feat!: country configurable user scopes & roles

packages/auth/package.json

@@ -84,7 +84,8 @@
       "<rootDir>"
     ],
     "moduleNameMapper": {
-      "@auth/(.*)": "<rootDir>/src/$1"
+      "@auth/(.*)": "<rootDir>/src/$1",
+      "@opencrvs/commons/(.*)": "@opencrvs/commons/build/dist/$1"
     },
     "testRegex": "(/__tests__/.*|(\\.|/)(test|spec))\\.tsx?$",
     "setupFiles": [

packages/auth/src/features/authenticate/handler.ts

@@ -8,21 +8,23 @@
  *
  * Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
  */
-import * as Hapi from '@hapi/hapi'
-import * as Joi from 'joi'
+import { JWT_ISSUER, WEB_USER_JWT_AUDIENCES } from '@auth/constants'
 import {
+  IAuthentication,
   authenticate,
-  storeUserInformation,
   createToken,
   generateAndSendVerificationCode,
-  IAuthentication
+  storeUserInformation
 } from '@auth/features/authenticate/service'
 import {
   NotificationEvent,
   generateNonce
 } from '@auth/features/verifyCode/service'
-import { unauthorized, forbidden } from '@hapi/boom'
-import { WEB_USER_JWT_AUDIENCES, JWT_ISSUER } from '@auth/constants'
+import { forbidden, unauthorized } from '@hapi/boom'
+import * as Hapi from '@hapi/hapi'
+import { CoreUserRole } from '@opencrvs/commons/authentication'
+import * as Joi from 'joi'
+import { getUserRoleScopeMapping } from '@auth/features/scopes/service'
 
 interface IAuthPayload {
   username: string
@@ -34,6 +36,7 @@ interface IAuthResponse {
   mobile?: string
   email?: string
   status: string
+  systemRole: CoreUserRole
   token?: string
 }
 
@@ -43,6 +46,7 @@ export default async function authenticateHandler(
 ): Promise<IAuthResponse> {
   const payload = request.payload as IAuthPayload
   let result: IAuthentication
+
   const { username, password } = payload
   try {
     result = await authenticate(username.trim(), password)
@@ -58,15 +62,28 @@ export default async function authenticateHandler(
     mobile: result.mobile,
     email: result.email,
     status: result.status,
+    systemRole: result.systemRole,
     nonce
   }
 
   const isPendingUser = response.status && response.status === 'pending'
 
+  const roleScopeMappings = await getUserRoleScopeMapping()
+
+  let scopes = []
+
+  const role = result.role as keyof typeof roleScopeMappings
+
+  if (roleScopeMappings[role]) {
+    scopes = roleScopeMappings[role]
+  } else {
+    scopes = roleScopeMappings[response.systemRole]
+  }
+
   if (isPendingUser) {
     response.token = await createToken(
       result.userId,
-      result.scope,
+      scopes,
       WEB_USER_JWT_AUDIENCES,
       JWT_ISSUER
     )
@@ -75,7 +92,7 @@ export default async function authenticateHandler(
       nonce,
       result.name,
       result.userId,
-      result.scope,
+      scopes,
       result.mobile,
       result.email
     )
@@ -84,13 +101,14 @@ export default async function authenticateHandler(
 
     await generateAndSendVerificationCode(
       nonce,
-      result.scope,
+      scopes,
       notificationEvent,
       result.name,
       result.mobile,
       result.email
     )
   }
+
   return response
 }
 
@@ -104,5 +122,7 @@ export const responseSchema = Joi.object({
   mobile: Joi.string().optional(),
   email: Joi.string().optional(),
   status: Joi.string(),
+  role: Joi.string(),
+  systemRole: Joi.string(),
   token: Joi.string().optional()
 })

packages/auth/src/features/authenticate/service.ts

@@ -32,9 +32,12 @@ import {
   storeVerificationCode
 } from '@auth/features/verifyCode/service'
 import { logger } from '@opencrvs/commons'
+import { CoreUserRole } from '@opencrvs/commons/authentication'
 import { unauthorized } from '@hapi/boom'
-import { chainW, tryCatch } from 'fp-ts/Either'
-import { pipe } from 'fp-ts/function'
+
+import * as F from 'fp-ts'
+const { chainW, tryCatch } = F.either
+const { pipe } = F.function
 
 const cert = readFileSync(CERT_PRIVATE_KEY_PATH)
 const publicCert = readFileSync(CERT_PUBLIC_KEY_PATH)
@@ -55,8 +58,9 @@ export interface IAuthentication {
   mobile?: string
   userId: string
   status: string
-  scope: string[]
   email?: string
+  systemRole: CoreUserRole
+  role: string
 }
 
 export interface ISystemAuthentication {
@@ -86,11 +90,14 @@ export async function authenticate(
   if (res.status !== 200) {
     throw Error(res.statusText)
   }
+
   const body = await res.json()
+
   return {
     name: body.name,
     userId: body.id,
-    scope: body.scope,
+    role: body.role,
+    systemRole: body.systemRole,
     status: body.status,
     mobile: body.mobile,
     email: body.email
@@ -174,12 +181,7 @@ export async function generateAndSendVerificationCode(
   email?: string
 ) {
   const isDemoUser = scope.indexOf('demo') > -1 || QA_ENV
-  logger.info(
-    `isDemoUser,
-      ${JSON.stringify({
-        isDemoUser: isDemoUser
-      })}`
-  )
+  logger.info(`Is demo user: ${isDemoUser}. Scopes: ${scope.join(', ')}`)
   let verificationCode
   if (isDemoUser) {
     verificationCode = '000000'

packages/auth/src/features/authenticateSuperUser/handler.ts

@@ -17,6 +17,8 @@ import {
 } from '@auth/features/authenticate/service'
 import { unauthorized } from '@hapi/boom'
 import { WEB_USER_JWT_AUDIENCES, JWT_ISSUER } from '@auth/constants'
+import { DEFAULT_ROLE_SCOPES } from '@opencrvs/commons/authentication'
+import { logger } from '@opencrvs/commons'
 
 interface IAuthPayload {
   username: string
@@ -36,9 +38,16 @@ export default async function authenticateSuperUserHandler(
     throw unauthorized()
   }
 
