
@@ -362,7 +426,8 @@ impl TeamMember {
     pub async fn edit_team_member(
         id: TeamId,
         user_id: UserId,
-        new_permissions: Option<Permissions>,
+        new_permissions: Option<ProjectPermissions>,
+        new_organization_permissions: Option<OrganizationPermissions>,
         new_role: Option<String>,
         new_accepted: Option<bool>,
         new_payouts_split: Option<Decimal>,
@@ -384,6 +449,21 @@ impl TeamMember {
             .await?;
         }
 
+        if let Some(organization_permissions) = new_organization_permissions {
+            sqlx::query!(
+                "
+                UPDATE team_members
+                SET organization_permissions = $1
+                WHERE (team_id = $2 AND user_id = $3)
+                ",
+                organization_permissions.bits() as i64,
+                id as TeamId,
+                user_id as UserId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+        }
+
         if let Some(role) = new_role {
             sqlx::query!(
                 "
@@ -458,7 +538,8 @@ impl TeamMember {
     {
         let result = sqlx::query!(
             "
-            SELECT tm.id, tm.team_id, tm.user_id, tm.role, tm.permissions, tm.accepted, tm.payouts_split, tm.ordering FROM mods m
+            SELECT tm.id, tm.team_id, tm.user_id, tm.role, tm.permissions, tm.organization_permissions, tm.accepted, tm.payouts_split, tm.ordering
+            FROM mods m
             INNER JOIN team_members tm ON tm.team_id = m.team_id AND user_id = $2 AND accepted = TRUE
             WHERE m.id = $1
             ",
@@ -474,7 +555,52 @@ impl TeamMember {
                 team_id: TeamId(m.team_id),
                 user_id,
                 role: m.role,
-                permissions: Permissions::from_bits(m.permissions as u64).unwrap_or_default(),
+                permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                    .unwrap_or_default(),
+                organization_permissions: m
+                    .organization_permissions
+                    .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
+                accepted: m.accepted,
+                payouts_split: m.payouts_split,
+                ordering: m.ordering,
+            }))
+        } else {
+            Ok(None)
+        }
+    }
+
+    pub async fn get_from_user_id_organization<'a, 'b, E>(
+        id: OrganizationId,
+        user_id: UserId,
+        executor: E,
+    ) -> Result<Option<Self>, super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+    {
+        let result = sqlx::query!(
+            "
+            SELECT tm.id, tm.team_id, tm.user_id, tm.role, tm.permissions, tm.organization_permissions, tm.accepted, tm.payouts_split, tm.ordering
+            FROM organizations o
+            INNER JOIN team_members tm ON tm.team_id = o.team_id AND user_id = $2 AND accepted = TRUE
+            WHERE o.id = $1
+            ",
+            id as OrganizationId,
+            user_id as UserId
+        )
+            .fetch_optional(executor)
+            .await?;
+
+        if let Some(m) = result {
+            Ok(Some(TeamMember {
+                id: TeamMemberId(m.id),
+                team_id: TeamId(m.team_id),
+                user_id,
+                role: m.role,
+                permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                    .unwrap_or_default(),
+                organization_permissions: m
+                    .organization_permissions
+                    .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
                 accepted: m.accepted,
                 payouts_split: m.payouts_split,
                 ordering: m.ordering,
@@ -494,7 +620,8 @@ impl TeamMember {
     {
         let result = sqlx::query!(
             "
-            SELECT tm.id, tm.team_id, tm.user_id, tm.role, tm.permissions, tm.accepted, tm.payouts_split, tm.ordering FROM versions v
+            SELECT tm.id, tm.team_id, tm.user_id, tm.role, tm.permissions, tm.organization_permissions, tm.accepted, tm.payouts_split, tm.ordering, v.mod_id 
+            FROM versions v
             INNER JOIN mods m ON m.id = v.mod_id
             INNER JOIN team_members tm ON tm.team_id = m.team_id AND tm.user_id = $2 AND tm.accepted = TRUE
             WHERE v.id = $1
@@ -511,7 +638,11 @@ impl TeamMember {
                 team_id: TeamId(m.team_id),
                 user_id,
                 role: m.role,
-                permissions: Permissions::from_bits(m.permissions as u64).unwrap_or_default(),
+                permissions: ProjectPermissions::from_bits(m.permissions as u64)
+                    .unwrap_or_default(),
+                organization_permissions: m
+                    .organization_permissions
+                    .map(|p| OrganizationPermissions::from_bits(p as u64).unwrap_or_default()),
                 accepted: m.accepted,
                 payouts_split: m.payouts_split,
                 ordering: m.ordering,
@@ -520,4 +651,30 @@ impl TeamMember {
             Ok(None)
         }
     }
+
+    // Gets both required members for checking permissions of an action on a project
+    // - project team member (a user's membership to a given project)
+    // - organization team member (a user's membership to a given organization that owns a given project)
+    pub async fn get_for_project_permissions<'a, 'b, E>(
+        project: &Project,
+        user_id: UserId,
+        executor: E,
+    ) -> Result<(Option<Self>, Option<Self>), super::DatabaseError>
+    where
+        E: sqlx::Executor<'a, Database = sqlx::Postgres> + Copy,
+    {
+        let project_team_member =
+            Self::get_from_user_id(project.team_id, user_id, executor).await?;
+
+        let organization =
+            Organization::get_associated_organization_project_id(project.id, executor).await?;
+
+        let organization_team_member = if let Some(organization) = &organization {
+            Self::get_from_user_id(organization.team_id, user_id, executor).await?
+        } else {
+            None
+        };
+
+        Ok((project_team_member, organization_team_member))
+    }
 }