@mondaydotcomorg/monday-authorization 3.5.1-feat-shaime-support-entity-attributes-in-authorization-sdk-d2be13e → 3.5.1-fix-authorize-profile-picker-9fcaf6a
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/attributions-service.d.ts.map +1 -1
- package/dist/attributions-service.js +0 -1
- package/dist/authorization-attributes-service.d.ts +54 -0
- package/dist/authorization-attributes-service.d.ts.map +1 -0
- package/dist/authorization-attributes-service.js +186 -0
- package/dist/authorization-service.d.ts.map +1 -1
- package/dist/authorization-service.js +34 -7
- package/dist/constants/sns.d.ts +2 -12
- package/dist/constants/sns.d.ts.map +1 -1
- package/dist/constants/sns.js +2 -22
- package/dist/esm/attributions-service.d.ts.map +1 -1
- package/dist/esm/attributions-service.mjs +0 -1
- package/dist/esm/authorization-attributes-service.d.ts +54 -0
- package/dist/esm/authorization-attributes-service.d.ts.map +1 -0
- package/dist/esm/authorization-attributes-service.mjs +180 -0
- package/dist/esm/authorization-service.d.ts.map +1 -1
- package/dist/esm/authorization-service.mjs +34 -7
- package/dist/esm/constants/sns.d.ts +2 -12
- package/dist/esm/constants/sns.d.ts.map +1 -1
- package/dist/esm/constants/sns.mjs +3 -17
- package/dist/esm/index.d.ts +1 -9
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.mjs +1 -7
- package/dist/esm/roles-service.d.ts +1 -1
- package/dist/esm/roles-service.mjs +1 -1
- package/dist/esm/types/authorization-attributes-contracts.d.ts +4 -36
- package/dist/esm/types/authorization-attributes-contracts.d.ts.map +1 -1
- package/dist/esm/types/authorization-attributes-contracts.mjs +1 -6
- package/dist/index.d.ts +1 -9
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -15
- package/dist/roles-service.d.ts +1 -1
- package/dist/roles-service.js +1 -1
- package/dist/types/authorization-attributes-contracts.d.ts +4 -36
- package/dist/types/authorization-attributes-contracts.d.ts.map +1 -1
- package/dist/types/authorization-attributes-contracts.js +0 -5
- package/package.json +1 -1
- package/src/attributions-service.ts +0 -4
- package/src/authorization-attributes-service.ts +234 -0
- package/src/authorization-service.ts +71 -11
- package/src/constants/sns.ts +2 -19
- package/src/index.ts +1 -18
- package/src/roles-service.ts +1 -1
- package/src/types/authorization-attributes-contracts.ts +3 -56
- package/dist/authorization-attributes-ms-service.d.ts +0 -67
- package/dist/authorization-attributes-ms-service.d.ts.map +0 -1
- package/dist/authorization-attributes-ms-service.js +0 -256
- package/dist/authorization-attributes-sns-service.d.ts +0 -85
- package/dist/authorization-attributes-sns-service.d.ts.map +0 -1
- package/dist/authorization-attributes-sns-service.js +0 -203
- package/dist/base-attribute-assignment.d.ts +0 -18
- package/dist/base-attribute-assignment.d.ts.map +0 -1
- package/dist/base-attribute-assignment.js +0 -43
- package/dist/entity-attribute-assignment.d.ts +0 -24
- package/dist/entity-attribute-assignment.d.ts.map +0 -1
- package/dist/entity-attribute-assignment.js +0 -36
- package/dist/entity-attributes-constants.d.ts +0 -7
- package/dist/entity-attributes-constants.d.ts.map +0 -1
- package/dist/entity-attributes-constants.js +0 -9
- package/dist/errors/argument-error.d.ts +0 -4
- package/dist/errors/argument-error.d.ts.map +0 -1
- package/dist/errors/argument-error.js +0 -11
- package/dist/esm/authorization-attributes-ms-service.d.ts +0 -67
- package/dist/esm/authorization-attributes-ms-service.d.ts.map +0 -1
- package/dist/esm/authorization-attributes-ms-service.mjs +0 -254
- package/dist/esm/authorization-attributes-sns-service.d.ts +0 -85
- package/dist/esm/authorization-attributes-sns-service.d.ts.map +0 -1
- package/dist/esm/authorization-attributes-sns-service.mjs +0 -197
- package/dist/esm/base-attribute-assignment.d.ts +0 -18
- package/dist/esm/base-attribute-assignment.d.ts.map +0 -1
- package/dist/esm/base-attribute-assignment.mjs +0 -41
- package/dist/esm/entity-attribute-assignment.d.ts +0 -24
- package/dist/esm/entity-attribute-assignment.d.ts.map +0 -1
- package/dist/esm/entity-attribute-assignment.mjs +0 -34
- package/dist/esm/entity-attributes-constants.d.ts +0 -7
- package/dist/esm/entity-attributes-constants.d.ts.map +0 -1
- package/dist/esm/entity-attributes-constants.mjs +0 -7
- package/dist/esm/errors/argument-error.d.ts +0 -4
- package/dist/esm/errors/argument-error.d.ts.map +0 -1
