Move accounts plugin to Node app and better split accounts from users/IDP

[aldeed]

Resolves #5588
Resolves #5213
Impact: minor
Type: refactor

Changes

• Move the "account" plugin to the Node app core-services folder
• Move createUser into the account plugin. It's still relying on Meteor, but that's OK until we split the apps.
• Reaction Admin no longer creates automatic "anonymous" users in the system, and a migration deletes all anonymous users and accounts. These have not been used since 2.0.0, but the code creating them was never removed from Reaction Admin.
• Move all auth logic and middleware into the account plugin (see below)

New Middleware Pattern

Plugins can register Express middleware using registerPlugin:

    expressMiddleware: [
      {
        route: "graphql",
        stage: "authenticate",
        fn: tokenMiddleware
      }
    ],

For now, only "graphql" route is supported, and the following stages are supported in this order:

• first
• before-authenticate
• authenticate
• before-response

An authenticate middleware function should do something like look up the user by the Authorization header, and either set request.user or send a 401 response if the token is invalid. It should not require a token. This is what the built-in account service now does.

The first middleware stage can be used for loggers or anything else that needs to be first in the middleware list. before-response middleware will have the user available if there is one, and is called before the Apollo GraphQL middleware.

A middleware function is passed context and must return the Express middleware handler function, which must call next() or send a response.

Auth functions

Plugins can also define auth-related functions when calling registerPlugin. The built-in accounts service does this.

    auth: {
      accountByUserId,
      getHasPermissionFunctionForUser,
      getShopsUserHasPermissionForFunctionForUser
    },

These are all functions that are called on every request, when adding request-specific properties to context.

• accountByUserId(context, userId): Must return an account for the user ID, if one can be found
• getHasPermissionFunctionForUser(context): Must return a function that matches the context.userHasPermission signature and returns true or false. This function can assume context.user/context.account is the user/account to check.
• getShopsUserHasPermissionForFunctionForUser(context): Must return a function that matches the context.shopsUserHasPermissionFor signature and returns an array of shop IDs. This function can assume context.user/context.account is the user/account to check.

Testing

• Verify Reaction Admin works, especially logging in / out.
• Verify that authenticated GraphQL requests continue to work. Clicking around in Reaction Admin, such as product and order tables, is enough to verify this.

[kieckhafer]

Code looks mostly good, just a few import updates.

Testing functionality now.

[aldeed]

Made suggested changes

[kieckhafer]

👍 Works as expected, good to merge once CI passes.