Implement fetching person's sisu roles from importer

docker-compose.yml

@@ -6,6 +6,8 @@ services:
       context: ./
       dockerfile: dev.Dockerfile
     image: jami_dev
+    env_file:
+      - .env
     environment:
       - DATABASE_URL=postgres://postgres:postgres@db:5432/postgres
       - PORT=3000

package.json

@@ -42,6 +42,7 @@
   "dependencies": {
     "@sentry/node": "^7.27.0",
     "@sentry/tracing": "^7.27.0",
+    "axios": "^1.6.8",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
     "morgan": "^1.10.0",

src/auth/sisuRoles.ts

@@ -0,0 +1,48 @@
+import getImporterClient from '../util/importerClient'
+
+const importerClient = getImporterClient()
+
+const sisuRolesGivingFullAccess = [
+  'hy-ac-kosu1',
+  'hy-ac-kosu2',
+  'hy-ac-kosu3',
+  'hy-ac-opne1',
+  'hy-ac-opne2',
+  'hy-ac-opne3',
+  'hy-ac-sview',
+]
+
+type UserCacheEntry = {
+  hasAccess: boolean
+  accessedAt: Date
+}
+
+const userCache = new Map<string, UserCacheEntry>()
+
+export const hasFullSisuAccess = async (personId: string) => {
+  if (!importerClient) return false
+
+  if (userCache.has(personId)) {
+    const { hasAccess, accessedAt } = userCache.get(personId)
+
+    // Cache is valid for 24 hours
+    if (new Date().getTime() - accessedAt.getTime() < 24 * 60 * 60 * 1000) {
+      return hasAccess
+    }
+  }
+
+  const { data } = await importerClient.get(`/jami/sisuroles/${personId}`)
+
+  if (data && Array.isArray(data)) {
+    const hasFullAccessToSisu = data.some((role) =>
+      sisuRolesGivingFullAccess.includes(role.accessroleId),
+    )
+    userCache.set(personId, {
+      hasAccess: hasFullAccessToSisu,
+      accessedAt: new Date(),
+    })
+    return hasFullAccessToSisu
+  }
+
+  return false
+}

src/index.ts

@@ -14,6 +14,7 @@ import {
   iamToFaculty,
 } from './auth/IAMConfig'
 import getIAMRights from './auth/IAMRights'
+import { hasFullSisuAccess } from './auth/sisuRoles'
 import { FACULTIES } from './organisation/faculties'
 
 import { connectToDatabase } from './db/connection'
@@ -33,15 +34,19 @@ app.use(accessLogger)
 
 app.get('/ping', (_req, res) => res.send('pong'))
 
-app.post('/', (req, res) => {
-  const { userId, iamGroups = [] } = req.body
+app.post('/', async (req, res) => {
+  const { userId, iamGroups = [], getSisuAccess = false } = req.body
 
   const relevantIamGroups = iamGroups.filter((iam) =>
     relevantIAMs.includes(iam),
   )
 
   const { access, specialGroup } = getIAMRights(relevantIamGroups)
 
+  if (getSisuAccess) {
+    specialGroup.fullSisuAccess = await hasFullSisuAccess(userId)
+  }
+
   if (userId && iamGroups) User.upsert({ id: userId, iamGroups })
 
   logger.info('IAM authentication', { userId, iamGroups, access })

src/util/config.ts

@@ -1,10 +1,13 @@
 import dotenv from 'dotenv'
 dotenv.config()
 
-const PORT = process.env.PORT
+export const PORT = process.env.PORT
 
-const inProduction = process.env.NODE_ENV === 'production'
+export const inProduction = process.env.NODE_ENV === 'production'
 
-const DATABASE_URL = process.env.DATABASE_URL
+export const DATABASE_URL = process.env.DATABASE_URL
 
-export { DATABASE_URL, PORT, inProduction }
+export const importerUrl =
+  'https://api-toska.apps.ocp-prod-0.k8s.it.helsinki.fi/importer'
+
+export const importerToken = process.env.IMPORTER_DB_API_TOKEN || ''

src/util/importerClient.ts

@@ -0,0 +1,20 @@
+import axios from 'axios'
+import { importerUrl, importerToken } from './config'
+import logger from './logger'
+
+const importerClient = axios.create({
+  headers: {
+    token: importerToken,
+  },
+  baseURL: importerUrl,
+})
+
+const getImporterClient = () => {
+  if (!importerToken) {
+    logger.error("Importer token not set, can't return client!")
+    return null
+  }
+  return importerClient
+}
+
+export default getImporterClient