Merge pull request #525 from energywebfoundation/task/ICL-253_authori…

…ze_issuer task/ICL-253 authorize issuer
energywebfoundation · Apr 20, 2022 · d3d1a67 · d3d1a67
2 parents ee0bfe4 + b55c86b
commit d3d1a67
Show file tree

Hide file tree

Showing 6 changed files with 72 additions and 0 deletions.
diff --git a/docs/api/classes/NotAuthorizedIssuer.md b/docs/api/classes/NotAuthorizedIssuer.md
@@ -0,0 +1,30 @@
+# Class: NotAuthorizedIssuer
+
+## Hierarchy
+
+- `Error`
+
+  ↳ **`NotAuthorizedIssuer`**
+
+## Table of contents
+
+### Constructors
+
+- [constructor](NotAuthorizedIssuer.md#constructor)
+
+## Constructors
+
+### constructor
+
+• **new NotAuthorizedIssuer**(`issuer`, `role`)
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `issuer` | `string` |
+| `role` | `string` |
+
+#### Overrides
+
+Error.constructor
diff --git a/docs/api/modules.md b/docs/api/modules.md
@@ -32,6 +32,7 @@
 - [MalformedDIDError](classes/MalformedDIDError.md)
 - [MessagingService](classes/MessagingService.md)
 - [MethodNotAvailableInNodeEnvError](classes/MethodNotAvailableInNodeEnvError.md)
+- [NotAuthorizedIssuer](classes/NotAuthorizedIssuer.md)
 - [SignerService](classes/SignerService.md)
 - [StakingFactoryService](classes/StakingFactoryService.md)
 - [StakingPoolService](classes/StakingPoolService.md)

diff --git a/e2e/claims.service.e2e.ts b/e2e/claims.service.e2e.ts
@@ -91,6 +91,7 @@ const mockGetClaimsBySubject = jest.fn();
 const mockRequestClaim = jest.fn();
 const mockIssueClaim = jest.fn();
 const mockRejectClaim = jest.fn();
+const mockGetAllowedRoles = jest.fn();
 jest.mock('../src/modules/cache-client/cache-client.service', () => {
   return {
     CacheClient: jest.fn().mockImplementation(() => {
@@ -105,6 +106,7 @@ jest.mock('../src/modules/cache-client/cache-client.service', () => {
         requestClaim: mockRequestClaim,
         issueClaim: mockIssueClaim,
         rejectClaim: mockRejectClaim,
+        getAllowedRolesByIssuer: mockGetAllowedRoles,
       };
     }),
   };
@@ -162,6 +164,26 @@ describe('Enrollment claim tests', () => {
       returnSteps: false,
     });
     ({ didRegistry, claimsService } = await connectToDidRegistry());
+    mockGetAllowedRoles.mockImplementation(async (issuer) => {
+      const roleDefs = Object.values(roles);
+      const isRoleIssuerOfRole = await Promise.all(
+        roleDefs.map(
+          (r) =>
+            r.issuer.roleName &&
+            claimsService.hasOnChainRole(issuer, r.issuer.roleName, version)
+        )
+      );
+      const allowedRoles = roleDefs
+        .filter((r, i) => {
+          return (
+            (r.issuer.issuerType === 'DID' && r.issuer.did?.includes(issuer)) ||
+            (r.issuer.issuerType === 'ROLE' && isRoleIssuerOfRole[i])
+          );
+        })
+        .map((r) => ({ ...r, namespace: `${r.roleName}.${root}` }));
+
+      return allowedRoles;
+    });
     Reflect.set(didRegistry, '_cacheClient', undefined);
     setLogger(new ConsoleLogger(LogLevel.warn));
   });

diff --git a/src/errors/index.ts b/src/errors/index.ts
@@ -5,3 +5,4 @@ export { DeletingNamespaceNotPossibleError } from './deleting-namespace-not-poss
 export { ENSOwnerNotValidAddressError } from './ens-owner-not-valid-address.error';
 export { ERROR_MESSAGES } from './error-messages';
 export { MalformedDIDError } from './malformed-did.error';
+export { NotAuthorizedIssuer } from './not-authorized-issuer';
diff --git a/src/errors/not-authorized-issuer.ts b/src/errors/not-authorized-issuer.ts
@@ -0,0 +1,5 @@
+export class NotAuthorizedIssuer extends Error {
+  constructor(issuer: string, role: string) {
+    super(`${issuer} is not authorized to issue ${role}`);
+  }
+}
diff --git a/src/modules/claims/claims.service.ts b/src/modules/claims/claims.service.ts
@@ -40,6 +40,7 @@ import { JWT } from '@ew-did-registry/jwt';
 import { privToPem, KeyType } from '@ew-did-registry/keys';
 import { readyToBeRegisteredOnchain } from './claims.types';
 import { VerifiableCredentialsServiceBase } from '../verifiable-credentials';
+import { NotAuthorizedIssuer } from '../../errors/not-authorized-issuer';
 
 const {
   id,
@@ -257,6 +258,7 @@ export class ClaimsService {
       claimData: { claimType: string; claimTypeVersion: number };
       sub: string;
     };
+    await this.verifyIssuer(claimData.claimType);
 
     await this.verifyEnrolmentPrerequisites({
       subject: sub,
@@ -447,6 +449,7 @@ export class ClaimsService {
       issuerFields: { key: string; value: string | number }[];
     };
   }) {
+    await this.verifyIssuer(claim.claimType);
     await this.verifyEnrolmentPrerequisites({ subject, role: claim.claimType });
 
     const message: IClaimIssuance = {
@@ -697,6 +700,16 @@ export class ClaimsService {
     }
   }
 
+  private async verifyIssuer(role: string) {
+    if (
+      !(
+        await this._cacheClient.getAllowedRolesByIssuer(this._signerService.did)
+      ).some((r) => r.namespace === role)
+    ) {
+      throw new NotAuthorizedIssuer(this._signerService.did, role);
+    }
+  }
+
   private async createOnChainProof(
     role: string,
     version: number,