@develit-io/backend-sdk 9.3.0 → 9.4.0

package/dist/index.d.mts

@@ -447,11 +447,14 @@ interface CommandItem<TAuditAction = string> {
 interface IdempotencyContextVariables {
     key: string;
 }
-interface UserContextVariables {
-    email: string;
-    role: string;
-    organizationId: string;
-}
+type IdentityContextVariables = {
+    user: {
+        id: string;
+        email: string;
+        role: string;
+        rawUserMetaData: string | null;
+    };
+};
 
 /**
  * Utility type to infer possible relation includes (`with`) for a given table.
@@ -844,4 +847,4 @@ type AsyncMethod<TArgs extends unknown[] = unknown[], TResult = unknown> = (...a
 declare function cloudflareQueue<TArgs extends unknown[] = unknown[], TResult = unknown>(options: WithRetryCounterOptions): (target: unknown, propertyKey: string | symbol, descriptor: TypedPropertyDescriptor<AsyncMethod<TArgs, TResult>>) => void;
 
 export { DatabaseTransaction, ENVIRONMENT, RPCResponse, USER_ROLES, action, asNonEmpty, bankAccount, bankAccountMetadataSchema, base, bicSchema, buildMultiFilterConditions, buildRangeFilterConditions, buildSearchConditions, calculateExponentialBackoff, cloudflareQueue, composeWranglerBase, createAuditLogWriter, createInternalError, defineCommand, derivePortFromId, develitWorker, durableObjectNamespaceIdFromName, first, firstOrError, getD1Credentials, getD1DatabaseIdFromWrangler, getDrizzleD1Config, getSecret, handleAction, ibanSchema, isInternalError, nullToOptional, optionalToNull, paginationQuerySchema, paginationSchema, resolveColumn, service, useFetch, useResult, useResultSync, uuidv4, workflowInstanceStatusSchema };
-export type { ActionExecution, ActionHandlerOptions, AuditLogWriter, BankAccountMetadata, BaseEvent, BuildSearchOptions, Command, CommandLogPayload, DevelitWorkerMethods, Environment, GatewayResponse, IRPCResponse, IdempotencyContextVariables, IncludeRelation, InferResultType, InternalError, InternalErrorResponseStatus, Project, RequestLog, ResponseLog, UserContextVariables, UserRole, ValidatedInput, WorkflowInstanceStatus };
+export type { ActionExecution, ActionHandlerOptions, AuditLogWriter, BankAccountMetadata, BaseEvent, BuildSearchOptions, Command, CommandLogPayload, DevelitWorkerMethods, Environment, GatewayResponse, IRPCResponse, IdempotencyContextVariables, IdentityContextVariables, IncludeRelation, InferResultType, InternalError, InternalErrorResponseStatus, Project, RequestLog, ResponseLog, UserRole, ValidatedInput, WorkflowInstanceStatus };

package/dist/index.d.ts

@@ -447,11 +447,14 @@ interface CommandItem<TAuditAction = string> {
 interface IdempotencyContextVariables {
     key: string;
 }
-interface UserContextVariables {
-    email: string;
-    role: string;
-    organizationId: string;
-}
+type IdentityContextVariables = {
+    user: {
+        id: string;
+        email: string;
+        role: string;
+        rawUserMetaData: string | null;
+    };
+};
 
 /**
  * Utility type to infer possible relation includes (`with`) for a given table.
@@ -844,4 +847,4 @@ type AsyncMethod<TArgs extends unknown[] = unknown[], TResult = unknown> = (...a
 declare function cloudflareQueue<TArgs extends unknown[] = unknown[], TResult = unknown>(options: WithRetryCounterOptions): (target: unknown, propertyKey: string | symbol, descriptor: TypedPropertyDescriptor<AsyncMethod<TArgs, TResult>>) => void;
 
 export { DatabaseTransaction, ENVIRONMENT, RPCResponse, USER_ROLES, action, asNonEmpty, bankAccount, bankAccountMetadataSchema, base, bicSchema, buildMultiFilterConditions, buildRangeFilterConditions, buildSearchConditions, calculateExponentialBackoff, cloudflareQueue, composeWranglerBase, createAuditLogWriter, createInternalError, defineCommand, derivePortFromId, develitWorker, durableObjectNamespaceIdFromName, first, firstOrError, getD1Credentials, getD1DatabaseIdFromWrangler, getDrizzleD1Config, getSecret, handleAction, ibanSchema, isInternalError, nullToOptional, optionalToNull, paginationQuerySchema, paginationSchema, resolveColumn, service, useFetch, useResult, useResultSync, uuidv4, workflowInstanceStatusSchema };
-export type { ActionExecution, ActionHandlerOptions, AuditLogWriter, BankAccountMetadata, BaseEvent, BuildSearchOptions, Command, CommandLogPayload, DevelitWorkerMethods, Environment, GatewayResponse, IRPCResponse, IdempotencyContextVariables, IncludeRelation, InferResultType, InternalError, InternalErrorResponseStatus, Project, RequestLog, ResponseLog, UserContextVariables, UserRole, ValidatedInput, WorkflowInstanceStatus };
+export type { ActionExecution, ActionHandlerOptions, AuditLogWriter, BankAccountMetadata, BaseEvent, BuildSearchOptions, Command, CommandLogPayload, DevelitWorkerMethods, Environment, GatewayResponse, IRPCResponse, IdempotencyContextVariables, IdentityContextVariables, IncludeRelation, InferResultType, InternalError, InternalErrorResponseStatus, Project, RequestLog, ResponseLog, UserRole, ValidatedInput, WorkflowInstanceStatus };

package/dist/middlewares.d.mts

@@ -1,5 +1,16 @@
 import { MiddlewareHandler } from 'hono/types';
 
