@defra/lis-infra-ui-services 0.18.0 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/lis-infra-ui-services",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "UI-Services shared definitions for the livestock taxonomy topology.",
   "main": "src/index.js",
   "repository": {
@@ -68,10 +68,12 @@
     "undici": "7.24.8"
   },
   "peerDependencies": {
+    "@defra/lis-hubs-infra-access": ">=0.29.0 <1.0.0",
     "@defra/lis-hubs-infra-core": ">=0.4.0 <1.0.0",
     "eslint": "^9.0.0"
   },
   "devDependencies": {
+    "@defra/lis-hubs-infra-access": "^0.29.0",
     "@defra/lis-hubs-infra-core": "^0.12.0",
     "@defra/lis-infra-eslint-config": "^0.6.0",
     "@vitest/coverage-istanbul": "^4.1.10",

package/src/nunjucks/context.js

@@ -1,6 +1,50 @@
 import path from 'node:path'
 
-import { getModuleById } from '@defra/lis-hubs-infra-registry'
+import { hasPermission } from '@defra/lis-hubs-infra-access/authorization'
+import { HUBS, getModuleById } from '@defra/lis-hubs-infra-registry'
+
+const HUB_SERVICE_NAME_PREFIX = 'lis-hubs-'
+
+/**
+ * Both auth schemes put the hub's service name on credentials.caller - a
+ * spoke gets the hub that called it, a hub gets itself - so it is only
+ * known once the request has authenticated.
+ * @param {object} [request]
+ * @returns {string | null}
+ */
+function resolveHubId(request) {
+  const caller = request?.auth?.credentials?.caller
+
+  return (
+    HUBS.find(
+      (candidateHubId) =>
+        caller === `${HUB_SERVICE_NAME_PREFIX}${candidateHubId}`
+    ) ?? null
+  )
+}
+
+/**
+ * Builds the hasPermission() template helper for a request. It throws on a
+ * missing permission or cph because templates render undefined variables as
+ * empty, so a typo would otherwise silently hide the content it guards.
+ * @param {object} [request]
+ * @returns {(params: { permission: string, cph: string }) => boolean}
+ */
+function createPermissionCheck(request) {
+  return function hasPermissionForRequest({ permission, cph } = {}) {
+    if (typeof permission !== 'string' || permission.length === 0) {
+      throw new Error('hasPermission() requires a permission')
+    }
+
+    if (typeof cph !== 'string' || cph.length === 0) {
+      throw new Error(
+        "hasPermission() requires a cph - pass '*' where no holding applies"
+      )
+    }
+
+    return hasPermission(request?.auth?.credentials?.user, { permission, cph })
+  }
+}
 
 /**
  * @param {{ config: object, buildNavigation: Function, getRequestBasePath: Function, logger: object, readFileSync: Function, moduleId?: string }} options
@@ -38,6 +82,7 @@ export function createNunjucksContextBuilder({
 
     const requestBasePath = getRequestBasePath(request)
     const assetRoot = `${requestBasePath}${config.get('assetPath')}`
+    const requestHubId = resolveHubId(request)
 
     return {
       assetPath: `${assetRoot}/assets`,
@@ -47,6 +92,9 @@ export function createNunjucksContextBuilder({
       breadcrumbs: [],
       navigation: buildNavigation(request),
       isSignedIn: Boolean(request?.auth?.credentials?.user),
+      isFrontOffice: requestHubId === 'front-office',
+      isBackOffice: requestHubId === 'back-office',
+      hasPermission: createPermissionCheck(request),
       logoutUrl: '/signout',
       getAssetPath(asset) {
         const viteAssetPath = viteManifest?.[asset]?.file

package/src/nunjucks/context.test.js

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { test } from 'vitest'
+import { describe, expect, test } from 'vitest'
 
 import { createNunjucksContextBuilder } from './context.js'
 
@@ -207,3 +207,320 @@ test('createNunjucksContextBuilder marks the user signed out without credentials
 
