11797112764

Committed 12 Nov 2024 12:19PM UTC coverage: 72.39% (+0.1%) from 72.288%

Build Type

push

github

Committed by Gerald Baulig

Commit Message

fix(test): fix test configs

Run Details

72 of 92 branches covered (78.26%)

Branch coverage included in aggregate %.

18 of 22 new or added lines in 1 file covered. (81.82%)

40 existing lines in 2 files now uncovered.

864 of 1201 relevant lines covered (71.94%)

3.16 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

85.44

/src/service.ts

import * as _ from 'lodash-es';
import { Logger } from '@restorecommerce/logger';
import { ResourcesAPIBase, ServiceBase } from '@restorecommerce/resource-base-interface';
import { Operation, PolicySetRQResponse, ResolvedSubject } from '@restorecommerce/acs-client';
import { AuthZAction } from '@restorecommerce/acs-client';
import { checkAccessRequest, getACSFilters, resolveSubject } from './utils.js';
import * as uuid from 'uuid';
import { Response_Decision } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';
import {
  ReadRequest,
  DeleteRequest,
  DeepPartial,
  DeleteResponse,
  Resource,
  ResourceListResponse,
  ResourceList,
} from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/resource_base.js';
import { Filter_Operation, Filter_ValueType } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/filter.js';
import { Subject } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/auth.js';

export class ResourceService extends ServiceBase<ResourceListResponse, ResourceList> {
  private readonly urns: any;

  constructor(
    private readonly resourceName: string,
    resourceEvents: any,
    cfg: any,
    logger: Logger,
    resourceAPI: ResourcesAPIBase,
    isEventsEnabled: boolean,
  ) {
    super(resourceName, resourceEvents, logger, resourceAPI, isEventsEnabled);
    this.urns = cfg.get('authorization:urns');
  }

  async create(request: any, ctx: any) {
    try {
      const subject = await resolveSubject(request.subject);
      // update meta data for owners information
      request.items = await this.createMetadata(request.items, AuthZAction.CREATE, subject);
      ctx ??= {};
      ctx.subject = subject;
      ctx.resources = request.items;
      const acsResponse = await checkAccessRequest(
        ctx,
        [{ resource: this.resourceName, id: request.items.map((item: any) => item.id) }],
        AuthZAction.CREATE,
        Operation.isAllowed
      );
      if (acsResponse.decision != Response_Decision.PERMIT) {
        return { operation_status: acsResponse.operation_status };
      }
      return await super.create(request, ctx);
    } catch (err: any) {
      this.logger.error('Error occurred requesting access-control-srv', err);
      return {
        operation_status: {
          code: err.code,
          message: err.message
        }
      };
    }
  }

  async read(request: ReadRequest, ctx: any): Promise<DeepPartial<any>> {
    try {
      const subject = await resolveSubject(request.subject);
      ctx ??= {};
      ctx.subject = subject;
      ctx.resources = [];
      const acsResponse = await checkAccessRequest(
        ctx,
        [{ resource: this.resourceName }],
        AuthZAction.READ,
        Operation.whatIsAllowed
      ) as PolicySetRQResponse;

      if (acsResponse.decision != Response_Decision.PERMIT) {
        return { operation_status: acsResponse.operation_status };
      }
      const acsFilters = getACSFilters(acsResponse, this.resourceName);
      if (request.filters) {
        request.filters.push(...acsFilters);
      }
      else {
        request.filters = acsFilters;
      }

      request.custom_queries = acsResponse.custom_query_args?.flatMap(arg => arg.custom_queries);
      request.custom_arguments = acsResponse.custom_query_args?.flatMap(arg => arg.custom_arguments)[0];
      return await super.read(request, ctx);
    } catch (err: any) {
      this.logger.error('Error occurred requesting access-control-srv:', err);
      return {
        operation_status: {
          code: err.code,
          message: err.message
        }
      };
    }
  }

  async update(request: any, ctx: any) {
    try {
      const subject = await resolveSubject(request.subject);
      // update meta data for owner information
      const acsResources = await this.createMetadata(request.items, AuthZAction.MODIFY, subject);
      ctx ??= {};
      ctx.subject = subject;
      ctx.resources = acsResources;
      const acsResponse = await checkAccessRequest(
        ctx,
        [{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],
        AuthZAction.MODIFY,
        Operation.isAllowed
      );
      if (acsResponse.decision != Response_Decision.PERMIT) {
        return { operation_status: acsResponse.operation_status };
      }
      return await super.update(request, ctx);
    } catch (err: any) {
      this.logger.error('Error occurred requesting access-control-srv:', err);
      return {
        operation_status: {
          code: err.code,
          message: err.message
        }
      };
    }
  }

