feat(backend): start of handling grant token rotation more gracefully (…

…#2887)

* feat(backend): add grantService.getOrCreate method

* feat(backend): update grant lookup call

* feat(backend): add deletedAt to grants table

* feat(backend): add migrations for grants table

* chore(backend): separating into functions

* chore(backend): adding authServerService to list of services

* test(backend): adding tests for getOrCreate and getExistingGrant functions

* chore(backend): merge migrations

* feat(backend): add subset actions if present

packages/backend/migrations/20240820101201_add_deleted_at_grants.js

@@ -0,0 +1,21 @@
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+exports.up = function (knex) {
+  return knex.schema.alterTable('grants', (table) => {
+    table.dropUnique(['authServerId', 'accessType', 'accessActions'])
+    table.timestamp('deletedAt').nullable()
+  })
+}
+
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+exports.down = function (knex) {
+  return knex.schema.alterTable('grants', (table) => {
+    table.unique(['authServerId', 'accessType', 'accessActions'])
+    table.dropColumn('deletedAt')
+  })
+}

packages/backend/src/app.ts

@@ -98,6 +98,8 @@ import {
 } from './open_payments/wallet_address/middleware'
 
 import { LoggingPlugin } from './graphql/plugin'
+import { GrantService } from './open_payments/grant/service'
+import { AuthServerService } from './open_payments/authServer/service'
 export interface AppContextData {
   logger: Logger
   container: AppContainer
@@ -232,6 +234,8 @@ export interface AppServices {
   incomingPaymentService: Promise<IncomingPaymentService>
   remoteIncomingPaymentService: Promise<RemoteIncomingPaymentService>
   receiverService: Promise<ReceiverService>
+  grantService: Promise<GrantService>
+  authServerService: Promise<AuthServerService>
   streamServer: Promise<StreamServer>
   webhookService: Promise<WebhookService>
   quoteService: Promise<QuoteService>

packages/backend/src/index.ts

@@ -256,6 +256,7 @@ export function initIocContainer(
   container.singleton('grantService', async (deps) => {
     return await createGrantService({
       authServerService: await deps.use('authServerService'),
+      openPaymentsClient: await deps.use('openPaymentsClient'),
       logger: await deps.use('logger'),
       knex: await deps.use('knex')
     })

packages/backend/src/open_payments/grant/errors.ts

@@ -0,0 +1,8 @@
+export enum GrantError {
+  GrantRequiresInteraction = 'GrantRequiresInteraction',
+  InvalidGrantRequest = 'InvalidGrantRequest'
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/explicit-module-boundary-types
+export const isGrantError = (o: any): o is GrantError =>
+  Object.values(GrantError).includes(o)

packages/backend/src/open_payments/grant/model.ts

@@ -33,6 +33,7 @@ export class Grant extends BaseModel {
   public accessType!: AccessType
   public accessActions!: AccessAction[]
   public expiresAt?: Date | null
+  public deletedAt?: Date
 
   public get expired(): boolean {
     return !!this.expiresAt && this.expiresAt <= new Date()