@3sixty/api-tenant-processor 0.0.0-stage → 0.20.0-next.0

package/dist/es/models/api/ITenantListRequest.js

@@ -0,0 +1,4 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+export {};
+//# sourceMappingURL=ITenantListRequest.js.map

package/dist/es/models/api/ITenantListRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITenantListRequest.js","sourceRoot":"","sources":["../../../../src/models/api/ITenantListRequest.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\n\n/**\n * The list of tenants.\n */\nexport interface ITenantListRequest {\n\t/**\n\t * The query parameters.\n\t */\n\tquery: {\n\t\t/**\n\t\t * The condition for the query as JSON version of EntityCondition type.\n\t\t */\n\t\tconditions?: string;\n\n\t\t/**\n\t\t * The properties to include in the returned tenants, separated by commas.\n\t\t * If not provided, all properties will be returned.\n\t\t */\n\t\tproperties?: string;\n\n\t\t/**\n\t\t * The cursor to get the next chunk of tenants.\n\t\t */\n\t\tcursor?: string;\n\n\t\t/**\n\t\t * The number of tenants to return.\n\t\t */\n\t\tlimit?: string;\n\t};\n}\n"]}

package/dist/es/models/api/ITenantListResponse.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ITenantListResponse.js.map

package/dist/es/models/api/ITenantListResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITenantListResponse.js","sourceRoot":"","sources":["../../../../src/models/api/ITenantListResponse.ts"],"names":[],"mappings":"","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type { ITenant } from \"@3sixty/api-models\";\nimport type { HeaderTypes } from \"@3sixty/web\";\n\n/**\n * The list of tenants.\n */\nexport interface ITenantListResponse {\n\t/**\n\t * The headers which can be used to include the cursor.\n\t */\n\theaders?: {\n\t\t[HeaderTypes.Link]?: string | string[];\n\t};\n\n\t/**\n\t * The list of tenants.\n\t */\n\tbody: ITenant[];\n}\n"]}

package/dist/es/models/api/ITenantRemoveRequest.js

@@ -0,0 +1,4 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+export {};
+//# sourceMappingURL=ITenantRemoveRequest.js.map

package/dist/es/models/api/ITenantRemoveRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITenantRemoveRequest.js","sourceRoot":"","sources":["../../../../src/models/api/ITenantRemoveRequest.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\n\n/**\n * The tenant to remove by id.\n */\nexport interface ITenantRemoveRequest {\n\t/**\n\t * The path parameters.\n\t */\n\tpathParams: {\n\t\t/**\n\t\t * The id of the tenant to remove.\n\t\t */\n\t\tid: string;\n\t};\n}\n"]}

package/dist/es/models/api/ITenantUpdateRequest.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ITenantUpdateRequest.js.map

package/dist/es/models/api/ITenantUpdateRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITenantUpdateRequest.js","sourceRoot":"","sources":["../../../../src/models/api/ITenantUpdateRequest.ts"],"names":[],"mappings":"","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type { ITenant } from \"@3sixty/api-models\";\n\n/**\n * The tenant to update.\n */\nexport interface ITenantUpdateRequest {\n\t/**\n\t * The path parameters.\n\t */\n\tpathParams: {\n\t\t/**\n\t\t * The id of the tenant to update.\n\t\t */\n\t\tid: string;\n\t};\n\n\t/**\n\t * The tenant to update.\n\t */\n\tbody: Omit<ITenant, \"id\" | \"dateCreated\" | \"dateModified\">;\n}\n"]}

package/dist/es/restEntryPoints.js

@@ -0,0 +1,13 @@
+import { generateRestRoutesTenants, tagsTenants } from "./tenantRoutes.js";
+/**
+ * REST entry points for the tenant administration service.
+ */
+export const restEntryPoints = [
+    {
+        name: "tenants",
+        defaultBaseRoute: "tenants",
+        tags: tagsTenants,
+        generateRoutes: generateRestRoutesTenants
+    }
+];
+//# sourceMappingURL=restEntryPoints.js.map

