Basic access management

backend/.env.sample

@@ -2,6 +2,7 @@ PORT=4000
 JWT_SECRET="JWT_DARK_SECRET"
 ALLOW_ORIGIN=http://localhost:3000
 CLIENT_ADDRESS=http://localhost:3000
+NODE_ENV=development
 
 DATABASE_URL="postgresql://admin:example@localhost:5432/moro?schema=public"
 

backend/package.json

@@ -31,6 +31,7 @@
     "graphql-tools": "^7.0.2",
     "helmet": "^4.2.0",
     "jsonwebtoken": "^8.5.1",
+    "lodash": "^4.17.20",
     "node-fetch": "^2.6.1",
     "uuid": "^8.3.2"
   },
@@ -45,6 +46,7 @@
     "@types/express": "^4.17.9",
     "@types/express-jwt": "^6.0.0",
     "@types/jest": "^26.0.20",
+    "@types/lodash": "^4.14.168",
     "@types/node": "^14.14.11",
     "@types/uuid": "^8.3.0",
     "concurrently": "^5.3.0",

backend/prisma/migrations/20210202171154_access/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "permissions" TEXT[];

backend/prisma/schema.prisma

@@ -17,11 +17,12 @@ model Project {
 }
 
 model User {
-  id       Int      @id @default(autoincrement())
-  email    String   @unique
-  name     String?
-  password String?
-  projects Project?
+  id          Int      @id @default(autoincrement())
+  email       String   @unique
+  name        String?
+  password    String?
+  projects    Project?
+  permissions String[]
 }
 
 enum TOKEN_TYPES {

backend/src/graphql/resolverHelper.ts

@@ -1,4 +1,5 @@
 import { prisma } from '../server/prisma';
+import { UserWithoutPassword } from '../types';
 import { StitchingResolver } from './resolvers-types';
 
 /*
@@ -24,6 +25,6 @@ export function resolverHelper<TArgs, TResult>(
     | StitchingResolver<TResult, any, any, TArgs>
     | undefined,
 ) {
-  return (args: TArgs): TResult =>
-    (resolver as ResolverFn<TArgs, TResult>)({}, args, { prisma }, {});
+  return (args: TArgs, user?: UserWithoutPassword): TResult =>
+    (resolver as ResolverFn<TArgs, TResult>)({}, args, { prisma, user }, {});
 }

backend/src/graphql/resolvers-types.ts

@@ -26,6 +26,7 @@ export type Project = {
 
 export type Query = {
   __typename?: 'Query';
+  getAllPermissions: Array<Scalars['String']>;
   projects?: Maybe<Array<Maybe<Project>>>;
   user?: Maybe<User>;
   users?: Maybe<Array<Maybe<User>>>;
@@ -37,6 +38,13 @@ export type UserInput = {
   password?: Maybe<Scalars['String']>;
 };
 
+export type AdminUserInput = {
+  id: Scalars['Int'];
+  email?: Maybe<Scalars['String']>;
+  name?: Maybe<Scalars['String']>;
+  permissions?: Maybe<Array<Scalars['String']>>;
+};
+
 export type CredentialsInput = {
   email: Scalars['String'];
   password?: Maybe<Scalars['String']>;
@@ -65,6 +73,7 @@ export type User = {
   id?: Maybe<Scalars['Int']>;
   email?: Maybe<Scalars['String']>;
   name?: Maybe<Scalars['String']>;
+  permissions?: Maybe<Array<Maybe<Scalars['String']>>>;
 };
 
 export type AuthResult = {
@@ -77,6 +86,7 @@ export type AuthResult = {
 export type Mutation = {
   __typename?: 'Mutation';
   createUser?: Maybe<User>;
+  updateUser?: Maybe<User>;
   register?: Maybe<AuthResult>;
   login?: Maybe<AuthResult>;
   forgotPassword?: Maybe<AuthResult>;
@@ -88,6 +98,10 @@ export type MutationCreateUserArgs = {
   user: UserInput;
 };
 
