Add access control (#65)

manual-tests/cognito-client.ts

@@ -0,0 +1,65 @@
+import axios from 'axios';
+
+interface TokenResponse {
+  access_token: string;
+  expires_in: number;
+  token_type: string;
+}
+
+export default class CognitoClient {
+  tokenEndpont: string;
+  clientId: string;
+  clientSecret: string;
+  scope: string;
+  expiresAt: number;
+  accessToken: string;
+
+  constructor(
+    tokenEndpoint: string,
+    clientId: string,
+    clientSecret: string,
+    scope: string,
+  ) {
+    this.tokenEndpont = `${tokenEndpoint}/oauth2/token`;
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.scope = scope;
+    this.accessToken = '';
+    this.expiresAt = 0;
+  }
+
+  private getPostData(): URLSearchParams {
+    const params = new URLSearchParams();
+    params.append('grant_type', 'client_credentials');
+    params.append('client_id', this.clientId);
+    params.append('scope', this.scope);
+    return params;
+  }
+
+  public async getToken(): Promise<string> {
+    const now = Date.now();
+    if (this.expiresAt < now) {
+      await this.getNewToken();
+    }
+    console.log('Getting cached token');
+    return this.accessToken;
+  }
+
+  private async getNewToken(): Promise<void> {
+    console.log('Getting new token');
+    const authString =
+      'Basic ' +
+      Buffer.from(this.clientId + ':' + this.clientSecret).toString('base64');
+    const res: TokenResponse = await axios
+      .post(this.tokenEndpont, this.getPostData(), {
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Authorization: authString,
+        },
+      })
+      .then((r) => r.data);
+
+    this.accessToken = res.access_token;
+    this.expiresAt = Date.now() + res.expires_in * 1e3;
+  }
+}

manual-tests/test-scopes.ts

@@ -0,0 +1,95 @@
+import axios from 'axios';
+import CognitoClient from './cognito-client';
+
+const config = {
+  PW_GRAPHQL_URL: 'http://docker.for.mac.localhost:4000',
+  API_TOKEN_ENDPOINT:
+    'https://photowall-test-admin.auth.eu-west-1.amazoncognito.com',
+  API_CLIENT_ID: '',
+  API_CLIENT_SECRET: '',
+};
+
+async function doQuery(
+  query: string,
+  variables: any,
+  scopes: string[],
+): Promise<any> {
+  const cognitoClient = new CognitoClient(
+    config.API_TOKEN_ENDPOINT,
+    config.API_CLIENT_ID,
+    config.API_CLIENT_SECRET,
+    scopes.join(' '),
+  );
+  let token = '';
+  token = await cognitoClient.getToken();
+
+  const url = config.PW_GRAPHQL_URL;
+  const res = await axios({
+    url: url,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    data: JSON.stringify({
+      query,
+      variables,
+    }),
+  });
+  return res;
+}
+
+async function testGetOrder() {
+  const query = `
+  query GetOrder($id: ID!) {
+    order(id:$id){
+      id
+      klarnaOrderId
+      # paypalTransactionId
+      customerType
+      countryCode
+    }
+  }
+  `;
+  const variables = {
+    id: '414246',
+  };
+  const res = await doQuery(query, variables, [
+    'https://graphql.photowall.com/orders.read',
+  ]);
+  console.log(JSON.stringify(res.data, null, 2));
+}
+
+async function testGetProduct() {
+  const query = `
+  query GetProduct($id: Int!) {
+    product(id:$id){
+      id
+      fields {
+        artNo
+        name
+      }
+    }
+  }
+  `;
+  const variables = {
+    id: 52924,
+  };
+  const res = await doQuery(query, variables, [
+    'https://graphql.photowall.com/products.read',
+  ]);
+  console.log(JSON.stringify(res.data, null, 2));
+}
+
+async function main() {
+  console.log('Starting');
+  try {
+    await testGetOrder();
+    await testGetProduct();
+  } catch (e) {
+    console.log(e?.response.data.errors);
+  }
+}
+
+main();