@contember/engine-server 1.1.1 → 1.2.0-alpha.10

package/src/project/ProjectContainerResolver.ts

@@ -21,20 +21,8 @@ export class ProjectContainerResolver {
 		private readonly tenantConfig: TenantConfig,
 	) {}
 
-	public async getAllProjectContainers(): Promise<ProjectContainer[]> {
-		const projects = await this.projectManager.getProjects(this.tenantDatabase)
-		return await Promise.all(
-			projects.map(async it => {
-				const container = await this.getProjectContainer(it.slug)
-				if (!container) {
-					throw new Error('should not happen')
-				}
-				return container
-			}),
-		)
-	}
 
-	public async getProjectContainer(slug: string, alias: boolean = false): Promise<ProjectContainer | undefined> {
+	public async getProjectContainer(slug: string, { alias = false, logger }: {alias?: boolean; logger?: Logger} = {}): Promise<ProjectContainer | undefined> {
 		const realSlug = this.projectContainers.resolveAlias(slug)
 		if (realSlug) {
 			slug = realSlug
@@ -55,14 +43,14 @@ export class ProjectContainerResolver {
 		if (!project) {
 			return undefined
 		}
-		const container = await this.createProjectContainer(project)
+		const container = await this.createProjectContainer(project, logger)
 		if (slug !== project.slug) {
 			this.projectContainers.setAlias(project.slug, slug)
 		}
 		return container
 	}
 
-	public async createProjectContainer(project: ProjectWithSecrets): Promise<ProjectContainer> {
+	public async createProjectContainer(project: ProjectWithSecrets, logger?: Logger): Promise<ProjectContainer> {
 		const projectConfig = this.projectConfigResolver(project.slug, project.config, project.secrets, this.tenantConfig)
 		return (await this.projectContainers.fetchContainer(project.slug, async slug => {
 			const projectContainer = this.projectContainerFactory.createContainer({
@@ -71,8 +59,7 @@ export class ProjectContainerResolver {
 			await this.systemProjectInitializer.initialize(
 				projectContainer.systemDatabaseContextFactory,
 				projectContainer.project,
-				// eslint-disable-next-line no-console
-				new Logger(console.log),
+				logger ?? new Logger(() => null),
 			)
 			const cleanups = this.onCreate.map(it => it(projectContainer) || (() => null))
 			return {

package/src/projectGroup/ProjectGroupContainer.ts

@@ -6,6 +6,8 @@ import {
 	Authenticator,
 	CryptoWrapper,
 	ProjectGroupContainer,
+	ProjectMembershipFetcher,
+	ProjectMembershipResolver,
 	Providers,
 	SystemGraphQLHandlerFactory,
 	TenantGraphQLHandlerFactory,
@@ -30,6 +32,7 @@ interface ProjectGroupContainerFactoryArgs
 
