@things-factory/auth-base 8.0.0-beta.8 → 8.0.0

package/server/service/granted-role/granted-role-mutation.ts

@@ -0,0 +1,156 @@
+import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'
+import { EntityManager, In, Not, Repository } from 'typeorm'
+
+import { Domain, getRepository } from '@things-factory/shell'
+
+import { Partner } from '../partner/partner'
+import { Role } from '../role/role'
+import { RolePatch } from '../role/role-types'
+import { User } from '../user/user'
+import { GrantedRole } from './granted-role'
+
+@Resolver(GrantedRole)
+export class GrantedRoleMutation {
+  @Directive('@privilege(category: "partner", privilege: "mutation")')
+  @Directive('@transaction')
+  @Mutation(returns => Boolean)
+  async grantRoles(
+    @Arg('customerId') customerId: string,
+    @Arg('roles', type => [RolePatch]) roles: RolePatch[],
+    @Ctx() context: ResolverContext
+  ): Promise<Boolean> {
+    const { tx, domain } = context.state
+    // Check if current domain has partnership with passed `customer`
+    const customerDomain: Domain = await tx.getRepository(Domain).findOneBy({ id: customerId })
+    const customer: Partner = await tx.getRepository(Partner).findOne({
+      where: { domain: { id: domain.id }, partnerDomain: { id: customerDomain.id } }
+    })
+
+    if (!customer) throw new Error(`Failed to find partnership with customer`)
+
+    // Remove existing granted roles
+    const grantedRoles: GrantedRole[] = await getGrantedRolesToCustomer(domain, customerDomain, tx)
+    if (grantedRoles.length) {
+      await tx.getRepository(GrantedRole).delete(grantedRoles.map((gr: GrantedRole) => gr.id))
+    }
+
+    // Insert newly granted roles
+    await tx.getRepository(Role).findBy({
+      id: In(roles.map((role: Partial<Role>) => role.id))
+    })
+    const newlyGrantedRoles: Partial<GrantedRole>[] = roles.map((role: Role) => {
+      return {
+        domain: customerDomain,
+        role
+      }
+    })
+
+    await tx.getRepository(GrantedRole).save(newlyGrantedRoles)
+
+    // If there's someone having role which will be removed (refuse roles)
+    // user roles should be removed as well
+    const grantedRoleIds: string[] = roles.map((role: Partial<Role>) => role.id)
+    const nonGrantedRoles: Role[] = await tx.getRepository(Role).find({
+      where: { domain: { id: domain.id }, id: Not(In(grantedRoleIds)) }
+    })
+
+    if (nonGrantedRoles?.length) {
+      // Find customer's user who has non granted roles already
+      const nonGrantedRoleIds: string[] = nonGrantedRoles.map((role: Role) => role.id)
+
+      let havingRefusedRoleCustomers: User[] = await getCustomerUsersByRoles(customerDomain, nonGrantedRoles, tx)
+      havingRefusedRoleCustomers = havingRefusedRoleCustomers.map((customerUser: User) => {
+        const customerDomains: Domain[] = customerUser.domains
+        const customerDomainIds: string[] = customerDomains.map((domain: Domain) => domain.id)
+        if (customerDomainIds.indexOf(domain.id) >= 0) {
+          // Case for customer user is a member of current domain.
+          // If user is a member of current domain user can have any roles of the domain even if the roles is not granted
+          return customerUser
+        } else {
+          // Case for customer user is an user of partner domain.
