Add access control (#65)

src/cognito/access-control.ts

@@ -0,0 +1,35 @@
+import { AuthenticationError } from 'apollo-server';
+import { ClaimVerifyResult } from './cognito-client';
+
+export const RESOURCE = 'https://graphql.photowall.com';
+
+export enum SCOPES {
+  ORDERS_READ = 'orders.read',
+  ORDERS_WRITE = 'orders.write',
+  DESIGNERS_READ = 'designers.read',
+  DESIGNERS_WRITE = 'designers.write',
+  PRODUCTS_READ = 'products.read',
+  PRODUCTS_WRITE = 'products.write',
+}
+
+export function checkAccess(scopes: string[], auth: ClaimVerifyResult): void {
+  if (auth.userName === 'testuser') {
+    return;
+  }
+  if (auth.idToken) {
+    if (auth.idToken['custom:adgroups'].includes('WebAdmin')) {
+      return;
+    }
+  }
+  if (auth.accessToken) {
+    const authScopes = auth.accessToken.scope.split(' ');
+
+    const requiredScoped = scopes.map((s) => `${RESOURCE}/${s}`);
+    const checker = (arr: string[], target: string[]) =>
+      target.every((v) => arr.includes(v));
+    if (checker(authScopes, requiredScoped)) {
+      return;
+    }
+  }
+  throw new AuthenticationError('Not authorized for this endpoint');
+}