fix(api-scheduler): gate scheduler access on each app's own permissions

packages/api-headless-cms-scheduler/__tests__/schedulerPermissions.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, it } from "vitest";
+import { useHandler } from "./__mocks/context/useHandler.js";
+import { createMockTargetModelPlugins, MOCK_TARGET_MODEL_ID } from "./__mocks/targetModel.js";
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel";
+import { CreateEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/CreateEntry";
+import {
+    GetScheduledActionUseCase,
+    ListScheduledActionsUseCase
+} from "@webiny/api-scheduler/exports/api/scheduler.js";
+import { IdentityContext } from "@webiny/api-core/exports/api/security.js";
+import { CMS_NAMESPACE } from "~/utils/namespace.js";
+import { SchedulePublishEntryUseCase } from "~/exports/api/cms/scheduler.js";
+
+/*
+ * There is no `scheduler.*` permission to grant in the admin, so a user with CMS permissions but
+ * no full access (the usual role on a non-root tenant) has to be able to see what they scheduled.
+ * Scheduler access follows the permissions of the app that owns the scheduled action.
+ */
+const setup = async (permissions: { name: string; [key: string]: unknown }[]) => {
+    const context = await useHandler({
+        permissions,
+        legacyPlugins: [createMockTargetModelPlugins()]
+    }).handler();
+    const { container } = context;
+
+    const model = (await container.resolve(GetModelUseCase).execute(MOCK_TARGET_MODEL_ID)).value;
+    const entry = await container.resolve(CreateEntryUseCase).execute(model, {
+        values: { title: "Scheduled entry" }
+    });
+    const scheduled = await container.resolve(SchedulePublishEntryUseCase).execute({
+        id: entry.value.id,
+        model,
+        tenant: "root",
+        scheduleFor: new Date(Date.now() + 100000)
+    });
+
+    return { container, scheduled };
+};
+
+describe("Scheduler permissions", () => {
+    it("lets a user with CMS entry permissions see the actions they scheduled", async () => {
+        const { container, scheduled } = await setup([{ name: "cms.*" }]);
+        expect(scheduled.isOk()).toBe(true);
+
+        const list = await container.resolve(ListScheduledActionsUseCase).execute({
+            where: { namespace_startsWith: CMS_NAMESPACE }
+        });
+        expect(list.isOk()).toBe(true);
+        expect(list.value.items).toHaveLength(1);
+
+        const action = await container.resolve(GetScheduledActionUseCase).execute({
+            id: scheduled.value.scheduledAction.id,
+            namespace: scheduled.value.scheduledAction.namespace
+        });
+        expect(action.isOk()).toBe(true);
+    });
+
+    it("keeps a user without CMS entry permissions out of CMS scheduled actions", async () => {
+        const { scheduled } = await setup([{ name: "cms.*" }]);
+        expect(scheduled.isOk()).toBe(true);
+
+        const { container } = await useHandler({
+            permissions: [{ name: "fm.*" }],
+            legacyPlugins: [createMockTargetModelPlugins()]
+        }).handler();
+
+        const action = await container.resolve(GetScheduledActionUseCase).execute({
+            id: scheduled.value.scheduledAction.id,
+            namespace: scheduled.value.scheduledAction.namespace
+        });
+        expect(action.isFail()).toBe(true);
+        expect(action.error.code).toBe("Scheduler/NotAuthorized");
+    });
+});
+
+/*
+ * When no app claims an action's namespace, or a caller lists without one, there are no app
+ * permissions to check against, so only full-access identities and code running without
+ * authorization get through.
+ */
+describe("Scheduler permissions without an owning app", () => {
+    const contextWith = (permissions: { name: string }[]) =>
+        useHandler({
+            permissions,
+            legacyPlugins: [createMockTargetModelPlugins()]
+        }).handler();
+
+    it("doesn't let a CMS user list without a namespace", async () => {
+        const { container } = await setup([{ name: "cms.*" }]);
+
+        const result = await container.resolve(ListScheduledActionsUseCase).execute({ where: {} });
+
+        expect(result.isFail()).toBe(true);
+        expect(result.error.code).toBe("Scheduler/NotAuthorized");
+    });
+
+    it("doesn't let a CMS user list a namespace no app claims", async () => {
+        const { container } = await contextWith([{ name: "cms.*" }]);
+
+        const result = await container.resolve(ListScheduledActionsUseCase).execute({
+            where: { namespace: "Unknown/App" }
+        });
+
+        expect(result.isFail()).toBe(true);
+        expect(result.error.code).toBe("Scheduler/NotAuthorized");
+    });
+
+    it("lets a full-access user list without a namespace", async () => {
+        const { container } = await setup([{ name: "*" }]);
+
+        const result = await container.resolve(ListScheduledActionsUseCase).execute({ where: {} });
+
+        expect(result.isOk()).toBe(true);
+        expect(result.value.items).toHaveLength(1);
+    });
+
+    it("lets code running without authorization list without a namespace", async () => {
+        const { container } = await setup([{ name: "cms.*" }]);
+
+        const result = await container
+            .resolve(IdentityContext)
+            .withoutAuthorization(() =>
+                container.resolve(ListScheduledActionsUseCase).execute({ where: {} })
+            );
+
+        expect(result.isOk()).toBe(true);
+        expect(result.value.items).toHaveLength(1);
+    });
+});

packages/api-headless-cms-scheduler/src/CmsSchedulerFeature.ts

@@ -1,5 +1,6 @@
 import { createFeature } from "@webiny/feature/api";
 import { CancelScheduledActionOnEntryChangeFeature } from "~/features/CancelScheduledActionOnEntryChange/feature.js";
+import { CmsSchedulerPermissions } from "~/features/permissions/CmsSchedulerPermissions.js";
 import { NamespaceHandler } from "~/features/NamespaceHandler/NamespaceHandler.js";
 import { PublishEntryActionHandler } from "~/features/PublishActionHandler/PublishEntryActionHandler.js";
 import { UnpublishEntryActionHandler } from "~/features/UnpublishActionHandler/UnpublishEntryActionHandler.js";
@@ -17,5 +18,6 @@ export const CmsSchedulerFeature = createFeature({
         container.register(ScheduleUnpublishEntryUseCase);
 
         CancelScheduledActionOnEntryChangeFeature.register(container);
+        container.register(CmsSchedulerPermissions);
     }
 });

packages/api-headless-cms-scheduler/src/features/permissions/CmsSchedulerPermissions.ts

@@ -0,0 +1,35 @@
+import { SchedulerPermissions } from "@webiny/api-scheduler/features/permissions/abstractions.js";
+import { IdentityContext } from "@webiny/api-core/exports/api/security.js";
+import { CMS_NAMESPACE } from "~/utils/namespace.js";
+
+class CmsSchedulerPermissionsImpl implements SchedulerPermissions.Interface {
+    constructor(private identityContext: IdentityContext.Interface) {}
+
+    canHandle(namespace: string): boolean {
+        return namespace.startsWith(CMS_NAMESPACE);
+    }
+
+    async canRead(): Promise<boolean> {
+        if (await this.identityContext.hasFullAccess()) {
+            return true;
+        }
+        const permissions = await this.identityContext.getPermissions("cms.contentEntry");
+        return permissions.length > 0;
+    }
+
+    async onlyOwnRecords(): Promise<boolean> {
+        if (await this.identityContext.hasFullAccess()) {
+            return false;
+        }
+        const permissions = await this.identityContext.getPermissions("cms.contentEntry");
+        if (!permissions.length) {
+            return false;
+        }
+        return !permissions.some((p: any) => !p.own);
+    }
+}
+
+export const CmsSchedulerPermissions = SchedulerPermissions.createImplementation({
+    implementation: CmsSchedulerPermissionsImpl,
+    dependencies: [IdentityContext]
+});