+          // An user of partner domain only can have granted roles
+          customerUser.roles = customerUser.roles.filter((role: Role) => nonGrantedRoleIds.indexOf(role.id) < 0)
+          return customerUser
+        }
+      })
+
+      await tx.getRepository(User).save(havingRefusedRoleCustomers)
+    }
+    return true
+  }
+}
+
+export async function getGrantedCustomerUsers(
+  domain: Domain,
+  customerDomain: Domain,
+  trx?: EntityManager
+): Promise<User[]> {
+  const grantedRoles: GrantedRole[] = await getGrantedRolesToCustomer(domain, customerDomain, trx)
+  const roles: Role[] = grantedRoles.map((grantedRole: GrantedRole) => grantedRole.role)
+  return await getCustomerUsersByRoles(customerDomain, roles, trx)
+}
+
+export async function getCustomerUsersByRoles(
+  customerDomain: Domain,
+  roles: Role[],
+  trx?: EntityManager
+): Promise<User[]> {
+  if (!roles.length) return []
+  const userRepo: Repository<User> = trx?.getRepository(User) || getRepository(User)
+
+  const customerUsers: User[] = await userRepo
+    .createQueryBuilder('USER')
+    .select('USER.id')
+    .distinct(true)
+    .leftJoin('USER.domains', 'U_DOMAIN')
+    .leftJoin('USER.roles', 'U_ROLE')
+    .where('U_DOMAIN.id = :customerDomainId', { customerDomainId: customerDomain.id })
+    .groupBy('USER.id')
+    .addGroupBy('U_ROLE.id')
+    .having('U_ROLE.id IN (:...roleIds)', {
+      roleIds: roles.map((role: Role) => role.id)
+    })
+    .getMany()
+
+  return await userRepo.find({
+    where: {
+      id: In(customerUsers.map((user: User) => user.id))
+    },
+    relations: ['domains', 'roles', 'roles.domain']
+  })
+}
+
+async function getGrantedRolesToCustomer(
+  domain: Domain,
+  customerDomain: Domain,
+  trx?: EntityManager
+): Promise<GrantedRole[]> {
+  const grantedRoleRepo: Repository<GrantedRole> = trx?.getRepository(GrantedRole) || getRepository(GrantedRole)
+  const grantedRoleQueryBuilder = grantedRoleRepo.createQueryBuilder('GRANTED_ROLE')
+  return await grantedRoleQueryBuilder
+    .leftJoinAndSelect('GRANTED_ROLE.domain', 'DOMAIN')
+    .leftJoinAndSelect('GRANTED_ROLE.role', 'ROLE')
+    .leftJoin('ROLE.domain', 'R_DOMAIN')
+    .where('R_DOMAIN.id = :domainId', { domainId: domain.id })
+    .andWhere('DOMAIN.id = :customerDomainId', { customerDomainId: customerDomain.id })
+    .getMany()
+}
+
+export async function terminateGrantedRoles(
+  domain: Domain,
+  customerDomain: Domain,
+  trx?: EntityManager
+): Promise<void> {
+  const userRepo: Repository<User> = trx?.getRepository(User) || getRepository(User)
+  const grantedRoleRepo: Repository<GrantedRole> = trx?.getRepository(GrantedRole) || getRepository(GrantedRole)
+
+  const grantedRoles: GrantedRole[] = await getGrantedRolesToCustomer(domain, customerDomain, trx)
+  const customerUsers: User[] = await getGrantedCustomerUsers(domain, customerDomain, trx)
+
+  for (let i: number = 0; i < customerUsers.length; i++) {
+    customerUsers[i].roles = customerUsers[i].roles.filter((role: Role) => role.domain.id !== domain.id)
+  }
+
+  if (customerUsers?.length) await userRepo.save(customerUsers)
+  if (grantedRoles?.length) await grantedRoleRepo.delete(grantedRoles.map((grantedRole: GrantedRole) => grantedRole.id))
+}

