PIN-5849 - restrict agreements visibility only to allowed tenants

collections/agreement/Compute Agreeements State.bru

@@ -5,7 +5,7 @@ meta {
 }
 
 post {
-  url: {{host-agreement}}/compute/agreementsState
+  url: {{host-agreement}}/internal/compute/agreementsState
   body: json
   auth: none
 }

packages/agreement-process/src/model/domain/agreement-validators.ts

@@ -181,13 +181,15 @@ export const assertRequesterCanActAsConsumerOrProducer = (
   }
 };
 
-export const assertRequesterCanRetrieveConsumerDocuments = async (
+export const assertRequesterCanRetrieveAgreement = async (
   agreement: Agreement,
   authData: AuthData,
   readModelService: ReadModelService
 ): Promise<void> => {
-  // This operation has a dedicated assertion because it's the only operation that
-  // can be performed also by the producer/consumer even when active producer/consumer delegations exist
+  // This validator is for retrieval operations that can be performed by all the tenants involved:
+  // the consumer, the producer, the consumer delegate, and the producer delegate.
+  // Consumers and producers can retrieve agreements even if delegations exist.
+
   try {
     assertRequesterIsConsumer(agreement.consumerId, authData);
   } catch {

packages/agreement-process/src/routers/AgreementRouter.ts

@@ -378,7 +378,7 @@ const agreementRouter = (
           },
           req.query.limit,
           req.query.offset,
-          ctx.logger
+          ctx
         );
 
         return res.status(200).send(
@@ -411,11 +411,11 @@ const agreementRouter = (
       const ctx = fromAppContext(req.ctx);
 
       try {
-        const producers = await agreementService.getAgreementProducers(
+        const producers = await agreementService.getAgreementsProducers(
           req.query.producerName,
           req.query.limit,
           req.query.offset,
-          ctx.logger
+          ctx
         );
 
         return res.status(200).send(
@@ -448,11 +448,11 @@ const agreementRouter = (
       const ctx = fromAppContext(req.ctx);
 
       try {
-        const consumers = await agreementService.getAgreementConsumers(
+        const consumers = await agreementService.getAgreementsConsumers(
           req.query.consumerName,
           req.query.limit,
           req.query.offset,
-          ctx.logger
+          ctx
         );
 
         return res.status(200).send(
@@ -480,7 +480,6 @@ const agreementRouter = (
       API_ROLE,
       SECURITY_ROLE,
       M2M_ROLE,
-      INTERNAL_ROLE,
       SUPPORT_ROLE,
     ]),
     async (req, res) => {
@@ -489,7 +488,7 @@ const agreementRouter = (
       try {
         const agreement = await agreementService.getAgreementById(
           unsafeBrandId(req.params.agreementId),
-          ctx.logger
+          ctx
         );
         return res
           .status(200)
@@ -673,13 +672,13 @@ const agreementRouter = (
   );
 
   agreementRouter.post(
-    "/compute/agreementsState",
-    authorizationMiddleware([ADMIN_ROLE, INTERNAL_ROLE, M2M_ROLE]),
+    "/internal/compute/agreementsState",
+    authorizationMiddleware([INTERNAL_ROLE]),
     async (req, res) => {
       const ctx = fromAppContext(req.ctx);
 
       try {
-        await agreementService.computeAgreementsStateByAttribute(
+        await agreementService.internalComputeAgreementsStateByAttribute(
           unsafeBrandId(req.body.attributeId),
           fromApiCompactTenant(req.body.consumer),
           ctx
@@ -710,18 +709,15 @@ const agreementRouter = (
       const ctx = fromAppContext(req.ctx);
 
       try {
-        const eservices = await agreementService.getAgreementEServices(
+        const eservices = await agreementService.getAgreementsEServices(
           {
             eserviceName: req.query.eServiceName,
             consumerIds: req.query.consumersIds.map(unsafeBrandId<TenantId>),
             producerIds: req.query.producersIds.map(unsafeBrandId<TenantId>),
-            agreeementStates: req.query.states.map(
-              apiAgreementStateToAgreementState
-            ),
           },
           req.query.limit,
           req.query.offset,
-          ctx.logger
+          ctx
         );
 
