chore: update COMS service

kyle1morel · kyle1morel · commit 3750b369ded0 · 2026-03-30T13:45:40.000-07:00
Use pseudo service account where required. Update how COMS permissions are applied for external users.
diff --git a/app/src/controllers/accessRequest.ts b/app/src/controllers/accessRequest.ts
@@ -87,7 +87,7 @@ export const createUserAccessRequestController = async (
       }
 
       // Assign new group
-      await assignGroup(tx, req.currentContext.bearerToken, user.sub, accessRequest.groupId);
+      await assignGroup(tx, user.sub, accessRequest.groupId);
 
       // Mock an access request for the response
       data = {
@@ -98,7 +98,7 @@ export const createUserAccessRequestController = async (
       };
     } else if (isAdmin) {
       if (accessRequest.grant) {
-        await assignGroup(tx, req.currentContext.bearerToken, user.sub, accessRequest.groupId);
+        await assignGroup(tx, user.sub, accessRequest.groupId);
         // Mock an access request for the response
         data = {
           userId: userResponse?.userId,
@@ -157,7 +157,7 @@ export const processUserAccessRequestController = async (
               throw new Problem(409, { detail: 'User must be an IDIR user to be assigned this role' });
             }
 
-            await assignGroup(tx, undefined, userResponse.sub, accessRequest.groupId);
+            await assignGroup(tx, userResponse.sub, accessRequest.groupId);
           } else {
             // Remove requested group if provided - otherwise remove all user groups for initiative
             const groupsToRemove = accessRequest.groupId
diff --git a/app/src/middleware/requireSomeGroup.ts b/app/src/middleware/requireSomeGroup.ts
@@ -1,4 +1,5 @@
 import { transactionWrapper } from '../db/utils/transactionWrapper.ts';
+import { assignPermissions } from '../services/coms.ts';
 import { assignGroup, getGroups, getSubjectGroups } from '../services/yars.ts';
 import { Problem } from '../utils/index.ts';
 import { GroupName, IdentityProviderKind, Initiative } from '../utils/enums/application.ts';
@@ -17,30 +18,37 @@ import type { PrismaTransactionClient } from '../db/dataConnection.ts';
  */
 export const requireSomeGroup = async (req: Request, _res: Response, next: NextFunction) => {
   await transactionWrapper<void>(async (tx: PrismaTransactionClient) => {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const idp = (req.currentContext?.tokenPayload as any).identity_provider;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const sub = (req.currentContext?.tokenPayload as any).sub;
+    const idp = req.currentContext?.tokenPayload?.identity_provider;
+    const sub = req.currentContext?.tokenPayload?.sub;
+
+    if (!sub) {
+      throw new Problem(403, {
+        detail: 'Unable to obtain token sub',
+        instance: req.originalUrl
+      });
+    }
 
     let groups = await getSubjectGroups(tx, sub);
 
     if (idp !== IdentityProviderKind.IDIR) {
       const required = [Initiative.ELECTRIFICATION, Initiative.HOUSING, Initiative.PCNS];
       const missing = required.filter((x) => !groups.some((g) => g.initiativeCode === x));
-      await Promise.all(
-        missing.map(async (x) => {
-          const g = await getGroups(tx, x);
-
-          await assignGroup(
-            tx,
-            req.currentContext.bearerToken,
-            sub,
-            g.find((x) => x.name === GroupName.PROPONENT)?.groupId
-          );
-        })
-      );
-
-      groups = await getSubjectGroups(tx, sub);
+
+      if (missing.length) {
+        await Promise.all(
+          missing.map(async (x) => {
+            const g = await getGroups(tx, x);
+
+            const groupId = g.find((x) => x.name === GroupName.PROPONENT)?.groupId;
+            if (groupId) await assignGroup(tx, sub, groupId);
+          })
+        );
+
+        groups = await getSubjectGroups(tx, sub);
+
+        // Assign COMS permissions
+        await assignPermissions(tx, req.currentContext);
+      }
     }
 
     if (groups.length === 0) {
diff --git a/app/src/services/coms.ts b/app/src/services/coms.ts
@@ -1,17 +1,33 @@
 import axios from 'axios';
 import config from 'config';
 
-import { Action } from '../utils/enums/application.ts';
-import { Problem, uuidValidateV4 } from '../utils/index.ts';
+import { Action, GroupName } from '../utils/enums/application.ts';
+import { getCurrentSubject, Problem, uuidValidateV4 } from '../utils/index.ts';
+import { getSubjectGroups } from './yars.ts';
 
 import type { AxiosInstance, AxiosRequestConfig } from 'axios';
+import type { PrismaTransactionClient } from '../db/dataConnection.ts';
+import type { CurrentContext } from '../types/stuff';
 
 /**
  * Returns an Axios instance for the COMS API
+ * Injects pseudo service account basic auth if no other auth provided
  * @param options Axios request config options
  * @returns An axios instance
  */
 function comsAxios(options: AxiosRequestConfig = {}): AxiosInstance {
+  // Inject pseudo service account if no other auth provided
+  if (!options.headers?.Authorization) {
+    const ak = config.get<string>('server.objectStorage.accessKeyId');
+    const sak = config.get<string>('server.objectStorage.secretAccessKey');
+    const b64 = Buffer.from(ak + ':' + sak).toString('base64');
+
+    if (!options.headers) options.headers = {};
+    options.headers.Authorization = `basic ${b64}`;
+    options.headers['x-amz-bucket'] = config.get('server.objectStorage.bucket');
+    options.headers['x-amz-endpoint'] = config.get('server.objectStorage.endpoint');
+  }
+
   // Create axios instance
   const instance = axios.create({
     baseURL: config.get('frontend.coms.apiPath'),
@@ -23,27 +39,20 @@ function comsAxios(options: AxiosRequestConfig = {}): AxiosInstance {
 }
 
 /**
- * Creates a bucket record. Bucket should exist in S3. If the set of bucket, endpoint and key match
- * an existing record, the user will be added to that existing bucket with the provided permissions
- * instead of generating a new bucket record.
- * This endpoint can be used to grant the current user permission to upload to a new or existing bucket.
- * @param bearerToken The bearer token of the authorized user
- * @param permissions An array of permissions to grant the user
+ * Obtain a bucket record. This actually utilizes the COMS create bucket endpoint as its the only way to
+ * obtain full bucket information using their pseudo service account access.
  * @returns The created bucket data
  */
-export const createBucket = async (bearerToken: string, permissions: Action[]) => {
-  const { data } = await comsAxios({
-    headers: { Authorization: `Bearer ${bearerToken}` }
-  }).put('/bucket', {
+export const getBucket = async () => {
+  const { status, headers, data } = await comsAxios().put('/bucket', {
     accessKeyId: config.get('server.objectStorage.accessKeyId'),
     bucket: config.get('server.objectStorage.bucket'),
     bucketName: 'PCNS',
     endpoint: config.get('server.objectStorage.endpoint'),
     secretAccessKey: config.get('server.objectStorage.secretAccessKey'),
-    key: config.get('server.objectStorage.key'),
-    permCodes: permissions
+    key: config.get('server.objectStorage.key')
   });
-  return data;
+  return { status, headers, data };
 };
 
 /**
@@ -62,3 +71,71 @@ export const getObject = async (bearerToken: string, objectId: string) => {
   }).get(`/object/${objectId}`);
   return { status, headers, data };
 };
+
+/**
+ * Obtain the current user information in COMS
+ * @param currentContext The current context of the Express request
+ * @returns The COMS response
+ */
+export const searchUser = async (currentContext: CurrentContext) => {
+  const { status, headers, data } = await comsAxios({
+    headers: { Authorization: `Bearer ${currentContext.bearerToken}` }
+    // Update to use username (sub) if COMS ever opens that up
+  }).get('/user', { params: { identityId: getCurrentSubject(currentContext).split('@')[0].toUpperCase() } });
+  return { status, headers, data };
+};
+
+/**
+ * Assigns COMS permissions to the current user based on their current groups
+ * @param tx Prisma transaction client
+ * @param currentContext The current context of the Express request
+ */
+export const assignPermissions = async (tx: PrismaTransactionClient, currentContext: CurrentContext) => {
+  const sub = currentContext.tokenPayload?.sub;
+
+  if (!sub) {
+    throw new Problem(403, {
+      detail: 'Unable to obtain token sub'
+    });
+  }
+
+  const groups = await getSubjectGroups(tx, sub);
+  const groupNames = new Set(groups.map((x) => x.name));
+
+  const comsPermsMap = new Map<GroupName, Action[]>([
+    [GroupName.PROPONENT, [Action.CREATE]],
+    [GroupName.NAVIGATOR_READ_ONLY, [Action.READ]],
+    [GroupName.NAVIGATOR, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
+    [GroupName.SUPERVISOR, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
+    [GroupName.ADMIN, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
+    [GroupName.DEVELOPER, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]]
+  ]);
+
+  const actions = new Set<Action>([...groupNames].flatMap((groupName) => comsPermsMap.get(groupName) ?? []));
+
+  if (actions && currentContext) {
+    try {
+      const user = await searchUser(currentContext);
+      const bucket = await getBucket();
+
+      const { userId } = user.data[0];
+      const { bucketId } = bucket.data;
+
+      if (!userId || !bucketId) {
+        throw new Error('Unable to obtain userId or bucketId');
+      }
+
+      const permissions = [...actions].flatMap((action) => ({ permCode: action, userId }));
+
+      await comsAxios().put(`/permission/bucket/${bucketId}`, permissions);
+    } catch (e) {
+      if (axios.isAxiosError(e)) {
+        const detail = e.response?.data.detail;
+        const status = e.response ? e.response.status : 500;
+        throw new Problem(status, { detail }, { extra: { comsError: e.response?.data } });
+      } else {
+        throw new Problem(500, { detail: 'Server Error' });
+      }
+    }
+  }
+};
diff --git a/app/src/services/yars.ts b/app/src/services/yars.ts
@@ -1,7 +1,5 @@
 /* TODO: Create group policy details type and set explicit return types */
-
-import { createBucket } from './coms.ts';
-import { Initiative, GroupName, Action } from '../utils/enums/application.ts';
+import { Initiative, GroupName } from '../utils/enums/application.ts';
 
