Add access control (#65)

2021-10-11 16:53:18 +02:00
parent 1d5d75d354
commit 640849de45
12 changed files with 382 additions and 35 deletions
@@ -1,8 +1,10 @@
+import { checkAccess } from '../cognito/access-control';
 import { CategoryAPI } from '../datasources/category-api';
 import { ProductAPI } from '../datasources/product-api';

 const Category = {
-  async products({ id }, _args, { dataSources }) {
+  async products({ id }, _args, { dataSources, auth }) {
+    checkAccess(['products.read'], auth);
    return (<ProductAPI>dataSources.productApi).getCategoryProducts(id);
  },
 };
@@ -1,22 +1,27 @@
+import { checkAccess } from '../cognito/access-control';
 import { DesignerAPI } from '../datasources/designer-api';
 import { OrderAPI } from '../datasources/order-api';
 import { ProductAPI } from '../datasources/product-api';
 import { GeneralInput } from '../types/types';

 const Designer = {
-  async orderRows({ id }, input: GeneralInput, { dataSources }) {
+  async orderRows({ id }, input: GeneralInput, { dataSources, auth }) {
+    checkAccess(['orders.read'], auth);
    return (<OrderAPI>dataSources.orderApi).getOrderRowsByDesignerId(id, input);
  },
-  async products({ id }, _args, { dataSources }) {
+  async products({ id }, _args, { dataSources, auth }) {
+    checkAccess(['products.read'], auth);
    return (<ProductAPI>dataSources.productApi).getDesignerProducts(id);
  },
 };

-async function getDesigners(_, { limit }, { dataSources }) {
+async function getDesigners(_, { limit }, { dataSources, auth }) {
+  checkAccess(['designers.read'], auth);
  return (<DesignerAPI>dataSources.designerApi).getDesigners(limit);
 }

-async function getDesigner(parent, { id }, { dataSources }) {
+async function getDesigner(_, { id }, { dataSources, auth }) {
+  checkAccess(['designers.read'], auth);
  return (<DesignerAPI>dataSources.designerApi).getDesignerById(id);
 }

@@ -1,8 +1,10 @@
+import { checkAccess } from '../cognito/access-control';
 import { KeywordAPI } from '../datasources/keyword-api';
 import { ProductAPI } from '../datasources/product-api';

 const Keyword = {
-  async products({ id }, _args, { dataSources }) {
+  async products({ id }, _args, { dataSources, auth }) {
+    checkAccess(['products.read'], auth);
    return (<ProductAPI>dataSources.productApi).getKeywordProducts(id);
  },
 };
@@ -1,3 +1,4 @@
+import { checkAccess } from '../cognito/access-control';
 import { MarketLocaleAPI } from '../datasources/market-locale-api';
 import { OrderAPI } from '../datasources/order-api';
 import { OrdersResult } from '../types/order-types';
@@ -27,7 +28,8 @@ const Order = {
 };

 const OrderRow = {
-  async order(parent, _args, { dataSources }) {
+  async order(parent, _args, { dataSources, auth }) {
+    checkAccess(['orders.read'], auth);
    return (<OrderAPI>dataSources.orderApi).getOrderById(parent.orderId);
  },
 };
@@ -35,8 +37,9 @@ const OrderRow = {
 async function getOrdersResult(
  _,
  input: GeneralInput,
-  { dataSources },
+  { dataSources, auth },
 ): Promise<OrdersResult> {
+  checkAccess(['orders.read'], auth);
  const total = (<OrderAPI>dataSources.orderApi).getOrdersTotal(input);
  const items = (<OrderAPI>dataSources.orderApi).getOrders(input);
  return {
@@ -49,7 +52,8 @@ async function getOrdersResult(
  };
 }

-async function getOrder(_, { id }, { dataSources }) {
+async function getOrder(_, { id }, { dataSources, auth }) {
+  checkAccess(['orders.read'], auth);
  return (<OrderAPI>dataSources.orderApi).getOrderById(id);
 }

@@ -16,6 +16,7 @@ import { InteriorsLambdaAPI } from '../datasources/interiors-lambda-api';
 import { IdNumberResult } from '../types/types';
 import { moveS3File } from '../s3';
 import { DesignerAPI } from '../datasources/designer-api';
+import { checkAccess } from '../cognito/access-control';

 const ProductBlacklist = {
  async market(parent, _args, { dataSources }) {
@@ -30,7 +31,8 @@ const Product = {
  async categories({ id }, _args, { dataSources }): Promise<Array<Category>> {
    return (<CategoryAPI>dataSources.categoryApi).getProductCategories(id);
  },
-  async designer({ designerId }, _args, { dataSources }) {
+  async designer({ designerId }, _args, { dataSources, auth }) {
+    checkAccess(['designers.read'], auth);
    if (!designerId) {
      return null;
    }
@@ -53,8 +55,9 @@ const PrintProduct = {
 async function getProductsResult(
  _,
  input: ProductsFilterInput,
-  { dataSources },
+  { dataSources, auth },
 ): Promise<ProductListResult> {
+  checkAccess(['products.read'], auth);
  const total = (<ProductAPI>dataSources.productApi).getProductsTotal(input);
  const items = (<ProductAPI>dataSources.productApi).getProducts(input);

@@ -71,8 +74,9 @@ async function getProductsResult(
 async function getProductsSearchResult(
  _,
  { q },
-  { dataSources },
+  { dataSources, auth },
 ): Promise<ProductsSearchResult> {
+  checkAccess(['products.read', 'designers.read'], auth);
  const prodApi = <ProductAPI>dataSources.productApi;
  const catApi = <CategoryAPI>dataSources.categoryApi;
  const keywApi = <KeywordAPI>dataSources.keywordApi;
@@ -92,7 +96,7 @@ async function getProductsSearchResult(
  };
 }

-async function getProduct(_, { id }, { dataSources }): Promise<Product> {
+async function getProduct(_, { id }, { dataSources, auth }): Promise<Product> {
  return (<ProductAPI>dataSources.productApi).getProduct(id);
 }

@@ -111,14 +115,16 @@ export const productQueryTypeDefs = {
 ///////////////////
 // Mutations below
 export const productMutationTypeDefs = {
-  async addProduct(_, { name, batch }, { dataSources }) {
+  async addProduct(_, { name, batch }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
    const id = await (<ProductAPI>dataSources.productApi).addProduct(
      name,
      batch,
    );
    return (<ProductAPI>dataSources.productApi).getProduct(id);
  },
-  async productInfo(_, { productId, info }, { dataSources }) {
+  async productInfo(_, { productId, info }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).updateProductInfo(
      productId,
      info,
@@ -128,8 +134,9 @@ export const productMutationTypeDefs = {
  async productFocusPoint(
    _,
    { productId, focusXpoint2, focusYpoint2 },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).updateFocusPoint(
      productId,
      focusXpoint2,
@@ -145,14 +152,16 @@ export const productMutationTypeDefs = {
    )).generateNewInteriors(product);
    return (<ProductAPI>dataSources.productApi).getProduct(productId);
  },
-  async productBlacklisting(_, { productId, markets }, { dataSources }) {
+  async productBlacklisting(_, { productId, markets }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).updateBlacklisting(
      productId,
      markets,
    );
    return (<ProductAPI>dataSources.productApi).getProduct(productId);
  },
-  async productGroup(_, { productId, groupIds }, { dataSources }) {
+  async productGroup(_, { productId, groupIds }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).updateGroups(
      productId,
      groupIds,
@@ -168,8 +177,9 @@ export const productMutationTypeDefs = {
  async productGroupInteriors(
    _,
    { productId, groupId, uris },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).addInteriorsToProductGroup(
      productId,
      groupId,
@@ -177,7 +187,8 @@ export const productMutationTypeDefs = {
    );
    return (<ProductAPI>dataSources.productApi).getProduct(productId);
  },
-  async productKeywords(_, { productId, keywordIds }, { dataSources }) {
+  async productKeywords(_, { productId, keywordIds }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
    await (<KeywordAPI>dataSources.keywordApi).setProductKeywords(
      productId,
      keywordIds,
@@ -187,8 +198,9 @@ export const productMutationTypeDefs = {
  async productProportionsWarning(
    _,
    { productId, proportions },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).setProportionsWarning(
      productId,
      proportions,
@@ -198,8 +210,9 @@ export const productMutationTypeDefs = {
  async addOwnInteriorToPrintProduct(
    _,
    { printId, uploadedS3Key },
-    { dataSources },
+    { dataSources, auth },
  ): Promise<IdNumberResult> {
+    checkAccess(['products.write'], auth);
    return (<InteriorAPI>dataSources.interiorApi).addOwnUploadToPrintId(
      printId,
      uploadedS3Key,
@@ -208,8 +221,9 @@ export const productMutationTypeDefs = {
  async productWallpaperType(
    _,
    { productId, wallpaperTypes },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).setWallpaperTypes(
      productId,
      wallpaperTypes,
@@ -219,8 +233,9 @@ export const productMutationTypeDefs = {
  async updateProductImage(
    _,
    { productId, uploadedS3Key, width, height },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await moveS3File(
      CONFIG.uploadBucket,
      uploadedS3Key,
@@ -246,7 +261,12 @@ export const productMutationTypeDefs = {
    )).generateNewInteriors(product);
    return 'success';
  },
-  async addRelatedProducts(_, { productId, articleNumbers }, { dataSources }) {
+  async addRelatedProducts(
+    _,
+    { productId, articleNumbers },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).addRelatedProducts(
      productId,
      articleNumbers,
@@ -256,8 +276,9 @@ export const productMutationTypeDefs = {
  async removeRelatedProducts(
    _,
    { productId, relatedProductIds },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).removeRelatedProducts(
      productId,
      relatedProductIds,
@@ -265,7 +286,12 @@ export const productMutationTypeDefs = {
    return (<ProductAPI>dataSources.productApi).getProduct(productId);
  },

-  async addCategoriesToProduct(_, { productId, categoryIds }, { dataSources }) {
+  async addCategoriesToProduct(
+    _,
+    { productId, categoryIds },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).addCategoriesToProduct(
      productId,
      categoryIds,
@@ -276,15 +302,21 @@ export const productMutationTypeDefs = {
  async removeCategoriesFromProduct(
    _,
    { productId, categoryIds },
-    { dataSources },
+    { dataSources, auth },
  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).removeCategoriesFromProduct(
      productId,
      categoryIds,
    );
    return (<ProductAPI>dataSources.productApi).getProduct(productId);
  },
-  async updateProductComments(_, { productId, comments }, { dataSources }) {
+  async updateProductComments(
+    _,
+    { productId, comments },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
    await (<ProductAPI>dataSources.productApi).updateComments(
      productId,
      comments,