[$75] 500 Internal Server error returned for the GET/taas-teams endpoints for some users

[SathyaJayabal]

500 Internal server error displayed for the following users/ endpoints
Users: dan_developer, tester1234 (role: topcoder member)
1.GET /taas-teams
2. GET /taas-teams/:id
3. GET /taas-teams/:id/jobs/:jobId

User: topcoderconnect (role: booking manager)
2. GET /taas-teams/:id
3. GET /taas-teams/:id/jobs/:jobId

Note: for user tonyj (role:admin) all the three endpoints work correctly)

[maxceem]

Contest https://www.topcoder.com/challenges/30158843 has been created for this ticket.

This is an automated message for maxceem via Topcoder X

[maxceem]

@imcaizheng open for pickup.

[maxceem]

Contest https://www.topcoder.com/challenges/30158843 has been updated - it has been assigned to aaron2017.

This is an automated message for maxceem via Topcoder X

[imcaizheng]

@SathyaJayabal Unable to login to DEV via dan_developer/tester1234. Is the username/password correct?

[SathyaJayabal]

@imcaizheng , those are two different users. Can you message me on the community slack (sathya jayabal) please and I will send you the passwords .

[maxceem]

@imcaizheng the error in log:

[2020-12-18T09:30:13.317Z] TeamService searchTeams [31mERROR[39m : cannot GET /v5/users/a55fe1bc-1754-45fa-9adc-cf3d6d7c377a?enrich=true (500)

So I think the issue is with calling helper.getUserById using a regular user token. I think we should fix this kind of issues in a general way by using only M2M tokens for internal calls and stop using the token of users who are calling TaaS API.

For now, let's update this for TeamService.js only (though if it's better to make such update for all the services together, we can do that too):

• Use only M2M calls for internal calls of other API endpoints.
• There are only 2 exceptions: helper.getProjects and helper.getProjectById should use currentUser token instead of M2M token if currentUser is not booking manager and is not machine. This is to check if the regular user has permission to access the team.
• At the moment it looks like regular user cannot call endpoint GET /taas-teams/:teamId/job/:jobID implemented by method getTeamJob. In this method we also have to call helper.getProjectById to check if user has permission to access the team, if current user is not booking manager and is not machine.
• It would be great if this would clear inside the code. So instead of reassigning currentUser.jwtToken with m2m token. Can we use m2mToken directly, so we always know if we use currentUser token or m2mToken for a particular call.

@imcaizheng does it make sense? do you see any drawbacks in such an approach?

[imcaizheng]

@maxceem That is, of course, the best solution.

[imcaizheng]

PR created #73