10903462393

Committed 17 Sep 2024 12:53PM UTC coverage: 13.685% (-0.02%) from 13.709%

Build # 10903462393

Build Type

Pull #9231

github

Committed by

web-flow

Commit Message

Merge 5d8f25e34 into 81f186948

Pull Request Pull Request #9231: Restructures auth builder to prioritize comment and thread over community

Run Details

3030 of 20592 branches covered (14.71%)

Branch coverage included in aggregate %.

18 of 19 new or added lines in 1 file covered. (94.74%)

1 existing line in 1 file now uncovered.

3962 of 30501 relevant lines covered (12.99%)

3.93 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

84.92

/libs/model/src/middleware/authorization.ts

import {
  Actor,
  INVALID_ACTOR_ERROR,
  InvalidActor,
  InvalidInput,
  type Context,
  type Handler,
} from '@hicommonwealth/core';
import { Group, GroupPermissionAction } from '@hicommonwealth/schemas';
import { Role } from '@hicommonwealth/shared';
import { Op, QueryTypes } from 'sequelize';
import { ZodSchema, z } from 'zod';
import { models } from '../database';
import type {
  AddressInstance,
  CommentInstance,
  ThreadInstance,
  TopicInstance,
} from '../models';

export type AuthContext = {
  address: AddressInstance | null;
  community_id?: string | null;
  topic_id?: number | null;
  thread_id?: number | null;
  comment_id?: number | null;
  topic?: TopicInstance | null;
  thread?: ThreadInstance | null;
  comment?: CommentInstance | null;
  author_address_id?: number;
  is_author: boolean;
  is_collaborator?: boolean;
};

export type AuthHandler<Input extends ZodSchema = ZodSchema> = Handler<
  Input,
  ZodSchema,
  AuthContext
>;

export class BannedActor extends InvalidActor {
  constructor(public actor: Actor) {
    super(actor, 'Banned User');
    this.name = INVALID_ACTOR_ERROR;
  }
}

export class NonMember extends InvalidActor {
  constructor(
    public actor: Actor,
    public topic: string,
    public action: GroupPermissionAction,
  ) {
    super(
      actor,
      `User does not have permission to perform action ${action} in topic ${topic}`,
    );
    this.name = INVALID_ACTOR_ERROR;
  }
}

export class RejectedMember extends InvalidActor {
  constructor(
    public actor: Actor,
    public reasons: string[],
  ) {
    super(actor, reasons.join(', '));
    this.name = INVALID_ACTOR_ERROR;
  }
}

/**
 * Builds authorization context
 *
 * TODO: Keep developing this pattern for other entities!
 * The idea is that authorized requests could include aggregate ids that should be pre-loaded
 * and authorized by prefilling the authorization context.
 *
 * Currenlty, the waterfall is:
 * 1. by comment_id
 * 3. or by thread_id
 * 2. or by community_id (community_id or id)
 *
 * TODO: Find ways to cache() by args to avoid db trips
 *
 * @param ctx execution context
 * @param roles community roles filter when authorizing specific roles
 * @param collaborators flag to include thread collaborators when preloading threads
 * @returns authorization context
 */
async function buildAuth(
  ctx: Context<ZodSchema, AuthContext>,
  roles: Role[],
  collaborators = false,
): Promise<AuthContext> {
  const { actor, payload } = ctx;
  if (!actor.address)
    throw new InvalidActor(ctx.actor, 'Must provide an address');

  const { id, community_id, topic_id, thread_id, comment_id } = payload;
  const auth: AuthContext = {
    address: null,
    is_author: false,
    community_id: community_id || id,
    topic_id,
    thread_id,
    comment_id,
  };
  (ctx as { auth: AuthContext }).auth = auth;