  async upsert(request: any, ctx: any) {
    try {
      const subject = await resolveSubject(request.subject);
      const acsResources = await this.createMetadata(request.items, AuthZAction.MODIFY, subject);
      ctx ??= {};
      ctx.subject = subject;
      ctx.resources = acsResources;
      const acsResponse = await checkAccessRequest(
        ctx,
        [{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],
        AuthZAction.MODIFY,
        Operation.isAllowed
      );
      if (acsResponse.decision != Response_Decision.PERMIT) {
        return { operation_status: acsResponse.operation_status };
      }
      return await super.upsert(request, ctx);
    } catch (err: any) {
      this.logger.error('Error occurred requesting access-control-srv:', err);
      return {
        operation_status: {
          code: err.code,
          message: err.message
        }
      };
    }
  }

  async delete(request: DeleteRequest, ctx: any): Promise<DeepPartial<DeleteResponse>> {
    try {
      const resourceIDs = request.ids;
      const resources = [];
      let acsResources = [];
      const subject = await resolveSubject(request.subject);
      let action;
      if (resourceIDs) {
        action = AuthZAction.DELETE;
        if (Array.isArray(resourceIDs)) {
          for (let id of resourceIDs) {
            resources.push({ id });
          }
        } else {
          resources.push([{ id: resourceIDs }]);
        }
        Object.assign(resources, { id: resourceIDs });
        acsResources = await this.createMetadata<any>(resources, action, subject as ResolvedSubject);
      }
      if (request.collection) {
        action = AuthZAction.DROP;
        acsResources = [{ collection: request.collection }];
      }
      ctx ??= {};
      ctx.subject = subject;
      ctx.resources = acsResources;
      const acsResponse = await checkAccessRequest(
        ctx,
        [{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],
        action,
        Operation.isAllowed
      );
      if (acsResponse.decision != Response_Decision.PERMIT) {
        return { operation_status: acsResponse.operation_status };
      }
      return await super.delete(request as any, ctx);
    } catch (err: any) {
      this.logger.error('Error occurred requesting access-control-srv:', err);
      return {
        operation_status: {
          code: err?.code,
          message: err?.message
        }
      };
    }
  }

  /**
   * reads meta data from DB and updates owners information in resource if action is UPDATE / DELETE
   * @param reaources list of resources
   * @param entity entity name
   * @param action resource action
   */
  async createMetadata<T extends Resource>(
    resources: T | T[],
    action: string,
    subject?: Subject
  ): Promise<T[]> {

    if (!Array.isArray(resources)) {
      resources = [resources];
    }

    const setDefaultMeta = (resource: T) => {
      if (!resource.id?.length) {
        resource.id = uuid.v4().replace(/-/g, '');
      }

      if (!resource.meta) {
        resource.meta = {};
        resource.meta.owners = [];

        if (subject?.scope) {
          resource.meta.owners.push(
            {
              id: this.urns.ownerIndicatoryEntity,
              value: this.urns.organization,
              attributes: [{
                id: this.urns.ownerInstance,
                value: subject.scope
              }]
            }
          );
        }

        if (subject?.id) {
          resource.meta.owners.push(
            {
              id: this.urns.ownerIndicatoryEntity,
              value: this.urns.user,
              attributes: [{
                id: this.urns.ownerInstance,
                value: subject.id
              }]
            }
          );
        }
      }
    };

    if (action === AuthZAction.MODIFY || action === AuthZAction.DELETE) {
      const ids = [
        ...new Set(
          resources.map(
            r => r.id
          ).filter(
            id => id
          )
        ).values()
      ];
      const filters = ReadRequest.fromPartial({
        filters: [
          {
            filters: [
              {
                field: 'id',
                operation: Filter_Operation.in,
                value: JSON.stringify(ids),
                type: Filter_ValueType.ARRAY
              }
            ]
          }
        ],
        limit: ids.length
      });

      const result_map = await super.read(filters, {}).then(
        resp => new Map(
          resp.items?.map(
            item => [item.payload?.id, item?.payload]
          )
        )
      );

