3010: Apollo 4 major update and complete security overhaul to prepare for public api support

* 2919: rewrite for update to apollo 4 (#131)

* rewrite for update to apollo 4

* removed container tests, edited make to publish any branch to staging

* revert makefile

* cleanup

* update 1

* more fixes to get it working on aws

* enabled csrf prevention protection, testing if build works

* switched to express version

* changed the healthcheck url

* added cache to restdatasources

* 3011: create a login mutation on graphql server that responds with a access token (#133)

* 3011 added login rest endpoint and general scope fixes

* changed login auth to basic auth username and password

* minor changes from CR feedback

* force update

* added tighter timeout for idle knex connection

* Refactor authentication and scopes (#134)

* big refactor of scopes in graphql

* cr fixes

* some security fixes (#135)

* some security fixes

* cleanup

* update staging

* minor readme change

src/resolvers/products-resolver.ts

@@ -17,7 +17,6 @@ import { InteriorsLambdaAPI } from '../datasources/interiors-lambda-api';
 import { IdNumberResult } from '../types/types';
 import { moveS3File } from '../aws/s3';
 import { DesignerAPI } from '../datasources/designer-api';
-import { checkAccess } from '../cognito/access-control';
 import { PrintProductDefaultsAPI } from '../datasources/printproduct-defaults-api';
 import { PrintProductDefaults } from '../types/printproduct-defaults-types';
 
@@ -30,12 +29,10 @@ const ProductBlacklist = {
 };
 
 const Product = {
-  // (parent, args, ctx, info)
   async categories({ id }, _args, { dataSources }): Promise<Array<Category>> {
     return (<CategoryAPI>dataSources.categoryApi).getProductCategories(id);
   },
-  async designer({ designerId }, _args, { dataSources, auth }) {
-    checkAccess(['designers.read'], auth);
+  async designer({ designerId }, _args, { dataSources }) {
     if (!designerId) {
       return null;
     }
@@ -63,9 +60,8 @@ const PrintProduct = {
 async function getProductsResult(
   _,
   input: ProductsFilterInput,
-  { dataSources, auth },
+  { dataSources },
 ): Promise<ProductListResult> {
-  checkAccess(['products.read'], auth);
   const total = (<ProductAPI>dataSources.productApi).getProductsTotal(input);
   const items = (<ProductAPI>dataSources.productApi).getProducts(input);
   const offset = input.pagination?.offset ?? 0;
@@ -82,9 +78,8 @@ async function getProductsResult(
 async function getProductsSearchResult(
   _,
   { q },
-  { dataSources, auth },
+  { dataSources },
 ): Promise<ProductsSearchResult> {
-  checkAccess(['products.read', 'designers.read'], auth);
   const prodApi = <ProductAPI>dataSources.productApi;
   const catApi = <CategoryAPI>dataSources.categoryApi;
   const keywApi = <KeywordAPI>dataSources.keywordApi;
@@ -117,7 +112,7 @@ async function getProductsSearchResult(
   };
 }
 
-async function getProduct(_, { id }, { dataSources, auth }): Promise<Product> {
+async function getProduct(_, { id }, { dataSources }): Promise<Product> {
   return (<ProductAPI>dataSources.productApi).getProduct(id);
 }
 
@@ -142,15 +137,16 @@ export const productQueryTypeDefs = {
   productsSearch: getProductsSearchResult,
 };
 
