feat: include new validation on validateAdminUserAccess

graphql/directives.graphql

@@ -1,6 +1,8 @@
 directive @withSession on FIELD | FIELD_DEFINITION
 directive @withPermissions on FIELD | FIELD_DEFINITION
-directive @validateAdminUserAccess on FIELD | FIELD_DEFINITION
+directive @validateAdminUserAccess(
+  orgPermission: String
+) on FIELD | FIELD_DEFINITION
 directive @validateStoreUserAccess on FIELD | FIELD_DEFINITION
 directive @checkUserAccess on FIELD | FIELD_DEFINITION
 directive @checkAdminAccess on FIELD | FIELD_DEFINITION

graphql/schema.graphql

@@ -153,7 +153,8 @@ type Mutation {
     notifyUsers: Boolean
   ): OrganizationCostCenterResponse
     @checkAdminAccess
-    @cacheControl(scope: PRIVATE)
+    @validateAdminUserAccess(orgPermission: "buyer_organization_edit")
+    @cacheControl(scope: PRIVATE, maxAge: 300)
   createOrganizationAndCostCentersWithId(
     input: NormalizedOrganizationInput!
   ): MasterDataResponse @checkAdminAccess @cacheControl(scope: PRIVATE)

node/clients/IdentityClient.ts

@@ -1,6 +1,14 @@
 import type { InstanceOptions, IOContext } from '@vtex/api'
 import { JanusClient } from '@vtex/api'
 
+type AuthUser = {
+  id: string
+  authStatus: string
+  tokenType: string
+  account: string
+  audience: string
+  user: string
+}
 export default class IdentityClient extends JanusClient {
   constructor(ctx: IOContext, options?: InstanceOptions) {
     super(ctx, {
@@ -11,7 +19,7 @@ export default class IdentityClient extends JanusClient {
     })
   }
 
-  public async validateToken({ token }: { token: string }): Promise<any> {
+  public async validateToken({ token }: { token: string }): Promise<AuthUser> {
     return this.http.post('/api/vtexid/credential/validate', { token })
   }
 

node/clients/LMClient.ts

@@ -1,6 +1,7 @@
+/* eslint-disable no-console */
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import type { InstanceOptions, IOContext } from '@vtex/api'
-import { ExternalClient } from '@vtex/api'
+import { ExternalClient, ForbiddenError } from '@vtex/api'
 
 export default class LMClient extends ExternalClient {
   constructor(ctx: IOContext, options?: InstanceOptions) {
@@ -24,6 +25,24 @@ export default class LMClient extends ExternalClient {
     })
   }
 
+  public checkUserAdminPermission = async (
+    account: string,
+    userEmail: string,
+    resourceCode: string
+  ) => {
+    const productCode = '97'
+
+    const checkOrgPermission = await this.get<boolean>(
+      `/api/license-manager/pvt/accounts/${account}/products/${productCode}/logins/${userEmail}/resources/${resourceCode}/granted`
+    )
+
+    if (!checkOrgPermission) {
+      throw new ForbiddenError('Unauthorized Access')
+    }
+
+    return checkOrgPermission
+  }
+
   public getAccount = async () => {
     return this.get<GetAccountResponse>(`/api/license-manager/account`).then(
       (res) => {

node/resolvers/directives/helper.ts

@@ -1,8 +1,11 @@
+/* eslint-disable no-console */
+
 import { isUserPartOfBuyerOrg } from '../Queries/Users'
 
 export const validateAdminToken = async (
   context: Context,
-  adminUserAuthToken: string
+  adminUserAuthToken: string,
+  orgPermission?: 'buyer_organization_edit' | 'buyer_organization_view'
 ): Promise<{
   hasAdminToken: boolean
   hasValidAdminToken: boolean
@@ -16,15 +19,19 @@ export const validateAdminToken = async (
   // check if has admin token and if it is valid
   const hasAdminToken = !!adminUserAuthToken
   let hasValidAdminToken = false
+  let userEmail = ''
+  let tokenType = ''
   // this is used to check if the token is valid by current standards
   let hasCurrentValidAdminToken = false
 
+  console.log('VALIDATE ADMIN TOKEN')
   if (hasAdminToken) {
     try {
       const authUser = await identity.validateToken({
         token: adminUserAuthToken,
       })
 
+      console.log({ authUser })
       // we set this flag to true if the token is valid by current standards
       // in the future we should remove this line
       hasCurrentValidAdminToken = true
@@ -34,6 +41,10 @@ export const validateAdminToken = async (
           account,
           authUser.id
         )
+
+        userEmail = authUser.user
+        tokenType = authUser.tokenType
+        console.log({ userEmail, tokenType })
       }
     } catch (err) {
       // noop so we leave hasValidAdminToken as false
@@ -44,6 +55,11 @@ export const validateAdminToken = async (
     }
   }
 
+  console.log({ hasValidAdminToken, orgPermission, tokenType })
+  if (hasValidAdminToken && orgPermission && tokenType === 'user') {
+    await lm.checkUserAdminPermission(account, userEmail, orgPermission)
+  }
+
   return { hasAdminToken, hasValidAdminToken, hasCurrentValidAdminToken }
 }
 
@@ -79,6 +95,9 @@ export const validateApiToken = async (
         token,
       })
 
+      console.log('validateApiToken')
+      console.log({ authUser })
+      console.log('end validateApiToken')
       // we set this flag to true if the token is valid by current standards
       // in the future we should remove this line
       hasCurrentValidApiToken = true

node/resolvers/directives/validateAdminUserAccess.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-console */
 import { SchemaDirectiveVisitor } from 'graphql-tools'
 import { AuthenticationError, ForbiddenError } from '@vtex/api'
 import type { GraphQLField } from 'graphql'
@@ -15,6 +16,10 @@ export class ValidateAdminUserAccess extends SchemaDirectiveVisitor {
   public visitFieldDefinition(field: GraphQLField<any, any>) {
     const { resolve = defaultFieldResolver } = field
 
+    console.log('Directive arguments:', this.args)
+    const { orgPermission } = this.args
+
+    console.log('orgPermission:', orgPermission)
     field.resolve = async (
       root: any,
       args: any,
@@ -43,7 +48,8 @@ export class ValidateAdminUserAccess extends SchemaDirectiveVisitor {
 
       const { hasAdminToken, hasValidAdminToken } = await validateAdminToken(
         context,
-        adminUserAuthToken as string
+        adminUserAuthToken as string,
+        orgPermission
       )
 
       // add admin token metrics