Merge pull request #75 from SachiniSiriwardene/login

Add role validation checks and portal settings pages

Author: DivyaPremanantha

.github/workflows/build-and-release.yml

@@ -62,7 +62,7 @@ jobs:
             mkdir -p ./temp-dir/developer-portal
             
             # Copy the additional files and folders into developer-portal
-            cp -r bin artifacts InstallationGuide.md QuickStart.md README.md config.json ./temp-dir/developer-portal/
+            cp -r bin/startup.sh bin/startup.bat artifacts InstallationGuide.md QuickStart.md README.md config.json ./temp-dir/developer-portal/
             
             # Move the current dist file into developer-portal
             mv "$file" ./temp-dir/developer-portal/

artifacts/script.sql

@@ -15,6 +15,15 @@ CREATE TABLE "DP_ORGANIZATION" (
 	"BUSINESS_OWNER" VARCHAR(256) NOT NULL,
 	"BUSINESS_OWNER_CONTACT" VARCHAR(256) NOT NULL,
 	"BUSINESS_OWNER_EMAIL" VARCHAR(256) NOT NULL,
+    "DEV_PORTAL_URL_IDENTIFIER" VARCHAR(255),
+    "ROLE_CLAIM_NAME" VARCHAR(255) NOT NULL,
+    "GROUPS_CLAIM_NAME" VARCHAR(255) NOT NULL,
+    "ORGANIZATION_CLAIM_NAME" VARCHAR(255) NOT NULL,
+    "ORGANIZATION_IDENTIFIER" VARCHAR(255) NOT NULL,
+    "ADMIN_ROLE" VARCHAR(255) NOT NULL,
+    "SUBSCRIBER_ROLE" VARCHAR(255) NOT NULL,
+    "GROUP_CLAIM_NAME" VARCHAR(255) NOT NULL,
+    "SUPER_ADMIN_ROLE" VARCHAR(255) NOT NULL
 	UNIQUE ("ORG_NAME"),
 	PRIMARY KEY("ORG_ID")
 );
@@ -66,6 +75,7 @@ CREATE TABLE "DP_API_METADATA" (
     "PRODUCTION_URL" VARCHAR(256),
     "SANDBOX_URL" VARCHAR(256),
     "METADATA_SEARCH" JSON,
+    "PROVIDER" VARCHAR(256)
     PRIMARY KEY ("API_ID"),
     FOREIGN KEY ("ORG_ID") REFERENCES "DP_ORGANIZATION"("ORG_ID") ON DELETE CASCADE
 );

config.json

@@ -3,19 +3,56 @@
   "pathToContent": "../src/",
   "mode": "production",
   "controlPlane" : {
-    "url": "https://localhost:9443/api/am/devportal/v3",
-    "accessToken" :"Bearer <control-plane-access-token>",
-    "disableCertValidation": false,
+    "url": "https://127.0.0.1:9443/api/am/devportal/v3",
+    "disableCertValidation": true,
     "pathToCertificate": "../api-developer-portal/conf/security/client-truststore.pem"
   },
   "db": {
     "username": "postgres",
     "password": "postgres",
-    "database": "devportal",
+    "database": "DEVPORTAL_NEWSCHEMA",
     "host": "localhost",
     "dialect": "postgres"
   },
   "providerURL": {
     "AWS": "https://aws.amazon.com"
-  }
+  },
+  "identityProvider" : {
+    "name": "IS",
+    "issuer": "https://127.0.0.1:9443/oauth2/token",
+    "authorizationURL": "https://localhost:9443/oauth2/authorize",
+    "tokenURL": "https://127.0.0.1:9443/oauth2/token",
+    "userInfoURL": "https://localhost:9443/oauth2/userinfo",
+    "clientId": "meVRlVAkUoVufXXjN3aUk72PVF8a",
+    "callbackURL": "http://localhost:3000/ACME/callback",
+    "scope": "openid email profile apim:subscribe role",
+    "signUpURL": "",
+    "logoutURL": "https://localhost:9443/oidc/logout",
+    "logoutRedirectURI": "http://localhost:3000/ACME"
+},
+"roleClaim": "roles", 
+"orgIDClaim": "organizationID",
+"groupsClaim": "groups",
+"adminRole": "admin",
+"subscriberRole": "Interna/subscriber",
+"superAdminRole": "superAdmin",
+ "authenticatedPages": [
+    "/*/configure",
+    "/portal",
+    "/*/applications",
+     "/*/applications/*",
+     "/*/api/*",
+     "/*/myAPIs",
+     "/*/myAPIs/*"
+
+  ],
+  "authorizedPages": [
+    "/*/applications",
+    "/*/applications/*",
+    "/*/configure",
+    "/portal",
+    "/*/api/*",
+    "/*/myAPIs",
+    "/*/myAPIs/*"
+  ]
 }

