added more authentication tests

lib/auth/index.js

@@ -41,7 +41,10 @@ function makeStrategy(logger) {
           const user = {
             account_sid: results[0].account_sid,
             service_provider_sid: results[0].service_provider_sid,
-            hasScope: (s) => scope.includes(s)
+            hasScope: (s) => scope.includes(s),
+            hasAdminAuth: scope.length === 3,
+            hasServiceProviderAuth: scope.includes('service_provider') && !scope.includes('admin'),
+            hasAccountAuth: scope.includes('account') && !scope.includes('service_provider')
           };
           logger.info(user, `successfully validated with scope ${scope}`);
           return done(null, user, {scope});

lib/routes/api/accounts.js

@@ -10,18 +10,46 @@ const preconditions = {
 };
 
 async function validateAdd(req) {
-  /* check that service provider exists */
-  const result = await ServiceProvider.retrieve(req.body.service_provider_sid);
-  if (!result || result.length === 0) {
-    throw new DbErrorBadRequest(`service_provider not found for sid ${req.body.service_provider_sid}`);
+  /* account-level token can not be used to add accounts */
+  if (req.user.hasAccountAuth) {
+    throw new DbErrorUnprocessableRequest('insufficient permissions to create accounts');
+  }
+  if (req.user.hasServiceProviderAuth) {
+    /* service providers can only create accounts under themselves */
+    req.body.service_provider_sid = req.user.service_provider_sid;
+  }
+  if (req.body.service_provider_sid) {
+    const result = await ServiceProvider.retrieve(req.body.service_provider_sid);
+    if (!result || result.length === 0) {
+      throw new DbErrorBadRequest(`service_provider not found for sid ${req.body.service_provider_sid}`);
+    }
   }
 }
 async function validateUpdate(req, sid) {
-  if (req.body.service_provider_sid) throw new DbErrorBadRequest('service_provider_sid may not be modified')
+  if (req.user.hasAccountAuth && req.user.account_sid !== sid) {
+    throw new DbErrorUnprocessableRequest('insufficient privileges to update this account');
+  }
+
+  if (req.user.service_provider_sid && !req.user.hasScope('admin')) {
+    const result = await Account.retrieve(sid);
+    if (result[0].service_provider_sid !== req.user.service_provider_sid) {
+      throw new DbErrorUnprocessableRequest('cannot update account from different service provider');
+    }
+  }
+  if (req.body.service_provider_sid) throw new DbErrorBadRequest('service_provider_sid may not be modified');
 }
 async function validateDelete(req, sid) {
+  if (req.user.hasAccountAuth && req.user.account_sid !== sid) {
+    throw new DbErrorUnprocessableRequest('insufficient privileges to update this account');
+  }
   const assignedPhoneNumbers = await Account.getForeignKeyReferences('phone_numbers.account_sid', sid);
   if (assignedPhoneNumbers > 0) throw new DbErrorUnprocessableRequest('cannot delete account with phone numbers');
+  if (req.user.service_provider_sid && !req.user.hasScope('admin')) {
+    const result = await Account.retrieve(sid);
+    if (result[0].service_provider_sid !== req.user.service_provider_sid) {
+      throw new DbErrorUnprocessableRequest('cannot delete account from different service provider');
+    }
+  }
 }
 
 decorate(router, Account, ['*'], preconditions);

lib/routes/api/api-keys.js

@@ -11,18 +11,20 @@ const preconditions = {
 };
 
 function validateAddToken(req) {
-  if (req.user.hasScope('admin') && ('account_sid' in req.body)) {
-    // ok
+  req.body.token = uuidv4();
+
+  if (req.user.hasAdminAuth) return;
+  if (req.user.hasServiceProviderAuth) {
+    if (req.body.account_sid) delete req.body.service_provider_sid;
+    else req.body.service_provider_sid = req.user.service_provider_sid;
   }
-  else if (req.user.hasScope('service_provider') &&
-    (!('account_sid' in req.body) && !('service_provider_sid' in req.body))) {
-    req.body['service_provider_sid'] = req.user.service_provider_sid;
-  }
-  else if (req.user.hasScope('account') && !req.user.hasScope('service_provider')) {
+  if (req.user.hasAccountAuth) {
+    if (req.body.account_sid !== req.user.account_sid) {
+      throw new DbErrorBadRequest('an account level token may not be used to create a token for a different account');
+    }
     delete req.body['service_provider_sid'];
     req.body['account_sid'] = req.user.account_sid;
   }
-  req.body.token = uuidv4();
 }
 
 async function validateDeleteToken(req, sid) {

lib/swagger/swagger.yaml

@@ -12,7 +12,7 @@ servers:
   - url: /v1
     description: development server
 paths:
-  /Apikeys:
+  /ApiKeys:
     post:
       summary: create an api key
       operationId: createApikey