PM-3575 - Add new endpoint to fetch salesforce BAs for user

.env.example

@@ -11,5 +11,15 @@ AUTH0_AUDIENCE=""               # e.g. https://m2m.topcoder-dev.com/
 AUTH0_ISSUER=""                 # e.g. https://topcoder-dev.auth0.com/
 ALLOWED_ROLES="Administrator,Topcoder User,Manager"  # comma-separated
 
+# Salesforce
+SALESFORCE_CLIENT_ID=""
+SALESFORCE_SUBJECT=""                # e.g. integration@topcoder.com
+SALESFORCE_CLIENT_KEY=""             # PEM private key (use `\\n` for newlines)
+SALESFORCE_AUDIENCE="https://login.salesforce.com" # or https://test.salesforce.com for sandbox
+
+# Optional SFDC field mapping overrides (defaults used by service)
+SFDC_BILLING_ACCOUNT_NAME_FIELD="Billing_Account_name__c"
+SFDC_BILLING_ACCOUNT_MARKUP_FIELD="Mark_Up__c"
+SFDC_BILLING_ACCOUNT_ACTIVE_FIELD="Active__c"
 # Service
 PORT=3000

README.md

@@ -8,6 +8,7 @@
   - `GET /billing-accounts` 
   - `POST /billing-accounts` 
   - `GET /billing-accounts/:billingAccountId` (includes locked/consumed arrays + budget totals)
+  - `GET /billing-accounts/users/:userId` (list billing accounts accessible by the given Topcoder user ID — resolved via Salesforce resource object)
   - `PATCH /billing-accounts/:billingAccountId`
   - `PATCH /billing-accounts/:billingAccountId/lock-amount` (0 amount = unlock)
   - `PATCH /billing-accounts/:billingAccountId/consume-amount` (deletes locks for challenge, then upserts consumed)
@@ -40,6 +41,18 @@ pnpm run dev
 pnpm run build && pnpm start
 ```
 
+## Salesforce integration
+
+- This service can resolve billing accounts a user has access to via Salesforce. To enable Salesforce calls, configure the following environment variables in `.env` (see `.env.example`):
+  - `SALESFORCE_CLIENT_ID` — Connected App client ID
+  - `SALESFORCE_SUBJECT` — integration user username (subject for JWT)
+  - `SALESFORCE_CLIENT_KEY` — PEM private key for the connected app (escape newlines as `\\n` in single-line `.env` files)
+  - `SALESFORCE_AUDIENCE` — login URL (default `https://login.salesforce.com`, use `https://test.salesforce.com` for sandbox)
+
+- Optional overrides for field names returned by your Salesforce org are available via `SFDC_BILLING_ACCOUNT_NAME_FIELD`, `SFDC_BILLING_ACCOUNT_MARKUP_FIELD`, and `SFDC_BILLING_ACCOUNT_ACTIVE_FIELD`.
+
+- Once configured, you can call `GET /v6/billing-accounts/users/:userId` to obtain billing accounts the specified user has access to (the service authenticates to Salesforce using JWT Bearer flow and queries resource objects).
+
 ## Import scripts
 
 - Legacy import (clients, billing accounts, challenge budgets):

package.json

@@ -19,18 +19,21 @@
     "generate:subcontractor-sql": "ts-node scripts/generate-subcontractor-sql.ts"
   },
   "dependencies": {
+    "@nestjs/cli": "^11.0.0",
     "@nestjs/common": "^10.3.0",
     "@nestjs/config": "^3.2.0",
     "@nestjs/core": "^10.3.0",
-    "@nestjs/cli": "^11.0.0",
-    "@nestjs/swagger": "^7.4.2",
     "@nestjs/mapped-types": "^2.1.0",
     "@nestjs/platform-express": "^10.3.0",
+    "@nestjs/swagger": "^7.4.2",
     "@prisma/client": "^6.18.0",
     "@types/express": "^5.0.3",
+    "axios": "^1.13.4",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
     "dotenv": "^16.4.5",
+    "jsonwebtoken": "^9.0.3",
+    "lodash": "^4.17.23",
     "pino": "^9.0.0",
     "prisma": "^6.18.0",
     "reflect-metadata": "^0.1.13",
@@ -41,6 +44,9 @@
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
     "@eslint/js": "^9.18.0",
+    "@types/axios": "^0.14.4",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/lodash": "^4.17.23",
     "@types/node": "^20.14.9",
