Merge pull request #3547 from gradido/refactor_community_auth

fix(backend): allow reading gmsApiKey admins only

admin/src/graphql/updateHomeCommunity.js

@@ -8,7 +8,7 @@ export const updateHomeCommunity = gql`
       location: $location
       hieroTopicId: $hieroTopicId
     ) {
-      id
+      uuid
     }
   }
 `

backend/src/auth/ADMIN_RIGHTS.ts

@@ -5,8 +5,6 @@ export const ADMIN_RIGHTS = [
   RIGHTS.DELETE_USER,
   RIGHTS.UNDELETE_USER,
   RIGHTS.COMMUNITY_UPDATE,
-  RIGHTS.COMMUNITY_BY_UUID,
-  RIGHTS.COMMUNITY_BY_IDENTIFIER,
-  RIGHTS.HOME_COMMUNITY,
+  RIGHTS.COMMUNITY_WITH_API_KEYS,
   RIGHTS.PROJECT_BRANDING_MUTATE,
 ]

backend/src/auth/DLT_CONNECTOR_RIGHTS.ts

@@ -1,3 +1,3 @@
 import { RIGHTS } from './RIGHTS'
 
-export const DLT_CONNECTOR_RIGHTS = [RIGHTS.COMMUNITY_BY_IDENTIFIER, RIGHTS.HOME_COMMUNITY]
+export const DLT_CONNECTOR_RIGHTS = [RIGHTS.COMMUNITIES, RIGHTS.COMMUNITY_UPDATE]

backend/src/auth/RIGHTS.ts

@@ -69,9 +69,7 @@ export enum RIGHTS {
   SET_USER_ROLE = 'SET_USER_ROLE',
   DELETE_USER = 'DELETE_USER',
   UNDELETE_USER = 'UNDELETE_USER',
-  COMMUNITY_BY_UUID = 'COMMUNITY_BY_UUID',
-  COMMUNITY_BY_IDENTIFIER = 'COMMUNITY_BY_IDENTIFIER',
-  HOME_COMMUNITY = 'HOME_COMMUNITY',
   COMMUNITY_UPDATE = 'COMMUNITY_UPDATE',
+  COMMUNITY_WITH_API_KEYS = 'COMMUNITY_WITH_API_KEYS',
   PROJECT_BRANDING_MUTATE = 'PROJECT_BRANDING_MUTATE',
 }

backend/src/graphql/model/AdminCommunityView.ts

@@ -38,7 +38,6 @@ export class AdminCommunityView {
     this.updatedAt = dbCom.updatedAt
     this.uuid = dbCom.communityUuid
     this.authenticatedAt = dbCom.authenticatedAt
-    this.gmsApiKey = dbCom.gmsApiKey
     this.hieroTopicId = dbCom.hieroTopicId
     if (dbCom.location) {
       this.location = Point2Location(dbCom.location as Point)

backend/src/graphql/model/Community.ts

@@ -12,7 +12,6 @@ export class Community {
     this.creationDate = dbCom.creationDate
     this.uuid = dbCom.communityUuid
     this.authenticatedAt = dbCom.authenticatedAt
-    this.gmsApiKey = dbCom.gmsApiKey
     this.hieroTopicId = dbCom.hieroTopicId
   }
 
@@ -40,9 +39,6 @@ export class Community {
   @Field(() => Date, { nullable: true })
   authenticatedAt: Date | null
 
-  @Field(() => String, { nullable: true })
-  gmsApiKey: string | null
-
   @Field(() => String, { nullable: true })
   hieroTopicId: string | null
 }

backend/src/graphql/resolver/CommunityResolver.test.ts

@@ -324,6 +324,10 @@ describe('CommunityResolver', () => {
 
       beforeEach(async () => {
         jest.clearAllMocks()
+        await userFactory(testEnv, peterLustig)
+        // login as admin
+        await mutate({ mutation: login, variables: peterLoginData })
+
         comHomeCom1 = DbCommunity.create()
         comHomeCom1.foreign = false
         comHomeCom1.url = 'http://localhost'
@@ -547,13 +551,10 @@ describe('CommunityResolver', () => {
 
