soajs.controller 4.3.17 → 4.3.18

package/test/data/provision/hosts/departments.js

@@ -0,0 +1,12 @@
+'use strict';
+
+let host = {
+    _id: "5da078e22357684b57effcf1",
+    env: "dev",
+    ip: "127.0.0.1",
+    name: "departments",
+    version: "1",
+    port: 4013
+};
+
+module.exports = host;

package/test/data/provision/marketplace/departments.js

@@ -0,0 +1,38 @@
+'use strict';
+
+let service = {
+	_id: "5da078c92357684b57effcf0",
+	"type": "service",
+	name: "departments",
+	configuration: {
+		group: "SOAJS test",
+		port: 4013,
+		requestTimeout: 30,
+		requestTimeoutRenewal: 5
+	},
+	versions: [{
+		"version": "1",
+		maintenance: {
+			"port": {
+				"type": "maintenance"
+			},
+			"readiness": "/heartbeat"
+		},
+		oauth: true,
+		extKeyRequired: true,
+		urac: false,
+		urac_Profile: false,
+		urac_ACL: false,
+		provision_ACL: false,
+		apis: [
+			{
+				l: "Tenant access resolver",
+				v: "/tenant/access",
+				m: "post",
+				group: "Integration test"
+			}
+		]
+	}
+	]
+};
+module.exports = service;

package/test/data/provision/oauth/token/department_member_token.js

@@ -0,0 +1,72 @@
+'use strict';
+
+let token = {
+    _id: "5cdc190fd52c82e0ddb1dcd6",
+    type: "accessToken",
+    token: "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d901",
+    clientId: "5c0e74ba9acc3c5a84a51260",
+    user: {
+        _id: "5c8d0c505653de3985aa1001",
+        locked: true,
+        username: "dept_member",
+        firstName: "owner3'sèį",
+        lastName: "owner",
+        email: "me@localhost.com",
+        "ts": new Date().getTime(),
+        status: "active",
+        profile: {},
+        groups: [
+            "owner"
+        ],
+        config: {
+            packages: {},
+            keys: {},
+            allowedTenants: [
+                {
+                    tenant: {
+                        id: "THYME_tID",
+                        code: "THYME_CODE",
+                        pin: {
+                            code: "5678",
+                            allowed: true
+                        }
+                    },
+                    groups: [
+                        "waiter"
+                    ]
+                },
+                {
+                    tenant: {
+                        id: "ELVIRA_tID",
+                        code: "ELVIRA_CODE"
+                    },
+                    groups: [
+                        "manager"
+                    ]
+                }
+            ]
+        },
+        tenant: {
+            id: "5c0e74ba9acc3c5a84a51260",
+            code: "HOME",
+            pin: {
+                code: "1235",
+                allowed: true
+            }
+        },
+        lastLogin: new Date().getTime(),
+        groupsConfig: {
+            allowedPackages: {
+                DSBRD: [
+                    "DSBRD_OWNER"
+                ]
+            },
+            allowedEnvironments: {}
+        },
+        loginMode: "urac",
+        id: "5c8d0c505653de3985aa1001"
+    },
+    env: "dev",
+    expires: new Date((new Date().getFullYear()) + 2, 0, 1)
+};
+module.exports = token;

