feat: list and ability to delete psa request created though deleted tokens

packages/api/src/index.js

@@ -21,7 +21,8 @@ import {
   userUploadsDelete,
   userUploadGet,
   userUploadsGet,
-  userUploadsRename
+  userUploadsRename,
+  userPinDelete
 } from './user.js'
 import { pinDelete, pinGet, pinPost, pinsGet } from './pins.js'
 import { blogSubscriptionCreate } from './blog.js'
@@ -109,6 +110,7 @@ router.delete('/user/tokens/:id',        auth['👤🗑️'](userTokensDelete))
 router.get('/user/account',              auth['👤'](userAccountGet))
 router.get('/user/info',                 auth['👤'](userInfoGet))
 router.get('/user/pins',                 auth['📌⚠️'](userPinsGet))
+router.delete('/user/pins/:requestId',   auth['👤🗑️'](userPinDelete))
 router.get('/user/payment',              auth['👤'](userPaymentGet))
 router.put('/user/payment',              auth['👤'](userPaymentPut))
 

packages/api/src/pins.js

@@ -226,7 +226,7 @@ export async function pinDelete (request, env, ctx) {
 
   try {
     // Update deleted_at (and updated_at) timestamp for the pin request.
-    await env.db.deletePsaPinRequest(requestId, authToken._id)
+    await env.db.deletePsaPinRequest(requestId, [authToken._id])
   } catch (e) {
     console.error(e)
     throw new PSAErrorResourceNotFound()
@@ -265,7 +265,7 @@ async function replacePin (normalizedCid, newPinData, requestId, authTokenId, en
   }
 
   try {
-    await env.db.deletePsaPinRequest(requestId, authTokenId)
+    await env.db.deletePsaPinRequest(requestId, [authTokenId])
   } catch (e) {
     console.error(e)
     throw new PSAErrorDB()

packages/api/src/user.js

@@ -1,7 +1,7 @@
 import * as JWT from './utils/jwt.js'
 import { JSONResponse, notFound } from './utils/json-response.js'
 import { JWT_ISSUER } from './constants.js'
-import { HTTPError, RangeNotSatisfiableError } from './errors.js'
+import { HTTPError, PSAErrorInvalidData, PSAErrorRequiredData, PSAErrorResourceNotFound, RangeNotSatisfiableError } from './errors.js'
 import { getTagValue, hasPendingTagProposal, hasTag } from './utils/tags.js'
 import {
   NO_READ_OR_WRITE,
@@ -11,7 +11,7 @@ import {
 } from './maintenance.js'
 import { pagination } from './utils/pagination.js'
 import { toPinStatusResponse } from './pins.js'
-import { validateSearchParams } from './utils/psa.js'
+import { INVALID_REQUEST_ID, REQUIRED_REQUEST_ID, validateSearchParams } from './utils/psa.js'
 import { magicLinkBypassForE2ETestingInTestmode } from './magic.link.js'
 import { CustomerNotFound, getPaymentSettings, initializeBillingForNewUser, isStoragePriceName, savePaymentSettings } from './utils/billing.js'
 
@@ -315,7 +315,6 @@ export async function userRequestPost (request, env) {
  * @param {import('./env').Env} env
  */
 export async function userTokensGet (request, env) {
-  // @ts-ignore
   const tokens = await env.db.listKeys(request.auth.user._id)
 
   return new JSONResponse(tokens)
@@ -514,8 +513,7 @@ export async function userPinsGet (request, env) {
     throw psaParams.error
   }
 
-  // @ts-ignore
-  const tokens = (await env.db.listKeys(request.auth.user._id)).map((key) => key._id)
+  const tokens = (await env.db.listKeys(request.auth.user._id, { includeDeleted: true })).map((key) => key._id)
 
   let pinRequests
 
@@ -569,6 +567,42 @@ export async function userPinsGet (request, env) {
   }, { headers })
 }
 