     describe('with empty list', () => {
       beforeEach(async () => {
-        await cleanDB()
-        jest.clearAllMocks()
+        await DbCommunity.clear()
       })
 
       it('returns no community entry', async () => {
-        // const result: Community[] = await query({ query: getCommunities })
-        // expect(result.length).toEqual(0)
         await expect(query({ query: communitiesQuery })).resolves.toMatchObject({
           data: {
             communities: [],
@@ -785,7 +786,6 @@ describe('CommunityResolver', () => {
         ).resolves.toMatchObject({
           data: {
             updateHomeCommunity: {
-              id: expect.any(Number),
               foreign: homeCom?.foreign,
               name: homeCom?.name,
               description: homeCom?.description,

backend/src/graphql/resolver/CommunityResolver.ts

@@ -35,7 +35,7 @@ export class CommunityResolver {
     )
   }
 
-  @Authorized([RIGHTS.COMMUNITIES])
+  @Authorized([RIGHTS.COMMUNITY_WITH_API_KEYS])
   @Query(() => [AdminCommunityView])
   async allCommunities(@Args() paginated: Paginated): Promise<AdminCommunityView[]> {
     // communityUUID could be oneTimePassCode (uint32 number)
@@ -54,7 +54,7 @@ export class CommunityResolver {
     return dbCommunities.map((dbCom: DbCommunity) => new Community(dbCom))
   }
 
-  @Authorized([RIGHTS.COMMUNITY_BY_IDENTIFIER])
+  @Authorized([RIGHTS.COMMUNITIES])
   @Query(() => Community)
   async communityByIdentifier(
     @Arg('communityIdentifier') communityIdentifier: string,
@@ -67,7 +67,7 @@ export class CommunityResolver {
     return new Community(community)
   }
 
-  @Authorized([RIGHTS.HOME_COMMUNITY])
+  @Authorized([RIGHTS.COMMUNITIES])
   @Query(() => Community)
   async homeCommunity(): Promise<Community> {
     const community = await getHomeCommunity()
@@ -78,10 +78,10 @@ export class CommunityResolver {
   }
 
   @Authorized([RIGHTS.COMMUNITY_UPDATE])
-  @Mutation(() => Community)
+  @Mutation(() => AdminCommunityView)
   async updateHomeCommunity(
     @Args() { uuid, gmsApiKey, location, hieroTopicId }: EditCommunityInput,
-  ): Promise<Community> {
+  ): Promise<AdminCommunityView> {
     const homeCom = await getCommunityByUuid(uuid)
     if (!homeCom) {
       throw new LogError('HomeCommunity with uuid not found: ', uuid)
@@ -101,6 +101,6 @@ export class CommunityResolver {
       homeCom.hieroTopicId = hieroTopicId ?? null
       await DbCommunity.save(homeCom)
     }
-    return new Community(homeCom)
+    return new AdminCommunityView(homeCom)
   }
 }

backend/src/seeds/graphql/mutations.ts

@@ -375,7 +375,6 @@ export const logout = gql`
 export const updateHomeCommunityQuery = gql`
   mutation ($uuid: String!, $gmsApiKey: String!) {
     updateHomeCommunity(uuid: $uuid, gmsApiKey: $gmsApiKey) {
-      id
       foreign
       name
       description

backend/src/seeds/graphql/queries.ts

@@ -146,7 +146,6 @@ export const communitiesQuery = gql`
       creationDate
       uuid
       authenticatedAt
-      gmsApiKey
     }
   }
 `
@@ -162,7 +161,6 @@ export const getCommunityByIdentifierQuery = gql`
       creationDate
       uuid
       authenticatedAt
-      gmsApiKey
     }
   }
 `
@@ -178,7 +176,6 @@ export const getHomeCommunityQuery = gql`
       creationDate
       uuid
       authenticatedAt
-      gmsApiKey
     }
   }
 `