feat: collaborators

src/middleware/authorization.ts

@@ -1,8 +1,7 @@
 import autoBind from "auto-bind"
-import { NextFunction, Request, Response } from "express"
 
 import UserWithSiteSessionData from "@classes/UserWithSiteSessionData"
-
+import { ForbiddenError } from "@errors/ForbiddenError"
 import { RequestHandler } from "@root/types"
 import AuthorizationMiddlewareService from "@services/middlewareServices/AuthorizationMiddlewareService"
 
@@ -19,8 +18,30 @@ export class AuthorizationMiddleware {
     autoBind(this)
   }
 
+  // Check whether a user is a site admin
+  verifySiteAdmin: RequestHandler<
+    never,
+    unknown,
+    unknown,
+    never,
+    { userWithSiteSessionData: UserWithSiteSessionData }
+  > = async (req, res, next) => {
+    const { userWithSiteSessionData } = res.locals
+
+    try {
+      const result = await this.authorizationMiddlewareService.checkIsSiteAdmin(
+        userWithSiteSessionData
+      )
+      if (result instanceof ForbiddenError) return next(new ForbiddenError())
+
+      return next()
+    } catch (err) {
+      return next(err)
+    }
+  }
+
   // Check whether a user is a site member
-  checkIsSiteMember: RequestHandler<
+  verifySiteMember: RequestHandler<
     never,
     unknown,
     unknown,
@@ -29,10 +50,15 @@ export class AuthorizationMiddleware {
   > = async (req, res, next) => {
     const { userWithSiteSessionData } = res.locals
 
-    await this.authorizationMiddlewareService.checkIsSiteMember(
-      userWithSiteSessionData
-    )
+    try {
+      const result = await this.authorizationMiddlewareService.checkIsSiteMember(
+        userWithSiteSessionData
+      )
+      if (result instanceof ForbiddenError) return next(new ForbiddenError())
 
-    return next()
+      return next()
+    } catch (err) {
+      return next(err)
+    }
   }
 }

src/middleware/index.ts

@@ -9,6 +9,7 @@ import UserWithSiteSessionData from "@classes/UserWithSiteSessionData"
 
 import { RequestHandler } from "@root/types"
 import IdentityAuthService from "@services/identity/AuthService"
+import CollaboratorsService from "@root/services/identity/CollaboratorsService"
 import IsomerAdminsService from "@services/identity/IsomerAdminsService"
 import UsersService from "@services/identity/UsersService"
 import AuthenticationMiddlewareService from "@services/middlewareServices/AuthenticationMiddlewareService"
@@ -27,15 +28,18 @@ const getAuthorizationMiddleware = ({
   identityAuthService,
   usersService,
   isomerAdminsService,
+  collaboratorsService,
 }: {
   identityAuthService: IdentityAuthService
   usersService: UsersService
   isomerAdminsService: IsomerAdminsService
+  collaboratorsService: CollaboratorsService
 }) => {
   const authorizationMiddlewareService = new AuthorizationMiddlewareService({
     identityAuthService,
     usersService,
     isomerAdminsService,
+    collaboratorsService,
   })
   const authorizationMiddleware = new AuthorizationMiddleware({
     authorizationMiddlewareService,

src/routes/v1/authenticatedSites/index.js

@@ -26,7 +26,7 @@ const getAuthenticatedSitesSubrouter = ({
 
   authenticatedSitesSubrouter.use(authenticationMiddleware.verifyJwt)
   authenticatedSitesSubrouter.use(attachSiteHandler)
-  authenticatedSitesSubrouter.use(authorizationMiddleware.checkIsSiteMember)
+  authenticatedSitesSubrouter.use(authorizationMiddleware.verifySiteAdmin)
 
   authenticatedSitesSubrouter.use("/pages", pagesRouter)
   authenticatedSitesSubrouter.use("/collections", collectionsRouter)

src/routes/v2/authenticatedSites/index.js

@@ -189,7 +189,7 @@ const getAuthenticatedSitesSubrouter = ({
 
   authenticatedSitesSubrouter.use(authenticationMiddleware.verifyJwt)
   authenticatedSitesSubrouter.use(attachSiteHandler)
-  authenticatedSitesSubrouter.use(authorizationMiddleware.checkIsSiteMember)
+  authenticatedSitesSubrouter.use(authorizationMiddleware.verifySiteAdmin)
 
   authenticatedSitesSubrouter.use(
     "/collections/:collectionName",

src/server.js

@@ -30,10 +30,12 @@ import DeploymentsService from "@services/identity/DeploymentsService"
 import ReposService from "@services/identity/ReposService"
 import InfraService from "@services/infra/InfraService"
 
+import { AuthorizationMiddleware } from "./middleware/authorization"
 import getAuthenticatedSubrouterV1 from "./routes/v1/authenticated"
 import getAuthenticatedSitesSubrouterV1 from "./routes/v1/authenticatedSites"
 import getAuthenticatedSubrouter from "./routes/v2/authenticated"
 import getAuthenticatedSitesSubrouter from "./routes/v2/authenticatedSites"
+import CollaboratorsService from "./services/identity/CollaboratorsService"
 
 const path = require("path")
 