+/**
+ *  List a user's pins regardless of the token used.
+ *  As we don't want to scope the Pinning Service API to users
+ *  we need a new endpoint as an umbrella.
+ *
+ * @param {import('./user').AuthenticatedRequest} request
+ * @param {import('./env').Env} env
+ * @param {import('./index').Ctx} ctx
+ * @return {Promise<JSONResponse>}
+ */
+export async function userPinDelete (request, env, ctx) {
+  // @ts-ignore
+  const requestId = request.params?.requestId
+
+  if (!requestId) {
+    throw new PSAErrorRequiredData(REQUIRED_REQUEST_ID)
+  }
+
+  if (typeof requestId !== 'string') {
+    throw new PSAErrorInvalidData(INVALID_REQUEST_ID)
+  }
+
+  // TODO: Improve me, it is un-optimal to get the tokens in a separate request to the db.
+  const tokens = (await env.db.listKeys(request.auth.user._id, { includeDeleted: true })).map((key) => key._id)
+
+  try {
+    // Update deleted_at (and updated_at) timestamp for the pin request.
+    await env.db.deletePsaPinRequest(requestId, tokens)
+  } catch (e) {
+    console.error(e)
+    throw new PSAErrorResourceNotFound()
+  }
+
+  return new JSONResponse({}, { status: 202 })
+}
+
 /**
  * @param {string} userProposalForm
  * @param {string} tagName

packages/api/test/fixtures/init-data.sql

@@ -70,8 +70,8 @@ VALUES  (6, 'test-pinning-and-restriction', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ
         (7, 'test-restriction', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0LXJlc3RyaWN0aW9uIiwiaXNzIjoid2ViMy1zdG9yYWdlIiwiaWF0IjoxNjMzOTU3Mzg5ODcyLCJuYW1lIjoidGVzdC1yZXN0cmljdGlvbiJ9.uAklG7dHOxRD85c564RBcBqeFGUGNBper7VLaXBGnFg', 10000000000000007);
 
 -- Used to test pinning from an existing user with a different token
-INSERT INTO auth_key (id, name, secret, user_id)
-VALUES (8, 'test-pinning-b', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0LXBpbm5pbmctYiIsImlzcyI6IndlYjMtc3RvcmFnZSIsImlhdCI6MTYzMzk1NzM4OTg3MiwibmFtZSI6InRlc3QtcGlubmluZy1iIn0.B2qeE5mHW93saJx-Nu8p8Io_z7_3VRaHoBAVxPbCP5c', 10000000000000004);
+INSERT INTO auth_key (id, name, secret, user_id, deleted_at)
+VALUES (8, 'test-pinning-b', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0LXBpbm5pbmctYiIsImlzcyI6IndlYjMtc3RvcmFnZSIsImlhdCI6MTYzMzk1NzM4OTg3MiwibmFtZSI6InRlc3QtcGlubmluZy1iIn0.B2qeE5mHW93saJx-Nu8p8Io_z7_3VRaHoBAVxPbCP5c', 10000000000000004, '2021-07-14T19:27:14.934572+00:00');
 
 -- Reset the primary key next value
 SELECT pg_catalog.setval(pg_get_serial_sequence('auth_key', 'id'), MAX(id)) FROM auth_key;

packages/api/test/user.spec.js

@@ -417,6 +417,8 @@ describe('GET /user/pins', () => {
 
     assert(res.ok)
     const body = await res.json()
+
+    // one of the auth tokens is deleted, but the request should still appear in the list.
     assert.equal([...new Set(body.results.map(x => x.pin.authKey))].length, 2)
   })
 })

packages/db/db-client-types.ts

@@ -353,3 +353,7 @@ export type LogEmailSentInput = {
   emailType: string,
   messageId: string
 }
+
+export type ListKeysOptions = {
+  includeDeleted: boolean
+}

packages/db/index.d.ts

@@ -31,6 +31,7 @@ import type {
   EmailSentInput,
   LogEmailSentInput,
   GetUserOptions,
+  ListKeysOptions,
 } from './db-client-types'
 
