feat: replace ID with UID

BREAKING CHANGE: remove auto incremental ids from user, group and permissions and add a virtual uid property that returns string value of documents object id
2026-01-07 06:30:06 +00:00 · 2023-05-09 15:01:56 +05:00
parent d2239f75c2
commit 093fe90589
36 changed files with 461 additions and 483 deletions
--- a/api/src/controllers/auth.ts
+++ b/api/src/controllers/auth.ts
@@ -27,14 +27,14 @@ import User from '../model/User'
@Tags('Auth')
 export class AuthController {
  static authCodes: { [key: string]: { [key: string]: string } } = {}
-  static saveCode = (userId: number, clientId: string, code: string) => {
+  static saveCode = (userId: string, clientId: string, code: string) => {
    if (AuthController.authCodes[userId])
      return (AuthController.authCodes[userId][clientId] = code)

    AuthController.authCodes[userId] = { [clientId]: code }
    return AuthController.authCodes[userId][clientId]
  }
-  static deleteCode = (userId: number, clientId: string) =>
+  static deleteCode = (userId: string, clientId: string) =>
    delete AuthController.authCodes[userId][clientId]

  /**
@@ -159,7 +159,7 @@ const updatePassword = async (
 ) => {
  const { currentPassword, newPassword } = data
  const userId = req.user?.userId
-  const dbUser = await User.findOne({ id: userId })
+  const dbUser = await User.findOne({ _id: userId })

  if (!dbUser)
    throw {
--- a/api/src/controllers/group.ts
+++ b/api/src/controllers/group.ts
@@ -12,28 +12,29 @@ import {

 import Group, { GroupPayload, PUBLIC_GROUP_NAME } from '../model/Group'
 import User from '../model/User'
-import { AuthProviderType } from '../utils'
-import { UserResponse } from './user'
+import { GetUserBy, UserResponse } from './user'

 export interface GroupResponse {
-  groupId: number
+  uid: string
  name: string
  description: string
 }

-export interface GroupDetailsResponse {
-  groupId: number
-  name: string
-  description: string
+export interface GroupDetailsResponse extends GroupResponse {
  isActive: boolean
  users: UserResponse[]
 }

 interface GetGroupBy {
-  groupId?: number
+  _id?: string
  name?: string
 }

+enum GroupAction {
+  AddUser = 'addUser',
+  RemoveUser = 'removeUser'
+}
+
@Security('bearerAuth')
@Route('SASjsApi/group')
@Tags('Group')
@@ -44,7 +45,7 @@ export class GroupController {
   */
  @Example<GroupResponse[]>([
    {
-      groupId: 123,
+      uid: 'groupIdString',
      name: 'DCGroup',
      description: 'This group represents Data Controller Users'
    }
@@ -59,7 +60,7 @@ export class GroupController {
   *
   */
  @Example<GroupDetailsResponse>({
-    groupId: 123,
+    uid: 'groupIdString',
    name: 'DCGroup',
    description: 'This group represents Data Controller Users',
    isActive: true,
@@ -78,7 +79,7 @@ export class GroupController {
   * @example dcgroup
   */
  @Get('by/groupname/{name}')
-  public async getGroupByGroupName(
+  public async getGroupByName(
    @Path() name: string
  ): Promise<GroupDetailsResponse> {
    return getGroup({ name })
@@ -86,68 +87,66 @@ export class GroupController {

  /**
   * @summary Get list of members of a group (userName). All users can request this.
-   * @param groupId The group's identifier
-   * @example groupId 1234
+   * @param uid The group's identifier
+   * @example uid "12ByteString"
   */
-  @Get('{groupId}')
-  public async getGroup(
-    @Path() groupId: number
-  ): Promise<GroupDetailsResponse> {
-    return getGroup({ groupId })
+  @Get('{uid}')
+  public async getGroup(@Path() uid: string): Promise<GroupDetailsResponse> {
+    return getGroup({ _id: uid })
  }

  /**
   * @summary Add a user to a group. Admin task only.
-   * @param groupId The group's identifier
-   * @example groupId "1234"
-   * @param userId The user's identifier
-   * @example userId "6789"
+   * @param groupUid The group's identifier
+   * @example groupUid "12ByteString"
+   * @param userUid The user's identifier
+   * @example userId "12ByteString"
   */
  @Example<GroupDetailsResponse>({
-    groupId: 123,
+    uid: 'groupIdString',
    name: 'DCGroup',
    description: 'This group represents Data Controller Users',
    isActive: true,
    users: []
  })
-  @Post('{groupId}/{userId}')
+  @Post('{groupUid}/{userUid}')
  public async addUserToGroup(
-    @Path() groupId: number,
-    @Path() userId: number
+    @Path() groupUid: string,
+    @Path() userUid: string
  ): Promise<GroupDetailsResponse> {
-    return addUserToGroup(groupId, userId)
+    return addUserToGroup(groupUid, userUid)
  }

  /**
-   * @summary Remove a user to a group. Admin task only.
-   * @param groupId The group's identifier
-   * @example groupId "1234"
-   * @param userId The user's identifier
-   * @example userId "6789"
+   * @summary Remove a user from a group. Admin task only.
+   * @param groupUid The group's identifier
+   * @example groupUid "12ByteString"
+   * @param userUid The user's identifier
+   * @example userUid "12ByteString"
   */
  @Example<GroupDetailsResponse>({
-    groupId: 123,
+    uid: 'groupIdString',
    name: 'DCGroup',
    description: 'This group represents Data Controller Users',
    isActive: true,
    users: []
  })
-  @Delete('{groupId}/{userId}')
+  @Delete('{groupUid}/{userUid}')
  public async removeUserFromGroup(
-    @Path() groupId: number,
-    @Path() userId: number
+    @Path() groupUid: string,
+    @Path() userUid: string
  ): Promise<GroupDetailsResponse> {
-    return removeUserFromGroup(groupId, userId)
+    return removeUserFromGroup(groupUid, userUid)
  }

