@aeriajs/builtins 0.0.227 → 0.0.229

package/dist/collections/user/activate.d.ts

@@ -38,4 +38,4 @@ export declare const activate: (payload: {
     readonly result: {
         readonly userId: ObjectId;
     };
-} | undefined>;
+}>;

package/dist/collections/user/activate.js

@@ -47,12 +47,6 @@ const activate = async (payload, context) => {
     }
     if (!user.password) {
         if (!password) {
-            // if( context.request.method === 'GET' ) {
-            //   return context.response.writeHead(302, {
-            //     location: `/user/activation?step=password&u=${userId}&t=${token}`,
-            //   }).end()
-            // }
-            //
             return context.error(types_1.HTTPStatus.UnprocessableContent, {
                 code: types_1.ACError.MalformedInput,
             });
@@ -65,15 +59,16 @@ const activate = async (payload, context) => {
                 password: await bcrypt.hash(password, 10),
             },
         });
-        return;
     }
-    await context.collection.model.updateOne({
-        _id: user._id,
-    }, {
-        $set: {
-            active: true,
-        },
-    });
+    else {
+        await context.collection.model.updateOne({
+            _id: user._id,
+        }, {
+            $set: {
+                active: true,
+            },
+        });
+    }
     // if( context.request.method === 'GET' ) {
     //   return context.response.writeHead(302, {
     //     location: '/user/activation',

package/dist/collections/user/activate.mjs

@@ -53,29 +53,23 @@ export const activate = async (payload, context) => {
         code: ACError.MalformedInput
       });
     }
-    await context.collection.model.updateOne(
-      {
-        _id: user._id
-      },
-      {
-        $set: {
-          active: true,
-          password: await bcrypt.hash(password, 10)
-        }
+    await context.collection.model.updateOne({
+      _id: user._id
+    }, {
+      $set: {
+        active: true,
+        password: await bcrypt.hash(password, 10)
       }
-    );
-    return;
-  }
-  await context.collection.model.updateOne(
-    {
+    });
+  } else {
+    await context.collection.model.updateOne({
       _id: user._id
-    },
-    {
+    }, {
       $set: {
         active: true
       }
-    }
-  );
+    });
+  }
   return Result.result({
     userId: user._id
   });

package/dist/collections/user/editProfile.d.ts

@@ -1,5 +1,5 @@
+import type { description } from './description.js';
 import { HTTPStatus, ACError, type Context, type SchemaWithId, type PackReferences } from '@aeriajs/types';
-import { type description } from './description.js';
 export declare const editProfile: (payload: Partial<PackReferences<SchemaWithId<typeof description>>> & Record<string, unknown>, context: Context<typeof description>) => Promise<import("@aeriajs/types").InsertReturnType<SchemaWithId<{
     readonly $id: "user";
     readonly icon: "users";
@@ -103,14 +103,6 @@ export declare const editProfile: (payload: Partial<PackReferences<SchemaWithId<
         };
     };
 }>> | import("@aeriajs/types").Result.Error<{
-    readonly code: ACError.MalformedInput;
-} & {
-    httpStatus: HTTPStatus.BadRequest;
-}> | import("@aeriajs/types").Result.Error<{
-    readonly code: ACError.AuthorizationError;
-} & {
-    httpStatus: HTTPStatus.Unauthorized;
-}> | import("@aeriajs/types").Result.Error<{
     readonly code: ACError.TargetImmutable;
 } & {
     httpStatus: HTTPStatus.Forbidden;

package/dist/collections/user/editProfile.js

@@ -6,19 +6,9 @@ const core_1 = require("@aeriajs/core");
 const bcrypt = require("bcrypt");
 const editProfile = async (payload, context) => {
     const mutableProperties = context.config.security.mutableUserProperties;
-    if (!context.token.authenticated || !context.token.sub) {
+    if (!context.token.sub) {
         throw new Error;
     }
-    if (!payload._id) {
-        return context.error(types_1.HTTPStatus.BadRequest, {
-            code: types_1.ACError.MalformedInput,
-        });
-    }
-    if (!context.token.sub.equals(payload._id)) {
-        return context.error(types_1.HTTPStatus.Unauthorized, {
-            code: types_1.ACError.AuthorizationError,
-        });
-    }
     const user = await context.collections.user.model.findOne({
         _id: context.token.sub,
     });
@@ -37,8 +27,8 @@ const editProfile = async (payload, context) => {
     }
     return (0, core_1.insert)({
         what: {
-            _id: payload._id,
             ...payload,
+            _id: context.token.sub,
         },
     }, context);
 };

package/dist/collections/user/editProfile.mjs

@@ -4,19 +4,9 @@ import { insert as originalInsert } from "@aeriajs/core";
 import * as bcrypt from "bcrypt";
 export const editProfile = async (payload, context) => {
   const mutableProperties = context.config.security.mutableUserProperties;
-  if (!context.token.authenticated || !context.token.sub) {
+  if (!context.token.sub) {
     throw new Error();
   }
-  if (!payload._id) {
-    return context.error(HTTPStatus.BadRequest, {
-      code: ACError.MalformedInput
-    });
-  }
-  if (!context.token.sub.equals(payload._id)) {
-    return context.error(HTTPStatus.Unauthorized, {
-      code: ACError.AuthorizationError
-    });
-  }
   const user = await context.collections.user.model.findOne({
     _id: context.token.sub
   });
@@ -33,13 +23,10 @@ export const editProfile = async (payload, context) => {
       code: ACError.TargetImmutable
     });
   }
-  return originalInsert(
-    {
-      what: {
-        _id: payload._id,
-        ...payload
-      }
-    },
-    context
-  );
+  return originalInsert({
+    what: {
+      ...payload,
+      _id: context.token.sub
+    }
+  }, context);
 };

package/dist/collections/user/getActivationLink.js

@@ -42,9 +42,11 @@ const getActivationLink = async (payload, context) => {
     const activationToken = await (0, exports.getActivationToken)(payload.userId.toString(), context);
     //const url = `${context.config.webPublicUrl}/user/activation?step=password&u=${payload.userId.toString()}&t=${activationToken}`
     const url = new URL(`${context.config.webPublicUrl}/user/activation`);
-    url.searchParams.set('step', 'password'),
-        url.searchParams.set('u', payload.userId.toString());
+    url.searchParams.set('u', payload.userId.toString());
     url.searchParams.set('t', activationToken);
+    if (!user.password) {
+        url.searchParams.set('step', 'password');
+    }
     if (payload.redirect) {
         url.searchParams.set('next', payload.redirect);
     }

package/dist/collections/user/getActivationLink.mjs

@@ -38,8 +38,11 @@ export const getActivationLink = async (payload, context) => {
   }
   const activationToken = await getActivationToken(payload.userId.toString(), context);
   const url = new URL(`${context.config.webPublicUrl}/user/activation`);
-  url.searchParams.set("step", "password"), url.searchParams.set("u", payload.userId.toString());
+  url.searchParams.set("u", payload.userId.toString());
   url.searchParams.set("t", activationToken);
+  if (!user.password) {
+    url.searchParams.set("step", "password");
+  }
   if (payload.redirect) {
     url.searchParams.set("next", payload.redirect);
   }

package/dist/collections/user/index.d.ts

@@ -243,7 +243,17 @@ export declare const user: Omit<Collection<never>, "functions" | "description" |
         } & {
             httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
         }>>;
-        readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<Context, "token">) => Promise<import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
+        readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<Context, "token">) => Promise<import("@aeriajs/types").Result.Error<{
+            readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+            readonly message: "user is not allowed to edit other users roles";
+        } & {
+            httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+        }> | import("@aeriajs/types").Result.Error<{
+            readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+            readonly message: "tried to set unallowed roles";
+        } & {
+            httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+        }> | import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
         readonly editProfile: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
             readonly $id: "user";
             readonly icon: "users";
@@ -449,14 +459,6 @@ export declare const user: Omit<Collection<never>, "functions" | "description" |
                 };
             };
         }>> | import("@aeriajs/types").Result.Error<{
-            readonly code: import("@aeriajs/types").ACError.MalformedInput;
-        } & {
-            httpStatus: import("@aeriajs/types").HTTPStatus.BadRequest;
-        }> | import("@aeriajs/types").Result.Error<{
-            readonly code: import("@aeriajs/types").ACError.AuthorizationError;
-        } & {
-            httpStatus: import("@aeriajs/types").HTTPStatus.Unauthorized;
-        }> | import("@aeriajs/types").Result.Error<{
             readonly code: import("@aeriajs/types").ACError.TargetImmutable;
         } & {
             httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
@@ -530,7 +532,7 @@ export declare const user: Omit<Collection<never>, "functions" | "description" |
             readonly result: {
                 readonly userId: import("@aeriajs/core").ObjectId;
             };
-        } | undefined>;
+        }>;
         readonly createAccount: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
             readonly $id: "user";
             readonly icon: "users";

package/dist/collections/user/insert.d.ts

@@ -1,2 +1,13 @@
 import type { Context, SchemaWithId, InsertPayload, Description } from '@aeriajs/types';
-export declare const insert: <TDescription extends Description, TInsertPayload extends InsertPayload<SchemaWithId<TDescription>>>(payload: NoInfer<TInsertPayload>, context: Context<TDescription>) => Promise<import("@aeriajs/types").InsertReturnType<SchemaWithId<TDescription>>>;
+import { HTTPStatus, ACError } from '@aeriajs/types';
+export declare const insert: <TDescription extends Description, TInsertPayload extends InsertPayload<SchemaWithId<TDescription>>>(payload: NoInfer<TInsertPayload>, context: Context<TDescription>) => Promise<import("@aeriajs/types").Result.Error<{
+    readonly code: ACError.AuthorizationError;
+    readonly message: "user is not allowed to edit other users roles";
+} & {
+    httpStatus: HTTPStatus.Forbidden;
+}> | import("@aeriajs/types").Result.Error<{
+    readonly code: ACError.AuthorizationError;
+    readonly message: "tried to set unallowed roles";
+} & {
+    httpStatus: HTTPStatus.Forbidden;
+}> | import("@aeriajs/types").InsertReturnType<SchemaWithId<TDescription>>>;

package/dist/collections/user/insert.js

@@ -1,9 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.insert = void 0;
+const types_1 = require("@aeriajs/types");
+const common_1 = require("@aeriajs/common");
 const core_1 = require("@aeriajs/core");
 const bcrypt = require("bcrypt");
+const isRoleAllowed = (targetRole, context) => {
+    if (!context.config.security.rolesHierarchy || !context.token.authenticated) {
+        throw new Error;
+    }
+    for (const role of context.token.roles) {
+        if (role in context.config.security.rolesHierarchy) {
+            const hierarchy = context.config.security.rolesHierarchy[role];
+            if (!hierarchy) {
+                continue;
+            }
+            if (hierarchy === true || hierarchy.includes(targetRole)) {
+                return true;
+            }
+        }
+    }
+    return false;
+};
 const insert = async (payload, context) => {
+    if (!context.token.authenticated) {
+        throw new Error;
+    }
+    if ('roles' in payload.what) {
+        if (context.config.security.rolesHierarchy) {
+            if (!(0, common_1.arraysIntersect)(context.token.roles, Object.keys(context.config.security.rolesHierarchy))) {
+                return context.error(types_1.HTTPStatus.Forbidden, {
+                    code: types_1.ACError.AuthorizationError,
+                    message: 'user is not allowed to edit other users roles',
+                });
+            }
+            if (Array.isArray(payload.what.roles)) {
+                const allowed = payload.what.roles.every((role) => isRoleAllowed(role, context));
+                if (!allowed) {
+                    return context.error(types_1.HTTPStatus.Forbidden, {
+                        code: types_1.ACError.AuthorizationError,
+                        message: 'tried to set unallowed roles',
+                    });
+                }
+            }
+        }
+    }
     if ('password' in payload.what && typeof payload.what.password === 'string') {
         payload.what.password = await bcrypt.hash(payload.what.password, 10);
     }

package/dist/collections/user/insert.mjs

@@ -1,7 +1,48 @@
 "use strict";
+import { HTTPStatus, ACError } from "@aeriajs/types";
+import { arraysIntersect } from "@aeriajs/common";
 import { insert as originalInsert } from "@aeriajs/core";
 import * as bcrypt from "bcrypt";
+const isRoleAllowed = (targetRole, context) => {
+  if (!context.config.security.rolesHierarchy || !context.token.authenticated) {
+    throw new Error();
+  }
+  for (const role of context.token.roles) {
+    if (role in context.config.security.rolesHierarchy) {
+      const hierarchy = context.config.security.rolesHierarchy[role];
+      if (!hierarchy) {
+        continue;
+      }
+      if (hierarchy === true || hierarchy.includes(targetRole)) {
+        return true;
+      }
+    }
+  }
+  return false;
+};
 export const insert = async (payload, context) => {
+  if (!context.token.authenticated) {
+    throw new Error();
+  }
+  if ("roles" in payload.what) {
+    if (context.config.security.rolesHierarchy) {
+      if (!arraysIntersect(context.token.roles, Object.keys(context.config.security.rolesHierarchy))) {
+        return context.error(HTTPStatus.Forbidden, {
+          code: ACError.AuthorizationError,
+          message: "user is not allowed to edit other users roles"
+        });
+      }
+      if (Array.isArray(payload.what.roles)) {
+        const allowed = payload.what.roles.every((role) => isRoleAllowed(role, context));
+        if (!allowed) {
+          return context.error(HTTPStatus.Forbidden, {
+            code: ACError.AuthorizationError,
+            message: "tried to set unallowed roles"
+          });
+        }
+      }
+    }
+  }
   if ("password" in payload.what && typeof payload.what.password === "string") {
     payload.what.password = await bcrypt.hash(payload.what.password, 10);
   }

package/dist/functions/describe.d.ts

@@ -1,4 +1,4 @@
-import type { Description, RouteContext } from '@aeriajs/types';
+import type { Description, RouteContext, RolesHierarchy, UserRole } from '@aeriajs/types';
 import { Result, ACError, HTTPStatus } from '@aeriajs/types';
 import { authenticate } from '../collections/user/authenticate.js';
 declare const Payload: Partial<{} & Omit<Readonly<import("@aeriajs/types").FilterReadonlyProperties<{
@@ -56,9 +56,10 @@ export declare const describe: (contextOrPayload: RouteContext | typeof Payload)
     readonly error: undefined;
     readonly result: {
         descriptions: Record<string, Description>;
-        roles?: string[];
+        roles?: UserRole[];
         auth?: Awaited<ReturnType<typeof authenticate>> extends Result.Either<unknown, infer Right> ? Partial<Right> : never;
         router?: unknown;
+        rolesHierarchy?: RolesHierarchy;
     };
 }>;
 export {};

package/dist/functions/describe.js

@@ -33,7 +33,9 @@ const [Payload, validatePayload] = (0, validation_1.validator)({
     },
 });
 const describe = async (contextOrPayload) => {
-    const result = {};
+    const result = {
+        descriptions: {},
+    };
     let props;
     if ('request' in contextOrPayload) {
         const { error, result: validatedPayload } = validatePayload(contextOrPayload.request.payload);
@@ -72,7 +74,7 @@ const describe = async (contextOrPayload) => {
         const collection = typeof candidate === 'function'
             ? candidate()
             : candidate;
-        if (!(0, core_1.isValidCollection)(collection)) {
+        if (!(0, common_1.isValidCollection)(collection)) {
             throw new Error(`The "${collectionName}" symbol exported from the entrypoint doesn't seem like a valid collection. Make sure only collections are exported from the "import('.').collections".`);
         }
         const { description: rawDescription } = collection;
@@ -89,6 +91,9 @@ const describe = async (contextOrPayload) => {
             ? userRolesProperty.items.enum
             : [];
         result.roles = Array.from(new Set(userRoles.concat(await (0, entrypoint_1.getAvailableRoles)())));
+        if ('config' in contextOrPayload) {
+            result.rolesHierarchy = contextOrPayload.config.security.rolesHierarchy;
+        }
     }
     if (props.router) {
         result.router = await (0, core_1.getEndpoints)();

