feat: add token validation and set token in graphql clients

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add token validation in graphql operations and token to call storefront-permission and b2b-organization
+
 ## [2.4.1] - 2023-11-09
 
 ### Fixed

graphql/directives.graphql

@@ -3,3 +3,4 @@ directive @withPermissions on FIELD | FIELD_DEFINITION
 directive @withSegment on FIELD | FIELD_DEFINITION
 directive @checkAdminAccess on FIELD | FIELD_DEFINITION
 directive @auditAccess on FIELD | FIELD_DEFINITION
+directive @checkUserAccess on FIELD | FIELD_DEFINITION

graphql/schema.graphql

@@ -30,7 +30,7 @@ type Mutation {
   useQuote(id: String, orderFormId: String): String
     @withPermissions
     @withSession
-  clearCart(orderFormId: String): String @auditAccess
+  clearCart(orderFormId: String): String @checkUserAccess
   saveAppSettings(input: AppSettingsInput!): AppSettings
     @cacheControl(scope: PRIVATE)
     @checkAdminAccess

manifest.json

@@ -11,11 +11,10 @@
   },
   "dependencies": {
     "vtex.storefront-permissions": "1.x",
+    "vtex.b2b-organizations-graphql": "0.x",
     "vtex.orders-broadcast": "0.x"
   },
-  "registries": [
-    "smartcheckout"
-  ],
+  "registries": ["smartcheckout"],
   "policies": [
     {
       "name": "vbase-read-write"
@@ -48,7 +47,7 @@
       "name": "vtex.storefront-permissions:resolve-graphql"
     },
     {
-      "name": "vtex.graphql-server:resolve-graphql"
+      "name": "vtex.b2b-organizations-graphql:resolve-graphql"
     },
     {
       "name": "Get_User_By_Identifier"

node/clients/index.ts

@@ -1,6 +1,8 @@
+import type { IOContext } from '@vtex/api'
 import { IOClients } from '@vtex/api'
 
 import RequestHub from '../utils/Hub'
+import Identity from '../utils/Identity'
 import { Scheduler } from '../utils/Scheduler'
 import Checkout from './checkout'
 import MailClient from './email'
@@ -9,7 +11,20 @@ import OrdersClient from './OrdersClient'
 import Organizations from './organizations'
 import StorefrontPermissions from './storefrontPermissions'
 import VtexId from './vtexId'
-import Identity from '../utils/Identity'
+
+export const getTokenToHeader = (ctx: IOContext) => {
+  const token =
+    ctx.storeUserAuthToken ?? ctx.adminUserAuthToken ?? ctx.authToken
+
+  const { sessionToken } = ctx
+
+  return {
+    'x-vtex-credential': ctx.authToken,
+    VtexIdclientAutCookie: token,
+    cookie: `VtexIdclientAutCookie=${token}`,
+    'x-vtex-session': sessionToken,
+  }
+}
 
 // Extend the default IOClients implementation with our own custom clients.
 export class Clients extends IOClients {

node/clients/organizations.ts

@@ -1,41 +1,14 @@
 import type { InstanceOptions, IOContext } from '@vtex/api'
-import { AppClient, GraphQLClient } from '@vtex/api'
+import { AppGraphQLClient } from '@vtex/api'
 
-export default class Organizations extends AppClient {
-  protected graphql: GraphQLClient
+import { getTokenToHeader } from './index'
 
+export default class Organizations extends AppGraphQLClient {
   constructor(ctx: IOContext, options?: InstanceOptions) {
-    super('[email protected]', ctx, options)
-    this.graphql = new GraphQLClient(this.http)
-  }
-
-  public getOrganizationIDs = async (search: string): Promise<any> => {
-    const graphQLQuery = `query GetOrganizations($search: String!) {
-      getOrganizations(search: $search) {
-          data {
-              id
-          }
-        }
-      }`
-
-    return this.graphql.query(
-      {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: graphQLQuery,
-        variables: {
-          search,
-        },
-      },
-      { url: '/graphql' }
-    )
+    super('[email protected]', ctx, options)
   }
 
   public getOrganizationById = async (id: string): Promise<any> => {
     const graphQLQuery = `query GetOrganizationById($id: ID!) {
         getOrganizationById(id: $id) {
             name
@@ -43,50 +16,16 @@
       }
       `
 
-    return this.graphql.query(
-      {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: graphQLQuery,
-        variables: {
-          id,
-        },
+    return this.query({
+      extensions: this.getPersistedQuery(),
+      query: graphQLQuery,
+      variables: {
+        id,
       },
-      { url: '/graphql' }
-    )
-  }
-
-  public getCostCenterIDs = async (search: string): Promise<any> => {
-    const graphQLQuery = `query GetCostCenters($search: String!) {
-      getCostCenters(search: $search) {
-          data {
-              id
-          }
-        }
-      }`
-
-    return this.graphql.query(
-      {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: graphQLQuery,
-        variables: {
-          search,
-        },
-      },
-      { url: '/graphql' }
-    )
+    })
   }
 
   public getCostCenterById = async (id: string): Promise<any> => {
     const graphQLQuery = `query GetCostCenterById($id: ID!) {
         getCostCenterById(id: $id) {
             name
@@ -94,20 +33,43 @@
       }
       `
 