  /**
   * @summary Delete a group. Admin task only.
-   * @param groupId The group's identifier
-   * @example groupId 1234
+   * @param uid The group's identifier
+   * @example uid "12ByteString"
   */
-  @Delete('{groupId}')
-  public async deleteGroup(@Path() groupId: number) {
-    const group = await Group.findOne({ groupId })
+  @Delete('{uid}')
+  public async deleteGroup(@Path() uid: string) {
+    const group = await Group.findOne({ _id: uid })
    if (!group)
      throw {
        code: 404,
@@ -160,9 +159,7 @@ export class GroupController {
 }

 const getAllGroups = async (): Promise<GroupResponse[]> =>
-  await Group.find({})
-    .select({ _id: 0, groupId: 1, name: 1, description: 1 })
-    .exec()
+  await Group.find({}).select('uid name description').exec()

 const createGroup = async ({
  name,
@@ -187,7 +184,7 @@ const createGroup = async ({
  const savedGroup = await group.save()

  return {
-    groupId: savedGroup.groupId,
+    uid: savedGroup.uid,
    name: savedGroup.name,
    description: savedGroup.description,
    isActive: savedGroup.isActive,
@@ -198,11 +195,12 @@ const createGroup = async ({
 const getGroup = async (findBy: GetGroupBy): Promise<GroupDetailsResponse> => {
  const group = (await Group.findOne(
    findBy,
-    'groupId name description isActive users -_id'
+    'uid name description isActive users'
  ).populate(
    'users',
-    'id username displayName isAdmin -_id'
+    'uid username displayName isAdmin'
  )) as unknown as GroupDetailsResponse
+
  if (!group)
    throw {
      code: 404,
@@ -211,7 +209,7 @@ const getGroup = async (findBy: GetGroupBy): Promise<GroupDetailsResponse> => {
    }

  return {
-    groupId: group.groupId,
+    uid: group.uid,
    name: group.name,
    description: group.description,
    isActive: group.isActive,
@@ -220,23 +218,23 @@ const getGroup = async (findBy: GetGroupBy): Promise<GroupDetailsResponse> => {
 }

 const addUserToGroup = async (
-  groupId: number,
-  userId: number
+  groupUid: string,
+  userUid: string
 ): Promise<GroupDetailsResponse> =>
-  updateUsersListInGroup(groupId, userId, 'addUser')
+  updateUsersListInGroup(groupUid, userUid, GroupAction.AddUser)

 const removeUserFromGroup = async (
-  groupId: number,
-  userId: number
+  groupUid: string,
+  userUid: string
 ): Promise<GroupDetailsResponse> =>
-  updateUsersListInGroup(groupId, userId, 'removeUser')
+  updateUsersListInGroup(groupUid, userUid, GroupAction.RemoveUser)

 const updateUsersListInGroup = async (
-  groupId: number,
-  userId: number,
-  action: 'addUser' | 'removeUser'
+  groupUid: string,
+  userUid: string,
+  action: GroupAction
 ): Promise<GroupDetailsResponse> => {
-  const group = await Group.findOne({ groupId })
+  const group = await Group.findOne({ _id: groupUid })
  if (!group)
    throw {
      code: 404,
@@ -258,7 +256,7 @@ const updateUsersListInGroup = async (
      message: `Can't add/remove user to group created by external auth provider.`
    }

-  const user = await User.findOne({ id: userId })
+  const user = await User.findOne({ _id: userUid })
  if (!user)
    throw {
      code: 404,
@@ -274,7 +272,7 @@ const updateUsersListInGroup = async (
    }

  const updatedGroup =
-    action === 'addUser'
+    action === GroupAction.AddUser
      ? await group.addUser(user)
      : await group.removeUser(user)

@@ -286,7 +284,7 @@ const updateUsersListInGroup = async (
    }

  return {
-    groupId: updatedGroup.groupId,
+    uid: updatedGroup.uid,
    name: updatedGroup.name,
    description: updatedGroup.description,
    isActive: updatedGroup.isActive,
--- a/api/src/controllers/permission.ts
+++ b/api/src/controllers/permission.ts
@@ -56,9 +56,9 @@ interface RegisterPermissionPayload {
  principalType: PrincipalType
  /**
   * The id of user or group to which a rule is assigned.
-   * @example 123
+   * @example 'groupIdString'
   */
-  principalId: number
+  principalId: string
 }

 interface UpdatePermissionPayload {
@@ -70,7 +70,7 @@ interface UpdatePermissionPayload {
 }

 export interface PermissionDetailsResponse {
-  permissionId: number
+  uid: string
  path: string
  type: string
  setting: string
@@ -91,24 +91,24 @@ export class PermissionController {
   */
  @Example<PermissionDetailsResponse[]>([
    {
-      permissionId: 123,
+      uid: 'permissionId1String',
      path: '/SASjsApi/code/execute',
      type: 'Route',
      setting: 'Grant',
      user: {
-        id: 1,
+        uid: 'user1-id',
        username: 'johnSnow01',
        displayName: 'John Snow',
        isAdmin: false
      }
    },
    {
-      permissionId: 124,
+      uid: 'permissionId2String',
      path: '/SASjsApi/code/execute',
      type: 'Route',
      setting: 'Grant',
      group: {
-        groupId: 1,
+        uid: 'group1-id',
        name: 'DCGroup',
        description: 'This group represents Data Controller Users',
        isActive: true,
@@ -128,12 +128,12 @@ export class PermissionController {
   *
   */
  @Example<PermissionDetailsResponse>({
-    permissionId: 123,
+    uid: 'permissionIdString',
    path: '/SASjsApi/code/execute',
    type: 'Route',
    setting: 'Grant',
    user: {
-      id: 1,
+      uid: 'userIdString',
      username: 'johnSnow01',
      displayName: 'John Snow',
      isAdmin: false
@@ -149,36 +149,36 @@ export class PermissionController {
  /**
   * @summary Update permission setting. Admin only
   * @param permissionId The permission's identifier
-   * @example permissionId 1234
+   * @example permissionId "permissionIdString"
   */
  @Example<PermissionDetailsResponse>({
-    permissionId: 123,
+    uid: 'permissionIdString',
    path: '/SASjsApi/code/execute',
    type: 'Route',
    setting: 'Grant',
    user: {
-      id: 1,
+      uid: 'userIdString',
      username: 'johnSnow01',
      displayName: 'John Snow',
      isAdmin: false
    }
  })
-  @Patch('{permissionId}')
+  @Patch('{uid}')
  public async updatePermission(
-    @Path() permissionId: number,
+    @Path() uid: string,
    @Body() body: UpdatePermissionPayload
  ): Promise<PermissionDetailsResponse> {
-    return updatePermission(permissionId, body)
+    return updatePermission(uid, body)
  }

  /**
   * @summary Delete a permission. Admin only.
   * @param permissionId The user's identifier
-   * @example permissionId 1234
+   * @example permissionId "permissionIdString"
   */
-  @Delete('{permissionId}')
-  public async deletePermission(@Path() permissionId: number) {
-    return deletePermission(permissionId)
+  @Delete('{uid}')
+  public async deletePermission(@Path() uid: string) {
+    return deletePermission(uid)
  }
 }

@@ -191,7 +191,7 @@ const getAllPermissions = async (
  else {
    const permissions: PermissionDetailsResponse[] = []

-    const dbUser = await User.findOne({ id: user?.userId })
+    const dbUser = await User.findOne({ _id: user?.userId })
    if (!dbUser)
      throw {
        code: 404,
@@ -227,7 +227,7 @@ const createPermission = async ({

  switch (principalType) {
    case PrincipalType.user: {
-      const userInDB = await User.findOne({ id: principalId })
+      const userInDB = await User.findOne({ _id: principalId })
      if (!userInDB)
        throw {
          code: 404,
@@ -259,7 +259,7 @@ const createPermission = async ({
      permission.user = userInDB._id

      user = {
-        id: userInDB.id,
+        uid: userInDB.uid,
        username: userInDB.username,
        displayName: userInDB.displayName,
        isAdmin: userInDB.isAdmin
@@ -267,7 +267,7 @@ const createPermission = async ({
      break
    }
    case PrincipalType.group: {
-      const groupInDB = await Group.findOne({ groupId: principalId })
+      const groupInDB = await Group.findOne({ _id: principalId })
      if (!groupInDB)
        throw {
          code: 404,
@@ -291,13 +291,13 @@ const createPermission = async ({
      permission.group = groupInDB._id

      group = {
-        groupId: groupInDB.groupId,
+        uid: groupInDB.uid,
        name: groupInDB.name,
        description: groupInDB.description,
        isActive: groupInDB.isActive,
        users: groupInDB.populate({
          path: 'users',
-          select: 'id username displayName isAdmin -_id',
+          select: 'uid username displayName isAdmin -_id',
          options: { limit: 15 }
        }) as unknown as UserResponse[]
      }
@@ -314,7 +314,7 @@ const createPermission = async ({
  const savedPermission = await permission.save()

  return {
-    permissionId: savedPermission.permissionId,
+    uid: savedPermission.uid,
    path: savedPermission.path,
    type: savedPermission.type,
    setting: savedPermission.setting,
@@ -324,27 +324,21 @@ const createPermission = async ({
 }

 const updatePermission = async (
-  id: number,
+  uid: string,
  data: UpdatePermissionPayload
 ): Promise<PermissionDetailsResponse> => {
  const { setting } = data

  const updatedPermission = (await Permission.findOneAndUpdate(
-    { permissionId: id },
+    { _id: uid },
    { setting },
    { new: true }
  )
-    .select({
-      _id: 0,
-      permissionId: 1,
-      path: 1,
-      type: 1,
-      setting: 1
-    })
-    .populate({ path: 'user', select: 'id username displayName isAdmin -_id' })
+    .select('uid path type setting')
+    .populate({ path: 'user', select: 'uid username displayName isAdmin' })
    .populate({
      path: 'group',
-      select: 'groupId name description -_id'
+      select: 'groupId name description'
    })) as unknown as PermissionDetailsResponse
  if (!updatedPermission)
    throw {
@@ -356,13 +350,13 @@ const updatePermission = async (
  return updatedPermission
 }

-const deletePermission = async (id: number) => {
-  const permission = await Permission.findOne({ permissionId: id })
+const deletePermission = async (uid: string) => {
+  const permission = await Permission.findOne({ _id: uid })
  if (!permission)
    throw {
      code: 404,
      status: 'Not Found',
      message: 'Permission not found.'
    }
-  await Permission.deleteOne({ permissionId: id })
+  await Permission.deleteOne({ _id: uid })
 }
--- a/api/src/controllers/session.ts
+++ b/api/src/controllers/session.ts
@@ -2,8 +2,9 @@ import express from 'express'
 import { Request, Security, Route, Tags, Example, Get } from 'tsoa'
 import { UserResponse } from './user'

-interface SessionResponse extends UserResponse {
-  needsToUpdatePassword: boolean
+interface SessionResponse extends Omit<UserResponse, 'uid'> {
+  id: string
+  needsToUpdatePassword?: boolean
 }

@Security('bearerAuth')
@@ -14,11 +15,12 @@ export class SessionController {
   * @summary Get session info (username).
   *
   */
-  @Example<UserResponse>({
-    id: 123,
+  @Example<SessionResponse>({
+    id: 'userIdString',
    username: 'johnusername',
    displayName: 'John',
-    isAdmin: false
+    isAdmin: false,
+    needsToUpdatePassword: false
  })
  @Get('/')
  public async session(
--- a/api/src/controllers/user.ts
+++ b/api/src/controllers/user.ts
@@ -26,18 +26,14 @@ import {
 import { GroupController, GroupResponse } from './group'

 export interface UserResponse {
-  id: number
+  uid: string
  username: string
  displayName: string
  isAdmin: boolean
 }

-export interface UserDetailsResponse {
-  id: number
-  displayName: string
-  username: string
+export interface UserDetailsResponse extends UserResponse {
  isActive: boolean
-  isAdmin: boolean
  autoExec?: string
  groups?: GroupResponse[]
 }
@@ -52,13 +48,13 @@ export class UserController {
   */
  @Example<UserResponse[]>([
    {
-      id: 123,
+      uid: 'userIdString',
      username: 'johnusername',
      displayName: 'John',
      isAdmin: false
    },
    {
-      id: 456,
+      uid: 'anotherUserIdString',
      username: 'starkusername',
      displayName: 'Stark',
      isAdmin: true
@@ -74,7 +70,7 @@ export class UserController {
   *
   */
  @Example<UserDetailsResponse>({
-    id: 1234,
+    uid: 'userIdString',
    displayName: 'John Snow',
    username: 'johnSnow01',
    isAdmin: false,
@@ -111,20 +107,20 @@ export class UserController {
   * Only Admin or user itself will get user autoExec code.
   * @summary Get user properties - such as group memberships, userName, displayName.
   * @param userId The user's identifier
-   * @example userId 1234
+   * @example userId "userIdString"
   */
-  @Get('{userId}')
+  @Get('{uid}')
  public async getUser(
    @Request() req: express.Request,
-    @Path() userId: number
+    @Path() uid: string
  ): Promise<UserDetailsResponse> {
    const { MODE } = process.env

    if (MODE === ModeType.Desktop) return getDesktopAutoExec()

    const { user } = req
-    const getAutoExec = user!.isAdmin || user!.userId == userId
-    return getUser({ id: userId }, getAutoExec)
+    const getAutoExec = user!.isAdmin || user!.userId === uid
+    return getUser({ _id: uid }, getAutoExec)
  }

  /**
@@ -133,7 +129,7 @@ export class UserController {
   * @example username "johnSnow01"
   */
  @Example<UserDetailsResponse>({
-    id: 1234,
+    uid: 'userIdString',
    displayName: 'John Snow',
    username: 'johnSnow01',
    isAdmin: false,
@@ -158,7 +154,7 @@ export class UserController {
   * @example userId "1234"
   */
  @Example<UserDetailsResponse>({
-    id: 1234,
+    uid: 'userIdString',
    displayName: 'John Snow',
    username: 'johnSnow01',
    isAdmin: false,
@@ -166,7 +162,7 @@ export class UserController {
  })
  @Patch('{userId}')
  public async updateUser(
-    @Path() userId: number,
+    @Path() userId: string,
    @Body() body: UserPayload
  ): Promise<UserDetailsResponse> {
    const { MODE } = process.env
@@ -174,7 +170,7 @@ export class UserController {
    if (MODE === ModeType.Desktop)
      return updateDesktopAutoExec(body.autoExec ?? '')

-    return updateUser({ id: userId }, body)
+    return updateUser({ _id: userId }, body)
  }

  /**
@@ -198,18 +194,16 @@ export class UserController {
   */
  @Delete('{userId}')
  public async deleteUser(
-    @Path() userId: number,
+    @Path() userId: string,
    @Body() body: { password?: string },
    @Query() @Hidden() isAdmin: boolean = false
  ) {
-    return deleteUser({ id: userId }, isAdmin, body)
+    return deleteUser({ _id: userId }, isAdmin, body)
  }
 }

 const getAllUsers = async (): Promise<UserResponse[]> =>
-  await User.find({})
-    .select({ _id: 0, id: 1, username: 1, displayName: 1, isAdmin: 1 })
-    .exec()
+  await User.find({}).select('uid username displayName isAdmin').exec()

 const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {
  const { displayName, username, password, isAdmin, isActive, autoExec } = data
@@ -239,15 +233,15 @@ const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {

  const groupController = new GroupController()
  const allUsersGroup = await groupController
-    .getGroupByGroupName(ALL_USERS_GROUP.name)
+    .getGroupByName(ALL_USERS_GROUP.name)
    .catch(() => {})

  if (allUsersGroup) {
-    await groupController.addUserToGroup(allUsersGroup.groupId, savedUser.id)
+    await groupController.addUserToGroup(allUsersGroup.uid, savedUser.uid)
  }

  return {
-    id: savedUser.id,
+    uid: savedUser.uid,
    displayName: savedUser.displayName,
    username: savedUser.username,
    isActive: savedUser.isActive,
@@ -256,8 +250,8 @@ const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {
  }
 }

-interface GetUserBy {
-  id?: number
+export interface GetUserBy {
+  _id?: string
  username?: string
 }

@@ -267,10 +261,10 @@ const getUser = async (
 ): Promise<UserDetailsResponse> => {
  const user = (await User.findOne(
    findBy,
-    `id displayName username isActive isAdmin autoExec -_id`
+    `uid displayName username isActive isAdmin autoExec`
  ).populate(
    'groups',
-    'groupId name description -_id'
+    'uid name description'
  )) as unknown as UserDetailsResponse

  if (!user)
@@ -280,7 +274,7 @@ const getUser = async (
    }

  return {
-    id: user.id,
+    uid: user.uid,
    displayName: user.displayName,
    username: user.username,
    isActive: user.isActive,
@@ -293,7 +287,7 @@ const getUser = async (
 const getDesktopAutoExec = async () => {
  return {
    ...desktopUser,
-    id: desktopUser.userId,
+    uid: desktopUser.userId,
    autoExec: await getUserAutoExec()
  }
 }
@@ -329,8 +323,8 @@ const updateUser = async (
    const usernameExist = await User.findOne({ username })
    if (usernameExist) {
      if (
-        (findBy.id && usernameExist.id != findBy.id) ||
-        (findBy.username && usernameExist.username != findBy.username)
+        (findBy._id && usernameExist.uid !== findBy._id) ||
+        (findBy.username && usernameExist.username !== findBy.username)
      )
        throw {
          code: 409,
@@ -350,11 +344,11 @@ const updateUser = async (
  if (!updatedUser)
    throw {
      code: 404,
-      message: `Unable to find user with ${findBy.id || findBy.username}`
+      message: `Unable to find user with ${findBy._id || findBy.username}`
    }

