PR:Add Database Explorer page to Staff Portal Tech Admin section for MongoDB collections/documents

apps/ui-community/mock-oidc.users.json

@@ -3,7 +3,7 @@
 		"username": "test@example.com",
 		"sub": "00000000-0000-4000-8000-000000000001",
 		"password": "password",
-        "oidcConfigName": "end-user",
+		"oidcConfigName": "end-user",
 		"claims": {
 			"email": "test@example.com",
 			"given_name": "Test",
@@ -15,7 +15,7 @@
 		"username": "john.doe@example.com",
 		"sub": "00000000-0000-4000-8000-000000000002",
 		"password": "password",
-        "oidcConfigName": "end-user",
+		"oidcConfigName": "end-user",
 		"claims": {
 			"email": "john.doe@example.com",
 			"given_name": "John",
@@ -27,7 +27,7 @@
 		"username": "owner@test.example",
 		"sub": "aaaaaaaa-bbbb-1ccc-9ddd-eeeeeeeeee01",
 		"password": "password",
-        "oidcConfigName": "end-user",
+		"oidcConfigName": "end-user",
 		"claims": {
 			"email": "owner@test.example",
 			"given_name": "Test",

apps/ui-staff/mock-oidc.users.json

@@ -3,7 +3,7 @@
 		"username": "staff@ownercommunity.onmicrosoft.com",
 		"sub": "10000000-0000-4000-8000-000000000001",
 		"password": "password",
-        "oidcConfigName": "staff-user",
+		"oidcConfigName": "staff-user",
 		"claims": {
 			"email": "staff@ownercommunity.onmicrosoft.com",
 			"given_name": "Staff",

apps/ui-staff/src/App.tsx

@@ -27,14 +27,16 @@ function StaffRoutes() {
 	const canViewStaffUsers = perms?.canViewStaffUsers === true;
 	const canManageFinance = perms?.canManageFinance === true;
 	const canManageTechAdmin = perms?.canManageTechAdmin === true;
+	const canViewDatabaseDocuments = perms?.canViewDatabaseDocuments === true;
+	const canAccessTechAdmin = canManageTechAdmin || canViewDatabaseDocuments;
 	const canViewRoles = perms?.canViewRoles === true;
 	const canAddRole = perms?.canAddRole === true;
 	const canEditRole = perms?.canEditRole === true;
 	const canRemoveRole = perms?.canRemoveRole === true;
 	const canAccessUserManagement = canManageUsers || canAssignStaffRoles || canViewStaffUsers || canManageStaffRolesAndPermissions || canViewRoles || canAddRole || canEditRole || canRemoveRole || canManageTechAdmin;
 
 	let defaultStaffRoute = '/unauthorized';
-	if (canManageTechAdmin) {
+	if (canAccessTechAdmin) {
 		defaultStaffRoute = '/staff/tech';
 	} else if (canManageFinance) {
 		defaultStaffRoute = '/staff/finance';
@@ -73,7 +75,7 @@ function StaffRoutes() {
 					element={<Finance />}
 				/>
 			)}
-			{canManageTechAdmin && (
+			{canAccessTechAdmin && (
 				<Route
 					path="tech/*"
 					element={<TechAdmin />}

apps/ui-staff/src/hooks/use-staff-permissions.ts

@@ -34,6 +34,7 @@ const CURRENT_STAFF_USER_QUERY = gql`
 					}
 					techAdminPermissions {
 						canManageTechAdmin
+						canViewDatabaseDocuments
 					}
 				}
 			}
@@ -49,6 +50,7 @@ interface StaffPermissions {
 	canViewStaffUsers: boolean;
 	canManageFinance: boolean;
 	canManageTechAdmin: boolean;
+	canViewDatabaseDocuments: boolean;
 	canViewRoles: boolean;
 	canAddRole: boolean;
 	canEditRole: boolean;
@@ -72,7 +74,7 @@ interface StaffUserQueryResult {
 				userPermissions: { canManageUsers: boolean; canAssignStaffRoles: boolean; canViewStaffUsers: boolean };
 				staffRolePermissions: { canViewRoles: boolean; canAddRole: boolean; canEditRole: boolean; canRemoveRole: boolean };
 				financePermissions: { canManageFinance: boolean };
-				techAdminPermissions: { canManageTechAdmin: boolean };
+				techAdminPermissions: { canManageTechAdmin: boolean; canViewDatabaseDocuments: boolean };
 			};
 		};
 	};
@@ -104,6 +106,7 @@ export const useStaffPermissions = (): {
 				canViewStaffUsers: rolePermissions.userPermissions.canViewStaffUsers || rolePermissions.userPermissions.canManageUsers || isTechAdmin,
 				canManageFinance: rolePermissions.financePermissions.canManageFinance || isTechAdmin,
 				canManageTechAdmin: isTechAdmin,
+				canViewDatabaseDocuments: rolePermissions.techAdminPermissions.canViewDatabaseDocuments || isTechAdmin,
 				canViewRoles: rolePermissions.staffRolePermissions.canViewRoles || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin,
 				canAddRole: rolePermissions.staffRolePermissions.canAddRole || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin,
 				canEditRole: rolePermissions.staffRolePermissions.canEditRole || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin,