package/dist/es/restEntryPoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restEntryPoints.js","sourceRoot":"","sources":["../../src/restEntryPoints.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B;IACtD;QACC,IAAI,EAAE,SAAS;QACf,gBAAgB,EAAE,SAAS;QAC3B,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,yBAAyB;KACzC;CACD,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type { IRestRouteEntryPoint } from \"@3sixty/api-models\";\nimport { generateRestRoutesTenants, tagsTenants } from \"./tenantRoutes.js\";\n\n/**\n * REST entry points for the tenant administration service.\n */\nexport const restEntryPoints: IRestRouteEntryPoint[] = [\n\t{\n\t\tname: \"tenants\",\n\t\tdefaultBaseRoute: \"tenants\",\n\t\ttags: tagsTenants,\n\t\tgenerateRoutes: generateRestRoutesTenants\n\t}\n];\n"]}

package/dist/es/schema.js

@@ -0,0 +1,64 @@
+// Copyright 2025 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { Is } from "@3sixty/core";
+import { EntitySchemaFactory, EntitySchemaHelper } from "@3sixty/entity";
+import { SchemaMigrationFactory } from "@3sixty/entity-storage-models";
+import { Tenant } from "./entities/tenant.js";
+import { TenantV0 } from "./entities/tenantV0.js";
+import { TenantV1 } from "./entities/tenantV1.js";
+/**
+ * Initialize the schema for the node tenant processor, including the Tenant 1 to 2 migration
+ * step which converts organizationIdLegacy from a pipe-delimited string to an array of ids.
+ */
+export function initSchema() {
+    EntitySchemaFactory.register("Tenant", () => EntitySchemaHelper.getSchema(Tenant));
+    EntitySchemaFactory.register("TenantV0", () => EntitySchemaHelper.getSchema(TenantV0));
+    EntitySchemaFactory.register("TenantV1", () => EntitySchemaHelper.getSchema(TenantV1));
+    SchemaMigrationFactory.register(`${"Tenant"}_1_2`, () => ({
+        transformEntityProperty: (entity, schema1Property, schema2Property, value) => {
+            if (schema2Property.property !== "organizationIdLegacy") {
+                return;
+            }
+            return toOrganizationIdList(value);
+        }
+    }));
+}
+/**
+ * Convert a stored organizationIdLegacy value to the array shape the current schema declares.
+ * Accepts every physical shape a version 1 table can hold: a pipe-delimited string written by
+ * 0.10.0 and earlier, a JSON array written by a fresh 0.10.1-next.4+ table, JSON array text left
+ * by a partial hand fix, or an already-migrated array. Ids are trimmed, emptied entries are
+ * dropped, duplicates are removed, and case is preserved because the values are DIDs.
+ * @param value The stored value to convert.
+ * @returns The de-duplicated list of ids, or undefined when there are none.
+ */
+function toOrganizationIdList(value) {
+    let parts;
+    if (Is.array(value)) {
+        parts = value;
+    }
+    else if (Is.stringValue(value) && value.trim().startsWith("[")) {
+        try {
+            const parsed = JSON.parse(value);
+            parts = Is.array(parsed) ? parsed : [];
+        }
+        catch {
+            parts = [];
+        }
+    }
+    else if (Is.stringValue(value)) {
+        parts = value.split("|");
+    }
+    else {
+        parts = [];
+    }
+    const ids = [];
+    for (const part of parts) {
+        const id = Is.stringValue(part) ? part.trim() : "";
+        if (id.length > 0 && !ids.includes(id)) {
+            ids.push(id);
+        }
+    }
+    return ids.length > 0 ? ids : undefined;
+}
+//# sourceMappingURL=schema.js.map

package/dist/es/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,UAAU;IACzB,mBAAmB,CAAC,QAAQ,WAAmB,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,mBAAmB,CAAC,QAAQ,aAAqB,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/F,mBAAmB,CAAC,QAAQ,aAAqB,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/F,sBAAsB,CAAC,QAAQ,CAAC,GAAG,QAAgB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,uBAAuB,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE;YAC5E,IAAI,eAAe,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gBACzD,OAAO;YACR,CAAC;YACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;KACD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC3C,IAAI,KAAgB,CAAC;IAErB,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,GAAG,KAAK,CAAC;IACf,CAAC;SAAM,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACR,KAAK,GAAG,EAAE,CAAC;QACZ,CAAC;IACF,CAAC;SAAM,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;IACF,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { Is } from \"@3sixty/core\";\nimport { EntitySchemaFactory, EntitySchemaHelper } from \"@3sixty/entity\";\nimport { SchemaMigrationFactory } from \"@3sixty/entity-storage-models\";\nimport { nameof } from \"@3sixty/nameof\";\nimport { Tenant } from \"./entities/tenant.js\";\nimport { TenantV0 } from \"./entities/tenantV0.js\";\nimport { TenantV1 } from \"./entities/tenantV1.js\";\n\n/**\n * Initialize the schema for the node tenant processor, including the Tenant 1 to 2 migration\n * step which converts organizationIdLegacy from a pipe-delimited string to an array of ids.\n */\nexport function initSchema(): void {\n\tEntitySchemaFactory.register(nameof<Tenant>(), () => EntitySchemaHelper.getSchema(Tenant));\n\tEntitySchemaFactory.register(nameof<TenantV0>(), () => EntitySchemaHelper.getSchema(TenantV0));\n\tEntitySchemaFactory.register(nameof<TenantV1>(), () => EntitySchemaHelper.getSchema(TenantV1));\n\n\tSchemaMigrationFactory.register(`${nameof<Tenant>()}_1_2`, () => ({\n\t\ttransformEntityProperty: (entity, schema1Property, schema2Property, value) => {\n\t\t\tif (schema2Property.property !== \"organizationIdLegacy\") {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treturn toOrganizationIdList(value);\n\t\t}\n\t}));\n}\n\n/**\n * Convert a stored organizationIdLegacy value to the array shape the current schema declares.\n * Accepts every physical shape a version 1 table can hold: a pipe-delimited string written by\n * 0.10.0 and earlier, a JSON array written by a fresh 0.10.1-next.4+ table, JSON array text left\n * by a partial hand fix, or an already-migrated array. Ids are trimmed, emptied entries are\n * dropped, duplicates are removed, and case is preserved because the values are DIDs.\n * @param value The stored value to convert.\n * @returns The de-duplicated list of ids, or undefined when there are none.\n */\nfunction toOrganizationIdList(value: unknown): string[] | undefined {\n\tlet parts: unknown[];\n\n\tif (Is.array(value)) {\n\t\tparts = value;\n\t} else if (Is.stringValue(value) && value.trim().startsWith(\"[\")) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(value);\n\t\t\tparts = Is.array(parsed) ? parsed : [];\n\t\t} catch {\n\t\t\tparts = [];\n\t\t}\n\t} else if (Is.stringValue(value)) {\n\t\tparts = value.split(\"|\");\n\t} else {\n\t\tparts = [];\n\t}\n\n\tconst ids: string[] = [];\n\tfor (const part of parts) {\n\t\tconst id = Is.stringValue(part) ? part.trim() : \"\";\n\t\tif (id.length > 0 && !ids.includes(id)) {\n\t\t\tids.push(id);\n\t\t}\n\t}\n\n\treturn ids.length > 0 ? ids : undefined;\n}\n"]}

package/dist/es/singleTenantProcessor.js

@@ -0,0 +1,81 @@
+// Copyright 2025 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { HttpErrorHelper } from "@3sixty/api-models";
+import { ContextIdHelper, ContextIdKeys, ContextIdStore } from "@3sixty/context";
+import { BaseError, Is, UnauthorizedError } from "@3sixty/core";
+import { HttpStatusCode } from "@3sixty/web";
+/**
+ * Injects the single-tenant organization ID into every request context and validates any organization query parameter.
+ */
+export class SingleTenantProcessor {
+    /**
+     * Runtime name for the class.
+     */
+    static CLASS_NAME = "SingleTenantProcessor";
+    /**
+     * The organization ID for the single-tenant node, cached at startup.
+     * @internal
+     */
+    _nodeOrganizationId;
+    /**
+     * Include the stack with errors.
+     * @internal
+     */
+    _includeErrorStack;
+    /**
+     * Create a new instance of SingleTenantProcessor.
+     * @param options Options for the processor.
+     */
+    constructor(options) {
+        this._includeErrorStack = options?.config?.includeErrorStack ?? false;
+    }
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className() {
+        return SingleTenantProcessor.CLASS_NAME;
+    }
+    /**
+     * Cache the node organization ID from the engine context so it can be injected into each
+     * per-request context without requiring a separate ContextIdProcessor for Organization.
+     * @param nodeLoggingComponentType The node logging component type.
+     * @returns A promise that resolves when the node organization ID has been cached.
+     */
+    async start(nodeLoggingComponentType) {
+        const contextIds = await ContextIdStore.getContextIds();
+        ContextIdHelper.guard(contextIds, ContextIdKeys.Organization);
+        this._nodeOrganizationId = contextIds[ContextIdKeys.Organization];
+    }
+    /**
+     * Pre process the REST request for the specified route.
+     * @param request The incoming request.
+     * @param response The outgoing response.
+     * @param route The route to process.
+     * @param contextIds The context IDs of the request.
+     * @param processorState The state handed through the processors.
+     * @returns A promise that resolves when the organization ID has been injected and any query parameter validated.
+     */
+    async pre(request, response, route, contextIds, processorState) {
+        contextIds[ContextIdKeys.Organization] = this._nodeOrganizationId;
+        if (!Is.empty(route)) {
+            try {
+                // If an organization ID is provided as a query parameter, validate it against the node organization ID.
+                // since this processor is meant for single-tenant use cases, the presence of an organization ID is probably in the form
+                // of a callback, so we should still validate it but not require it.
+                const organizationIdQueryParam = request.query?.[ContextIdKeys.Organization];
+                if (Is.stringValue(organizationIdQueryParam) &&
+                    organizationIdQueryParam !== this._nodeOrganizationId) {
+                    throw new UnauthorizedError(SingleTenantProcessor.CLASS_NAME, "invalidOrganizationId", {
+                        paramName: ContextIdKeys.Organization,
+                        value: organizationIdQueryParam
+                    });
+                }
+            }
+            catch (err) {
+                HttpErrorHelper.buildResponse(response, BaseError.fromError(err), HttpStatusCode.unauthorized, this._includeErrorStack);
+            }
+        }
+    }
+}
+//# sourceMappingURL=singleTenantProcessor.js.map

package/dist/es/singleTenantProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"singleTenantProcessor.js","sourceRoot":"","sources":["../../src/singleTenantProcessor.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EACN,eAAe,EAKf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAoB,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACjC;;OAEG;IACI,MAAM,CAAU,UAAU,2BAA2C;IAE5E;;;OAGG;IACK,mBAAmB,CAAU;IAErC;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACH,YAAY,OAAkD;QAC7D,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,IAAI,KAAK,CAAC;IACvE,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,qBAAqB,CAAC,UAAU,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,KAAK,CAAC,wBAAiC;QACnD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;QACxD,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CACf,OAA2B,EAC3B,QAAuB,EACvB,KAA6B,EAC7B,UAAuB,EACvB,cAAyC;QAEzC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAElE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,wGAAwG;gBACxG,wHAAwH;gBACxH,oEAAoE;gBACpE,MAAM,wBAAwB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7E,IACC,EAAE,CAAC,WAAW,CAAC,wBAAwB,CAAC;oBACxC,wBAAwB,KAAK,IAAI,CAAC,mBAAmB,EACpD,CAAC;oBACF,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,UAAU,EAAE,uBAAuB,EAAE;wBACtF,SAAS,EAAE,aAAa,CAAC,YAAY;wBACrC,KAAK,EAAE,wBAAwB;qBAC/B,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,eAAe,CAAC,aAAa,CAC5B,QAAQ,EACR,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EACxB,cAAc,CAAC,YAAY,EAC3B,IAAI,CAAC,kBAAkB,CACvB,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport {\n\tHttpErrorHelper,\n\ttype IBaseRoute,\n\ttype IBaseRouteProcessor,\n\ttype IHttpResponse,\n\ttype IHttpServerRequest\n} from \"@3sixty/api-models\";\nimport { ContextIdHelper, ContextIdKeys, ContextIdStore, type IContextIds } from \"@3sixty/context\";\nimport { BaseError, Is, UnauthorizedError } from \"@3sixty/core\";\nimport { nameof } from \"@3sixty/nameof\";\nimport { HttpStatusCode } from \"@3sixty/web\";\nimport type { ISingleTenantProcessorConstructorOptions } from \"./models/ISingleTenantProcessorConstructorOptions.js\";\n\n/**\n * Injects the single-tenant organization ID into every request context and validates any organization query parameter.\n */\nexport class SingleTenantProcessor implements IBaseRouteProcessor {\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = nameof<SingleTenantProcessor>();\n\n\t/**\n\t * The organization ID for the single-tenant node, cached at startup.\n\t * @internal\n\t */\n\tprivate _nodeOrganizationId?: string;\n\n\t/**\n\t * Include the stack with errors.\n\t * @internal\n\t */\n\tprivate readonly _includeErrorStack: boolean;\n\n\t/**\n\t * Create a new instance of SingleTenantProcessor.\n\t * @param options Options for the processor.\n\t */\n\tconstructor(options?: ISingleTenantProcessorConstructorOptions) {\n\t\tthis._includeErrorStack = options?.config?.includeErrorStack ?? false;\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The class name of the component.\n\t */\n\tpublic className(): string {\n\t\treturn SingleTenantProcessor.CLASS_NAME;\n\t}\n\n\t/**\n\t * Cache the node organization ID from the engine context so it can be injected into each\n\t * per-request context without requiring a separate ContextIdProcessor for Organization.\n\t * @param nodeLoggingComponentType The node logging component type.\n\t * @returns A promise that resolves when the node organization ID has been cached.\n\t */\n\tpublic async start(nodeLoggingComponentType?: string): Promise<void> {\n\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\tContextIdHelper.guard(contextIds, ContextIdKeys.Organization);\n\t\tthis._nodeOrganizationId = contextIds[ContextIdKeys.Organization];\n\t}\n\n\t/**\n\t * Pre process the REST request for the specified route.\n\t * @param request The incoming request.\n\t * @param response The outgoing response.\n\t * @param route The route to process.\n\t * @param contextIds The context IDs of the request.\n\t * @param processorState The state handed through the processors.\n\t * @returns A promise that resolves when the organization ID has been injected and any query parameter validated.\n\t */\n\tpublic async pre(\n\t\trequest: IHttpServerRequest,\n\t\tresponse: IHttpResponse,\n\t\troute: IBaseRoute | undefined,\n\t\tcontextIds: IContextIds,\n\t\tprocessorState: { [id: string]: unknown }\n\t): Promise<void> {\n\t\tcontextIds[ContextIdKeys.Organization] = this._nodeOrganizationId;\n\n\t\tif (!Is.empty(route)) {\n\t\t\ttry {\n\t\t\t\t// If an organization ID is provided as a query parameter, validate it against the node organization ID.\n\t\t\t\t// since this processor is meant for single-tenant use cases, the presence of an organization ID is probably in the form\n\t\t\t\t// of a callback, so we should still validate it but not require it.\n\t\t\t\tconst organizationIdQueryParam = request.query?.[ContextIdKeys.Organization];\n\t\t\t\tif (\n\t\t\t\t\tIs.stringValue(organizationIdQueryParam) &&\n\t\t\t\t\torganizationIdQueryParam !== this._nodeOrganizationId\n\t\t\t\t) {\n\t\t\t\t\tthrow new UnauthorizedError(SingleTenantProcessor.CLASS_NAME, \"invalidOrganizationId\", {\n\t\t\t\t\t\tparamName: ContextIdKeys.Organization,\n\t\t\t\t\t\tvalue: organizationIdQueryParam\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t} catch (err) {\n\t\t\t\tHttpErrorHelper.buildResponse(\n\t\t\t\t\tresponse,\n\t\t\t\t\tBaseError.fromError(err),\n\t\t\t\t\tHttpStatusCode.unauthorized,\n\t\t\t\t\tthis._includeErrorStack\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n}\n"]}