  return {
-    id: updatedUser.id,
+    uid: updatedUser.uid,
    username: updatedUser.username,
    displayName: updatedUser.displayName,
    isAdmin: updatedUser.isAdmin,
@@ -367,7 +361,7 @@ const updateDesktopAutoExec = async (autoExec: string) => {
  await updateUserAutoExec(autoExec)
  return {
    ...desktopUser,
-    id: desktopUser.userId,
+    uid: desktopUser.userId,
    autoExec
  }
 }
--- a/api/src/middlewares/authenticateToken.ts
+++ b/api/src/middlewares/authenticateToken.ts
@@ -76,7 +76,7 @@ const authenticateToken = async (
  const { MODE } = process.env
  if (MODE === ModeType.Desktop) {
    req.user = {
-      userId: 1234,
+      userId: '1234',
      clientId: 'desktopModeClientId',
      username: 'desktopModeUsername',
      displayName: 'desktopModeDisplayName',
--- a/api/src/middlewares/authorize.ts
+++ b/api/src/middlewares/authorize.ts
@@ -18,7 +18,7 @@ export const authorize: RequestHandler = async (req, res, next) => {
  // no need to check for permissions when route is Public
  if (await isPublicRoute(req)) return next()

-  const dbUser = await User.findOne({ id: user.userId })
+  const dbUser = await User.findOne({ _id: user.userId })
  if (!dbUser) return res.sendStatus(401)

  const path = getPath(req)
--- a/api/src/middlewares/desktop.ts
+++ b/api/src/middlewares/desktop.ts
@@ -28,7 +28,7 @@ export const desktopRestrict: RequestHandler = (req, res, next) => {
 }

 export const desktopUser: RequestUser = {
-  userId: 12345,
+  userId: '12345',
  clientId: 'desktop_app',
  username: userInfo().username,
  displayName: userInfo().username,
--- a/api/src/middlewares/verifyAdminIfNeeded.ts
+++ b/api/src/middlewares/verifyAdminIfNeeded.ts
@@ -9,7 +9,7 @@ export const verifyAdminIfNeeded: RequestHandler = (req, res, next) => {
    let adminAccountRequired: boolean = true

    if (req.params.userId) {
-      adminAccountRequired = user?.userId !== parseInt(req.params.userId)
+      adminAccountRequired = user?.userId !== req.params.userId
    } else if (req.params.username) {
      adminAccountRequired = user?.username !== req.params.username
    }
--- a/api/src/model/Group.ts
+++ b/api/src/model/Group.ts
@@ -1,9 +1,9 @@
 import { Schema, model, Document, Model } from 'mongoose'
 import { GroupDetailsResponse } from '../controllers'
 import User, { IUser } from './User'
-import { AuthProviderType, getSequenceNextValue } from '../utils'
+import { AuthProviderType } from '../utils'

-export const PUBLIC_GROUP_NAME = 'Public'
+export const PUBLIC_GROUP_NAME = 'public'

 export interface GroupPayload {
  /**
@@ -24,10 +24,12 @@ export interface GroupPayload {
 }

 interface IGroupDocument extends GroupPayload, Document {
-  groupId: number
  isActive: boolean
  users: Schema.Types.ObjectId[]
  authProvider?: AuthProviderType
+
+  // Declare virtual properties as read-only properties
+  readonly uid: string
 }

 interface IGroup extends IGroupDocument {
@@ -37,40 +39,46 @@ interface IGroup extends IGroupDocument {
 }
 interface IGroupModel extends Model<IGroup> {}

-const groupSchema = new Schema<IGroupDocument>({
-  name: {
-    type: String,
-    required: true,
-    unique: true
-  },
-  groupId: {
-    type: Number,
-    unique: true
-  },
-  description: {
-    type: String,
-    default: 'Group description.'
-  },
-  authProvider: {
-    type: String,
-    enum: AuthProviderType
-  },
-  isActive: {
-    type: Boolean,
-    default: true
-  },
-  users: [{ type: Schema.Types.ObjectId, ref: 'User' }]
-})
-
-// Hooks
-groupSchema.pre('save', async function () {
-  if (this.isNew) {
-    this.groupId = await getSequenceNextValue('groupId')
+const opts = {
+  toJSON: {
+    virtuals: true,
+    transform: function (doc: any, ret: any, options: any) {
+      delete ret._id
+      delete ret.id
+      return ret
+    }
  }
+}
+const groupSchema = new Schema<IGroupDocument>(
+  {
+    name: {
+      type: String,
+      required: true,
+      unique: true
+    },
+    description: {
+      type: String,
+      default: 'Group description.'
+    },
+    authProvider: {
+      type: String,
+      enum: AuthProviderType
+    },
+    isActive: {
+      type: Boolean,
+      default: true
+    },
+    users: [{ type: Schema.Types.ObjectId, ref: 'User' }]
+  },
+  opts
+)
+
+groupSchema.virtual('uid').get(function () {
+  return this._id.toString()
 })

 groupSchema.post('save', function (group: IGroup, next: Function) {
-  group.populate('users', 'id username displayName -_id').then(function () {
+  group.populate('users', 'uid username displayName').then(function () {
    next()
  })
 })
--- a/api/src/model/Permission.ts
+++ b/api/src/model/Permission.ts
@@ -1,6 +1,5 @@
 import { Schema, model, Document, Model } from 'mongoose'
 import { PermissionDetailsResponse } from '../controllers'
-import { getSequenceNextValue } from '../utils'

 interface GetPermissionBy {
  user?: Schema.Types.ObjectId
@@ -11,9 +10,11 @@ interface IPermissionDocument extends Document {
  path: string
  type: string
  setting: string
-  permissionId: number
  user: Schema.Types.ObjectId
  group: Schema.Types.ObjectId
+
+  // Declare virtual properties as read-only properties
+  readonly uid: string
 }

 interface IPermission extends IPermissionDocument {}
@@ -22,32 +23,39 @@ interface IPermissionModel extends Model<IPermission> {
  get(getBy: GetPermissionBy): Promise<PermissionDetailsResponse[]>
 }

-const permissionSchema = new Schema<IPermissionDocument>({
-  permissionId: {
-    type: Number,
-    unique: true
-  },
-  path: {
-    type: String,
-    required: true
-  },
-  type: {
-    type: String,
-    required: true
-  },
-  setting: {
-    type: String,
-    required: true
-  },
-  user: { type: Schema.Types.ObjectId, ref: 'User' },
-  group: { type: Schema.Types.ObjectId, ref: 'Group' }
-})
-
-// Hooks
-permissionSchema.pre('save', async function () {
-  if (this.isNew) {
-    this.permissionId = await getSequenceNextValue('permissionId')
+const opts = {
+  toJSON: {
+    virtuals: true,
+    transform: function (doc: any, ret: any, options: any) {
+      delete ret._id
+      delete ret.id
+      return ret
+    }
  }
+}
+
+const permissionSchema = new Schema<IPermissionDocument>(
+  {
+    path: {
+      type: String,
+      required: true
+    },
+    type: {
+      type: String,
+      required: true
+    },
+    setting: {
+      type: String,
+      required: true
+    },
+    user: { type: Schema.Types.ObjectId, ref: 'User' },
+    group: { type: Schema.Types.ObjectId, ref: 'Group' }
+  },
+  opts
+)
+
+permissionSchema.virtual('uid').get(function () {
+  return this._id.toString()
 })

 // Static Methods
@@ -55,20 +63,14 @@ permissionSchema.static('get', async function (getBy: GetPermissionBy): Promise<
  PermissionDetailsResponse[]
 > {
  return (await this.find(getBy)
-    .select({
-      _id: 0,
-      permissionId: 1,
-      path: 1,
-      type: 1,
-      setting: 1
-    })
-    .populate({ path: 'user', select: 'id username displayName isAdmin -_id' })
+    .select('uid path type setting')
+    .populate({ path: 'user', select: 'uid username displayName isAdmin' })
    .populate({
      path: 'group',
-      select: 'groupId name description -_id',
+      select: 'uid name description',
      populate: {
        path: 'users',
-        select: 'id username displayName isAdmin -_id',
+        select: 'uid username displayName isAdmin',
        options: { limit: 15 }
      }
    })) as unknown as PermissionDetailsResponse[]
--- a/api/src/model/User.ts
+++ b/api/src/model/User.ts
@@ -1,4 +1,4 @@
-import { Schema, model, Document, Model } from 'mongoose'
+import { Schema, model, Document, Model, ObjectId } from 'mongoose'
 import bcrypt from 'bcryptjs'
 import { AuthProviderType, getSequenceNextValue } from '../utils'

@@ -36,7 +36,6 @@ export interface UserPayload {

 interface IUserDocument extends UserPayload, Document {
  _id: Schema.Types.ObjectId
-  id: number
  isAdmin: boolean
  isActive: boolean
  needsToUpdatePassword: boolean
@@ -44,6 +43,9 @@ interface IUserDocument extends UserPayload, Document {
  groups: Schema.Types.ObjectId[]
  tokens: [{ [key: string]: string }]
  authProvider?: AuthProviderType
+
+  // Declare virtual properties as read-only properties
+  readonly uid: string
 }

 export interface IUser extends IUserDocument {
@@ -54,70 +56,74 @@ export interface IUser extends IUserDocument {
 interface IUserModel extends Model<IUser> {
  hashPassword(password: string): string
 }
-
-const userSchema = new Schema<IUserDocument>({
-  displayName: {
-    type: String,
-    required: true
-  },
-  username: {
-    type: String,
-    required: true,
-    unique: true
-  },
-  id: {
-    type: Number,
-    unique: true
-  },
-  password: {
-    type: String,
-    required: true
-  },
-  authProvider: {
-    type: String,
-    enum: AuthProviderType
-  },
-  isAdmin: {
-    type: Boolean,
-    default: false
-  },
-  isActive: {
-    type: Boolean,
-    default: true
-  },
-  needsToUpdatePassword: {
-    type: Boolean,
-    default: true
-  },
-  autoExec: {
-    type: String
-  },
-  groups: [{ type: Schema.Types.ObjectId, ref: 'Group' }],
-  tokens: [
-    {
-      clientId: {
-        type: String,
-        required: true
-      },
-      accessToken: {
-        type: String,
-        required: true
-      },
-      refreshToken: {
-        type: String,
-        required: true
-      }
+const opts = {
+  toJSON: {
+    virtuals: true,
+    transform: function (doc: any, ret: any, options: any) {
+      delete ret._id
+      delete ret.id
+      return ret
    }
-  ]
-})
-
-// Hooks
-userSchema.pre('save', async function (next) {
-  if (this.isNew) {
-    this.id = await getSequenceNextValue('id')
  }
+}

-  next()
+const userSchema = new Schema<IUserDocument>(
+  {
+    displayName: {
+      type: String,
+      required: true
+    },
+    username: {
+      type: String,
+      required: true,
+      unique: true
+    },
+    password: {
+      type: String,
+      required: true
+    },
+    authProvider: {
+      type: String,
+      enum: AuthProviderType
+    },
+    isAdmin: {
+      type: Boolean,
+      default: false
+    },
+    isActive: {
+      type: Boolean,
+      default: true
+    },
+    needsToUpdatePassword: {
+      type: Boolean,
+      default: true
+    },
+    autoExec: {
+      type: String
+    },
+    groups: [{ type: Schema.Types.ObjectId, ref: 'Group' }],
+    tokens: [
+      {
+        clientId: {
+          type: String,
+          required: true
+        },
+        accessToken: {
+          type: String,
+          required: true
+        },
+        refreshToken: {
+          type: String,
+          required: true
+        }
+      }
+    ]
+  },
+  opts
+)
+
+userSchema.virtual('uid').get(function () {
+  return this._id.toString()
 })

 // Static Methods
--- a/api/src/routes/api/group.ts
+++ b/api/src/routes/api/group.ts
@@ -33,12 +33,12 @@ groupRouter.get('/', authenticateAccessToken, async (req, res) => {
  }
 })

-groupRouter.get('/:groupId', authenticateAccessToken, async (req, res) => {
-  const { groupId } = req.params
+groupRouter.get('/:uid', authenticateAccessToken, async (req, res) => {
+  const { uid } = req.params

  const controller = new GroupController()
  try {
-    const response = await controller.getGroup(parseInt(groupId))
+    const response = await controller.getGroup(uid)
    res.send(response)
  } catch (err: any) {
    res.status(err.code).send(err.message)
@@ -56,7 +56,7 @@ groupRouter.get(

    const controller = new GroupController()
    try {
-      const response = await controller.getGroupByGroupName(name)
+      const response = await controller.getGroupByName(name)
      res.send(response)
    } catch (err: any) {
      res.status(err.code).send(err.message)
@@ -65,18 +65,33 @@ groupRouter.get(
 )

 groupRouter.post(
-  '/:groupId/:userId',
+  '/:groupUid/:userUid',
  authenticateAccessToken,
  verifyAdmin,
  async (req, res) => {
-    const { groupId, userId } = req.params
+    const { groupUid, userUid } = req.params

    const controller = new GroupController()
    try {
-      const response = await controller.addUserToGroup(
-        parseInt(groupId),
-        parseInt(userId)
-      )
+      const response = await controller.addUserToGroup(groupUid, userUid)
+      res.send(response)
+    } catch (err: any) {
+      console.log('err :>> ', err)
+      res.status(err.code).send(err.message)
+    }
+  }
+)
+
+groupRouter.delete(
+  '/:groupUid/:userUid',
+  authenticateAccessToken,
+  verifyAdmin,
+  async (req, res) => {
+    const { groupUid, userUid } = req.params
+
+    const controller = new GroupController()
+    try {
+      const response = await controller.removeUserFromGroup(groupUid, userUid)
      res.send(response)
    } catch (err: any) {
      res.status(err.code).send(err.message)
@@ -85,35 +100,15 @@ groupRouter.post(
 )

 groupRouter.delete(
-  '/:groupId/:userId',
+  '/:uid',
  authenticateAccessToken,
  verifyAdmin,
  async (req, res) => {
-    const { groupId, userId } = req.params
+    const { uid } = req.params

    const controller = new GroupController()
    try {
-      const response = await controller.removeUserFromGroup(
-        parseInt(groupId),
-        parseInt(userId)
-      )
-      res.send(response)
-    } catch (err: any) {
-      res.status(err.code).send(err.message)
-    }
-  }
-)
-
-groupRouter.delete(
-  '/:groupId',
-  authenticateAccessToken,
-  verifyAdmin,
-  async (req, res) => {
-    const { groupId } = req.params
-
-    const controller = new GroupController()
-    try {
-      await controller.deleteGroup(parseInt(groupId))
+      await controller.deleteGroup(uid)
      res.status(200).send('Group Deleted!')
    } catch (err: any) {
      res.status(err.code).send(err.message)
--- a/api/src/routes/api/permission.ts
+++ b/api/src/routes/api/permission.ts
@@ -34,14 +34,14 @@ permissionRouter.post('/', verifyAdmin, async (req, res) => {
  }
 })

-permissionRouter.patch('/:permissionId', verifyAdmin, async (req: any, res) => {
-  const { permissionId } = req.params
+permissionRouter.patch('/:uid', verifyAdmin, async (req: any, res) => {
+  const { uid } = req.params

  const { error, value: body } = updatePermissionValidation(req.body)
  if (error) return res.status(400).send(error.details[0].message)

  try {
-    const response = await controller.updatePermission(permissionId, body)
+    const response = await controller.updatePermission(uid, body)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code
@@ -50,20 +50,16 @@ permissionRouter.patch('/:permissionId', verifyAdmin, async (req: any, res) => {
  }
 })

-permissionRouter.delete(
-  '/:permissionId',
-  verifyAdmin,
-  async (req: any, res) => {
-    const { permissionId } = req.params
+permissionRouter.delete('/:uid', verifyAdmin, async (req: any, res) => {
+  const { uid } = req.params

-    try {
-      await controller.deletePermission(permissionId)
-      res.status(200).send('Permission Deleted!')
-    } catch (err: any) {
-      const statusCode = err.code
-      delete err.code
-      res.status(statusCode).send(err.message)
-    }
+  try {
+    await controller.deletePermission(uid)
+    res.status(200).send('Permission Deleted!')
+  } catch (err: any) {
+    const statusCode = err.code
+    delete err.code
+    res.status(statusCode).send(err.message)
  }
-)
+})
 export default permissionRouter
--- a/api/src/routes/api/user.ts
+++ b/api/src/routes/api/user.ts
@@ -56,12 +56,12 @@ userRouter.get(
  }
 )

-userRouter.get('/:userId', authenticateAccessToken, async (req, res) => {
-  const { userId } = req.params
+userRouter.get('/:uid', authenticateAccessToken, async (req, res) => {
+  const { uid } = req.params

  const controller = new UserController()
  try {
-    const response = await controller.getUser(req, parseInt(userId))
+    const response = await controller.getUser(req, uid)
    res.send(response)
  } catch (err: any) {
    res.status(err.code).send(err.message)
@@ -97,12 +97,12 @@ userRouter.patch(
 )

 userRouter.patch(
-  '/:userId',
+  '/:uid',
  authenticateAccessToken,
  verifyAdminIfNeeded,
  async (req, res) => {
    const { user } = req
-    const { userId } = req.params
+    const { uid } = req.params

    // only an admin can update `isActive` and `isAdmin` fields
    const { error, value: body } = updateUserValidation(req.body, user!.isAdmin)
@@ -110,7 +110,7 @@ userRouter.patch(

    const controller = new UserController()
    try {
-      const response = await controller.updateUser(parseInt(userId), body)
+      const response = await controller.updateUser(uid, body)
      res.send(response)
    } catch (err: any) {
      res.status(err.code).send(err.message)
@@ -147,12 +147,12 @@ userRouter.delete(
 )

 userRouter.delete(
-  '/:userId',
+  '/:uid',
  authenticateAccessToken,
  verifyAdminIfNeeded,
  async (req, res) => {
    const { user } = req
-    const { userId } = req.params
+    const { uid } = req.params