- package/dist/esm/errors/argument-error.mjs +0 -9
- package/dist/esm/resource-attribute-assignment.d.ts +0 -24
- package/dist/esm/resource-attribute-assignment.d.ts.map +0 -1
- package/dist/esm/resource-attribute-assignment.mjs +0 -34
- package/dist/esm/resource-attributes-constants.d.ts +0 -25
- package/dist/esm/resource-attributes-constants.d.ts.map +0 -1
- package/dist/esm/resource-attributes-constants.mjs +0 -25
- package/dist/esm/utils/path-utils.d.ts +0 -8
- package/dist/esm/utils/path-utils.d.ts.map +0 -1
- package/dist/esm/utils/path-utils.mjs +0 -15
- package/dist/esm/utils/validation.d.ts +0 -45
- package/dist/esm/utils/validation.d.ts.map +0 -1
- package/dist/esm/utils/validation.mjs +0 -75
- package/dist/resource-attribute-assignment.d.ts +0 -24
- package/dist/resource-attribute-assignment.d.ts.map +0 -1
- package/dist/resource-attribute-assignment.js +0 -36
- package/dist/resource-attributes-constants.d.ts +0 -25
- package/dist/resource-attributes-constants.d.ts.map +0 -1
- package/dist/resource-attributes-constants.js +0 -28
- package/dist/utils/path-utils.d.ts +0 -8
- package/dist/utils/path-utils.d.ts.map +0 -1
- package/dist/utils/path-utils.js +0 -17
- package/dist/utils/validation.d.ts +0 -45
- package/dist/utils/validation.d.ts.map +0 -1
- package/dist/utils/validation.js +0 -77
- package/src/authorization-attributes-ms-service.ts +0 -400
- package/src/authorization-attributes-sns-service.ts +0 -290
- package/src/base-attribute-assignment.ts +0 -55
- package/src/entity-attribute-assignment.ts +0 -35
- package/src/entity-attributes-constants.ts +0 -7
- package/src/errors/argument-error.ts +0 -7
- package/src/resource-attribute-assignment.ts +0 -43
- package/src/resource-attributes-constants.ts +0 -26
- package/src/utils/path-utils.ts +0 -13
- package/src/utils/validation.ts +0 -77
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mondaydotcomorg/monday-authorization",
|
|
3
|
-
"version": "3.5.1-
|
|
3
|
+
"version": "3.5.1-fix-authorize-profile-picker-9fcaf6a",
|
|
4
4
|
"main": "dist/index.js",
|
|
5
5
|
"types": "dist/index.d.ts",
|
|
6
6
|
"license": "BSD-3-Clause",
|
|
@@ -53,10 +53,6 @@ export function getAttributionsFromApi(): { [key: string]: string } {
|
|
|
53
53
|
const runtimeAttributionsOutgoingHeaders = runtimeAttributions?.buildOutgoingHeaders('HTTP_INTERNAL');
|
|
54
54
|
|
|
55
55
|
if (!runtimeAttributionsOutgoingHeaders) {
|
|
56
|
-
logger.info(
|
|
57
|
-
{ tag: 'authorization-service', runtimeAttributionsOutgoingHeaders },
|
|
58
|
-
'No runtime attributions outgoing headers'
|
|
59
|
-
);
|
|
60
56
|
return callerAppNameFromSdk;
|
|
61
57
|
}
|
|
62
58
|
|
|
@@ -0,0 +1,234 @@
|
|
|
1
|
+
import chunk from 'lodash/chunk.js';
|
|
2
|
+
import { Api, FetcherConfig, HttpClient } from '@mondaydotcomorg/trident-backend-api';
|
|
3
|
+
import { getTopicAttributes, sendToSns } from '@mondaydotcomorg/monday-sns';
|
|
4
|
+
import { HttpFetcherError, RecursivePartial } from '@mondaydotcomorg/monday-fetch-api';
|
|
5
|
+
import {
|
|
6
|
+
ResourceAttributeAssignment,
|
|
7
|
+
ResourceAttributeResponse,
|
|
8
|
+
ResourceAttributesOperation,
|
|
9
|
+
} from './types/authorization-attributes-contracts';
|
|
10
|
+
import { Resource } from './types/general';
|
|
11
|
+
import { logger } from './authorization-internal-service';
|
|
12
|
+
import { getAttributionsFromApi } from './attributions-service';
|
|
13
|
+
import {
|
|
14
|
+
ASYNC_RESOURCE_ATTRIBUTES_MAX_OPERATIONS_PER_MESSAGE,
|
|
15
|
+
RESOURCE_ATTRIBUTES_SNS_UPDATE_OPERATION_MESSAGE_KIND,
|
|
16
|
+
SNS_ARN_ENV_VAR_NAME,
|
|
17
|
+
SNS_DEV_TEST_NAME,
|
|
18
|
+
} from './constants/sns';
|
|
19
|
+
import { APP_NAME, DEFAULT_FETCH_OPTIONS, ERROR_MESSAGES } from './constants';
|
|
20
|
+
import type { TopicAttributesMap } from 'aws-sdk/clients/sns';
|
|
21
|
+
|
|
22
|
+
export class AuthorizationAttributesService {
|
|
23
|
+
private static LOG_TAG = 'authorization_attributes';
|
|
24
|
+
private static API_PATHS = {
|
|
25
|
+
UPSERT_RESOURCE_ATTRIBUTES: '/attributes/{accountId}/resource',
|
|
26
|
+
DELETE_RESOURCE_ATTRIBUTES: '/attributes/{accountId}/resource/{resourceType}/{resourceId}',
|
|
27
|
+
} as const;
|
|
28
|
+
private httpClient: HttpClient;
|
|
29
|
+
private fetchOptions: RecursivePartial<FetcherConfig>;
|
|
30
|
+
private snsArn: string;
|
|
31
|
+
|
|
32
|
+
/**
|
|
33
|
+
* Public constructor to create the AuthorizationAttributesService instance.
