Skip to content

Commit 68ff9a8

Browse files
Vishwas1Vishwas1
authored
Merge pull request #102 from hypersign-protocol/implemented/permission-policy
storing user access list based on default and user permission
2 parents c9df95b + 6c8cb58 commit 68ff9a8

File tree

11 files changed

+261
-131
lines changed

11 files changed

+261
-131
lines changed

‎src/app-auth/dtos/create-app.dto.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import {
1919
SERVICE_TYPES,
2020
APP_ENVIRONMENT,
2121
} from 'src/supported-service/services/iServiceList';
22+
import { IsUrlOrBase64Image } from 'src/utils/customDecorator/IsUrlOrBase64Image.decorator';
2223

2324
export class CreateAppDto {
2425
@ApiProperty({
@@ -60,7 +61,7 @@ export class CreateAppDto {
6061
})
6162
@IsOptional()
6263
@IsString()
63-
@IsUrlEmpty()
64+
@IsUrlOrBase64Image()
6465
logoUrl?: string;
6566
@ApiProperty({
6667
description: 'services',

‎src/app-auth/services/app-auth.service.ts‎

Lines changed: 47 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ import { WebPageConfigRepository } from 'src/webpage-config/repositories/webpage
3434
import { InjectModel } from '@nestjs/mongoose';
3535
import { CustomerOnboarding } from 'src/customer-onboarding/schemas/customer-onboarding.schema';
3636
import { Model } from 'mongoose';
37-
import { getAccessListForModule } from 'src/utils/utils';
37+
import { evaluateAccessPolicy, getAccessListForModule } from 'src/utils/utils';
3838
import { TokenModule } from 'src/config/access-matrix';
3939
import { redisClient } from 'src/utils/redis.provider';
4040
import {
@@ -68,7 +68,7 @@ export class AppAuthService {
6868
@InjectModel(CustomerOnboarding.name)
6969
private readonly onboardModel: Model<CustomerOnboarding>,
7070
private readonly webpageConfigRepo: WebPageConfigRepository,
71-
) { }
71+
) {}
7272

7373
async createAnApp(
7474
createAppDto: CreateAppDto,
@@ -752,10 +752,15 @@ export class AppAuthService {
752752
switch (serviceType) {
753753
case SERVICE_TYPES.SSI_API: {
754754
grant_type = GRANT_TYPES.access_service_ssi;
755-
accessList = getAccessListForModule(
755+
const defaultAccessList = getAccessListForModule(
756756
TokenModule.APP_AUTH,
757757
SERVICE_TYPES.SSI_API,
758758
);
759+
accessList = evaluateAccessPolicy(
760+
defaultAccessList,
761+
SERVICE_TYPES.SSI_API,
762+
[],
763+
);
759764
break;
760765
}
761766
case SERVICE_TYPES.CAVACH_API: {
@@ -769,18 +774,28 @@ export class AppAuthService {
769774
]);
770775
}
771776
grant_type = grantType || GRANT_TYPES.access_service_kyc;
772-
accessList = getAccessListForModule(
777+
const defaultAccessList = getAccessListForModule(
773778
TokenModule.APP_AUTH,
774779
SERVICE_TYPES.CAVACH_API,
775780
);
781+
accessList = evaluateAccessPolicy(
782+
defaultAccessList,
783+
SERVICE_TYPES.CAVACH_API,
784+
[],
785+
);
776786
break;
777787
}
778788
case SERVICE_TYPES.QUEST: {
779789
grant_type = GRANT_TYPES.access_service_quest;
780-
accessList = getAccessListForModule(
790+
const defaultAccessList = getAccessListForModule(
781791
TokenModule.APP_AUTH,
782792
SERVICE_TYPES.QUEST,
783793
);
794+
accessList = evaluateAccessPolicy(
795+
defaultAccessList,
796+
SERVICE_TYPES.QUEST,
797+
[],
798+
);
784799
break;
785800
}
786801
default: {
@@ -865,8 +880,13 @@ export class AppAuthService {
865880
grantType: string,
866881
appId: string,
867882
user,
883+
session?,
868884
): Promise<{ access_token; expiresIn; tokenType }> {
869-
const sessionId = `${appId}_${Context.idDashboard}`;
885+
const context = Context.idDashboard;
886+
let sessionId = `${appId}_${context}_${session.userId}`;
887+
if (session && session.tenantId) {
888+
sessionId = `${sessionId}_tenant`;
889+
}
870890
const savedSession = await redisClient.get(sessionId);
871891
switch (grantType) {
872892
case GRANT_TYPES.access_service_ssi:
@@ -924,10 +944,16 @@ export class AppAuthService {
924944
'Invalid grant type for this service ' + appId,
925945
]);
926946
}
927-
accessList = getAccessListForModule(
947+
const defaultAccessList = getAccessListForModule(
928948
TokenModule.DASHBOARD,
929949
SERVICE_TYPES.SSI_API,
930950
);
951+
accessList = evaluateAccessPolicy(
952+
defaultAccessList,
953+
SERVICE_TYPES.SSI_API,
954+
user.accessList,
955+
context,
956+
);
931957
break;
932958
}
933959
case SERVICE_TYPES.CAVACH_API: {
@@ -939,10 +965,16 @@ export class AppAuthService {
939965
'Invalid grant type for this service ' + appId,
940966
]);
941967
}
942-
accessList = getAccessListForModule(
968+
const defaultAccessList = getAccessListForModule(
943969
TokenModule.DASHBOARD,
944970
SERVICE_TYPES.CAVACH_API,
945971
);
972+
accessList = evaluateAccessPolicy(
973+
defaultAccessList,
974+
SERVICE_TYPES.CAVACH_API,
975+
user.accessList,
976+
context,
977+
);
946978
break;
947979
}
948980
case SERVICE_TYPES.QUEST: {
@@ -951,10 +983,16 @@ export class AppAuthService {
951983
'Invalid grant type for this service ' + appId,
952984
]);
953985
}
954-
accessList = getAccessListForModule(
986+
const defaultAccessList = getAccessListForModule(
955987
TokenModule.DASHBOARD,
956988
SERVICE_TYPES.QUEST,
957989
);
990+
accessList = evaluateAccessPolicy(
991+
defaultAccessList,
992+
SERVICE_TYPES.QUEST,
993+
user.accessList,
994+
context,
995+
);
958996
break;
959997
}
960998
default: {

