@alizadefaig/pos-server 1.2.25 → 1.2.27

package/app/core/services/AuthService.js

@@ -0,0 +1,468 @@
+const crypto = require('crypto');
+const sanctum = require('../auth/sanctum');
+const scope = require('../auth/scope');
+const {platformHeaders} = require('../auth');
+const {teamUserResource} = require('../resources/TeamResource');
+const {shiftResource} = require('../resources/ShiftResource');
+const {nullableBool, modelArray, takeText, jsonText} = require('../resources/casts');
+const {isoDate, phpArray} = require('../support/php');
+const {transArray, FALLBACK_LOCALE} = require('../support/lang');
+const {teamSettings, hasTaxIntegration} = require('../support/teamSettings');
+const {imageUrls, castImage} = require('../support/images');
+const {unique, groupBy, indexBy, alive, whereIn} = require('../support/rows');
+const {nowSql} = require('../support/time');
+const ShiftService = require('./ShiftService');
+const {HttpError, notFound} = require('../errors');
+
+/**
+ * Вход терминала — порт AuthController (auth, loginTerminal, logoutApp, unlock) и
+ * TeamUserService::unlock. Только облако: на кассе вход по логину невозможен без облака, а
+ * `auth.unlock` там обслуживает офлайн-обработчик из снапшота.
+ *
+ * Ответ `app.auth` — это `toArray()` моделей User и Team со связями, поэтому ключи идут в порядке
+ * колонок таблицы (SELECT *), касты — как в моделях. Отступления от Laravel:
+ * - секреты не отдаются: `teams.admin_passwords` и `terminals.password` (в PHP уходили на кассу);
+ * - удалённая строка team_users вход в команду не даёт;
+ * - то, на чём PHP падал 500 (не-bcrypt хеш, нет валюты у команды, нет терминала при
+ *   loginTerminal), здесь даёт понятный ответ.
+ */
+
+const NOT_FOUND = {message: 'user_not_found', success: false};
+const TOO_MANY = 'Çox cəhd edildi, bir az gözləyin';
+
+let bcrypt = null;
+const hashCheck = async (value, hashed) => {
+    if (typeof hashed !== 'string' || hashed === '') {
+        return false;
+    }
+    if (typeof value === 'number') {
+        value = String(value);
+    }
+    if (typeof value !== 'string') {
+        return false;
+    }
+    bcrypt = bcrypt || require('bcryptjs');
+    try {
+        return await bcrypt.compare(value, hashed);
+    } catch (e) {
+        return false;
+    }
+};
+
+/** `$request->boolean()` — FILTER_VALIDATE_BOOLEAN. */
+const phpBoolean = (value) => {
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    if (typeof value === 'number') {
+        return value === 1;
+    }
+    return typeof value === 'string' && ['1', 'true', 'on', 'yes'].includes(value.trim().toLowerCase());
+};
+
+/** `!$code` PHP. */
+const phpEmpty = (value) => value === null || value === undefined || value === false || value === 0
+    || value === '' || value === '0' || (Array.isArray(value) && value.length === 0);
+
+const isScalar = (value) => ['string', 'number', 'boolean'].includes(typeof value);
+
+const phpString = (value) => (typeof value === 'boolean' ? (value ? '1' : '') : String(value));
+
+/**
+ * RateLimiter Laravel для `auth.unlock`: окно ставит первая неудача и дальше не сдвигается,
+ * успех счётчик сбрасывает. В Laravel он в общем кэше, здесь — в памяти процесса (у каждой
+ * реплики облачного Node свой).
