Prod - April release

[jmgasper]

https://topcoder.atlassian.net/browse/PM-4211
https://topcoder.atlassian.net/browse/PM-3764
https://topcoder.atlassian.net/browse/PM-4720

[Copilot]

Pull request overview

This PR bundles April production release updates focused on permission/read-parity adjustments, improved billing-account lookups, and expanded test coverage around Auth0/M2M token handling.

Changes:

• Extend/adjust legacy role-based read access paths (projects, members/invites/attachments, work layer) and align M2M scope evaluation by merging user.scopes with token-claim scopes.
• Add Billing Accounts API lookup for default billing account with Salesforce fallback, plus env/config updates and tests.
• Add/expand tests for Auth0-shaped client-credentials tokens and updated Swagger auth documentation expectations.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/project-member.e2e-spec.ts	Adds e2e coverage for M2M member write operations and Auth0-shaped scope behavior.
test/deployment-validation.e2e-spec.ts	Updates deployment validation to accept new Billing Accounts API env var with fallback.
src/shared/utils/swagger.utils.spec.ts	Adds Swagger auth doc test coverage for global project-read machine scopes.
src/shared/utils/permission-docs.utils.ts	Updates documented role/scope summaries for some permissions (but needs alignment for READ_PROJECT_ANY).
src/shared/services/permission.service.ts	Expands legacy read role logic, adjusts work-layer permission evaluation, and merges scope sources for M2M consistency.
src/shared/services/permission.service.spec.ts	Adds unit coverage for new permission behaviors and merged-scope scenarios.
src/shared/services/billingAccount.service.ts	Implements Billing Accounts API lookup with M2M auth + Salesforce fallback and adds response mapping utilities.
src/shared/services/billingAccount.service.spec.ts	Introduces unit tests for Billing Accounts API success and Salesforce fallback.
src/shared/modules/global/jwt.service.spec.ts	Adds unit test for extracting Auth0 client-credentials scopes for machine subjects.
src/shared/guards/tokenRoles.guard.spec.ts	Adds coverage for legacy topcoder_manager and broadened work-layer role pass-through.
src/shared/enums/userRole.enum.ts	Adds UserRole.TOPCODER_MANAGER enum value and defines MANAGER_ROLES.
src/shared/constants/roles.ts	Broadens WORK_LAYER_ALLOWED_ROLES to all known roles for downstream permission enforcement.
src/shared/config/service-endpoints.config.ts	Adds billingAccountsApiUrl and env var fallbacks for member/identity endpoints.
src/api/workstream/workstream.controller.ts	Updates docstring to reflect new work-layer auth approach (pass-through + PermissionGuard).
src/api/project/project.service.ts	Refactors global project read access decisions and tightens direct project visibility checks.
src/api/project/project.service.spec.ts	Adds tests ensuring PM/TM roles are membership-scoped for listings and direct access is rejected when not on project.
src/api/copilot/copilot.utils.ts	Makes admin/manager helpers tolerate undefined user for public routes.
src/api/copilot/copilot-opportunity.service.ts	Allows user to be undefined and adjusts logic accordingly.
src/api/copilot/copilot-opportunity.controller.ts	Marks opportunity browse/get endpoints @Public() and accepts @CurrentUser() as optional (but introduces an auth-context issue).
docs/PERMISSIONS.md	Documents legacy read access behavior and role handling.
README.md	Updates endpoint description and documents BILLING_ACCOUNTS_API_URL.
.env.example	Adds BILLING_ACCOUNTS_API_URL.

Comments suppressed due to low confidence (2)

src/api/copilot/copilot-opportunity.controller.ts:70

• @Public() short-circuits TokenRolesGuard before JWT validation, so @CurrentUser() will always be undefined even when a caller provides an Authorization: Bearer ... header. That breaks the endpoint’s documented behavior (e.g., “Admin and manager callers also receive minimal nested project metadata”) and makes @Roles/@Scopes metadata ineffective at runtime. If auth should be optional here, consider adding an “optional auth” path that still parses the token when present; if auth should be required, replace @Public() with @AnyAuthenticated()/@UseGuards accordingly.

  @Get('copilots/opportunities')
  @Public()
  @Roles(...Object.values(UserRole))
  @Scopes(
    Scope.PROJECTS_READ,
    Scope.PROJECTS_WRITE,
    Scope.PROJECTS_ALL,
    Scope.CONNECT_PROJECT_ADMIN,
  )

src/api/copilot/copilot-opportunity.controller.ts:121

• Same issue as the list endpoint: @Public() bypasses JWT validation, so this handler cannot distinguish authenticated callers from anonymous ones (and will never see user even if a token is sent). Revisit the auth approach if you need optional-but-parsed authentication, otherwise require a validated token.

  @Get('copilot/opportunity/:id')
  @Get('copilots/opportunity/:id')
  @Public()
  // TODO [QUALITY]: Two route decorators (singular/plural) map to the same handler for legacy compatibility; document which route is canonical.
  @Roles(...Object.values(UserRole))
  @Scopes(
    Scope.PROJECTS_READ,
    Scope.PROJECTS_WRITE,
    Scope.PROJECTS_ALL,
    Scope.CONNECT_PROJECT_ADMIN,
  )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.