feat: treat orgs user_type

Author: alexey-yarmosh

migrations/dashboard/create-tables.js.sql

@@ -102,7 +102,8 @@ CREATE TABLE IF NOT EXISTS gp_orgs (
 	github_id VARCHAR(255) NOT NULL,
 	adoption_token VARCHAR(255) NOT NULL,
 	extra_adoption_tokens LONGTEXT COLLATE utf8mb4_bin NOT NULL DEFAULT '[]' CHECK (json_valid(`extra_adoption_tokens`)),
-	public_probes BOOLEAN NOT NULL DEFAULT 0
+	public_probes BOOLEAN NOT NULL DEFAULT 0,
+	user_type VARCHAR(255) NOT NULL DEFAULT 'member'
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 CREATE TABLE IF NOT EXISTS gp_org_members (

src/lib/accounts.ts

@@ -3,11 +3,12 @@ import { dashboardClient } from './sql/client.js';
 
 export const ACCOUNTS_TABLE = 'gp_accounts';
 export const MEMBERS_TABLE = 'gp_org_members';
+const ORGS_TABLE = 'gp_orgs';
 const ACCOUNT_TTL = 60 * 60 * 1000;
 const ROLE_TTL = 60 * 1000;
 
 export type AccountRole = 'owner' | 'admin' | 'member' | 'viewer';
-export type ResolvedAccount = { id: string; role: AccountRole };
+export type ResolvedAccount = { id: string; role: AccountRole; userType: 'member' | 'sponsor' | 'special' };
 
 const accountIdsByUserId = new TTLCache<string, string>({ ttl: ACCOUNT_TTL });
 const rolesByUserAndAccount = new TTLCache<string, ResolvedAccount | null>({ ttl: ROLE_TTL });
@@ -29,7 +30,7 @@ export const getUserAccountId = async (userId: string): Promise<string | null> =
 };
 
 // The role of the user in the account: 'owner' for their own, their membership role for an org, null if they are not in it.
-export const getAccountRole = async (accountId: string, userId: string): Promise<ResolvedAccount | null> => {
+export const getOrgRole = async (accountId: string, userId: string): Promise<ResolvedAccount | null> => {
 	const key = `${userId}:${accountId}`;
 	const cached = rolesByUserAndAccount.get(key);
 
@@ -38,20 +39,15 @@ export const getAccountRole = async (accountId: string, userId: string): Promise
 	}
 
 	const account = await dashboardClient(ACCOUNTS_TABLE)
-		.leftJoin(MEMBERS_TABLE, function () {
+		.join(MEMBERS_TABLE, function () {
 			this.on(`${MEMBERS_TABLE}.org`, `${ACCOUNTS_TABLE}.org`)
 				.andOnVal(`${MEMBERS_TABLE}.user`, '=', userId);
 		})
+		.join(ORGS_TABLE, `${ORGS_TABLE}.id`, `${ACCOUNTS_TABLE}.org`)
 		.where(`${ACCOUNTS_TABLE}.id`, accountId)
-		.where(function () {
-			this.where(`${ACCOUNTS_TABLE}.user`, userId).orWhereNotNull(`${MEMBERS_TABLE}.id`);
-		})
-		.first<{ id: string; role: AccountRole } | undefined>(
-			`${ACCOUNTS_TABLE}.id`,
-			dashboardClient.raw(`IF(?? = ?, 'owner', ??) AS role`, [ `${ACCOUNTS_TABLE}.user`, userId, `${MEMBERS_TABLE}.role` ]),
-		);
+		.first<ResolvedAccount | undefined>(`${ACCOUNTS_TABLE}.id`, `${MEMBERS_TABLE}.role`, `${ORGS_TABLE}.user_type AS userType`);
 
-	const role = account ? { id: account.id, role: account.role } : null;
+	const role = account ? { id: account.id, role: account.role, userType: account.userType } : null;
 	rolesByUserAndAccount.set(key, role);
 
 	return role;

src/lib/http/auth.ts

@@ -8,6 +8,7 @@ import { ACCOUNTS_TABLE, MEMBERS_TABLE, type AccountRole } from '../accounts.js'
 
 export const GP_TOKENS_TABLE = 'gp_tokens';
 export const USERS_TABLE = 'directus_users';
+const ORGS_TABLE = 'gp_orgs';
 
 const logger = scopedLogger('auth');
 
