@appweaver/core 1.3.1 → 1.4.1

package/security/auth-service.js

@@ -6,6 +6,7 @@ const helper_1 = require("./helper");
 const oauth2_service_1 = require("./oauth2/oauth2-service");
 const context_1 = require("../context");
 const cache_1 = require("../cache");
+const storage_1 = require("../storage");
 const errors_1 = require("../errors");
 const AUTH_KEY = 'auth';
 class AuthService {
@@ -21,7 +22,7 @@ class AuthService {
     /**
      * Finds an authenticated user by their unique identifier.
      *
-     * @param {number} id - The unique identifier of the authenticated user to find.
+     * @param {ResourceId} id - The unique identifier of the authenticated user to find.
      * @return {Promise<AuthUser | null>} A promise that resolves to the authenticated user object if found, otherwise
      * null.
      */
@@ -80,7 +81,7 @@ class AuthService {
     /**
      * Updates an authenticated user's information in the system.
      *
-     * @param {number} id - The unique identifier of the authenticated user to be updated.
+     * @param {ResourceId} id - The unique identifier of the authenticated user to be updated.
      * @param {Partial<AuthUser> & { password?: string }} data - The partial user data to update, optionally including a
      * password.
      * @return {Promise<AuthUser>} A promise that resolves to the updated authenticated user object.
@@ -106,10 +107,11 @@ class AuthService {
      * @throws {HttpError} Throws an error if the registration process fails.
      */
     async registerAuthUser(source, email, password, data) {
+        let authUser;
         try {
             const serviceConfig = this._authUserService[common_1.CONFIG];
-            const registrationData = serviceConfig.registrationData(source, email, password, data);
-            return this._authUserService.create({
+            const registrationData = await serviceConfig.registrationData(source, email, password, data);
+            authUser = await this._authUserService.create({
                 ...registrationData,
                 verifiedEmail: source !== common_1.AuthSource.Password
             });
@@ -117,6 +119,42 @@ class AuthService {
         catch (e) {
             throw new errors_1.HttpError('Auth user registration error', 500, e);
         }
+        await this.saveRegistrationFiles(authUser, source, data);
+        return authUser;
+    }
+    /**
+     * Saves the files the `registrationFiles` service configuration selects for a newly registered user, each one to the
+     * file field of the auth model it is keyed by. The files are stored only after the user exists, since a file record
+     * is linked to the resource that owns it. Storing a file is best-effort, so a rejected file, such as an avatar the
+     * provider served in an unsupported format, is logged and never fails the registration.
+     *
+     * @internal
+     */
+    async saveRegistrationFiles(authUser, source, data) {
+        const serviceConfig = this._authUserService[common_1.CONFIG];
+        if (!serviceConfig.registrationFiles) {
+            return;
+        }
+        let files;
+        try {
+            files = (await serviceConfig.registrationFiles(source, data)) ?? {};
+        }
+        catch (e) {
+            common_1.logger.error({ id: authUser.id, err: e }, 'Registration files selection error');
+            return;
+        }
+        const fileService = (0, context_1.inject)(storage_1.FileService);
+        for (const [field, file] of Object.entries(files)) {
+            if (!file) {
+                continue;
+            }
+            try {
+                await fileService.saveBuffer(field, file, authUser, this._authUserService.client);
+            }
+            catch (e) {
+                common_1.logger.error({ id: authUser.id, field, err: e }, 'Registration file save error');
+            }
+        }
     }
     /**
      * Changes the password for the authenticated user.
@@ -292,7 +330,7 @@ class AuthService {
     /**
      * Logs out a user by updating their authentication information with a logout timestamp.
      *
-     * @param {number} id - The unique identifier of the user to be logged out.
+     * @param {ResourceId} id - The unique identifier of the user to be logged out.
      * @return {Promise<boolean>} A promise that resolves to a boolean indicating whether the logout operation was
      * successful.
      */

package/security/create-auth-resources.d.ts

@@ -1,7 +1,8 @@
 import { Ctor, IResourceService, ResourceModel, ResourceModelConfig, ResourceServiceConfig } from '@appweaver/common';
-import { CheckOAuth2UserFn, RegistrationDataFn } from '../types';
+import { CheckOAuth2UserFn, RegistrationDataFn, RegistrationFilesFn } from '../types';
 export declare function createAuthModel(config: ResourceModelConfig): ResourceModel;
 export declare function createAuthService<T = any, C = any, U = any>(config: ResourceServiceConfig<T, C, U> & {
     registrationData?: RegistrationDataFn<T>;
+    registrationFiles?: RegistrationFilesFn;
     checkOAuth2User?: CheckOAuth2UserFn;
 }): Ctor<IResourceService<T, T, C, U>>;

package/security/oauth2/create-oauth2-plugin.js

@@ -13,6 +13,7 @@ const auth_service_1 = require("../auth-service");
 const oauth2_service_1 = require("./oauth2-service");
 const helper_1 = require("../helper");
 const oauth2_schema_1 = require("./oauth2-schema");
+const oauth2_util_1 = require("./oauth2-util");
 function createOAuth2Plugin(authSource, oAuth2Config) {
     const name = authSource.replace('oauth2', '');
     const upperName = name.toUpperCase();
@@ -100,7 +101,8 @@ function createOAuth2Plugin(authSource, oAuth2Config) {
                 }
                 authUser = await authService.registerAuthUser(authSource, userInfo.email, undefined, {
                     ...(0, common_1.pickProperties)(userInfo, ['firstName', 'lastName', 'avatarUrl']),
-                    avatarFile: userInfo.avatarFile ?? (await fetchAvatarFile(userInfo))
+                    avatarFile: userInfo.avatarFile ??
+                        (await (0, oauth2_util_1.fetchAvatarFile)(userInfo.avatarUrl, userInfo.id))
                 });
             }
             const stateData = request.oauth2State;
@@ -137,36 +139,3 @@ function createOAuth2Plugin(authSource, oAuth2Config) {
         });
     });
 }
-/**
- * Downloads the user's avatar image from the OAuth2 provider so it can be passed to the `registrationData` callback.
- * Fetching is best-effort: any failure is logged and `undefined` is returned so the registration flow is not blocked.
- *
- * @param {UserInfo} userInfo - The user info extracted from the OAuth2 provider, including the optional avatar URL.
- * @return {Promise<AvatarFile | undefined>} A promise resolving to the downloaded avatar file, or `undefined` when
- * avatar fetching is disabled, no avatar URL is available, or the download fails.
- */
-async function fetchAvatarFile(userInfo) {
-    if (!common_1.config.SECURITY_OAUTH2_FETCH_AVATAR_ENABLED || !userInfo.avatarUrl) {
-        return undefined;
-    }
-    try {
-        const resp = await fetch(userInfo.avatarUrl, { method: 'GET' });
-        if (!resp.ok) {
-            common_1.logger.debug({ url: userInfo.avatarUrl, status: resp.status }, 'OAuth2 avatar fetch failed');
-            return undefined;
-        }
-        const mimeType = resp.headers.get('content-type') ?? 'image/jpeg';
-        const data = Buffer.from(await resp.arrayBuffer());
-        const extension = mimeType.split('/')[1]?.split(';')[0] ?? 'jpg';
-        return {
-            name: `avatar-${userInfo.id}.${extension}`,
-            mimeType,
-            size: data.length,
-            data
-        };
-    }
-    catch (e) {
-        common_1.logger.debug({ url: userInfo.avatarUrl, err: e }, 'OAuth2 avatar fetch error');
-        return undefined;
-    }
-}

package/security/oauth2/oauth2-microsoft.js

@@ -31,6 +31,6 @@ async function fetchMicrosoftUser(accessToken) {
         firstName: data.givenName ?? firstName,
         lastName: data.surname ?? lastName,
         // Microsoft Graph serves the photo as authenticated binary content, so it has to be downloaded here.
-        avatarFile: await (0, oauth2_util_1.fetchAuthenticatedAvatar)(`${userInfoUrl}/photo/$value`, accessToken, data.id)
+        avatarFile: await (0, oauth2_util_1.fetchAvatarFile)(`${userInfoUrl}/photo/$value`, data.id, accessToken)
     };
 }

package/security/oauth2/oauth2-util.d.ts

@@ -6,20 +6,22 @@ import { AvatarFile } from '../../types';
  * @param {string} url - The user info endpoint to call.
  * @param {string} accessToken - The access token obtained from the authorization code flow.
  * @param {Record<string, string>} [headers] - Extra request headers required by the provider.
- * @return {Promise<T>} A promise resolving to the parsed response body.
+ * @return {Promise<Object>} A promise resolving to the parsed response body.
  * @throws {HttpError} If the provider responds with a non-2xx status.
  */
 export declare function fetchUserInfo<T>(providerName: string, url: string, accessToken: string, headers?: Record<string, string>): Promise<T>;
 /**
- * Downloads an avatar image that is only reachable with the provider's access token, so it cannot be resolved later
- * from a plain URL. Fetching is best-effort and returns `undefined` on any failure.
+ * Downloads the user's avatar image so it can be passed to the `registrationData` and `registrationFiles` callbacks as
+ * `avatarFile`. Fetching is opt-in through `SECURITY_OAUTH2_FETCH_AVATAR_ENABLED` and best-effort: every reason the
+ * image does not arrive is logged and `undefined` is returned, so the registration flow is never blocked by it.
  *
- * @param {string} url - The avatar endpoint to call.
- * @param {string} accessToken - The access token obtained from the authorization code flow.
+ * @param {string | undefined} url - The avatar endpoint to call.
  * @param {string} id - The provider's user identifier, used to name the file.
- * @return {Promise<AvatarFile | undefined>} A promise resolving to the downloaded avatar, or `undefined`.
+ * @param {string} [accessToken] - Access token, for providers whose avatar endpoint requires authentication.
+ * @return {Promise<AvatarFile | undefined>} A promise resolving to the downloaded avatar, or `undefined` when
+ * fetching is disabled, no avatar URL is available, or the download fails.
  */
-export declare function fetchAuthenticatedAvatar(url: string, accessToken: string, id: string): Promise<AvatarFile | undefined>;
+export declare function fetchAvatarFile(url: string | undefined, id: string, accessToken?: string): Promise<AvatarFile | undefined>;
 /**
  * Splits a provider's single display name field into a first and last name. Everything after the first whitespace
  * separated word becomes the last name, so multipart surnames are kept intact.

package/security/oauth2/oauth2-util.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchUserInfo = fetchUserInfo;
-exports.fetchAuthenticatedAvatar = fetchAuthenticatedAvatar;
+exports.fetchAvatarFile = fetchAvatarFile;
 exports.splitFullName = splitFullName;
 exports.requireEmail = requireEmail;
 exports.decodeJwtPayload = decodeJwtPayload;
@@ -51,7 +51,7 @@ const APPLE_TOKEN_AUDIENCE = 'https://appleid.apple.com';
  * @param {string} url - The user info endpoint to call.
  * @param {string} accessToken - The access token obtained from the authorization code flow.
  * @param {Record<string, string>} [headers] - Extra request headers required by the provider.
- * @return {Promise<T>} A promise resolving to the parsed response body.
+ * @return {Promise<Object>} A promise resolving to the parsed response body.
  * @throws {HttpError} If the provider responds with a non-2xx status.
  */
 async function fetchUserInfo(providerName, url, accessToken, headers = {}) {
@@ -65,24 +65,30 @@ async function fetchUserInfo(providerName, url, accessToken, headers = {}) {
     return resp.json();
 }
 /**
- * Downloads an avatar image that is only reachable with the provider's access token, so it cannot be resolved later
- * from a plain URL. Fetching is best-effort and returns `undefined` on any failure.
+ * Downloads the user's avatar image so it can be passed to the `registrationData` and `registrationFiles` callbacks as
+ * `avatarFile`. Fetching is opt-in through `SECURITY_OAUTH2_FETCH_AVATAR_ENABLED` and best-effort: every reason the
+ * image does not arrive is logged and `undefined` is returned, so the registration flow is never blocked by it.
  *
- * @param {string} url - The avatar endpoint to call.
- * @param {string} accessToken - The access token obtained from the authorization code flow.
+ * @param {string | undefined} url - The avatar endpoint to call.
  * @param {string} id - The provider's user identifier, used to name the file.
- * @return {Promise<AvatarFile | undefined>} A promise resolving to the downloaded avatar, or `undefined`.
+ * @param {string} [accessToken] - Access token, for providers whose avatar endpoint requires authentication.
+ * @return {Promise<AvatarFile | undefined>} A promise resolving to the downloaded avatar, or `undefined` when
+ * fetching is disabled, no avatar URL is available, or the download fails.
  */
-async function fetchAuthenticatedAvatar(url, accessToken, id) {
+async function fetchAvatarFile(url, id, accessToken) {
     if (!common_1.config.SECURITY_OAUTH2_FETCH_AVATAR_ENABLED) {
         return undefined;
     }
+    if (!url) {
+        return undefined;
+    }
     try {
         const resp = await fetch(url, {
             method: 'GET',
-            headers: { authorization: `Bearer ${accessToken}` }
+            headers: accessToken ? { authorization: `Bearer ${accessToken}` } : {}
         });
         if (!resp.ok) {
+            common_1.logger.error({ url, status: resp.status }, 'OAuth2 avatar fetch failed');
             return undefined;
         }
         const mimeType = resp.headers.get('content-type') ?? 'image/jpeg';
@@ -95,7 +101,8 @@ async function fetchAuthenticatedAvatar(url, accessToken, id) {
             data
         };
     }
-    catch {
+    catch (e) {
+        common_1.logger.error({ url, err: e }, 'OAuth2 avatar fetch error');
         return undefined;
     }
 }

package/security/resources/api-key/model.js

@@ -44,6 +44,8 @@ exports.default = shouldCreateModel
                         type: 'oneToMany',
                         mappedBy: 'apiKeys',
                         owner: true,
+                        // API keys are meaningless without their user
+                        onDelete: 'cascade',
                         input: {
                             type: 'none'
                         },

package/security/resources/connected-account/model.js

@@ -37,6 +37,8 @@ exports.default = shouldCreateModel
                         type: 'oneToMany',
                         mappedBy: 'connectedAccounts',
                         owner: true,
+                        // Connected accounts are meaningless without their user
+                        onDelete: 'cascade',
                         input: {
                             type: 'none'
                         },

package/security/store/database-security-store.js

@@ -45,7 +45,8 @@ class DatabaseSecurityStore extends common_1.SecurityStore {
     }
     /** @internal */
     async removeOneTimeToken(id) {
-        await this._db.client().oneTimeToken.delete({ where: { id } });
+        // The generated client types the id after the configured primary key
+        await this._db.client().oneTimeToken.delete({ where: { id: id } });
     }
 }
 exports.DatabaseSecurityStore = DatabaseSecurityStore;

package/server/swagger.js

@@ -11,7 +11,7 @@ const context_1 = require("../context");
 exports.default = (0, fastify_plugin_1.default)((server) => {
     server.register(swagger_1.default, {
         hideUntagged: common_1.config.SWAGGER_HIDE_UNTAGGED,
-        transformObject: (document) => addConfig(normalizeUnionTypes(pruneUnusedSchemas(document))),
+        transformObject: (document) => addConfig(normalizeUnionTypes(pruneUnusedSchemas(inlineNullableRefs(document)))),
         openapi: {
             info: {
                 title: common_1.config.APP_NAME,
@@ -64,6 +64,54 @@ exports.default = (0, fastify_plugin_1.default)((server) => {
         });
     }
 });
+/**
+ * Replaces every reference to a nullable model variant with the union it stands
+ * for. Each model registers a `<Model>SingleNullable` schema the response
+ * serializer needs as a name of its own, since it cannot compile an inline
+ * union that cycles back to a model it is already writing. The document says
+ * the same thing without that indirection, leaving the variants unreferenced
+ * for {@link pruneUnusedSchemas} to drop.
+ *
+ * @param {Object} document The transform argument of the Swagger plugin,
+ * wrapping the OpenAPI document in its `openapiObject` property.
+ * @returns {Object} The same argument, with every reference to a nullable model
+ * variant replaced in place.
+ */
+function inlineNullableRefs(document) {
+    const schemas = document.openapiObject?.components?.schemas ?? {};
+    // The schemas are registered under generated names, so the variants are
+    // recognized by the title carrying the name they were declared with
+    const variants = new Map();
+    for (const [name, schema] of Object.entries(schemas)) {
+        if (/SingleNullable$/.test(schema?.title ?? '') && (0, common_1.isArray)(schema?.anyOf)) {
+            variants.set(`#/components/schemas/${name}`, schema.anyOf);
+        }
+    }
+    if (variants.size === 0) {
+        return document;
+    }
+    const visit = (node) => {
+        if (!node || typeof node !== 'object') {
+            return;
+        }
+        if ((0, common_1.isArray)(node)) {
+            for (const item of node)
+                visit(item);
+            return;
+        }
+        for (const value of Object.values(node)) {
+            visit(value);
+        }
+        const union = variants.get(node.$ref);
+        if (union) {
+            delete node.$ref;
+            node.anyOf = structuredClone(union);
+        }
+    };
+    visit(document.openapiObject?.paths);
+    visit(schemas);
+    return document;
+}
 /**
  * Rewrites the JSON Schema type lists of the document into the equivalent
  * `anyOf` unions. The query filter schemas declare their plain values as a

package/storage/file-service.d.ts

@@ -1,6 +1,6 @@
 import { Multipart, MultipartFile } from '@fastify/multipart';
-import { ContentStream, Resource, ResourceClient } from '@appweaver/common';
-import { File } from '../types';
+import { ContentStream, Resource, ResourceClient, ResourceId } from '@appweaver/common';
+import { File, FileBuffer } from '../types';
 export type FileStream = {
     content: ContentStream;
     fileName: string;
@@ -41,6 +41,21 @@ export declare class FileService {
      * @throws {HttpError} Throws an error if file validation, storage, or resource association fails.
      */
     saveFile(data: MultipartFile, resource: Resource, client: ResourceClient): Promise<File>;
+    /**
+     * Saves an in-memory file to storage and associates it with a file field of a specific resource. Behaves exactly like
+     * {@link saveFile}, except the content is taken from a buffer instead of a multipart upload, which makes it usable
+     * outside a file upload request, for an avatar downloaded from an OAuth2 provider or an image the application
+     * generates itself.
+     *
+     * @param {string} fieldName The file field of the resource the file is saved to.
+     * @param {FileBuffer} file The file content, along with its original name and media type.
+     * @param {Resource} resource The resource object with which the file is being associated.
+     * @param {ResourceClient} client The database client responsible for handling the resource.
+     * @return {Promise<File>} A promise that resolves to the saved file object or rejects with an error if the operation
+     * fails.
+     * @throws {HttpError} Throws an error if file validation, storage, or resource association fails.
+     */
+    saveBuffer(fieldName: string, file: FileBuffer, resource: Resource, client: ResourceClient): Promise<File>;
     /**
      * Saves files received as an asynchronous iterable of multipart data.
      *
@@ -85,8 +100,8 @@ export declare class FileService {
      * setting (or set to `'keep'`) are left untouched.
      *
      * @param {string} resourceName - The resource model name.
-     * @param {number} resourceId - The ID of the deleted resource.
+     * @param {ResourceId} id - The ID of the deleted resource.
      * @return {Promise<File[]>} A promise that resolves to the list of successfully deleted files.
      */
-    deleteResourceFiles(resourceName: string, resourceId: number): Promise<File[]>;
+    deleteResourceFiles(resourceName: string, id: ResourceId): Promise<File[]>;
 }