|
|
34
|
+
* @param httpClient The HTTP client to use for API requests, if not provided, the default HTTP client from Api will be used.
|
|
35
|
+
* @param fetchOptions The fetch options to use for API requests, if not provided, the default fetch options will be used.
|
|
36
|
+
*/
|
|
37
|
+
constructor(httpClient?: HttpClient, fetchOptions?: RecursivePartial<FetcherConfig>) {
|
|
38
|
+
if (!httpClient) {
|
|
39
|
+
httpClient = Api.getPart('httpClient');
|
|
40
|
+
if (!httpClient) {
|
|
41
|
+
throw new Error(ERROR_MESSAGES.HTTP_CLIENT_NOT_INITIALIZED);
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
if (!fetchOptions) {
|
|
46
|
+
fetchOptions = DEFAULT_FETCH_OPTIONS;
|
|
47
|
+
} else {
|
|
48
|
+
fetchOptions = {
|
|
49
|
+
...DEFAULT_FETCH_OPTIONS,
|
|
50
|
+
...fetchOptions,
|
|
51
|
+
};
|
|
52
|
+
}
|
|
53
|
+
this.httpClient = httpClient;
|
|
54
|
+
this.fetchOptions = fetchOptions;
|
|
55
|
+
this.snsArn = AuthorizationAttributesService.getSnsTopicArn();
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
/**
|
|
59
|
+
* Upsert resource attributes synchronously, performing http call to the authorization MS to assign the given attributes to the given resource.
|
|
60
|
+
* @param accountId
|
|
61
|
+
* @param resourceAttributeAssignments - Array of resource (resourceType, resourceId) and attribute (key, value) pairs to upsert in the authorization MS.
|
|
62
|
+
* e.g. [{ resourceType: 'board', resourceId: 123, key: 'board_kind', value: 'private' }]
|
|
63
|
+
* @returns ResourceAttributeResponse - The affected (created and updated_ resource attributes assignments in the `attributes` field.
|
|
64
|
+
*/
|
|
65
|
+
async upsertResourceAttributes(
|
|
66
|
+
accountId: number,
|
|
67
|
+
resourceAttributeAssignments: ResourceAttributeAssignment[]
|
|
68
|
+
): Promise<ResourceAttributeResponse> {
|
|
69
|
+
const attributionHeaders = getAttributionsFromApi();
|
|
70
|
+
try {
|
|
71
|
+
return await this.httpClient.fetch<ResourceAttributeResponse>(
|
|
72
|
+
{
|
|
73
|
+
url: {
|
|
74
|
+
appName: APP_NAME,
|
|
75
|
+
path: AuthorizationAttributesService.API_PATHS.UPSERT_RESOURCE_ATTRIBUTES.replace(
|
|
76
|
+
'{accountId}',
|
|
77
|
+
accountId.toString()
|
|
78
|
+
),
|
|
79
|
+
},
|
|
80
|
+
method: 'POST',
|
|
81
|
+
headers: {
|
|
82
|
+
'Content-Type': 'application/json',
|
|
83
|
+
...attributionHeaders,
|
|
84
|
+
},
|
|
85
|
+
body: JSON.stringify({ resourceAttributeAssignments }),
|
|
86
|
+
},
|
|
87
|
+
this.fetchOptions
|
|
88
|
+
);
|
|
89
|
+
} catch (err) {
|
|
90
|
+
if (err instanceof HttpFetcherError) {
|
|
91
|
+
throw new Error(ERROR_MESSAGES.REQUEST_FAILED('upsertResourceAttributes', err.status, err.message));
|
|
92
|
+
}
|
|
93
|
+
throw err;
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
|
|
97
|
+
/**
|
|
98
|
+
* Delete resource attributes assignments synchronously, performing http call to the authorization MS to delete the given attributes from the given singular resource.
|
|
99
|
+
* @param accountId
|
|
100
|
+
* @param resource - The resource (resourceType, resourceId) to delete the attributes for.
|
|
101
|
+
* @param attributeKeys - Array of attribute keys to delete for the resource.
|
|
102
|
+
* @returns ResourceAttributeResponse - The affected (deleted) resource attributes assignments in the `attributes` field.
