Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: amend user-mgnt changes with scopes #7903

Merged
merged 1 commit into from
Nov 7, 2024
Merged

chore: amend user-mgnt changes with scopes #7903

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
193 changes: 100 additions & 93 deletions packages/user-mgnt/src/config/routes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,18 +96,7 @@ import changeEmailHandler, {
} from '@user-mgnt/features/changeEmail/handler'
import { getAllSystemsHandler } from '@user-mgnt/features/getAllSystems/handler'
import * as mongoose from 'mongoose'

const enum RouteScope {
DECLARE = 'declare',
REGISTER = 'register',
CERTIFY = 'certify',
PERFORMANCE = 'performance',
SYSADMIN = 'sysadmin',
NATLSYSADMIN = 'natlsysadmin',
VALIDATE = 'validate',
RECORDSEARCH = 'recordsearch',
VERIFY = 'verify'
}
import { SCOPES } from '@opencrvs/commons/authentication'

export const getRoutes = () => {
return [
Expand Down Expand Up @@ -215,12 +204,14 @@ export const getRoutes = () => {
description: 'Changes password for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -240,12 +231,14 @@ export const getRoutes = () => {
description: 'Changes password for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -265,12 +258,14 @@ export const getRoutes = () => {
description: 'Changes email for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -290,12 +285,14 @@ export const getRoutes = () => {
description: 'Changes avatar for logged-in user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -315,12 +312,14 @@ export const getRoutes = () => {
description: 'Retrieves a user mobile number',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -338,12 +337,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -361,16 +362,16 @@ export const getRoutes = () => {
description: 'Retrieves a user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE,
RouteScope.VERIFY,
RouteScope.RECORDSEARCH,
// @TODO: Refer to an enum / constant
'record.confirm-registration'
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL,
SCOPES.RECORD_REGISTRATION_VERIFY_CERTIFIED_COPIES,
SCOPES.RECORDSEARCH
]
},
validate: {
Expand All @@ -386,7 +387,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Creates a new user',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
}
}
},
Expand All @@ -398,7 +399,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Updates an existing user',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
}
}
},
Expand All @@ -411,12 +412,14 @@ export const getRoutes = () => {
description: 'Activate an existing pending user',
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand Down Expand Up @@ -449,7 +452,7 @@ export const getRoutes = () => {
handler: userAuditHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: userAuditSchema
Expand All @@ -464,12 +467,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -485,12 +490,14 @@ export const getRoutes = () => {
options: {
auth: {
scope: [
RouteScope.DECLARE,
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.RECORD_DECLARE_BIRTH,
SCOPES.RECORD_DECLARE_DEATH,
SCOPES.RECORD_DECLARE_MARRIAGE,
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -505,7 +512,7 @@ export const getRoutes = () => {
handler: resendInviteHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: resendInviteRequestSchema
Expand All @@ -520,7 +527,7 @@ export const getRoutes = () => {
handler: usernameReminderHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: usernameReminderRequestSchema
Expand All @@ -535,7 +542,7 @@ export const getRoutes = () => {
handler: resetPasswordInviteHandler,
options: {
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: resetPasswordRequestSchema
Expand All @@ -552,7 +559,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Creates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: reqRegisterSystemSchema
Expand All @@ -570,7 +577,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Update system permissions',
auth: {
scope: [RouteScope.SYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: reqUpdateSystemSchema
Expand All @@ -585,7 +592,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Deactivates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand All @@ -603,7 +610,7 @@ export const getRoutes = () => {
tags: ['api'],
description: 'Reactivates a new system client',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand Down Expand Up @@ -666,11 +673,11 @@ export const getRoutes = () => {
description: 'Gets count of users group by office ids',
auth: {
scope: [
RouteScope.REGISTER,
RouteScope.CERTIFY,
RouteScope.PERFORMANCE,
RouteScope.SYSADMIN,
RouteScope.VALIDATE
SCOPES.REGISTER,
SCOPES.CERTIFY,
SCOPES.PERFORMANCE_READ,
SCOPES.CONFIG_UPDATE_ALL,
SCOPES.RECORD_SUBMIT_FOR_APPROVAL
]
},
validate: {
Expand All @@ -689,7 +696,7 @@ export const getRoutes = () => {
description: 'Refresh client secret ',
notes: 'Refresh client secret',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: systemSecretRequestSchema
Expand All @@ -708,7 +715,7 @@ export const getRoutes = () => {
description: 'Delete system ',
notes: 'This is responsible for system deletion',
auth: {
scope: [RouteScope.NATLSYSADMIN]
scope: [SCOPES.CONFIG_UPDATE_ALL]
},
validate: {
payload: clientIdSchema
Expand Down
3 changes: 2 additions & 1 deletion packages/user-mgnt/src/features/updateUser/handler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import * as Hapi from '@hapi/hapi'
import { logger } from '@opencrvs/commons'
import { Practitioner } from '@opencrvs/commons/types'
import { SCOPES } from '@opencrvs/commons/authentication'
import { postUserActionToMetrics } from '@user-mgnt/features/changePhone/handler'
import {
createFhirPractitioner,
Expand Down Expand Up @@ -70,7 +71,7 @@ export default async function updateUser(
existingUser.role = user.role

if (existingUser.primaryOfficeId !== user.primaryOfficeId) {
if (request.auth.credentials?.scope?.includes('natlsysadmin')) {
if (request.auth.credentials?.scope?.includes(SCOPES.CONFIG_UPDATE_ALL)) {
existingUser.primaryOfficeId = user.primaryOfficeId
} else {
throw new Error('Location can be changed only by National System Admin')
Expand Down
Loading