Manage users & groups with OAuth impersonation

// Import necessary modules from @qlik/api
import {
auth,
users,
} from "@qlik/api";

// Specify admin authentication configuration with relevant admin scopes. This will be
// used for actions that require admin privileges, such as user management.
const authAdmin = {
    authType: "oauth2",
    host: "https://mytenant.us.qlikcloud.com",
    clientId: process.env.QLIK_ADMIN_CLIENT_ID,
    clientSecret: process.env.QLIK_ADMIN_CLIENT_SECRET,
    scope: "admin.users",
};

// Specify user authentication configuration with relevant user scopes. This will be
// used for generating the user access token.
const authUser = {
    authType: "oauth2",
    host: "https://mytenant.us.qlikcloud.com",
    clientId: process.env.QLIK_USER_CLIENT_ID,
    clientSecret: process.env.QLIK_USER_CLIENT_SECRET,
    scope: "user_default",
};

/**
 * Adds a custom group to a user's assigned groups if they don't already have it
 * @param {string} userId - The ID of the user
 * @param {string} groupName - The name of the group to add
 * @param {Array} currentGroups - The user's current assigned groups
 * @returns {Promise<void>}
 */
async function ensureUserHasGroup(userId, groupName, currentGroups = []) {
// Check if user already has the specified group with providerType "custom"
const hasRequiredGroup = currentGroups.some(group =>
    group.name === groupName && group.providerType === "custom"
);

if (!hasRequiredGroup) {
    console.log(`User ${userId} does not have ${groupName} group, adding it`);

    // Add the specified group
    const updatedGroups = [
    ...currentGroups,
    {
        name: groupName,
        providerType: "custom"
    }
    ];

    // Update the user with the new groups
    await users.patchUser(
    userId,
    [
        {
        op: "replace",
        path: "/assignedGroups",
        value: updatedGroups
        }
    ],
    {
        hostConfig: {
        ...authAdmin,
        },
    }
    );

    console.log(`Added ${groupName} group to user ${userId}`);
} else {
    console.log(`User ${userId} already has ${groupName} group`);
}
}

/**
 * Gets an impersonated access token for a user based on their email and group name
 * @param {string} userEmail - The email address of the user
 * @param {string} userName - The name of the user (used when creating new users)
 * @param {string} userSubject - The subject of the user (used when creating new users, must be unique)
 * @param {string} groupName - The name of the group to assign to the user
 * @returns {Promise<string>} - The impersonated access token
 */
async function getImpersonatedUserToken(userEmail, userName, userSubject, groupName) {
// Input validation
if (!userEmail || !userName || !userSubject || !groupName) {
    throw new Error("All parameters are required: userEmail, userName, userSubject, groupName");
}

if (!userEmail.includes("@")) {
    throw new Error("Invalid email format provided");
}

try {
    // Step 1: Get user ID using their email
    const { data: foundUsers } = await users.getUsers(
    {
        filter: `email eq "${userEmail}" and status eq "active"`,
    },
    {
        hostConfig: {
        ...authAdmin,
        },
    }
    );

    let userId;

    if (!foundUsers || foundUsers.length === 0) {
        // User doesn't exist, create them
        console.log(`User with email ${userEmail} not found, creating new user`);

    const userPayload = {
        name: userName,
        email: userEmail,
        subject: userSubject,
    };

    const newUser = await users.createUser(userPayload, {
        hostConfig: {
        ...authAdmin,
        },
    });

        userId = newUser.data.id;
        console.log(`Created new user with ID: ${userId} for email: ${userEmail}`);

        // Add the required group to the new user
        await ensureUserHasGroup(userId, groupName, []);
    } else if (foundUsers.length === 1) {
        userId = foundUsers[0].id;
        const existingUser = foundUsers[0];
        console.log(`Found existing user ID: ${userId} for email: ${userEmail}`);

        // Ensure the existing user has the required group
        await ensureUserHasGroup(userId, groupName, existingUser.assignedGroups || []);
    } else {
        // Multiple users found - this should never happen and is an error
        throw new Error(`Multiple users found with email ${userEmail}. This is not possible in Qlik Cloud since user emails must be unique.`);
    }

    // Step 2: Generate impersonated access token for the user
    const accessToken = await auth.getAccessToken({
        hostConfig: {
            ...authUser,
            userId: userId,
            scope: "user_default",
        },
    });

    console.log(`Generated impersonated token for user: ${userId}`);
    return accessToken;

} catch (error) {
    console.error("Error generating impersonated user token:", error);
    throw new Error(`Failed to get impersonated token for user ${userEmail}: ${error.message}`);
}
}

// Example usage:
// This function demonstrates how to get an impersonated access token for a user
async function exampleUsage() {
    try {
        const accessToken = await getImpersonatedUserToken(
            "john.doe@qlik.com",        // userEmail - the email of the user to impersonate
            "John Doe",                 // userName - display name for the user
            "6893db654802ab50d228526e", // userSubject - subject identifier (avoid using personal identifiers such as email)
            "Consumer"                  // groupName - the custom group to assign
        );

        console.log("Successfully obtained access token:", accessToken);
        return accessToken;
    } catch (error) {
        console.error("Failed to get impersonated token:", error.message);
        throw error;
    }
}

// Uncomment the line below to run the example
// exampleUsage();