feat(api-mailer): add security permissions and checks (#2733)

webiny · Oct 25, 2022 · 57df8ee · 57df8ee
1 parent 3337e33
commit 57df8ee
Show file tree

Hide file tree

Showing 7 changed files with 188 additions and 69 deletions.
diff --git a/packages/api-mailer/__tests__/context/helpers.ts b/packages/api-mailer/__tests__/context/helpers.ts
@@ -1,13 +1,8 @@
-import { SecurityIdentity } from "@webiny/api-security/types";
 export { until } from "@webiny/project-utils/testing/helpers/until";
 export { sleep } from "@webiny/project-utils/testing/helpers/sleep";
 
 export interface PermissionsArg {
     name: string;
-    locales?: string[];
-    rwd?: string;
-    pw?: string | null;
-    own?: boolean;
 }
 
 export const identity = {
@@ -16,53 +11,13 @@ export const identity = {
     type: "admin"
 };
 
-const getSecurityIdentity = () => {
-    return identity;
-};
-
 export const createPermissions = (permissions?: PermissionsArg[]): PermissionsArg[] => {
     if (permissions) {
         return permissions;
     }
     return [
         {
-            name: "cms.settings"
-        },
-        {
-            name: "cms.contentModel",
-            rwd: "rwd"
-        },
-        {
-            name: "cms.contentModelGroup",
-            rwd: "rwd"
-        },
-        {
-            name: "cms.contentEntry",
-            rwd: "rwd",
-            pw: "rcpu"
-        },
-        {
-            name: "cms.endpoint.read"
-        },
-        {
-            name: "cms.endpoint.manage"
-        },
-        {
-            name: "cms.endpoint.preview"
-        },
-        {
-            name: "content.i18n",
-            locales: ["en-US"]
-        },
-        {
-            name: "apw.publishingWorkflows"
+            name: "mailer.settings"
         }
     ];
 };
-
-export const createIdentity = (identity?: SecurityIdentity) => {
-    if (!identity) {
-        return getSecurityIdentity();
-    }
-    return identity;
-};
diff --git a/packages/api-mailer/__tests__/settings.crud.test.ts b/packages/api-mailer/__tests__/settings.crud.test.ts
@@ -179,4 +179,85 @@ describe("Settings Transporter CRUD", () => {
             host: "dummy-host2.webiny"
         });
     });
+
+    it("should be possible to access settings when no permissions", async () => {
+        process.env.WEBINY_MAILER_PASSWORD_SECRET = "really secret secret";
+
+        const fullCtx = await handle();
+
+        await fullCtx.mailer.createSettings({
+            input
+        });
+
+        const { handle: noAccessHandle } = createContextHandler({
+            permissions: []
+        });
+
+        const context = await noAccessHandle();
+
+        const response = await context.mailer.getSettings();
+
+        expect(response).toEqual({
+            ...input,
+            id: expect.any(String)
+        });
+    });
+
+    it("should not be possible to create or update settings due to no permissions", async () => {
+        process.env.WEBINY_MAILER_PASSWORD_SECRET = "really secret secret";
+
+        const { handle: noAccessHandle } = createContextHandler({
+            permissions: []
+        });
+
+        const context = await noAccessHandle();
+
+        let createResponse: any = null;
+        let createError: any = null;
+
+        try {
+            createResponse = await context.mailer.createSettings({
+                input
+            });
+        } catch (ex) {
+            createError = {
+                message: ex.message,
+                code: ex.code,
+                data: ex.data
+            };
+        }
+
+        expect(createResponse).toEqual(null);
+        expect(createError).toEqual({
+            message: "Not authorized!",
+            code: "SECURITY_NOT_AUTHORIZED",
+            data: {
+                reason: "Not allowed to update the mailer settings."
+            }
+        });
+
+        let updateResponse: any = null;
+        let updateError: any = null;
+
+        try {
+            updateResponse = await context.mailer.updateSettings({
+                input
+            });
+        } catch (ex) {
+            updateError = {
+                message: ex.message,
+                code: ex.code,
+                data: ex.data
+            };
+        }
+
+        expect(updateResponse).toEqual(null);
+        expect(updateError).toEqual({
+            message: "Not authorized!",
+            code: "SECURITY_NOT_AUTHORIZED",
+            data: {
+                reason: "Not allowed to update the mailer settings."
+            }
+        });
+    });
 });
diff --git a/packages/api-mailer/__tests__/settings.graphql.test.ts b/packages/api-mailer/__tests__/settings.graphql.test.ts
@@ -181,4 +181,36 @@ describe("Mailer Settings GraphQL", () => {
             }
         });
     });
+
+    it("should not have access to saving settings", async () => {
+        const noAccessHandler = createGraphQLHandler({
+            permissions: []
+        });
+        const [response] = await noAccessHandler.saveSettings({
+            data: {
+                host: "dummy-host.webiny",
+                user: "user",
+                password: "password",
+                from: "from@dummy-host.webiny",
+                replyTo: "replyTo@dummy-host.webiny"
+            }
+        });
+
+        expect(response).toEqual({
+            data: {
+                mailer: {
+                    saveSettings: {
+                        data: null,
+                        error: {
+                            code: "SECURITY_NOT_AUTHORIZED",
+                            data: {
+                                reason: "Not allowed to update the mailer settings."
+                            },
+                            message: "Not authorized!"
+                        }
+                    }
+                }
+            }
+        });
+    });
 });
diff --git a/packages/api-mailer/src/crud/settings.crud.ts b/packages/api-mailer/src/crud/settings.crud.ts
@@ -21,6 +21,7 @@ import { getSecret } from "~/crud/settings/secret";
 import { createValidation, updateValidation } from "~/crud/settings/validation";
 import { CmsEntry, CmsModel } from "@webiny/api-headless-cms/types";
 import { attachPasswordObfuscatingHooks } from "~/crud/settings/hooks";
+import { NotAuthorizedError } from "@webiny/api-security";
 