|
|
103
|
+
*/
|
|
104
|
+
async deleteResourceAttributes(
|
|
105
|
+
accountId: number,
|
|
106
|
+
resource: Resource,
|
|
107
|
+
attributeKeys: string[]
|
|
108
|
+
): Promise<ResourceAttributeResponse> {
|
|
109
|
+
const attributionHeaders = getAttributionsFromApi();
|
|
110
|
+
if (!resource.id) {
|
|
111
|
+
throw new Error('Resource ID is required');
|
|
112
|
+
}
|
|
113
|
+
try {
|
|
114
|
+
return await this.httpClient.fetch<ResourceAttributeResponse>(
|
|
115
|
+
{
|
|
116
|
+
url: {
|
|
117
|
+
appName: APP_NAME,
|
|
118
|
+
path: AuthorizationAttributesService.API_PATHS.DELETE_RESOURCE_ATTRIBUTES.replace(
|
|
119
|
+
'{accountId}',
|
|
120
|
+
accountId.toString()
|
|
121
|
+
)
|
|
122
|
+
.replace('{resourceType}', resource.type)
|
|
123
|
+
.replace('{resourceId}', resource.id.toString()),
|
|
124
|
+
},
|
|
125
|
+
method: 'DELETE',
|
|
126
|
+
headers: {
|
|
127
|
+
'Content-Type': 'application/json',
|
|
128
|
+
...attributionHeaders,
|
|
129
|
+
},
|
|
130
|
+
body: JSON.stringify({ keys: attributeKeys }),
|
|
131
|
+
},
|
|
132
|
+
this.fetchOptions
|
|
133
|
+
);
|
|
134
|
+
} catch (err) {
|
|
135
|
+
if (err instanceof HttpFetcherError) {
|
|
136
|
+
throw new Error(ERROR_MESSAGES.REQUEST_FAILED('deleteResourceAttributes', err.status, err.message));
|
|
137
|
+
}
|
|
138
|
+
throw err;
|
|
139
|
+
}
|
|
140
|
+
}
|
|
141
|
+
|
|
142
|
+
/**
|
|
143
|
+
* Async function, this function only send the updates request to SNS and return before the change actually took place
|
|
144
|
+
* @param accountId
|
|
145
|
+
* @param appName - App name of the calling app
|
|
146
|
+
* @param callerActionIdentifier - action identifier
|
|
147
|
+
* @param resourceAttributeOperations - Array of operations to do on resource attributes.
|
|
148
|
+
* @return {Promise<ResourceAttributesOperation[]>} Array of sent operations
|
|
149
|
+
* */
|
|
150
|
+
async updateResourceAttributesAsync(
|
|
151
|
+
accountId: number,
|
|
152
|
+
appName: string,
|
|
153
|
+
callerActionIdentifier: string,
|
|
154
|
+
resourceAttributeOperations: ResourceAttributesOperation[]
|
|
155
|
+
): Promise<ResourceAttributesOperation[]> {
|
|
156
|
+
const topicArn: string = this.snsArn;
|
|
157
|
+
const sendToSnsPromises: Promise<ResourceAttributesOperation[]>[] = [];
|
|
158
|
+
const operationChucks = chunk(resourceAttributeOperations, ASYNC_RESOURCE_ATTRIBUTES_MAX_OPERATIONS_PER_MESSAGE);
|
|
159
|
+
for (const operationsChunk of operationChucks) {
|
|
160
|
+
sendToSnsPromises.push(
|
|
161
|
+
this.sendSingleSnsMessage(topicArn, accountId, appName, callerActionIdentifier, operationsChunk)
|
|
162
|
+
);
|
|
163
|
+
}
|
|
164
|
+
return (await Promise.all(sendToSnsPromises)).flat();
|
|
165
|
+
}
|
|
166
|
+
|
|
167
|
+
private async sendSingleSnsMessage(
|
|
168
|
+
topicArn: string,
|
|
169
|
+
accountId: number,
|
|
170
|
+
appName: string,
|
|
171
|
+
callerActionIdentifier: string,
|
|
172
|
+
operations: ResourceAttributesOperation[]
|
|
173
|
+
): Promise<ResourceAttributesOperation[]> {
|
|
174
|
+
const payload = {
|
|
175
|
+
kind: RESOURCE_ATTRIBUTES_SNS_UPDATE_OPERATION_MESSAGE_KIND,
|
|
176
|
+
payload: {
|
|
177
|
+
accountId: accountId,
|
|
178
|
+
callerAppName: appName,
|
|
179
|
+
callerActionIdentifier: callerActionIdentifier,
|
|
180
|
+
operations: operations,
|
|
181
|
+
},
|
|
182
|
+
};
|
|
183
|
+
try {
|
|
184
|
+
await sendToSns(payload, topicArn);
|
|
185
|
+
return operations;
|
|
186
|
+
} catch (error) {
|
|
187
|
+
logger.error(
|
|
188
|
+
{ error, tag: AuthorizationAttributesService.LOG_TAG },
|
|
189
|
+
'Authorization resource attributes async update: failed to send operations to SNS'
|
|
190
|
+
);
|
|
191
|
+
return [];
|
|
192
|
+
}
|
|
193
|
+
}
|
|
194
|
+
|
|
195
|
+
private static getSnsTopicArn(): string {
|
|
196
|
+
const arnFromEnv: string | undefined = process.env[SNS_ARN_ENV_VAR_NAME];
|
|
197
|
+
if (arnFromEnv) {
|
|
198
|
+
return arnFromEnv;
|
|
199
|
+
}
|
|
200
|
+
if (process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test') {
|
|
201
|
+
return SNS_DEV_TEST_NAME;
|
|
202
|
+
}
|
|
203
|
+
throw new Error('Unable to get sns topic arn from env variable');
|
|
204
|
+
}
|
|
205
|
+
|
|
206
|
+
/**
|
|
207
|
+
* Checks we can contact the required SNS topic that used to send attribute updates to Authorization MS.
|
|
208
|
+
* This function can be used as health check for services that updating resource attributes in async is crucial.
|
|
209
|
+
* Note this function only verify the POD can contact AWS SDK and the topic exists, but the user still might get
|
|
210
|
+
* errors when pushing for the SNS (e.g: in case the AWS role of the POD don't have permissions to push messages).
|
|
211
|
+
* However, this is the best we can do without actually push dummy messages to the SNS.