-///////////////////
-// Mutations below
+// ---------------------------------------------------------
+// MUTATIONS
+// ---------------------------------------------------------
+
 export const productMutationTypeDefs = {
   /**
    * @function addProduct
    * @description Will add a product
    */
-  async addProduct(_, { name, batch, designerId }, { dataSources, auth }) {
-    checkAccess(['products.write'], auth);
+  async addProduct(_, { name, batch, designerId }, { dataSources }) {
     const id = await (<ProductAPI>dataSources.productApi).addProduct(
       name,
       batch,
@@ -163,8 +159,7 @@ export const productMutationTypeDefs = {
    * @function productInfo
    * @description Mutate base information about a product
    */
-  async productInfo(_, { productId, info }, { dataSources, auth }) {
-    checkAccess(['products.write'], auth);
+  async productInfo(_, { productId, info }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).updateProductInfo(
       productId,
       info,
@@ -179,9 +174,8 @@ export const productMutationTypeDefs = {
   async productFocusPoint(
     _,
     { productId, focusXpoint2, focusYpoint2 },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).updateFocusPoint(
       productId,
       focusXpoint2,
@@ -202,8 +196,7 @@ export const productMutationTypeDefs = {
    * @function productBlacklisting
    * @description Mutate the product blacklist
    */
-  async productBlacklisting(_, { productId, markets }, { dataSources, auth }) {
-    checkAccess(['products.write'], auth);
+  async productBlacklisting(_, { productId, markets }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).updateBlacklisting(
       productId,
       markets,
@@ -215,8 +208,7 @@ export const productMutationTypeDefs = {
    * @function productGroup
    * @description Mutate the product groups, when changing group interiors lambda is triggered.
    */
-  async productGroup(_, { productId, groupIds }, { dataSources, auth }) {
-    checkAccess(['products.write'], auth);
+  async productGroup(_, { productId, groupIds }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).updateGroups(
       productId,
       groupIds,
@@ -237,9 +229,8 @@ export const productMutationTypeDefs = {
   async productGroupInteriors(
     _,
     { productId, groupId, uris },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).addInteriorsToProductGroup(
       productId,
       groupId,
@@ -252,8 +243,7 @@ export const productMutationTypeDefs = {
    * @function productKeywords
    * @description Mutate the keywords for a product
    */
-  async productKeywords(_, { productId, keywordIds }, { dataSources, auth }) {
-    checkAccess(['products.write'], auth);
+  async productKeywords(_, { productId, keywordIds }, { dataSources }) {
     await (<KeywordAPI>dataSources.keywordApi).setProductKeywords(
       productId,
       keywordIds,
@@ -268,9 +258,8 @@ export const productMutationTypeDefs = {
   async productProportionsWarning(
     _,
     { productId, proportions },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).setProportionsWarning(
       productId,
       proportions,
@@ -285,9 +274,8 @@ export const productMutationTypeDefs = {
   async addOwnInteriorToPrintProduct(
     _,
     { printId, uploadedS3Key },
-    { dataSources, auth },
+    { dataSources },
   ): Promise<IdNumberResult> {
-    checkAccess(['products.write'], auth);
     return (<InteriorAPI>dataSources.interiorApi).addOwnUploadToPrintId(
       printId,
       uploadedS3Key,
@@ -301,9 +289,8 @@ export const productMutationTypeDefs = {
   async printProductDefaults(
     _,
     { printId, widthMm, heightMm, cropX, cropY, border },
-    { dataSources, auth },
+    { dataSources },
   ): Promise<PrintProductDefaults> {
-    checkAccess(['products.write'], auth);
     return (<PrintProductDefaultsAPI>(
       dataSources.printProductDefaultsApi
     )).updateDefaults(printId, widthMm, heightMm, cropX, cropY, border);
@@ -316,9 +303,8 @@ export const productMutationTypeDefs = {
   async productWallpaperType(
     _,
     { productId, wallpaperTypes },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).setWallpaperTypes(
       productId,
       wallpaperTypes,
@@ -335,9 +321,8 @@ export const productMutationTypeDefs = {
   async updateProductImage(
     _,
     { productId, uploadedS3Key, width, height },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await moveS3File(
       CONFIG.uploadBucket,
       uploadedS3Key,
@@ -369,12 +354,7 @@ export const productMutationTypeDefs = {
    * @description Adds a related product to a product, when doing this the related product
    * gets the same relationship back. So products are always related to eachother.
    */
-  async addRelatedProducts(
-    _,
-    { productId, articleNumbers },
-    { dataSources, auth },
-  ) {
-    checkAccess(['products.write'], auth);
+  async addRelatedProducts(_, { productId, articleNumbers }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).addRelatedProducts(
       productId,
       articleNumbers,
@@ -389,9 +369,8 @@ export const productMutationTypeDefs = {
   async removeRelatedProducts(
     _,
     { productId, relatedProductIds },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).removeRelatedProducts(
       productId,
       relatedProductIds,
@@ -403,12 +382,7 @@ export const productMutationTypeDefs = {
    * @function addCategoriesToProduct
    * @description Add categories to a product
    */
-  async addCategoriesToProduct(
-    _,
-    { productId, categoryIds },
-    { dataSources, auth },
-  ) {
-    checkAccess(['products.write'], auth);
+  async addCategoriesToProduct(_, { productId, categoryIds }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).addCategoriesToProduct(
       productId,
       categoryIds,
@@ -423,9 +397,8 @@ export const productMutationTypeDefs = {
   async removeCategoriesFromProduct(
     _,
     { productId, categoryIds },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).removeCategoriesFromProduct(
       productId,
       categoryIds,
@@ -437,12 +410,7 @@ export const productMutationTypeDefs = {
    * @function updateProductComments
    * @description Mutate product comments
    */
-  async updateProductComments(
-    _,
-    { productId, comments },
-    { dataSources, auth },
-  ) {
-    checkAccess(['products.write'], auth);
+  async updateProductComments(_, { productId, comments }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).updateComments(
       productId,
       comments,
@@ -456,9 +424,8 @@ export const productMutationTypeDefs = {
   async massUpdatePublishing(
     _,
     { productIds, visible, browsable },
-    { dataSources, auth },
+    { dataSources },
   ) {
-    checkAccess(['products.write'], auth);
     await (<ProductAPI>dataSources.productApi).massUpdatePublishing(
       productIds,
       visible,
@@ -472,12 +439,7 @@ export const productMutationTypeDefs = {
    * @function massUpdateBlacklisting
    * @description Mutate the blacklisting for products
    */
-  async massUpdateBlacklisting(
-    _,
-    { productIds, markets },
-    { dataSources, auth },
-  ) {
-    checkAccess(['products.write'], auth);
+  async massUpdateBlacklisting(_, { productIds, markets }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).massUpdateBlacklisting(
       productIds,
       markets,
@@ -490,12 +452,7 @@ export const productMutationTypeDefs = {
    * @function massUpdatePublishing
    * @description Mutate the Publishing for products
    */
-  async massUpdatePublishingDate(
-    _,
-    { productIds, date },
-    { dataSources, auth },
-  ) {
-    checkAccess(['products.write'], auth);
+  async massUpdatePublishingDate(_, { productIds, date }, { dataSources }) {
     await (<ProductAPI>dataSources.productApi).massUpdatePublishingDate(
       productIds,
       date,