 import type { PrismaTransactionClient } from '../db/dataConnection.ts';
 import type { Group } from '../types/index.ts';
@@ -10,16 +8,14 @@ import type { Group } from '../types/index.ts';
  * Assigns an identity to the given group
  * Assigns permissions to COMS based on the given group
  * @param tx Prisma transaction client
- * @param bearerToken The bearer token of the authorized user
  * @param sub Subject of the authorized user
  * @param groupId The group ID to add the user to
  * @returns A Promise that resolve to an object with a subject and role id
  */
 export const assignGroup = async (
   tx: PrismaTransactionClient,
-  bearerToken: string | undefined,
   sub: string,
-  groupId?: number
+  groupId: number
 ): Promise<{ sub: string; roleId: number }> => {
   const groupResult = await tx.group.findFirstOrThrow({
     where: {
@@ -34,20 +30,6 @@ export const assignGroup = async (
     }
   });
 
-  const comsPermsMap = new Map<GroupName, Action[]>([
-    [GroupName.PROPONENT, [Action.CREATE]],
-    [GroupName.NAVIGATOR, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
-    [GroupName.NAVIGATOR_READ_ONLY, [Action.READ]],
-    [GroupName.SUPERVISOR, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
-    [GroupName.ADMIN, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]],
-    [GroupName.DEVELOPER, [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE]]
-  ]);
-
-  const comsPerms = comsPermsMap.get(groupResult.name as GroupName);
-  if (comsPerms && bearerToken) {
-    await createBucket(bearerToken, comsPerms);
-  }
-
   return { sub: result.sub, roleId: result.groupId };
 };
 
diff --git a/app/tests/unit/services/coms.spec.ts b/app/tests/unit/services/coms.spec.ts
@@ -1,18 +1,13 @@
 import axios from 'axios';
-import config from 'config';
 
 import * as comsService from '../../../src/services/coms.ts';
-import { Action } from '../../../src/utils/enums/application.ts';
 
 // Mock config library - @see {@link https://stackoverflow.com/a/64819698}
 jest.mock('config');
-let mockedConfig = config as jest.MockedObjectDeep<typeof config>;
-
 jest.mock('axios');
 let mockedAxios = axios as jest.MockedObjectDeep<typeof axios>;
 
 beforeEach(() => {
-  mockedConfig = config as jest.MockedObjectDeep<typeof config>;
   mockedAxios = axios as jest.MockedObjectDeep<typeof axios>;
 
   // Replace any instances with the mocked instance
@@ -28,25 +23,6 @@ afterEach(() => {
   jest.resetAllMocks();
 });
 
-describe('createBucket', () => {
-  it('calls POST /bucket with correct body and returns result', async () => {
-    mockedConfig.get.mockImplementation(() => '');
-    mockedAxios.put.mockResolvedValueOnce({ data: { object: 'ABC' } });
-    const response = await comsService.createBucket('BEARER', [Action.CREATE]);
-
-    expect(mockedAxios.put).toHaveBeenCalledWith('/bucket', {
-      accessKeyId: expect.any(String),
-      bucket: expect.any(String),
-      bucketName: 'PCNS',
-      endpoint: expect.any(String),
-      secretAccessKey: expect.any(String),
-      key: expect.any(String),
-      permCodes: [Action.CREATE]
-    });
-    expect(response).toStrictEqual({ object: 'ABC' });
-  });
-});
-
 describe('getObject', () => {
   it('calls GET /object with correct parameters and returns result', async () => {
     mockedAxios.get.mockResolvedValueOnce({ status: 200, headers: '', data: { object: 'ABC' } });
