Talent manager permissions for BAs (https://topcoder.atlassian.net/browse/PM-4376)

Author: jmgasper

README.md

@@ -23,6 +23,10 @@
 **Authorization**
 - JWT middleware via `tc-core-library-js` attaches `req.authUser`
 - Guards for Roles (e.g., `Administrator`) and M2M Scopes are provided.
+- Billing-account management endpoints accept `administrator`, `Talent Manager`,
+  and `Topcoder Talent Manager` JWT roles; read-only billing-account lookups
+  also continue to allow `copilot`. Role checks are case-insensitive so mixed
+  token casing does not block Talent Manager access.
 - Configure env: `AUTH_SECRET` or `AUTH0_URL/AUDIENCE/ISSUER` as needed.
 
 ## Quickstart

src/auth/auth.middleware.ts

@@ -1,9 +1,6 @@
 import { Injectable, NestMiddleware } from "@nestjs/common";
 import { Request, Response, NextFunction } from "express";
-
-// tc-core-library-js is CommonJS only, import via require
-
-const tcCore = require("tc-core-library-js");
+import * as tcCore from "tc-core-library-js";
 
 @Injectable()
 export class AuthMiddleware implements NestMiddleware {

src/auth/constants.ts

@@ -13,3 +13,5 @@ export const SCOPES = {
 
 export const ADMIN_ROLE = "administrator";
 export const COPILOT_ROLE = "copilot";
+export const TALENT_MANAGER_ROLE = "Talent Manager";
+export const TOPCODER_TALENT_MANAGER_ROLE = "Topcoder Talent Manager";

src/auth/guards/roles.guard.ts

@@ -19,6 +19,9 @@ export class RolesGuard implements CanActivate {
       context.getClass(),
     ]);
     if (!required || required.length === 0) return true;
+    const normalizedRequiredRoles = required.map((role) =>
+      role.trim().toLowerCase(),
+    );
 
     const req = context.switchToHttp().getRequest();
     const user = req.authUser;
@@ -31,24 +34,33 @@ export class RolesGuard implements CanActivate {
           .split(",")
           .map((r: string) => r.trim())
           .filter(Boolean);
+    const normalizedRoles = roles.map((role) => role.toLowerCase());
 
-    const ok = roles.some((r: string) => required.includes(r));
+    const ok = normalizedRoles.some((role: string) =>
+      normalizedRequiredRoles.includes(role),
+    );
     if (ok) return true;
 
     const fallbackScopes = this.reflector.getAllAndOverride<string[]>(
       SCOPES_KEY,
-      [context.getHandler(), context.getClass()]
+      [context.getHandler(), context.getClass()],
     );
 
     if (fallbackScopes && fallbackScopes.length > 0) {
+      const normalizedFallbackScopes = fallbackScopes.map((scope) =>
+        scope.trim().toLowerCase(),
+      );
       const scopes: string[] = Array.isArray(user.scopes)
         ? user.scopes
         : (user.scope || "")
             .split(" ")
             .map((s: string) => s.trim())
             .filter(Boolean);
+      const normalizedScopes = scopes.map((scope) => scope.toLowerCase());
 
-      const scopeOk = fallbackScopes.some((s) => scopes.includes(s));
+      const scopeOk = normalizedScopes.some((scope) =>
+        normalizedFallbackScopes.includes(scope),
+      );
       if (scopeOk) return true;
     }
 

src/auth/guards/scopes.guard.ts

@@ -35,10 +35,10 @@ export class ScopesGuard implements CanActivate {
     const ok = required.some((s) => scopes.includes(s));
     if (ok) return true;
 
-    const fallbackRoles = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
-      context.getHandler(),
-      context.getClass(),
-    ]);
+    const fallbackRoles = this.reflector.getAllAndOverride<string[]>(
+      ROLES_KEY,
+      [context.getHandler(), context.getClass()],
+    );
 
     if (fallbackRoles && fallbackRoles.length > 0) {
       const roles: string[] = Array.isArray(user.roles)