Change insufficient permissions to be an error class
Signed-off-by: trivernis <trivernis@protonmail.com>pull/28/head
parent
123d8159da
commit
eaf484596b
GPG Key ID:
DFFFCC2C7A02DB45
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,167 @@
|
|||||||
|
/*
|
||||||
|
Copyright (C) 2020 Leon Löchner
|
||||||
|
|
||||||
|
This file is part of fLotte-API-Server.
|
||||||
|
|
||||||
|
fLotte-API-Server is free software: you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
fLotte-API-Server is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License
|
||||||
|
along with fLotte-API-Server. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import { ApolloServer } from 'apollo-server-express';
|
||||||
|
import bikeResolver from './resolvers/cargoBikeResolver';
|
||||||
|
import { CargoBikeAPI } from './datasources/db/cargobikeAPI';
|
||||||
|
import typeDefs from './schema/type-defs';
|
||||||
|
import 'reflect-metadata';
|
||||||
|
import { ConnectionOptions, createConnection } from 'typeorm';
|
||||||
|
import { UserServerAPI } from './datasources/userserver/userserviceAPI';
|
||||||
|
import express from 'express';
|
||||||
|
import { requiredPermissions } from './datasources/userserver/permission';
|
||||||
|
import { CargoBike } from './model/CargoBike';
|
||||||
|
import { BikeEvent } from './model/BikeEvent';
|
||||||
|
import { ContactInformation } from './model/ContactInformation';
|
||||||
|
import { Equipment } from './model/Equipment';
|
||||||
|
import { LendingStation } from './model/LendingStation';
|
||||||
|
import { TimeFrame } from './model/TimeFrame';
|
||||||
|
import { Participant } from './model/Participant';
|
||||||
|
import { Organisation } from './model/Organisation';
|
||||||
|
import { Provider } from './model/Provider';
|
||||||
|
import { Engagement } from './model/Engagement';
|
||||||
|
import { Workshop } from './model/Workshop';
|
||||||
|
import { LendingStationAPI } from './datasources/db/lendingstationAPI';
|
||||||
|
import lendingStationResolvers from './resolvers/lendingStationResolvers';
|
||||||
|
import { ParticipantAPI } from './datasources/db/participantAPI';
|
||||||
|
import participantResolvers from './resolvers/participantResolvers';
|
||||||
|
import { ContactInformationAPI } from './datasources/db/contactinformationAPI';
|
||||||
|
import providerResolvers from './resolvers/providerResolvers';
|
||||||
|
import { ProviderAPI } from './datasources/db/providerAPI';
|
||||||
|
import contactInformationResolvers from './resolvers/contactInformationResolvers';
|
||||||
|
import { Person } from './model/Person';
|
||||||
|
import { WorkshopType } from './model/WorkshopType';
|
||||||
|
import { EngagementType } from './model/EngagementType';
|
||||||
|
import { EquipmentType } from './model/EquipmentType';
|
||||||
|
import { BikeEventType } from './model/BikeEventType';
|
||||||
|
import { WorkshopAPI } from './datasources/db/workshopAPI';
|
||||||
|
import workshopResolvers from './resolvers/workshopResolvers';
|
||||||
|
import { ActionLog } from './model/ActionLog';
|
||||||
|
import actionLogResolvers from './resolvers/actionLogResolvers';
|
||||||
|
import { ActionLogAPI } from './datasources/db/actionLogAPI';
|
||||||
|
import bodyParser from 'body-parser';
|
||||||
|
const cors = require('cors');
|
||||||
|
require('dotenv').config();
|
||||||
|
|
||||||
|
export const userAPI = new UserServerAPI(process.env.RPC_HOST);
|
||||||
|
|
||||||
|
export function getConnectionOptions (): ConnectionOptions {
|
||||||
|
return {
|
||||||
|
// @ts-ignore
|
||||||
|
type: process.env.DATABASE_TYPE,
|
||||||
|
url: process.env.DATABASE_URL,
|
||||||
|
database: process.env.DATABASE_NAME,
|
||||||
|
entities: [