 export class ProjectGroupContainerFactory {
 	constructor(
+		private readonly debug: boolean,
 		private readonly providers: Providers,
 		private readonly systemContainerFactory: SystemContainerFactory,
 		private readonly tenantContainerFactory: TenantContainerFactory,
@@ -45,13 +48,15 @@ export class ProjectGroupContainerFactory {
 				slug)
 			.addService('providers', () =>
 				this.providers)
-			.addService('tenantConnection', (): Connection.ConnectionType =>
-				new Connection(config.db, {}))
+			.addService('tenantDbCredentials', () =>
+				config.db)
+			.addService('tenantConnection', ({ tenantDbCredentials }): Connection.ConnectionType =>
+				Connection.create(tenantDbCredentials))
 			.addService('projectSchemaResolver', () =>
 				new ProjectSchemaResolverProxy())
 			.addService('projectInitializer', () =>
 				new ProjectInitializerProxy())
-			.addService('tenantContainer', ({ tenantConnection, projectSchemaResolver, projectInitializer }) => {
+			.addService('tenantContainer', ({ tenantConnection, tenantDbCredentials, projectSchemaResolver, projectInitializer }) => {
 				const encryptionKey = config.secrets.encryptionKey
 					? createSecretKey(Buffer.from(config.secrets.encryptionKey, 'hex'))
 					: undefined
@@ -59,6 +64,7 @@ export class ProjectGroupContainerFactory {
 				const cryptoWrapper = new CryptoWrapper(encryptionKey)
 				return this.tenantContainerFactory.create({
 					connection: tenantConnection,
+					dbCredentials: tenantDbCredentials,
 					mailOptions: config.mailer,
 					tenantCredentials: config.credentials,
 					projectInitializer,
@@ -103,6 +109,8 @@ export class ProjectGroupContainerFactory {
 				this.systemGraphQLHandlerFactory.create(systemContainer.systemResolversFactory))
 			.addService('authenticator', ({ tenantDatabase, tenantContainer }) =>
 				new Authenticator(tenantDatabase, tenantContainer.apiKeyManager))
+			.addService('projectMembershipResolver', ({ tenantContainer }) =>
+				new ProjectMembershipResolver(this.debug, new ProjectMembershipFetcher(tenantContainer.projectMemberManager, tenantContainer.databaseContext)))
 			.build()
 			.pick(
 				'projectContainerResolver',
@@ -113,6 +121,7 @@ export class ProjectGroupContainerFactory {
 				'tenantContainer',
 				'tenantDatabase',
 				'authenticator',
+				'projectMembershipResolver',
 				'tenantGraphQLHandler',
 				'slug',
 			)

package/src/projectGroup/ProjectGroupResolver.ts

@@ -0,0 +1,12 @@
+import { ProjectGroupContainer, ProjectGroupResolver as ProjectGroupResolverInterface } from '@contember/engine-http'
+
+export class ProjectGroupResolver implements ProjectGroupResolverInterface {
+	constructor(
+		private readonly projectGroupContainer: ProjectGroupContainer,
+	) {
+	}
+
+	resolveContainer(): Promise<ProjectGroupContainer> {
+		return Promise.resolve(this.projectGroupContainer)
+	}
+}

package/src/start.ts

@@ -1,85 +1,28 @@
 #!/usr/bin/env node
 
-import { createContainer, readConfig } from './index'
-import { Server } from 'net'
+import { createContainer, listenOnProcessTermination, serverConfigSchema, TerminationJob } from './index'
 import loadPlugins from './loadPlugins'
-import { ConfigProcessor } from '@contember/engine-plugins'
-import { join } from 'path'
-import os from 'os'
-import cluster from 'cluster'
-import { getClusterProcessType, initSentry, notifyWorkerStarted, timeout, waitForWorker } from './utils'
-import { ConfigSource } from './config/config'
+import { initSentry } from './utils'
 
-const createServerTerminator = (): Server[] => {
-	const signals = [
-		['SIGHUP', 1],
-		['SIGINT', 2],
-		['SIGTERM', 15],
-	] as const
 
-	let servers: Server[] = []
-	for (const [signal, code] of signals) {
-		process.on(signal, async () => {
-			// eslint-disable-next-line no-console
-			console.log(`process received a ${signal} signal`)
-			for (const server of servers) {
-				await new Promise(resolve => server.close(() => resolve(null)))
-			}
-			process.exit(128 + code)
-		})
-	}
-	return servers
-}
+import { getServerVersion, isDebugMode, printStartInfo, resolveServerConfig } from './utils/serverStartup'
 
-;(async () => {
+(async () => {
 	if (process.env.NODE_HEAPDUMP === 'true') {
 		// eslint-disable-next-line no-console
 		console.log('Initializing heapdump')
 		await import('heapdump')
 	}
-	const isDebug = process.env.NODE_ENV === 'development'
-	const packageJsonFile = process.env.CONTEMBER_PACKAGE_JSON || join(__dirname, '../../package.json')
-	// eslint-disable-next-line @typescript-eslint/no-var-requires
-	const version = require(packageJsonFile).version
-
-	if (cluster.isMaster) {
-		// eslint-disable-next-line no-console
-		console.log(`Starting Contember ${version}`)
-		// eslint-disable-next-line no-console
-		console.log(`NODE_ENV is set to ${process.env.NODE_ENV}`)
-		if (isDebug) {
-			// eslint-disable-next-line no-console
-			console.log('Starting Contember in debug mode')
-			// eslint-disable-next-line no-console
-			console.log('NEVER USE debug mode in production environment')
-		}
-	}
+	const terminationJobs: TerminationJob[] = []
+	listenOnProcessTermination(terminationJobs)
 
+	const isDebug = isDebugMode()
+	const version = getServerVersion()
+	printStartInfo({ version, isDebug })
 	const plugins = await loadPlugins()
-	const configProcessors = plugins
-		.map(it => (it.getConfigProcessor ? it.getConfigProcessor() : null))
-		.filter((it): it is ConfigProcessor => it !== null)
-
-	const configSources: ConfigSource[] = []
-	for (const configType of ['file', 'yaml', 'json'] as const) {
-		const envValue = process.env['CONTEMBER_CONFIG_' + configType.toUpperCase()]
-		if (envValue) {
-			configSources.push({ type: configType, data: envValue })
-		}
-	}
-
-	const { serverConfig, projectConfigResolver, tenantConfigResolver } = await readConfig(configSources, configProcessors)
-
-	if (process.argv[2] === 'validate') {
-		process.exit(0)
-	}
-	'sentry' in serverConfig.logging && initSentry(serverConfig.logging.sentry?.dsn)
-	const workerConfig = serverConfig.workerCount || 1
+	const { serverConfig, projectConfigResolver, tenantConfigResolver } = await resolveServerConfig({ plugins, serverConfigSchema })
 
-	const workerCount = workerConfig === 'auto' ? os.cpus().length : Number(workerConfig)
-	const isClusterMode = workerCount > 1
-
-	const processType = getClusterProcessType(isClusterMode)
+	initSentry(serverConfig.logging.sentry?.dsn)
 
 	const container = createContainer({
 		debugMode: isDebug,
@@ -87,70 +30,18 @@ const createServerTerminator = (): Server[] => {
 		projectConfigResolver,
 		tenantConfigResolver,
 		plugins,
-		processType,
 		version,
 	})
 
-	let initializedProjects: string[] = []
-	if (cluster.isMaster) {
-		const monitoringPort = serverConfig.monitoringPort
-		const terminator = createServerTerminator()
-		terminator.push(
-			container.monitoringKoa.listen(monitoringPort, () => {
-				// eslint-disable-next-line no-console
-				console.log(`Monitoring running on http://localhost:${monitoringPort}`)
-			}),
-		)
-		if (!serverConfig.projectGroup) {
-			initializedProjects = await container.initializer.initialize()
-		}
-	}
+	const initializedProjects: string[] = await container.initializer.initialize()
 
-	const port = serverConfig.port
-	const printStarted = () => {
-		if (serverConfig.projectGroup) {
-			// eslint-disable-next-line no-console
-			console.log('Contember Cloud running')
-		} else {
-			// eslint-disable-next-line no-console
-			console.log(`Contember API running on http://localhost:${port}`)
-			// eslint-disable-next-line no-console
-			console.log(initializedProjects.length ? `Initialized projects: ${initializedProjects.join(', ')}` : 'No project initialized')
-		}
-	}
-
-	if (isClusterMode && cluster.isMaster) {
+	const httpServer = container.koa.listen(serverConfig.port, () => {
 		// eslint-disable-next-line no-console
-		console.log(`Master ${process.pid} is running`)
-		for (let i = 0; i < workerCount; i++) {
-			cluster.fork()
-			await waitForWorker(15000)
-		}
-		printStarted()
-
-		cluster.on('exit', async (worker, code, signal) => {
-			// eslint-disable-next-line no-console
-			console.log(`Worker ${worker.process.pid} died with signal ${signal}, restarting`)
-			await timeout(2000)
-			cluster.fork()
-		})
-	} else {
-		if (isClusterMode) {
-			// eslint-disable-next-line no-console
-			console.log(`Starting worker ${process.pid}`)
-		}
-		const serverTerminator = createServerTerminator()
-
-		serverTerminator.push(
-			container.koa.listen(port, () => {
-				if (!isClusterMode) {
-					printStarted()
-				} else {
-					notifyWorkerStarted()
-				}
-			}),
-		)
-	}
+		console.log(`Contember API running on http://localhost:${(serverConfig.port)}`)
+		// eslint-disable-next-line no-console
+		console.log(initializedProjects.length ? `Initialized projects: ${initializedProjects.join(', ')}` : 'No project initialized')
+	})
+	terminationJobs.push(() => new Promise<any>(resolve => httpServer.close(resolve)))
 })().catch(e => {
 	// eslint-disable-next-line no-console
 	console.log(e)