|
|
212
|
+
* @return {Promise<boolean>} - true if succeeded
|
|
213
|
+
*/
|
|
214
|
+
async asyncResourceAttributesHealthCheck(): Promise<boolean> {
|
|
215
|
+
try {
|
|
216
|
+
const requestedTopicArn: string = this.snsArn;
|
|
217
|
+
const attributes: TopicAttributesMap = await getTopicAttributes(requestedTopicArn);
|
|
218
|
+
const isHealthy = !(!attributes || !('TopicArn' in attributes) || attributes.TopicArn !== requestedTopicArn);
|
|
219
|
+
if (!isHealthy) {
|
|
220
|
+
logger.error(
|
|
221
|
+
{ requestedTopicArn, snsReturnedAttributes: attributes, tag: AuthorizationAttributesService.LOG_TAG },
|
|
222
|
+
'authorization-attributes-service failed in health check'
|
|
223
|
+
);
|
|
224
|
+
}
|
|
225
|
+
return isHealthy;
|
|
226
|
+
} catch (error) {
|
|
227
|
+
logger.error(
|
|
228
|
+
{ error, tag: AuthorizationAttributesService.LOG_TAG },
|
|
229
|
+
'authorization-attributes-service got error during health check'
|
|
230
|
+
);
|
|
231
|
+
return false;
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
}
|
|
@@ -155,19 +155,60 @@ export class AuthorizationService {
|
|
|
155
155
|
logger.error({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, failing request');
|
|
156
156
|
throw new Error('AuthorizationService: igniteClient is not set, failing request');
|
|
157
157
|
}
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
158
|
+
|
|
159
|
+
const allowedProfiles = this.igniteClient.configuration.getObjectValue<string[]>(
|
|
160
|
+
ALLOWED_SDK_PLATFORM_PROFILES_KEY,
|
|
161
|
+
[]
|
|
162
|
+
);
|
|
163
|
+
const isAllowedProfile = allowedProfiles.includes(appName);
|
|
164
|
+
logger.info(
|
|
165
|
+
{ tag: 'auth-debug', accountId, userId, appName, allowedProfiles, isAllowedProfile },
|
|
166
|
+
'AuthorizationService.getProfile: checking allowed profiles'
|
|
167
|
+
);
|
|
168
|
+
|
|
169
|
+
if (isAllowedProfile) {
|
|
170
|
+
const profile = getProfile();
|
|
171
|
+
logger.info(
|
|
172
|
+
{ tag: 'auth-debug', accountId, userId, appName, profile },
|
|
173
|
+
'AuthorizationService.getProfile: selected profile via allowed profiles'
|
|
174
|
+
);
|
|
175
|
+
return profile;
|
|
162
176
|
}
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
)
|
|
169
|
-
|
|
177
|
+
|
|
178
|
+
const inReleaseProfiles = this.igniteClient.configuration.getObjectValue<string[]>(
|
|
179
|
+
IN_RELEASE_SDK_PLATFORM_PROFILES_KEY,
|
|
180
|
+
[]
|
|
181
|
+
);
|
|
182
|
+
const isInReleaseProfile = inReleaseProfiles.includes(appName);
|
|
183
|
+
const isFeatureFlagReleased = this.igniteClient.isReleased(PLATFORM_PROFILE_RELEASE_FF, { accountId, userId });
|
|
184
|
+
|
|
185
|
+
logger.info(
|
|
186
|
+
{
|
|
187
|
+
tag: 'auth-debug',
|
|
188
|
+
accountId,
|
|
189
|
+
userId,
|
|
190
|
+
appName,
|
|
191
|
+
inReleaseProfiles,
|
|
192
|
+
isInReleaseProfile,
|
|
193
|
+
isFeatureFlagReleased,
|
|
194
|
+
featureFlag: PLATFORM_PROFILE_RELEASE_FF,
|
|
195
|
+
},
|
|
196
|
+
'AuthorizationService.getProfile: checking feature flag release'
|
|
197
|
+
);
|
|
198
|
+
|
|
199
|
+
if (isInReleaseProfile && isFeatureFlagReleased) {
|
|
200
|
+
const profile = getProfile();
|
|
201
|
+
logger.info(
|
|
202
|
+
{ tag: 'auth-debug', accountId, userId, appName, profile },
|
|
203
|
+
'AuthorizationService.getProfile: selected profile via feature flag release'
|
|
204
|
+
);
|
|
205
|
+
return profile;
|
|
170
206
|
}
|
|
207
|
+
|
|
208
|
+
logger.info(
|
|
209
|
+
{ tag: 'auth-debug', accountId, userId, appName, profile: PlatformProfile.APP },
|
|
210
|
+
'AuthorizationService.getProfile: selected default APP profile'
|
|
211
|
+
);
|
|
171
212
|
return PlatformProfile.APP;
|
|
172
213
|
}
|
|
173
214
|
|
|
@@ -184,15 +225,34 @@ export class AuthorizationService {
|
|
|
184
225
|
this.igniteClient?.isReleased(NAVIGATE_CAN_ACTION_IN_SCOPE_TO_GRAPH_FF, { accountId, userId })
|
|
185
226
|
);
|
|
186
227
|
|
|
228
|
+
logger.info(
|
|
229
|
+
{
|
|
230
|
+
tag: 'auth-debug',
|
|
231
|
+
accountId,
|
|
232
|
+
userId,
|
|
233
|
+
shouldNavigateToGraph,
|
|
234
|
+
featureFlag: NAVIGATE_CAN_ACTION_IN_SCOPE_TO_GRAPH_FF,
|
|
235
|
+
},
|
|
236
|
+
'AuthorizationService.canActionInScopeMultiple: determining which API flow to use'
|
|
237
|
+
);
|
|
238
|
+
|
|
187
239
|
const startTime = performance.now();
