feat: include new validation on validateAdminUserAccess #181

giurigaud · 2024-10-11T15:32:09Z

What problem is this solving?

Currently, when accessing organization management, any user can make any change. The goal is to implement a minimum control of viewing/changing.
VTEX already has two features in the license manager that are not used, called:
Buyer Organization View
Buyer Organization Edit
These two features could be used to facilitate the requested changes.

How to test it?

Create an admin user that does not have the buyer_organization_view permission
Log in to the admin with this user
Call getOrganizations via graphql ide https://giurigaud--b2bstore005.myvtex.com/admin/graphql-ide/, it needs to have the "buyer_organization_view" permission, you will get a 403 error.

query { getOrganizations(search: "giu") { data { id name } pagination { page pageSize total } } }

The same can be done with createOrganization for example and the buyer_organization_edit permission.
mutation { createOrganization(input: { name: "Nome da Organização" tradeName: "Nome Comercial" b2bCustomerAdmin: { email: "admin@exemplo.com" firstName: "Nome" lastName: "Sobrenome" } defaultCostCenter: { name: "Centro de Custo Padrão" address: { country: "BRA" postalCode: "12345-678" city: "Cidade" state: "Estado" street: "Rua Exemplo" number: "123" } } }) { id status message } }

Workspace

Screenshots or example usage:

Describe alternatives you've considered, if any.

Related to / Depends on

How does this PR make you feel?

![https://giphy.com/gifs/Friends-season-5-episode-111-the-one-where-everybody-finds-out-YnBntKOgnUSBkV7bQH](put .gif link here - can be found under "advanced" on giphy)

vtex-io-ci-cd · 2024-10-11T15:32:12Z

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

Patch (backwards-compatible bug fixes)
Minor (backwards-compatible functionality)
Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

No thanks, I would rather do it manually 😞

vtex-io-docs-bot · 2024-10-11T15:32:16Z

Beep boop 🤖

I noticed you didn't make any changes at the docs/ folder

There's nothing new to document 🤔
I'll do it later 😞

In order to keep track, I'll create an issue if you decide now is not a good time

I just updated 🎉🎉

enzomerca

Nice! I think that is the idea! I just left some small comments.

node/resolvers/directives/helper.ts

node/clients/LMClient.ts

enzomerca · 2024-10-22T16:32:20Z

graphql/schema.graphql

+    @validateAdminUserAccess(orgPermission: "buyer_organization_view")
+    @validateStoreUserAccess(orgPermission: "buyer_organization_view")


We should have just one validate directive per API (in this case we should keep only the @validateStoreUserAccess

enzomerca · 2024-10-22T16:34:18Z

graphql/directives.graphql

-directive @validateAdminUserAccess on FIELD | FIELD_DEFINITION
-directive @validateStoreUserAccess on FIELD | FIELD_DEFINITION
+directive @validateAdminUserAccess(
+  orgPermission: String


I think we need to change orgPermission to something more meaningful... maybe requiredPermission?

enzomerca · 2024-10-22T16:35:21Z

graphql/schema.graphql

@@ -11,6 +11,7 @@ type Query {
    sortedBy: String = "created"
  ): OrganizationRequestResult
    @cacheControl(scope: PRIVATE, maxAge: SHORT)
+    @validateAdminUserAccess(orgPermission: "buyer_organization_view")


for now lets not add the directive to APIs that don't have it. Lets just add the parameter to APIs that already have either validateAdminUserAccess or validateStoreUserAccess.

but if we don't add in getOrganizations for example the permissions will pass. Will it really be like that?

enzomerca · 2024-10-22T16:37:02Z

node/clients/LMClient.ts

+    userEmail: string,
+    resourceCode: string
+  ) => {
+    const productCode = B2B_LM_PRODUCT_CODE // resource name on lincense manager = B2B


the actual name of this resource is Buyer Organization actually (I gave you the wrong info before). So lets update the comment here

Suggested change

const productCode = B2B_LM_PRODUCT_CODE // resource name on lincense manager = B2B

const productCode = B2B_LM_PRODUCT_CODE // resource name on lincense manager = Buyer Organization

enzomerca · 2024-10-22T16:37:28Z

node/clients/LMClient.ts

@@ -24,6 +26,24 @@ export default class LMClient extends ExternalClient {
    })
  }

+  public checkUserAdminPermission = async (


Suggested change

public checkUserAdminPermission = async (

public checkAdminUserRequiredPermission = async (

enzomerca · 2024-10-22T16:37:59Z

node/clients/LMClient.ts

+    const checkOrgPermission = await this.get<boolean>(
+      `/api/license-manager/pvt/accounts/${account}/products/${productCode}/logins/${userEmail}/resources/${resourceCode}/granted`
+    )
+
+    if (!checkOrgPermission) {
+      throw new ForbiddenError('Unauthorized Access')
+    }
+
+    return checkOrgPermission


Suggested change

const checkOrgPermission = await this.get<boolean>(

`/api/license-manager/pvt/accounts/${account}/products/${productCode}/logins/${userEmail}/resources/${resourceCode}/granted`

)

if (!checkOrgPermission) {

throw new ForbiddenError('Unauthorized Access')

}

return checkOrgPermission

const checkRequiredPermission = await this.get<boolean>(

`/api/license-manager/pvt/accounts/${account}/products/${productCode}/logins/${userEmail}/resources/${resourceCode}/granted`

)

if (!checkRequiredPermission) {

throw new ForbiddenError('Unauthorized Access')

}

return checkRequiredPermission

enzomerca · 2024-10-22T16:38:48Z

node/resolvers/directives/helper.ts

@@ -2,7 +2,8 @@ import { isUserPartOfBuyerOrg } from '../Queries/Users'

 export const validateAdminToken = async (
  context: Context,
-  adminUserAuthToken: string
+  adminUserAuthToken: string,
+  orgPermission?: 'buyer_organization_edit' | 'buyer_organization_view'


(lets change orgPermission everywhere to requiredPermission

Suggested change

orgPermission?: 'buyer_organization_edit' | 'buyer_organization_view'

requiredPermission?: 'buyer_organization_edit' | 'buyer_organization_view'

enzomerca · 2024-10-22T16:40:30Z

node/utils/constants.ts

@@ -14,3 +14,5 @@ export const ORGANIZATION_REQUEST_STATUSES = {
 export const MARKETING_TAGS = {
  VBASE_BUCKET: 'b2b_marketing_tags',
 }
+
+export const B2B_LM_PRODUCT_CODE = '97' // resource name on lincense manager = B2B


update comment here as well.

feat: include new validation on validateAdminUserAccess

3ec35c5

Merge branch 'master' into feat/acl

e353db0

giurigaud marked this pull request as draft October 11, 2024 15:33

enzomerca reviewed Oct 11, 2024

View reviewed changes

node/resolvers/directives/helper.ts Outdated Show resolved Hide resolved

node/resolvers/directives/helper.ts Outdated Show resolved Hide resolved

node/resolvers/directives/helper.ts Outdated Show resolved Hide resolved

node/clients/LMClient.ts Outdated Show resolved Hide resolved

giurigaud added 3 commits October 14, 2024 15:02

feat: add constants and remove console log

0f7af38

feat: add validateUserAdminAccess

c541c9a

feat: changelog

74f84a4

giurigaud marked this pull request as ready for review October 14, 2024 18:09

fix: remove eslint comment

403b36d

giurigaud changed the title ~~draft: include new validation on validateAdminUserAccess~~ feat: include new validation on validateAdminUserAccess Oct 14, 2024

feat: add to validateStoreUserAccess

bbec4ca

giurigaud mentioned this pull request Oct 15, 2024

Feat/acl vtex-apps/storefront-permissions#167

Open

enzomerca requested a review from a team October 22, 2024 16:22

enzomerca reviewed Oct 22, 2024

View reviewed changes

giurigaud added 2 commits October 25, 2024 08:48

feat: changes code review

109ca8a

Merge remote-tracking branch 'upstream/master' into feat/acl

bda16d2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: include new validation on validateAdminUserAccess #181

feat: include new validation on validateAdminUserAccess #181

giurigaud commented Oct 11, 2024 •

edited

Loading

vtex-io-ci-cd bot commented Oct 11, 2024

vtex-io-docs-bot bot commented Oct 11, 2024

enzomerca left a comment

enzomerca Oct 22, 2024

enzomerca Oct 22, 2024

giurigaud Oct 23, 2024

enzomerca Oct 22, 2024

giurigaud Oct 23, 2024

enzomerca Oct 22, 2024

enzomerca Oct 22, 2024

enzomerca Oct 22, 2024

enzomerca Oct 22, 2024

enzomerca Oct 22, 2024

		@validateAdminUserAccess(orgPermission: "buyer_organization_view")
		@validateStoreUserAccess(orgPermission: "buyer_organization_view")

	const productCode = B2B_LM_PRODUCT_CODE // resource name on lincense manager = B2B
	const productCode = B2B_LM_PRODUCT_CODE // resource name on lincense manager = Buyer Organization

	public checkUserAdminPermission = async (
	public checkAdminUserRequiredPermission = async (

	orgPermission?: 'buyer_organization_edit' \| 'buyer_organization_view'
	requiredPermission?: 'buyer_organization_edit' \| 'buyer_organization_view'

feat: include new validation on validateAdminUserAccess #181

Are you sure you want to change the base?

feat: include new validation on validateAdminUserAccess #181

Conversation

giurigaud commented Oct 11, 2024 • edited Loading

What problem is this solving?

How to test it?

Screenshots or example usage:

Describe alternatives you've considered, if any.

Related to / Depends on

How does this PR make you feel?

vtex-io-ci-cd bot commented Oct 11, 2024

vtex-io-docs-bot bot commented Oct 11, 2024

enzomerca left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

giurigaud commented Oct 11, 2024 •

edited

Loading