package/test/data/provision/oauth/token/department_outsider_token.js

@@ -0,0 +1,72 @@
+'use strict';
+
+let token = {
+    _id: "5cdc190fd52c82e0ddb1dcd7",
+    type: "accessToken",
+    token: "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d902",
+    clientId: "5c0e74ba9acc3c5a84a51260",
+    user: {
+        _id: "5c8d0c505653de3985aa1002",
+        locked: true,
+        username: "dept_outsider",
+        firstName: "owner3'sèį",
+        lastName: "owner",
+        email: "me@localhost.com",
+        "ts": new Date().getTime(),
+        status: "active",
+        profile: {},
+        groups: [
+            "owner"
+        ],
+        config: {
+            packages: {},
+            keys: {},
+            allowedTenants: [
+                {
+                    tenant: {
+                        id: "THYME_tID",
+                        code: "THYME_CODE",
+                        pin: {
+                            code: "5678",
+                            allowed: true
+                        }
+                    },
+                    groups: [
+                        "waiter"
+                    ]
+                },
+                {
+                    tenant: {
+                        id: "ELVIRA_tID",
+                        code: "ELVIRA_CODE"
+                    },
+                    groups: [
+                        "manager"
+                    ]
+                }
+            ]
+        },
+        tenant: {
+            id: "5c0e74ba9acc3c5a84a51260",
+            code: "HOME",
+            pin: {
+                code: "1235",
+                allowed: true
+            }
+        },
+        lastLogin: new Date().getTime(),
+        groupsConfig: {
+            allowedPackages: {
+                DSBRD: [
+                    "DSBRD_OWNER"
+                ]
+            },
+            allowedEnvironments: {}
+        },
+        loginMode: "urac",
+        id: "5c8d0c505653de3985aa1002"
+    },
+    env: "dev",
+    expires: new Date((new Date().getFullYear()) + 2, 0, 1)
+};
+module.exports = token;

package/test/data/provision/tenants/dbtn.js

@@ -5,6 +5,12 @@ let tenant = {
     "code": "DBTN",
     "locked": true,
     "name": "Console Tenant",
+    "profile": {
+        "access": {
+            "resolver": "department",
+            "subject": "dept_1"
+        }
+    },
     "description": "This is the tenant that holds the access rights and configuration for the console users with DSBRD_GUEST as Guest default package",
     "oauth": {
         "secret": "this is a secret",