  if (auth.comment_id) {
    auth.comment = await models.Comment.findOne({
      where: { id: auth.comment_id },
      include: [
        {
          model: models.Thread,
          required: true,
        },
      ],
    });
    if (!auth.comment)
      throw new InvalidInput('Must provide a valid comment id');
    auth.community_id = auth.comment.Thread!.community_id;
    auth.topic_id = auth.comment.Thread!.topic_id;
    auth.thread_id = auth.comment.Thread!.id;
    auth.author_address_id = auth.comment.address_id;
  } else if (auth.thread_id) {
    const include = collaborators
      ? {
          model: models.Address,
          as: 'collaborators',
          required: false,
        }
      : undefined;
    auth.thread = await models.Thread.findOne({
      where: { id: auth.thread_id },
      include,
    });
    if (!auth.thread) throw new InvalidInput('Must provide a valid thread id');
    auth.community_id = auth.thread.community_id;
    auth.topic_id = auth.thread.topic_id;
    auth.author_address_id = auth.thread.address_id;
  } else if (!auth.community_id)
    throw new InvalidInput('Must provide a community id');

  auth.address = await models.Address.findOne({
    where: {
      user_id: actor.user.id,
      address: actor.address,
      community_id: auth.community_id,
      role: { [Op.in]: roles },
    },
    order: [['role', 'DESC']],
  });
  if (!auth.address)
    throw new InvalidActor(actor, `User is not ${roles} in the community`);

  auth.is_author = auth.address!.id === auth.author_address_id;

  // fire and forget address activity tracking
  auth.address.last_active = new Date();
  void auth.address.save();

  return auth;
}

/**
 * Checks if actor passes a set of requirements and grants access for all groups of the given topic
 */
async function isTopicMember(
  actor: Actor,
  auth: AuthContext,
  action: GroupPermissionAction,
): Promise<void> {
  if (!auth.topic_id) throw new InvalidInput('Must provide a topic id');

  auth.topic = await models.Topic.findOne({ where: { id: auth.topic_id } });
  if (!auth.topic) throw new InvalidInput('Topic not found');

  if (auth.topic.group_ids?.length === 0) return;

  const groups = await models.sequelize.query<
    z.infer<typeof Group> & {
      allowed_actions?: GroupPermissionAction[];
    }
  >(
    `
    SELECT g.*, gp.allowed_actions
    FROM "Groups" as g 
    LEFT JOIN "GroupPermissions" gp ON g.id = gp.group_id
    WHERE g.community_id = :community_id AND g.id IN (:group_ids);
    `,
    {
      type: QueryTypes.SELECT,
      raw: true,
      replacements: {
        community_id: auth.topic.community_id,
        group_ids: auth.topic.group_ids,
      },
    },
  );

  // There are 2 cases here. We either have the old group permission system where the group doesn't have
  // any allowed_actions, or we have the new fine-grained permission system where the action must be in
  // the allowed_actions list.
  const allowed = groups.filter(
    (g) => !g.allowed_actions || g.allowed_actions.includes(action),
  );
  if (!allowed.length!) throw new NonMember(actor, auth.topic.name, action);

  // check membership for all groups of topic
  const memberships = await models.Membership.findAll({
    where: {
      group_id: { [Op.in]: allowed.map((g) => g.id!) },
      address_id: auth.address!.id,
    },
    include: [
      {
        model: models.Group,
        as: 'group',
      },
    ],
  });
  if (!memberships.length) throw new NonMember(actor, auth.topic.name, action);

  const rejects = memberships.filter((m) => m.reject_reason);
  if (rejects.length === memberships.length)
    throw new RejectedMember(
      actor,
      rejects.flatMap((reject) =>
        reject.reject_reason!.map((reason) => reason.message),
      ),
    );
}

//  MIDDLEWARE
export const isSuperAdmin: AuthHandler = async (ctx) => {
  if (!ctx.actor.user.isAdmin)
    await Promise.reject(new InvalidActor(ctx.actor, 'Must be a super admin'));
};

