@axinom/mosaic-id-guard 0.47.0-rc.9 → 0.47.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axinom/mosaic-id-guard",
-  "version": "0.47.0-rc.9",
+  "version": "0.47.0",
   "description": "Authentication and authorization helpers for Axinom Mosaic services",
   "author": "Axinom",
   "license": "PROPRIETARY",
@@ -30,10 +30,10 @@
     "lint": "eslint . --ext .ts,.tsx,.js --color --cache"
   },
   "dependencies": {
-    "@axinom/mosaic-id-utils": "^0.26.0-rc.9",
-    "@axinom/mosaic-message-bus": "^0.49.0-rc.9",
-    "@axinom/mosaic-service-common": "^0.68.0-rc.9",
-    "@axinom/mosaic-transactional-inbox-outbox": "^0.28.0-rc.9",
+    "@axinom/mosaic-id-utils": "^0.26.0",
+    "@axinom/mosaic-message-bus": "^0.49.0",
+    "@axinom/mosaic-service-common": "^0.68.0",
+    "@axinom/mosaic-transactional-inbox-outbox": "^0.28.0",
     "amqplib": "^0.10.3",
     "express": "^4.17.1",
     "express-bearer-token": "^3.0.0",
@@ -69,5 +69,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "498434cc9d80f6fb1ff75fe1d411a969d0b7384a"
+  "gitHead": "9732fd094fafedb5360d10405cc19fa202d42de6"
 }

package/src/graphql/query-mutation-guard-plugin.spec.ts

@@ -2,6 +2,7 @@ import { skipMaskTag } from '@axinom/mosaic-service-common';
 import {
   MutationPayloadQueryPlugin,
   MutationPlugin,
+  Plugin,
   QueryPlugin,
   StandardTypesPlugin,
   SubscriptionPlugin,
@@ -989,3 +990,342 @@ describe('QueryMutationGuardPlugin', () => {
     });
   });
 });
+
+describe('When an operation is renamed via a hook plugin', () => {
+  const RenameEchoPlugin: Plugin = (builder) => {
+    builder.hook('GraphQLObjectType:fields', (fields, _build, { Self }) => {
+      if (Self.name === 'Query' && 'echo' in fields) {
+        const { echo, ...rest } = fields;
+        return { ...rest, renamedEcho: echo };
+      }
+      if (Self.name === 'Mutation' && 'echoMutation' in fields) {
+        const { echoMutation, ...rest } = fields;
+        return { ...rest, renamedEchoMutation: echoMutation };
+      }
+      if (Self.name === 'Subscription' && 'echoSubscription' in fields) {
+        const { echoSubscription, ...rest } = fields;
+        return { ...rest, renamedEchoSubscription: echoSubscription };
+      }
+      return fields;
+    });
+  };
+
+  const makeSchemaWithRenamePlugin = async (
+    spy: any,
+    options = {},
+  ): Promise<GraphQLSchema> =>
+    buildSchema(
+      [
+        StandardTypesPlugin,
+        QueryPlugin,
+        MutationPlugin,
+        MutationPayloadQueryPlugin,
+        SubscriptionPlugin,
+        makeExtendSchemaPlugin(() => ({
+          typeDefs: gql`
+            extend type Query {
+              echo(message: String!): String
+            }
+            extend type Mutation {
+              echoMutation(message: String!): String
+            }
+            extend type Subscription {
+              echoSubscription: String
+            }
+          `,
+          resolvers: {
+            Query: {
+              echo: spy,
+            },
+            Mutation: {
+              echoMutation: spy,
+            },
+            Subscription: {
+              echoSubscription: {
+                subscribe: () => pubSub.asyncIterator('echoSubscription'),
+                resolve: () => 'Hello Subscription',
+              },
+            },
+          },
+        })),
+        RenameEchoPlugin,
+        QueryMutationGuardPlugin,
+      ],
+      {
+        serviceId: 'test-service',
+        ...options,
+      },
+    );
+
+  it('Authorized user can access the renamed query', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEcho'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Editor'] },
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    // Act
+    const result = await graphql(
+      schema,
+      '{ renamedEcho(message: "Hello") }',
+      null,
+      jwtContext,
+    );
+
+    // Assert
+    expect(result.errors).toBeUndefined();
+    expect(spy).toHaveBeenCalledTimes(1);
+    expect(result.data?.renamedEcho).toBe('Hello');
+  });
+
+  it('Unauthorized user cannot access the renamed query', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEcho'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Viewer'] },
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    // Act