      for (let resource of resources) {
        if (!resource.meta && result_map.has(resource?.id)) {
          resource.meta = result_map.get(resource?.id).meta;
        }
        else {
          setDefaultMeta(resource);
        }
      }
    }
    else if (action === AuthZAction.CREATE) {
      for (let resource of resources) {
        setDefaultMeta(resource);
      }
    }

    return resources;
  }
}

1	import * as _ from 'lodash-es';	1✔
2	import { Logger } from '@restorecommerce/logger';	1✔
3	import { ResourcesAPIBase, ServiceBase } from '@restorecommerce/resource-base-interface';	1✔
4	import { Operation, PolicySetRQResponse, ResolvedSubject } from '@restorecommerce/acs-client';	1✔
5	import { AuthZAction } from '@restorecommerce/acs-client';	1✔
6	import { checkAccessRequest, getACSFilters, resolveSubject } from './utils.js';	1✔
7	import * as uuid from 'uuid';	1✔
8	import { Response_Decision } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';	1✔
9	import {	1✔
10	ReadRequest,	1✔
11	DeleteRequest,	1✔
12	DeepPartial,	1✔
13	DeleteResponse,	1✔
14	Resource,	1✔
15	ResourceListResponse,	1✔
16	ResourceList,	1✔
17	} from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/resource_base.js';	1✔
18	import { Filter_Operation, Filter_ValueType } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/filter.js';	1✔
19	import { Subject } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/auth.js';	1✔
20		1✔
21	export class ResourceService extends ServiceBase<ResourceListResponse, ResourceList> {	1✔
22	private readonly urns: any;	6✔
23		6✔
24	constructor(	6✔
25	private readonly resourceName: string,	6✔
26	resourceEvents: any,	6✔
27	cfg: any,	6✔
28	logger: Logger,	6✔
29	resourceAPI: ResourcesAPIBase,	6✔
30	isEventsEnabled: boolean,	6✔
31	) {	6✔
32	super(resourceName, resourceEvents, logger, resourceAPI, isEventsEnabled);	6✔
33	this.urns = cfg.get('authorization:urns');	6✔
34	}	6✔
35		6✔
36	async create(request: any, ctx: any) {	6✔
37	try {	4✔
38	const subject = await resolveSubject(request.subject);	4✔
39	// update meta data for owners information	4✔
40	request.items = await this.createMetadata(request.items, AuthZAction.CREATE, subject);	4✔
41	ctx ??= {};	4✔
42	ctx.subject = subject;	4✔
43	ctx.resources = request.items;	4✔
44	const acsResponse = await checkAccessRequest(	4✔
45	ctx,	4✔
46	[{ resource: this.resourceName, id: request.items.map((item: any) => item.id) }],	4✔
47	AuthZAction.CREATE,	4✔
48	Operation.isAllowed	4✔
49	);	4✔
50	if (acsResponse.decision != Response_Decision.PERMIT) {	4✔
51	return { operation_status: acsResponse.operation_status };	1✔
52	}	1✔
53	return await super.create(request, ctx);	3✔
54	} catch (err: any) {	4!
55	this.logger.error('Error occurred requesting access-control-srv', err);	×
56	return {	×
57	operation_status: {	×
58	code: err.code,	×
59	message: err.message	×
60	}	×
61	};	×
UNCOV 62	}	×
63	}	4✔
64		6✔
65	async read(request: ReadRequest, ctx: any): Promise<DeepPartial<any>> {	6✔
66	try {	11✔
67	const subject = await resolveSubject(request.subject);	11✔
68	ctx ??= {};	11✔
69	ctx.subject = subject;	11✔
70	ctx.resources = [];	11✔
71	const acsResponse = await checkAccessRequest(	11✔
72	ctx,	11✔
73	[{ resource: this.resourceName }],	11✔
74	AuthZAction.READ,	11✔
75	Operation.whatIsAllowed	11✔
76	) as PolicySetRQResponse;	11✔
77		11✔
78	if (acsResponse.decision != Response_Decision.PERMIT) {	11✔
79	return { operation_status: acsResponse.operation_status };	1✔
