add auth

lib/workload_service_web/controllers/task_controller.ex

@@ -9,6 +9,7 @@ defmodule WorkloadServiceWeb.TaskController do
   alias WorkloadServiceWeb.QueryHelpers
 
   tags(["Tasks"])
+  security([%{"bearerAuth" => []}])
 
   operation(:list,
     summary: "List tasks",
@@ -24,7 +25,9 @@ defmodule WorkloadServiceWeb.TaskController do
   )
 
   def list(conn, params) do
-    case Queries.list_tasks(params) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
+
+    case Queries.list_tasks_by_org(org_id, params) do
       {:ok, {tasks, meta}} ->
         conn
         |> put_status(:ok)
@@ -50,7 +53,9 @@ defmodule WorkloadServiceWeb.TaskController do
   )
 
   def show(conn, %{"id" => id}) do
-    case Queries.get_task_by_id(id) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
+
+    case Queries.get_task_by_id(org_id, id) do
       {:error, :not_found} ->
         conn |> put_status(:not_found) |> json(%{error: "task not found"})
 
@@ -73,22 +78,23 @@ defmodule WorkloadServiceWeb.TaskController do
   )
 
   def submit(conn, %{"id" => id} = params) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
     task_type = get_task_type(id)
 
     case task_type do
       "quote" ->
-        handle_quote_submit(conn, id, params)
+        handle_quote_submit(conn, id, params, org_id)
 
       "solicitation" ->
-        handle_solicitation_submit(conn, id, params)
+        handle_solicitation_submit(conn, id, params, org_id)
 
       _ ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid task type"})
     end
   end
 
-  defp handle_quote_submit(conn, id, params) do
-    case Queries.get_task_by_id(id) do
+  defp handle_quote_submit(conn, id, params, org_id) do
+    case Queries.get_task_by_id(org_id, id) do
       {:error, :not_found} ->
         conn |> put_status(:not_found) |> json(%{error: "task not found"})
 
@@ -107,15 +113,15 @@ defmodule WorkloadServiceWeb.TaskController do
           attachments: params["document_urls"] || []
         }
 
-        dispatch_and_respond(conn, id, command)
+        dispatch_and_respond(conn, id, command, org_id)
 
       {:ok, _task} ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid state for submit"})
     end
   end
 
-  defp handle_solicitation_submit(conn, id, params) do
-    case Queries.get_task_by_id(id) do
+  defp handle_solicitation_submit(conn, id, params, org_id) do
+    case Queries.get_task_by_id(org_id, id) do
       {:error, :not_found} ->
         conn |> put_status(:not_found) |> json(%{error: "task not found"})
 
@@ -133,7 +139,7 @@ defmodule WorkloadServiceWeb.TaskController do
           attachments: params["document_urls"] || []
         }
 
-        dispatch_and_respond(conn, id, command)
+        dispatch_and_respond(conn, id, command, org_id)
 
       {:ok, _task} ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid state for submit"})
@@ -153,29 +159,35 @@ defmodule WorkloadServiceWeb.TaskController do
   )
 
   def approve(conn, %{"id" => id}) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
     task_type = get_task_type(id)
 
     case task_type do
       "quote" ->
-        handle_approve(conn, id, WorkloadService.Commands.QuoteTask.ApproveSubmission)
+        handle_approve(conn, id, WorkloadService.Commands.QuoteTask.ApproveSubmission, org_id)
 
       "solicitation" ->
-        handle_approve(conn, id, WorkloadService.Commands.SolicitationTask.ApproveSubmission)
+        handle_approve(
+          conn,
+          id,
+          WorkloadService.Commands.SolicitationTask.ApproveSubmission,
+          org_id
+        )
 
       _ ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid task type"})
     end
   end
 
-  defp handle_approve(conn, id, command_module) do
-    case Queries.get_task_by_id(id) do
+  defp handle_approve(conn, id, command_module, org_id) do
+    case Queries.get_task_by_id(org_id, id) do
       {:error, :not_found} ->
         conn |> put_status(:not_found) |> json(%{error: "task not found"})
 
       {:ok, %{status: "draft"} = _task} ->
         task_id = TaskId.parse!(id)
         command = struct(command_module, id: task_id)
-        dispatch_and_respond(conn, id, command)
+        dispatch_and_respond(conn, id, command, org_id)
 
       {:ok, _task} ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid state for approve"})
@@ -195,20 +207,37 @@ defmodule WorkloadServiceWeb.TaskController do
     ]
   )
 
-  def complete(conn, %{"id" => id} = params) do
+  operation(:request_approval,
+    summary: "Request approval for task",
+    parameters: [
+      id: [in: :path, type: :string, required: true]
+    ],
+    responses: [
+      ok: {"Task approved", "application/json", S.TaskDetailResponse},
+      not_found: {"Not found", "application/json", S.ErrorResponse},
+      unprocessable_entity: {"Error", "application/json", S.ErrorResponse}
+    ]
+  )
+
+  def request_approval(conn, %{"id" => id}) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
     task_type = get_task_type(id)
-    completed_by = params["completed_by"] || "system"
 
     case task_type do
       "quote" ->
-        handle_complete(conn, id, completed_by, WorkloadService.Commands.QuoteTask.CompleteTask)
-
-      "solicitation" ->
-        handle_complete(
+        handle_request_approval(
           conn,
           id,
-          completed_by,
-          WorkloadService.Commands.SolicitationTask.CompleteTask
+          WorkloadService.Commands.QuoteTask.RequestApproval,
+          org_id
+        )
+
+      "solicitation" ->
+        handle_request_approval(
+          conn,
+          id,
+          WorkloadService.Commands.SolicitationTask.RequestApproval,
+          org_id
         )
 
       _ ->
@@ -216,25 +245,54 @@ defmodule WorkloadServiceWeb.TaskController do
     end
   end
 
-  defp handle_complete(conn, id, completed_by, command_module) do
-    case Queries.get_task_by_id(id) do
+  def complete(conn, %{"id" => id} = params) do
+    org_id = conn.private[WorkloadServiceWeb.Plugs.ExtractOrganizationId]
+    task_type = get_task_type(id)
+    completed_by = params["completed_by"] || "system"
+
+    case task_type do
+      "quote" ->
+        handle_complete(
+          conn,
+          id,
+          completed_by,
+          WorkloadService.Commands.QuoteTask.CompleteTask,
+          org_id
+        )
+
+      "solicitation" ->
+        handle_complete(
+          conn,
+          id,
+          completed_by,
+          WorkloadService.Commands.SolicitationTask.CompleteTask,
+          org_id
+        )
+
+      _ ->
+        conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid task type"})
+    end
+  end
+
+  defp handle_complete(conn, id, completed_by, command_module, org_id) do
+    case Queries.get_task_by_id(org_id, id) do
       {:error, :not_found} ->
         conn |> put_status(:not_found) |> json(%{error: "task not found"})
 
       {:ok, %{status: "approved"} = _task} ->
         task_id = TaskId.parse!(id)
         command = struct(command_module, id: task_id, completed_by: completed_by)
-        dispatch_and_respond(conn, id, command)
+        dispatch_and_respond(conn, id, command, org_id)
 
       {:ok, _task} ->
         conn |> put_status(:unprocessable_entity) |> json(%{error: "invalid state for complete"})
     end
   end
 
-  defp dispatch_and_respond(conn, id, command) do
+  defp dispatch_and_respond(conn, id, command, org_id) do
     case CommandedApp.dispatch(command) do
       :ok ->
-        {:ok, task} = Queries.get_task_by_id(id)
+        {:ok, task} = Queries.get_task_by_id(org_id, id)
         conn |> put_status(:ok) |> json(%{data: task_detail(task)})
 
       {:error, reason} ->
@@ -242,6 +300,23 @@ defmodule WorkloadServiceWeb.TaskController do
     end
   end
 
+  defp handle_request_approval(conn, id, command_module, org_id) do
+    case Queries.get_task_by_id(org_id, id) do
+      {:error, :not_found} ->
+        conn |> put_status(:not_found) |> json(%{error: "task not found"})
+
+      {:ok, %{status: "draft"} = _task} ->
+        task_id = TaskId.parse!(id)
+        command = struct(command_module, id: task_id)
+        dispatch_and_respond(conn, id, command, org_id)
+
+      {:ok, _task} ->
+        conn
+        |> put_status(:unprocessable_entity)
+        |> json(%{error: "invalid state for request_approval"})
+    end
+  end
+
   defp get_task_type(id) do
     case WorkloadService.Aggregates.TaskId.parse(id) do
       {:ok, %{type: type}} -> type