|
||||||
|
CargoBike,
|
||||||
|
BikeEvent,
|
||||||
|
BikeEventType,
|
||||||
|
ContactInformation,
|
||||||
|
Equipment,
|
||||||
|
EquipmentType,
|
||||||
|
LendingStation,
|
||||||
|
TimeFrame,
|
||||||
|
Organisation,
|
||||||
|
Participant,
|
||||||
|
Provider,
|
||||||
|
Engagement,
|
||||||
|
EngagementType,
|
||||||
|
Workshop,
|
||||||
|
Person,
|
||||||
|
WorkshopType,
|
||||||
|
ActionLog
|
||||||
|
],
|
||||||
|
synchronize: true,
|
||||||
|
logging: false
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function getApp (connOptions: ConnectionOptions) {
|
||||||
|
/**
|
||||||
|
* Function that is called to authenticate a user by using the user rpc server
|
||||||
|
* @param req
|
||||||
|
* @param res
|
||||||
|
* @param next
|
||||||
|
*/
|
||||||
|
async function authenticate (req: any, res: any, next: any) {
|
||||||
|
if (req.body.operationName === 'IntrospectionQuery') {
|
||||||
|
next();
|
||||||
|
} else if (process.env.NODE_ENV === 'develop') {
|
||||||
|
req.permissions = requiredPermissions.map((e) => e.name);
|
||||||
|
req.userId = await userAPI.getUserId(req.headers.authorization?.replace('Bearer ', ''));
|
||||||
|
next();
|
||||||
|
} else {
|
||||||
|
const token = req.headers.authorization?.replace('Bearer ', '');
|
||||||
|
if (token) {
|
||||||
|
if (await userAPI.validateToken(token)) {
|
||||||
|
req.permissions = await userAPI.getUserPermissions(token);
|
||||||
|
req.userId = await userAPI.getUserId(req.headers.authorization?.replace('Bearer ', ''));
|
||||||
|
next();
|
||||||
|
} else {
|
||||||
|
res.status(401);
|
||||||
|
res.send('Unauthorized');
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
res.status(401);
|
||||||
|
res.send('Unauthorized');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
await createConnection(connOptions);
|
||||||
|
} catch (err) {
|
||||||
|
console.error(err);
|
||||||
|
}
|
||||||
|
|
||||||
|
const server = new ApolloServer({
|
||||||
|
resolvers: [
|
||||||
|
bikeResolver,
|
||||||
|
lendingStationResolvers,
|
||||||
|
participantResolvers,
|
||||||
|
providerResolvers,
|
||||||
|
contactInformationResolvers,
|
||||||
|
workshopResolvers,
|
||||||
|
actionLogResolvers
|
||||||
|
],
|
||||||
|
typeDefs,
|
||||||
|
dataSources: () => ({
|
||||||
|
cargoBikeAPI: new CargoBikeAPI(),
|
||||||
|
lendingStationAPI: new LendingStationAPI(),
|
||||||
|
participantAPI: new ParticipantAPI(),
|
||||||
|
contactInformationAPI: new ContactInformationAPI(),
|
||||||
|
providerAPI: new ProviderAPI(),
|
||||||
|
workshopAPI: new WorkshopAPI(),
|
||||||
|
actionLogAPI: new ActionLogAPI(),
|
||||||
|
userAPI
|
||||||
|
}),
|
||||||
|
context: (req: any) => {
|
||||||
|
return req;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
const app = express();
|
||||||
|
app.use(cors());
|
||||||
|
app.use(bodyParser.json());
|
||||||
|
app.post('/graphql', authenticate);
|
||||||
|
app.get(/\/graphql?&.*query=/, authenticate);
|
||||||
|
|
||||||
|
server.applyMiddleware({ app });
|
||||||
|
|
||||||
|
return app;
|
||||||
|
}
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
import { ApolloError } from 'apollo-server-express';
|
||||||
|
|
||||||
|
export class PermissionError extends ApolloError {
|
||||||
|
constructor () {
|
||||||
|
super('Insufficient permissions.', 'INSUFFICIENT_PERMISSION');
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,70 @@
|
|||||||
|
function gql (strings: TemplateStringsArray) {
|
||||||
|
}
|
||||||
|
|
||||||
|
export const CREATE_CARGO_BIKE = gql`
|
||||||
|
mutation {
|
||||||
|
createCargoBike(
|
||||||
|
cargoBike: {
|
||||||
|
group: KL
|
||||||
|
name: "Test"
|
||||||
|
modelName: "cool"
|
||||||
|
numberOfWheels: 1
|
||||||
|
forCargo: true
