New endpoint to allow admins to get all access requests

backend/src/connectors/authorisation/base.ts

@@ -287,6 +287,17 @@ export class BasicAuthorisationConnector {
           return { success: false, info: 'You cannot change an access request you do not own.', id: request.id }
         }
 
+        if (
+          !(await this.model(user, model, ModelAction.View)).success &&
+          ([AccessRequestAction.View] as AccessRequestActionKeys[]).includes(action)
+        ) {
+          return {
+            success: false,
+            info: 'You cannot view an access request for a model you cannot view.',
+            id: request.id,
+          }
+        }
+
         // Otherwise they either own the model, access request or this is a read-only action.
         return { success: true, id: request.id }
       }),

backend/src/routes.ts

@@ -17,6 +17,7 @@ import { putFileScan } from './routes/v2/filescanning/putFileScan.js'
 import { deleteAccessRequest } from './routes/v2/model/accessRequest/deleteAccessRequest.js'
 import { getAccessRequest } from './routes/v2/model/accessRequest/getAccessRequest.js'
 import { getAccessRequestCurrentUserPermissions } from './routes/v2/model/accessRequest/getAccessRequestCurrentUserPermissions.js'
+import { getAccessRequests } from './routes/v2/model/accessRequest/getAccessRequests.js'
 import { getModelAccessRequests } from './routes/v2/model/accessRequest/getModelAccessRequests.js'
 import { patchAccessRequest } from './routes/v2/model/accessRequest/patchAccessRequest.js'
 import { postAccessRequest } from './routes/v2/model/accessRequest/postAccessRequest.js'
@@ -140,6 +141,7 @@ server.post('/api/v2/model/:modelId/release/:semver/review', ...postReleaseRevie
 
 server.post('/api/v2/model/:modelId/access-requests', ...postAccessRequest)
 server.get('/api/v2/model/:modelId/access-requests', getModelAccessRequests)
+server.get('/api/v2/access-requests/search', getAccessRequests)
 server.get('/api/v2/model/:modelId/access-request/:accessRequestId', ...getAccessRequest)
 server.delete('/api/v2/model/:modelId/access-request/:accessRequestId', ...deleteAccessRequest)
 server.patch('/api/v2/model/:modelId/access-request/:accessRequestId', ...patchAccessRequest)

backend/src/routes/v2/model/accessRequest/getAccessRequests.ts

@@ -0,0 +1,57 @@
+import { Request, Response } from 'express'
+import { z } from 'zod'
+
+import { AuditInfo } from '../../../../connectors/audit/Base.js'
+import audit from '../../../../connectors/audit/index.js'
+import { AccessRequestInterface } from '../../../../models/AccessRequest.js'
+import { findAccessRequests } from '../../../../services/accessRequest.js'
+import { accessRequestInterfaceSchema, registerPath } from '../../../../services/specification.js'
+import { coerceArray, parse, strictCoerceBoolean } from '../../../../utils/validate.js'
+
+export const GetAccessRequestsSchema = z.object({
+  query: z.object({
+    modelId: coerceArray(z.array(z.string()).optional().default([])),
+    schemaId: z.string().optional().default(''),
+    mine: strictCoerceBoolean(z.boolean().optional().default(false)),
+    adminAccess: strictCoerceBoolean(z.boolean().optional().default(false)),
+  }),
+})
+
+registerPath({
+  method: 'get',
+  path: '/api/v2/access-requests/search',
+  tags: ['access-request'],
+  description: 'Get all access requests for all models.',
+  schema: GetAccessRequestsSchema,
+  responses: {
+    200: {
+      description: 'An array of access request instances.',
+      content: {
+        'application/json': {
+          schema: z.object({
+            accessRequests: z.array(accessRequestInterfaceSchema),
+          }),
+        },
+      },
+    },
+  },
+})
+
+interface GetAccessRequestsResponse {
+  accessRequests: Array<AccessRequestInterface>
+}
+
+export const getAccessRequests = [
+  async (req: Request, res: Response<GetAccessRequestsResponse>): Promise<void> => {
+    req.audit = AuditInfo.ViewAccessRequests
+    const {
+      query: { modelId, schemaId, mine, adminAccess },
+    } = parse(req, GetAccessRequestsSchema)
+
+    const accessRequests = await findAccessRequests(req.user, modelId, schemaId, mine, adminAccess)
+
+    await audit.onViewAccessRequests(req, accessRequests)
+
+    res.json({ accessRequests })
+  },
+]

backend/src/services/accessRequest.ts

@@ -1,10 +1,12 @@
+// eslint-disable-next-line simple-import-sort/imports
 import { Validator } from 'jsonschema'
-import { Types } from 'mongoose'
+import { PipelineStage, Types } from 'mongoose'
 
 import authentication from '../connectors/authentication/index.js'
+import { Roles } from '../connectors/authentication/Base.js'
 import { AccessRequestAction } from '../connectors/authorisation/actions.js'
 import authorisation from '../connectors/authorisation/index.js'
-import { AccessRequestInterface } from '../models/AccessRequest.js'
+import AccessRequestModel, { AccessRequestDoc, AccessRequestInterface } from '../models/AccessRequest.js'
 import AccessRequest from '../models/AccessRequest.js'
 import ResponseModel, { ResponseKind } from '../models/Response.js'
 import ReviewModel from '../models/Review.js'
@@ -131,6 +133,74 @@ export async function getAccessRequestById(user: UserInterface, accessRequestId:
   return accessRequest
 }
 
+export async function findAccessRequests(
+  user: UserInterface,
+  modelId: Array<string>,
+  schemaId: string,
+  mine: boolean,
+  adminAccess?: boolean,
+): Promise<Array<AccessRequestDoc>> {
+  if (adminAccess) {
+    if (!(await authentication.hasRole(user, Roles.Admin))) {
+      throw Forbidden('You do not have the required role.', {
+        userDn: user.dn,
+        requiredRole: Roles.Admin,
+      })
+    }
+  }
+
+  const query: any = {}
+
+  if (modelId.length) {
+    query.modelId = { $in: modelId }
+  }
+
+  if (schemaId) {
+    query.schemaId = { $in: schemaId }
+  }
+
+  if (mine) {
+    query['metadata.overview.entities'] = {
+      $in: await authentication.getEntities(user),
+    }
+  }
+
+  const stages: PipelineStage[] = [{ $match: query }]
+
+  //Auth already checked, so just need to check if they require admin access
+  if (adminAccess) {
+    const results = await AccessRequestModel.aggregate(stages)
+    return results
+  }
+
+  stages.push(
+    { $group: { _id: '$modelId', accessRequests: { $push: '$$ROOT' } } },
+    {
+      $lookup: {
+        from: 'v2_models',
+        localField: '_id',
+        foreignField: 'id',
+        as: 'model',
+      },
+    },
+    {
+      $unwind: '$model',
+    },
+  )
+
+  const results = await AccessRequestModel.aggregate(stages)
+
+  const accessRequests: AccessRequestDoc[] = []
+  for (const result of results) {
+    const auth = await authorisation.accessRequests(user, result.model, result.accessRequests, AccessRequestAction.View)
+
+    const authorisedIds = new Set(auth.filter((result) => result.success).map((result) => result.id))
+    const filteredAccessRequests = result.accessRequests.filter((accessRequest) => authorisedIds.has(accessRequest.id))
+    accessRequests.push(...filteredAccessRequests)
+  }
+  return accessRequests
+}
+
 export type UpdateAccessRequestParams = Pick<AccessRequestInterface, 'metadata'>
 export async function updateAccessRequest(
   user: UserInterface,

backend/test/routes/model/accessRequest/__snapshots__/getAccessRequests.spec.ts.snap

