| 1 | import { type Database, schema } from '@ghost/db'; |
| 2 | import { Inject, Injectable |
| 3 | import { and, desc |
| 4 | import { alias } |
| 5 | |
| 6 | import { DATABASE } |
| 7 | import { isoTimestamp } |
| 8 | import { |
| 9 | findOauthApp, |
| 10 | keyOauthClientId, |
| 11 | oauthAppColumns, |
| 12 | } from '../../lib/github/oauth-apps.js'; |
| 13 | import { OauthAppNotFoundError } |
| 14 | import { |
| 15 | administeredOrganization, |
| 16 | membershipIn, |
| 17 | } from '../../lib/organizations/administered-organization.js'; |
| 18 | import { oauthAppBlocked } |
| 19 | import type { |
| 20 | ListOauthAppAccessResponseDTO, |
| 21 | ListOauthAppOrganizationAccessResponseDTO, |
| 22 | OauthAppAccessDTO, |
| 23 | } from './dto/oauth-app-access.dto.js'; |
| 24 | |
| 25 | const requester = alias |
| 26 | const decider = alias |
| 27 | const ownerUser = alias |
| 28 | const ownerOrganization = alias |
| 29 | |
| 30 | /** An organization's OAuth app access restrictions: which apps its members asked for, and what its admins answered. */ |
| 31 | @Injectable() |
| 32 | export class OauthAppAccessService |
| 33 | constructor(@Inject( |
| 34 | |
| 35 | async list( |
| 36 | slug: string, |
| 37 | userId: string, |
| 38 | ): Promise<ListOauthAppAccessResponseDTO |
| 39 | const { organizationId, |
| 40 | this.db, |
| 41 | slug, |
| 42 | userId, |
| 43 | ); |
| 44 | return { |
| 45 | restricted: settings?.oauthAppRestrictions |
| 46 | apps: await this |
| 47 | }; |
| 48 | } |
| 49 | |
| 50 | /** An admin's answer; it stands until it is changed or revoked. */ |
| 51 | async decide( |
| 52 | slug: string, |
| 53 | userId: string, |
| 54 | clientId: string, |
| 55 | state: 'approved |
| 56 | ): Promise<OauthAppAccessDTO |
| 57 | const { organizationId |
| 58 | this.db, |
| 59 | slug, |
| 60 | userId, |
| 61 | ); |
| 62 | if (!(await |
| 63 | throw new OauthAppNotFoundError() |
| 64 | await this.db |
| 65 | .insert(schema.organizationOauthApp |
| 66 | .values({ |
| 67 | organizationId, |
| 68 | clientId, |
| 69 | state, |
| 70 | decidedById: userId, |
| 71 | decidedAt: new Date |
| 72 | }) |
| 73 | .onConflictDoUpdate({ |
| 74 | target: [ |
| 75 | schema.organizationOauthApp.organizationId |
| 76 | schema.organizationOauthApp.clientId |
| 77 | ], |
| 78 | set: { state, |
| 79 | }); |
| 80 | const [answer] |
| 81 | return answer!; |
| 82 | } |
| 83 | |
| 84 | /** Forgets the answer, so a revoked approval blocks the app again and a revoked denial lets members ask again. */ |
| 85 | async revoke(slug |
| 86 | const { organizationId |
| 87 | this.db, |
| 88 | slug, |
| 89 | userId, |
| 90 | ); |
| 91 | await this.db |
| 92 | .delete(schema.organizationOauthApp |
| 93 | .where( |
| 94 | and( |
| 95 | eq(schema.organizationOauthApp |
| 96 | eq(schema.organizationOauthApp |
| 97 | ), |
| 98 | ); |
| 99 | } |
| 100 | |
| 101 | /** A member asks the admins for the app. Asking again changes nothing: an answer, once given, stands. */ |
| 102 | async request( |
| 103 | slug: string, |
| 104 | userId: string, |
| 105 | clientId: string, |
| 106 | ): Promise<OauthAppAccessDTO |
| 107 | const { organizationId |
| 108 | if (!(await |
| 109 | throw new OauthAppNotFoundError() |
| 110 | await this.db |
| 111 | .insert(schema.organizationOauthApp |