packages/cellix/server-oauth2-mock-seedwork/tests/file-user-store.test.ts

@@ -126,9 +126,7 @@ describe('file user store oidcConfigName filtering', () => {
 
 	it('users without oidcConfigName are visible to all scoped stores', async () => {
 		if (!tmp) throw new Error('tmp not created');
-		writeUsers(tmp, 'mock-oidc.users.json', [
-			{ username: 'shared@example.com', sub: 'sub-shared' },
-		]);
+		writeUsers(tmp, 'mock-oidc.users.json', [{ username: 'shared@example.com', sub: 'sub-shared' }]);
 		const endStore = createFileUserStore(tmp, 'end-user');
 		const staffStore = createFileUserStore(tmp, 'staff-user');
 
@@ -191,15 +189,7 @@ describe('file user store oidcConfigName filtering', () => {
 			expect(users).toHaveLength(1);
 			expect(users[0]?.username).toBe('good@example.com');
 			expect(warnSpy.length).toBeGreaterThan(0);
-			expect(
-				warnSpy.some((args) =>
-					(args as unknown[]).some(
-						(arg) =>
-							typeof arg === 'string' &&
-							arg.includes('"oidcConfigName" must be a string'),
-					),
-				),
-			).toBe(true);
+			expect(warnSpy.some((args) => (args as unknown[]).some((arg) => typeof arg === 'string' && arg.includes('"oidcConfigName" must be a string')))).toBe(true);
 		} finally {
 			console.warn = origWarn;
 		}

packages/cellix/server-oauth2-mock-seedwork/tests/portal-discovery.test.ts

@@ -569,11 +569,7 @@ describe('discoverPortalConfigs', () => {
 				envVars: { clientId: 'VITE_APP_PORTAL_STAFF_CLIENTID', redirectUri: 'VITE_APP_PORTAL_STAFF_REDIRECT' },
 			},
 		]);
-		writeEnv(
-			tmp,
-			'ui-portal/.env',
-			'VITE_APP_PORTAL_END_CLIENTID=end-cid\nVITE_APP_PORTAL_END_REDIRECT=https://portal/end/cb\nVITE_APP_PORTAL_STAFF_CLIENTID=staff-cid\nVITE_APP_PORTAL_STAFF_REDIRECT=https://portal/staff/cb\n',
-		);
+		writeEnv(tmp, 'ui-portal/.env', 'VITE_APP_PORTAL_END_CLIENTID=end-cid\nVITE_APP_PORTAL_END_REDIRECT=https://portal/end/cb\nVITE_APP_PORTAL_STAFF_CLIENTID=staff-cid\nVITE_APP_PORTAL_STAFF_REDIRECT=https://portal/staff/cb\n');
 
 		const portals = discoverPortalConfigs(tmp);
 		expect(portals).toHaveLength(2);

packages/ocom-verification/acceptance-api/src/step-definitions/index.ts

@@ -5,4 +5,4 @@
 
 import '../contexts/community/step-definitions/index.ts';
 import '../contexts/authentication/step-definitions/index.ts';
-import '../contexts/staff/step-definitions/index.ts';
+import '../contexts/staff/step-definitions/index.ts';

packages/ocom/application-services/package.json

@@ -29,7 +29,8 @@
 		"@ocom/domain": "workspace:*",
 		"@ocom/persistence": "workspace:*",
 		"@ocom/service-blob-storage": "workspace:*",
-		"@ocom/service-queue-storage": "workspace:*"
+		"@ocom/service-queue-storage": "workspace:*",
+		"mongoose": "catalog:"
 	},
 	"devDependencies": {
 		"@cellix/archunit-tests": "workspace:*",

packages/ocom/application-services/src/contexts/tech-admin/database-documents.command-mapper.ts

