Service account checkpoint

backend/src/middleware/requireMembershipOrgAuth.ts

@@ -3,7 +3,7 @@ import { UnauthorizedRequestError } from '../utils/errors';
 import {
     MembershipOrg
 } from '../models';
-import { validateMembership } from '../helpers/membershipOrg';
+import { validateMembershipOrg } from '../helpers/membershipOrg';
 
 
 type req = 'params' | 'body' | 'query';
@@ -17,9 +17,11 @@ type req = 'params' | 'body' | 'query';
  */
 const requireMembershipOrgAuth = ({
     acceptedRoles,
+    acceptedStatuses,
     location = 'params'
 }: {
     acceptedRoles: string[];
+    acceptedStatuses: string[];
     location?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
@@ -29,14 +31,13 @@ const requireMembershipOrgAuth = ({
             
             if (!membershipOrg) throw new Error('Failed to find target organization membership');
             
-            const targetMembership = await validateMembership({
-                userId: req.user._id.toString(),
-                organizationId: membershipOrg.organization.toString(),
-                acceptedRoles
+            req.targetMembership = await validateMembershipOrg({
+                userId: req.user._id,
+                organizationId: membershipOrg.organization,
+                acceptedRoles,
+                acceptedStatuses
             });
             
-            req.targetMembership = targetMembership;
-            
             return next();
         } catch (err) {
             return next(UnauthorizedRequestError({

backend/src/middleware/requireOrganizationAuth.ts

@@ -1,6 +1,8 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { IOrganization, MembershipOrg } from '../models';
 import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
+import { validateMembershipOrg } from '../helpers/membershipOrg';
 
 type req = 'params' | 'body' | 'query';
 
@@ -9,7 +11,7 @@ type req = 'params' | 'body' | 'query';
  * on request params.
  * @param {Object} obj
  * @param {String[]} obj.acceptedRoles - accepted organization roles
- * @param {String[]} obj.acceptedStatuses - accepted organization statuses
+ * @param {String[]} obj.accepteStatuses - accepted organization statuses
  */
 const requireOrganizationAuth = ({
 	acceptedRoles,
@@ -21,30 +23,13 @@ const requireOrganizationAuth = ({
 	location?: req;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		// organization authorization middleware
-		
 		const { organizationId } = req[location];
-
-		// validate organization membership
-		const membershipOrg = await MembershipOrg.findOne({
-			user: req.user._id,
-			organization: organizationId
-		}).populate<{ organization: IOrganization }>('organization');
-
-
-		if (!membershipOrg) {
-			return next(UnauthorizedRequestError({message: "You're not a member of this Organization."}))
-		}
-		//TODO is this important to validate? I mean is it possible to save wrong role to database or get wrong role from databse? - Zamion101
-		if (!acceptedRoles.includes(membershipOrg.role)) {
-			return next(ValidationError({message: 'Failed to validate Organization Membership Role'}))
-		}
-
-		if (!acceptedStatuses.includes(membershipOrg.status)) {
-			return next(ValidationError({message: 'Failed to validate Organization Membership Status'}))
-		}
-
-		req.membershipOrg = membershipOrg;
+		req.membershipOrg = await validateMembershipOrg({
+			userId: req.user._id,
+			organizationId: new Types.ObjectId(organizationId),
+			acceptedRoles,
+			acceptedStatuses
+		});
 
 		return next();
 	};

backend/src/middleware/requireServiceAccountAuth.ts

@@ -1,9 +1,11 @@
 import { Request, Response, NextFunction } from 'express';
 import { ServiceAccount } from '../models';
 import {
-    AccountNotFoundError,
-    UnauthorizedRequestError
+    ServiceAccountNotFoundError
 } from '../utils/errors';
+import {
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
 
 type req = 'params' | 'body' | 'query';
 
@@ -20,14 +22,19 @@ const requireServiceAccountAuth = ({
         const serviceAccountId = req[location].serviceAccountId;
         const serviceAccount = await ServiceAccount.findById(serviceAccountId); 
         
-        // TODO: acceptedRoles and acceptedStatuses
-        
         if (!serviceAccount) {
-            return next(AccountNotFoundError({ message: 'Failed to locate Service Account' }));
+            return next(ServiceAccountNotFoundError({ message: 'Failed to locate Service Account' }));
         }
         
         if (serviceAccount.user.toString() !== req.user.id.toString()) {
-            return next(UnauthorizedRequestError({ message: 'Failed to authenticate the Service Account' }));
+            // case: creator of the service account is different from
+            // the user on the request -> apply middleware role/status validation
+            await validateMembershipOrg({
+                userId: req.user._id,
+                organizationId: serviceAccount.organization,
+                acceptedRoles,
+                acceptedStatuses
+            });
         }
         
         req.serviceAccount = serviceAccount;