PM-3575 - handle BA Admin user

package.json

@@ -26,6 +26,7 @@
     "@nestjs/platform-express": "^11.1.7",
     "@nestjs/swagger": "^11.2.1",
     "@prisma/client": "^6.18.0",
+    "@topcoder/billing-accounts-api-v6": "github:topcoder-platform/billing-accounts-api-v6#develop",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.2",
     "cors": "^2.8.5",

src/api/admin/admin.controller.ts

@@ -44,8 +44,21 @@ export class AdminController {
     private readonly tcMembersService: TopcoderMembersService,
   ) {}
 
+  private isBaAdmin(user?: { roles?: string[] }) {
+    return (user?.roles || []).some(
+      (r) =>
+        r &&
+        r.trim().toLowerCase() === Role.PaymentBaAdmin.trim().toLowerCase(),
+    );
+  }
+
   @Post('/winnings/search')
-  @Roles(Role.PaymentAdmin, Role.PaymentEditor, Role.PaymentViewer)
+  @Roles(
+    Role.PaymentAdmin,
+    Role.PaymentBaAdmin,
+    Role.PaymentEditor,
+    Role.PaymentViewer,
+  )
   @ApiOperation({
     summary: 'Search winnings with parameters',
     description: 'Roles: Payment Admin, Payment Editor, Payment Viewer',
@@ -62,8 +75,16 @@ export class AdminController {
   @HttpCode(HttpStatus.OK)
   async searchWinnings(
     @Body() body: WinningRequestDto,
+    @User() user: any,
   ): Promise<ResponseDto<SearchWinningResult>> {
-    const result = await this.winningsRepo.searchWinnings(body);
+    const result = await this.winningsRepo.searchWinnings(
+      await this.adminService.applyBaAdminUserFilters(
+        user.id,
+        this.isBaAdmin(user),
+        body,
+      ),
+    );
+
     if (result.error) {
       result.status = ResponseStatusType.ERROR;
     }
@@ -74,7 +95,12 @@ export class AdminController {
   }
 
   @Post('/winnings/export')
-  @Roles(Role.PaymentAdmin, Role.PaymentEditor, Role.PaymentViewer)
+  @Roles(
+    Role.PaymentAdmin,
+    Role.PaymentBaAdmin,
+    Role.PaymentEditor,
+    Role.PaymentViewer,
+  )
   @ApiOperation({
     summary: 'Export search winnings result in csv file format',
     description: 'Roles: Payment Admin, Payment Editor, Payment Viewer',
@@ -91,11 +117,17 @@ export class AdminController {
   @HttpCode(HttpStatus.OK)
   @Header('Content-Type', 'text/csv')
   @Header('Content-Disposition', 'attachment; filename="winnings.csv"')
-  async exportWinnings(@Body() body: WinningRequestDto) {
-    const result = await this.winningsRepo.searchWinnings({
-      ...body,
-      limit: 999,
-    });
+  async exportWinnings(@Body() body: WinningRequestDto, @User() user: any) {
+    const result = await this.winningsRepo.searchWinnings(
+      await this.adminService.applyBaAdminUserFilters(
+        user.id,
+        this.isBaAdmin(user),
+        {
+          ...body,
+          limit: 999,
+        },
+      ),
+    );
 
     const handles = await this.tcMembersService.getHandlesByUserIds(
       result.data.winnings.map((d) => d.winnerId),
@@ -149,7 +181,7 @@ export class AdminController {
   }
 
   @Patch('/winnings')
-  @Roles(Role.PaymentAdmin, Role.PaymentEditor)
+  @Roles(Role.PaymentAdmin, Role.PaymentBaAdmin, Role.PaymentEditor)
   @ApiOperation({
     summary: 'Update winnings with given parameter',
     description:
@@ -175,7 +207,11 @@ export class AdminController {
       );
     }
 
-    const result = await this.adminService.updateWinnings(body, user.id);
+    const result = await this.adminService.updateWinnings(
+      body,
+      user.id,
+      this.isBaAdmin(user),
+    );
 
     result.status = ResponseStatusType.SUCCESS;
     if (result.error) {
@@ -186,7 +222,12 @@ export class AdminController {
   }
 
   @Get('/winnings/:winningID/audit')
-  @Roles(Role.PaymentAdmin, Role.PaymentEditor, Role.PaymentViewer)
+  @Roles(
+    Role.PaymentAdmin,
+    Role.PaymentBaAdmin,
+    Role.PaymentEditor,
+    Role.PaymentViewer,
+  )
   @ApiOperation({
     summary: 'List winning audit logs with given winning id',
     description: 'Roles: Payment Admin, Payment Editor, Payment Viewer',
@@ -203,7 +244,12 @@ export class AdminController {
   })
   async getWinningAudit(
     @Param('winningID') winningId: string,
+    @User() user: any,
   ): Promise<ResponseDto<WinningAuditDto[]>> {
+    if (this.isBaAdmin(user)) {
+      await this.adminService.verifyBaAdminAccessToWinning(winningId, user.id);
+    }
+
     const result = await this.adminService.getWinningAudit(winningId);
 
     result.status = ResponseStatusType.SUCCESS;
@@ -215,7 +261,12 @@ export class AdminController {
   }
 
