organization.js

import { t } from '@lingui/macro'
import { GraphQLBoolean, GraphQLInt, GraphQLObjectType, GraphQLString, GraphQLList, GraphQLNonNull } from 'graphql'
import { connectionArgs, globalIdField } from 'graphql-relay'

import { organizationPoliciesType } from './organization-policies'
import { organizationSummaryType } from './organization-summary'
import { nodeInterface } from '../../node'
import { Acronym, Slug } from '../../scalars'
import { affiliationUserOrder } from '../../affiliation/inputs'
import { affiliationConnection } from '../../affiliation/objects'
import { domainOrder, domainFilter } from '../../domain/inputs'
import { domainConnection } from '../../domain/objects'
import { OrderDirection } from '../../enums'
import { tagType } from '../../tags/objects'
import ac from '../../access-control'

export const organizationType = new GraphQLObjectType({
  name: 'Organization',
  fields: () => ({
    id: globalIdField('organization'),
    acronym: {
      type: Acronym,
      description: 'The organizations acronym.',
      resolve: ({ acronym }) => acronym,
    },
    name: {
      type: GraphQLString,
      description: 'The full name of the organization.',
      resolve: ({ name }) => name,
    },
    slug: {
      type: Slug,
      description: 'Slugified name of the organization.',
      resolve: ({ slug }) => slug,
    },
    zone: {
      type: GraphQLString,
      description: 'The zone which the organization belongs to.',
      resolve: ({ zone }) => zone,
    },
    sector: {
      type: GraphQLString,
      description: 'The sector which the organization belongs to.',
      resolve: ({ sector }) => sector,
    },
    country: {
      type: GraphQLString,
      description: 'The country in which the organization resides.',
      resolve: ({ country }) => country,
    },
    province: {
      type: GraphQLString,
      description: 'The province in which the organization resides.',
      resolve: ({ province }) => province,
    },
    city: {
      type: GraphQLString,
      description: 'The city in which the organization resides.',
      resolve: ({ city }) => city,
    },
    verified: {
      type: GraphQLBoolean,
      description: 'Whether the organization is a verified organization.',
      resolve: ({ verified }) => verified,
    },
    externallyManaged: {
      type: GraphQLBoolean,
      description: 'Whether the organization is externally managed.',
      resolve: ({ externallyManaged }) => externallyManaged,
    },
    externalId: {
      type: GraphQLString,
      description: 'String ID used to identify the organization in an external system.',
      resolve: ({ externalId }) => externalId,
    },
    availableTags: {
      type: new GraphQLList(tagType),
      description: '',
      args: {
        includeGlobal: {
          type: GraphQLBoolean,
          description: '',
        },
        includePending: {
          type: GraphQLBoolean,
          description: '',
        },
        sortDirection: {
          type: new GraphQLNonNull(OrderDirection),
          description: 'The direction in which to sort the data.',
        },
      },
      resolve: async (
        { _key },
        args,
        { userKey, auth: { userRequired, loginRequiredBool, verifiedRequired }, dataSources: { tags } },
      ) => {
        if (loginRequiredBool) {
          const user = await userRequired()
          verifiedRequired({ user })
        }

        const orgTags = await tags.byOrg({
          orgId: _key,
          ...args,
        })

        console.debug(`User: ${userKey} successfully retrieved their org's tags.`)

        return orgTags
      },
    },
    policies: {
      type: organizationPoliciesType,
      description: 'Policies that apply to this organization.',
      resolve: ({ policies }) => policies,
    },
    summaries: {
      type: organizationSummaryType,
      description: 'Summaries based on scan types that are preformed on the given organizations domains.',
      resolve: ({ summaries }) => summaries,
    },
    historicalSummaries: {
      type: new GraphQLList(organizationSummaryType),
      description: 'Historical summaries based on scan types that are performed on the given organizations domains.',
      args: {
        startDate: {
          type: GraphQLString,
          description: 'The start date for the returned data (YYYY-MM-DD).',
        },
        endDate: {
          type: GraphQLString,
          description: 'The end date for the returned data (YYYY-MM-DD).',
        },
        sortDirection: {
          type: OrderDirection,
          description: 'The direction in which to sort the data.',
        },
        limit: {
          type: GraphQLInt,
          description: 'The maximum amount of summaries to be returned.',
        },
      },
      resolve: async (
        { _id },
        args,
        {
          userKey,
          auth: { userRequired, loginRequiredBool, verifiedRequired },
          dataSources: { organization: organizationDS },
        },
      ) => {
        if (loginRequiredBool) {
          const user = await userRequired()
          verifiedRequired({ user })
        }

        const historicalSummaries = await organizationDS.summariesByPeriod({
          orgId: _id,
          ...args,
        })

        console.info(`User: ${userKey} successfully retrieved their organization summaries.`)
        return historicalSummaries
      },
    },
    domainCount: {
      type: GraphQLInt,
      description: 'The number of domains associated with this organization.',
      resolve: ({ domainCount }) => domainCount,
    },
    toCsv: {
      type: GraphQLString,
      description:
        'CSV formatted output of all domains in the organization including their email and web scan statuses.',
      args: {
        filters: {
          type: new GraphQLList(domainFilter),
          description: 'Filters used to limit domains returned.',
        },
      },
      resolve: async (
        { _id },
        args,
        {
          i18n,
          userKey,
          request: { ip },
          auth: { userRequired, verifiedRequired },
          dataSources: { auth: authDS, auditLogs, organization: organizationDS },
        },
      ) => {
        const user = await userRequired()
        verifiedRequired({ user })

        const permission = await authDS.permissionByOrgId.load(_id)
        if (!ac.can(permission).createOwn('csv').granted) {
          console.error(
            `User "${userKey}" attempted to retrieve CSV output for organization "${_id}". Permission: ${permission}`,
          )
          throw new Error(t`Permission Denied: Please contact organization user for help with retrieving this domain.`)
        }

        const domains = await organizationDS.domainStatuses({
          orgId: _id,
          ...args,
        })
        const headers = [
          'domain',
          'ipAddresses',
          'https',
          'hsts',
          'certificates',
          'protocols',
          'ciphers',
          'curves',
          'spf',
          'dkim',
          'dmarc',
          'phase',
          'tags',
          'assetState',
          'rcode',
          'blocked',
          'wildcardSibling',
          'wildcardEntry',
          'hasEntrustCertificate',
          'top25Vulnerabilities',
          'cvdEnrollmentStatus',
        ]
        let csvOutput = headers.join(',')
        domains.forEach((domainDoc) => {
          const csvLine = headers
            .map((header) => {
              if (['ipAddresses', 'tags', 'top25Vulnerabilities'].includes(header)) {
                return `"${domainDoc[header]?.join('|') || []}"`
              } else if (
                ['https', 'hsts', 'certificates', 'protocols', 'ciphers', 'curves', 'spf', 'dkim', 'dmarc'].includes(
                  header,
                )
              ) {
                return `"${domainDoc?.status[header]}"`
              } else if (header === 'phase') {
                switch (domainDoc[header]) {
                  case 'assess':
                    return i18n._(t`Assess`)
                  case 'deploy':
                    return i18n._(t`Deploy`)
                  case 'enforce':
                    return i18n._(t`Enforce`)
                  case 'maintain':
                    return i18n._(t`Maintain`)
                  default:
                    return ''
                }
              }
              return `"${domainDoc[header]}"`
            })
            .join(',')
          csvOutput += `\n${csvLine}`
        })

        // Get org names to use in activity log
        let orgNames
        try {
          orgNames = await organizationDS.namesById.load(_id)
        } catch (err) {
          console.error(
            `Error occurred when user: ${userKey} attempted to export org: ${_id}. Error while retrieving organization names. error: ${err}`,
          )
          throw new Error(i18n._(t`Unable to export organization. Please try again.`))
        }

        await auditLogs.logActivity({
          initiatedBy: {
            id: user._key,
            userName: user.userName,
            role: permission,
            ipAddress: ip,
          },
          action: 'export',
          target: {
            resource: {
              en: orgNames.orgNameEN,
              fr: orgNames.orgNameFR,
            },
            organization: {
              id: _id,
              name: orgNames.orgNameEN,
            },
            resourceType: 'organization',
          },
        })

        return csvOutput
      },
    },
    domains: {
      type: domainConnection.connectionType,
      description: 'The domains which are associated with this organization.',
      args: {
        orderBy: {
          type: domainOrder,
          description: 'Ordering options for domain connections.',
        },
        ownership: {
          type: GraphQLBoolean,
          description: 'Limit domains to those that belong to an organization that has ownership.',
        },
        search: {
          type: GraphQLString,
          description: 'String used to search for domains.',
        },
        filters: {
          type: new GraphQLList(domainFilter),
          description: 'Filters used to limit domains returned.',
        },
        ...connectionArgs,
      },
      resolve: async (
        { _id },
        args,

        { dataSources: { auth: authDS, domain: domainDataSource } },
      ) => {
        const permission = await authDS.permissionByOrgId.load(_id)
        const connections = await domainDataSource.connectionsByOrgId({
          orgId: _id,
          permission,
          ...args,
        })
        return connections
      },
    },
    affiliations: {
      type: affiliationConnection.connectionType,
      description: 'Organization affiliations to various users.',
      args: {
        orderBy: {
          type: affiliationUserOrder,
          description: 'Ordering options for affiliation connections.',
        },
        search: {
          type: GraphQLString,
          description: 'String used to search for affiliated users.',
        },
        includePending: {
          type: GraphQLBoolean,
          description: 'Exclude (false) or include only (true) pending affiliations in the results.',
        },
        ...connectionArgs,
      },
      resolve: async (
        { _id },
        args,
        {
          i18n,
          auth: { loginRequiredBool },
          dataSources: { auth: authDS, affiliation },
        },
      ) => {
        const permission = await authDS.permissionByOrgId.load(_id)
        if (!ac.can(permission).readOwn('affiliation').granted && loginRequiredBool) {
          throw new Error(i18n._(t`Cannot query affiliations on organization without admin permission or higher.`))
        }

        const affiliations = await affiliation.connectionsByOrgId({
          orgId: _id,
          ...args,
        })
        return affiliations
      },
    },
    userHasPermission: {
      type: GraphQLBoolean,
      description:
        'Value that determines if a user is affiliated with an organization, whether through organization affiliation, verified affiliation, or through super admin status.',
      resolve: async ({ _id }, _args, { dataSources: { auth: authDS } }) => {
        const permission = await authDS.permissionByOrgId.load(_id)
        return ['user', 'admin', 'super_admin', 'owner'].includes(permission)
      },
    },
  }),
  interfaces: [nodeInterface],
  description: 'Organization object containing information for a given Organization.',
})