|
|
188
240
|
let scopedActionResponseObjects: ScopedActionResponseObject[];
|
|
189
241
|
let apiType: 'graph' | 'platform';
|
|
190
242
|
|
|
191
243
|
if (shouldNavigateToGraph) {
|
|
192
244
|
apiType = 'graph';
|
|
245
|
+
logger.info(
|
|
246
|
+
{ tag: 'auth-debug', accountId, userId, apiType },
|
|
247
|
+
'AuthorizationService.canActionInScopeMultiple: using graph API flow'
|
|
248
|
+
);
|
|
193
249
|
scopedActionResponseObjects = await this.graphApi.checkPermissions(accountId, userId, scopedActions);
|
|
194
250
|
} else {
|
|
195
251
|
apiType = 'platform';
|
|
252
|
+
logger.info(
|
|
253
|
+
{ tag: 'auth-debug', accountId, userId, apiType },
|
|
254
|
+
'AuthorizationService.canActionInScopeMultiple: using platform API flow'
|
|
255
|
+
);
|
|
196
256
|
const profile = this.getProfile(accountId, userId);
|
|
197
257
|
const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
|
|
198
258
|
|
package/src/constants/sns.ts
CHANGED
|
@@ -1,22 +1,5 @@
|
|
|
1
|
-
export
|
|
2
|
-
|
|
3
|
-
ENTITY = 'entity',
|
|
4
|
-
}
|
|
5
|
-
|
|
6
|
-
// Resource SNS constants
|
|
7
|
-
export const RESOURCE_SNS_ARN_ENV_VAR_NAME = 'SHARED_AUTHORIZATION_SNS_ENDPOINT_RESOURCE_ATTRIBUTES';
|
|
8
|
-
export const RESOURCE_SNS_DEV_TEST_NAME =
|
|
1
|
+
export const SNS_ARN_ENV_VAR_NAME = 'SHARED_AUTHORIZATION_SNS_ENDPOINT_RESOURCE_ATTRIBUTES';
|
|
2
|
+
export const SNS_DEV_TEST_NAME =
|
|
9
3
|
'arn:aws:sns:us-east-1:000000000000:monday-authorization-resource-attributes-sns-local';
|
|
10
|
-
|
|
11
|
-
// Entity SNS constants
|
|
12
|
-
export const ENTITY_SNS_ARN_ENV_VAR_NAME = 'SHARED_AUTHORIZATION_SNS_ENDPOINT_ENTITY_ATTRIBUTES';
|
|
13
|
-
export const ENTITY_SNS_DEV_TEST_NAME =
|
|
14
|
-
'arn:aws:sns:us-east-1:000000000000:monday-authorization-entity-attributes-sns-local';
|
|
15
4
|
export const RESOURCE_ATTRIBUTES_SNS_UPDATE_OPERATION_MESSAGE_KIND = 'resourceAttributeModification';
|
|
16
|
-
export const ENTITY_ATTRIBUTES_SNS_UPDATE_OPERATION_MESSAGE_KIND = 'entityAttributeModification';
|
|
17
5
|
export const ASYNC_RESOURCE_ATTRIBUTES_MAX_OPERATIONS_PER_MESSAGE = 100;
|
|
18
|
-
export const ASYNC_ENTITY_ATTRIBUTES_MAX_OPERATIONS_PER_MESSAGE = 100;
|
|
19
|
-
|
|
20
|
-
// Legacy exports for backward compatibility
|
|
21
|
-
export const SNS_ARN_ENV_VAR_NAME = RESOURCE_SNS_ARN_ENV_VAR_NAME;
|
|
22
|
-
export const SNS_DEV_TEST_NAME = RESOURCE_SNS_DEV_TEST_NAME;
|
package/src/index.ts
CHANGED
|
@@ -57,24 +57,7 @@ export {
|
|
|
57
57
|
skipAuthorizationMiddleware,
|
|
58
58
|
} from './authorization-middleware';
|
|
59
59
|
export { AuthorizationService, AuthorizeResponse } from './authorization-service';
|
|
60
|
-
export {
|
|
61
|
-
export { AuthorizationAttributesMsService } from './authorization-attributes-ms-service';
|
|
62
|
-
export { ResourceAttributeAssignment } from './resource-attribute-assignment';
|
|
63
|
-
export { RESOURCE_TYPES, RESOURCE_ATTRIBUTES_CONSTANTS } from './resource-attributes-constants';
|
|
64
|
-
export { EntityAttributeAssignment } from './entity-attribute-assignment';
|
|
65
|
-
export { ENTITY_TYPES } from './entity-attributes-constants';
|
|
66
|
-
export { ArgumentError } from './errors/argument-error';
|
|
67
|
-
export {
|
|
68
|
-
ResourceAttributeResponse,
|
|
69
|
-
EntityAttributeResponse,
|
|
70
|
-
ResourceType,
|
|
71
|
-
EntityAttributeKeyType,
|
|
72
|
-
ResourceAttributeKeyType,
|
|
73
|
-
CommonAttributeKey,
|
|
74
|
-
ResourceAttributeKey,
|
|
75
|
-
EntityAttributeKey,
|
|
76
|
-
} from './types/authorization-attributes-contracts';
|
|
77
|
-
export type { EntityType } from './entity-attributes-constants';
|
|
60
|
+
export { AuthorizationAttributesService } from './authorization-attributes-service';
|
|
78
61
|
export { RolesService } from './roles-service';
|
|
79
62
|
export { MembershipsService } from './memberships';
|
|
80
63
|
export { AuthorizationObject, Resource, BaseRequest, ResourceGetter, ContextGetter } from './types/general';
|
package/src/roles-service.ts
CHANGED
|
@@ -12,7 +12,7 @@ export class RolesService {
|
|
|
12
12
|
private attributionHeaders: { [key: string]: string };
|
|
13
13
|
|
|
14
14
|
/**
|
|
15
|
-
* Public constructor to create the
|
|
15
|
+
* Public constructor to create the AuthorizationAttributesService instance.