 /**
  * Note that settings cannot be used if there is no secret defined.
@@ -33,25 +34,45 @@ export const createSettingsCrud = async (
      */
     attachPasswordObfuscatingHooks(context);
 
+    const getTenant = () => {
+        return context.tenancy.getCurrentTenant().id;
+    };
+
+    const validateAccess = async () => {
+        const permission = await context.security.getPermission("mailer.settings");
+
+        if (permission) {
+            return;
+        }
+        throw new NotAuthorizedError({
+            data: {
+                reason: `Not allowed to update the mailer settings.`
+            }
+        });
+    };
+
     let secret: string | null = null;
     try {
         secret = getSecret();
     } catch (ex) {}
 
     const getModel = async (): Promise<CmsModel> => {
-        const model = await context.cms.getModel(SETTINGS_MODEL_ID);
-        if (model) {
-            return model;
+        try {
+            context.security.disableAuthorization();
+            const model = await context.cms.getModel(SETTINGS_MODEL_ID);
+            if (model) {
+                return model;
+            }
+        } catch (ex) {
+            throw new WebinyError(ex.message, ex.code, ex.data);
+        } finally {
+            context.security.enableAuthorization();
         }
         throw new WebinyError(`Missing CMS Model "${SETTINGS_MODEL_ID}".`, "CMS_MODEL_MISSING", {
             modelId: SETTINGS_MODEL_ID
         });
     };
 
-    const getTenant = () => {
-        return context.tenancy.getCurrentTenant().id;
-    };
-
     // get
     const onSettingsBeforeGet = createTopic<OnSettingsBeforeGetTopicParams>(
         "mailer.onSettingsBeforeGet"
@@ -105,10 +126,12 @@ export const createSettingsCrud = async (
         onSettingsUpdateError,
         getSettings: async () => {
             checkSecret();
+
             const model = await getModel();
 
             const tenant = getTenant();
             try {
+                context.security.disableAuthorization();
                 await onSettingsBeforeGet.publish({
                     tenant
                 });
@@ -145,6 +168,8 @@ export const createSettingsCrud = async (
                     tenant,
                     error: ex
                 });
+            } finally {
+                context.security.enableAuthorization();
             }
             return null;
         },
@@ -154,6 +179,8 @@ export const createSettingsCrud = async (
          */
         async createSettings(this: MailerContextObject, params) {
             checkSecret();
+            await validateAccess();
+
             const { input } = params;
 