| 112 | .values({ |
| 113 | organizationId, |
| 114 | clientId, |
| 115 | state: 'requested', |
| 116 | requestedById: userId, |
| 117 | }) |
| 118 | .onConflictDoNothing(); |
| 119 | const [answer] |
| 120 | return answer!; |
| 121 | } |
| 122 | |
| 123 | /** Where the app reaches among the user's organizations, for the approval screen and the authorized apps page. */ |
| 124 | async forApp( |
| 125 | userId: string, |
| 126 | clientId: string, |
| 127 | ): Promise<ListOauthAppOrganizationAccessResponseDTO |
| 128 | if (!(await |
| 129 | throw new OauthAppNotFoundError() |
| 130 | const rows = |
| 131 | .select({ |
| 132 | id: schema.organization |
| 133 | slug: schema.organization |
| 134 | name: schema.organization |
| 135 | restricted: sql<boolean |
| 136 | state: schema.organizationOauthApp |
| 137 | }) |
| 138 | .from(schema.member |
| 139 | .innerJoin( |
| 140 | schema.organization, |
| 141 | eq(schema.organization |
| 142 | ) |
| 143 | .leftJoin( |
| 144 | schema.organizationSettings, |
| 145 | eq(schema.organizationSettings |
| 146 | ) |
| 147 | .leftJoin( |
| 148 | schema.organizationOauthApp, |
| 149 | and( |
| 150 | eq( |
| 151 | schema.organizationOauthApp.organizationId |
| 152 | schema.organization.id |
| 153 | ), |
| 154 | eq(schema.organizationOauthApp |
| 155 | ), |
| 156 | ) |
| 157 | .where(eq(schema |
| 158 | .orderBy(schema.organization |
| 159 | return { |
| 160 | organizations: await Promise |
| 161 | rows.map(async |
| 162 | ...organization, |
| 163 | allowed: !(await |
| 164 | clientId, |
| 165 | organizationId: id, |
| 166 | })), |
| 167 | })), |
| 168 | ), |
| 169 | }; |
| 170 | } |
| 171 | |
| 172 | private answers(organizationId |
| 173 | const app = |
| 174 | return this.db |
| 175 | .select({ |
| 176 | clientId: app, |
| 177 | name: oauthAppColumns.name |
| 178 | logoUrl: oauthAppColumns.logoUrl |
| 179 | description: oauthAppColumns.description |
| 180 | homepageUrl: oauthAppColumns.homepageUrl |
| 181 | owner: sql< |
| 182 | string | null |
| 183 | >`coalesce(${ownerUser.username |
| 184 | // What the app can do here: every scope a member of this organization granted it, through a key or a refresh token still alive. |
| 185 | scopes: sql< |
| 186 | string[] |
| 187 | >`array(select distinct scope from (select jsonb_array_elements_text(coalesce(${schema.apikey |
| 188 | state: schema.organizationOauthApp |
| 189 | requestedBy: requester.username |
| 190 | requestedAt: isoTimestamp(schema |
| 191 | decidedBy: decider.username |
| 192 | decidedAt: sql< |
| 193 | string | null |
| 194 | >`${isoTimestamp(schema |
| 195 | }) |
| 196 | .from(schema.organizationOauthApp |
| 197 | .innerJoin( |
| 198 | schema.oauthClient, |
| 199 | eq(schema.oauthClient |
| 200 | ) |
| 201 | .leftJoin(ownerUser, |
| 202 | .leftJoin( |
| 203 | ownerOrganization, |
| 204 | eq(ownerOrganization.id |
| 205 | ) |
| 206 | .leftJoin( |
| 207 | requester, |
| 208 | eq(requester.id |
| 209 | ) |
| 210 | .leftJoin( |
| 211 | decider, |
| 212 | eq(decider.id |
| 213 | ) |
| 214 | .where( |
| 215 | and( |
| 216 | eq(schema.organizationOauthApp |
| 217 | clientId |
| 218 | ? eq(schema. |
| 219 | : undefined, |
| 220 | ), |
| 221 | ) |
| 222 | .orderBy(desc(schema |
| 223 | } |
| 224 | } |