package/src/utils/index.ts

@@ -1,6 +1,2 @@
-export * from './cluster'
-export * from './dbMetrics'
 export * from './sentry'
 export * from './strings'
-export * from './timeout'
-export * from './tuple'

package/src/utils/sentry.ts

@@ -28,7 +28,7 @@ export const logSentryError = (error: any, context: SentryErrorContext) => {
 			scope.setTag('project', context.project)
 		}
 		scope.setTag('module', context.module)
-		scope.setLevel(Sentry.Severity.Error)
+		scope.setLevel('error')
 		scope.setUser({
 			id: context.user,
 		})

package/src/utils/serverStartup.ts

@@ -0,0 +1,42 @@
+import { join } from 'path'
+import { ConfigProcessor, Plugin } from '@contember/engine-plugins'
+import { ConfigSource, readConfig, ServerConfig } from '../config/config'
+import { Type } from '@contember/typesafe'
+
+export const getServerVersion = (): string => {
+	const packageJsonFile = process.env.CONTEMBER_PACKAGE_JSON || join(__dirname, '../../../package.json')
+	// eslint-disable-next-line @typescript-eslint/no-var-requires
+	const version = require(packageJsonFile).version
+	return version
+}
+
+export const isDebugMode = (): boolean => process.env.NODE_ENV === 'development'
+
+export const printStartInfo = ({ version, isDebug }: { version: string; isDebug: boolean }) => {
+	// eslint-disable-next-line no-console
+	console.log(`Starting Contember ${version}`)
+	// eslint-disable-next-line no-console
+	console.log(`NODE_ENV is set to ${process.env.NODE_ENV}`)
+	if (isDebug) {
+		// eslint-disable-next-line no-console
+		console.log('Starting Contember in debug mode')
+		// eslint-disable-next-line no-console
+		console.log('NEVER USE debug mode in production environment')
+	}
+}
+
+export const resolveServerConfig = async <T extends ServerConfig>({ plugins, serverConfigSchema }: { plugins: Plugin[]; serverConfigSchema: Type<T> }) => {
+	const configProcessors = plugins
+		.map(it => (it.getConfigProcessor ? it.getConfigProcessor() : null))
+		.filter((it): it is ConfigProcessor => it !== null)
+
+	const configSources: ConfigSource[] = []
+	for (const configType of ['file', 'yaml', 'json'] as const) {
+		const envValue = process.env['CONTEMBER_CONFIG_' + configType.toUpperCase()]
+		if (envValue) {
+			configSources.push({ type: configType, data: envValue })
+		}
+	}
+
+	return await readConfig(configSources, configProcessors, serverConfigSchema)
+}

package/src/utils/serverTermination.ts

@@ -0,0 +1,20 @@
+import cluster from 'cluster'
+
+const signals = {
+	SIGHUP: 1,
+	SIGINT: 2,
+	SIGTERM: 15,
+}
+export type TerminationJob = (args: { signal: keyof typeof signals; code: number }) => Promise<void>
+export const listenOnProcessTermination = (jobs: TerminationJob[]) => {
+	for (const [signal, code] of Object.entries(signals)) {
+		process.on(signal, async () => {
+			// eslint-disable-next-line no-console
+			console.log(`Process ${process.pid} received a ${signal} signal, executing ${jobs.length} termination jobs`)
+			await Promise.allSettled(jobs.map(it => it({ signal: signal as keyof typeof signals, code })))
+			// eslint-disable-next-line no-console
+			console.log(cluster.isMaster ? `All terminated, exiting` : 'All terminated, exiting a worker')
+			process.exit(128 + code)
+		})
+	}
+}