+    const result = await graphql(
+      schema,
+      '{ renamedEcho(message: "Hello") }',
+      null,
+      jwtContext,
+    );
+
+    // Assert
+    expect(result.data?.renamedEcho).toBeNull();
+    expect(spy).toHaveBeenCalledTimes(0);
+    expect(result.errors).toHaveLength(1);
+    const error = result.errors![0].originalError as any;
+    expect(error.code).toBe(IdGuardErrors.UserNotAuthorized.code);
+  });
+
+  it('Authorized user can access the renamed mutation', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEchoMutation'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Editor'] },
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    // Act
+    const result = await graphql(
+      schema,
+      'mutation { renamedEchoMutation(message: "Hello") }',
+      null,
+      jwtContext,
+    );
+
+    // Assert
+    expect(result.errors).toBeUndefined();
+    expect(spy).toHaveBeenCalledTimes(1);
+    expect(result.data?.renamedEchoMutation).toBe('Hello');
+  });
+
+  it('Unauthorized user cannot access the renamed mutation', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEchoMutation'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Viewer'] },
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    // Act
+    const result = await graphql(
+      schema,
+      'mutation { renamedEchoMutation(message: "Hello") }',
+      null,
+      jwtContext,
+    );
+
+    // Assert
+    expect(result.data?.renamedEchoMutation).toBeNull();
+    expect(spy).toHaveBeenCalledTimes(0);
+    expect(result.errors).toHaveLength(1);
+    const error = result.errors![0].originalError as any;
+    expect(error.code).toBe(IdGuardErrors.UserNotAuthorized.code);
+  });
+
+  it('Authorized user can access the renamed subscription', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEchoSubscription'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Editor'] },
+        exp: new Date().getTime() / 1000 + 20,
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    const document = parse('subscription { renamedEchoSubscription }');
+
+    // Create subscription
+    const subscription: any = await subscribe({
+      schema,
+      document,
+      rootValue: null,
+      contextValue: jwtContext,
+    });
+
+    const resolveSubscription = subscription.next();
+
+    // Publish trigger to invoke subscription resolver
+    pubSub.publish('echoSubscription', 'message');
+
+    // Await for the subscription resolver to respond
+    const result = await resolveSubscription;
+
+    expect(result.value.errors).toBeFalsy();
+    expect(result.value.data.renamedEchoSubscription).toBe(
+      'Hello Subscription',
+    );
+
+    // Close subscription
+    await subscription.return();
+  });
+
+  it('Unauthorized user cannot access the renamed subscription', async () => {
+    // Arrange
+    const spy = makeEchoSpy();
+    const schema = await makeSchemaWithRenamePlugin(spy, {
+      permissionDefinition: {
+        gqlOptions: {
+          anonymousGqlOperations: [],
+          ignoredGqlOperations: [],
+        },
+        permissions: [
+          {
+            key: 'Editor',
+            title: 'Editor',
+            gqlOperations: ['renamedEchoSubscription'],
+          },
+        ],
+      },
+    });
+    const jwtContext = {
+      subject: {
+        sub: 'test-user',
+        permissions: { 'test-service': ['Viewer'] },
+        exp: new Date().getTime() / 1000 + 20,
+        subjectType: SubjectType.UserAccount,
+      },
+    };
+
+    const document = parse('subscription { renamedEchoSubscription }');
+
+    // Create subscription
+    const subscription: any = await subscribe({
+      schema,
+      document,
+      rootValue: null,
+      contextValue: jwtContext,
+    });
+
+    const resolveSubscription = subscription.next();
+
+    // Publish trigger to invoke subscription resolver
+    pubSub.publish('echoSubscription', 'message');
+
+    // Await for the subscription resolver to respond
+    const result = await resolveSubscription;
+
+    expect(result.value.errors).toBeTruthy();
+    expect(result.value.errors[0].message).toBe(
+      'User is not authorized to access the operation.',
+    );
+
+    // Close subscription
+    await subscription.return();
+  });
+});