@@ -81,6 +83,13 @@ const infraService = new InfraService({
   reposService,
   deploymentsService,
 })
+const collaboratorsService = new CollaboratorsService({
+  siteRepository: Site,
+  siteMemberRepository: SiteMember,
+  sitesService,
+  usersService,
+  whitelist: Whitelist,
+})
 
 const gitHubService = new GitHubService({
   axiosInstance: isomerRepoAxiosInstance,
@@ -94,6 +103,7 @@ const authorizationMiddleware = getAuthorizationMiddleware({
   identityAuthService,
   usersService,
   isomerAdminsService,
+  collaboratorsService,
 })
 
 const authenticatedSubrouterV1 = getAuthenticatedSubrouterV1({
@@ -113,6 +123,8 @@ const authenticatedSubrouterV2 = getAuthenticatedSubrouter({
   reposService,
   deploymentsService,
   isomerAdminsService,
+  collaboratorsService,
+  authorizationMiddleware,
 })
 const authenticatedSitesSubrouterV2 = getAuthenticatedSitesSubrouter({
   authorizationMiddleware,

src/services/middlewareServices/AuthorizationMiddlewareService.ts

@@ -1,9 +1,11 @@
 import { NotFoundError } from "@errors/NotFoundError"
-
+import { CollaboratorRoles } from "@root/constants"
+import { ForbiddenError } from "@root/errors/ForbiddenError"
 import UserWithSiteSessionData from "@classes/UserWithSiteSessionData"
 
 import { E2E_ISOMER_ID } from "@root/constants"
 import AuthService from "@services/identity/AuthService"
+import CollaboratorsService from "@services/identity/CollaboratorsService"
 import IsomerAdminsService from "@services/identity/IsomerAdminsService"
 import UsersService from "@services/identity/UsersService"
 
@@ -14,6 +16,7 @@ interface AuthorizationMiddlewareServiceProps {
   identityAuthService: AuthService
   usersService: UsersService
   isomerAdminsService: IsomerAdminsService
+  collaboratorsService: CollaboratorsService
 }
 
 export default class AuthorizationMiddlewareService {
@@ -23,36 +26,71 @@ export default class AuthorizationMiddlewareService {
 
   readonly isomerAdminsService: AuthorizationMiddlewareServiceProps["isomerAdminsService"]
 
+  readonly collaboratorsService: AuthorizationMiddlewareServiceProps["collaboratorsService"]
+
   constructor({
     identityAuthService,
     usersService,
     isomerAdminsService,
+    collaboratorsService,
   }: AuthorizationMiddlewareServiceProps) {
     this.identityAuthService = identityAuthService
     this.usersService = usersService
     this.isomerAdminsService = isomerAdminsService
+    this.collaboratorsService = collaboratorsService
   }
 
   async checkIsSiteMember(sessionData: UserWithSiteSessionData) {
     // Check if user has access to site
     const { siteName, isomerUserId: userId } = sessionData
 
     // Should always be defined - authorization middleware only exists if siteName is defined
-    if (!siteName) throw Error("No site name in authorization middleware")
+    if (!siteName) {
+      logger.error("No site name in authorization middleware")
+      return new ForbiddenError()
+    }
 
     logger.info(`Verifying user's access to ${siteName}`)
 
     const isSiteMember = await (sessionData.isEmailUser()
-      ? this.usersService.hasAccessToSite(userId, siteName)
+      ? (await this.collaboratorsService.getRole(siteName, userId)) !== null
       : this.identityAuthService.hasAccessToSite(sessionData))
 
-    const isAdminUser = await this.isomerAdminsService.getByUserId(userId)
+    const isIsomerCoreAdmin = await this.isomerAdminsService.getByUserId(userId)
 
     const isE2EUser = userId === E2E_ISOMER_ID
-    if (!isSiteMember && !isAdminUser && !isE2EUser) {
-      throw new NotFoundError("Site does not exist")
+    if (!isSiteMember && !isIsomerCoreAdmin && !isE2EUser) {
+      logger.error("Site does not exist")
+      return new ForbiddenError()
     }
 
     logger.info(`User ${userId} has access to ${siteName}`)
   }
+
+  async checkIsSiteAdmin(sessionData: UserWithSiteSessionData) {
+    // Check if user has access to site
+    const { siteName, isomerUserId: userId } = sessionData
+
+    // Should always be defined - authorization middleware only exists if siteName is defined
+    if (!siteName) {
+      logger.error("No site name in authorization middleware")
+      return new ForbiddenError()
+    }
+
+    logger.info(`Verifying user's access to ${siteName}`)
+
+    const isSiteAdmin = await (sessionData.isEmailUser()
+      ? (await this.collaboratorsService.getRole(siteName, userId)) ===
+        CollaboratorRoles.Admin
+      : this.identityAuthService.hasAccessToSite(sessionData))
+    const isIsomerCoreAdmin = await this.isomerAdminsService.getByUserId(userId)
+
+    const isE2EUser = userId === E2E_ISOMER_ID
+    if (!isSiteAdmin && !isIsomerCoreAdmin && !isE2EUser) {
+      logger.error("Site does not exist")
+      return new ForbiddenError()
+    }
+
+    logger.info(`User ${userId} has admin access to ${siteName}`)
+  }
 }