feat(medusa): PublishableApiKeys SC scopes (#2590)

**What**
-  add/ remove sales channels to/from PublishableApiKey in batch
- associate created cart with SC defined by PK
- filter products if PK with SC association is present
- retrieve a list of sales channels for a PK
- implement 3 new middleware
  - `extendRequestParams`
    -  _extend req object with PK scopes (a list of sales channels) if a publishable key is present in the header of the request_
  - `validateProductSalesChannelAssociation`
    -  _validate if the passed product id belongs to a SC from the PK's scope_
  - `validateSalesChannelParam`
    -  _validate that passed SC ids in the req body/query are within the scope of the PK_

**How**
- The general idea was to reuse existing logic in the controller layer which expects `sales_channel_id` array to be passed. The middleware sets associated SC ids in the request context if a PK is present. These ids are then merged in the controller and passed to the service layer.

**TODO**
- filter response from the search endpoint (CORE-824)

**Testing**
- _integration tests_
  - add sales channels to the publishable API key scope
  - remove sales channels from the publishable API key scope
  - returns products from a specific channel associated with a publishable key
  - returns products from multiples sales channels associated with a publishable key
  - returns all products if PK is not passed
  - returns all products if passed PK doesn't have associated channels
  - should assign sales channel to order on cart completion if PK is present in the header
  - list sales channels from the publishable api key
  -  throws because sales channel in query/body is not in the scope of passed PK 

---

**Discussion**
- what about the other endpoints (e.g. GET /store/product/:id - do we return 404 if the product is not in the SC associated with passed PK)
- what about products search route
- what about `/admin/products` & `/admin/orders` routes (do we add the middleware there as well)

---

RESOLVES CORE-792
RESOLVES CORE-793
RESOLVES CORE-816
This commit is contained in:
Frane Polić
2022-12-07 07:50:20 +00:00
committed by GitHub
parent 1b21af87ab
commit 322d462311
21 changed files with 1551 additions and 20 deletions
@@ -6,15 +6,9 @@ const { useApi } = require("../../../../helpers/use-api")
const { useDb } = require("../../../../helpers/use-db")
const {
simpleCartFactory,
simpleRegionFactory,
simpleShippingOptionFactory,
simpleCustomShippingOptionFactory,
simpleProductFactory,
simplePriceListFactory,
simpleDiscountFactory,
} = require("../../../factories")
const { IdMap } = require("medusa-test-utils")
jest.setTimeout(30000)