@@ -0,0 +1,61 @@
+type DatabaseDocumentsQueryArgs = {
+	collection: string;
+	filter?: string | null | undefined;
+	page?: number | null | undefined;
+	pageSize?: number | null | undefined;
+};
+
+const ALLOWED_OPERATORS = new Set(['$eq', '$in', '$gt', '$gte', '$lt', '$lte', '$exists', '$regex', '$and', '$or', '$not']);
+
+function validateOperatorKey(key: string): void {
+	if (!key.startsWith('$')) return;
+	if (key === '$where' || key === '$function' || key === '$expr') {
+		throw new Error(`Operator ${key} is not allowed in filter`);
+	}
+	if (!ALLOWED_OPERATORS.has(key)) {
+		throw new Error(`Unknown operator: ${key}`);
+	}
+}
+
+function validateFilterOperators(obj: unknown): void {
+	if (obj === null || obj === undefined) return;
+	if (Array.isArray(obj)) {
+		for (const item of obj) validateFilterOperators(item);
+		return;
+	}
+	if (typeof obj !== 'object') return;
+	for (const [k, v] of Object.entries(obj as Record<string, unknown>)) {
+		validateOperatorKey(k);
+		validateFilterOperators(v);
+	}
+}
+
+export type DatabaseDocumentsQueryCommand = {
+	collection: string;
+	filter: Record<string, unknown>;
+	page: number;
+	pageSize: number;
+};
+
+export function buildDatabaseDocumentsQueryCommand(args: DatabaseDocumentsQueryArgs): DatabaseDocumentsQueryCommand {
+	if (!/^[a-zA-Z0-9_-]+$/.test(args.collection)) {
+		throw new Error('Invalid collection name');
+	}
+
+	let parsedFilter: Record<string, unknown> = {};
+	if (args.filter) {
+		try {
+			parsedFilter = JSON.parse(args.filter) as Record<string, unknown>;
+		} catch {
+			throw new Error('Invalid filter JSON');
+		}
+		validateFilterOperators(parsedFilter);
+	}
+
+	return {
+		collection: args.collection,
+		filter: parsedFilter,
+		pageSize: Math.min(Math.max(args.pageSize ?? 20, 1), 100),
+		page: Math.max(args.page ?? 1, 1),
+	};
+}

packages/ocom/application-services/src/contexts/tech-admin/index.ts

@@ -0,0 +1,15 @@
+import { ListCollections } from './list-collections.ts';
+import { DatabaseDocuments } from './query-documents.ts';
+export { buildDatabaseDocumentsQueryCommand } from './database-documents.command-mapper.ts';
+
+export interface TechAdminApplicationService {
+	ListCollections: ReturnType<typeof ListCollections>;
+	DatabaseDocuments: ReturnType<typeof DatabaseDocuments>;
+}
+
+export const TechAdmin = (): TechAdminApplicationService => {
+	return {
+		ListCollections: ListCollections(),
+		DatabaseDocuments: DatabaseDocuments(),
+	};
+};

packages/ocom/application-services/src/contexts/tech-admin/list-collections.ts

@@ -0,0 +1,13 @@
+import mongoose from 'mongoose';
+
+export const ListCollections = () => {
+	return async (): Promise<string[]> => {
+		const { db } = mongoose.connection;
+		if (!db) throw new Error('Database connection is not available');
+		const cols = await db.listCollections().toArray();
+		return cols
+			.map((c) => c.name)
+			.filter((n) => !n.startsWith('system.'))
+			.sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' }));
+	};
+};