     "eslint": "^9.18.0",
     "eslint-config-prettier": "^10.0.1",

src/billing-accounts/billing-accounts.controller.ts

@@ -86,6 +86,29 @@ export class BillingAccountsController {
     return this.service.create(dto);
   }
 
+  @Get("users/:userId")
+  @UseGuards(RolesGuard, ScopesGuard)
+  @Roles(ADMIN_ROLE, COPILOT_ROLE)
+  @Scopes(SCOPES.READ_BA, SCOPES.ALL_BA)
+  @ApiOperation(
+    buildOperationDoc({
+      summary: "List billing accounts accessible by user",
+      description:
+        "Retrieve billing accounts that the given user ID has access to (via Salesforce).",
+      jwtRoles: [ADMIN_ROLE, COPILOT_ROLE],
+      m2mScopes: [SCOPES.READ_BA, SCOPES.ALL_BA],
+    }),
+  )
+  @ApiOkResponse({ description: "List of billing accounts returned" })
+  @ApiParam({
+    name: "userId",
+    description: "User ID (number)",
+    type: Number,
+  })
+  async listByUserIds(@Param("userId", ParseIntPipe) userId: number) {
+    return this.service.listByUserId(userId);
+  }
+
   @Get(":billingAccountId")
   @UseGuards(RolesGuard, ScopesGuard)
   @Roles(ADMIN_ROLE, COPILOT_ROLE)

src/billing-accounts/billing-accounts.module.ts

@@ -2,10 +2,11 @@ import { Module } from "@nestjs/common";
 import { BillingAccountsController } from "./billing-accounts.controller";
 import { BillingAccountsService } from "./billing-accounts.service";
 import { MembersLookupService } from "../common/members-lookup.service";
+import SalesforceService from "../common/salesforce.service";
 
 @Module({
   controllers: [BillingAccountsController],
-  providers: [BillingAccountsService, MembersLookupService],
-  exports: [BillingAccountsService, MembersLookupService],
+  providers: [BillingAccountsService, MembersLookupService, SalesforceService],
+  exports: [BillingAccountsService, MembersLookupService, SalesforceService],
 })
 export class BillingAccountsModule {}

src/billing-accounts/billing-accounts.service.ts

@@ -7,14 +7,37 @@ import { UpdateBillingAccountDto } from "./dto/update-billing-account.dto";
 import { LockAmountDto } from "./dto/lock-amount.dto";
 import { ConsumeAmountDto } from "./dto/consume-amount.dto";
 import { MembersLookupService } from "../common/members-lookup.service";
+import SalesforceService from "../common/salesforce.service";
 
 @Injectable()
 export class BillingAccountsService {
   constructor(
     private readonly prisma: PrismaService,
     private readonly membersLookup: MembersLookupService,
+    private readonly salesforce: SalesforceService,
   ) {}
 
+  /**
+   * List billing accounts one or more user IDs have access to (via Salesforce resource object).
+   * Accepts a single userId (number).
+   */
+  async listByUserId(userId: number) {
+    const { accessToken, instanceUrl } = await this.salesforce.authenticate();
+
+    // escape backslashes and single quotes and build IN clause
+    const escaped = `'${String(userId).replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+    const nameField =
+      process.env.SFDC_BILLING_ACCOUNT_NAME_FIELD || "Billing_Account_name__c";
+    const sql = `SELECT Topcoder_Billing_Account__r.Id, Topcoder_Billing_Account__r.TopCoder_Billing_Account_Id__c, Topcoder_Billing_Account__r.${nameField}, Topcoder_Billing_Account__r.Start_Date__c, Topcoder_Billing_Account__r.End_Date__c FROM Topcoder_Billing_Account_Resource__c tbar WHERE Topcoder_Billing_Account__r.Active__c=true AND UserID__c = ${escaped}`;
+
+    const res = await this.salesforce.queryUserBillingAccounts(
+      sql,
+      accessToken,
+      instanceUrl,
+    );
+    return res;
+  }
+
   async list(q: QueryBillingAccountsDto) {
     const {
       clientId,