package/server/service/granted-role/granted-role-query.ts

@@ -0,0 +1,60 @@
+import { Arg, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'
+import { SelectQueryBuilder } from 'typeorm'
+
+import { Domain, getRepository } from '@things-factory/shell'
+
+import { Partner } from '../partner/partner'
+import { Role } from '../role/role'
+import { GrantedRole } from './granted-role'
+
+@Resolver(GrantedRole)
+export class GrantedRoleQuery {
+  @Directive('@privilege(category: "user", privilege: "query", domainOwnerGranted: true, superUserGranted: true)')
+  @Query(returns => [GrantedRole])
+  async grantedRoles(@Ctx() context: ResolverContext): Promise<GrantedRole[]> {
+    const { domain } = context.state
+    return await getRepository(GrantedRole).find({
+      where: { domain: { id: domain.id } }
+    })
+  }
+
+  /**
+   * @summary The role list that target customer being granted by domain.
+   *
+   * @param customerId
+   * @param context
+   * @returns
+   */
+  @Directive('@privilege(category: "user", privilege: "query", domainOwnerGranted: true)')
+  @Query(returns => [GrantedRole])
+  async grantingRoles(@Arg('customerId') customerId: string, @Ctx() context: ResolverContext): Promise<GrantedRole[]> {
+    const { domain } = context.state
+    const customerDomain: Domain = await getRepository(Domain).findOneBy({ id: customerId })
+
+    if (!customerDomain) throw new Error(`Failed to find customer by passed customerId (${customerId})`)
+
+    const hasPartnership: boolean = Boolean(
+      await getRepository(Partner).countBy({ domain: { id: domain.id }, partnerDomain: { id: customerDomain.id } })
+    )
+
+    if (!hasPartnership) throw new Error(`Company doesn't have partnership with ${customerDomain.name}`)
+
+    const qb: SelectQueryBuilder<GrantedRole> = getRepository(GrantedRole)
+      .createQueryBuilder('GRANTED_ROLE')
+      .leftJoin('GRANTED_ROLE.role', 'ROLE')
+      .where('GRANTED_ROLE.domain_id = :customerId', { customerId })
+      .andWhere('ROLE.domain_id = :domainId ', { domainId: domain.id })
+
+    return await qb.getMany()
+  }
+
+  @FieldResolver(type => Role)
+  async role(@Root() grantedRole: GrantedRole): Promise<Role> {
+    return await getRepository(Role).findOneBy({ id: grantedRole.roleId })
+  }
+
+  @FieldResolver(type => Domain)
+  async domain(@Root() grantedRole: GrantedRole): Promise<Domain> {
+    return await getRepository(Domain).findOneBy({ id: grantedRole.domainId })
+  }
+}

package/server/service/granted-role/granted-role.ts

@@ -0,0 +1,27 @@
+import { Domain } from '@things-factory/shell'
+import { Role } from '../role/role'
+import { ObjectType, Field, ID } from 'type-graphql'
+import { Entity, ManyToOne, PrimaryGeneratedColumn, Index, RelationId } from 'typeorm'
+
+@Entity()
+@Index('ix_granted_role_0', (grantedRole: GrantedRole) => [grantedRole.role, grantedRole.domain], { unique: true })
+@ObjectType()
+export class GrantedRole {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @ManyToOne(type => Role)
+  @Field()
+  role: Role
+
+  @RelationId((grantedRole: GrantedRole) => grantedRole.role)
+  roleId: string
+
+  @ManyToOne(type => Domain)
+  @Field(type => Domain)
+  domain?: Domain
+
+  @RelationId((grantedRole: GrantedRole) => grantedRole.domain)
+  domainId: string
+}

package/server/service/granted-role/index.ts

@@ -0,0 +1,6 @@
+import { GrantedRole } from './granted-role'
+import { GrantedRoleQuery } from './granted-role-query'
+import { GrantedRoleMutation } from './granted-role-mutation'
+
+export const entities = [GrantedRole]
+export const resolvers = [GrantedRoleQuery, GrantedRoleMutation]

