Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
async function auth (ctx: ServiceContext, authArgs: AuthDirectiveArgs): Promise {
const vtexIdToken = ctx.cookies.get('VtexIdclientAutCookie') || ctx.get('VtexIdclientAutCookie')
if (!vtexIdToken) {
throw new ForbiddenError('VtexIdclientAutCookie not found.')
}
const userEmail = await getUserEmail(ctx.vtex.authToken, vtexIdToken)
if (!userEmail) {
throw new ForbiddenError('Could not find user specified by VtexIdclientAutCookie.')
}
const userCanAccessResource = await getUserCanAccessResource(ctx.vtex.authToken, ctx.vtex.account, userEmail, authArgs.productCode, authArgs.resourceCode)
if (!userCanAccessResource) {
throw new ForbiddenError('User indicated by VtexIdclientAutCookie is not authorized to access the indicated resource.')
}
}
async function auth (ctx: ServiceContext, authArgs: AuthDirectiveArgs): Promise {
const vtexIdToken = ctx.cookies.get('VtexIdclientAutCookie') || ctx.get('VtexIdclientAutCookie')
if (!vtexIdToken) {
throw new ForbiddenError('VtexIdclientAutCookie not found.')
}
const userEmail = await getUserEmail(ctx.vtex.authToken, vtexIdToken)
if (!userEmail) {
throw new ForbiddenError('Could not find user specified by VtexIdclientAutCookie.')
}
const userCanAccessResource = await getUserCanAccessResource(ctx.vtex.authToken, ctx.vtex.account, userEmail, authArgs.productCode, authArgs.resourceCode)
if (!userCanAccessResource) {
throw new ForbiddenError('User indicated by VtexIdclientAutCookie is not authorized to access the indicated resource.')
}
}
async function auth (ctx: ServiceContext, authArgs: AuthDirectiveArgs): Promise {
const vtexIdToken = ctx.cookies.get('VtexIdclientAutCookie') || ctx.get('VtexIdclientAutCookie')
if (!vtexIdToken) {
throw new ForbiddenError('VtexIdclientAutCookie not found.')
}
const userEmail = await getUserEmail(ctx.vtex.authToken, vtexIdToken)
if (!userEmail) {
throw new ForbiddenError('Could not find user specified by VtexIdclientAutCookie.')
}
const userCanAccessResource = await getUserCanAccessResource(ctx.vtex.authToken, ctx.vtex.account, userEmail, authArgs.productCode, authArgs.resourceCode)
if (!userCanAccessResource) {
throw new ForbiddenError('User indicated by VtexIdclientAutCookie is not authorized to access the indicated resource.')
}
}
async channelEvent(
@Args({ name: 'channelId', type: () => ID }) channelId: string,
@CurrentUser() user?: TokenUserInfo
) {
const channel = throwApolloError(await this.channelService.findById(channelId));
if (!channel.isPublic) {
if (!user) {
throw new ForbiddenError('You are not logged in');
}
const member = this.channelService.getRootMember(channel, user.id);
if (!member) {
this.logger.warn(`[Forbidden] A user (${user.id}) attempt to subscribe a channel that they does not joined.`);
throw new ForbiddenError('You are not a member of this channel.');
}
}
return pubSub.asyncIterator(await this.eventService.getTriggerId(channelId));
}
}
async channelEvent(
@Args({ name: 'channelId', type: () => ID }) channelId: string,
@CurrentUser() user?: TokenUserInfo
) {
const channel = throwApolloError(await this.channelService.findById(channelId));
if (!channel.isPublic) {
if (!user) {
throw new ForbiddenError('You are not logged in');
}
const member = this.channelService.getRootMember(channel, user.id);
if (!member) {
this.logger.warn(`[Forbidden] A user (${user.id}) attempt to subscribe a channel that they does not joined.`);
throw new ForbiddenError('You are not a member of this channel.');
}
}
return pubSub.asyncIterator(await this.eventService.getTriggerId(channelId));
}
}