/**
 * Validates if actor's address is authorized by checking in the following order:
 * - 1. **in roles**: User address must be in the provided community roles
 * - 2. **admin**: Allows all operations when the user is an admin or super admin (god mode, site admin)
 * - 3. **not banned**: Reject if address is banned
 * - 4. **topic group**: Allows when address has group permissions in topic
 * - 5. **author**: Allows when address is the creator of the entity
 * - 6. **collaborators**: Allows when address is a collaborator
 *
 * @param roles specific community roles - all by default
 * @param action specific group permission action
 * @param collaborators authorize thread collaborators
 * @throws InvalidActor when not authorized
 */
export function isAuthorized({
  roles = ['admin', 'moderator', 'member'],
  action,
  collaborators = false,
}: {
  roles?: Role[];
  action?: GroupPermissionAction;
  collaborators?: boolean;
}): AuthHandler {
  return async (ctx) => {
    const isAdmin = ctx.actor.user.isAdmin;

    const auth = await buildAuth(
      ctx,
      isAdmin ? ['admin', 'moderator', 'member'] : roles,
      collaborators,
    );

    if (isAdmin || auth.address?.role === 'admin') return;

    if (auth.address!.is_banned) throw new BannedActor(ctx.actor);

    if (action) {
      // waterfall stops here after validating the action
      await isTopicMember(ctx.actor, auth, action);
      return;
    }

    if (auth.is_author) return;

    if (collaborators) {
      const found = auth.thread?.collaborators?.find(
        ({ address }) => address === ctx.actor.address,
      );
      auth.is_collaborator = !!found;
      if (auth.is_collaborator) return;
      throw new InvalidActor(ctx.actor, 'Not authorized collaborator');
    }

    // at this point, the address is either a moderator or member
    // without any action or collaboration requirements
  };
}

1	import {
2	Actor,
3	INVALID_ACTOR_ERROR,
4	InvalidActor,
5	InvalidInput,
6	type Context,
7	type Handler,
8	} from '@hicommonwealth/core';
9	import { Group, GroupPermissionAction } from '@hicommonwealth/schemas';
10	import { Role } from '@hicommonwealth/shared';
11	import { Op, QueryTypes } from 'sequelize';
12	import { ZodSchema, z } from 'zod';
13	import { models } from '../database';
14	import type {
15	AddressInstance,
16	CommentInstance,
17	ThreadInstance,
18	TopicInstance,
19	} from '../models';
20
21	export type AuthContext = {
22	address: AddressInstance \| null;
23	community_id?: string \| null;
24	topic_id?: number \| null;
25	thread_id?: number \| null;
26	comment_id?: number \| null;
27	topic?: TopicInstance \| null;
28	thread?: ThreadInstance \| null;
29	comment?: CommentInstance \| null;
30	author_address_id?: number;
31	is_author: boolean;
32	is_collaborator?: boolean;
33	};
34
35	export type AuthHandler<Input extends ZodSchema = ZodSchema> = Handler<
36	Input,
37	ZodSchema,
38	AuthContext
39	>;
40
41	export class BannedActor extends InvalidActor {
42	constructor(public actor: Actor) {	1✔
43	super(actor, 'Banned User');	1✔
44	this.name = INVALID_ACTOR_ERROR;	1✔
45	}
46	}
47
48	export class NonMember extends InvalidActor {
49	constructor(
50	public actor: Actor,	4✔
51	public topic: string,	4✔
52	public action: GroupPermissionAction,	4✔
53	) {
54	super(	4✔
55	actor,
56	`User does not have permission to perform action ${action} in topic ${topic}`,
57	);
58	this.name = INVALID_ACTOR_ERROR;	4✔
59	}
60	}
61
62	export class RejectedMember extends InvalidActor {
63	constructor(
64	public actor: Actor,	1✔
65	public reasons: string[],	1✔
66	) {
67	super(actor, reasons.join(', '));	1✔
68	this.name = INVALID_ACTOR_ERROR;	1✔
69	}
70	}
71
72	/**
73	* Builds authorization context
74	*
75	* TODO: Keep developing this pattern for other entities!
76	* The idea is that authorized requests could include aggregate ids that should be pre-loaded
77	* and authorized by prefilling the authorization context.
78	*
79	* Currenlty, the waterfall is:
80	* 1. by comment_id
81	* 3. or by thread_id
82	* 2. or by community_id (community_id or id)
83	*
84	* TODO: Find ways to cache() by args to avoid db trips
85	*
86	* @param ctx execution context
87	* @param roles community roles filter when authorizing specific roles
88	* @param collaborators flag to include thread collaborators when preloading threads
89	* @returns authorization context
90	*/
91	async function buildAuth(
92	ctx: Context<ZodSchema, AuthContext>,
93	roles: Role[],
94	collaborators = false,	×
95	): Promise<AuthContext> {
96	const { actor, payload } = ctx;	88✔
97	if (!actor.address)	88!
98	throw new InvalidActor(ctx.actor, 'Must provide an address');	×
99
100	const { id, community_id, topic_id, thread_id, comment_id } = payload;	88✔
101	const auth: AuthContext = {	88✔
102	address: null,
103	is_author: false,
104	community_id: community_id \|\| id,	342✔
105	topic_id,
106	thread_id,
107	comment_id,
108	};
109	(ctx as { auth: AuthContext }).auth = auth;	88✔
110
111	if (auth.comment_id) {	88✔
112	auth.comment = await models.Comment.findOne({	7✔
113	where: { id: auth.comment_id },
114	include: [
115	{
116	model: models.Thread,
117	required: true,
118	},
119	],
120	});
121	if (!auth.comment)	7✔
122	throw new InvalidInput('Must provide a valid comment id');	2✔
123	auth.community_id = auth.comment.Thread!.community_id;	5✔
124	auth.topic_id = auth.comment.Thread!.topic_id;	5✔
125	auth.thread_id = auth.comment.Thread!.id;	5✔
126	auth.author_address_id = auth.comment.address_id;	5✔
127	} else if (auth.thread_id) {	81✔
128	const include = collaborators	34✔
129	? {
130	model: models.Address,
131	as: 'collaborators',
132	required: false,
133	}
134	: undefined;
135	auth.thread = await models.Thread.findOne({	34✔
136	where: { id: auth.thread_id },
137	include,
138	});
139	if (!auth.thread) throw new InvalidInput('Must provide a valid thread id');	34✔
140	auth.community_id = auth.thread.community_id;	32✔
141	auth.topic_id = auth.thread.topic_id;	32✔
142	auth.author_address_id = auth.thread.address_id;	32✔
143	} else if (!auth.community_id)	47!
NEW 144	throw new InvalidInput('Must provide a community id');	×
145
146	auth.address = await models.Address.findOne({	84✔
147	where: {
148	user_id: actor.user.id,
149	address: actor.address,
150	community_id: auth.community_id,
151	role: { [Op.in]: roles },
152	},
153	order: [['role', 'DESC']],
154	});
155	if (!auth.address)	84✔
156	throw new InvalidActor(actor, `User is not ${roles} in the community`);	5✔
157
158	auth.is_author = auth.address!.id === auth.author_address_id;	79✔
159