+  if (result.status === 'deactivated') {
+    logger.info('Login attempt with a deactivated super user account detected')
+    throw unauthorized()
+  }
+
+  const scope = DEFAULT_ROLE_SCOPES.SUPER_ADMIN
+
   const token = await createToken(
     result.userId,
-    result.scope,
+    scope,
     WEB_USER_JWT_AUDIENCES,
     JWT_ISSUER
   )

packages/auth/src/features/scopes/service.ts

@@ -0,0 +1,47 @@
+import { COUNTRY_CONFIG_URL } from '@auth/constants'
+import { fetchJSON, joinURL, logger } from '@opencrvs/commons'
+import {
+  DEFAULT_CORE_ROLE_SCOPES,
+  Scope,
+  CoreUserRole
+} from '@opencrvs/commons/authentication'
+
+type NewRolesResponseFormat = Array<{
+  id: string
+  systemRole: CoreUserRole
+  labels: Array<{ language: string; label: string }>
+  scopes: Scope[]
+}>
+
+function isOpenCRVS1_7FormatWithScopes(
+  response: Record<string, any> | NewRolesResponseFormat
+): response is NewRolesResponseFormat {
+  return Array.isArray(response)
+}
+
+export async function getUserRoleScopeMapping() {
+  const scopes = await fetchJSON<
+    NewRolesResponseFormat | typeof DEFAULT_CORE_ROLE_SCOPES
+  >(joinURL(COUNTRY_CONFIG_URL, '/roles'))
+
+  if (!isOpenCRVS1_7FormatWithScopes(scopes)) {
+    logger.error('Country config implements the old /roles response format')
+    throw new Error('Old /roles response format. Check logs for more info')
+  }
+  logger.info(
+    'Country config implements the new /roles response format. Custom scopes apply'
+  )
+
+  const userRoleMappings = scopes.reduce<Record<string, Scope[]>>(
+    (acc, { id, scopes }) => {
+      acc[id] = scopes
+      return acc
+    },
+    {}
+  )
+
+  return {
+    ...DEFAULT_CORE_ROLE_SCOPES,
+    ...userRoleMappings
+  }
+}

packages/auth/src/server.ts

@@ -72,6 +72,7 @@ import { getPublicKey } from '@auth/features/authenticate/service'
 import anonymousTokenHandler, {
   responseSchema
 } from './features/anonymousToken/handler'
+import { Boom, badRequest } from '@hapi/boom'
 
 export async function createServer() {
   let whitelist: string[] = [HOSTNAME]
@@ -84,7 +85,22 @@ export async function createServer() {
     port: AUTH_PORT,
     routes: {
       cors: { origin: whitelist },
-      payload: { maxBytes: 52428800, timeout: DEFAULT_TIMEOUT }
+      payload: { maxBytes: 52428800, timeout: DEFAULT_TIMEOUT },
+      response: {
+        failAction: async (req, _2, err: Boom) => {
+          if (process.env.NODE_ENV === 'production') {
+            // In prod, log a limited error message and throw the default Bad Request error.
+            logger.error(`Response validationError: ${err.message}`)
+            throw badRequest(`Invalid response payload returned from handler`)
+          } else {
+            // During development, log and respond with the full error.
+            logger.error(
+              `${req.path} response has a validation error: ${err.message}`
+            )
+            throw err
+          }
+        }
+      }
     }
   })
 

packages/auth/tsconfig.json

@@ -2,45 +2,31 @@
   "compilerOptions": {
     "baseUrl": "./src",
     "paths": {
-      "@auth/*": [
-        "./*"
-      ]
+      "@auth/*": ["./*"]
     },
     "target": "es6",
     "module": "commonjs",
     "allowSyntheticDefaultImports": true,
     "skipLibCheck": true,
     "outDir": "build/dist",
     "sourceMap": true,
-    "moduleResolution": "node",
+    "moduleResolution": "node16",
     "rootDir": ".",
-    "lib": [
-      "esnext.asynciterable",
-      "es6",
-      "es2017"
-    ],
+    "lib": ["esnext.asynciterable", "es6", "es2017"],
     "forceConsistentCasingInFileNames": true,
     "noImplicitReturns": true,
     "noImplicitThis": true,
     "noImplicitAny": true,
     "strictNullChecks": true,
-    "suppressImplicitAnyIndexErrors": true,
     "noUnusedLocals": true,
-    "types": [
-      "fhir",
-      "jest"
-    ]
+    "types": ["fhir", "jest"]
   },
-  "include": [
-    "resources/**/*.ts",
-    "src/**/*.ts",
-    "typings"
-  ],
+  "include": ["resources/**/*.ts", "src/**/*.ts", "typings"],
   "exclude": [
     "node_modules",
     "build",
     "scripts",
     "acceptance-tests",
     "src/setupTests.ts"
   ]
-}
+}