@@ -0,0 +1,25 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`routes > accessRequest > getAccessRequests > 200 > ok 1`] = `
+{
+  "accessRequests": {
+    "_id": "664e1aa8bda1f88c28e1c0ce",
+    "deleted": false,
+    "deletedAt": "",
+    "deletedBy": "",
+    "id": "test-access-request-13623",
+    "modelId": "test-model-4342",
+  },
+}
+`;
+
+exports[`routes > accessRequest > getAccessRequests > audit > expected call 1`] = `
+{
+  "_id": "664e1aa8bda1f88c28e1c0ce",
+  "deleted": false,
+  "deletedAt": "",
+  "deletedBy": "",
+  "id": "test-access-request-13623",
+  "modelId": "test-model-4342",
+}
+`;

backend/test/routes/model/accessRequest/getAccessRequests.spec.ts

@@ -0,0 +1,51 @@
+import qs from 'qs'
+import { describe, expect, test, vi } from 'vitest'
+
+import audit from '../../../../src/connectors/audit/__mocks__/index.js'
+import AccessRequestModel from '../../../../src/models/AccessRequest.js'
+import { GetAccessRequestsSchema } from '../../../../src/routes/v2/model/accessRequest/getAccessRequests.js'
+import { createFixture, testGet } from '../../../testUtils/routes.js'
+import { testAccessRequest } from '../../../testUtils/testModels.js'
+
+vi.mock('../../../../src/connectors/audit/index.js')
+
+const accessRequestsMock = vi.hoisted(() => {
+  return {
+    findAccessRequests: vi.fn(() => undefined as any),
+  }
+})
+vi.mock('../../../../src/services/accessRequest.js', () => accessRequestsMock)
+
+const responseMock = vi.hoisted(() => {
+  return {
+    findResponses: vi.fn(() => undefined as any),
+  }
+})
+vi.mock('../../../../src/services/response.js', () => responseMock)
+
+describe('routes > accessRequest > getAccessRequests', () => {
+  test('200 > ok', async () => {
+    const accessRequestDoc = new AccessRequestModel({ ...testAccessRequest })
+    accessRequestsMock.findAccessRequests.mockResolvedValueOnce(accessRequestDoc)
+    responseMock.findResponses.mockResolvedValue([testAccessRequest])
+
+    const fixture = createFixture(GetAccessRequestsSchema)
+    const res = await testGet(`/api/v2/access-requests/search?${qs.stringify(fixture.query)}`)
+
+    expect(res.statusCode).toBe(200)
+    expect(res.body).matchSnapshot()
+  })
+
+  test('audit > expected call', async () => {
+    const accessRequestDoc = new AccessRequestModel({ ...testAccessRequest })
+    accessRequestsMock.findAccessRequests.mockResolvedValueOnce(accessRequestDoc)
+    responseMock.findResponses.mockResolvedValue([testAccessRequest])
+
+    const fixture = createFixture(GetAccessRequestsSchema)
+    const res = await testGet(`/api/v2/access-requests/search?${qs.stringify(fixture.query)}`)
+
+    expect(res.statusCode).toBe(200)
+    expect(audit.onViewAccessRequests).toBeCalled()
+    expect(audit.onViewAccessRequests.mock.calls.at(0)?.at(1)).toMatchSnapshot()
+  })
+})

backend/test/services/__snapshots__/accessRequest.spec.ts.snap

@@ -1,5 +1,33 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
+exports[`services > accessRequest > findAccessRequests > admin access with auth 1`] = `
+[
+  {
+    "accessRequests": [
+      {
+        "id": "a",
+      },
+    ],
+  },
+]
+`;
+
+exports[`services > accessRequest > findAccessRequests > all filters 1`] = `
+[
+  {
+    "id": "a",
+  },
+]
+`;
+
+exports[`services > accessRequest > findAccessRequests > no filters 1`] = `
+[
+  {
+    "id": "a",
+  },
+]
+`;
+
 exports[`services > accessRequest > getAccessRequestsByModel > good 1`] = `
 [
   {