packages/ocom/application-services/src/contexts/tech-admin/query-documents.ts

@@ -0,0 +1,126 @@
+import mongoose from 'mongoose';
+
+function normalizeBsonValue(value: unknown): unknown {
+	if (value === null || value === undefined) return value;
+	if (Array.isArray(value)) return value.map(normalizeBsonValue);
+	if (value instanceof Date) return value.toISOString();
+	if (value && typeof (value as { toHexString?: unknown }).toHexString === 'function') return (value as { toHexString: () => string }).toHexString();
+	if (value && (value as { _bsontype?: unknown })._bsontype === 'Decimal128') return (value as { toString: () => string }).toString();
+	if (Buffer.isBuffer(value)) return value.toString('base64');
+	if (value instanceof Uint8Array) return Buffer.from(value).toString('base64');
+	if (typeof value === 'object') {
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+			out[k] = normalizeBsonValue(v);
+		}
+		return out;
+	}
+	return value;
+}
+
+const OBJECT_ID_KEYS = new Set(['_id', 'role']);
+const objectIdPattern = /^[a-fA-F0-9]{24}$/;
+
+function normalizeObjectIdValue(value: unknown): unknown {
+	if (typeof value === 'string' && objectIdPattern.test(value)) {
+		return new mongoose.Types.ObjectId(value);
+	}
+	if (Array.isArray(value)) {
+		return value.map((item) => normalizeObjectIdValue(item));
+	}
+	if (value && typeof value === 'object') {
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+			out[k] = normalizeObjectIdValue(v);
+		}
+		return out;
+	}
+	return value;
+}
+
+function normalizeFilterObjectIds(obj: unknown): unknown {
+	if (obj === null || obj === undefined) return obj;
+	if (Array.isArray(obj)) {
+		return obj.map((item) => normalizeFilterObjectIds(item));
+	}
+	if (typeof obj !== 'object') return obj;
+	const out: Record<string, unknown> = {};
+	for (const [k, v] of Object.entries(obj as Record<string, unknown>)) {
+		if (k.startsWith('$')) {
+			out[k] = normalizeFilterObjectIds(v);
+			continue;
+		}
+		if (OBJECT_ID_KEYS.has(k)) {
+			out[k] = normalizeObjectIdValue(v);
+			continue;
+		}
+		out[k] = normalizeFilterObjectIds(v);
+	}
+	return out;
+}
+
+async function enrichStaffUserRoles(collection: string, docs: Record<string, unknown>[], db: mongoose.mongo.Db): Promise<Record<string, unknown>[]> {
+	if (collection !== 'users') return docs;
+	const roleIds = new Set<string>();
+	for (const doc of docs) {
+        //biome-ignore lint:useLiteralKeys
+		const role = doc['role'];
+		if (typeof role === 'string' && role.length === 24) roleIds.add(role);
+		if (role && typeof role === 'object' && typeof (role as { id?: unknown }).id === 'string') roleIds.add((role as { id: string }).id);
+	}
+	if (roleIds.size === 0) return docs;
+	const roleObjectIds = [...roleIds].map((id) => new mongoose.Types.ObjectId(id));
+	const roles = await db.collection('roles').find({ _id: { $in: roleObjectIds } }, { projection: { roleName: 1, enterpriseAppRole: 1 } }).toArray();
+	const roleMap = new Map(
+		roles.map((role) => [
+			String(role._id),
+			{
+                //biome-ignore lint:useLiteralKeys
+				roleName: role['roleName'] ?? null,
+                //biome-ignore lint:useLiteralKeys
+				enterpriseAppRole: role['enterpriseAppRole'] ?? null,
+			},
+		]),
+	);
+	return docs.map((doc) => {
+        //biome-ignore lint:useLiteralKeys
+		const roleId = typeof doc['role'] === 'string' ? doc['role'] : (doc['role'] as { id?: string } | undefined)?.id ?? null;
+		if (!roleId) return doc;
+		const roleInfo = roleMap.get(roleId);
+		if (!roleInfo) return doc;
+		return { ...doc, role: { id: roleId, ...roleInfo } };
+	});
+}
+
+import type { DatabaseDocumentsQueryCommand } from './database-documents.command-mapper.ts';
+
+type DatabaseDocument = {
+	id: string;
+	json: string;
+};
+
+type DatabaseDocumentPage = {
+	documents: DatabaseDocument[];
+	totalCount: number;
+};
+
+export const DatabaseDocuments = () => {
+	return async (command: DatabaseDocumentsQueryCommand): Promise<DatabaseDocumentPage> => {
+		const { db } = mongoose.connection;
+		if (!db) throw new Error('Database connection is not available');
+		const skip = (command.page - 1) * command.pageSize;
+		const coll = db.collection(command.collection);
+		const filter = normalizeFilterObjectIds(command.filter) as Record<string, unknown>;
+		const totalCount = await coll.countDocuments(filter);
+		const docs = await coll.find(filter).skip(skip).limit(command.pageSize).toArray();
+		const enrichedDocs = await enrichStaffUserRoles(command.collection, docs as Record<string, unknown>[], db);
+		return {
+			totalCount,
+			documents: enrichedDocs.map((doc) => {
+				const sanitized = normalizeBsonValue(doc as Record<string, unknown>);
+                //biome-ignore lint:useLiteralKeys
+				return { id: String(doc['_id']), json: JSON.stringify(sanitized) };
+			}),
+		};
+	};
+};

packages/ocom/application-services/src/contexts/user/index.ts

@@ -2,17 +2,20 @@ import type { DataSources } from '@ocom/persistence';
 import { EndUser as EndUserApi, type EndUserApplicationService } from './end-user/index.ts';
 import { StaffRole as StaffRoleApi, type StaffRoleApplicationService } from './staff-role/index.ts';
 import { StaffUser as StaffUserApi, type StaffUserApplicationService } from './staff-user/index.ts';
+import { TechAdmin as TechAdminApi, type TechAdminApplicationService } from '../tech-admin/index.ts';
 
 export interface UserContextApplicationService {
 	EndUser: EndUserApplicationService;
 	StaffRole: StaffRoleApplicationService;
 	StaffUser: StaffUserApplicationService;
+	TechAdmin: TechAdminApplicationService;
 }
 
 export const User = (dataSources: DataSources): UserContextApplicationService => {
 	return {
 		EndUser: EndUserApi(dataSources),
 		StaffRole: StaffRoleApi(dataSources),
 		StaffUser: StaffUserApi(dataSources),
+		TechAdmin: TechAdminApi(),
 	};
 };