160	// fire and forget address activity tracking
161	auth.address.last_active = new Date();	79✔
162	void auth.address.save();	79✔
163
164	return auth;	79✔
165	}
166
167	/**
168	* Checks if actor passes a set of requirements and grants access for all groups of the given topic
169	*/
170	async function isTopicMember(
171	actor: Actor,
172	auth: AuthContext,
173	action: GroupPermissionAction,
174	): Promise<void> {
175	if (!auth.topic_id) throw new InvalidInput('Must provide a topic id');	25!
176
177	auth.topic = await models.Topic.findOne({ where: { id: auth.topic_id } });	25✔
178	if (!auth.topic) throw new InvalidInput('Topic not found');	25!
179
180	if (auth.topic.group_ids?.length === 0) return;	25!
181
182	const groups = await models.sequelize.query<	25✔
183	z.infer<typeof Group> & {
184	allowed_actions?: GroupPermissionAction[];
185	}
186	>(
187	`
188	SELECT g.*, gp.allowed_actions
189	FROM "Groups" as g
190	LEFT JOIN "GroupPermissions" gp ON g.id = gp.group_id
191	WHERE g.community_id = :community_id AND g.id IN (:group_ids);
192	`,
193	{
194	type: QueryTypes.SELECT,
195	raw: true,
196	replacements: {
197	community_id: auth.topic.community_id,
198	group_ids: auth.topic.group_ids,
199	},
200	},
201	);
202
203	// There are 2 cases here. We either have the old group permission system where the group doesn't have
204	// any allowed_actions, or we have the new fine-grained permission system where the action must be in
205	// the allowed_actions list.
206	const allowed = groups.filter(	25✔
207	(g) => !g.allowed_actions \|\| g.allowed_actions.includes(action),	50✔
208	);
209	if (!allowed.length!) throw new NonMember(actor, auth.topic.name, action);	25!
210
211	// check membership for all groups of topic
212	const memberships = await models.Membership.findAll({	25✔
213	where: {
214	group_id: { [Op.in]: allowed.map((g) => g.id!) },	25✔
215	address_id: auth.address!.id,
216	},
217	include: [
218	{
219	model: models.Group,
220	as: 'group',
221	},
222	],
223	});
224	if (!memberships.length) throw new NonMember(actor, auth.topic.name, action);	25✔
225
226	const rejects = memberships.filter((m) => m.reject_reason);	21✔
227	if (rejects.length === memberships.length)	21✔
228	throw new RejectedMember(	1✔
229	actor,
230	rejects.flatMap((reject) =>
231	reject.reject_reason!.map((reason) => reason.message),	1✔
232	),
233	);
234	}
235
236	// MIDDLEWARE
237	export const isSuperAdmin: AuthHandler = async (ctx) => {	17✔
238	if (!ctx.actor.user.isAdmin)	×
239	await Promise.reject(new InvalidActor(ctx.actor, 'Must be a super admin'));	×
240	};
241
242	/**
243	* Validates if actor's address is authorized by checking in the following order:
244	* - 1. in roles: User address must be in the provided community roles
245	* - 2. admin: Allows all operations when the user is an admin or super admin (god mode, site admin)
246	* - 3. not banned: Reject if address is banned
247	* - 4. topic group: Allows when address has group permissions in topic
248	* - 5. author: Allows when address is the creator of the entity
249	* - 6. collaborators: Allows when address is a collaborator
250	*
251	* @param roles specific community roles - all by default
252	* @param action specific group permission action
253	* @param collaborators authorize thread collaborators
254	* @throws InvalidActor when not authorized
255	*/
256	export function isAuthorized({
257	roles = ['admin', 'moderator', 'member'],	92✔
258	action,
259	collaborators = false,	154✔
260	}: {
261	roles?: Role[];
262	action?: GroupPermissionAction;
263	collaborators?: boolean;
264	}): AuthHandler {
265	return async (ctx) => {	89✔
266	const isAdmin = ctx.actor.user.isAdmin;	88✔
267
268	const auth = await buildAuth(	88✔
269	ctx,
270	isAdmin ? ['admin', 'moderator', 'member'] : roles,	176✔
271	collaborators,
272	);
273
274	if (isAdmin \|\| auth.address?.role === 'admin') return;	79✔
275
276	if (auth.address!.is_banned) throw new BannedActor(ctx.actor);	32✔
277
278	if (action) {	31✔
279	// waterfall stops here after validating the action
280	await isTopicMember(ctx.actor, auth, action);	25✔
281	return;	20✔
282	}
283
284	if (auth.is_author) return;	6✔
285
286	if (collaborators) {	5!
287	const found = auth.thread?.collaborators?.find(	5✔
288	({ address }) => address === ctx.actor.address,	7✔
289	);
290	auth.is_collaborator = !!found;	5✔
291	if (auth.is_collaborator) return;	5!
292	throw new InvalidActor(ctx.actor, 'Not authorized collaborator');	×
293	}
294
295	// at this point, the address is either a moderator or member
296	// without any action or collaboration requirements
297	};
298	}

hicommonwealth / commonwealth / 10903462393

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous