Skip to content

Commit

Permalink
chore: amend user-mgnt changes with scopes
Browse files Browse the repository at this point in the history
  • Loading branch information
@Nil20
Nil20 committed Nov 5, 2024
1 parent 0cd4934 commit 6214ddd
Show file tree
Hide file tree
Showing 2 changed files with 102 additions and 94 deletions.
193 changes: 100 additions & 93 deletions packages/user-mgnt/src/config/routes.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,18 +96,7 @@ import changeEmailHandler, {
} from '@user-mgnt/features/changeEmail/handler'
import { getAllSystemsHandler } from '@user-mgnt/features/getAllSystems/handler'
import * as mongoose from 'mongoose'

const enum RouteScope {
DECLARE = 'declare',
REGISTER = 'register',
CERTIFY = 'certify',
PERFORMANCE = 'performance',
SYSADMIN = 'sysadmin',
NATLSYSADMIN = 'natlsysadmin',
VALIDATE = 'validate',
RECORDSEARCH = 'recordsearch',
VERIFY = 'verify'
}
import { SCOPES } from '@opencrvs/commons/authentication'

export const getRoutes = () => {
return [
Expand Down Expand Up @@ -215,12 +204,14 @@ export const getRoutes = () => {
description: 'Changes password for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -240,12 +231,14 @@ export const getRoutes = () => {
description: 'Changes password for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -265,12 +258,14 @@ export const getRoutes = () => {
description: 'Changes email for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -290,12 +285,14 @@ export const getRoutes = () => {
description: 'Changes avatar for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -315,12 +312,14 @@ export const getRoutes = () => {
description: 'Retrieves a user mobile number',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -338,12 +337,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -361,16 +362,16 @@ export const getRoutes = () => {
description: 'Retrieves a user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE,
RouteScope.VERIFY,
RouteScope.RECORDSEARCH,
// @TODO: Refer to an enum / constant
'record.confirm-registration'
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL,
SCOPES.RECORD_REGISTRATION_VERIFY_CERTIFIED_COPIES,
SCOPES.RECORDSEARCH
]
},
validate: {
Expand All @@ -386,7 +387,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Creates a new user',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
}
}
},
Expand All @@ -398,7 +399,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Updates an existing user',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
}
}
},
Expand All @@ -411,12 +412,14 @@ export const getRoutes = () => {
description: 'Activate an existing pending user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand Down Expand Up @@ -449,7 +452,7 @@ export const getRoutes = () => {
handler: userAuditHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: userAuditSchema
Expand All @@ -464,12 +467,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -485,12 +490,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -505,7 +512,7 @@ export const getRoutes = () => {
handler: resendInviteHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: resendInviteRequestSchema
Expand All @@ -520,7 +527,7 @@ export const getRoutes = () => {
handler: usernameReminderHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: usernameReminderRequestSchema
Expand All @@ -535,7 +542,7 @@ export const getRoutes = () => {
handler: resetPasswordInviteHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: resetPasswordRequestSchema
Expand All @@ -552,7 +559,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Creates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: reqRegisterSystemSchema
Expand All @@ -570,7 +577,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Update system permissions',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: reqUpdateSystemSchema
Expand All @@ -585,7 +592,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Deactivates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand All @@ -603,7 +610,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Reactivates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand Down Expand Up @@ -666,11 +673,11 @@ export const getRoutes = () => {
description: 'Gets count of users group by office ids',
auth: {
scope: [
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -689,7 +696,7 @@ export const getRoutes = () => {
description: 'Refresh client secret ',
notes: 'Refresh client secret',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: systemSecretRequestSchema
Expand All @@ -708,7 +715,7 @@ export const getRoutes = () => {
description: 'Delete system ',
notes: 'This is responsible for system deletion',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand Down
3 changes: 2 additions & 1 deletion packages/user-mgnt/src/features/updateUser/handler.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import * as Hapi from '@hapi/hapi'
import { logger } from '@opencrvs/commons'
import { Practitioner } from '@opencrvs/commons/types'
import { SCOPES } from '@opencrvs/commons/authentication'
import { postUserActionToMetrics } from '@user-mgnt/features/changePhone/handler'
import {
createFhirPractitioner,
Expand Down Expand Up @@ -70,7 +71,7 @@ export default async function updateUser(
existingUser.role = user.role

if (existingUser.primaryOfficeId !== user.primaryOfficeId) {
if (request.auth.credentials?.scope?.includes('natlsysadmin')) {
if (request.auth.credentials?.scope?.includes(SCOPES.CONFIG_UPDATE_ALL)) {
existingUser.primaryOfficeId = user.primaryOfficeId
} else {
throw new Error('Location can be changed only by National System Admin')
Expand Down

0 comments on commit 6214ddd

Please sign in to comment.