package/tests/e2e/acl-condition-variable.test.ts

@@ -0,0 +1,74 @@
+import { assert, test } from 'vitest'
+import { createTester, gql } from '../src/tester'
+import { createSchema, SchemaDefinition as def, AclDefinition as acl } from '@contember/schema-definition'
+import { addProjectMember, signIn, signUp } from '../src/requests'
+
+namespace ArticleModel {
+	export const readerRole = acl.createRole('reader')
+	export const subscriptionVariable = acl.createConditionVariable('subscription', readerRole)
+
+	@acl.allow(readerRole, {
+		read: true,
+		when: {
+			publishedAt: subscriptionVariable,
+		},
+	})
+	export class Article {
+		publishedAt = def.dateTimeColumn().notNull()
+	}
+}
+
+test('ACL: condition variable', async () => {
+	const tester = await createTester(createSchema(ArticleModel))
+
+	await tester(
+		gql`
+			mutation {
+				articleA: createArticle(data: { publishedAt: "2022-02-01" }) {
+					ok
+				}
+				articleB: createArticle(data: { publishedAt: "2021-12-01" }) {
+					ok
+				}
+			}
+		`,
+	)
+		.expect(response => {
+			assert.deepStrictEqual(response.body.data, {
+				articleA: {
+					ok: true,
+				},
+				articleB: {
+					ok: true,
+				},
+			})
+		})
+		.expect(200)
+
+
+	const email = `john+${Date.now()}@doe.com`
+	const identityId = await signUp(email)
+	const authKey = await signIn(email)
+	await addProjectMember(identityId, tester.projectSlug, { role: 'reader', variables: [{ name: 'subscription', values: [JSON.stringify({ gte: '2022-01-01' })] }] })
+
+	await tester(
+		gql`
+			query {
+				listArticle {
+					publishedAt
+				}
+			}
+		`,
+		{ authorizationToken: authKey },
+	)
+		.expect(response => {
+			assert.deepStrictEqual(response.body.data, {
+				listArticle: [
+					{
+						publishedAt: '2022-02-01T00:00:00.000Z',
+					},
+				],
+			})
+		})
+		.expect(200)
+})

package/tests/e2e/assume-identity.test.ts

@@ -0,0 +1,127 @@
+import { test } from 'vitest'
+import { createTester, gql } from '../src/tester'
+import { addProjectMember, signIn, signUp } from '../src/requests'
+import { createSchema, SchemaDefinition as def } from '@contember/schema-definition'
+import { AllowAllPermissionFactory } from '@contember/schema-utils'
+
+namespace TagModel {
+	export class Tag {
+		label = def.stringColumn()
+	}
+}
+
+
+test('Content API: assume identity', async () => {
+	const tester = await createTester(createSchema(TagModel, schema => {
+		return {
+			...schema,
+			acl: {
+				roles: {
+					test: {
+						entities: new AllowAllPermissionFactory().create(schema.model),
+						variables: {},
+						system: {
+							history: true,
+							assumeIdentity: true,
+						},
+					},
+				},
+			},
+		}
+	}))
+
+	const email = `john+${Date.now()}@doe.com`
+	const identityId = await signUp(email)
+	const authKey = await signIn(email)
+	await addProjectMember(identityId, tester.projectSlug, { role: 'test', variables: [] })
+
+	const assumedIdentityId = '65e049e7-4b22-487a-a93b-528b3127d967'
+	await tester(
+		gql`
+			mutation {
+				createTag(data: {label: "foo bar"}) {
+					ok
+				}
+			}
+		`,
+		{ authorizationToken: authKey },
+	)
+		.set('X-Contember-assume-identity', assumedIdentityId)
+		.expect(200)
+
+
+	await tester(
+		gql`
+			query {
+				events {
+					tableName
+					identityId
+				}
+			}
+		`,
+		{ authorizationToken: authKey, path: `/system/${tester.projectSlug}` },
+	)
+		.expect({ data: { events: [{ tableName: 'tag', identityId: assumedIdentityId }] } })
+		.expect(200)
+})
+
+
+test('Content API: assume identity is declined', async () => {
+	const tester = await createTester(createSchema(TagModel, schema => {
+		return {
+			...schema,
+			acl: {
+				roles: {
+					foo: {
+						entities: {},
+						variables: {},
+						system: {
+							assumeIdentity: true,
+						},
+					},
+					test: {
+						entities: new AllowAllPermissionFactory().create(schema.model),
+						variables: {},
+						system: {
+							history: true,
+						},
+					},
+				},
+			},
+		}
+	}))
+
+	const email = `john+${Date.now()}@doe.com`
+	const identityId = await signUp(email)
+	const authKey = await signIn(email)
+	await addProjectMember(identityId, tester.projectSlug, { role: 'test', variables: [] })
+
+	const assumedIdentityId = '65e049e7-4b22-487a-a93b-528b3127d967'
+	await tester(
+		gql`
+			mutation {
+				createTag(data: {label: "foo bar"}) {
+					ok
+				}
+			}
+		`,
+		{ authorizationToken: authKey },
+	)
+		.set('X-Contember-assume-identity', assumedIdentityId)
+		.expect(200)
+
+
+	await tester(
+		gql`
+			query {
+				events {
+					tableName
+					identityId
+				}
+			}
+		`,
+		{ authorizationToken: authKey, path: `/system/${tester.projectSlug}` },
+	)
+		.expect({ data: { events: [{ tableName: 'tag', identityId }] } })
+		.expect(200)
+})

package/tests/e2e/assume-membership.test.ts

@@ -0,0 +1,64 @@
+import { test } from 'vitest'
+import { createTester, gql } from '../src/tester'
+import { addProjectMember, signIn, signUp } from '../src/requests'
+import { createSchema, SchemaDefinition as def } from '@contember/schema-definition'
+
+namespace TagModel {
+	export class Tag {
+		label = def.stringColumn()
+	}
+}
+
+
+test('Content API: assume membership', async () => {
+	const tester = await createTester(createSchema(TagModel, schema => {
+		return {
+			...schema,
+			acl: {
+				roles: {
+					test: {
+						entities: {},
+						variables: {},
+						content: {
+							assumeMembership: {
+								admin: {},
+							},
+						},
+					},
+				},
+			},
+		}
+	}))
+
+	const email = `john+${Date.now()}@doe.com`
+	const identityId = await signUp(email)
+	const authKey = await signIn(email)
+	await addProjectMember(identityId, tester.projectSlug, { role: 'test', variables: [] })
+
+	await tester(
+		gql`
+			query {
+				listTag {
+					id
+				}
+			}
+		`,
+		{ authorizationToken: authKey },
+	)
+		.expect(400)
+
+
+	await tester(
+		gql`
+			query {
+				listTag {
+					id
+				}
+			}
+		`,
+		{ authorizationToken: authKey },
+	)
+		.set('X-Contember-assume-membership', JSON.stringify({ memberships: [{ role: 'admin', variables: [] }] }))
+		.expect({ data: { listTag: [] } })
+		.expect(200)
+})

package/tests/e2e/content-api-basic.test.ts

@@ -0,0 +1,51 @@
+import { assert, test } from 'vitest'
+import { createTester, gql } from '../src/tester'
+import { createSchema, SchemaDefinition as def } from '@contember/schema-definition'
+
+namespace TagModel {
+	export class Tag {
+		label = def.stringColumn()
+	}
+}
+
+test('Content API: create & read tag', async () => {
+	const tester = await createTester(createSchema(TagModel))
+
+	await tester(
+		gql`
+			mutation {
+				createTag(data: { label: "graphql" }) {
+					ok
+				}
+			}
+		`,
+	)
+		.expect(response => {
+			assert.deepStrictEqual(response.body.data, {
+				createTag: {
+					ok: true,
+				},
+			})
+		})
+		.expect(200)
+
+	await tester(
+		gql`
+			query {
+				listTag(filter: { label: { eq: "graphql" } }) {
+					label
+				}
+			}
+		`,
+	)
+		.expect(response => {
+			assert.deepStrictEqual(response.body.data, {
+				listTag: [
+					{
+						label: 'graphql',
+					},
+				],
+			})
+		})
+		.expect(200)
+})