         return res.status(200).send(

packages/agreement-process/src/services/agreementService.ts

@@ -90,7 +90,7 @@ import {
   assertActivableState,
   assertRequesterCanActAsProducer,
   assertRequesterCanActAsConsumerOrProducer,
-  assertRequesterCanRetrieveConsumerDocuments,
+  assertRequesterCanRetrieveAgreement,
   assertCanWorkOnConsumerDocuments,
   assertExpectedState,
   assertRequesterIsDelegateConsumer,
@@ -232,18 +232,34 @@ export function agreementServiceBuilder(
       filters: AgreementQueryFilters,
       limit: number,
       offset: number,
-      logger: Logger
+      { authData, logger }: WithLogger<AppContext>
     ): Promise<ListResult<Agreement>> {
-      logger.info("Retrieving agreements");
-      return await readModelService.getAgreements(filters, limit, offset);
+      logger.info(
+        `Getting agreements with filters: ${JSON.stringify(
+          filters
+        )}, offset = ${offset}, limit = ${limit}`
+      );
+
+      // Permissions are checked in the readModelService
+      return await readModelService.getAgreements(
+        authData.organizationId,
+        filters,
+        limit,
+        offset
+      );
     },
     async getAgreementById(
       agreementId: AgreementId,
-      logger: Logger
+      { authData, logger }: WithLogger<AppContext>
     ): Promise<Agreement> {
       logger.info(`Retrieving agreement by id ${agreementId}`);
 
       const agreement = await retrieveAgreement(agreementId, readModelService);
+      await assertRequesterCanRetrieveAgreement(
+        agreement.data,
+        authData,
+        readModelService
+      );
       return agreement.data;
     },
     async createAgreement(
@@ -306,27 +322,41 @@ export function agreementServiceBuilder(
 
       return agreement;
     },
-    async getAgreementProducers(
+    async getAgreementsProducers(
       producerName: string | undefined,
       limit: number,
       offset: number,
-      logger: Logger
+      { authData, logger }: WithLogger<AppContext>
     ): Promise<ListResult<CompactOrganization>> {
       logger.info(
         `Retrieving producers from agreements with producer name ${producerName}`
       );
-      return await readModelService.getProducers(producerName, limit, offset);
+
+      // Permissions are checked in the readModelService
+      return await readModelService.getAgreementsProducers(
+        authData.organizationId,
+        producerName,
+        limit,
+        offset
+      );
     },
-    async getAgreementConsumers(
+    async getAgreementsConsumers(
       consumerName: string | undefined,
       limit: number,
       offset: number,
-      logger: Logger
+      { authData, logger }: WithLogger<AppContext>
     ): Promise<ListResult<CompactOrganization>> {
       logger.info(
         `Retrieving consumers from agreements with consumer name ${consumerName}`
       );
-      return await readModelService.getConsumers(consumerName, limit, offset);
+
+      // Permissions are checked in the readModelService
+      return await readModelService.getAgreementsConsumers(
+        authData.organizationId,
+        consumerName,
+        limit,
+        offset
+      );
     },
     async updateAgreement(
       agreementId: AgreementId,
@@ -876,7 +906,7 @@ export function agreementServiceBuilder(
 
       const agreement = await retrieveAgreement(agreementId, readModelService);
 
-      await assertRequesterCanRetrieveConsumerDocuments(
+      await assertRequesterCanRetrieveAgreement(
         agreement.data,
         authData,
         readModelService
@@ -943,17 +973,21 @@ export function agreementServiceBuilder(
 
       return updatedAgreement;
     },
-    async getAgreementEServices(
+    async getAgreementsEServices(
       filters: AgreementEServicesQueryFilters,
       limit: number,
       offset: number,
-      logger: Logger
+      { authData, logger }: WithLogger<AppContext>
     ): Promise<ListResult<CompactEService>> {
       logger.info(
-        `Retrieving EServices with consumers ${filters.consumerIds}, producers ${filters.producerIds}, states ${filters.agreeementStates}, offset ${offset}, limit ${limit} and name matching ${filters.eserviceName}`
+        `Retrieving EServices from agreements with filters: ${JSON.stringify(
+          filters
+        )}, offset ${offset}, limit ${limit}`
       );
 
+      // Permissions are checked in the readModelService
       return await readModelService.getAgreementsEServices(
+        authData.organizationId,
         filters,
         limit,
         offset
@@ -1332,7 +1366,7 @@ export function agreementServiceBuilder(
         )
       );
     },
-    async computeAgreementsStateByAttribute(
+    async internalComputeAgreementsStateByAttribute(
       attributeId: AttributeId,
       consumer: CompactTenant,
       { logger, correlationId }: WithLogger<AppContext>