RBAC tweaks

services/api/.env

@@ -31,6 +31,9 @@ API_URL=http://localhost:2300
 UPLOADS_STORE=local
 UPLOADS_GCS_BUCKET=bedrock-staging-uploads
 
+# Multi-Tenancy
+DEFAULT_ORGANIZATION_NAME=
+
 # Sentry Error Tracking
 SENTRY_DSN=
 

services/api/README.md

@@ -207,7 +207,7 @@ const { requirePermissions } = require('../utils/middleware/permissions');
 router
   .use(authenticate())
   // Only allow access to users that have write permissions for this organization
-  .use(requirePermissions({ endpoint: 'shops', level: 'write', context: 'organization' }))
+  .use(requirePermissions('shops.write', 'organization'))
   .post(
     '/',
     validate({

services/api/src/app.js

@@ -6,6 +6,7 @@ const corsMiddleware = require('./utils/middleware/cors');
 const bodyMiddleware = require('./utils/middleware/body');
 const recordMiddleware = require('./utils/middleware/record');
 const serializeMiddleware = require('./utils/middleware/serialize');
+const organizationMiddleware = require('./utils/middleware/organization');
 const { applicationMiddleware } = require('./utils/middleware/application');
 const { loadDefinition } = require('./utils/openapi');
 const Sentry = require('@sentry/node');
@@ -38,6 +39,7 @@ if (['staging', 'development'].includes(ENV_NAME)) {
 }
 
 app.use(serializeMiddleware);
+app.use(organizationMiddleware);
 
 // Record middleware must occur before serialization to
 // derive model names but after errorHandler to capture

services/api/src/models/definitions/user.json

@@ -40,7 +40,11 @@
         },
         "scope": {
           "type": "String",
-          "required": true
+          "required": true,
+          "enum": [
+            "global",
+            "organization"
+          ]
         },
         "scopeRef": {
           "type": "ObjectId",

services/api/src/models/user.js

@@ -1,11 +1,9 @@
 const mongoose = require('mongoose');
 const { createSchema } = require('@bedrockio/model');
-
-const { validScopes } = require('../utils/permissions');
 const { setPassword } = require('../utils/auth/password');
+
 const definition = require('./definitions/user.json');
 
-definition.attributes.roles[0].scope.enum = validScopes;
 const schema = createSchema(definition);
 
 schema.virtual('name').get(function () {

services/api/src/roles.json

@@ -5,13 +5,14 @@
       "global"
     ],
     "permissions": {
-      "auditEntries": "read",
-      "users": "read-write",
-      "shops": "read-write",
-      "products": "read-write",
-      "organizations": "read-write",
-      "applications": "read-write",
-      "uploads": "read-write"
+      "applications": "all",
+      "auditEntries": "all",
+      "organizations": "all",
+      "products": "all",
+      "roles": "all",
+      "shops": "all",
+      "users": "all",
+      "uploads": "all"
     },
     "allowAuthenticationOnRoles": [
       "admin",
@@ -21,28 +22,29 @@
   "admin": {
     "name": "Admin",
     "allowScopes": [
-      "organization"
+      "global"
     ],
     "permissions": {
       "auditEntries": "read",
-      "users": "read-write",
-      "shops": "read-write",
-      "products": "read-write",
-      "applications": "read-write",
-      "uploads": "read-write"
+      "applications": "all",
+      "products": "all",
+      "roles": "all",
+      "shops": "all",
+      "users": "all",
+      "uploads": "all"
     }
   },
   "viewer": {
     "name": "Viewer",
     "allowScopes": [
-      "organization"
+      "global"
     ],
     "permissions": {
+      "applications": "read",
       "auditEntries": "read",
-      "users": "read",
-      "shops": "read",
       "products": "read",
-      "applications": "read",
+      "shops": "read",
+      "users": "read",
       "uploads": "read"
     }
   }

services/api/src/routes/__tests__/uploads.js

@@ -41,7 +41,7 @@ describe('/1/uploads', () => {
       expect(response.body.data.filename).toBe('test.png');
     });
 
-    it('should not be able to access private upload as viewer', async () => {
+    it('should be able to access private upload as viewer', async () => {
       const manager = await importFixtures('users/jack');
       const upload = await createUpload({
         private: true,
@@ -54,7 +54,8 @@ describe('/1/uploads', () => {
           user: manager,
         }
       );
-      expect(response.status).toBe(401);
+      expect(response.status).toBe(200);
+      expect(response.body.data.filename).toBe('test.png');
     });
 
     it('should not allow access private upload when unauthenticated', async () => {

services/api/src/routes/__tests__/users.js

@@ -99,6 +99,28 @@ describe('/1/users', () => {
       );
       expect(response.status).toBe(403);
     });
+
+    it('should error on invalid roles', async () => {
+      const admin = await createAdmin();
+      const response = await request(
+        'POST',
+        '/1/users',
+        {
+          email: '[email protected]',
+          password: 'verysecurepassword',
+          firstName: 'Mellow',
+          lastName: 'Yellow',
+          roles: [
+            {
+              role: 'superAdmin',
+              scope: 'organization',
+            },
+          ],
+        },
+        { user: admin }
+      );
+      expect(response.status).toBe(400);
+    });
   });
 