‎src/app-oauth/app-oauth.controller.ts‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,15 @@ export class AppOauthController {
134134
@Req() request,
135135
): Promise<{ access_token; expiresIn; tokenType }> {
136136
const { user } = request;
137+
const { session } = request;
137138
//
138139
Logger.log('reGenerateAppSecretKey() method: starts', 'AppOAuthController');
139140

140-
return this.appAuthService.grantPermission(grantType, serviceId, user);
141+
return this.appAuthService.grantPermission(
142+
grantType,
143+
serviceId,
144+
user,
145+
session,
146+
);
141147
}
142148
}

‎src/config/access-matrix.ts‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ export enum TokenModule {
33
DASHBOARD = 'DASHBOARD',
44
VERIFIER = 'VERIFIER',
55
APP_AUTH = 'APP_AUTH',
6+
SUPER_ADMIN = 'SUPER_ADMIN',
7+
ID_SERVICE = 'ID_SERVICE',
68
}
79
export const KYC_ACCESS_MATRIX = {
810
[TokenModule.DASHBOARD]: [
@@ -38,12 +40,33 @@ export const KYC_ACCESS_MATRIX = {
3840
SERVICES.CAVACH_API.ACCESS_TYPES.READ_WIDGET_CONFIG,
3941
SERVICES.CAVACH_API.ACCESS_TYPES.READ_USER_CONSENT,
4042
],
43+
[TokenModule.SUPER_ADMIN]: [SERVICES.SSI_API.ACCESS_TYPES.WRITE_CREDIT],
4144
};
4245
export const SSI_ACCESS_MATRIX = {
43-
// will modify its access later. Assigning ALL for the time being
44-
[TokenModule.DASHBOARD]: [SERVICES.SSI_API.ACCESS_TYPES.ALL],
45-
[TokenModule.VERIFIER]: [SERVICES.SSI_API.ACCESS_TYPES.ALL],
46-
[TokenModule.APP_AUTH]: [SERVICES.SSI_API.ACCESS_TYPES.ALL],
46+
[TokenModule.DASHBOARD]: [
47+
SERVICES.SSI_API.ACCESS_TYPES.READ_DID,
48+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_DID,
49+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_CREDIT,
50+
SERVICES.SSI_API.ACCESS_TYPES.READ_CREDIT,
51+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_SCHEMA,
52+
SERVICES.SSI_API.ACCESS_TYPES.READ_SCHEMA,
53+
SERVICES.SSI_API.ACCESS_TYPES.CHECK_LIVE_STATUS,
54+
SERVICES.SSI_API.ACCESS_TYPES.READ_TX,
55+
SERVICES.SSI_API.ACCESS_TYPES.READ_CREDENTIAL,
56+
SERVICES.SSI_API.ACCESS_TYPES.VERIFY_CREDENTIAL,
57+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_CREDENTIAL,
58+
SERVICES.SSI_API.ACCESS_TYPES.READ_USAGE,
59+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_PRESENTATION,
60+
SERVICES.SSI_API.ACCESS_TYPES.VERIFY_PRESENTATION,
61+
],
62+
[TokenModule.VERIFIER]: [SERVICES.SSI_API.ACCESS_TYPES.READ_DID],
63+
[TokenModule.APP_AUTH]: [],
64+
[TokenModule.ID_SERVICE]: [
65+
SERVICES.SSI_API.ACCESS_TYPES.READ_TX,
66+
SERVICES.SSI_API.ACCESS_TYPES.WRITE_CREDENTIAL,
67+
SERVICES.SSI_API.ACCESS_TYPES.VERIFY_PRESENTATION,
68+
],
69+
[TokenModule.SUPER_ADMIN]: [SERVICES.SSI_API.ACCESS_TYPES.WRITE_CREDIT],
4770
};
4871
export const QUEST_ACCESS_MATRIX = {
4972
[TokenModule.DASHBOARD]: [],

‎src/customer-onboarding/constants/enum.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ export enum OnboardingStep {
133133
CREATE_DID = 'CREATE_DID',
134134
REGISTER_DID = 'REGISTER_DID',
135135
CREATE_KYC_SERVICE = 'CREATE_KYC_SERVICE',
136-
GIVE_KYC_DASHBOARD_ACCESS = 'GIVE_KYC_DASHBOARD_ACCESS',
136+
GIVE_DASHBOARD_ACCESS = 'GIVE_DASHBOARD_ACCESS',
137137
CREDIT_KYC_SERVICE = 'CREDIT_KYC_SERVICE',
138138
SETUP_KYC_WIDGET = 'SETUP_KYC_WIDGET',
139139
CONFIGURE_KYC_VERIFIER_PAGE = 'CONFIGURE_KYC_VERIFIER_PAGE',

0 commit comments

Comments
 (0)