speckle-server/packages/server/modules/shared/services/auth.ts

import type { GetStream } from '@/modules/core/domain/streams/operations'
import {
  isResourceAllowed,
  RoleResourceTargets,
  roleResourceTypeToTokenResourceType
} from '@/modules/core/helpers/token'
import { ProjectRecordVisibility } from '@/modules/core/helpers/types'
import type {
  AuthorizeResolver,
  GetUserAclRole,
  GetUserServerRole,
  ValidateScopes
} from '@/modules/shared/domain/operations'
import type { GetRoles } from '@/modules/shared/domain/rolesAndScopes/operations'
import { ForbiddenError } from '@/modules/shared/errors'
import type { adminOverrideEnabled } from '@/modules/shared/helpers/envHelper'
import type { EventBusEmit } from '@/modules/shared/services/eventBus'
import { WorkspaceEvents } from '@/modules/workspacesCore/domain/events'
import type { GetWorkspaceRoleAndSeat } from '@/modules/workspacesCore/domain/operations'
import { isNullOrUndefined, Roles } from '@speckle/shared'
import { OperationTypeNode } from 'graphql'

/**
 * Validates the scope against a list of scopes of the current session.
 */
export const validateScopesFactory = (): ValidateScopes => async (scopes, scope) => {
  const errMsg = `Your auth token does not have the required scope${
    scope?.length ? ': ' + scope + '.' : '.'
  }`

  if (!scopes) throw new ForbiddenError(errMsg, { info: { scope } })
  if (scopes.indexOf(scope) === -1 && scopes.indexOf('*') === -1)
    throw new ForbiddenError(errMsg, { info: { scope } })
}

const workspaceRoleImplicitProjectRoleMap = (
  projectVisibility: ProjectRecordVisibility | null
) => {
  const isFullyPrivate = projectVisibility === ProjectRecordVisibility.Private

  return <const>{
    [Roles.Workspace.Admin]: Roles.Stream.Owner,
    [Roles.Workspace.Member]: isFullyPrivate ? null : Roles.Stream.Reviewer,
    [Roles.Workspace.Guest]: null
  }
}

/**
 * Checks the userId against the resource's acl.
 */
export const authorizeResolverFactory =
  (deps: {
    getRoles: GetRoles
    adminOverrideEnabled: typeof adminOverrideEnabled
    getUserServerRole: GetUserServerRole
    getStream: GetStream
    getUserAclRole: GetUserAclRole
    getWorkspaceRoleAndSeat: GetWorkspaceRoleAndSeat
    emitWorkspaceEvent: EventBusEmit
  }): AuthorizeResolver =>
  async (userId, resourceId, requiredRole, userResourceAccessLimits, operationType) => {
    // Bypass all authorization logic
    return
  }