   @Get('/winnings/:winningID/audit-payout')
-  @Roles(Role.PaymentAdmin, Role.PaymentEditor, Role.PaymentViewer)
+  @Roles(
+    Role.PaymentAdmin,
+    Role.PaymentBaAdmin,
+    Role.PaymentEditor,
+    Role.PaymentViewer,
+  )
   @ApiOperation({
     summary: 'Fetch winnings payout audit logs with given winning id.',
     description:
@@ -233,7 +284,12 @@ export class AdminController {
   })
   async getWinningAuditPayout(
     @Param('winningID') winningId: string,
+    @User() user: any,
   ): Promise<ResponseDto<AuditPayoutDto[]>> {
+    if (this.isBaAdmin(user)) {
+      await this.adminService.verifyBaAdminAccessToWinning(winningId, user.id);
+    }
+
     const result = await this.adminService.getWinningAuditPayout(winningId);
 
     result.status = ResponseStatusType.SUCCESS;

src/api/admin/admin.service.ts

@@ -14,7 +14,8 @@ import { PaymentStatus } from 'src/dto/payment.dto';
 import { WinningAuditDto, AuditPayoutDto } from './dto/audit.dto';
 import { WinningUpdateRequestDto } from './dto/winnings.dto';
 import { TopcoderChallengesService } from 'src/shared/topcoder/challenges.service';
-import { Logger } from 'src/shared/global';
+import { Logger, getBaClient } from 'src/shared/global';
+import { WinningRequestDto } from 'src/dto/winning.dto';
 
 function formatDate(date = new Date()) {
   const pad = (n, z = 2) => String(n).padStart(z, '0');
@@ -43,6 +44,32 @@ export class AdminService {
     private readonly tcChallengesService: TopcoderChallengesService,
   ) {}
 
+  async getBillingAccountsForUser(userId: string): Promise<string[]> {
+    const baPrisma = getBaClient();
+    const baRows = await baPrisma.billingAccountAccess.findMany({
+      where: {
+        userId,
+      }
+    });
+
+    return baRows.map(r => `${r.billingAccountId}`);
+  }
+
+  async applyBaAdminUserFilters(
+    userId: string,
+    isBaAdmin?: boolean,
+    filters: WinningRequestDto = {},
+  ) {
+    if (!isBaAdmin) {
+      return filters;
+    }
+
+    return {
+      ...filters,
+      billingAccounts: await this.getBillingAccountsForUser(userId),
+    };
+  }
+
   private getWinningById(winningId: string) {
     return this.prisma.winnings.findFirst({ where: { winning_id: winningId } });
   }
@@ -65,6 +92,47 @@ export class AdminService {
     });
   }
 
+  /**
+   * Verify that a BA admin user has access to the billing account(s)
+   * associated with the given winningsId. Throws BadRequestException when
+   * access is not allowed.
+   */
+  async verifyBaAdminAccessToWinning(
+    winningsId: string,
+    userId: string,
+  ): Promise<void> {
+    const payments = await this.prisma.payment.findMany({
+      where: {
+        winnings_id: {
+          equals: winningsId,
+        },
+      },
+      select: {
+        billing_account: true,
+      }
+    });;
+
+    if (!payments || payments.length === 0) {
+      // nothing to check
+      return;
+    }
+
+    const allowedBAs = await this.getBillingAccountsForUser(userId);
+    const paymentBAs = payments
+      .map((p) => p.billing_account)
+      .filter((b) => b !== null && b !== undefined);
+
+    const unauthorized = paymentBAs.some((ba) => !allowedBAs.includes(`${ba}`));
+    if (unauthorized) {
+      this.logger.warn(
+        `BA admin ${userId} attempted to access winnings ${winningsId} for unauthorized billing account(s)`,
+      );
+      throw new BadRequestException(
+        'BA admin user does not have access to the billing account for this winnings',
+      );
+    }
+  }
+
   /**
    * Update winnings with parameters
    * @param body the request body
@@ -74,6 +142,7 @@ export class AdminService {
   async updateWinnings(
     body: WinningUpdateRequestDto,
     userId: string,
+    isBaAdmin?: boolean,
   ): Promise<ResponseDto<string>> {
     const result = new ResponseDto<string>();
 
@@ -84,6 +153,10 @@ export class AdminService {
     );
     this.logger.log(`updateWinnings payload: ${JSON.stringify(body)}`);
 