|
||||||
|
forChildren: false
|
||||||
|
numberOfChildren: 2
|
||||||
|
technicalEquipment: {
|
||||||
|
bicycleShift: "shift"
|
||||||
|
isEBike: false
|
||||||
|
hasLightSystem:false
|
||||||
|
}
|
||||||
|
dimensionsAndLoad: {
|
||||||
|
hasCoverBox: true
|
||||||
|
lockable:false
|
||||||
|
boxLength: 0.1
|
||||||
|
boxWidth: 0.2
|
||||||
|
boxHeight:0.3
|
||||||
|
maxWeightBox: 1.1
|
||||||
|
maxWeightLuggageRack: 1.2
|
||||||
|
maxWeightTotal: 1.3
|
||||||
|
bikeLength:2.1
|
||||||
|
}
|
||||||
|
security: {frameNumber: "bla"}
|
||||||
|
insuranceData: {name:"in"
|
||||||
|
benefactor: "ben"
|
||||||
|
billing: "bill"
|
||||||
|
noPnP: "noP"
|
||||||
|
|
||||||
|
maintenanceResponsible: "someone"
|
||||||
|
maintenanceBenefactor: "mben"
|
||||||
|
hasFixedRate: true}
|
||||||
|
taxes: {costCenter:"cost"}
|
||||||
|
}
|
||||||
|
) {
|
||||||
|
id
|
||||||
|
insuranceData{
|
||||||
|
maintenanceResponsible
|
||||||
|
}
|
||||||
|
equipmentType {
|
||||||
|
id
|
||||||
|
name
|
||||||
|
}
|
||||||
|
provider {
|
||||||
|
id
|
||||||
|
organisation{
|
||||||
|
id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
lendingStation {
|
||||||
|
id
|
||||||
|
name
|
||||||
|
cargoBikes {
|
||||||
|
id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}`;
|
||||||
|
export const GET_CARGO_BIKE = gql`{
|
||||||
|
cargoBikes(offset: 0, limit: 1) {
|
||||||
|
id
|
||||||
|
}
|
||||||
|
}`;
|
||||||
@ -0,0 +1,65 @@
|
|||||||
|
/* eslint no-unused-expressions: 0 */
|
||||||
|
import * as chai from 'chai';
|
||||||
|
import { expect } from 'chai';
|
||||||
|
import { describe, it, before, after } from 'mocha';
|
||||||
|
import { step } from 'mocha-steps';
|
||||||
|
|
||||||
|
import chaiHttp from 'chai-http';
|
||||||
|
// @ts-ignore
|
||||||
|
import * as queries from './testQueries';
|
||||||
|
import { getApp, getConnectionOptions } from '../src/app';
|
||||||
|
import { getConnection } from 'typeorm';
|
||||||
|
|
||||||
|
chai.use(chaiHttp);
|
||||||
|
const chaiLib = <any>chai;
|
||||||
|
const request = chaiLib.default.request;
|
||||||
|
// @ts-ignore
|
||||||
|
chai.request = request;
|
||||||
|
|
||||||
|
process.env.NODE_ENV = 'develop';
|
||||||
|
|
||||||
|
function getAppServer () {
|
||||||
|
return getApp(getConnectionOptions());
|
||||||
|
}
|
||||||
|
|
||||||
|
describe('cargo bike resolver', () => {
|
||||||
|
let agent: any = null;
|
||||||
|
|
||||||
|
before(async () => {
|
||||||
|
const app = await getAppServer();
|
||||||
|
const connection = getConnection();
|
||||||
|
await connection.dropDatabase();
|
||||||
|
await connection.synchronize();
|
||||||
|
agent = chai.request.agent(app).post('/graphql').type('json');
|
||||||
|
});
|
||||||
|
|
||||||
|
step('creates cargo bikes', (done) => {
|
||||||
|
agent.send({
|
||||||
|
query: queries.CREATE_CARGO_BIKE
|
||||||
|
}).end((err: any, res: any) => {
|
||||||
|
debugger;
|
||||||
|
expect(err).to.be.null;
|
||||||
|
expect(res).to.have.status(200);
|
||||||
|
expect(res).to.be.json;
|
||||||
|
expect(res.body.errors).to.be.undefined;
|
||||||
|
|
||||||
|
done();
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
step('returns cargo bike data', (done) => {
|
||||||
|
agent.send({
|
||||||
|
query: queries.GET_CARGO_BIKE
|
||||||
|
}).end((err: any, res: any) => {
|
||||||
|
expect(err).to.be.null;
|
||||||
|
expect(res).to.have.status(200);
|
||||||
|
expect(res).to.be.json;
|
||||||
|
expect(res.body.errors).to.be.undefined;
|
||||||
|
expect(res.body.data.cargoBikes).not.to.be.empty;
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
after(async () => {
|
||||||
|
await getConnection().dropDatabase();
|
||||||
|
});
|
||||||
|
});
|
||||||
Loading…
Reference in New Issue