   assert.equal(context.isSignedIn, false)
 })
+
+describe('createNunjucksContextBuilder() hub flags', () => {
+  test('marks the request as front office when the caller is the front-office hub', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}',
+      moduleId: 'cattle-register'
+    })
+    const request = {
+      headers: {},
+      path: '/',
+      auth: { credentials: { user: null, caller: 'lis-hubs-front-office' } }
+    }
+
+    // Act
+    const context = contextBuilder(request)
+
+    // Assert
+    expect(context.isFrontOffice).toBe(true)
+    expect(context.isBackOffice).toBe(false)
+  })
+
+  test('marks the request as back office when the caller is the back-office hub', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}',
+      moduleId: 'cattle-register'
+    })
+    const request = {
+      headers: {},
+      path: '/',
+      auth: { credentials: { user: null, caller: 'lis-hubs-back-office' } }
+    }
+
+    // Act
+    const context = contextBuilder(request)
+
+    // Assert
+    expect(context.isFrontOffice).toBe(false)
+    expect(context.isBackOffice).toBe(true)
+  })
+
+  test('sets neither flag on a request with no credentials', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}',
+      moduleId: 'cattle-register'
+    })
+    const request = { headers: {}, path: '/', auth: { credentials: null } }
+
+    // Act
+    const context = contextBuilder(request)
+
+    // Assert
+    expect(context.isFrontOffice).toBe(false)
+    expect(context.isBackOffice).toBe(false)
+  })
+
+  test('sets neither flag for an unrecognised caller', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}',
+      moduleId: 'cattle-register'
+    })
+    const request = {
+      headers: {},
+      path: '/',
+      auth: { credentials: { user: null, caller: 'lis-hubs-other' } }
+    }
+
+    // Act
+    const context = contextBuilder(request)
+
+    // Assert
+    expect(context.isFrontOffice).toBe(false)
+    expect(context.isBackOffice).toBe(false)
+  })
+})
+
+describe('createNunjucksContextBuilder() hasPermission()', () => {
+  test('grants a permission the user holds on the given cph', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const user = {
+      statements: [
+        {
+          role: 'keeper',
+          cphs: ['12/345/0001'],
+          permissions: ['lis-perm-cattle-move-write']
+        }
+      ]
+    }
+    const request = { headers: {}, path: '/', auth: { credentials: { user } } }
+
+    // Act
+    const result = contextBuilder(request).hasPermission({
+      permission: 'lis-perm-cattle-move-write',
+      cph: '12/345/0001'
+    })
+
+    // Assert
+    expect(result).toBe(true)
+  })
+
+  test('refuses a permission the user holds only on another cph', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const user = {
+      statements: [
+        {
+          role: 'keeper',
+          cphs: ['12/345/0001'],
+          permissions: ['lis-perm-cattle-move-write']
+        }
+      ]
+    }
+    const request = { headers: {}, path: '/', auth: { credentials: { user } } }
+
+    // Act
+    const result = contextBuilder(request).hasPermission({
+      permission: 'lis-perm-cattle-move-write',
+      cph: '98/765/0002'
+    })
+
+    // Assert
+    expect(result).toBe(false)
+  })
+
+  test("grants a permission held everywhere when cph is '*'", () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const user = {
+      statements: [
+        {
+          role: 'caseworker',
+          cphs: '*',
+          permissions: ['lis-perm-back-office']
+        }
+      ]
+    }
+    const request = { headers: {}, path: '/', auth: { credentials: { user } } }
+
+    // Act
+    const result = contextBuilder(request).hasPermission({
+      permission: 'lis-perm-back-office',
+      cph: '*'
+    })
+
+    // Assert
+    expect(result).toBe(true)
+  })
+
+  test("refuses a permission held only on specific cphs when cph is '*'", () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const user = {
+      statements: [
+        {
+          role: 'keeper',
+          cphs: ['12/345/0001'],
+          permissions: ['lis-perm-cattle-move-write']
+        }
+      ]
+    }
+    const request = { headers: {}, path: '/', auth: { credentials: { user } } }
+
+    // Act
+    const result = contextBuilder(request).hasPermission({
+      permission: 'lis-perm-cattle-move-write',
+      cph: '*'
+    })
+
+    // Assert
+    expect(result).toBe(false)
+  })
+
+  test('refuses every permission when the user is signed out', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const request = { headers: {}, path: '/', auth: { credentials: null } }
+
+    // Act
+    const result = contextBuilder(request).hasPermission({
+      permission: 'lis-perm-cattle-move-write',
+      cph: '12/345/0001'
+    })
+
+    // Assert
+    expect(result).toBe(false)
+  })
+
+  test('throws when no cph is given', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const request = { headers: {}, path: '/', auth: { credentials: null } }
+
+    // Act
+    let result, error
+    try {
+      result = contextBuilder(request).hasPermission({
+        permission: 'lis-perm-cattle-move-write',
+        cph: undefined
+      })
+    } catch (e) {
+      error = e
+    }
+
+    // Assert
+    expect(result).toBeUndefined()
+    expect(error.message).toBe(
+      "hasPermission() requires a cph - pass '*' where no holding applies"
+    )
+  })
+
+  test('throws when no permission is given', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const request = { headers: {}, path: '/', auth: { credentials: null } }
+
+    // Act
+    let result, error
+    try {
+      result = contextBuilder(request).hasPermission({
+        permission: undefined,
+        cph: '12/345/0001'
+      })
+    } catch (e) {
+      error = e
+    }
+
+    // Assert
+    expect(result).toBeUndefined()
+    expect(error.message).toBe('hasPermission() requires a permission')
+  })
+
+  test('throws when called with no arguments', () => {
+    // Arrange
+    const contextBuilder = createNunjucksContextBuilder({
+      config: createConfig(),
+      buildNavigation: () => [],
+      getRequestBasePath: () => '',
+      logger: {},
+      readFileSync: () => '{}'
+    })
+    const request = { headers: {}, path: '/', auth: { credentials: null } }
+
+    // Act
+    let result, error
+    try {
+      result = contextBuilder(request).hasPermission()
+    } catch (e) {
+      error = e
+    }
+
+    // Assert
+    expect(result).toBeUndefined()
+    expect(error.message).toBe('hasPermission() requires a permission')
+  })
+})

package/src/nunjucks/globals.js

@@ -1,3 +1,4 @@
 const govukRebrand = true
 
 export { govukRebrand }
+export { PERMISSIONS } from '@defra/lis-hubs-infra-access/authorization'

package/src/nunjucks/plugin.test.js

@@ -85,4 +85,29 @@ describe('createNunjucksConfig()', () => {
     expect(mocks.getBasePathForModule).not.toHaveBeenCalled()
     expect(nunjucksConfig.plugin).toBeDefined()
   })
+
+  test('exposes PERMISSIONS to templates as a global', () => {
+    // Arrange
+    const addGlobal = vi.fn()
+    mocks.nunjucksConfigure.mockReturnValueOnce({
+      addGlobal,
+      addFilter: vi.fn()
+    })
+    const config = {
+      get: vi.fn((key) => (key === 'root' ? projectRoot : false))
+    }
+
+    // Act
+    createNunjucksConfig({
+      config,
+      logger: {},
+      getRequestBasePath: vi.fn()
+    })
+
+    // Assert
+    expect(addGlobal).toHaveBeenCalledWith(
+      'PERMISSIONS',
+      expect.objectContaining({ backOffice: 'lis-perm-back-office' })
+    )
+  })
 })