             const model = await getModel();
@@ -175,6 +202,8 @@ export const createSettingsCrud = async (
             };
 
             try {
+                context.security.disableAuthorization();
+
                 await onSettingsBeforeCreate.publish({
                     settings: passwordlessSettings
                 });
@@ -200,6 +229,8 @@ export const createSettingsCrud = async (
                     error: ex
                 });
                 throw new WebinyError(ex.message, ex.code, ex.data);
+            } finally {
+                context.security.enableAuthorization();
             }
         },
         /**
@@ -208,6 +239,8 @@ export const createSettingsCrud = async (
          */
         async updateSettings(this: MailerContextObject, params) {
             checkSecret();
+            await validateAccess();
+
             const { input, original: initialOriginal } = params;
 
             const model = await getModel();
@@ -238,6 +271,8 @@ export const createSettingsCrud = async (
                 password: ""
             };
             try {
+                context.security.disableAuthorization();
+
                 await onSettingsBeforeUpdate.publish({
                     settings: passwordlessSettings,
                     original
@@ -267,6 +302,8 @@ export const createSettingsCrud = async (
                     error: ex
                 });
                 throw new WebinyError(ex.message, ex.code, ex.data);
+            } finally {
+                context.security.enableAuthorization();
             }
         },
         async saveSettings(this: MailerContextObject, params) {

diff --git a/packages/app-mailer/src/plugins/Module.tsx b/packages/app-mailer/src/plugins/Module.tsx
@@ -35,22 +35,20 @@ export const Module: React.FC = () => {
                     />
                 </Menu>
             </Menu>
-            {
-                <AddRoute
-                    exact
-                    path={"/mailer/settings"}
-                    render={() => (
-                        <SecureRoute permission={"mailer.settings"}>
-                            <AdminLayout>
-                                <Helmet title={"Mailer - Settings"} />
-                                <Loader>
-                                    <Settings />
-                                </Loader>
-                            </AdminLayout>
-                        </SecureRoute>
-                    )}
-                />
-            }
+            <AddRoute
+                exact
+                path={"/mailer/settings"}
+                render={() => (
+                    <SecureRoute permission={"mailer.settings"}>
+                        <AdminLayout>
+                            <Helmet title={"Mailer - Settings"} />
+                            <Loader>
+                                <Settings />
+                            </Loader>
+                        </AdminLayout>
+                    </SecureRoute>
+                )}
+            />
         </>
     );
 };
diff --git a/packages/cwp-template-aws/template/common/types/env/index.d.ts b/packages/cwp-template-aws/template/common/types/env/index.d.ts
@@ -45,5 +45,13 @@ declare namespace NodeJS {
         APW_SCHEDULER_SCHEDULE_ACTION_HANDLER?: string;
         ELASTIC_SEARCH_ENDPOINT?: string;
         EVENT_BUS?: string;
+        /**
+         * api-mailer
+         */
+        WEBINY_MAILER_HOST?: string;
+        WEBINY_MAILER_USER?: string;
+        WEBINY_MAILER_PASSWORD?: string;
+        WEBINY_MAILER_REPLY_TO?: string;
+        WEBINY_MAILER_FROM?: string;
     }
 }
diff --git a/typings/env/index.d.ts b/typings/env/index.d.ts
@@ -47,5 +47,13 @@ declare namespace NodeJS {
         STAGED_ROLLOUTS_VARIANT?: string;
         ELASTIC_SEARCH_ENDPOINT?: string;
         EVENT_BUS?: string;
+        /**
+         * api-mailer
+         */
+        WEBINY_MAILER_HOST?: string;
+        WEBINY_MAILER_USER?: string;
+        WEBINY_MAILER_PASSWORD?: string;
+        WEBINY_MAILER_REPLY_TO?: string;
+        WEBINY_MAILER_FROM?: string;
     }
 }