+    return this.query({
+      extensions: this.getPersistedQuery(),
+      query: graphQLQuery,
+      variables: {
+        id,
+      },
+    })
+  }
+
+  private getPersistedQuery = () => {
+    return {
+      persistedQuery: {
+        provider: '[email protected]',
+        sender: '[email protected]',
+      },
+    }
+  }
+
+  private query = async (param: {
+    query: string
+    variables: any
+    extensions: any
+  }): Promise<any> => {
+    const { query, variables, extensions } = param
+
     return this.graphql.query(
       {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: graphQLQuery,
-        variables: {
-          id,
-        },
+        extensions,
+        query,
+        variables,
       },
-      { url: '/graphql' }
+      {
+        headers: getTokenToHeader(this.context),
+        params: {
+          locale: this.context.locale,
+        },
+      }
     )
   }
 }

node/clients/storefrontPermissions.ts

@@ -1,6 +1,8 @@
 import type { InstanceOptions, IOContext } from '@vtex/api'
 import { AppGraphQLClient } from '@vtex/api'
 
+import { getTokenToHeader } from './index'
+
 export const QUERIES = {
   getPermission: `query permissions {
     checkUserPermission {
@@ -59,36 +61,20 @@
     super('[email protected]', ctx, options)
   }
 
   public checkUserPermission = async (): Promise<any> => {
-    return this.graphql.query(
-      {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: QUERIES.getPermission,
-        variables: {},
-      },
-      {}
-    )
+    return this.query({
+      extensions: this.getPersistedQuery(),
+      query: QUERIES.getPermission,
+      variables: {},
+    })
   }
 
   public listRoles = async (): Promise<any> => {
-    return this.graphql.query(
-      {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: QUERIES.listRoles,
-        variables: {},
-      },
-      {}
-    )
+    return this.query({
+      extensions: this.getPersistedQuery(),
+      query: QUERIES.listRoles,
+      variables: {},
+    })
   }
 
   public listUsers = async ({
@@ -97,22 +83,45 @@
   }: {
     roleId: string
     organizationId?: string
   }): Promise<any> => {
+    return this.query({
+      extensions: this.getPersistedQuery(),
+      query: QUERIES.listUsers,
+      variables: {
+        roleId,
+        ...(organizationId && { organizationId }),
+      },
+    })
+  }
+
+  private getPersistedQuery = () => {
+    return {
+      persistedQuery: {
+        provider: '[email protected]',
+        sender: '[email protected]',
+      },
+    }
+  }
+
+  private query = async (param: {
+    query: string
+    variables: any
+    extensions: any
+  }): Promise<any> => {
+    const { query, variables, extensions } = param
+
     return this.graphql.query(
       {
-        extensions: {
-          persistedQuery: {
-            provider: '[email protected]',
-            sender: '[email protected]',
-          },
-        },
-        query: QUERIES.listUsers,
-        variables: {
-          roleId,
-          ...(organizationId && { organizationId }),
-        },
+        extensions,
+        query,
+        variables,
       },
-      {}
+      {
+        headers: getTokenToHeader(this.context),
+        params: {
+          locale: this.context.locale,
+        },
+      }
     )
   }
 }

node/package.json

@@ -8,7 +8,8 @@
     "jsonwebtoken": "^8.5.0",
     "ramda": "^0.25.0",
     "atob": "^2.1.2",
-    "axios": "0.27.2"
+    "axios": "0.27.2",
+    "@vtex/api": "6.46.0"
   },
   "devDependencies": {
     "@types/atob": "^2.1.2",
@@ -17,7 +18,6 @@
     "@types/jsonwebtoken": "^8.5.0",
     "@types/node": "^12.0.0",
     "@types/ramda": "types/npm-ramda#dist",
-    "@vtex/api": "6.45.20",
     "@vtex/prettier-config": "^0.3.1",
     "tslint": "^5.12.0",
     "tslint-config-prettier": "^1.18.0",

node/resolvers/directives.ts

@@ -1,13 +1,15 @@
+import { AuditAccess } from './directives/auditAccess'
+import { CheckAdminAccess } from './directives/checkAdminAccess'
+import { CheckUserAccess } from './directives/checkUserAccess'
 import { WithPermissions } from './directives/withPermissions'
-import { WithSession } from './directives/withSession'
 import { WithSegment } from './directives/withSegment'
-import { CheckAdminAccess } from './directives/checkAdminAccess'
-import { AuditAccess } from './directives/auditAccess'
+import { WithSession } from './directives/withSession'
 
 export const schemaDirectives = {
   withPermissions: WithPermissions as any,
   withSession: WithSession as any,
   withSegment: WithSegment as any,
   checkAdminAccess: CheckAdminAccess as any,
   auditAccess: AuditAccess as any,
+  checkUserAccess: CheckUserAccess as any,
 }