Fixes #98 and #258. **Breaking — major release.** Per the decisions in those threads: `My` means the resource's customer is the caller, `Others` means a different customer in the same business unit, all 47 permissions are modelled, and both scopes fail closed. ## What changed **`/me`** answers for the customer or anonymous session the bearer token was issued for. No token → `403 insufficient_scope`. Someone else's resource → `404`, not a leak. Resources created through `/me` are stamped with the caller so they can be read back. That closes the case @korsvanloon described in #98: `MyOrderService` inherited `getWithId` from `AbstractService` and resolved straight out of the repository, so `/me/orders/{id}` and the in-store variant returned any order. Both are covered by tests now. **`as-associate`** resolves the associate named in the path against the business unit named in the path, collects the permissions of their AssociateRoles, and enforces them: - List with only the `My` permission is **narrowed** to the caller rather than refused — that is what commercetools does, and refusing would be surprising. - Anything else missing → `403 AssociateMissingPermission`, carrying the `permissions` that would have sufficed and using commercetools' message shape. - A resource of another business unit → `404`. - Quotes have no blanket update permission, so they are policed per action: `changeQuoteState: Accepted` needs `AcceptMy/OthersQuotes`, `Declined` needs `Decline…`, `requestQuoteRenegotiation` needs `Renegotiate…`, `changeCustomer` needs `Reassign…`. Business units are the same shape: `UpdateAssociates` / `UpdateParentUnit` / `UpdateBusinessUnitDetails` per action. - `/as-associate/{id}/business-units` is the one resource outside `in-business-unit/key=`, so it checks against the unit in the resource: the list is narrowed to units the caller is an associate of. The full table lives in `src/associate-permissions.ts`, one place to check the mapping against the docs. ## The one design call worth flagging Identity resolution is now **independent of `enableAuthentication`**. The oauth middleware always runs and reads the identity out of a token the mock issued; only *enforcement* stays behind `validateCredentials`. Without this, scoping would be unreachable with the default options (the middleware was only installed when authentication was on), so `/me` would 403 with no way to authenticate. ## Adjacent fixes, needed for the scopes to work at all - `POST /oauth/{projectKey}/anonymous/token` honours a supplied `anonymous_id` instead of always generating one. - `PaymentDraft.customer` / `anonymousId` are stored — they were dropped, so a `/me` payment could not belong to anyone. - An order and a quote request created from a cart carry the cart's `businessUnit`, otherwise they fell outside the scope that created them. - `GET /me/active-cart` answers for the caller instead of returning the first active cart in the project. - `MyCustomerRepository.getMe`/`deleteMe` use the token's customer instead of "grab the first customer you can find for now", which is what the code said it was doing. ## Migration Tests calling these endpoints now have to say who is calling, so the testing helpers are exported as a new `@labdigital/commercetools-mock/testing` entrypoint: ```typescript import { createAssociateScope, customerSession } from '@labdigital/commercetools-mock/testing' const { headers } = customerSession(ctMock, customer.id) await ctMock.app.inject({ method: 'GET', url: '/my-project/me/orders', headers }) const scope = await createAssociateScope(ctMock, { permissions: ['ViewMyCarts'] }) await ctMock.app.inject({ method: 'GET', url: `${scope.basePath}/carts` }) ``` `loginCustomer` goes through the password grant when you want to exercise sign-in; `anonymousSession` starts an anonymous one. The authentication docs page has a new "Scoped endpoints" section, and the stale bullet saying `/me` ignores the token's `customer_id` is gone. ## Coverage Every existing `/me` and associate test was rewritten against the new semantics, plus new ones for the cases that used to pass vacuously: a colleague's cart refused, a list narrowed by `ViewMy…`, a list covering the unit with `ViewOthers…`, another unit's resource 404, a non-associate refused, an unknown business unit 404, per-action quote permissions, `/me` without a token, another customer's order 404 (id and in-store), and an anonymous session seeing only its own orders. 861 tests passing. One unrelated test needed a fix: `custom-object.test.ts` had an unawaited `unsafeAdd` and only passed because the read raced ahead of the write. The extra middleware changed the timing and exposed it.

Uh oh!

Implement asAssociate() methods #258

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions