diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml index a26efbb70a..997b3d00a0 100644 --- a/common/config/rush/pnpm-lock.yaml +++ b/common/config/rush/pnpm-lock.yaml @@ -6196,7 +6196,7 @@ packages: version: 0.0.0 '@rush-temp/tests-sanity@file:projects/tests-sanity.tgz': - resolution: {integrity: sha512-oAaYl2IO0i1GSSbO6rLxbZOnmAxl3tMQ8mLLe5A3lWMu7eXTFnt6arzUxNixChALxKiO9eCbA1KWpvutJ3dDEw==, tarball: file:projects/tests-sanity.tgz} + resolution: {integrity: sha512-6MzoRP9tBpHv4XkiFFo6bGdKNfW9tAmXZxiPTXHunGc/BIgxEiUqvYlBi28EMp1oYsJWg2s6t4up1hin0sqIFA==, tarball: file:projects/tests-sanity.tgz} version: 0.0.0 '@rush-temp/tests-ws-sanity@file:projects/tests-ws-sanity.tgz': @@ -34129,6 +34129,7 @@ snapshots: '@hcengineering/client-resources': 0.7.6 '@hcengineering/core': 0.7.7 '@hcengineering/platform-rig': 0.7.19(@babel/core@7.23.9)(postcss-load-config@4.0.2(postcss@8.5.3)(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.15.29)(typescript@5.9.3)))(postcss@8.5.3)(sass@1.93.2)(ts-node@10.9.2(@swc/core@1.13.5)(@types/node@22.15.29)(typescript@5.9.3)) + '@hcengineering/server-token': 0.7.5 '@playwright/test': 1.49.1 '@types/jest': 29.5.12 '@types/node': 22.15.29 diff --git a/dev/tool/src/github.ts b/dev/tool/src/github.ts index 973f940bc6..ad18191747 100644 --- a/dev/tool/src/github.ts +++ b/dev/tool/src/github.ts @@ -54,7 +54,7 @@ export async function performGithubAccountMigrations ( txes: Tx[], region: string | null ): Promise { - const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' }) + const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' }) const githubToken = generateToken(systemAccountUuid, undefined, { service: 'github' }) const accountClient = getAccountClient(token) diff --git a/dev/tool/src/gmail.ts b/dev/tool/src/gmail.ts index 400290645c..76756ba2b4 100644 --- a/dev/tool/src/gmail.ts +++ b/dev/tool/src/gmail.ts @@ -79,7 +79,7 @@ export async function performGmailAccountMigrations ( txes: Tx[] ): Promise { console.log('Start Gmail migrations') - const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' }) + const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' }) const accountClient = getAccountClient(token) const allWorkpaces = await accountClient.listWorkspaces(region) diff --git a/dev/tool/src/markup.ts b/dev/tool/src/markup.ts index f032f4b2df..6c98c4d9a7 100644 --- a/dev/tool/src/markup.ts +++ b/dev/tool/src/markup.ts @@ -378,7 +378,7 @@ export async function restoreMarkupRefs ( storageAdapter: StorageAdapter, region: string | null ): Promise { - const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' }) + const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' }) const ctx = new MeasureMetricsContext('restore-markup-ref', {}) const accountClient = getAccountClient(token) diff --git a/dev/tool/src/restoreGithub.ts b/dev/tool/src/restoreGithub.ts index 51cf67998f..5da6fd95d5 100644 --- a/dev/tool/src/restoreGithub.ts +++ b/dev/tool/src/restoreGithub.ts @@ -16,7 +16,7 @@ export async function restoreGithubIntegrations (dbUrl: string, dryrun: boolean) try { const pg = getDBClient(dbUrl) const pgClient = await pg.getClient() - const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' }) + const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' }) const accountClient = getAccountClient(token) const integrationSettings = await pgClient< diff --git a/server/account/src/__tests__/utils.test.ts b/server/account/src/__tests__/utils.test.ts index 79563c3da3..311c745eda 100644 --- a/server/account/src/__tests__/utils.test.ts +++ b/server/account/src/__tests__/utils.test.ts @@ -1686,15 +1686,6 @@ describe('account utils', () => { }).not.toThrow() }) - test('should not throw for admin', () => { - const services = ['service1'] - const extra = { service: 'service2', admin: 'true' } - - expect(() => { - verifyAllowedServices(services, extra) - }).not.toThrow() - }) - test('should throw for unauthorized service', () => { const services = ['service1'] const extra = { service: 'service2' } diff --git a/server/account/src/serviceOperations.ts b/server/account/src/serviceOperations.ts index 0c8c727690..f8c4cc793e 100644 --- a/server/account/src/serviceOperations.ts +++ b/server/account/src/serviceOperations.ts @@ -585,10 +585,12 @@ export async function addSocialIdToPerson ( const { person, type, value, confirmed, displayValue } = params const { extra } = decodeTokenVerbose(ctx, token) - verifyAllowedServices( - ['github', 'telegram-bot', 'gmail', 'tool', 'workspace', 'hulygram', 'google-calendar', 'ai-assistant'], - extra - ) + if (extra?.admin !== 'true') { + verifyAllowedServices( + ['github', 'telegram-bot', 'gmail', 'tool', 'workspace', 'hulygram', 'google-calendar', 'ai-assistant'], + extra + ) + } if (person == null || person === '' || !Object.values(SocialIdType).includes(type) || value == null || value === '') { throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {})) diff --git a/server/account/src/utils.ts b/server/account/src/utils.ts index be57d2712e..d75fadbfa9 100644 --- a/server/account/src/utils.ts +++ b/server/account/src/utils.ts @@ -1536,7 +1536,7 @@ export async function getWorkspaces ( } export function verifyAllowedServices (services: string[], extra: any, shouldThrow = true): boolean { - const ok = services.includes(extra?.service) || extra?.admin === 'true' + const ok = services.includes(extra?.service) if (!ok && shouldThrow) { throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {})) @@ -1811,7 +1811,8 @@ export const integrationServices = [ 'gmail', 'google-calendar', 'huly-mail', - 'ai-assistant' + 'ai-assistant', + 'tool' ] export async function findExistingIntegration ( diff --git a/tests/sanity/package.json b/tests/sanity/package.json index aeb8acb908..f569d9cb8b 100644 --- a/tests/sanity/package.json +++ b/tests/sanity/package.json @@ -52,6 +52,7 @@ "@hcengineering/core": "^0.7.7", "@hcengineering/client-resources": "^0.7.6", "@hcengineering/account": "^0.7.0", - "@hcengineering/account-client": "^0.7.5" + "@hcengineering/account-client": "^0.7.5", + "@hcengineering/server-token": "^0.7.5" } } diff --git a/tests/sanity/tests/API/AccountClient.ts b/tests/sanity/tests/API/AccountClient.ts index 229096fe16..59768ceb03 100644 --- a/tests/sanity/tests/API/AccountClient.ts +++ b/tests/sanity/tests/API/AccountClient.ts @@ -1,5 +1,7 @@ import { getClient as getClientRaw, type AccountClient } from '@hcengineering/account-client' import { LocalUrl, PlatformAdmin } from '../utils' +import { systemAccountUuid } from '@hcengineering/core' +import { generateToken } from '@hcengineering/server-token' let adminAccountClient: AccountClient @@ -18,3 +20,8 @@ export async function getAdminAccountClient (): Promise { adminAccountClient = getClientRaw(LocalUrl, loginInfo.token) return adminAccountClient } + +export async function getServiceAccountClient (serviceName: string): Promise { + const token = generateToken(systemAccountUuid, undefined, { service: serviceName }, 'secret') + return getClientRaw(LocalUrl, token) +} diff --git a/tests/sanity/tests/integrations.spec.ts b/tests/sanity/tests/integrations.spec.ts index ecd6096e05..f84a1d9a13 100644 --- a/tests/sanity/tests/integrations.spec.ts +++ b/tests/sanity/tests/integrations.spec.ts @@ -4,11 +4,11 @@ import { Integration, IntegrationSecret } from '@hcengineering/account' import { buildSocialIdString, IntegrationKind, SocialIdType } from '@hcengineering/core' import { PlatformUser } from './utils' -import { getAdminAccountClient } from './API/AccountClient' +import { getServiceAccountClient } from './API/AccountClient' test.describe('integrations in accounts tests', () => { test('manage integrations', async () => { - const accountClient = await getAdminAccountClient() + const accountClient = await getServiceAccountClient('github') const personUuid = await accountClient.findPersonBySocialKey( buildSocialIdString({ type: SocialIdType.EMAIL, value: PlatformUser }) diff --git a/ws-tests/api-tests/src/__tests__/rest.test.ts b/ws-tests/api-tests/src/__tests__/rest.test.ts index a07daf2af6..ef7e10e6fc 100644 --- a/ws-tests/api-tests/src/__tests__/rest.test.ts +++ b/ws-tests/api-tests/src/__tests__/rest.test.ts @@ -75,7 +75,7 @@ describe('rest-api-server', () => { accountClient = getAccountClient(config.ACCOUNTS_URL, apiWorkspace1.token) adminAccountClient = getAccountClient( config.ACCOUNTS_URL, - generateToken(systemAccountUuid, undefined, { admin: 'true' }, 'secret') + generateToken(systemAccountUuid, undefined, { service: 'workspace', admin: 'true' }, 'secret') ) const person = await accountClient.getPerson() const socialIds: SocialId[] = await accountClient.getSocialIds(true)