package/server/service/index.ts

@@ -0,0 +1,90 @@
+/* IMPORT ENTITIES AND RESOLVERS */
+import { entities as UsersAuthProvidersEntities, resolvers as UsersAuthProvidersResolvers } from './users-auth-providers'
+import { entities as AuthProviderEntities, resolvers as AuthProviderResolvers } from './auth-provider'
+import { resolvers as AppbindingResolver } from './app-binding'
+import { entities as ApplianceEntities, resolvers as ApplianceResolvers } from './appliance'
+import { entities as ApplicationEntities, resolvers as ApplicationResolvers } from './application'
+import { resolvers as DomainGeneratorResolver } from './domain-generator'
+import { entities as GrantedRoleEntities, resolvers as GrantedRoleResolver } from './granted-role'
+import { entities as InvitationEntities, resolvers as InvitationResolver } from './invitation'
+import { entities as LoginHistoryEntities, resolvers as LoginHistoryResolver } from './login-history'
+import { entities as PartnerEntities, resolvers as PartnerResolvers } from './partner'
+import { entities as PasswordHistoryEntities } from './password-history'
+import { entities as PrivilegeEntities, resolvers as PrivilegeResolvers } from './privilege'
+import { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } from './privilege/privilege-directive'
+import { entities as RoleEntities, resolvers as RoleResolvers } from './role'
+import { entities as UserEntities, resolvers as UserResolvers } from './user'
+import { entities as VerificationTokenEntities } from './verification-token'
+import { entities as WebAuthCredentialEntities } from './web-auth-credential'
+
+/* EXPORT ENTITY TYPES */
+export * from './users-auth-providers/users-auth-providers'
+export * from './auth-provider/auth-provider'
+export * from './application/application'
+export * from './appliance/appliance'
+export * from './privilege/privilege'
+export * from './role/role'
+export * from './user/user'
+export * from './partner/partner'
+export * from './granted-role/granted-role'
+export * from './invitation/invitation'
+export * from './app-binding/app-binding'
+export * from './password-history/password-history'
+export * from './verification-token/verification-token'
+export * from './login-history/login-history'
+export * from './web-auth-credential/web-auth-credential'
+
+/* EXPORT TYPES */
+export * from './app-binding/app-binding-types'
+export * from './appliance/appliance-types'
+export * from './application/application-types'
+export * from './domain-generator/domain-generator-types'
+export * from './invitation/invitation-types'
+export * from './partner/partner-types'
+export * from './privilege/privilege-types'
+export * from './role/role-types'
+export * from './user/user-types'
+
+export const entities = [
+  /* ENTITIES */
+  ...UsersAuthProvidersEntities,
+  ...AuthProviderEntities,
+  ...ApplicationEntities,
+  ...ApplianceEntities,
+  ...PrivilegeEntities,
+  ...RoleEntities,
+  ...UserEntities,
+  ...PartnerEntities,
+  ...GrantedRoleEntities,
+  ...InvitationEntities,
+  ...PasswordHistoryEntities,
+  ...VerificationTokenEntities,
+  ...LoginHistoryEntities,
+  ...WebAuthCredentialEntities
+]
+
+export const schema = {
+  typeDefs: {
+    privilegeDirectiveTypeDefs
+  },
+
+  resolverClasses: [
+    /* RESOLVER CLASSES */
+    ...UsersAuthProvidersResolvers,
+    ...AuthProviderResolvers,
+    ...ApplicationResolvers,
+    ...ApplianceResolvers,
+    ...PrivilegeResolvers,
+    ...RoleResolvers,
+    ...UserResolvers,
+    ...PartnerResolvers,
+    ...GrantedRoleResolver,
+    ...InvitationResolver,
+    ...AppbindingResolver,
+    ...DomainGeneratorResolver,
+    ...LoginHistoryResolver
+  ],
+  directives: {
+    privilege: privilegeDirectiveResolver
+  }
+}

package/server/service/invitation/index.ts

@@ -0,0 +1,6 @@
+import { Invitation } from './invitation'
+import { InvitationQuery } from './invitation-query'
+import { InvitationMutation } from './invitation-mutation'
+
+export const entities = [Invitation]
+export const resolvers = [InvitationQuery, InvitationMutation]