|
|
16
16
|
* @param httpClient The HTTP client to use for API requests, if not provided, the default HTTP client from Api will be used.
|
|
17
17
|
* @param fetchOptions The fetch options to use for API requests, if not provided, the default fetch options will be used.
|
|
18
18
|
*/
|
|
@@ -1,71 +1,27 @@
|
|
|
1
1
|
import { Resource } from './general';
|
|
2
|
-
import type { EntityType } from '../entity-attributes-constants';
|
|
3
|
-
import type { ResourceType } from '../resource-attributes-constants';
|
|
4
2
|
|
|
5
|
-
export type { EntityType, ResourceType };
|
|
6
|
-
|
|
7
|
-
// Common attribute keys that can be used for both resources and entities
|
|
8
|
-
export type CommonAttributeKey = string;
|
|
9
|
-
|
|
10
|
-
// Resource-specific attribute keys
|
|
11
|
-
export type ResourceAttributeKey = string;
|
|
12
|
-
|
|
13
|
-
// Entity-specific attribute keys
|
|
14
|
-
export type EntityAttributeKey = string;
|
|
15
|
-
|
|
16
|
-
// Combined types for attribute keys
|
|
17
|
-
export type ResourceAttributeKeyType = CommonAttributeKey | ResourceAttributeKey;
|
|
18
|
-
export type EntityAttributeKeyType = CommonAttributeKey | EntityAttributeKey;
|
|
19
|
-
|
|
20
|
-
// Resource Attribute Assignment - matching API contract
|
|
21
3
|
export interface ResourceAttributeAssignment {
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
key:
|
|
25
|
-
value: string;
|
|
26
|
-
}
|
|
27
|
-
|
|
28
|
-
// Entity Attribute Assignment - matching API contract
|
|
29
|
-
// Note: For validation, use the EntityAttributeAssignment class from '../entity-attribute-assignment'
|
|
30
|
-
export interface EntityAttributeAssignment {
|
|
31
|
-
entityId: number;
|
|
32
|
-
entityType: EntityType;
|
|
33
|
-
key: EntityAttributeKeyType;
|
|
4
|
+
resourceType: Resource['type'];
|
|
5
|
+
resourceId: Resource['id'];
|
|
6
|
+
key: string;
|
|
34
7
|
value: string;
|
|
35
8
|
}
|
|
36
9
|
|
|
37
|
-
// Response types
|
|
38
10
|
export interface ResourceAttributeResponse {
|
|
39
11
|
attributes: ResourceAttributeAssignment[];
|
|
40
12
|
}
|
|
41
13
|
|
|
42
|
-
export interface EntityAttributeResponse {
|
|
43
|
-
attributes: EntityAttributeAssignment[];
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
// Legacy types for backward compatibility
|
|
47
14
|
export interface ResourceAttributeDelete {
|
|
48
15
|
resourceType: Resource['type'];
|
|
49
16
|
resourceId: Resource['id'];
|
|
50
17
|
key: string;
|
|
51
18
|
}
|
|
52
19
|
|
|
53
|
-
export interface EntityAttributeDelete {
|
|
54
|
-
entityType: EntityType;
|
|
55
|
-
entityId: number;
|
|
56
|
-
key: string;
|
|
57
|
-
}
|
|
58
|
-
|
|
59
20
|
export enum ResourceAttributeOperationEnum {
|
|
60
21
|
UPSERT = 'upsert',
|
|
61
22
|
DELETE = 'delete',
|
|
62
23
|
}
|
|
63
24
|
|
|
64
|
-
export enum EntityAttributeOperationEnum {
|
|
65
|
-
UPSERT = 'upsert',
|
|
66
|
-
DELETE = 'delete',
|
|
67
|
-
}
|
|
68
|
-
|
|
69
25
|
interface UpsertResourceAttributeOperation extends ResourceAttributeAssignment {
|
|
70
26
|
operationType: ResourceAttributeOperationEnum.UPSERT;
|
|
71
27
|
}
|
|
@@ -74,13 +30,4 @@ interface DeleteResourceAttributeOperation extends ResourceAttributeDelete {
|
|
|
74
30
|
operationType: ResourceAttributeOperationEnum.DELETE;
|
|
75
31
|
}
|
|
76
32
|
|
|
77
|
-
interface UpsertEntityAttributeOperation extends EntityAttributeAssignment {
|
|
78
|
-
operationType: EntityAttributeOperationEnum.UPSERT;
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
interface DeleteEntityAttributeOperation extends EntityAttributeDelete {
|
|
82
|
-
operationType: EntityAttributeOperationEnum.DELETE;
|
|
83
|
-
}
|
|
84
|
-
|
|
85
33
|
export type ResourceAttributesOperation = UpsertResourceAttributeOperation | DeleteResourceAttributeOperation;
|
|
86
|
-
export type EntityAttributesOperation = UpsertEntityAttributeOperation | DeleteEntityAttributeOperation;
|
|
@@ -1,67 +0,0 @@
|
|
|
1
|
-
import { ResourceAttributeAssignment } from './resource-attribute-assignment';
|
|
2
|
-
import { EntityAttributeAssignment } from './entity-attribute-assignment';
|
|
3
|
-
import { EntityType, EntityAttributeKeyType } from './types/authorization-attributes-contracts';
|
|
4
|
-
interface Resource {
|
|
5
|
-
resourceType: string;
|
|
6
|
-
resourceId: number;
|
|
7
|
-
}
|
|
8
|
-
/**
|
|
9
|
-
* Service class for managing resource attributes in the authorization microservice.
