fix: Restrict deactiveated enterprise user access

Author: suejung-sentry

graphql_api/tests/test_owner.py

@@ -762,6 +762,30 @@ def test_fetch_owner_on_unauthenticated_enteprise_guest_access(self):
             assert e.message == UnauthorizedGuestAccess.message
             assert e.extensions["code"] == UnauthorizedGuestAccess.code
 
+    @override_settings(IS_ENTERPRISE=True, GUEST_ACCESS=False)
+    def test_fetch_owner_on_unauthenticated_enteprise_guest_access_not_activated(self):
+        user = OwnerFactory(username="sample-user")
+        owner = OwnerFactory(username="sample-owner", plan_activated_users=[123, 456])
+        user.organizations = [owner.ownerid]
+        user.save()
+        owner.save()
+        query = (
+            """{
+                                    owner(username: "%s") {
+                                        isCurrentUserActivated
+                                    }
+                                }
+                                """
+            % owner.username
+        )
+
+        try:
+            self.gql_request(query, owner=user)
+
+        except GraphQLError as e:
+            assert e.message == UnauthorizedGuestAccess.message
+            assert e.extensions["code"] == UnauthorizedGuestAccess.code
+
     def test_fetch_current_user_is_okta_authenticated(self):
         account = AccountFactory()
         owner = OwnerFactory(username="sample-owner", service="github", account=account)
@@ -820,7 +844,7 @@ def test_fetch_current_user_is_not_okta_authenticated_no_account(self):
 
     @patch("shared.rate_limits.determine_entity_redis_key")
     @patch("shared.rate_limits.determine_if_entity_is_rate_limited")
-    @override_settings(IS_ENTERPRISE=True, GUEST_ACCESS=False)
+    @override_settings(IS_ENTERPRISE=True, GUEST_ACCESS=True)
     def test_fetch_is_github_rate_limited(
         self, mock_determine_rate_limit, mock_determine_redis_key
     ):

graphql_api/types/query/query.py

@@ -40,7 +40,7 @@ def resolve_me(_, info) -> Optional[Owner]:
 
 
 @query_bindable.field("owner")
-def resolve_owner(_, info, username):
+async def resolve_owner(_, info, username):
     configure_sentry_scope(query_name(info))
 
     service = info.context["service"]
@@ -50,7 +50,13 @@ def resolve_owner(_, info, username):
         if not user or not user.is_authenticated:
             raise UnauthorizedGuestAccess()
 
-    return get_owner(service, username)
+        # per product spec, if guestAccess is off for the environment, the current enterpriseUser
+        # must be "activated" in the given target owner (e.g., "codecov" org) in order to see things
+        target = await get_owner(service, username)
+        if user.ownerid not in target.plan_activated_users:
+            raise UnauthorizedGuestAccess()
+
+    return await get_owner(service, username)
 
 
 @query_bindable.field("config")