package/server/service/invitation/invitation-mutation.ts

@@ -0,0 +1,63 @@
+import { Arg, Ctx, Mutation, Resolver } from 'type-graphql'
+import { GraphQLEmailAddress } from 'graphql-scalars'
+
+import { getRepository } from '@things-factory/shell'
+
+import { sendInvitationEmail } from '../../controllers/invitation'
+import { Invitation } from './invitation'
+
+@Resolver(Invitation)
+export class InvitationMutation {
+  @Mutation(returns => Boolean)
+  async cancelInvitation(
+    @Arg('email', type => GraphQLEmailAddress) email: string,
+    @Arg('reference') reference: string,
+    @Arg('type') type: string
+  ) {
+    const repository = getRepository(Invitation)
+
+    await repository.delete({
+      email,
+      reference,
+      type
+    })
+
+    return true
+  }
+
+  @Mutation(returns => Invitation)
+  async sendInvitation(
+    @Arg('email', type => GraphQLEmailAddress) email: string,
+    @Arg('reference') reference: string,
+    @Arg('type') type: string,
+    @Ctx() context: ResolverContext
+  ) {
+    const repository = getRepository(Invitation)
+
+    const oldone = await repository.findOneBy({
+      email,
+      type,
+      reference
+    })
+
+    // TODO send invitation
+    await sendInvitationEmail({
+      invitation: {
+        email,
+        reference,
+        type
+      },
+      context
+    })
+
+    // update or create
+    return await repository.save({
+      ...oldone, // take only id from oldone for update
+      email,
+      reference,
+      type,
+      creator: context.state.user,
+      updater: context.state.user
+    })
+  }
+}

package/server/service/invitation/invitation-query.ts

@@ -0,0 +1,33 @@
+import { GraphQLEmailAddress } from 'graphql-scalars'
+import { Arg, Query, Resolver } from 'type-graphql'
+
+import { getRepository } from '@things-factory/shell'
+
+import { Invitation } from './invitation'
+import { InvitationList } from './invitation-types'
+
+@Resolver(Invitation)
+export class InvitationQuery {
+  @Query(returns => Invitation)
+  async invitation(
+    @Arg('email', type => GraphQLEmailAddress) email: string,
+    @Arg('reference') reference: string,
+    @Arg('type') type: string
+  ) {
+    return await getRepository(Invitation).findOneBy({
+      email,
+      reference,
+      type
+    })
+  }
+
+  @Query(returns => InvitationList)
+  async invitations(@Arg('reference') reference: string, @Arg('type') type: string) {
+    const [items, total] = await getRepository(Invitation).findAndCountBy({
+      reference,
+      type
+    })
+
+    return { items, total }
+  }
+}

package/server/service/invitation/invitation-types.ts

@@ -0,0 +1,11 @@
+import { Invitation } from './invitation'
+import { ObjectType, Field, Int } from 'type-graphql'
+
+@ObjectType()
+export class InvitationList {
+  @Field(type => [Invitation], { nullable: true })
+  items: Invitation[]
+
+  @Field(type => Int, { nullable: true })
+  total: number
+}

package/server/service/invitation/invitation.ts

@@ -0,0 +1,63 @@
+import {
+  CreateDateColumn,
+  UpdateDateColumn,
+  Entity,
+  Index,
+  Column,
+  ManyToOne,
+  RelationId,
+  PrimaryGeneratedColumn
+} from 'typeorm'
+import { ObjectType, Field, ID } from 'type-graphql'
+import { GraphQLEmailAddress } from 'graphql-scalars'
+import { User } from '../user/user'
+
+@Entity()
+@Index('ix_invitation_0', (invitation: Invitation) => [invitation.email, invitation.reference, invitation.type], {
+  unique: true
+})
+@Index('ix_invitation_1', (invitation: Invitation) => [invitation.token], { unique: true })
+@ObjectType()
+export class Invitation {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @Column()
+  @Field(type => GraphQLEmailAddress)
+  email: string
+
+  @Column()
+  @Field()
+  reference: string // company, bizplace
+
+  @Column()
+  @Field()
+  type: string // company, bizplace, .. should think whether this column needs.
+
+  @Column()
+  @Field()
+  token: string
+
+  @CreateDateColumn({ nullable: true })
+  @Field({ nullable: true })
+  createdAt: Date
+
+  @UpdateDateColumn({ nullable: true })
+  @Field({ nullable: true })
+  updatedAt: Date
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field({ nullable: true })
+  creator: User
+
+  @RelationId((invitation: Invitation) => invitation.creator)
+  creatorId: string
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field({ nullable: true })
+  updater: User
+
+  @RelationId((invitation: Invitation) => invitation.updater)
+  updaterId: string
+}

package/server/service/login-history/index.ts

@@ -0,0 +1,5 @@
+import { LoginHistory } from './login-history'
+import { LoginHistoryQuery } from './login-history-query'
+
+export const entities = [LoginHistory]
+export const resolvers = [LoginHistoryQuery]

