feat: Vendor verification

client/components/CandidateReview/TestPlans/index.jsx

@@ -21,6 +21,7 @@ import ClippedProgressBar from '@components/common/ClippedProgressBar';
 import { dates } from 'shared';
 import './TestPlans.css';
 import { calculations } from 'shared';
+import { UserPropType } from '../../common/proptypes';
 
 const FullHeightContainer = styled(Container)`
   min-height: calc(100vh - 64px);
@@ -177,7 +178,7 @@ const None = styled.span`
   }
 `;
 
-const TestPlans = ({ testPlanVersions }) => {
+const TestPlans = ({ testPlanVersions, me }) => {
   const [atExpandTableItems, setAtExpandTableItems] = useState({
     1: true,
     2: true,
@@ -503,20 +504,39 @@ const TestPlans = ({ testPlanVersions }) => {
                     .filter(t => t.isCandidateReview === true)
                     .filter(t => uniqueFilter(t, uniqueLinks, 'link'));
 
+                  const canReview =
+                    me.roles.includes('ADMIN') ||
+                    (me.roles.includes('VENDOR') &&
+                      me.company.ats.some(at => at.id === atId));
+
+                  const getTitleEl = () => {
+                    if (canReview) {
+                      return (
+                        <Link
+                          to={`/candidate-test-plan/${testPlanVersion.id}/${atId}`}
+                        >
+                          {getTestPlanVersionTitle(testPlanVersion, {
+                            includeVersionString: true
+                          })}{' '}
+                          ({testsCount} Test
+                          {testsCount === 0 || testsCount > 1 ? `s` : ''})
+                        </Link>
+                      );
+                    }
+                    return (
+                      <>
+                        {getTestPlanVersionTitle(testPlanVersion, {
+                          includeVersionString: true
+                        })}{' '}
+                        ({testsCount} Test
+                        {testsCount === 0 || testsCount > 1 ? `s` : ''})
+                      </>
+                    );
+                  };
                   return (
                     dataExists && (
                       <tr key={testPlanVersion.id}>
-                        <th>
-                          <Link
-                            to={`/candidate-test-plan/${testPlanVersion.id}/${atId}`}
-                          >
-                            {getTestPlanVersionTitle(testPlanVersion, {
-                              includeVersionString: true
-                            })}{' '}
-                            ({testsCount} Test
-                            {testsCount === 0 || testsCount > 1 ? `s` : ''})
-                          </Link>
-                        </th>
+                        <th>{getTitleEl()}</th>
                         <CenteredTd>
                           <i>
                             {dates.convertDateToString(
@@ -778,6 +798,7 @@ TestPlans.propTypes = {
       )
     })
   ).isRequired,
+  me: UserPropType.isRequired,
   triggerPageUpdate: PropTypes.func
 };
 

client/components/CandidateReview/index.jsx

@@ -3,12 +3,16 @@ import { useQuery } from '@apollo/client';
 import PageStatus from '../common/PageStatus';
 import TestPlans from './TestPlans';
 import { CANDIDATE_REVIEW_PAGE_QUERY } from './queries';
+import { ME_QUERY } from '../App/queries';
 
 const CandidateReview = () => {
   const { loading, data, error } = useQuery(CANDIDATE_REVIEW_PAGE_QUERY, {
     fetchPolicy: 'cache-and-network'
   });
 
+  const { data: meData } = useQuery(ME_QUERY);
+  const { me } = meData;
+
   if (error) {
     return (
       <PageStatus
@@ -33,7 +37,7 @@ const CandidateReview = () => {
 
   const testPlanVersions = data.testPlanVersions;
 
-  return <TestPlans testPlanVersions={testPlanVersions} />;
+  return <TestPlans testPlanVersions={testPlanVersions} me={me} />;
 };
 
 export default CandidateReview;

client/components/ConfirmAuth/index.jsx

@@ -1,15 +1,17 @@
 import React from 'react';
-import { Navigate } from 'react-router-dom';
+import { Navigate, useParams } from 'react-router-dom';
 import PropTypes from 'prop-types';
 import { useQuery } from '@apollo/client';
 import { ME_QUERY } from '../App/queries';
 import { evaluateAuth } from '../../utils/evaluateAuth';
 
-const ConfirmAuth = ({ children, requiredPermission }) => {
+const ConfirmAuth = ({ children, requiredPermission, requireVendorForAt }) => {
   const { data } = useQuery(ME_QUERY);
+  const { atId } = useParams();
 
   const auth = evaluateAuth(data && data.me ? data.me : {});
   const { roles, username, isAdmin, isSignedIn } = auth;
+  const company = data && data.me ? data.me.company : null;
 
   if (!username) return <Navigate to={{ pathname: '/invalid-request' }} />;
 
@@ -21,6 +23,14 @@ const ConfirmAuth = ({ children, requiredPermission }) => {
     return <Navigate to="/404" replace />;
   }
 
+  // Check if the user's company is the vendor for the associated At
+  if (requireVendorForAt && !isAdmin) {
+    const isVendorForAt = company && company.ats.some(at => at.id === atId);
+    if (!isVendorForAt) {
+      return <Navigate to="/404" replace />;
+    }
+  }
+
   return children;
 };
 
@@ -29,7 +39,8 @@ ConfirmAuth.propTypes = {
     PropTypes.arrayOf(PropTypes.node),
     PropTypes.node
   ]).isRequired,
-  requiredPermission: PropTypes.string
+  requiredPermission: PropTypes.string,
+  requireVendorForAt: PropTypes.bool
 };
 
 export default ConfirmAuth;

client/components/common/fragments/Me.js

@@ -6,6 +6,12 @@ const ME_FIELDS = gql`
     id
     username
     roles
+    company {
+      id
+      ats {
+        id
+      }
+    }
   }
 `;
 

client/index.js

@@ -51,7 +51,20 @@ window.signMeInAsTester = username => {
 };
 
 window.signMeInAsVendor = username => {
-  return signMeInCommon({ username, roles: [{ name: 'VENDOR' }] });
+  return signMeInCommon({
+    username,
+    roles: [{ name: 'VENDOR' }],
+    company: {
+      id: '1',
+      name: 'vispero',
+      ats: [
+        {
+          id: '1',
+          name: 'JAWS'
+        }
+      ]
+    }
+  });
 };
 
 window.startTestTransaction = async () => {

client/routes/index.js

@@ -33,7 +33,7 @@ export default () => (
       exact
       path="/candidate-test-plan/:testPlanVersionId/:atId"
       element={
-        <ConfirmAuth requiredPermission="VENDOR">
+        <ConfirmAuth requiredPermission="VENDOR" requireVendorForAt={true}>
           <CandidateTestPlanRun />
         </ConfirmAuth>
       }

client/tests/__mocks__/GraphQLMocks/TestPlanReportStatusDialogMock.js

@@ -827,7 +827,12 @@ export default (
         me: {
           id: '1',
           username: 'foo-bar',
-          roles: ['ADMIN', 'TESTER']
+          roles: ['ADMIN', 'TESTER'],
+          company: {
+            id: '1',
+            name: 'Company',
+            ats: []
+          }
         }
       }
     }

client/tests/__mocks__/GraphQLMocks/TestQueuePageAdminNotPopulatedMock.js

@@ -9,7 +9,12 @@ export default testQueuePageQuery => [
           __typename: 'User',
           id: '1',
           username: 'foo-bar',
-          roles: ['ADMIN', 'TESTER']
+          roles: ['ADMIN', 'TESTER'],
+          company: {
+            id: '1',
+            name: 'Company',
+            ats: []
+          }
         },
         users: [
           {
@@ -18,23 +23,38 @@ export default testQueuePageQuery => [
             username: 'foo-bar',
             roles: ['ADMIN', 'TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           },
           {
             __typename: 'User',
             id: '4',
             username: 'bar-foo',
             roles: ['TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           },
           {
             __typename: 'User',
             id: '5',
             username: 'boo-far',
             roles: ['TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           }
         ],
         ats: [],

client/tests/__mocks__/GraphQLMocks/TestQueuePageTesterNotPopulatedMock.js

@@ -9,7 +9,12 @@ export default testQueuePageQuery => [
           __typename: 'User',
           id: '4',
           username: 'bar-foo',
-          roles: ['TESTER']
+          roles: ['TESTER'],
+          company: {
+            id: '1',
+            name: 'Company',
+            ats: []
+          }
         },
         users: [
           {
@@ -18,23 +23,38 @@ export default testQueuePageQuery => [
             username: 'foo-bar',
             roles: ['ADMIN', 'TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           },
           {
             __typename: 'User',
             id: '4',
             username: 'bar-foo',
             roles: ['TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           },
           {
             __typename: 'User',
             id: '5',
             username: 'boo-far',
             roles: ['TESTER'],
             isBot: false,
-            ats: []
+            ats: [],
+            company: {
+              id: '1',
+              name: 'Company',
+              ats: []
+            }
           }
         ],
         ats: [],

server/controllers/AuthController.js

@@ -1,7 +1,15 @@
 const { User } = require('../models');
-const { getOrCreateUser } = require('../models/services/UserService');
+const {
+  getOrCreateUser,
+  addUserVendor,
+  getUserById
+} = require('../models/services/UserService');
 const { GithubService } = require('../services');
 const getUsersFromFile = require('../util/getUsersFromFile');
+const {
+  findVendorByName,
+  getOrCreateVendor
+} = require('../models/services/VendorService');
 
 const APP_SERVER = process.env.APP_SERVER;
 
@@ -70,6 +78,40 @@ const oauthRedirectFromGithubController = async (req, res) => {
     transaction: req.transaction
   });
 
+  if (roles.some(role => role.name === User.VENDOR)) {
+    const vendorEntry = vendors.find(
+      vendor => vendor.split('|')[0] === githubUsername
+    );
+    if (vendorEntry) {
+      const [, companyName] = vendorEntry.split('|');
+      const vendor = await findVendorByName({
+        name: companyName,
+        transaction: req.transaction
+      });
+      if (vendor) {
+        await addUserVendor(user.id, vendor.id, {
+          transaction: req.transaction
+        });
+      } else {
+        const vendor = await getOrCreateVendor({
+          where: { name: companyName },
+          transaction: req.transaction
+        });
+        await addUserVendor(user.id, vendor.id, {
+          transaction: req.transaction
+        });
+      }
+      // Fetch the user again with vendor and AT information
+      user = await getUserById({
+        id: user.id,
+        vendorAttributes: ['id', 'name'],
+        atAttributes: ['id', 'name'],
+        includeVendorAts: true,
+        transaction: req.transaction
+      });
+    }
+  }
+
   req.session.user = user;
 
   return loginSucceeded();