80	}	1✔
81	const acsFilters = getACSFilters(acsResponse, this.resourceName);	10✔
82	if (request.filters) {	11✔
83	request.filters.push(...acsFilters);	2✔
84	}	2✔
85	else {	8✔
86	request.filters = acsFilters;	8✔
87	}	8✔
88		10✔
89	request.custom_queries = acsResponse.custom_query_args?.flatMap(arg => arg.custom_queries);	11!
90	request.custom_arguments = acsResponse.custom_query_args?.flatMap(arg => arg.custom_arguments)[0];	11!
91	return await super.read(request, ctx);	11✔
92	} catch (err: any) {	11!
93	this.logger.error('Error occurred requesting access-control-srv:', err);	×
94	return {	×
95	operation_status: {	×
96	code: err.code,	×
97	message: err.message	×
98	}	×
99	};	×
UNCOV 100	}	×
101	}	11✔
102		6✔
103	async update(request: any, ctx: any) {	6✔
104	try {	4✔
105	const subject = await resolveSubject(request.subject);	4✔
106	// update meta data for owner information	4✔
107	const acsResources = await this.createMetadata(request.items, AuthZAction.MODIFY, subject);	4✔
108	ctx ??= {};	4✔
109	ctx.subject = subject;	4✔
110	ctx.resources = acsResources;	4✔
111	const acsResponse = await checkAccessRequest(	4✔
112	ctx,	4✔
113	[{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],	4✔
114	AuthZAction.MODIFY,	4✔
115	Operation.isAllowed	4✔
116	);	4✔
117	if (acsResponse.decision != Response_Decision.PERMIT) {	4✔
118	return { operation_status: acsResponse.operation_status };	1✔
119	}	1✔
120	return await super.update(request, ctx);	3✔
121	} catch (err: any) {	4!
122	this.logger.error('Error occurred requesting access-control-srv:', err);	×
123	return {	×
124	operation_status: {	×
125	code: err.code,	×
126	message: err.message	×
127	}	×
128	};	×
UNCOV 129	}	×
130	}	4✔
131		6✔
132	async upsert(request: any, ctx: any) {	6✔
133	try {	3✔
134	const subject = await resolveSubject(request.subject);	3✔
135	const acsResources = await this.createMetadata(request.items, AuthZAction.MODIFY, subject);	3✔
136	ctx ??= {};	3✔
137	ctx.subject = subject;	3✔
138	ctx.resources = acsResources;	3✔
139	const acsResponse = await checkAccessRequest(	3✔
140	ctx,	3✔
141	[{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],	3✔
142	AuthZAction.MODIFY,	3✔
143	Operation.isAllowed	3✔
144	);	3✔
145	if (acsResponse.decision != Response_Decision.PERMIT) {	3✔
146	return { operation_status: acsResponse.operation_status };	1✔
147	}	1✔
148	return await super.upsert(request, ctx);	2✔
149	} catch (err: any) {	3!
150	this.logger.error('Error occurred requesting access-control-srv:', err);	×
151	return {	×
152	operation_status: {	×
153	code: err.code,	×
154	message: err.message	×
155	}	×
156	};	×
UNCOV 157	}	×
158	}	3✔
159		6✔
160	async delete(request: DeleteRequest, ctx: any): Promise<DeepPartial<DeleteResponse>> {	6✔
161	try {	4✔
162	const resourceIDs = request.ids;	4✔
163	const resources = [];	4✔
164	let acsResources = [];	4✔
165	const subject = await resolveSubject(request.subject);	4✔
166	let action;	4✔
167	if (resourceIDs) {	4✔
168	action = AuthZAction.DELETE;	2✔
169	if (Array.isArray(resourceIDs)) {	2✔
170	for (let id of resourceIDs) {	2✔
171	resources.push({ id });	5✔
172	}	5✔
173	} else {	2!
174	resources.push([{ id: resourceIDs }]);	×
UNCOV 175	}	×
176	Object.assign(resources, { id: resourceIDs });	2✔
177	acsResources = await this.createMetadata<any>(resources, action, subject as ResolvedSubject);	2✔
178	}	2✔
179	if (request.collection) {	4✔
180	action = AuthZAction.DROP;	2✔
