Add access control (#65)

src/resolvers/products-resolver.ts

@@ -16,6 +16,7 @@ import { InteriorsLambdaAPI } from '../datasources/interiors-lambda-api';
 import { IdNumberResult } from '../types/types';
 import { moveS3File } from '../s3';
 import { DesignerAPI } from '../datasources/designer-api';
+import { checkAccess } from '../cognito/access-control';
 
 const ProductBlacklist = {
   async market(parent, _args, { dataSources }) {
@@ -30,7 +31,8 @@ const Product = {
   async categories({ id }, _args, { dataSources }): Promise<Array<Category>> {
     return (<CategoryAPI>dataSources.categoryApi).getProductCategories(id);
   },
-  async designer({ designerId }, _args, { dataSources }) {
+  async designer({ designerId }, _args, { dataSources, auth }) {
+    checkAccess(['designers.read'], auth);
     if (!designerId) {
       return null;
     }
@@ -53,8 +55,9 @@ const PrintProduct = {
 async function getProductsResult(
   _,
   input: ProductsFilterInput,
-  { dataSources },
+  { dataSources, auth },
 ): Promise<ProductListResult> {
+  checkAccess(['products.read'], auth);
   const total = (<ProductAPI>dataSources.productApi).getProductsTotal(input);
   const items = (<ProductAPI>dataSources.productApi).getProducts(input);
 
@@ -71,8 +74,9 @@ async function getProductsResult(
 async function getProductsSearchResult(
   _,
   { q },
-  { dataSources },
+  { dataSources, auth },
 ): Promise<ProductsSearchResult> {
+  checkAccess(['products.read', 'designers.read'], auth);
   const prodApi = <ProductAPI>dataSources.productApi;
   const catApi = <CategoryAPI>dataSources.categoryApi;
   const keywApi = <KeywordAPI>dataSources.keywordApi;
@@ -92,7 +96,7 @@ async function getProductsSearchResult(
   };
 }
 
-async function getProduct(_, { id }, { dataSources }): Promise<Product> {
+async function getProduct(_, { id }, { dataSources, auth }): Promise<Product> {
   return (<ProductAPI>dataSources.productApi).getProduct(id);
 }
 
@@ -111,14 +115,16 @@ export const productQueryTypeDefs = {
 ///////////////////
 // Mutations below
 export const productMutationTypeDefs = {
-  async addProduct(_, { name, batch }, { dataSources }) {
+  async addProduct(_, { name, batch }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
     const id = await (<ProductAPI>dataSources.productApi).addProduct(
       name,
       batch,
     );
     return (<ProductAPI>dataSources.productApi).getProduct(id);
   },
-  async productInfo(_, { productId, info }, { dataSources }) {
+  async productInfo(_, { productId, info }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateProductInfo(
       productId,
       info,
@@ -128,8 +134,9 @@ export const productMutationTypeDefs = {
   async productFocusPoint(
     _,
     { productId, focusXpoint2, focusYpoint2 },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateFocusPoint(
       productId,
       focusXpoint2,
@@ -145,14 +152,16 @@ export const productMutationTypeDefs = {
     )).generateNewInteriors(product);
     return (<ProductAPI>dataSources.productApi).getProduct(productId);
   },
-  async productBlacklisting(_, { productId, markets }, { dataSources }) {
+  async productBlacklisting(_, { productId, markets }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateBlacklisting(
       productId,
       markets,
     );
     return (<ProductAPI>dataSources.productApi).getProduct(productId);
   },
-  async productGroup(_, { productId, groupIds }, { dataSources }) {
+  async productGroup(_, { productId, groupIds }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateGroups(
       productId,
       groupIds,
@@ -168,8 +177,9 @@ export const productMutationTypeDefs = {
   async productGroupInteriors(
     _,
     { productId, groupId, uris },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).addInteriorsToProductGroup(
       productId,
       groupId,
@@ -177,7 +187,8 @@ export const productMutationTypeDefs = {
     );
     return (<ProductAPI>dataSources.productApi).getProduct(productId);
   },
-  async productKeywords(_, { productId, keywordIds }, { dataSources }) {
+  async productKeywords(_, { productId, keywordIds }, { dataSources, auth }) {
+    checkAccess(['products.write'], auth);
     await (<KeywordAPI>dataSources.keywordApi).setProductKeywords(
       productId,
       keywordIds,
@@ -187,8 +198,9 @@ export const productMutationTypeDefs = {
   async productProportionsWarning(
     _,
     { productId, proportions },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).setProportionsWarning(
       productId,
       proportions,
@@ -198,8 +210,9 @@ export const productMutationTypeDefs = {
   async addOwnInteriorToPrintProduct(
     _,
     { printId, uploadedS3Key },
-    { dataSources },
+    { dataSources, auth },
   ): Promise<IdNumberResult> {
+    checkAccess(['products.write'], auth);
     return (<InteriorAPI>dataSources.interiorApi).addOwnUploadToPrintId(
       printId,
       uploadedS3Key,
@@ -208,8 +221,9 @@ export const productMutationTypeDefs = {
   async productWallpaperType(
     _,
     { productId, wallpaperTypes },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).setWallpaperTypes(
       productId,
       wallpaperTypes,
@@ -219,8 +233,9 @@ export const productMutationTypeDefs = {
   async updateProductImage(
     _,
     { productId, uploadedS3Key, width, height },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await moveS3File(
       CONFIG.uploadBucket,
       uploadedS3Key,
@@ -246,7 +261,12 @@ export const productMutationTypeDefs = {
     )).generateNewInteriors(product);
     return 'success';
   },
-  async addRelatedProducts(_, { productId, articleNumbers }, { dataSources }) {
+  async addRelatedProducts(
+    _,
+    { productId, articleNumbers },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).addRelatedProducts(
       productId,
       articleNumbers,
@@ -256,8 +276,9 @@ export const productMutationTypeDefs = {
   async removeRelatedProducts(
     _,
     { productId, relatedProductIds },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).removeRelatedProducts(
       productId,
       relatedProductIds,
@@ -265,7 +286,12 @@ export const productMutationTypeDefs = {
     return (<ProductAPI>dataSources.productApi).getProduct(productId);
   },
 
-  async addCategoriesToProduct(_, { productId, categoryIds }, { dataSources }) {
+  async addCategoriesToProduct(
+    _,
+    { productId, categoryIds },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).addCategoriesToProduct(
       productId,
       categoryIds,
@@ -276,15 +302,21 @@ export const productMutationTypeDefs = {
   async removeCategoriesFromProduct(
     _,
     { productId, categoryIds },
-    { dataSources },
+    { dataSources, auth },
   ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).removeCategoriesFromProduct(
       productId,
       categoryIds,
     );
     return (<ProductAPI>dataSources.productApi).getProduct(productId);
   },
-  async updateProductComments(_, { productId, comments }, { dataSources }) {
+  async updateProductComments(
+    _,
+    { productId, comments },
+    { dataSources, auth },
+  ) {
+    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateComments(
       productId,
       comments,