package/dist/functions/describe.mjs

@@ -1,8 +1,8 @@
 "use strict";
-import { createContext, preloadDescription, getEndpoints, isValidCollection } from "@aeriajs/core";
+import { createContext, preloadDescription, getEndpoints } from "@aeriajs/core";
 import { getCollections, getAvailableRoles } from "@aeriajs/entrypoint";
 import { Result, ACError, HTTPStatus } from "@aeriajs/types";
-import { serialize, endpointError } from "@aeriajs/common";
+import { serialize, endpointError, isValidCollection } from "@aeriajs/common";
 import { validator } from "@aeriajs/validation";
 import { authenticate } from "../collections/user/authenticate.mjs";
 const [Payload, validatePayload] = validator({
@@ -31,7 +31,9 @@ const [Payload, validatePayload] = validator({
   }
 });
 export const describe = async (contextOrPayload) => {
-  const result = {};
+  const result = {
+    descriptions: {}
+  };
   let props;
   if ("request" in contextOrPayload) {
     const { error, result: validatedPayload } = validatePayload(contextOrPayload.request.payload);
@@ -78,6 +80,9 @@ export const describe = async (contextOrPayload) => {
     const userRolesProperty = userCollection.description.properties.roles;
     const userRoles = "enum" in userRolesProperty.items ? userRolesProperty.items.enum : [];
     result.roles = Array.from(new Set(userRoles.concat(await getAvailableRoles())));
+    if ("config" in contextOrPayload) {
+      result.rolesHierarchy = contextOrPayload.config.security.rolesHierarchy;
+    }
   }
   if (props.router) {
     result.router = await getEndpoints();

package/dist/index.d.ts

@@ -707,7 +707,17 @@ export declare const collections: {
             } & {
                 httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
             }>>;
-            readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<import("@aeriajs/types").Context, "token">) => Promise<import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
+            readonly insert: (payload: NoInfer<import("@aeriajs/types").InsertPayload<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>, context: Omit<import("@aeriajs/types").Context, "token">) => Promise<import("@aeriajs/types").Result.Error<{
+                readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+                readonly message: "user is not allowed to edit other users roles";
+            } & {
+                httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+            }> | import("@aeriajs/types").Result.Error<{
+                readonly code: import("@aeriajs/types").ACError.AuthorizationError;
+                readonly message: "tried to set unallowed roles";
+            } & {
+                httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
+            }> | import("@aeriajs/types").InsertReturnType<import("@aeriajs/types").SchemaWithId<import("@aeriajs/types").Description>>>;
             readonly editProfile: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
                 readonly $id: "user";
                 readonly icon: "users";
@@ -913,14 +923,6 @@ export declare const collections: {
                     };
                 };
             }>> | import("@aeriajs/types").Result.Error<{
-                readonly code: import("@aeriajs/types").ACError.MalformedInput;
-            } & {
-                httpStatus: import("@aeriajs/types").HTTPStatus.BadRequest;
-            }> | import("@aeriajs/types").Result.Error<{
-                readonly code: import("@aeriajs/types").ACError.AuthorizationError;
-            } & {
-                httpStatus: import("@aeriajs/types").HTTPStatus.Unauthorized;
-            }> | import("@aeriajs/types").Result.Error<{
                 readonly code: import("@aeriajs/types").ACError.TargetImmutable;
             } & {
                 httpStatus: import("@aeriajs/types").HTTPStatus.Forbidden;
@@ -994,7 +996,7 @@ export declare const collections: {
                 readonly result: {
                     readonly userId: import("mongodb").ObjectId;
                 };
-            } | undefined>;
+            }>;
             readonly createAccount: (payload: Partial<import("@aeriajs/types").PackReferences<import("@aeriajs/types").SchemaWithId<{
                 readonly $id: "user";
                 readonly icon: "users";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeriajs/builtins",
-  "version": "0.0.227",
+  "version": "0.0.229",
   "description": "## Installation",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -55,10 +55,10 @@
     "mongodb": "^6.5.0"
   },
   "peerDependencies": {
-    "@aeriajs/core": "^0.0.227",
-    "@aeriajs/common": "^0.0.130",
-    "@aeriajs/entrypoint": "^0.0.133",
-    "@aeriajs/types": "^0.0.112",
-    "@aeriajs/validation": "^0.0.145"
+    "@aeriajs/core": "^0.0.229",
+    "@aeriajs/common": "^0.0.131",
+    "@aeriajs/entrypoint": "^0.0.134",
+    "@aeriajs/types": "^0.0.113",
+    "@aeriajs/validation": "^0.0.146"
   }
 }