181	acsResources = [{ collection: request.collection }];	2✔
182	}	2✔
183	ctx ??= {};	4✔
184	ctx.subject = subject;	4✔
185	ctx.resources = acsResources;	4✔
186	const acsResponse = await checkAccessRequest(	4✔
187	ctx,	4✔
188	[{ resource: this.resourceName, id: acsResources.map((e: any) => e.id) }],	4✔
189	action,	4✔
190	Operation.isAllowed	4✔
191	);	4✔
192	if (acsResponse.decision != Response_Decision.PERMIT) {	4✔
193	return { operation_status: acsResponse.operation_status };	1✔
194	}	1✔
195	return await super.delete(request as any, ctx);	3✔
196	} catch (err: any) {	4!
197	this.logger.error('Error occurred requesting access-control-srv:', err);	×
198	return {	×
199	operation_status: {	×
200	code: err?.code,	×
201	message: err?.message	×
202	}	×
203	};	×
UNCOV 204	}	×
205	}	4✔
206		6✔
207	/**	6✔
208	* reads meta data from DB and updates owners information in resource if action is UPDATE / DELETE	6✔
209	* @param reaources list of resources	6✔
210	* @param entity entity name	6✔
211	* @param action resource action	6✔
212	*/	6✔
213	async createMetadata<T extends Resource>(	6✔
214	resources: T \| T[],	13✔
215	action: string,	13✔
216	subject?: Subject	13✔
217	): Promise<T[]> {	13✔
218		13✔
219	if (!Array.isArray(resources)) {	13!
220	resources = [resources];	×
UNCOV 221	}	×
222		13✔
223	const setDefaultMeta = (resource: T) => {	13✔
224	if (!resource.id?.length) {	14✔
225	resource.id = uuid.v4().replace(/-/g, '');	3✔
226	}	3✔
227		14✔
228	if (!resource.meta) {	14✔
229	resource.meta = {};	6✔
230	resource.meta.owners = [];	6✔
231		6✔
232	if (subject?.scope) {	6✔
233	resource.meta.owners.push(	6✔
234	{	6✔
235	id: this.urns.ownerIndicatoryEntity,	6✔
236	value: this.urns.organization,	6✔
237	attributes: [{	6✔
238	id: this.urns.ownerInstance,	6✔
239	value: subject.scope	6✔
240	}]	6✔
241	}	6✔
242	);	6✔
243	}	6✔
244		6✔
245	if (subject?.id) {	6✔
246	resource.meta.owners.push(	6✔
247	{	6✔
248	id: this.urns.ownerIndicatoryEntity,	6✔
249	value: this.urns.user,	6✔
250	attributes: [{	6✔
251	id: this.urns.ownerInstance,	6✔
252	value: subject.id	6✔
253	}]	6✔
254	}	6✔
255	);	6✔
256	}	6✔
257	}	6✔
258	};	13✔
259		13✔
260	if (action === AuthZAction.MODIFY \|\| action === AuthZAction.DELETE) {	13✔
261	const ids = [	9✔
262	...new Set(	9✔
263	resources.map(	9✔
264	r => r.id	9✔
265	).filter(	9✔
266	id => id	9✔
267	)	9✔
268	).values()	9✔
269	];	9✔
270	const filters = ReadRequest.fromPartial({	9✔
271	filters: [	9✔
272	{	9✔
273	filters: [	9✔
274	{	9✔
275	field: 'id',	9✔
276	operation: Filter_Operation.in,	9✔
277	value: JSON.stringify(ids),	9✔
278	type: Filter_ValueType.ARRAY	9✔
279	}	9✔
280	]	9✔
281	}	9✔
282	],	9✔
283	limit: ids.length	9✔
284	});	9✔
285		9✔
286	const result_map = await super.read(filters, {}).then(	9✔
287	resp => new Map(	9✔
288	resp.items?.map(	9✔
289	item => [item.payload?.id, item?.payload]	9✔
290	)	9✔
291	)	9✔
292	);	9✔
293		9✔
294	for (let resource of resources) {	9✔
295	if (!resource.meta && result_map.has(resource?.id)) {	17✔
296	resource.meta = result_map.get(resource?.id).meta;	11✔
297	}	11✔
298	else {	6✔
299	setDefaultMeta(resource);	6✔
300	}	6✔
301	}	17✔
302	}	9✔
303	else if (action === AuthZAction.CREATE) {	4✔
304	for (let resource of resources) {	4✔
305	setDefaultMeta(resource);	8✔
306	}	8✔
307	}	4✔
308		13✔
309	return resources;	13✔
310	}	13✔
311	}	6✔

restorecommerce / resource-srv / 11797112764

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous