Fix admin integrations

dev/tool/src/github.ts

@@ -54,7 +54,7 @@ export async function performGithubAccountMigrations (
   txes: Tx[],
   region: string | null
 ): Promise<void> {
-  const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' })
   const githubToken = generateToken(systemAccountUuid, undefined, { service: 'github' })
   const accountClient = getAccountClient(token)
 

dev/tool/src/gmail.ts

@@ -79,7 +79,7 @@ export async function performGmailAccountMigrations (
   txes: Tx[]
 ): Promise<void> {
   console.log('Start Gmail migrations')
-  const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' })
   const accountClient = getAccountClient(token)
 
   const allWorkpaces = await accountClient.listWorkspaces(region)

dev/tool/src/markup.ts

@@ -378,7 +378,7 @@ export async function restoreMarkupRefs (
   storageAdapter: StorageAdapter,
   region: string | null
 ): Promise<void> {
-  const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' })
   const ctx = new MeasureMetricsContext('restore-markup-ref', {})
 
   const accountClient = getAccountClient(token)

dev/tool/src/restoreGithub.ts

@@ -16,7 +16,7 @@ export async function restoreGithubIntegrations (dbUrl: string, dryrun: boolean)
   try {
     const pg = getDBClient(dbUrl)
     const pgClient = await pg.getClient()
-    const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
+    const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' })
     const accountClient = getAccountClient(token)
 
     const integrationSettings = await pgClient<

server/account/src/__tests__/utils.test.ts

@@ -1686,15 +1686,6 @@ describe('account utils', () => {
       }).not.toThrow()
     })
 
-    test('should not throw for admin', () => {
-      const services = ['service1']
-      const extra = { service: 'service2', admin: 'true' }
-
-      expect(() => {
-        verifyAllowedServices(services, extra)
-      }).not.toThrow()
-    })
-
     test('should throw for unauthorized service', () => {
       const services = ['service1']
       const extra = { service: 'service2' }

server/account/src/serviceOperations.ts

@@ -585,10 +585,12 @@ export async function addSocialIdToPerson (
   const { person, type, value, confirmed, displayValue } = params
   const { extra } = decodeTokenVerbose(ctx, token)
 
-  verifyAllowedServices(
-    ['github', 'telegram-bot', 'gmail', 'tool', 'workspace', 'hulygram', 'google-calendar', 'ai-assistant'],
-    extra
-  )
+  if (extra?.admin !== 'true') {
+    verifyAllowedServices(
+      ['github', 'telegram-bot', 'gmail', 'tool', 'workspace', 'hulygram', 'google-calendar', 'ai-assistant'],
+      extra
+    )
+  }
 
   if (person == null || person === '' || !Object.values(SocialIdType).includes(type) || value == null || value === '') {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))

server/account/src/utils.ts

@@ -1536,7 +1536,7 @@ export async function getWorkspaces (
 }
 
 export function verifyAllowedServices (services: string[], extra: any, shouldThrow = true): boolean {
-  const ok = services.includes(extra?.service) || extra?.admin === 'true'
+  const ok = services.includes(extra?.service)
 
   if (!ok && shouldThrow) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
@@ -1811,7 +1811,8 @@ export const integrationServices = [
   'gmail',
   'google-calendar',
   'huly-mail',
-  'ai-assistant'
+  'ai-assistant',
+  'tool'
 ]
 
 export async function findExistingIntegration (

tests/sanity/package.json

@@ -52,6 +52,7 @@
     "@hcengineering/core": "^0.7.7",
     "@hcengineering/client-resources": "^0.7.6",
     "@hcengineering/account": "^0.7.0",
-    "@hcengineering/account-client": "^0.7.5"
+    "@hcengineering/account-client": "^0.7.5",
+    "@hcengineering/server-token": "^0.7.5"
   }
 }

tests/sanity/tests/API/AccountClient.ts

@@ -1,5 +1,7 @@
 import { getClient as getClientRaw, type AccountClient } from '@hcengineering/account-client'
 import { LocalUrl, PlatformAdmin } from '../utils'
+import { systemAccountUuid } from '@hcengineering/core'
+import { generateToken } from '@hcengineering/server-token'
 
 let adminAccountClient: AccountClient
 
@@ -18,3 +20,8 @@ export async function getAdminAccountClient (): Promise<AccountClient> {
   adminAccountClient = getClientRaw(LocalUrl, loginInfo.token)
   return adminAccountClient
 }
+
+export async function getServiceAccountClient (serviceName: string): Promise<AccountClient> {
+  const token = generateToken(systemAccountUuid, undefined, { service: serviceName }, 'secret')
+  return getClientRaw(LocalUrl, token)
+}

tests/sanity/tests/integrations.spec.ts

@@ -4,11 +4,11 @@ import { Integration, IntegrationSecret } from '@hcengineering/account'
 import { buildSocialIdString, IntegrationKind, SocialIdType } from '@hcengineering/core'
 
 import { PlatformUser } from './utils'
-import { getAdminAccountClient } from './API/AccountClient'
+import { getServiceAccountClient } from './API/AccountClient'
 
 test.describe('integrations in accounts tests', () => {
   test('manage integrations', async () => {
-    const accountClient = await getAdminAccountClient()
+    const accountClient = await getServiceAccountClient('github')
 
     const personUuid = await accountClient.findPersonBySocialKey(
       buildSocialIdString({ type: SocialIdType.EMAIL, value: PlatformUser })

ws-tests/api-tests/src/__tests__/rest.test.ts

@@ -75,7 +75,7 @@ describe('rest-api-server', () => {
     accountClient = getAccountClient(config.ACCOUNTS_URL, apiWorkspace1.token)
     adminAccountClient = getAccountClient(
       config.ACCOUNTS_URL,
-      generateToken(systemAccountUuid, undefined, { admin: 'true' }, 'secret')
+      generateToken(systemAccountUuid, undefined, { service: 'workspace', admin: 'true' }, 'secret')
     )
     const person = await accountClient.getPerson()
     const socialIds: SocialId[] = await accountClient.getSocialIds(true)