From 29de9f87a65bf1742a708a382621590906eac28e Mon Sep 17 00:00:00 2001 From: nsdeschenes Date: Thu, 7 Jan 2021 07:43:31 -0400 Subject: [PATCH 1/2] update find-my-domains to have auth check --- .../domains/__tests__/find-my-domains.test.js | 109 ++++++------------ api-js/src/queries/domains/find-my-domains.js | 9 +- 2 files changed, 42 insertions(+), 76 deletions(-) diff --git a/api-js/src/queries/domains/__tests__/find-my-domains.test.js b/api-js/src/queries/domains/__tests__/find-my-domains.test.js index 6cd488debf..c2e218b53c 100644 --- a/api-js/src/queries/domains/__tests__/find-my-domains.test.js +++ b/api-js/src/queries/domains/__tests__/find-my-domains.test.js @@ -1,5 +1,4 @@ const { ArangoTools, dbNameFromFile } = require('arango-tools') -const bcrypt = require('bcrypt') const { graphql, GraphQLSchema, GraphQLError } = require('graphql') const { toGlobalId } = require('graphql-relay') const { setupI18n } = require('@lingui/core') @@ -10,15 +9,15 @@ const { makeMigrations } = require('../../../../migrations') const { createQuerySchema } = require('../..') const { createMutationSchema } = require('../../../mutations') const { cleanseInput } = require('../../../validators') -const { tokenize } = require('../../../auth') +const { userRequired } = require('../../../auth') const { domainLoaderConnectionsByUserId, - userLoaderByUserName, + userLoaderByKey, } = require('../../../loaders') const { DB_PASS: rootPass, DB_URL: url } = process.env describe('given findMyDomainsQuery', () => { - let query, drop, truncate, migrate, schema, collections, org, i18n + let query, drop, truncate, migrate, schema, collections, org, i18n, user beforeAll(async () => { // Create GQL Schema @@ -26,9 +25,14 @@ describe('given findMyDomainsQuery', () => { query: createQuerySchema(), mutation: createMutationSchema(), }) + // Generate DB Items + ;({ migrate } = await ArangoTools({ rootPass, url })) + ;({ query, drop, truncate, collections } = await migrate( + makeMigrations({ databaseName: dbNameFromFile(__filename), rootPass }), + )) }) - let consoleOutput = [] + const consoleOutput = [] const mockedInfo = (output) => consoleOutput.push(output) const mockedWarn = (output) => consoleOutput.push(output) const mockedError = (output) => consoleOutput.push(output) @@ -37,49 +41,13 @@ describe('given findMyDomainsQuery', () => { console.info = mockedInfo console.warn = mockedWarn console.error = mockedError - // Generate DB Items - ;({ migrate } = await ArangoTools({ rootPass, url })) - ;({ query, drop, truncate, collections } = await migrate( - makeMigrations({ databaseName: dbNameFromFile(__filename), rootPass }), - )) - await truncate() - await graphql( - schema, - ` - mutation { - signUp( - input: { - displayName: "Test Account" - userName: "test.account@istio.actually.exists" - password: "testpassword123" - confirmPassword: "testpassword123" - preferredLang: FRENCH - } - ) { - authResult { - user { - id - } - } - } - } - `, - null, - { - query, - auth: { - bcrypt, - tokenize, - }, - validators: { - cleanseInput, - }, - loaders: { - userLoaderByUserName: userLoaderByUserName(query), - }, - }, - ) - consoleOutput = [] + consoleOutput.length = 0 + + user = await collections.users.save({ + displayName: 'Test Account', + userName: 'test.account@istio.actually.exists', + preferredLang: 'french', + }) org = await collections.organizations.save({ orgDetails: { @@ -108,18 +76,16 @@ describe('given findMyDomainsQuery', () => { }) afterEach(async () => { + await truncate() + }) + + afterAll(async () => { await drop() }) describe('given successful retrieval of domains', () => { - let user, domainOne, domainTwo + let domainOne, domainTwo beforeEach(async () => { - const userCursor = await query` - FOR user IN users - FILTER user.userName == "test.account@istio.actually.exists" - RETURN user - ` - user = await userCursor.next() await collections.affiliations.save({ _from: org._id, _to: user._id, @@ -158,26 +124,6 @@ describe('given findMyDomainsQuery', () => { _from: org._id, }) }) - afterEach(async () => { - await query` - LET userEdges = (FOR v, e IN 1..1 ANY ${org._id} affiliations RETURN { edgeKey: e._key, userKey: e._to }) - LET removeUserEdges = (FOR userEdge IN userEdges REMOVE userEdge.edgeKey IN affiliations) - RETURN true - ` - await query` - FOR affiliation IN affiliations - REMOVE affiliation IN affiliations - ` - await query` - LET domainEdges = (FOR v, e IN 1..1 ANY ${org._id} claims RETURN { edgeKey: e._key, userKey: e._to }) - LET removeDomainEdges = (FOR domainEdge IN