+export type MutationUpdateUserArgs = {
+  user: AdminUserInput;
+};
+
 export type MutationRegisterArgs = {
   user: UserInput;
 };
@@ -214,6 +228,7 @@ export type ResolversTypes = ResolversObject<{
   String: ResolverTypeWrapper<Scalars['String']>;
   Query: ResolverTypeWrapper<{}>;
   UserInput: UserInput;
+  AdminUserInput: AdminUserInput;
   CredentialsInput: CredentialsInput;
   EmailInput: EmailInput;
   NewPasswordInput: NewPasswordInput;
@@ -232,6 +247,7 @@ export type ResolversParentTypes = ResolversObject<{
   String: Scalars['String'];
   Query: {};
   UserInput: UserInput;
+  AdminUserInput: AdminUserInput;
   CredentialsInput: CredentialsInput;
   EmailInput: EmailInput;
   NewPasswordInput: NewPasswordInput;
@@ -256,6 +272,7 @@ export type QueryResolvers<
   ContextType = ApolloContext,
   ParentType extends ResolversParentTypes['Query'] = ResolversParentTypes['Query']
 > = ResolversObject<{
+  getAllPermissions?: Resolver<Array<ResolversTypes['String']>, ParentType, ContextType>;
   projects?: Resolver<
     Maybe<Array<Maybe<ResolversTypes['Project']>>>,
     ParentType,
@@ -272,6 +289,11 @@ export type UserResolvers<
   id?: Resolver<Maybe<ResolversTypes['Int']>, ParentType, ContextType>;
   email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  permissions?: Resolver<
+    Maybe<Array<Maybe<ResolversTypes['String']>>>,
+    ParentType,
+    ContextType
+  >;
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 
@@ -295,6 +317,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationCreateUserArgs, 'user'>
   >;
+  updateUser?: Resolver<
+    Maybe<ResolversTypes['User']>,
+    ParentType,
+    ContextType,
+    RequireFields<MutationUpdateUserArgs, 'user'>
+  >;
   register?: Resolver<
     Maybe<ResolversTypes['AuthResult']>,
     ParentType,

backend/src/server/apolloContext.ts

@@ -1,5 +1,6 @@
 import { ApolloExpressContext } from '../types';
 import { prisma } from './prisma';
+import { checkMissingPermissions } from '../user/permissions/checkMissingPermissions';
 
 // This file will make apollo context available for resolvers
 
@@ -14,12 +15,5 @@ export const apolloContext = ({ req }: ApolloExpressContext): ApolloContext => (
   prisma,
   user: req.user,
   isAuthenticated: () => !!req.user,
-  checkMissingPermissions: (neededPermissions) => {
-    console.log(neededPermissions);
-    // get user permissions
-    // subtract perm from user permissions
-    // return missing permissions list
-
-    return [];
-  },
+  checkMissingPermissions: checkMissingPermissions(req.user),
 });

backend/src/server/express.ts

@@ -4,6 +4,7 @@ import expressJwt from 'express-jwt';
 import { getApolloServer } from '../graphql/graphqlServer';
 import { apolloContext } from './apolloContext';
 import { JWT_ALGORITHM, JWT_SECRET } from '../utils/constants';
+import { expressAddUserToRequest } from './expressAddUserToRequest';
 
 export const startExpress = (): void => {
   const app = express();
@@ -22,7 +23,7 @@ export const startExpress = (): void => {
     });
   }
 
-  // Extract user from JWT (Authorization header Bearer) as user in all requests
+  // Extract user id from JWT (Authorization header Bearer) as user in all requests
   app.use(
     expressJwt({
       secret: JWT_SECRET,
@@ -31,6 +32,9 @@ export const startExpress = (): void => {
     }),
   );
 
+  // get user by user id from the db and put it in the express request (req.user)
+  app.use(expressAddUserToRequest);
+
   // some level of http security
   app.use(
     helmet({

backend/src/server/expressAddUserToRequest.ts

@@ -0,0 +1,17 @@
+import { RequestHandler } from 'express';
+import { ExpressRequest } from '../types';
+import { getUserById } from '../user/utils/getUserById';
+
+export const expressAddUserToRequest: RequestHandler = async (
+  req,
+  res,
+  next,
+): Promise<void> => {
+  const request = req as ExpressRequest;
+  if (request.user?.id) {
+    const user = await getUserById(request.user.id);
+    if (user) request.user = user;
+  }
+
+  next();
+};

backend/src/types.ts

@@ -2,8 +2,10 @@ import { Request } from 'express';
 import { ExpressContext } from 'apollo-server-express/dist/ApolloServer';
 import { User } from '@prisma/client';
 
+export type UserWithoutPassword = Omit<User, 'password'>;
+
 export interface ExpressRequest extends Request {
-  user: User;
+  user?: UserWithoutPassword;
 }
 
 export interface ApolloExpressContext extends ExpressContext {

backend/src/user/createTokenFromUser.test.ts

@@ -6,13 +6,11 @@ describe('createTokenFromUser', () => {
   it('creates token correctly', () => {
     const token = createTokenFromUser({
       id: 1,
-      email: 'test@test.test',
-      name: 'Test',
     });
 
     const tokenDecryptedKeys = Object.keys(jwt.verify(token, JWT_SECRET)).sort();
 
-    expect(tokenDecryptedKeys).toEqual(['email', 'iat', 'id', 'name']);
+    expect(tokenDecryptedKeys).toEqual(['iat', 'id']);
   });
 
   it('does not include extra fields', () => {
@@ -25,6 +23,6 @@ describe('createTokenFromUser', () => {
 
     const tokenDecryptedKeys = Object.keys(jwt.verify(token, JWT_SECRET)).sort();
 
-    expect(tokenDecryptedKeys).toEqual(['email', 'iat', 'id', 'name']);
+    expect(tokenDecryptedKeys).toEqual(['iat', 'id']);
   });
 });

backend/src/user/createTokenFromUser.ts

@@ -5,8 +5,6 @@ import { JWT_SECRET, JWT_ALGORITHM } from '../utils/constants';
 export const createTokenFromUser = <T extends PublicUser>(user: T): string => {
   const body: PublicUser = {
     id: user.id,
-    email: user.email,
-    name: user.name,
   };
   return jwt.sign(body, JWT_SECRET, { algorithm: JWT_ALGORITHM });
 };

backend/src/user/forgotPassword.test.ts

@@ -1,7 +1,7 @@
 import { resolverHelper } from '../graphql/resolverHelper';
 import { prisma } from '../server/prisma';
 import { TOKEN_EXPIRE_MINUTES } from '../utils/constants';
-import { createFakeToken } from './createFakeToken';
+import { createFakeToken } from './utils/createFakeToken';
 import { hashUserPassword } from './hashUserPassword';
 import { forgotPassword as forgotPasswordResolver } from './forgotPassword';
 const forgotPassword = resolverHelper(forgotPasswordResolver);

backend/src/user/getUser.ts

@@ -1,5 +1,5 @@
 import { QueryResolvers } from '../graphql/resolvers-types';
 
 export const getUser: QueryResolvers['user'] = async (parent, args, ctx) => {
-  return ctx.user;
+  return ctx.user ? ctx.user : {};
 };

backend/src/user/permissions/allPermissions.ts

@@ -0,0 +1,6 @@
+export const allPermissions = [
+  'users.create',
+  'users.read',
+  'users.update',
+  'users.delete',
+];

backend/src/user/permissions/checkMissingPermissions.ts

@@ -0,0 +1,14 @@
+import { difference } from 'lodash';
+import { UserWithoutPassword } from '../../types';
+import { isDevEnv } from '../../utils/isDevEnv';
+
+export const checkMissingPermissions = (user: UserWithoutPassword | undefined) => (
+  neededPermissions: string[],
+): string[] => {
+  if (!user) return neededPermissions;
+
+  // exceptionally skip permission check if it's a development environment
+  if (isDevEnv()) return [];
+
+  return difference(neededPermissions, user.permissions);
+};

backend/src/user/permissions/getAllPermissions.ts

@@ -0,0 +1,5 @@
+import { QueryResolvers } from '../../graphql/resolvers-types';
+import { allPermissions } from './allPermissions';
+
+export const getAllPermissions: QueryResolvers['getAllPermissions'] = () =>
+  allPermissions;

backend/src/user/resetPassword.test.ts

@@ -4,7 +4,7 @@ import { prisma } from '../server/prisma';
 import { TOKEN_EXPIRE_MINUTES } from '../utils/constants';
 import { resetPassword as resetPasswordResolver } from './resetPassword';
 import { hashUserPassword } from './hashUserPassword';
-import { createFakeToken } from './createFakeToken';
+import { createFakeToken } from './utils/createFakeToken';
 const resetPassword = resolverHelper(resetPasswordResolver);
 
 describe('resetPassword', () => {