@@ -97,6 +98,7 @@ export class Auth {
 				this.on(`${MEMBERS_TABLE}.org`, `${ACCOUNTS_TABLE}.org`)
 					.andOn(`${MEMBERS_TABLE}.user`, `${GP_TOKENS_TABLE}.user_created`);
 			})
+			.leftJoin(ORGS_TABLE, `${ORGS_TABLE}.id`, `${ACCOUNTS_TABLE}.org`)
 			.where(filter)
 			.select<Row[]>([
 				'user_created',
@@ -107,7 +109,7 @@ export class Auth {
 				'date_last_used',
 				'scopes',
 				'github_username as user_github_username',
-				'user_type as user_user_type',
+				this.sql.raw(`COALESCE(??, ??) AS user_user_type`, [ `${ORGS_TABLE}.user_type`, `${USERS_TABLE}.user_type` ]),
 				this.sql.raw(`IF(?? = ??, 'owner', ??) AS account_role`, [ `${ACCOUNTS_TABLE}.user`, `${GP_TOKENS_TABLE}.user_created`, `${MEMBERS_TABLE}.role` ]),
 			]);
 

src/lib/http/middleware/authenticate.ts

@@ -3,7 +3,7 @@ import { jwtVerify } from 'jose';
 import createHttpError from 'http-errors';
 import apmAgent from 'elastic-apm-node';
 
-import { type AccountRole, getAccountRole, getUserAccountId } from '../../accounts.js';
+import { type AccountRole, getOrgRole, getUserAccountId } from '../../accounts.js';
 import { auth } from '../auth.js';
 import type { ExtendedMiddleware } from '../../../types.js';
 
@@ -54,17 +54,17 @@ const resolveAccount = async (ctx: Parameters<ExtendedMiddleware>[0], payload: S
 		cookieUserId !== payload.id
 		|| !activeAccountId
 		|| activeAccountId === userAccountId) {
-		return { accountId: userAccountId, accountRole: 'owner' as AccountRole };
+		return { accountId: userAccountId, accountRole: 'owner' as const, userType: payload.user_type ?? 'member' };
 	}
 
 	// activeAccountId is a cookie set by dashboard FE so it is untrusted, unlike userAccountId which is signed by the dashboard.
-	const resolved = await getAccountRole(activeAccountId, payload.id!);
+	const resolved = await getOrgRole(activeAccountId, payload.id!);
 
 	if (!resolved) {
 		throw createHttpError(403, 'The selected account is not available.', { type: 'access_forbidden' });
 	}
 
-	return { accountId: resolved.id, accountRole: resolved.role };
+	return { accountId: resolved.id, accountRole: resolved.role, userType: resolved.userType };
 };
 
 export const verifySessionPayload = async (cookie: string, key: Uint8Array): Promise<SessionCookiePayload | undefined> => {
@@ -106,7 +106,7 @@ export const authenticate = (): ExtendedMiddleware => {
 
 			if (payload?.id && payload.app_access === true) {
 				const account = await resolveAccount(ctx, payload);
-				ctx.state.user = { id: payload.id, ...account, username: payload.github_username || null, userType: payload.user_type || 'member', authMode: 'cookie', adminAccess: payload.admin_access === true };
+				ctx.state.user = { id: payload.id, ...account, username: payload.github_username || null, authMode: 'cookie', adminAccess: payload.admin_access === true };
 				apmAgent.setUserContext({ id: payload.id, username: payload.github_username || `ID(${payload.id})` });
 			}
 		}

test/tests/integration/middleware/authenticate.test.ts

@@ -42,6 +42,24 @@ describe('authenticate', () => {
 		await deleteFakeProbes();
 	});
 
+	describe('tier', () => {
+		it('should take the tier from the org when the token bills an org, and from the user otherwise', async () => {
+			const sponsor = await createUser(dashboardClient, { user_type: 'sponsor' });
+			const org = await createOrg(dashboardClient, { user_type: 'member', members: [{ userId: sponsor.id, role: 'admin' }] });
+
+			await dashboardClient(GP_TOKENS_TABLE).insert([
+				{ name: 'personal', user_created: sponsor.id, account_id: sponsor.accountId, value: 'kOSvlLIT0R9OjLXOaEqfgMIoZP8TTFFDnHXNkPJk5s0=' },
+				{ name: 'org', user_created: sponsor.id, account_id: org.accountId, value: 'RQ0R8MTk4VLUGAxaMGrUvFjNJj39v1MvNwXt0CvTEPY=' },
+			]);
+
+			const [ personalToken ] = await auth.fetchTokens({ account_id: sponsor.accountId });
+			const [ orgToken ] = await auth.fetchTokens({ account_id: org.accountId });
+
+			expect(personalToken!.user_user_type).to.equal('sponsor');
+			expect(orgToken!.user_user_type).to.equal('member');
+		});
+	});
+
 	describe('token', () => {
 		it('should accept if no "Authorization" header was passed', async () => {
 			await requestAgent.post('/v1/measurements')