Manage users & groups with OAuth impersonation

// Import necessary modules from @qlik/api
import {
auth,
groups,
users,
} from "@qlik/api";

// Regular M2M client for provisioning users and custom groups.
// admin_classic is required for custom group creation with the current OAuth scopes.
// This scope grants broad administrative permissions; keep this client server-side.
const authAdmin = {
    authType: "oauth2",
    host: "https://mytenant.us.qlikcloud.com",
    clientId: process.env.QLIK_ADMIN_CLIENT_ID,
    clientSecret: process.env.QLIK_ADMIN_CLIENT_SECRET,
    scope: "admin_classic",
};

// Separate M2M impersonation client for obtaining the embedded user's token.
// Configure this OAuth client with Trusted consent and M2M user impersonation enabled.
const authUser = {
    authType: "oauth2",
    host: "https://mytenant.us.qlikcloud.com",
    clientId: process.env.QLIK_USER_CLIENT_ID,
    clientSecret: process.env.QLIK_USER_CLIENT_SECRET,
    scope: "user_default",
};

/**
 * Makes sure a custom group exists in the tenant, and returns its ID
 * @param {string} groupName - The name of the custom group
 * @returns {Promise<string>} - The group ID
 */
async function ensureGroupExists(groupName) {
    const options = { hostConfig: { ...authAdmin } };
    // JSON.stringify escapes quotation marks and backslashes in the filter value.
    const filter = `name eq ${JSON.stringify(groupName)}`;
    let response = await groups.getGroups({ filter }, options);

    // The list endpoint is paginated. Check all matching results before creating a group.
    while (response) {
        const match = (response.data.data || []).find(
            group => group.name === groupName && group.providerType === "custom"
        );
        if (match) {
            return match.id;
        }
        response = response.next ? await response.next(options) : null;
    }

    const { data: createdGroup } = await groups.createGroup(
        {
            name: groupName,
            status: "active",
            providerType: "custom",
        },
        options
    );
    return createdGroup.id;
}

/**
 * Adds a custom group to a user's assigned groups if they don't already have it
 * @param {string} userId - The ID of the user
 * @param {string} groupName - The name of the group to add
 * @param {Array} currentGroups - The user's current assigned groups
 * @returns {Promise<void>}
 */
async function ensureUserHasGroup(userId, groupName, currentGroups = []) {
    const hasRequiredGroup = currentGroups.some(
        group => group.name === groupName && group.providerType === "custom"
    );

    if (hasRequiredGroup) {
        console.log(`User ${userId} already has ${groupName} group`);
        return;
    }

    // Create the group only when the user needs to be assigned to it.
    const groupId = await ensureGroupExists(groupName);
    await users.patchUser(
        userId,
        [{
            op: "add",
            path: "/assignedGroups/-",
            value: groupId,
        }],
        { hostConfig: { ...authAdmin } }
    );

    console.log(`Added ${groupName} group to user ${userId}`);
}

/**
 * Gets an impersonated access token for a user based on their email and group name
 * @param {string} userEmail - The email address of the user
 * @param {string} userName - The name of the user (used when creating new users)
 * @param {string} userSubject - The subject of the user (used when creating new users, must be unique)
 * @param {string} groupName - The name of the group to assign to the user
 * @returns {Promise<string>} - The impersonated access token
 */
async function getImpersonatedUserToken(userEmail, userName, userSubject, groupName) {
// Input validation
if (!userEmail || !userName || !userSubject || !groupName) {
    throw new Error("All parameters are required: userEmail, userName, userSubject, groupName");
}

if (!userEmail.includes("@")) {
    throw new Error("Invalid email format provided");
}

try {
    // Step 1: Get user ID using their email
    const { data: usersResponse } = await users.getUsers(
    {
        filter: `email eq ${JSON.stringify(userEmail)} and status eq "active"`,
    },
    {
        hostConfig: {
        ...authAdmin,
        },
    }
    );

    const foundUsers = usersResponse.data || [];

    let userId;

    if (foundUsers.length === 0) {
        // User doesn't exist, create them
        console.log(`User with email ${userEmail} not found, creating new user`);

    const userPayload = {
        name: userName,
        email: userEmail,
        subject: userSubject,
    };

    const newUser = await users.createUser(userPayload, {
        hostConfig: {
        ...authAdmin,
        },
    });

        userId = newUser.data.id;
        console.log(`Created new user with ID: ${userId} for email: ${userEmail}`);

        // Add the required group to the new user
        await ensureUserHasGroup(userId, groupName, []);
    } else if (foundUsers.length === 1) {
        userId = foundUsers[0].id;
        const existingUser = foundUsers[0];
        console.log(`Found existing user ID: ${userId} for email: ${userEmail}`);

        // Ensure the existing user has the required group
        await ensureUserHasGroup(userId, groupName, existingUser.assignedGroups || []);
    } else {
        // Multiple users found - this should never happen and is an error
        throw new Error(`Multiple users found with email ${userEmail}. This is not possible in Qlik Cloud since user emails must be unique.`);
    }

    // Step 2: Generate impersonated access token for the user
    const accessToken = await auth.getAccessToken({
        hostConfig: {
            ...authUser,
            userId: userId,
            scope: "user_default",
        },
    });

    console.log(`Generated impersonated token for user: ${userId}`);
    return accessToken;

} catch (error) {
    console.error("Error generating impersonated user token:", error);
    throw new Error(`Failed to get impersonated token for user ${userEmail}: ${error.message}`);
}
}

// Example usage:
// This function demonstrates how to get an impersonated access token for a user
async function exampleUsage() {
    try {
        const accessToken = await getImpersonatedUserToken(
            "john.doe@qlik.com",        // userEmail - the email of the user to impersonate
            "John Doe",                 // userName - display name for the user
            "6893db654802ab50d228526e", // userSubject - subject identifier (avoid using personal identifiers such as email)
            "Consumer"                  // groupName - the custom group to assign
        );

        // Do not log access tokens.
        return accessToken;
    } catch (error) {
        console.error("Failed to get impersonated token:", error.message);
        throw error;
    }
}

// Uncomment the line below to run the example
// exampleUsage();