fix: update user activation route with proper scopes

packages/gateway/src/features/user/root-resolvers.test.ts

@@ -658,6 +658,19 @@ describe('User root resolvers', () => {
     })
   })
   describe('activateUser mutation', () => {
+    const regsiterToken = jwt.sign(
+      { scope: ['SCOPES.REGISTER'] },
+      readFileSync('./test/cert.key'),
+      {
+        subject: 'ba7022f0ff4822',
+        algorithm: 'RS256',
+        issuer: 'opencrvs:auth-service',
+        audience: 'opencrvs:gateway-user'
+      }
+    )
+    const newUserHeaders = {
+      Authorization: `Bearer ${regsiterToken}`
+    }
     it('activates the pending user', async () => {
       fetch.mockResponses(
         [
@@ -677,7 +690,7 @@ describe('User root resolvers', () => {
           securityQNAs: [{ questionKey: 'HOME_TOWN', answer: 'test' }]
         },
         {
-          headers: undefined
+          headers: newUserHeaders
         }
       )
 
@@ -699,13 +712,51 @@ describe('User root resolvers', () => {
             securityQNAs: [{ questionKey: 'HOME_TOWN', answer: 'test' }]
           },
           {
-            headers: undefined
+            headers: newUserHeaders
           }
         )
       ).rejects.toThrowError(
         "Something went wrong on user-mgnt service. Couldn't activate given user"
       )
     })
+    it('fails to activate user if user is not token owner', async () => {
+      const regsiterToken = jwt.sign(
+        { scope: ['SCOPES.REGISTER'] },
+        readFileSync('./test/cert.key'),
+        {
+          subject: 'abcdefgh',
+          algorithm: 'RS256',
+          issuer: 'opencrvs:auth-service',
+          audience: 'opencrvs:gateway-user'
+        }
+      )
+      const newUserHeaders = {
+        Authorization: `Bearer ${regsiterToken}`
+      }
+      fetch.mockResponses(
+        [
+          JSON.stringify({
+            userId: 'abcdefgh'
+          }),
+          { status: 201 }
+        ],
+        [JSON.stringify({})]
+      )
+
+      return expect(
+        resolvers.Mutation!.activateUser(
+          {},
+          {
+            userId: 'ba7022f0ff4822',
+            password: 'test',
+            securityQNAs: [{ questionKey: 'HOME_TOWN', answer: 'test' }]
+          },
+          {
+            headers: newUserHeaders
+          }
+        )
+      ).rejects.toThrowError('User can not be activated')
+    })
   })
 
   describe('changePassword mutation', () => {

packages/gateway/src/features/user/root-resolvers.ts

@@ -347,6 +347,12 @@ export const resolvers: GQLResolver = {
       { userId, password, securityQNAs },
       { headers: authHeader }
     ) {
+      if (
+        !isTokenOwner(authHeader, userId) &&
+        !hasScope(authHeader, SCOPES.USER_UPDATE)
+      )
+        throw new Error('User can not be activated')
+
       const res = await fetch(`${USER_MANAGEMENT_URL}activateUser`, {
         method: 'POST',
         body: JSON.stringify({ userId, password, securityQNAs }),

packages/user-mgnt/src/config/routes.ts

@@ -335,9 +335,6 @@ export const getRoutes = () => {
       options: {
         tags: ['api'],
         description: 'Activate an existing pending user',
-        auth: {
-          scope: [SCOPES.USER_UPDATE]
-        },
         validate: {
           payload: activateUserRequestSchema
         }