M2M support for updating billingAccountId for the project

[vikasrohit]

We need to support updating billingAccountId for the project via m2m calls which I think is already supported. However, right now that is not restricted as of now and any one in the project team can update that field. It was okay till now because we were not syncing that back to the legacy project, but now we have to sync that back to the legacy topcoder-platform/legacy-project-processor#13, so we have to restrict update of the field only for certain user roles like we are doing here for directProjectId and possibly to a dedicated scope via m2m call.

[vikasrohit]

@maxceem fyi

[maxceem]

@vikasrohit it's now possible to implement it after #555.

I would suggest using common scope write:projects for consistency. But we also can add some dedicated scope if you like. In such case let me know how to name it.

[vikasrohit]

I would like to use specific scope (write:projects-billing-accounts) for this purpose because it is a privileged action and I don't want any app which has write access to the project to be able to update the billing account as well. I guess we need to make both scopes (write:projects and write:projects-billing-accounts) required to update billing account or do you think should we require write:projects for all fields of project except billingAccountId and write:projects-billing-accounts for writing billingAccountId field only?

[maxceem]

@vikasrohit I think we should require both. It would be also more easier and straightforward to implement from the technical point of view.

[vikasrohit]

Go for it. I think it would make it easier to get rid of this additional scope in future in case if other stakeholders think that it is not as per standards.

[maxceem]

Overview:
We shouldn't allow setting or updating billingAccountId to regular users.

Sum up:

• create a new permission definition MANAGE_PROJECT_BILLING_ACCOUNT_ID in https://github.com/topcoder-platform/tc-project-service/blob/899be6a10f2540f5c879fbf7010e9e0c77a58a82/src/permissions/constants.js
  • the permission should be the same as UPDATE_PROJECT_DIRECT_PROJECT_ID, but replace scope write:projects with write:projects-billing-accounts
  • give appropriate name and description, see permissions guide
• inside POST and PATCH endpoints we should only let to set or update billingAccountId if user has permission MANAGE_PROJECT_BILLING_ACCOUNT_ID.
• create a unit test for POST and PATCH endpoints, that would check, that when we use M2M token without scope write:projects-billing-accounts we cannot update billingAccountId

Additional:

• rename permission UPDATE_PROJECT_DIRECT_PROJECT_ID to MANAGE_PROJECT_DIRECT_PROJECT_ID and update its title and description accordingly.
• to keep it consistent and safe, don't allow to setting directProjectId inside POST endpoint. As now we don't allow updating directProjectId, but any user can still set it during creating.

Documentation:

• In general see how to use permissions https://github.com/topcoder-platform/tc-project-service/blob/develop/docs/guides/permissions-guide/permissions-guide.md#how-to-use and regenerate HTML document after updating any permission rules.

[maxceem]

@vikasrohit this is done via PR for DEV #564. (We can create a hotfix from the same branch if needed).

I have one question before merging to DEV: as we require a special scope for updating billingAccountId, should we also require a special scope for updating directId?

[vikasrohit]

Great!! We don't need it for direct id as of now. However, the permission HTML, I guess, it is not showing the write:projects which is also necessary for a m2m app to update the billing account along with write:projects-billing-accounts scope.