packages/api-scheduler/src/SchedulerFeature.ts

@@ -1,6 +1,6 @@
 import { type Container, createFeature } from "@webiny/feature/api";
 import { SchedulePrivateModel } from "./domain/SchedulePrivateModel.js";
-import { SchedulerPermissionsFeature } from "~/features/permissions/feature.js";
+import { SchedulerPermissionsResolver } from "~/features/permissions/SchedulerPermissionsResolver.js";
 import { SchedulerGraphQLFactoryFeature } from "~/graphql/feature.js";
 import { NamespaceHandlerExecutionerFeature } from "~/features/NamespaceHandler/feature.js";
 import { ScheduledActionModelProvider } from "~/features/ScheduledActionModelProvider.js";
@@ -10,7 +10,7 @@ export const SchedulerFeature = createFeature({
     name: "Scheduler",
     register(container: Container) {
         container.register(SchedulePrivateModel);
-        SchedulerPermissionsFeature.register(container);
+        container.register(SchedulerPermissionsResolver);
         SchedulerGraphQLFactoryFeature.register(container);
         NamespaceHandlerExecutionerFeature.register(container);
         SchedulerCoreFeature.register(container);

packages/api-scheduler/src/features/CancelScheduledAction/CancelScheduledActionUseCase.ts

@@ -10,7 +10,7 @@ import {
 import { DeleteEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/DeleteEntry/index.js";
 import { ScheduledActionIdWithVersion } from "~/domain/ScheduledActionIdWithVersion.js";
 import { EntryNotFoundError } from "@webiny/api-headless-cms/domain/contentEntry/errors.js";
-import { SchedulerPermissions } from "~/features/permissions/abstractions.js";
+import { SchedulerPermissionsResolver } from "~/features/permissions/abstractions.js";
 
 /**
  * Cancels a scheduled action
@@ -27,17 +27,17 @@ class CancelScheduledActionUseCaseImpl implements UseCaseAbstraction.Interface {
         private schedulerService: SchedulerService.Interface,
         private deleteEntryUseCase: DeleteEntryUseCase.Interface,
         private modelProvider: ScheduledActionModelProvider.Interface,
-        private permissions: SchedulerPermissions.Interface
+        private permissionsResolver: SchedulerPermissionsResolver.Interface
     ) {}
 
     async execute(
         params: UseCaseAbstraction.Params
     ): Promise<Result<boolean, UseCaseAbstraction.Error>> {
-        const hasPermission = await this.permissions.canRead("action");
-        if (!hasPermission) {
+        const { id, namespace } = params;
+        const permissions = this.permissionsResolver.forNamespace(namespace);
+        if (!(await permissions.canRead())) {
             return Result.fail(new NotAuthorizedError());
         }
-        const { id } = params;
         // Check if scheduled action exists
         const getResult = await this.getScheduledActionUseCase.execute(params);
 
@@ -100,6 +100,6 @@ export const CancelScheduledActionUseCase = UseCaseAbstraction.createImplementat
         SchedulerService,
         DeleteEntryUseCase,
         ScheduledActionModelProvider,
-        SchedulerPermissions
+        SchedulerPermissionsResolver
     ]
 });

packages/api-scheduler/src/features/ExecuteScheduledAction/ExecuteScheduledActionUseCase.ts

@@ -93,11 +93,21 @@ class ExecuteScheduledActionUseCaseImpl implements UseCaseAbstraction.Interface
             );
 