+ */
+const unlockLimiter = (() => {
+    const hits = new Map();
+    const LIMIT = 20000;
+    const live = (key) => {
+        const entry = hits.get(key);
+        if (entry && entry.resetAt > Date.now()) {
+            return entry;
+        }
+        hits.delete(key);
+        return null;
+    };
+    return {
+        /** null — можно, иначе секунды до снятия. */
+        retryAfter(key, maxAttempts) {
+            const entry = live(key);
+            if (!entry || entry.attempts < maxAttempts) {
+                return null;
+            }
+            return Math.max(1, Math.ceil((entry.resetAt - Date.now()) / 1000));
+        },
+        hit(key, decaySeconds) {
+            const entry = live(key);
+            if (entry) {
+                entry.attempts += 1;
+                return;
+            }
+            if (hits.size >= LIMIT) {
+                hits.clear();
+            }
+            hits.set(key, {attempts: 1, resetAt: Date.now() + decaySeconds * 1000});
+        },
+        clear(key) {
+            hits.delete(key);
+        },
+    };
+})();
+
+const unlockConfig = () => {
+    const max = parseInt(process.env.UNLOCK_MAX_ATTEMPTS ?? '0', 10);
+    const decay = parseInt(process.env.UNLOCK_DECAY_SECONDS ?? '60', 10);
+    return {
+        maxAttempts: Number.isFinite(max) ? max : 0,
+        decaySeconds: Math.max(1, Number.isFinite(decay) ? decay : 60),
+    };
+};
+
+// ------------------------------------------------------------ toArray моделей
+
+/** User: скрыты password и remember_token, email_verified_at — datetime. */
+const userArray = (row) => {
+    const {password, remember_token: rememberToken, ...rest} = row;
+    return modelArray(rest, {email_verified_at: isoDate});
+};
+
+/** Currency: HasTranslations на name и coins_name. */
+const currencyArray = (row, locale) => modelArray(row, {
+    name: (value) => transArray(value, locale),
+    coins_name: (value) => transArray(value, locale),
+    // double без каста: PDO отдаёт его строкой ("1"), драйвер Node — числом.
+    exchange_rate: (value) => (value === null || value === undefined ? value : String(value)),
+});
+
+/** Company: working_times_by_week_day без каста — текстом, как отдаёт PDO. */
+const companyArray = (row) => modelArray(takeText(row, ['working_times_by_week_day']), {
+    settings: phpArray,
+    is_all_day: nullableBool,
+    service_charge: (value) => (value === null || value === undefined ? null : parseInt(value, 10)),
+    pos_master_epoch: (value) => (value === null || value === undefined ? null : parseInt(value, 10)),
+    pos_mode_changed_at: isoDate,
+});
+
+/** Terminal (+ company). password не отдаётся. */
+const terminalArray = (row, company) => {
+    const {password, ...rest} = row;
+    const result = modelArray(rest, {
+        settings: phpArray,
+        sync_status: phpArray,
+        sync_seen_at: isoDate,
+    });
+    result.company = company;
+    return result;
+};
+
+/**
+ * Team: связи в порядке загрузки — owner и terminals (with), затем currency: её лениво
+ * подтягивает TeamSettingsCast ради символа валюты.
+ */
+const teamArray = (row, {owner, terminals, currency, urls, locale}) => {
+    const {admin_passwords: adminPasswords, ...rest} = row;
+    const result = modelArray(rest, {
+        name: (value) => transArray(value, locale),
+        logo: (value) => castImage(urls, value),
+        settings: (value) => teamSettings(value, currency ? currency.symbol : null),
+        is_trial: nullableBool,
+    });
+    result.has_tax_integration = hasTaxIntegration(row.settings);
+    result.owner = owner;
+    result.terminals = terminals;
+    result.currency = currency;
+    return result;
+};
+
+class AuthService {
+    /**
+     * @param {{db: object, context: import('../Context')}} services
+     */
+    constructor({db, context}) {
+        this.db = db;
+        this.context = context;
+    }
+
+    alive(alias = null) {
+        return alive(this.db, alias);
+    }
+
+    whereIn(sql, ids, params = []) {
+        return whereIn(this.db, sql, ids, params);
+    }
+
+    /** Токен запроса: из цепочки проверок, а при CORE_AUTH=false — сами. */
+    async who(extra) {
+        if (extra.auth && extra.auth.auth) {
+            return extra.auth.auth;
+        }
+        const found = await sanctum.authenticate(this.db, extra.headers || {});
+        if (!found) {
+            throw new HttpError(401, {message: 'Unauthenticated.'});
+        }
+        return found;
+    }
+
+    // ------------------------------------------------------------ app.auth
+
+    /** AuthController::auth — вход по логину и паролю, выпуск токена `terminal`. */
+    async auth(params) {
+        const username = params.username;
+        if (!isScalar(username) || phpString(username) === '') {
+            throw new HttpError(404, NOT_FOUND);
+        }
+        const user = await this.db.get(
+            `SELECT * FROM users WHERE email = ? AND is_super_admin = ?${this.alive()} LIMIT 1`,
+            [phpString(username), false]
+        );
+        if (!user || !await hashCheck(params.password, user.password)) {
+            throw new HttpError(404, NOT_FOUND);
+        }
+
+        const teams = await this.teams(user.id);
+        const token = await sanctum.issue(this.db, user.id, 'terminal');
+        const result = userArray(user);
+        result.token = token.plainTextToken;
+        return {success: true, type: 'user', user: result, teams};
+    }
+
+    /** Команды, где у пользователя роль с доступом к терминалу или роль владельца. */
+    async teams(userId) {
+        const rows = await this.db.all(
+            `SELECT teams.* FROM teams
+                LEFT JOIN team_users ON team_users.team_id = teams.id
+                LEFT JOIN roles ON team_users.role_id = roles.id
+                WHERE team_users.user_id = ?
+                  AND (roles.can_work_with_terminal = ? OR roles.is_owner = ?)${this.alive('teams')}${this.alive('team_users')}`,
+            [userId, true, true]
+        );
+        if (!rows.length) {
+            return [];
+        }
+        const locale = process.env.APP_LOCALE || FALLBACK_LOCALE;
+        const teamIds = unique(rows.map((row) => row.id));
+        const ownerIds = unique(rows.map((row) => row.user_id));
+        const currencyIds = unique(rows.map((row) => row.currency_id));
+
+        const [owners, terminals, currencies, urls] = await Promise.all([
+            this.whereIn(`SELECT * FROM users WHERE id IN (:ids)${this.alive()}`, ownerIds),
+            this.whereIn(
+                `SELECT * FROM terminals WHERE team_id IN (:ids) AND is_logged_in = ?${this.alive()}`,
+                teamIds,
+                [false]
+            ),
+            currencyIds.length
+                ? this.whereIn(`SELECT * FROM currencies WHERE id IN (:ids)${this.alive()}`, currencyIds)
+                : [],
+            imageUrls(this.db, rows.map((row) => row.logo)),
+        ]);
+
+        const companyIds = unique(terminals.map((row) => row.company_id));
+        const companies = companyIds.length
+            ? await this.whereIn(
+                `SELECT *${jsonText(this.db, ['working_times_by_week_day'])} FROM companies WHERE id IN (:ids)${this.alive()}`,
+                companyIds
+            )
+            : [];
+
+        const companiesById = new Map(companies.map((row) => [String(row.id), companyArray(row)]));
+        const ownersById = indexBy(owners);
+        const currenciesById = indexBy(currencies);
+        const terminalsByTeam = groupBy(terminals, 'team_id');
+
+        return rows.map((row) => {
+            const owner = ownersById.get(String(row.user_id));
+            const currency = row.currency_id ? currenciesById.get(String(row.currency_id)) : null;
+            return teamArray(row, {
+                owner: owner ? userArray(owner) : null,
+                terminals: (terminalsByTeam.get(String(row.id)) || []).map((terminal) =>
+                    terminalArray(terminal, companiesById.get(String(terminal.company_id)) || null)),
+                currency: currency ? currencyArray(currency, locale) : null,
+                urls,
+                locale,
+            });
+        });
+    }
+
+    // ------------------------------------------------------------ auth.loginTerminal
+
+    /** AuthController::loginTerminal — привязать токен к терминалу, терминал «вошёл». */
+    async loginTerminal(params, extra) {
+        const who = await this.who(extra);
+        const platform = extra.auth ? extra.auth.platform : platformHeaders(extra.headers || {});
+        const id = params.id;
+
+        const scopeMode = scope.mode();
+        if (scopeMode !== scope.MODE_OFF) {
+            const belongs = await scope.terminalBelongs(
+                this.db, id, platform.teamId, scope.value(platform.companyId), true
+            );
+            if (!belongs) {
+                scope.report(scope.REASON_TERMINAL, {event: extra.event, auth: who, platform, ip: extra.ip}, scopeMode, {
+                    target_terminal_id: isScalar(id) ? phpString(id) : null,
+                });
+                if (scopeMode === scope.MODE_ENFORCE) {
+                    // Токен не трогаем: привязка к чужому терминалу — ровно то, что запрещаем.
+                    const {status, body} = scope.deny(scope.REASON_TERMINAL);
+                    throw new HttpError(status, body);
+                }
+            }
+        }
+
+        // В PHP токен переписывался раньше поиска терминала, и на отсутствующем терминале
+        // запрос падал 500 с уже изменённым токеном. Здесь сначала ищем.
+        const terminal = scope.isUuid(id)
+            ? await this.db.get(`SELECT id FROM terminals WHERE id = ?${this.alive()}`, [id])
+            : null;
+        if (!terminal) {
+            throw notFound('Terminal not found');
+        }
+
+        // Eloquent пишет только изменённое: та же привязка не трогает updated_at.
+        const stamp = nowSql();
+        await this.db.run(
+            `UPDATE personal_access_tokens SET terminal_id = ?, updated_at = ?
+                WHERE id = ? AND (terminal_id IS NULL OR terminal_id <> ?)`,
+            [terminal.id, stamp, who.tokenId, terminal.id]
+        );
+        await this.db.run(
+            'UPDATE terminals SET is_logged_in = ?, updated_at = ? WHERE id = ? AND is_logged_in <> ?',
+            [true, stamp, terminal.id, true]
+        );
+        return true;
+    }
+
+    // ------------------------------------------------------------ auth.logoutApp
+
+    /**
+     * AuthController::logoutApp — отозвать токен. `keep_terminal`: касса отзывает токен прошлой
+     * сессии, а терминал уже вошёл с новым — отметку «вошёл» не сбрасываем.
+     */
+    async logoutApp(params, extra) {
+        const who = await this.who(extra);
+        await sanctum.revoke(this.db, who.tokenId);
+        const terminalId = this.context.terminalId;
+        if (!phpBoolean(params.keep_terminal) && scope.isUuid(terminalId)) {
+            await this.db.run(
+                `UPDATE terminals SET is_logged_in = ?, updated_at = ?
+                    WHERE id = ? AND is_logged_in <> ?${this.alive()}`,
+                [false, nowSql(), terminalId, false]
+            );
+        }
+        return true;
+    }
+
+    // ------------------------------------------------------------ auth.unlock
+
+    /** Ключ лимитера — как unlockThrottleKey в PHP: терминал команды, иначе IP. */
+    async unlockKey(ip) {
+        const teamId = scope.value(this.context.teamId) ?? '';
+        const terminalId = scope.value(this.context.terminalId);
+        const target = terminalId !== null && await scope.terminalBelongs(this.db, terminalId, teamId)
+            ? `terminal:${terminalId.toLowerCase()}`
+            : `ip:${ip ?? ''}`;
+        return 'auth-unlock:' + crypto.createHash('sha1').update(`${teamId}|${target}`).digest('hex');
+    }
+
+    /** AuthController::unlock — сотрудник по PIN или карте, со сменами. */
+    async unlock(params, extra) {
+        const {maxAttempts, decaySeconds} = unlockConfig();
+        const key = maxAttempts > 0 ? await this.unlockKey(extra.ip) : null;
+        if (key) {
+            const retryAfter = unlockLimiter.retryAfter(key, maxAttempts);
+            if (retryAfter !== null) {
+                throw new HttpError(429, {
+                    message: TOO_MANY,
+                    error_code: 'too_many_attempts',
+                    retry_after: retryAfter,
+                }, {'Retry-After': String(retryAfter)});
+            }
+        }
+
+        const member = await this.findUnlockMember(params.code);
+        if (!member) {
+            if (key) {
+                unlockLimiter.hit(key, decaySeconds);
+            }
+            // response()->json(null): Symfony подменяет null на пустой ArrayObject — уходит {}.
+            return {};
+        }
+        if (key) {
+            unlockLimiter.clear(key);
+        }
+
+        await this.context.load();
+        const team = this.context.getTeam();
+        const [user, role, scopes, cashShift, workShift] = await Promise.all([
+            this.db.get(`SELECT id, name FROM users WHERE id = ?${this.alive()}`, [member.user_id]),
+            this.db.get(`SELECT * FROM roles WHERE id = ?${this.alive()}`, [member.role_id]),
+            this.roleScopes(member.role_id),
+            this.cashShift(),
+            this.workShift(member.id),
+        ]);
+        return {
+            user: teamUserResource(member, {
+                user,
+                role,
+                scopes,
+                cashShift,
+                workShift,
+                teamOwnerId: team ? team.user_id : null,
+                teamId: this.context.teamId,
+            }),
+            // JsonResource от null сериализуется в [].
+            shift: workShift ? shiftResource(workShift) : [],
+            cash_shift: cashShift ? shiftResource(cashShift) : [],
+        };
+    }
+
+    /** TeamUserService::unlock. Код биндится строкой: число против varchar в PHP давало 500. */
+    async findUnlockMember(code) {
+        if (phpEmpty(code) || !isScalar(code) || !scope.isUuid(this.context.teamId)) {
+            return null;
+        }
+        const value = phpString(code);
+        return this.db.get(
+            `SELECT tu.* FROM team_users tu
+                WHERE tu.team_id = ? AND (tu.pin = ? OR tu.ic_card = ?)${this.alive('tu')}
+                  AND EXISTS (
+                      SELECT 1 FROM roles r
+                      WHERE r.id = tu.role_id AND (r.can_work_with_terminal = ? OR r.is_owner = ?)${this.alive('r')}
+                  )
+                LIMIT 1`,
+            [this.context.teamId, value, value, true, true]
+        );
+    }
+
+    async roleScopes(roleId) {
+        if (!roleId) {
+            return {};
+        }
+        const rows = await this.db.all(
+            `SELECT pe."group", pe.slug, per.can
+                FROM platform_events pe
+                INNER JOIN platform_event_roles per ON pe.id = per.platform_event_id
+                WHERE per.role_id = ?${this.alive('pe')}`,
+            [roleId]
+        );
+        const scopes = {};
+        for (const row of rows) {
+            scopes[`${row.group}:${row.slug}`] = row.can;
+        }
+        return scopes;
+    }
+
+    /** ShiftService::getCashShift. */
+    async cashShift() {
+        return new ShiftService({db: this.db, context: this.context}).cashShift();
+    }
+
+    /** ShiftService::getWorkShift — по сотруднику, см. ShiftService.workShift. */
+    async workShift(teamUserId) {
+        return new ShiftService({db: this.db, context: this.context}).workShift(teamUserId);
+    }
+}
+
+module.exports = AuthService;
+module.exports._unlockLimiter = unlockLimiter;