|
|
10
|
-
* Provides synchronous HTTP operations to create/update and delete attributes on resources.
|
|
11
|
-
*/
|
|
12
|
-
export declare class AuthorizationAttributesMsService {
|
|
13
|
-
private static LOG_TAG;
|
|
14
|
-
/**
|
|
15
|
-
* Gets request headers including Authorization, Content-Type, and optional attribution headers
|
|
16
|
-
*/
|
|
17
|
-
private static getRequestHeaders;
|
|
18
|
-
/**
|
|
19
|
-
* Validates that all messages are instances of the specified message class
|
|
20
|
-
*/
|
|
21
|
-
private static validateMessages;
|
|
22
|
-
/**
|
|
23
|
-
* Handles request errors with consistent logging and error formatting
|
|
24
|
-
*/
|
|
25
|
-
private static handleRequestError;
|
|
26
|
-
/**
|
|
27
|
-
* Generic helper for executing upsert requests
|
|
28
|
-
*/
|
|
29
|
-
private static executeUpsertRequest;
|
|
30
|
-
/**
|
|
31
|
-
* Generic helper for executing delete requests
|
|
32
|
-
*/
|
|
33
|
-
private static executeDeleteRequest;
|
|
34
|
-
/**
|
|
35
|
-
* Creates or updates resource attributes synchronously.
|
|
36
|
-
* @param accountId The account ID
|
|
37
|
-
* @param resourceAttributeAssignments Array of ResourceAttributeAssignment objects
|
|
38
|
-
* @returns Promise<void>
|
|
39
|
-
*/
|
|
40
|
-
static upsertResourceAttributesSync(accountId: number, resourceAttributeAssignments: ResourceAttributeAssignment[]): Promise<void>;
|
|
41
|
-
/**
|
|
42
|
-
* Deletes specific attributes from a resource synchronously.
|
|
43
|
-
* @param accountId The account ID
|
|
44
|
-
* @param resource Object with resourceType (string) and resourceId (number)
|
|
45
|
-
* @param attributeKeys Array of attribute key strings to delete
|
|
46
|
-
* @returns Promise<void>
|
|
47
|
-
*/
|
|
48
|
-
static deleteResourceAttributesSync(accountId: number, resource: Resource, attributeKeys: string[]): Promise<void>;
|
|
49
|
-
/**
|
|
50
|
-
* Creates or updates entity attributes synchronously.
|
|
51
|
-
* @param accountId The account ID
|
|
52
|
-
* @param entityAttributeAssignments Array of EntityAttributeAssignment objects
|
|
53
|
-
* @returns Promise<void>
|
|
54
|
-
*/
|
|
55
|
-
static upsertEntityAttributesSync(accountId: number, entityAttributeAssignments: EntityAttributeAssignment[]): Promise<void>;
|
|
56
|
-
/**
|
|
57
|
-
* Deletes specific attributes from an entity synchronously.
|
|
58
|
-
* @param accountId The account ID
|
|
59
|
-
* @param entityType The entity type
|
|
60
|
-
* @param entityId The entity ID
|
|
61
|
-
* @param attributeKeys Array of attribute key strings to delete
|
|
62
|
-
* @returns Promise<void>
|
|
63
|
-
*/
|
|
64
|
-
static deleteEntityAttributesSync(accountId: number, entityType: EntityType, entityId: number, attributeKeys: EntityAttributeKeyType[]): Promise<void>;
|
|
65
|
-
}
|
|
66
|
-
export {};
|
|
67
|
-
//# sourceMappingURL=authorization-attributes-ms-service.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"authorization-attributes-ms-service.d.ts","sourceRoot":"","sources":["../src/authorization-attributes-ms-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAchG,UAAU,QAAQ;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwBD;;;GAGG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAiC;IAEvD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IA+ChC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAiB/B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAmBjC;;OAEG;mBACkB,oBAAoB;IA0EzC;;OAEG;mBACkB,oBAAoB;IAmEzC;;;;;OAKG;WACU,4BAA4B,CACvC,SAAS,EAAE,MAAM,EACjB,4BAA4B,EAAE,2BAA2B,EAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;OAMG;WACU,4BAA4B,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;OAKG;WACU,0BAA0B,CACrC,SAAS,EAAE,MAAM,EACjB,0BAA0B,EAAE,yBAAyB,EAAE,GACtD,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;;OAOG;WACU,0BAA0B,CACrC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,sBAAsB,EAAE,GACtC,OAAO,CAAC,IAAI,CAAC;CAmBjB"}
|