-
-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: circumvent permission checks when developing locally via serve-…
…dev (credits go to bradleyDean)
- Loading branch information
Showing
5 changed files
with
74 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -26,14 +26,14 @@ jobs: | |
ref: main | ||
- uses: imranismail/setup-kustomize@v2 | ||
- run: | | ||
cd stage | ||
kustomize edit set image vnguyen/openbeta-graph-api:sha-${GITHUB_SHA} | ||
- name: Check if there is any change | ||
id: get_changes | ||
run: echo "changed=$(git status --porcelain | wc -l)" >> $GITHUB_OUTPUT | ||
- name: Push if tag has changes | ||
if: steps.get_changes.outputs.changed != 0 | ||
run: | | ||
cd api-server-deployment/stage | ||
git config user.name github-actions | ||
git config user.email [email protected] | ||
git commit -am "Update deployment. Code=${GITHUB_SHA}" | ||
|
@@ -54,7 +54,8 @@ jobs: | |
ref: main | ||
- uses: imranismail/setup-kustomize@v2 | ||
- run: | | ||
kustomize edit set image vnguyen/openbeta-graph-api:${GITHUB_REF} | ||
cd prod | ||
kustomize edit set image vnguyen/openbeta-graph-api:${GITHUB_REF_NAME} | ||
- name: Check if there is any change | ||
id: get_changes | ||
run: echo "changed=$(git status --porcelain | wc -l)" >> $GITHUB_OUTPUT | ||
|
@@ -63,7 +64,7 @@ jobs: | |
run: | | ||
git config user.name github-actions | ||
git config user.email [email protected] | ||
git commit -am "Update deployment. Code=${GITHUB_REF}" | ||
git commit -am "Update deployment. Code=${GITHUB_REF_NAME}" | ||
git push | ||
# build docker image and push to registry | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,37 +1,47 @@ | ||
import muid from 'uuid-mongodb' | ||
import muid, { MUUID } from 'uuid-mongodb' | ||
import { logger } from '../logger.js' | ||
import { AuthUserType } from '../types.js' | ||
import { verifyJWT } from './util.js' | ||
import { logger } from '../logger.js' | ||
|
||
/** | ||
* Create a middleware context for Apollo server | ||
*/ | ||
export const createContext = async ({ req }): Promise<any> => { | ||
const { headers } = req | ||
export const createContext = (() => { | ||
let testUUID: MUUID | ||
|
||
const user: AuthUserType = { | ||
roles: [], | ||
uuid: undefined, | ||
isBuilder: false | ||
if (process.env.GOD_MODE === 'true') { | ||
testUUID = muid.v4() | ||
logger.info('🚨🚨 GOD_MODE enabled, allowing all queries and mutations. This is ONLY for local development and should NOT happen production. 🚨🚨') | ||
logger.info(`The user.uuid for this session is: ${testUUID.toString()}`) | ||
} | ||
|
||
const authHeader = String(headers?.authorization ?? '') | ||
if (authHeader.startsWith('Bearer ')) { | ||
const token = authHeader.substring(7, authHeader.length).trim() | ||
// return async ({ req }: { req?: Request } = {}): Promise<any> => { | ||
// const headers = req?.headers | ||
return async ({ req }): Promise<any> => { | ||
const { headers } = req | ||
|
||
let payload | ||
try { | ||
payload = await verifyJWT(token) | ||
} catch (e) { | ||
logger.error(`Can't verify JWT token ${e.toString() as string}`) | ||
throw new Error('An unexpected error has occurred. Please notify us at [email protected].') | ||
const user: AuthUserType = { | ||
roles: [], | ||
uuid: undefined, | ||
isBuilder: false | ||
} | ||
|
||
user.isBuilder = payload?.scope?.includes('builder:default') ?? false | ||
user.roles = payload?.['https://tacos.openbeta.io/roles'] ?? [] | ||
const uidStr: string | undefined = payload?.['https://tacos.openbeta.io/uuid'] | ||
user.uuid = uidStr != null ? muid.from(uidStr) : undefined | ||
} | ||
if (process.env.GOD_MODE === 'true' && (user.uuid == null)) { | ||
user.roles = ['user_admin', 'org_admin', 'editor'] | ||
user.uuid = testUUID | ||
logger.info(`The user.roles for this session is: ${user.roles.toString()}`) | ||
} else { | ||
const authHeader = String(headers.authorization ?? '') | ||
if (authHeader.startsWith('Bearer ')) { | ||
const token = authHeader.substring(7, authHeader.length).trim() | ||
const z = await verifyJWT(token) | ||
|
||
return { user } | ||
} | ||
user.isBuilder = z?.scope?.includes('builder:default') ?? false | ||
user.roles = z?.['https://tacos.openbeta.io/roles'] ?? [] | ||
const uidStr: string | undefined = z?.['https://tacos.openbeta.io/uuid'] | ||
user.uuid = uidStr != null ? muid.from(uidStr) : undefined | ||
} | ||
} | ||
return { user } | ||
} | ||
})() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters