@arcote.tech/arc-host 0.1.3 → 0.1.5

package/host.ts

@@ -1,10 +1,12 @@
 import {
   ArcCollection,
   MasterDataStorage,
+  Model,
   QueryBuilderContext,
   QueryCache,
   type ArcCollectionAny,
   type ArcContextAny,
+  type AuthContext,
   type DatabaseAdapter,
   type DataStorageChanges,
   type MessageClientToHost,
@@ -12,17 +14,21 @@ import {
   type RealTimeCommunicationAdapter,
 } from "@arcote.tech/arc";
 import type { Server, ServerWebSocket } from "bun";
-import jwt from "jsonwebtoken";
+import { verifyToken, type TokenPayload } from "./auth/jwt";
 
 class RTCHost implements RealTimeCommunicationAdapter {
   private server!: Server;
   private dataStore: MasterDataStorage;
+  private model: Model<ArcContextAny>;
 
   constructor(
     private context: ArcContextAny,
     dbAdapter: Promise<DatabaseAdapter>,
   ) {
     this.dataStore = new MasterDataStorage(dbAdapter, () => this, context);
+    this.model = new Model(context, this.dataStore, (error) =>
+      console.error("Command error:", error),
+    );
     this.setupServer();
   }
 
@@ -42,20 +48,123 @@ class RTCHost implements RealTimeCommunicationAdapter {
     // throw new Error("Method not implemented.");
   }
 
-  private async verifyToken(token: string) {
+  private async verifyAuthToken(token: string) {
     try {
-      const secret = process.env.AUTH_SECRET as string;
-      if (!secret) {
-        throw new Error("AUTH_SECRET is not set");
-      }
-      const payload = jwt.verify(token, secret);
+      const payload = verifyToken(token);
       return payload;
     } catch (error) {
-      console.error("Token verification failed:", error);
       return null;
     }
   }
 
+  /**
+   * Convert JWT payload to AuthContext
+   */
+  private tokenToAuthContext(
+    payload: TokenPayload,
+    ipAddress?: string,
+  ): AuthContext {
+    return {
+      userId: payload.userId,
+      roles: [], // Default to no roles, you may want to extend TokenPayload to include roles
+      ipAddress,
+    };
+  }
+
+  /**
+   * Extract client IP address from request headers
+   */
+  private getClientIpAddress(req: Request): string | undefined {
+    // Check common headers for client IP
+    const xForwardedFor = req.headers.get("x-forwarded-for");
+    const xRealIp = req.headers.get("x-real-ip");
+    const cfConnectingIp = req.headers.get("cf-connecting-ip");
+
+    if (xForwardedFor) {
+      // x-forwarded-for can contain multiple IPs, take the first one
+      return xForwardedFor.split(",")[0].trim();
+    }
+
+    if (xRealIp) {
+      return xRealIp;
+    }
+
+    if (cfConnectingIp) {
+      return cfConnectingIp;
+    }
+
+    // Fallback - this might not work in all environments
+    return undefined;
+  }
+
+  /**
+   * Get default auth context for anonymous users
+   */
+  private getDefaultAuthContext(ipAddress?: string): AuthContext {
+    return {
+      userId: "anonymous",
+      roles: [],
+      ipAddress,
+    };
+  }
+
+  /**
+   * Parse FormData back to an object structure
+   */
+  private async parseFormDataToObject(formData: FormData): Promise<any> {
+    const obj: any = {};
+
+    // Use forEach instead of entries() for better TypeScript compatibility
+    formData.forEach((value, key) => {
+      this.setNestedProperty(obj, key, value);
+    });
+
+    return obj;
+  }
+
+  /**
+   * Helper method to set nested properties from FormData keys like "user[profile][avatar]"
+   */
+  private setNestedProperty(obj: any, path: string, value: any): void {
+    // Handle array notation like "items[0]" or nested object notation like "user[profile][name]"
+    const keys = path.split(/[\[\]]+/).filter((key) => key !== "");
+    let current = obj;
+
+    for (let i = 0; i < keys.length - 1; i++) {
+      const key = keys[i];
+      const nextKey = keys[i + 1];
+
+      // Check if next key is a number (array index)
+      if (!isNaN(Number(nextKey))) {
+        if (!current[key]) {
+          current[key] = [];
+        }
+        if (!current[key][Number(nextKey)]) {
+          current[key][Number(nextKey)] = {};
+        }
+        current = current[key][Number(nextKey)];
+        i++; // Skip the array index
+      } else {
+        if (!current[key]) {
+          current[key] = {};
+        }
+        current = current[key];
+      }
+    }
+
+    const finalKey = keys[keys.length - 1];
+    if (!isNaN(Number(finalKey))) {
+      // This is an array index at the root level
+      const parentKey = keys[keys.length - 2];
+      if (!current[parentKey]) {
+        current[parentKey] = [];
+      }
+      current[parentKey][Number(finalKey)] = value;
+    } else {
+      current[finalKey] = value;
+    }
+  }
+
   private async handleCommand(req: Request) {
     const url = new URL(req.url);
     const commandName = url.pathname.split("/command/")[1];
@@ -63,19 +172,39 @@ class RTCHost implements RealTimeCommunicationAdapter {
     if (!commandName) {
       return new Response("Command not specified", { status: 400 });
     }
+
     try {
-      const argument = await req.json();
-      // Create command context and execute command
-      const queryContext = new QueryBuilderContext(
-        new QueryCache(),
-        this.dataStore,
-      );
-      const commands = this.context.commandsClient(
-        "server",
-        queryContext,
-        this.dataStore,
-        (error) => console.error("Command error:", error),
-      );
+      // Extract token from Authorization header
+      const authHeader = req.headers.get("Authorization");
+      const token = authHeader?.replace("Bearer ", "");
+
+      const clientIp = this.getClientIpAddress(req);
+      let authContext: AuthContext;
+      if (token && !this.isPublicEndpoint(url.pathname)) {
+        const payload = await this.verifyAuthToken(token);
+        if (!payload) {
+          return new Response("Invalid or expired token", { status: 401 });
+        }
+        authContext = this.tokenToAuthContext(payload, clientIp);
+      } else {
+        authContext = this.getDefaultAuthContext(clientIp);
+      }
+
+      let argument: any;
+      const contentType = req.headers.get("Content-Type");
+
+      // Handle different content types
+      if (contentType && contentType.includes("multipart/form-data")) {
+        // Parse FormData
+        const formData = await req.formData();
+        argument = await this.parseFormDataToObject(formData);
+      } else {
+        // Parse JSON (default behavior)
+        argument = await req.json();
+      }
+
+      // Use the model's commands() method with auth context
+      const commands = this.model.commands(authContext);
 
       const result = await (commands as any)[commandName](argument);
       return new Response(JSON.stringify(result), {
@@ -90,6 +219,22 @@ class RTCHost implements RealTimeCommunicationAdapter {
 
   private async handleQuery(req: Request) {
     try {
+      // Extract token from Authorization header
+      const authHeader = req.headers.get("Authorization");
+      const token = authHeader?.replace("Bearer ", "");
+
+      const clientIp = this.getClientIpAddress(req);
+      let authContext: AuthContext;
+      if (token) {
+        const payload = await this.verifyAuthToken(token);
+        if (!payload) {
+          return new Response("Invalid or expired token", { status: 401 });
+        }
+        authContext = this.tokenToAuthContext(payload, clientIp);
+      } else {
+        return new Response("Authorization token required", { status: 401 });
+      }
+
       const body = await req.json();
       const { query } = body;
 
@@ -99,9 +244,10 @@ class RTCHost implements RealTimeCommunicationAdapter {
 
       const { element, queryType, params } = query;
 
-      // Access the model and run the query
+      // Access the model and run the query with auth context
       const queryBuilder = this.context.queryBuilder(
         new QueryBuilderContext(new QueryCache(), this.dataStore),
+        authContext,
       ) as any;
 
       // Get the appropriate element from the queryBuilder
@@ -141,20 +287,23 @@ class RTCHost implements RealTimeCommunicationAdapter {
       fetch: async (req, server) => {
         const url = new URL(req.url);
 
-        // const authHeader = req.headers.get("Authorization");
-        // const token =
-        //   authHeader?.replace("Bearer ", "") || url.searchParams.get("token");
-        // console.log(url);
+        // Extract token from Authorization header or query parameter
+        const authHeader = req.headers.get("Authorization");
+        const token =
+          authHeader?.replace("Bearer ", "") || url.searchParams.get("token");
 
-        // if (!token) {
-        //   return new Response("Unauthorized", { status: 401 });
-        // }
+        // Verify token for protected endpoints
+        let payload = null;
+        if (token) {
+          payload = await this.verifyAuthToken(token);
 
-        // const payload = await this.verifyToken(token);
-        // if (!payload) {
-        //   return new Response("Invalid token", { status: 401 });
-        // }
-        const payload = null;
+          // For protected endpoints, require valid token
+          if (!payload && !this.isPublicEndpoint(url.pathname)) {
+            return new Response("Invalid or expired token", { status: 401 });
+          }
+        } else if (!this.isPublicEndpoint(url.pathname)) {
+          return new Response("Authorization token required", { status: 401 });
+        }
 
         // Handle different endpoints
         if (
@@ -174,7 +323,6 @@ class RTCHost implements RealTimeCommunicationAdapter {
         if (url.pathname.startsWith("/command/") && req.method === "POST") {
           return await this.handleCommand(req);
         }
-        console.log(url.pathname);
 
         if (url.pathname === "/query" && req.method === "POST") {
           return await this.handleQuery(req);
@@ -195,6 +343,28 @@ class RTCHost implements RealTimeCommunicationAdapter {
     });
   }
 
+  private isPublicEndpoint(pathname: string): boolean {
+    // Extract command name from pathname
+    if (!pathname.startsWith("/command/")) {
+      return false;
+    }
+
+    const commandName = pathname.split("/command/")[1];
+    if (!commandName) {
+      return false;
+    }
+
+    // Get the command from the context and check if it's marked as public
+    const contextElement = this.context.elements.find(
+      (element: any) => element.name === commandName,
+    );
+
+    // Check if it's an ArcCommand instance and if it's marked as public
+    return contextElement && "isPublic" in contextElement
+      ? contextElement.isPublic === true
+      : false;
+  }
+
   private async handleSync(lastDate: string | null) {
     const syncDate = new Date();
     const where = lastDate

package/package.json

@@ -4,7 +4,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "author": "Przemysław Krasiński [arcote.tech]",
   "dependencies": {