package/test/integration/UC5-tenant-access/index.js

@@ -0,0 +1,153 @@
+"use strict";
+
+const assert = require('assert');
+const express = require('express');
+const helper = require("../../helper.js");
+const requester = require('../requester');
+let Controller = helper.requireModule('./server/controller');
+let localConfig = helper.requireModule('./config.js');
+
+let mock = require('../UC2-http-methods/service-mock/index.js');
+
+//NOTE: the users of these tokens live in tenant HOME, the key belongs to tenant DBTN which names
+//		the department resolver in its profile
+const memberToken = "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d901";
+const outsiderToken = "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d902";
+const ownerToken = "cfb209a91b23896820f510aadbf1f4284b512123";
+
+function startResolver(calls, callback) {
+	const sApp = express();
+	const mApp = express();
+	sApp.use(express.json());
+	sApp.post('/tenant/access', (req, res) => {
+		calls.push({ "body": req.body, "injectObj": JSON.parse(req.headers.soajsinjectobj) });
+		if (req.body.user.username === "dept_member" && req.body.subject === "dept_1") {
+			return res.json({
+				"result": true,
+				"data": {
+					"access": true,
+					"groups": ["member"],
+					"groupsConfig": { "allowedPackages": { "DSBRD": ["DSBRD_OWNER"] } }
+				}
+			});
+		}
+		return res.json({ "result": true, "data": { "access": false } });
+	});
+	mApp.get('/heartbeat', (req, res) => {
+		res.json({ "result": true, "ts": Date.now(), "service": { "service": "departments", "type": "rest", "route": "/heartbeat" } });
+	});
+	let sAppServer = sApp.listen(4013, () => {
+		let mAppServer = mApp.listen(5014, () => {
+			return callback({ "sAppServer": sAppServer, "mAppServer": mAppServer, "name": "departments" });
+		});
+	});
+}
+
+describe("Integration for Usecase 5 - tenant access resolver", function () {
+	let extKey = "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9";
+
+	let c = new Controller({
+		"serviceName": localConfig.serviceName,
+		"serviceVersion": localConfig.serviceVersion,
+		"serviceGroup": localConfig.serviceGroup,
+		"servicePort": localConfig.servicePort,
+		"maintenance": localConfig.maintenance
+	});
+	let registry = null;
+	let log = null;
+	let service = null;
+	let server = null;
+	let serverMaintenance = null;
+	let httpmethods = null;
+	let resolver = null;
+	let calls = [];
+
+	function call(token, cb) {
+		let options = {
+			uri: 'http://127.0.0.1:' + localConfig.servicePort + '/httpmethods/myroute',
+			headers: {
+				'Content-Type': 'application/json',
+				key: extKey
+			},
+			"qs": {
+				access_token: token
+			}
+		};
+		requester('get', options, cb);
+	}
+
+	before((done) => {
+		startResolver(calls, (servers) => {
+			resolver = servers;
+			mock.startServer(null, function (servers) {
+				httpmethods = servers;
+			});
+			c.init((_registry, _log, _service, _server, _serverMaintenance) => {
+				registry = _registry;
+				log = _log;
+				service = _service;
+				server = _server;
+				serverMaintenance = _serverMaintenance;
+				c.start(registry, log, service, server, serverMaintenance, () => {
+					setTimeout(function () {
+						done();
+					}, 5000);
+				});
+			});
+		});
+	});
+	beforeEach(() => {
+		calls.length = 0;
+	});
+
+	it("department member switching to the tenant gets the resolver ACL", function (done) {
+		call(memberToken, (error, body) => {
+			assert.ifError(error);
+			assert.ok(body);
+			assert.strictEqual(body.result, true, JSON.stringify(body.errors));
+			assert.deepStrictEqual(body.data.method, 'GET');
+			assert.strictEqual(calls.length, 1);
+			assert.deepStrictEqual(calls[0].body, {
+				"user": {
+					"id": "5c8d0c505653de3985aa1001",
+					"username": "dept_member",
+					"tenant": { "id": "5c0e74ba9acc3c5a84a51260", "code": "HOME" }
+				},
+				"tenant": { "id": "5c0e74ba9acc3c5a84a51259", "code": "DBTN" },
+				"subject": "dept_1"
+			});
+			assert.strictEqual(calls[0].injectObj.tenant.id, "5c0e74ba9acc3c5a84a51259");
+			assert.strictEqual(calls[0].injectObj.application.product, "DSBRD");
+			done();
+		});
+	});
+
+	it("user outside the department is refused after the urac fallback", function (done) {
+		call(outsiderToken, (error, body) => {
+			assert.ok(body);
+			assert.strictEqual(body.result, false);
+			assert.deepStrictEqual(body.errors.codes, [146]);
+			assert.strictEqual(calls.length, 1);
+			done();
+		});
+	});
+
+	it("user of the tenant itself does not call the resolver", function (done) {
+		call(ownerToken, (error, body) => {
+			assert.ifError(error);
+			assert.ok(body);
+			assert.strictEqual(body.result, true, JSON.stringify(body.errors));
+			assert.strictEqual(calls.length, 0);
+			done();
+		});
+	});
+
+	after((done) => {
+		mock.killServer(httpmethods);
+		resolver.sAppServer.close();
+		resolver.mAppServer.close();
+		c.stop(registry, log, service, server, serverMaintenance, () => {
+			done();
+		});
+	});
+});

package/test/integration/index.js

@@ -36,6 +36,10 @@ describe("starting integration tests", () => {
 		// to test roaming
 		require("./UC3-roaming/index.js");
 		
+		
+		// to test the tenant access resolver
+		require("./UC5-tenant-access/index.js");
+		
 		done();
 	});
 });

package/test/unit/index.js

@@ -29,6 +29,7 @@ describe("Starting Gateway Unit test", () => {
 
         require("./mw/mt/index.js");
         require("./mw/mt/urac.js");
+        require("./mw/mt/tenantAccess.js");
         require("./mw/mt/utils.js");
         require("./mw/mt/lib.js");