+    if (isBaAdmin) {
+      await this.verifyBaAdminAccessToWinning(body.winningsId, userId);
+    }
+
     try {
       const payments = await this.getPaymentsByWinningsId(
         winningsId,
@@ -100,6 +173,8 @@ export class AdminService {
         throw new NotFoundException('failed to get current payments');
       }
 
+
+
       let releaseDate;
       if (body.paymentStatus) {
         releaseDate = await this.getPaymentReleaseDateByWinningsId(winningsId);
@@ -385,7 +460,9 @@ export class AdminService {
       // Run all transaction tasks in a single prisma transaction
       await this.prisma.$transaction(async (tx) => {
         for (let i = 0; i < transactions.length; i++) {
-          this.logger.log(`Executing transaction ${i + 1}/${transactions.length}`);
+          this.logger.log(
+            `Executing transaction ${i + 1}/${transactions.length}`,
+          );
           await transactions[i](tx);
         }
       });

src/api/repository/winnings.repo.ts

@@ -62,7 +62,7 @@ export class WinningsRepository {
     winnerIds?: string[],
     externalIds?: string[],
     date?: DateFilterType,
-  ): Prisma.winningsFindManyArgs['where'] {
+  ): Prisma.winningsWhereInput {
     const typeFilter = type
       ? {
           equals: type as winnings_type,
@@ -185,6 +185,17 @@ export class WinningsRepository {
         searchProps.date,
       );
 
+      if (searchProps.billingAccounts) {
+        // override payment filter to include billing account constraint
+        // while preserving status/installment constraints
+        (queryWhere as any).payment.some = {
+          ...queryWhere.payment!.some,
+          billing_account: {
+            in: searchProps.billingAccounts,
+          },
+        };
+      }
+
       const orderBy = this.getOrderByWithWinnerId(
         searchProps.sortBy,
         searchProps.sortOrder,

src/config/config.env.ts

@@ -115,4 +115,7 @@ export class ConfigEnv {
 
   @IsInt({ each: true })
   TGBillingAccounts = [80000062, 80002800];
+
+  @IsString()
+  BILLING_ACCOUNTS_DB_URL!: string;
 }

src/core/auth/auth.constants.ts

@@ -1,6 +1,7 @@
 export enum Role {
   Administrator = 'Administrator',
   PaymentAdmin = 'Payment Admin',
+  PaymentBaAdmin = 'Payment BA Admin',
   PaymentEditor = 'Payment Editor',
   PaymentViewer = 'Payment Viewer',
   TaskManager = 'Task Manager',

src/core/auth/guards/roles.guard.ts

@@ -88,6 +88,7 @@ export class RolesGuard implements CanActivate {
       id: userId,
       handle: userHandle,
       email: request.email,
+      roles: userRoles,
     };
 
     return true;

src/dto/winning.dto.ts

@@ -189,6 +189,17 @@ export class WinningRequestDto extends SortPagination {
   @IsOptional()
   @IsEnum(DateFilterType)
   date?: DateFilterType;
+
+  @ApiProperty({
+    description: 'The array of billing account ids',
+    example: ['1234'],
+  })
+  @IsOptional()
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsString({ each: true })
+  @IsNotEmpty({ each: true })
+  billingAccounts?: string[];
 }
 
 export class WinningCreateRequestDto {

src/shared/global/ba-prisma.client.ts

@@ -0,0 +1,31 @@
+import { PrismaClientOptions } from '@prisma/client/runtime/library';
+import { PrismaClient as BaPrismaClient } from '@topcoder/billing-accounts-api-v6/packages/ba-prisma-client';
+import { ENV_CONFIG } from 'src/config';
+
+const clientOptions = {
+  transactionOptions: {
+    timeout: 20000,
+  },
+  log: [
+    { level: 'query', emit: 'event' },
+    { level: 'info', emit: 'event' },
+    { level: 'warn', emit: 'event' },
+    { level: 'error', emit: 'event' },
+  ] as PrismaClientOptions['log'],
+};
+
+let baPrismaClient: BaPrismaClient;
+export const getBaClient = () => {
+  if (!baPrismaClient) {
+    if (!ENV_CONFIG.BILLING_ACCOUNTS_DB_URL) {
+      throw new Error(
+        'BILLING_ACCOUNTS_DB_URL must be set for challenges Prisma client',
+      );
+    }
+    baPrismaClient = new BaPrismaClient({
+      ...clientOptions,
+      datasources: { db: { url: ENV_CONFIG.BILLING_ACCOUNTS_DB_URL } },
+    });
+  }
+  return baPrismaClient;
+};

src/shared/global/index.ts

@@ -1 +1,2 @@
 export * from './logger';
+export * from './ba-prisma.client';