 export class DBClient {
@@ -60,12 +61,12 @@ export class DBClient {
   getDealsForCids (cids: string[]): Promise<Record<string, Deal[]>>
   createKey (key: CreateAuthKeyInput): Promise<CreateAuthKeyOutput>
   getKey (issuer: string, secret: string): Promise<AuthKey>
-  listKeys (userId: number): Promise<Array<AuthKeyItemOutput>>
+  listKeys (userId: string, opts?: ListKeysOptions): Promise<Array<AuthKeyItemOutput>>
   createPsaPinRequest (pinRequest: PsaPinRequestUpsertInput): Promise<PsaPinRequestUpsertOutput>
   getPsaPinRequest (authKey: string, pinRequestId: string) : Promise<PsaPinRequestUpsertOutput>
   listPsaPinRequests (authKey: string, opts?: ListPsaPinRequestOptions ) : Promise<ListPsaPinRequestResults>
-  deletePsaPinRequest (pinRequestId: string, authKey: string) : Promise<PsaPinRequestItem>
-  deleteKey (id: number): Promise<void>
+  deletePsaPinRequest (pinRequestId: string, authKey: Array<string>) : Promise<PsaPinRequestItem>
+  deleteKey (userId: number, keyId: number): Promise<void>
   query<T, V>(document: RequestDocument, variables: V): Promise<T>
   createUserTag(userId: string, tag: UserTagInput): Promise<boolean>
   getUserTags(userId: string): Promise<UserTagInfo[]>

packages/db/index.js

@@ -1004,13 +1004,15 @@ export class DBClient {
   /**
    * List auth keys of a given user.
    *
-   * @param {number} userId
+   * @param {string} userId
+   * @param {import('./db-client-types').ListKeysOptions} opts
    * @return {Promise<Array<import('./db-client-types').AuthKeyItemOutput>>}
    */
-  async listKeys (userId) {
+  async listKeys (userId, { includeDeleted } = { includeDeleted: false }) {
     /** @type {{ error: PostgrestError, data: Array<import('./db-client-types').AuthKeyItem> }} */
     const { data, error } = await this._client.rpc('user_auth_keys_list', {
-      query_user_id: userId
+      query_user_id: userId,
+      include_deleted: includeDeleted
     })
 
     if (error) {
@@ -1244,9 +1246,9 @@ export class DBClient {
    * Delete a user PA pin request.
    *
    * @param {number} requestId
-   * @param {string} authKey
+   * @param {string[]} authKeys
    */
-  async deletePsaPinRequest (requestId, authKey) {
+  async deletePsaPinRequest (requestId, authKeys) {
     const date = new Date().toISOString()
     /** @type {{ data: import('./db-client-types').PsaPinRequestItem, error: PostgrestError }} */
     const { data, error } = await this._client
@@ -1255,7 +1257,8 @@ export class DBClient {
         deleted_at: date,
         updated_at: date
       })
-      .match({ auth_key_id: authKey, id: requestId })
+      .match({ id: requestId })
+      .in('auth_key_id', authKeys)
       .filter('deleted_at', 'is', null)
       .single()
 

packages/db/postgres/functions.sql

@@ -356,7 +356,7 @@ BEGIN
 END
 $$;
 
-CREATE OR REPLACE FUNCTION user_auth_keys_list(query_user_id BIGINT)
+CREATE OR REPLACE FUNCTION user_auth_keys_list(query_user_id BIGINT, include_deleted BOOLEAN default false)
   RETURNS TABLE
           (
               "id"                text,
@@ -374,7 +374,8 @@ SELECT (ak.id)::TEXT AS id,
        ak.inserted_at AS created,
        EXISTS(SELECT 42 FROM upload u WHERE u.auth_key_id = ak.id) AS has_uploads
   FROM auth_key ak
- WHERE ak.user_id = query_user_id AND ak.deleted_at IS NULL
+ WHERE ak.user_id = query_user_id AND 
+  (include_deleted OR ak.deleted_at IS NULL)
 $$;
 
 CREATE OR REPLACE FUNCTION find_deals_by_content_cids(cids text[])

packages/db/postgres/migrations/028-update-list-keys.sql

@@ -0,0 +1,23 @@
+DROP FUNCTION IF EXISTS user_auth_keys_list;
+
+CREATE OR REPLACE FUNCTION user_auth_keys_list(query_user_id BIGINT, include_deleted BOOLEAN default false)
+  RETURNS TABLE
+          (
+              "id"                text,
+              "name"              text,
+              "secret"            text,
+              "created"           timestamptz,
+              "has_uploads"           boolean
+          )
+  LANGUAGE sql
+AS
+$$
+SELECT (ak.id)::TEXT AS id,
+       ak.name AS name,
+       ak.secret AS secret,
+       ak.inserted_at AS created,
+       EXISTS(SELECT 42 FROM upload u WHERE u.auth_key_id = ak.id) AS has_uploads
+  FROM auth_key ak
+ WHERE ak.user_id = query_user_id AND 
+  (include_deleted OR ak.deleted_at IS NULL)
+$$;