domainEdges REMOVE domainEdge.edgeKey IN claims) - RETURN true - ` - await query` - FOR claim IN claims - REMOVE claim IN claims - ` - }) describe('user queries for their domains', () => { it('returns domains', async () => { const response = await graphql( @@ -208,6 +154,13 @@ describe('given findMyDomainsQuery', () => { { i18n, userKey: user._key, + auth: { + userRequired: userRequired({ + i18n, + userKey: user._key, + userLoaderByKey: userLoaderByKey(query, user._key, i18n), + }), + }, loaders: { domainLoaderConnectionsByUserId: domainLoaderConnectionsByUserId( query, @@ -305,6 +258,9 @@ describe('given findMyDomainsQuery', () => { { i18n, userKey: 1, + auth: { + userRequired: jest.fn(), + }, loaders: { domainLoaderConnectionsByUserId: mockedLoader, }, @@ -370,6 +326,9 @@ describe('given findMyDomainsQuery', () => { { i18n, userKey: 1, + auth: { + userRequired: jest.fn(), + }, loaders: { domainLoaderConnectionsByUserId: mockedLoader, }, diff --git a/api-js/src/queries/domains/find-my-domains.js b/api-js/src/queries/domains/find-my-domains.js index 4d93fba8fe..6aaafd7b55 100644 --- a/api-js/src/queries/domains/find-my-domains.js +++ b/api-js/src/queries/domains/find-my-domains.js @@ -18,10 +18,17 @@ const findMyDomains = { resolve: async ( _, args, - { i18n, userKey, loaders: { domainLoaderConnectionsByUserId } }, + { + i18n, + userKey, + auth: { userRequired }, + loaders: { domainLoaderConnectionsByUserId }, + }, ) => { let domainConnections + await userRequired() + try { domainConnections = await domainLoaderConnectionsByUserId(args) } catch (err) { From ee191c8aff4078c3e2fcbe4a8c9470308091352a Mon Sep 17 00:00:00 2001 From: nsdeschenes Date: Thu, 7 Jan 2021 07:43:37 -0400 Subject: [PATCH 2/2] update find-my-organizations to have auth check --- .../__tests__/find-my-organizations.test.js | 130 ++++++------------ .../organizations/find-my-organizations.js | 9 +- 2 files changed, 47 insertions(+), 92 deletions(-) diff --git a/api-js/src/queries/organizations/__tests__/find-my-organizations.test.js b/api-js/src/queries/organizations/__tests__/find-my-organizations.test.js index 2a211bcaf7..65864ae3c3 100644 --- a/api-js/src/queries/organizations/__tests__/find-my-organizations.test.js +++ b/api-js/src/queries/organizations/__tests__/find-my-organizations.test.js @@ -1,5 +1,4 @@ const { ArangoTools, dbNameFromFile } = require('arango-tools') -const bcrypt = require('bcrypt') const { graphql, GraphQLSchema, GraphQLError } = require('graphql') const { toGlobalId } = require('graphql-relay') const { setupI18n } = require('@lingui/core') @@ -10,10 +9,10 @@ const { makeMigrations } = require('../../../../migrations') const { createQuerySchema } = require('../..') const { createMutationSchema } = require('../../../mutations') const { cleanseInput } = require('../../../validators') -const { tokenize } = require('../../../auth') +const { userRequired } = require('../../../auth') const { orgLoaderConnectionsByUserId, - userLoaderByUserName, + userLoaderByKey, } = require('../../../loaders') const { DB_PASS: rootPass, DB_URL: url } = process.env @@ -35,9 +34,14 @@ describe('given findMyOrganizationsQuery', () => { query: createQuerySchema(), mutation: createMutationSchema(), }) + // Generate DB Items + ;({ migrate } = await ArangoTools({ rootPass, url })) + ;({ query, drop, truncate, collections } = await migrate( + makeMigrations({ databaseName: dbNameFromFile(__filename), rootPass }), + )) }) - let consoleOutput = [] + const consoleOutput = [] const mockedInfo = (output) => consoleOutput.push(output) const mockedWarn = (output) => consoleOutput.push(output) const mockedError = (output) => consoleOutput.push(output) @@ -46,49 +50,13 @@ describe('given findMyOrganizationsQuery', () => { console.info = mockedInfo console.warn = mockedWarn console.error = mockedError - // Generate DB Items - ;({ migrate } = await ArangoTools({ rootPass, url })) - ;({ query, drop, truncate, collections } = await migrate( - makeMigrations({ databaseName: dbNameFromFile(__filename), rootPass }), - )) - await truncate() - await graphql( - schema, - ` - mutation { - signUp( - input: { - displayName: "Test Account" - userName: "test.account@istio.actually.exists" - password: "testpassword123" - confirmPassword: "testpassword123" - preferredLang: FRENCH - } - ) { - authResult { - user { - id - } - } - } - } - `, - null, - { - query, - auth: { - bcrypt, - tokenize, - }, - validators: { - cleanseInput, - }, - loaders: { - userLoaderByUserName: userLoaderByUserName(query), - }, - }, - ) - consoleOutput = [] + consoleOutput.length = 0 + + user = await collections.users.save({ + displayName: 'Test Account', + userName: 'test.account@istio.actually.exists', + preferredLang: 'french', + }) orgOne = await collections.organizations.save({ orgDetails: { @@ -141,6 +109,10 @@ describe('given findMyOrganizationsQuery', () => { }) afterEach(async () => { + await truncate() + }) + + afterAll(async () => { await drop() }) @@ -157,12 +129,6 @@ describe('given findMyOrganizationsQuery', () => { }) }) beforeEach(async () => { - const userCursor = await query` - FOR user IN users - FILTER user.userName == "test.account@istio.actually.exists" - RETURN user - ` - user = await userCursor.next() await collections.affiliations.save({ _from: orgOne._id, _to: user._id, @@ -174,22 +140,6 @@ describe('given findMyOrganizationsQuery', () => { permission: 'user', }) }) - afterEach(async () => { - await query` - LET userEdges = (FOR v, e IN 1..1 ANY ${orgOne._id} affiliations RETURN { edgeKey: e._key, userKey: e._to }) - LET removeUserEdges = (FOR userEdge IN userEdges REMOVE userEdge.edgeKey IN affiliations) - RETURN true - ` - await query` - LET userEdges = (FOR v, e IN 1..1 ANY ${orgTwo._id} affiliations RETURN { edgeKey: e._key, userKey: e._to }) - LET removeUserEdges = (FOR userEdge IN userEdges REMOVE userEdge.edgeKey IN affiliations) - RETURN true - ` - await query` - FOR affiliation IN affiliations - REMOVE affiliation IN affiliations - ` - }) describe('given successful retrieval of domains', () => { describe('user queries for their organizations', () => { describe('in english', () => { @@ -227,6 +177,13 @@ describe('given findMyOrganizationsQuery', () => { { i18n, userKey: user._key, + auth: { + userRequired: userRequired({ + i18n, + userKey: user._key, + userLoaderByKey: userLoaderByKey(query, user._key, i18n), + }), + }, loaders: { orgLoaderConnectionsByUserId: orgLoaderConnectionsByUserId( query, @@ -327,6 +284,9 @@ describe('given findMyOrganizationsQuery', () => { { i18n, userKey: user._key, + auth: { + userRequired: jest.fn(), + }, loaders: { orgLoaderConnectionsByUserId: mockedOrgLoaderConnectionsByUserId, }, @@ -357,12 +317,6 @@ describe('given findMyOrganizationsQuery', () => { }) }) beforeEach(async () => { - const userCursor = await query` - FOR user IN users - FILTER user.userName == "test.account@istio.actually.exists" - RETURN user - ` - user = await userCursor.next() await collections.affiliations.save({ _from: orgOne._id, _to: user._id, @@ -374,22 +328,6 @@ describe('given findMyOrganizationsQuery', () => { permission: 'user', }) }) - afterEach(async () => { - await query` - LET userEdges = (FOR v, e IN 1..1 ANY ${orgOne._id} affiliations RETURN { edgeKey: e._key, userKey: e._to }) - LET removeUserEdges = (FOR userEdge IN userEdges REMOVE userEdge.edgeKey IN affiliations) - RETURN true - ` - await query` - LET userEdges = (FOR v, e IN 1..1 ANY ${orgTwo._id} affiliations RETURN { edgeKey: e._key, userKey: e._to }) - LET removeUserEdges = (FOR userEdge IN userEdges REMOVE userEdge.edgeKey IN affiliations) - RETURN true - ` - await query` - FOR affiliation IN affiliations - REMOVE affiliation IN affiliations - ` - }) describe('given successful retrieval of domains', () => { describe('user queries for their organizations', () => { describe('in french', () => { @@ -427,6 +365,13 @@ describe('given findMyOrganizationsQuery', () => { { i18n, userKey: user._key, + auth: { + userRequired: userRequired({ + i18n, + userKey: user._key, + userLoaderByKey: userLoaderByKey(query, user._key, i18n), + }), + }, loaders: { orgLoaderConnectionsByUserId: orgLoaderConnectionsByUserId( query, @@ -527,6 +472,9 @@ describe('given findMyOrganizationsQuery', () => { { i18n, userKey: user._key, + auth: { + userRequired: jest.fn(), + }, loaders: { orgLoaderConnectionsByUserId: mockedOrgLoaderConnectionsByUserId, }, diff --git a/api-js/src/queries/organizations/find-my-organizations.js b/api-js/src/queries/organizations/find-my-organizations.js index d58671f90f..d194d896cb 100644 --- a/api-js/src/queries/organizations/find-my-organizations.js +++ b/api-js/src/queries/organizations/find-my-organizations.js @@ -11,10 +11,17 @@ const findMyOrganizations = { resolve: async ( _, args, - { i18n, userKey, loaders: { orgLoaderConnectionsByUserId } }, + { + i18n, + userKey, + auth: { userRequired }, + loaders: { orgLoaderConnectionsByUserId }, + }, ) => { let orgConnections + await userRequired() + try { orgConnections = await orgLoaderConnectionsByUserId(args) } catch (err) {