Merge pull request #20 from topcoder-platform/PM-4847

Updates for M2M

Author: jmgasper

src/shared/services/permission.service.spec.ts

@@ -346,6 +346,28 @@ describe('PermissionService', () => {
     expect(allowed).toBe(true);
   });
 
+  it('allows reading any project for machine token with project read scope', () => {
+    const allowed = service.hasNamedPermission(Permission.READ_PROJECT_ANY, {
+      scopes: [Scope.PROJECTS_READ],
+      isMachine: true,
+    });
+
+    expect(allowed).toBe(true);
+  });
+
+  it('allows reading any project when machine scope is inferred from token claims', () => {
+    const allowed = service.hasNamedPermission(Permission.READ_PROJECT_ANY, {
+      scopes: [],
+      isMachine: false,
+      tokenPayload: {
+        gty: 'client-credentials',
+        scope: Scope.PROJECTS_READ,
+      },
+    });
+
+    expect(allowed).toBe(true);
+  });
+
   it.each([
     UserRole.TOPCODER_MANAGER,
     UserRole.PROJECT_MANAGER,

src/shared/services/permission.service.ts

@@ -254,7 +254,7 @@ export class PermissionService {
     switch (permission) {
       // Project read/write lifecycle permissions.
       case NamedPermission.READ_PROJECT_ANY:
-        return hasProjectReadTopcoderRole;
+        return hasProjectReadTopcoderRole || hasProjectReadScope;
 
       case NamedPermission.VIEW_PROJECT:
         return (

src/shared/utils/permission-docs.utils.ts

@@ -236,6 +236,7 @@ function getNamedPermissionDocumentation(
     case NamedPermission.READ_PROJECT_ANY:
       return createSummary({
         userRoles: ADMIN_AND_MANAGER_ROLES,
+        scopes: PROJECT_READ_SCOPES,
       });
 
     case NamedPermission.VIEW_PROJECT:

src/shared/utils/swagger.utils.spec.ts

@@ -76,6 +76,27 @@ describe('enrichSwaggerAuthDocumentation', () => {
     );
   });
 
+  it('documents project-read machine scopes for global project access routes', () => {
+    const document = createDocument({
+      description: 'List projects.',
+      [SWAGGER_REQUIRED_ROLES_KEY]: Object.values(UserRole),
+      [SWAGGER_REQUIRED_SCOPES_KEY]: [
+        Scope.PROJECTS_READ,
+        Scope.PROJECTS_WRITE,
+        Scope.PROJECTS_ALL,
+      ],
+      [SWAGGER_REQUIRED_PERMISSIONS_KEY]: [Permission.READ_PROJECT_ANY],
+    });
+
+    enrichSwaggerAuthDocumentation(document);
+
+    const description = document.paths['/test'].get?.description;
+
+    expect(description).toContain(
+      'Policy allows token scopes (any): all:connect_project, all:projects, read:projects, write:projects',
+    );
+  });
+
   it('documents permission-specific machine scopes when policy narrows route access', () => {
     const document = createDocument({
       description: 'Get project billing account details.',