package/server/service/login-history/login-history-query.ts

@@ -0,0 +1,51 @@
+import { Arg, Args, Ctx, FieldResolver, Query, Resolver, Root } from 'type-graphql'
+
+import { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'
+
+import { User } from '../user/user'
+import { LoginHistory } from './login-history'
+import { LoginHistoryList } from './login-history-type'
+
+@Resolver(LoginHistory)
+export class LoginHistoryQuery {
+  @Query(returns => LoginHistoryList, { description: 'To fetch multiple LoginHistories' })
+  async loginHistories(
+    @Args(type => ListParam) params: ListParam,
+    @Ctx() context: ResolverContext
+  ): Promise<LoginHistoryList> {
+    const { domain } = context.state
+
+    const queryBuilder = getQueryBuilderFromListParams({
+      domain,
+      params,
+      repository: await getRepository(LoginHistory)
+    })
+
+    const [items, total] = await queryBuilder.getManyAndCount()
+    return { items, total }
+  }
+
+  @Query(returns => [LoginHistory])
+  async myLoginHistories(@Arg('limit') limit: number, @Ctx() context: ResolverContext): Promise<LoginHistory[]> {
+    const user: User = context.state.user
+    if (!user) {
+      throw new Error('No user specified')
+    }
+
+    return await getRepository(LoginHistory).find({
+      where: { accessUser: { id: user.id } },
+      take: limit || 10,
+      order: { accessedAt: 'DESC' }
+    })
+  }
+
+  @FieldResolver()
+  async accessDomain(@Root() loginHistory: LoginHistory) {
+    return await getRepository(Domain).findOneBy({ id: loginHistory.accessDomainId })
+  }
+
+  @FieldResolver()
+  async accessUser(@Root() loginHistory: LoginHistory) {
+    return await getRepository(User).findOneBy({ id: loginHistory.accessUserId })
+  }
+}

package/server/service/login-history/login-history-type.ts

@@ -0,0 +1,12 @@
+import { Field, ID, InputType, Int, ObjectType } from 'type-graphql'
+
+import { LoginHistory } from './login-history'
+
+@ObjectType()
+export class LoginHistoryList {
+  @Field(type => [LoginHistory])
+  items: LoginHistory[]
+
+  @Field(type => Int)
+  total: number
+}

package/server/service/login-history/login-history.ts

@@ -0,0 +1,45 @@
+import { Field, ID, ObjectType } from 'type-graphql'
+import { Column, CreateDateColumn, Entity, Index, ManyToOne, PrimaryGeneratedColumn, RelationId } from 'typeorm'
+
+import { Domain, getRepository } from '@things-factory/shell'
+
+import { User } from '../user/user'
+
+@Entity()
+@Index('ix_login_history_0', (loginHistory: LoginHistory) => [loginHistory.accessDomain, loginHistory.accessUser])
+@ObjectType()
+export class LoginHistory {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @ManyToOne(type => Domain)
+  @Field(type => Domain)
+  accessDomain?: Domain
+
+  @RelationId((loginHistory: LoginHistory) => loginHistory.accessDomain)
+  accessDomainId: string
+
+  @ManyToOne(type => User)
+  @Field(type => User)
+  accessUser: User
+
+  @RelationId((loginHistory: LoginHistory) => loginHistory.accessUser)
+  accessUserId: string
+
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  accessorIp: string
+
+  @CreateDateColumn()
+  @Field({ nullable: true })
+  accessedAt: Date
+
+  static async stamp(accessDomain: Partial<Domain>, accessUser: User, accessorIp: string): Promise<void> {
+    await getRepository(LoginHistory).save({
+      accessDomain,
+      accessUser,
+      accessorIp
+    })
+  }
+}

package/server/service/partner/index.ts

@@ -0,0 +1,6 @@
+import { Partner } from './partner'
+import { PartnerQuery } from './partner-query'
+import { PartnerMutation } from './partner-mutation'
+
+export const entities = [Partner]
+export const resolvers = [PartnerQuery, PartnerMutation]