package-lock.json

@@ -33,6 +33,7 @@
     "express": "^4.21.0",
     "express-handlebars": "^7.1.3",
     "express-session": "^1.18.0",
+    "express-validator": "^7.2.0",
     "fs-extra": "^11.2.0",
     "graphiql": "^3.7.1",
     "graphql": "^16.9.0",
@@ -69,15 +70,13 @@
     ],
     "assets": [
       "src/pages/**/*",
-      "src/styles/**/*"
+      "src/styles/**/*",
+      "node_modules/axios/**/*"
     ],
     "targets": [
       "node18-macos-x64",
       "node18-linux-x64",
-      "node18-win-x64",
-      "node18-macos-x86",
-      "node18-linux-x86",
-      "node18-win-x86"
+      "node18-win-x64"
     ],
     "outputPath": "dist"
   },

package.json

@@ -33,6 +33,7 @@ const config = require(process.cwd() + '/config.json');
 const Handlebars = require('handlebars');
 const constants = require("./utils/constants");
 const designRoute = require('./routes/designModeRoute');
+const settingsRoute = require('./routes/configureRoute');
 
 const app = express();
 const secret = crypto.randomBytes(64).toString('hex');
@@ -93,6 +94,7 @@ if (config.mode === constants.DEV_MODE) {
     app.use(constants.ROUTE.DEFAULT, applicationContent);
     app.use(constants.ROUTE.DEFAULT, orgContent);
     app.use(constants.ROUTE.DEFAULT, myAPIs);
+    app.use(constants.ROUTE.DEFAULT, settingsRoute);
     app.use(constants.ROUTE.DEFAULT, customContent);  
 }
 

src/app.js

@@ -51,11 +51,7 @@ const loadAPIs = async (req, res) => {
             html = await renderTemplateFromAPI(templateContent, orgID, orgName, "pages/apis");
         } catch (error) {
             console.error(`Error while loading organization content ,${error}`);
-            console.log("Rendering default api listing page from file");
-            const templateContent = {
-                baseUrl: constants.BASE_URL + config.port
-            }
-            html = renderTemplate(filePrefix + 'pages/apis/page.hbs', filePrefix + 'layout/main.hbs', templateContent, false);
+            return res.redirect('/configure');
         }
     }
     res.send(html);
@@ -137,7 +133,7 @@ const loadAPIContent = async (req, res) => {
 
 const loadSubscriptionPlan = async (req, res, policyId) => {
     try {
-        return await util.invokeApiRequest('GET', `${config.controlPlane.url}/throttling-policies/subscription/${policyId}`);
+        return await util.invokeApiRequest(req, 'GET', `${config.controlPlane.url}/throttling-policies/subscription/${policyId}`);
     } catch (error) {
         console.error("Error occurred while loading subscription plans", error);
         util.handleError(res, error);
@@ -166,7 +162,12 @@ const loadTryOutPage = async (req, res) => {
             const orgID = await adminDao.getOrgId(orgName);
             const apiID = await apiDao.getAPIId(apiName);
             const metaData = await loadAPIMetaData(req, orgID, apiID);
-            let apiDefinition = await apiDao.getAPIFile(constants.FILE_NAME.API_DEFINITION_FILE_NAME, orgID, apiID);
+            let apiDefinition;
+            if (metaData.apiType === "GraphQL") {
+                apiDefinition = await apiDao.getAPIFile(constants.FILE_NAME.API_DEFINITION_GRAPHQL, orgID, apiID);
+            } else {
+                apiDefinition = await apiDao.getAPIFile(constants.FILE_NAME.API_DEFINITION_FILE_NAME, orgID, apiID);
+            }
             apiDefinition = apiDefinition.API_FILE.toString(constants.CHARSET_UTF8);
             const templateContent = {
                 apiMetadata: metaData,

src/controllers/apiContentController.js

@@ -1,3 +1,21 @@
+/*
+ * Copyright (c) 2024, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ *
+ * WSO2 Inc. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/* eslint-disable no-undef */
 const { renderTemplate, renderGivenTemplate, loadLayoutFromAPI, invokeApiRequest } = require('../utils/util');
 const config = require(process.cwd() + '/config');
 const constants = require('../utils/constants');
@@ -33,7 +51,7 @@ const loadApplications = async (req, res) => {
     else {
         const orgName = req.params.orgName;
         const orgID = await orgIDValue(orgName);
-        metaData = await getAPIMApplications();
+        metaData = await getAPIMApplications(req);
         templateContent = {
             applicationsMetadata: metaData,
             baseUrl: '/' + orgName
@@ -51,8 +69,8 @@ async function getMockApplications() {
     return mockApplicationsMetaData.list;
 }
 
-async function getAPIMApplications() {
-    const responseData = await invokeApiRequest('GET', controlPlaneUrl + '/applications', null, null);
+async function getAPIMApplications(req) {
+    const responseData = await invokeApiRequest(req, 'GET', controlPlaneUrl + '/applications', null, null);
     return responseData.list;
 }
 
@@ -71,7 +89,7 @@ const loadThrottlingPolicies = async (req, res) => {
     else {
         const orgName = req.params.orgName;
         const orgID = await orgIDValue(orgName);
-        metaData = await getAPIMThrottlingPolicies();
+        metaData = await getAPIMThrottlingPolicies(req);
         templateContent = {
             throttlingPoliciesMetadata: metaData,
             baseUrl: '/' + orgName
@@ -90,8 +108,8 @@ async function getMockThrottlingPolicies() {
     return mockThrottlingPoliciesMetaData.list;
 }
 
-async function getAPIMThrottlingPolicies() {
-    const responseData = await invokeApiRequest('GET', controlPlaneUrl + '/throttling-policies/application', null, null);
+async function getAPIMThrottlingPolicies(req) {
+    const responseData = await invokeApiRequest(req, 'GET', controlPlaneUrl + '/throttling-policies/application', null, null);
     return responseData.list;
 }
 
@@ -113,9 +131,9 @@ const loadApplication = async (req, res) => {
         } else {
             const orgName = req.params.orgName;
             const orgID = await orgIDValue(orgName);
-            metaData = await getAPIMApplication(applicationId);
-            const allApis = await getAllAPIs();
-            const subApis = await getSubscribedApis(applicationId);
+            metaData = await getAPIMApplication(req, applicationId);
+            const allApis = await getAllAPIs(req);
+            const subApis = await getSubscribedApis(req, applicationId);
             const subApiMap = new Map();
             subApis.list.forEach(subApi => subApiMap.set(subApi.apiId, { policy: subApi.throttlingPolicy, id: subApi.subscriptionId }));
             const apiList = [];
@@ -142,7 +160,7 @@ const loadApplication = async (req, res) => {
 
             });
 
-            kMmetaData = await getAPIMKeyManagers();
+            kMmetaData = await getAPIMKeyManagers(req);
             templateContent = {
                 applicationMetadata: metaData,
                 keyManagersMetadata: kMmetaData,
@@ -162,28 +180,28 @@ const loadApplication = async (req, res) => {
 }
 
 
-async function getAllAPIs() {
+async function getAllAPIs(req) {
     try {
-        return await util.invokeApiRequest('GET', `${controlPlaneUrl}/apis`);
+        return await util.invokeApiRequest(req, 'GET', `${controlPlaneUrl}/apis`);
     } catch (error) {
         console.error("Error occurred while loading APIs", error);
         throw error;
     }
 }
 
-const getSubscribedApis = async (appId) => {
+const getSubscribedApis = async (req, appId) => {
     try {
-        return await util.invokeApiRequest('GET', `${controlPlaneUrl}/subscriptions?applicationId=${appId}`);
+        return await util.invokeApiRequest(req, 'GET', `${controlPlaneUrl}/subscriptions?applicationId=${appId}`);
     } catch (error) {
         console.error("Error occurred while loading subscriptions", error);
         throw error;
     }
 }
 
 const loadApplicationForEdit = async (req, res) => {
-    const orgName = req.params.orgName;
+
     const applicationId = req.params.applicationid;
-    let html, templateContent, metaData;
+    let html, templateContent, metaData, throttlingMetaData;
     if (config.mode === constants.DEV_MODE) {
         metaData = await getMockApplication();
         throttlingMetaData = await getMockThrottlingPolicies();
@@ -196,8 +214,8 @@ const loadApplicationForEdit = async (req, res) => {
     } else {
         const orgName = req.params.orgName;
         const orgID = await orgIDValue(orgName);
-        metaData = await getAPIMApplication(applicationId);
-        throttlingMetaData = await getAPIMThrottlingPolicies();
+        metaData = await getAPIMApplication(req, applicationId);
+        throttlingMetaData = await getAPIMThrottlingPolicies(req);
         templateContent = {
             applicationMetadata: metaData,
             throttlingPoliciesMetadata: throttlingMetaData,
@@ -223,13 +241,13 @@ async function getMockKeyManagers() {
     return mockKeyManagersMetaData.list;
 }
 
-async function getAPIMApplication(applicationId) {
-    const responseData = await invokeApiRequest('GET', controlPlaneUrl + '/applications/' + applicationId, null, null);
+async function getAPIMApplication(req, applicationId) {
+    const responseData = await invokeApiRequest(req, 'GET', controlPlaneUrl + '/applications/' + applicationId, null, null);
     return responseData;
 }
 
-async function getAPIMKeyManagers() {
-    const responseData = await invokeApiRequest('GET', controlPlaneUrl + '/key-managers', null, null);
+async function getAPIMKeyManagers(req) {
+    const responseData = await invokeApiRequest(req, 'GET', controlPlaneUrl + '/key-managers', null, null);
     return responseData.list;
 }