   describe('GET /:user', () => {
@@ -300,7 +322,7 @@ describe('/1/users', () => {
         {
           roles: [
             {
-              role: 'limitedAdmin',
+              role: 'admin',
               scope: 'global',
             },
           ],
@@ -309,14 +331,33 @@ describe('/1/users', () => {
       );
       expect(response.status).toBe(200);
       expect(response.body.data.roles.length).toBe(1);
-      expect(response.body.data.roles[0].role).toBe('limitedAdmin');
+      expect(response.body.data.roles[0].role).toBe('admin');
       expect(response.body.data.roles[0].scope).toBe('global');
       const dbUser = await User.findById(user1.id);
       expect(dbUser.roles.length).toBe(1);
-      expect(dbUser.roles[0].role).toBe('limitedAdmin');
+      expect(dbUser.roles[0].role).toBe('admin');
       expect(dbUser.roles[0].scope).toBe('global');
     });
 
+    it('should error on invalid roles', async () => {
+      const admin = await createAdmin();
+      const user = await createUser({ firstName: 'New', lastName: 'Name' });
+      const response = await request(
+        'PATCH',
+        `/1/users/${user.id}`,
+        {
+          roles: [
+            {
+              role: 'superAdmin',
+              scope: 'organization',
+            },
+          ],
+        },
+        { user: admin }
+      );
+      expect(response.status).toBe(400);
+    });
+
     it('should strip out reserved fields', async () => {
       const admin = await createAdmin();
       const user1 = await createUser({ firstName: 'New', lastName: 'Name' });

services/api/src/routes/applications.js

@@ -11,7 +11,7 @@ const router = new Router();
 
 router
   .use(authenticate())
-  .use(requirePermissions({ endpoint: 'applications', permission: 'read', scope: 'global' }))
+  .use(requirePermissions('applications.read'))
   .param('id', fetchByParam(Application))
   .post('/mine/search', validateBody(Application.getSearchValidation()), async (ctx) => {
     const { body } = ctx.request;
@@ -54,7 +54,7 @@ router
       data: ctx.state.application,
     };
   })
-  .use(requirePermissions({ endpoint: 'applications', permission: 'write', scope: 'global' }))
+  .use(requirePermissions('applications.write'))
   .post('/', validateBody(Application.getCreateValidation()), async (ctx) => {
     const { body } = ctx.request;
     const apiKey = kebabCase(body.name);

services/api/src/routes/audit-entries.js

@@ -10,7 +10,7 @@ const router = new Router();
 
 router
   .use(authenticate())
-  .use(requirePermissions({ endpoint: 'auditEntries', permission: 'read', scope: 'global' }))
+  .use(requirePermissions('auditEntries.read'))
   .post(
     '/search',
     validateBody(

services/api/src/routes/invites.js

@@ -85,7 +85,7 @@ router
     }
   )
   .use(authenticate())
-  .use(requirePermissions({ endpoint: 'users', permission: 'read', scope: 'global' }))
+  .use(requirePermissions('users.read'))
   .param('id', fetchByParam(Invite))
   .post('/search', validateBody(Invite.getSearchValidation()), async (ctx) => {
     const { data, meta } = await Invite.search(ctx.request.body);
@@ -94,7 +94,7 @@ router
       meta,
     };
   })
-  .use(requirePermissions({ endpoint: 'users', permission: 'write', scope: 'global' }))
+  .use(requirePermissions('users.invite'))
   .post(
     '/',
     validateBody({

services/api/src/routes/organizations.js

@@ -38,15 +38,15 @@ router
       data: organization,
     };
   })
-  .use(requirePermissions({ endpoint: 'organizations', permission: 'read', scope: 'global' }))
+  .use(requirePermissions('organizations.read'))
   .post('/search', validateBody(Organization.getSearchValidation()), async (ctx) => {
     const { data, meta } = await Organization.search(ctx.request.body);
     ctx.body = {
       data,
       meta,
     };
   })
-  .use(requirePermissions({ endpoint: 'organizations', permission: 'write', scope: 'global' }))
+  .use(requirePermissions('organizations.write'))
   .post('/', validateBody(Organization.getCreateValidation()), async (ctx) => {
     const organization = await Organization.create(ctx.request.body);
     ctx.body = {

services/api/src/routes/uploads.js

@@ -4,6 +4,7 @@ const { authenticate } = require('../utils/middleware/authenticate');
 const { validateFiles } = require('../utils/middleware/validate');
 const { createUploads, getUploadUrl, createUrlStream } = require('../utils/uploads');
 const { userHasAccess } = require('./../utils/permissions');
+const { isEqual } = require('@bedrockio/model');
 const { Upload } = require('../models');
 
 const router = new Router();
@@ -41,7 +42,7 @@ router
         if (ctx.method === 'GET') {
           return true;
         } else {
-          return upload.owner?.equals(ctx.state.authUser.id);
+          return isEqual(upload.owner, ctx.state.authUser);
         }
       },
     })