Better auth handling

Author: jmgasper

src/auth/guards/scopes.guard.ts

@@ -32,7 +32,14 @@ export class ScopesGuard implements CanActivate {
           .map((s: string) => s.trim())
           .filter(Boolean);
 
-    const ok = required.some((s) => scopes.includes(s));
+    const normalizedRequiredScopes = required.map((scope) =>
+      scope.trim().toLowerCase(),
+    );
+    const normalizedScopes = scopes.map((scope) => scope.trim().toLowerCase());
+
+    const ok = normalizedScopes.some((scope) =>
+      normalizedRequiredScopes.includes(scope),
+    );
     if (ok) return true;
 
     const fallbackRoles = this.reflector.getAllAndOverride<string[]>(
@@ -48,7 +55,16 @@ export class ScopesGuard implements CanActivate {
             .map((r: string) => r.trim())
             .filter(Boolean);
 
-      const roleOk = roles.some((r: string) => fallbackRoles.includes(r));
+      const normalizedFallbackRoles = fallbackRoles.map((role) =>
+        role.trim().toLowerCase(),
+      );
+      const normalizedRoles = roles.map((role: string) =>
+        role.trim().toLowerCase(),
+      );
+
+      const roleOk = normalizedRoles.some((role: string) =>
+        normalizedFallbackRoles.includes(role),
+      );
       if (roleOk) return true;
     }
 

src/billing-accounts/billing-accounts.service.ts

@@ -33,8 +33,13 @@ import {
 } from "../auth/constants";
 
 export interface BillingAccountsAuthUser {
+  id?: number | string;
   role?: string;
   roles?: string[] | string;
+  sub?: number | string;
+  tcUserId?: number | string;
+  user_id?: number | string;
+  userID?: number | string;
   userId?: number | string;
 }
 
@@ -112,24 +117,33 @@ function getNormalizedAuthUserRoles(
 /**
  * Resolves the caller user id as a trimmed string when present.
  *
+ * Topcoder JWT middleware has used a few decoded claim names across services,
+ * so this accepts the canonical `userId` first and then falls back to the other
+ * common user-id claim spellings.
+ *
  * @param authUser Authenticated caller context from `req.authUser`.
  * @returns Normalized user id or `undefined` when missing.
  */
 function getNormalizedAuthUserId(
   authUser?: BillingAccountsAuthUser,
 ): string | undefined {
-  if (
-    typeof authUser?.userId === "number" &&
-    Number.isFinite(authUser.userId)
-  ) {
-    return String(authUser.userId);
+  const candidateUserId =
+    authUser?.userId ??
+    authUser?.user_id ??
+    authUser?.userID ??
+    authUser?.tcUserId ??
+    authUser?.id ??
+    authUser?.sub;
+
+  if (typeof candidateUserId === "number" && Number.isFinite(candidateUserId)) {
+    return String(candidateUserId);
   }
 
-  if (typeof authUser?.userId !== "string") {
+  if (typeof candidateUserId !== "string") {
     return undefined;
   }
 
-  const normalizedUserId = authUser.userId.trim();
+  const normalizedUserId = candidateUserId.trim();
 
   return normalizedUserId || undefined;
 }