    // only an admin can delete user without providing password
    const { error, value: data } = deleteUserValidation(req.body, user!.isAdmin)
@@ -160,7 +160,7 @@ userRouter.delete(

    const controller = new UserController()
    try {
-      await controller.deleteUser(parseInt(userId), data, user!.isAdmin)
+      await controller.deleteUser(uid, data, user!.isAdmin)
      res.status(200).send('Account Deleted!')
    } catch (err: any) {
      res.status(err.code).send(err.message)
--- a/api/src/types/InfoJWT.ts
+++ b/api/src/types/InfoJWT.ts
@@ -1,4 +1,4 @@
 export interface InfoJWT {
  clientId: string
-  userId: number
+  userId: string
 }
--- a/api/src/types/PreProgramVars.ts
+++ b/api/src/types/PreProgramVars.ts
@@ -1,6 +1,6 @@
 export interface PreProgramVars {
  username: string
-  userId: number
+  userId: string
  displayName: string
  serverUrl: string
  httpHeaders: string[]
--- a/api/src/types/RequestUser.ts
+++ b/api/src/types/RequestUser.ts
@@ -1,5 +1,5 @@
 export interface RequestUser {
-  userId: number
+  userId: string
  clientId: string
  username: string
  displayName: string
--- a/api/src/utils/getPreProgramVariables.ts
+++ b/api/src/utils/getPreProgramVariables.ts
@@ -22,7 +22,7 @@ export const getPreProgramVariables = (req: Request): PreProgramVars => {
  //So this is workaround.
  return {
    username: user ? user.username : 'demo',
-    userId: user ? user.userId : 0,
+    userId: user ? user.userId : 'demoId',
    displayName: user ? user.displayName : 'demo',
    serverUrl: protocol + host,
    httpHeaders
--- a/api/src/utils/getTokensFromDB.ts
+++ b/api/src/utils/getTokensFromDB.ts
@@ -4,7 +4,7 @@ import User from '../model/User'
 const isValidToken = async (
  token: string,
  key: string,
-  userId: number,
+  userId: string,
  clientId: string
 ) => {
  const promise = new Promise<boolean>((resolve, reject) =>
@@ -22,8 +22,8 @@ const isValidToken = async (
  return await promise.then(() => true).catch(() => false)
 }

-export const getTokensFromDB = async (userId: number, clientId: string) => {
-  const user = await User.findOne({ id: userId })
+export const getTokensFromDB = async (userId: string, clientId: string) => {
+  const user = await User.findOne({ _id: userId })
  if (!user) return

  const currentTokenObj = user.tokens.find(
--- a/api/src/utils/isPublicRoute.ts
+++ b/api/src/utils/isPublicRoute.ts
@@ -22,7 +22,7 @@ export const isPublicRoute = async (req: Request): Promise<boolean> => {
 }

 export const publicUser: RequestUser = {
-  userId: 0,
+  userId: 'public_user_id',
  clientId: 'public_app',
  username: 'publicUser',
  displayName: 'Public User',
--- a/api/src/utils/removeTokensInDB.ts
+++ b/api/src/utils/removeTokensInDB.ts
@@ -1,7 +1,7 @@
 import User from '../model/User'

-export const removeTokensInDB = async (userId: number, clientId: string) => {
-  const user = await User.findOne({ id: userId })
+export const removeTokensInDB = async (userId: string, clientId: string) => {
+  const user = await User.findOne({ _id: userId })
  if (!user) return

  const tokenObjIndex = user.tokens.findIndex(
--- a/api/src/utils/saveTokensInDB.ts
+++ b/api/src/utils/saveTokensInDB.ts
@@ -1,12 +1,12 @@
 import User from '../model/User'

 export const saveTokensInDB = async (
-  userId: number,
+  userId: string,
  clientId: string,
  accessToken: string,
  refreshToken: string
 ) => {
-  const user = await User.findOne({ id: userId })
+  const user = await User.findOne({ _id: userId })
  if (!user) return

  const currentTokenObj = user.tokens.find(
--- a/api/src/utils/seedDB.ts
+++ b/api/src/utils/seedDB.ts
@@ -82,7 +82,7 @@ export const seedDB = async (): Promise<ConfigurationType> => {
 }

 export const ALL_USERS_GROUP = {
-  name: 'AllUsers',
+  name: 'all-users',
  description: 'Group contains all users'
 }

--- a/api/src/utils/validation.ts
+++ b/api/src/utils/validation.ts
@@ -113,7 +113,7 @@ export const registerPermissionValidation = (data: any): Joi.ValidationResult =>
    principalType: Joi.string()
      .required()
      .valid(...Object.values(PrincipalType)),
-    principalId: Joi.number().required()
+    principalId: Joi.string().required()
  }).validate(data)

 export const updatePermissionValidation = (data: any): Joi.ValidationResult =>
--- a/api/src/utils/verifyTokenInDB.ts
+++ b/api/src/utils/verifyTokenInDB.ts
@@ -4,7 +4,7 @@ import { RequestUser } from '../types'
 export const fetchLatestAutoExec = async (
  reqUser: RequestUser
 ): Promise<RequestUser | undefined> => {
-  const dbUser = await User.findOne({ id: reqUser.userId })
+  const dbUser = await User.findOne({ _id: reqUser.userId })

  if (!dbUser) return undefined

@@ -26,7 +26,7 @@ export const verifyTokenInDB = async (
  token: string,
  tokenType: 'accessToken' | 'refreshToken'
 ): Promise<RequestUser | undefined> => {
-  const dbUser = await User.findOne({ id: userId })
+  const dbUser = await User.findOne({ _id: userId })

  if (!dbUser) return undefined