             // Update entry with error for debugging
-            await this.updateEntryUseCase.execute<IScheduledAction<T>>(model, scheduleId, {
-                values: {
-                    error: error.message
+            const updateResult = await this.updateEntryUseCase.execute<IScheduledAction<T>>(
+                model,
+                scheduleId,
+                {
+                    values: {
+                        error: error.message
+                    }
                 }
-            });
+            );
+            if (updateResult.isFail()) {
+                return Result.fail({
+                    ...updateResult.error,
+                    message: `Failed to update error to a scheduled action (${scheduleId}): ${updateResult.error.message}`
+                } as unknown as UseCaseAbstraction.Error);
+            }
 
             return Result.fail(error);
         }
@@ -126,11 +136,21 @@ class ExecuteScheduledActionUseCaseImpl implements UseCaseAbstraction.Interface
             );
 
             // Update entry with error for debugging
-            await this.updateEntryUseCase.execute<IScheduledAction<T>>(model, scheduleId, {
-                values: {
-                    error: executionError.message
+            const updateResult = await this.updateEntryUseCase.execute<IScheduledAction<T>>(
+                model,
+                scheduleId,
+                {
+                    values: {
+                        error: executionError.message
+                    }
                 }
-            });
+            );
+            if (updateResult.isFail()) {
+                return Result.fail({
+                    ...updateResult.error,
+                    message: `Failed to update error to a scheduled action: ${updateResult.error.message}`
+                } as unknown as UseCaseAbstraction.Error);
+            }
 
             return Result.fail(executionError);
         }

packages/api-scheduler/src/features/GetScheduledAction/GetScheduledActionUseCase.ts

@@ -10,7 +10,7 @@ import {
 import { GetEntryByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetEntryById/index.js";
 import { ScheduledActionIdWithVersion } from "~/domain/ScheduledActionIdWithVersion.js";
 import type { GenericRecord } from "@webiny/api/types.js";
-import { SchedulerPermissions } from "~/features/permissions/abstractions.js";
+import { SchedulerPermissionsResolver } from "~/features/permissions/abstractions.js";
 import { IdentityContext } from "@webiny/api-core/exports/api/security.js";
 import { ScheduledActionMapper } from "~/domain/ScheduledActionMapper.js";
 
@@ -26,18 +26,18 @@ class GetScheduledActionUseCaseImpl implements UseCaseAbstraction.Interface {
     constructor(
         private getEntryByIdUseCase: GetEntryByIdUseCase.Interface,
         private modelProvider: ScheduledActionModelProvider.Interface,
-        private permissions: SchedulerPermissions.Interface,
+        private permissionsResolver: SchedulerPermissionsResolver.Interface,
         private identityContext: IdentityContext.Interface
     ) {}
 
     async execute<T extends GenericRecord>(
         params: UseCaseAbstraction.Params
     ): Promise<Result<IScheduledAction<T>, UseCaseAbstraction.Error>> {
-        const hasPermission = await this.permissions.canRead("action");
-        if (!hasPermission) {
+        const { id, namespace } = params;
+        const permissions = this.permissionsResolver.forNamespace(namespace);
+        if (!(await permissions.canRead())) {
             return Result.fail(new NotAuthorizedError());
         }
-        const { id, namespace } = params;
         const model = await this.modelProvider.get();
         // Get entry from CMS
         const scheduleId = ScheduledActionIdWithVersion.from(id);
@@ -54,7 +54,7 @@ class GetScheduledActionUseCaseImpl implements UseCaseAbstraction.Interface {
             return Result.fail(new ScheduledActionPersistenceError(entryResult.error));
         }
 
-        const ownRecordsOnly = await this.permissions.onlyOwnRecords("action");
+        const ownRecordsOnly = await permissions.onlyOwnRecords();
         if (ownRecordsOnly) {
             if (entryResult.value.createdBy.id !== this.identityContext.getIdentity().id) {
                 return Result.fail(new NotAuthorizedError());
@@ -79,7 +79,7 @@ export const GetScheduledActionUseCase = UseCaseAbstraction.createImplementation
     dependencies: [
         GetEntryByIdUseCase,
         ScheduledActionModelProvider,
-        SchedulerPermissions,
+        SchedulerPermissionsResolver,
         IdentityContext
     ]
 });