Forbidden

every '0 1 * * *' do # 01:00 UTC everyday
  runner 'Cupix::Cron::EditingPermission.revoke_expired_editor_permissions'
  runner 'Cupix::Cron::EditingPermission.revoke_expired_manager_permissions'
end

completed_pairs.pluck(:editor_id, :facility_id).each do |user_id, facility_id|
  next if active_set.include?([user_id, facility_id])

  last_updated = last_completed_map[[user_id, facility_id]]
  next if last_updated.present? && last_updated > 1.month.ago

  next unless permission_set.include?([user_id, facility_id])

  facility = ::Facility.find_by(id: facility_id)
  next if facility.nil?

  user = ::User.find_by(id: user_id)
  next if user.nil?

  Cupix::Logger.info("Revoking expired editor permission: user=#{user_id}, facility=#{facility_id}",
                     class: name, function: __method__, module: 'Cupix::Cron')
  facility.unshare(user)
  count += 1

def remove_permission!(user_or_group)
  _permission = permissions.find_by(
    accessor: user_or_group
  )

  if _permission.present?
    _permission.destroy!

    Permissionable.flush_cached_permissions(user_or_group)
    Permissionable.flush_cached_permissions_by_user(user_or_group, self)

    _permission
  else
    raise Cupix::Errors::Entity.new(code: 'ENT10012', reason: 'Permission not found')
  end
end

def _delete_subscriptions_by_facility_permission(model)
  return false unless model.accessor_type == ::User.name

  user = model.accessor
  facility_key = model.facility.key

  _delete_subscription(user: user, facility_key: facility_key)
end

def _delete_subscription(opts = {})
  Cupix::NotificationService.new(user: opts[:user]).unsubscribe(facility_key: opts[:facility_key])
end

def _delete_recipes(opts = {})
  %w[
    record_preview_ready
    record_processing_completed
    facility_new_project
  ].each do |recipe_name|
    Cupix::NotificationService.new(user: opts[:user]).delete_user_recipe(recipe_name, team_id: opts[:team_id], facility_key: opts[:facility_key])
  end
end

def unsubscribe(facility_key: nil)
  return if @service_url.nil?

  begin
    response = Cupix::HttpClient.delete(
      "#{@service_url}/api/v1/subscriptions?model_type=Facility&model_id=#{facility_key}",
      {
        content_type: :json,
        'x-cupix-auth': @user.api_token
      }
    )
    Cupix::Logger.info("subscription of #{@user.email} on Facility #{facility_key} deleted", class: self.class.name, function: __method__, facility_key: facility_key)

    true
  rescue RestClient::ExceptionWithResponse => e
    Cupix::Logger.error(e.response, class: self.class.name, function: __method__, facility_key: facility_key)

    false
  end
end

const response = await CPUtils.fetchWithRetry(
  `https://api.${DOMAIN_NAME}/api/v1/me?fields=id,firstname,lastname,email,team`,
  {
    headers: {
      'x-cupix-auth': token
    }
  }
);

if (response.status !== 200) {
  throw new Error('Unauthorized; permission denied');
}
// ...
} catch (error: any) {
  console.log('Error authorizing: ', error.message);
  return { isAuthorized: false };
}

def verify_api_token!(api_token)
  user = ::User.find_by_api_token(api_token)

  session =
    if user.blank?
      get_session_from_session_info(api_token)
    else
      user.default_session
    end

  raise Cupix::Errors::Unauthorized.new(code: 'AUTH10008', reason: "Invalid API token") if session.blank?

  if session.present?
    raise Cupix::Errors::Session.new(code: 'AUTH10031', reason: 'Session has expired') if session.state_expired?
    raise Cupix::Errors::Session.new(code: 'AUTH10032', reason: 'Session has expired') if session.state_inactive?
    raise Cupix::Errors::Session.new(code: 'AUTH10033', reason: 'Session has expired') if session.expires_at < DateTime.now
  end

service:cupixworks-worker status:error @environment:production "Forbidden" @class:Cupix\:\:NotificationService

{
  "message": "recipe deletion failed: {\"message\":\"Forbidden\"}",
  "class": "Cupix::NotificationService",
  "function": "delete_user_recipe",
  "tenant": "cupix",
  "facility_key": "6gagd6",
  "recipe_name": "record_processing_completed",
  "service_role": "worker",
  "pid": "3347182",
  "host": "ip-10-1-18-233.us-west-2.compute.internal"
}

{
  "message": "Forbidden",
  "class": "Cupix::NotificationService",
  "function": "unsubscribe",
  "tenant": "cupix",
  "facility_key": "6gagd6",
  "service_role": "worker",
  "pid": "3347182",
  "host": "ip-10-1-18-233.us-west-2.compute.internal"
}

service:cupixworks-worker status:warn @class:Cupix\:\:NotificationService "Forbidden"