+interface AccessMiddlewareOptions {
+    errorMessage?: string;
+}
+interface AccessRequest<TScope extends string = string> {
+    scope: TScope;
+    resourceId?: string;
+    resourcePath?: string;
+}
+type AccessRequestResolver<TScope extends string = string> = AccessRequest<TScope>[] | ((context: unknown) => AccessRequest<TScope>[]);
+declare const access: <TScope extends string = string>(accessRequests: AccessRequestResolver<TScope>, options?: AccessMiddlewareOptions) => MiddlewareHandler;
+
 declare const idempotency: () => MiddlewareHandler;
 
 declare const jwt: () => MiddlewareHandler;
@@ -10,4 +21,4 @@ declare const logger: () => MiddlewareHandler;
 
 declare const signature: () => MiddlewareHandler;
 
-export { idempotency, ip, jwt, logger, signature };
+export { access, idempotency, ip, jwt, logger, signature };

package/dist/middlewares.d.ts

@@ -1,5 +1,16 @@
 import { MiddlewareHandler } from 'hono/types';
 
+interface AccessMiddlewareOptions {
+    errorMessage?: string;
+}
+interface AccessRequest<TScope extends string = string> {
+    scope: TScope;
+    resourceId?: string;
+    resourcePath?: string;
+}
+type AccessRequestResolver<TScope extends string = string> = AccessRequest<TScope>[] | ((context: unknown) => AccessRequest<TScope>[]);
+declare const access: <TScope extends string = string>(accessRequests: AccessRequestResolver<TScope>, options?: AccessMiddlewareOptions) => MiddlewareHandler;
+
 declare const idempotency: () => MiddlewareHandler;
 
 declare const jwt: () => MiddlewareHandler;
@@ -10,4 +21,4 @@ declare const logger: () => MiddlewareHandler;
 
 declare const signature: () => MiddlewareHandler;
 
-export { idempotency, ip, jwt, logger, signature };
+export { access, idempotency, ip, jwt, logger, signature };

package/dist/middlewares.mjs

@@ -33,6 +33,26 @@ const getRequestUserAgent = (request) => {
   return request.header("user-agent") || "UNKNOWN";
 };
 
+const access = (accessRequests, options = {}) => {
+  return createMiddleware(async (context, next) => {
+    if (!context.env.MIDDLEWARE_ACCESS_DISABLED) {
+      const identity = context.get("identity");
+      const requests = typeof accessRequests === "function" ? accessRequests(context) : accessRequests;
+      const { data: verifyData, error: verifyError } = await context.env.RBAC_SERVICE.verifyAccess({
+        userId: identity.user.id,
+        accessRequests: requests,
+        jwt: identity
+      });
+      if (verifyError || !verifyData?.isVerified) {
+        throw new HTTPException(404, {
+          message: options.errorMessage || "Forbidden"
+        });
+      }
+    }
+    await next();
+  });
+};
+
 const idempotency = () => {
   return createMiddleware(async (context, next) => {
     if (!context.env.MIDDLEWARE_IDEMPOTENCY_DISABLED) {
@@ -94,17 +114,13 @@ const jwt = () => {
       }
       const rawUserMetaDataString = data.payload.user.rawUserMetaData;
       const rawUserMetaData = rawUserMetaDataString ? JSON.parse(rawUserMetaDataString) : null;
-      const organizationId = rawUserMetaData?.organizationId ?? null;
-      if (!organizationId) {
+      const identityId = rawUserMetaData.organizationId ?? rawUserMetaData.exchangeOfficeId;
+      if (!identityId) {
         throw new HTTPException(422, {
           message: "User data integrity check failed."
         });
       }
-      context.set("user", {
-        email: data.payload.user.email,
-        role: data.payload.user.role,
-        organizationId
-      });
+      context.set("identity", data.payload);
     }
     await next();
   });
@@ -114,14 +130,17 @@ const ip = () => {
   return createMiddleware(async (context, next) => {
     if (!context.env.MIDDLEWARE_IP_DISABLED) {
       const requestIp = getRequestIpAddress(context.req);
-      const user = context.get("user");
-      if (!user.organizationId) {
+      const identityContext = context.get("identity");
+      const rawUserMetaDataString = identityContext.user.rawUserMetaData;
+      const rawUserMetaData = rawUserMetaDataString ? JSON.parse(rawUserMetaDataString) : null;
+      const organizationId = rawUserMetaData.organizationId;
+      if (!organizationId) {
         throw new HTTPException(401, {
           message: "Failed to retrieve request organization ID."
         });
       }
       const { data: organization, error } = await context.env.ORGANIZATION_SERVICE.getOrganization({
-        organizationId: user.organizationId
+        organizationId
       });
       if (!organization || error) {
         throw new HTTPException(404, {
@@ -166,7 +185,15 @@ const logger = () => {
       const requestLog = await composeRequestLog(context.req);
       logRequest(requestLog);
       if (!context.env.MIDDLEWARE_LOGGER_AUDITLOG_DISABLED) {
-        const userContext = context.get("user");
+        const identityContext = context.get("identity");
+        const rawUserMetaDataString = identityContext.user.rawUserMetaData;
+        const rawUserMetaData = rawUserMetaDataString ? JSON.parse(rawUserMetaDataString) : null;
+        const identityId = rawUserMetaData.organizationId ?? rawUserMetaData.exchangeOfficeId;
+        if (!identityId) {
+          throw new HTTPException(422, {
+            message: "User data integrity check failed."
+          });
+        }
         const requestId = uuidv4();
         context.set("auditLog", {
           requestId
@@ -176,8 +203,12 @@ const logger = () => {
           method: requestLog.method,
           path: requestLog.path,
           actor: {
-            email: userContext?.email || "NOT_AUTHORIZED",
-            organizationId: userContext?.organizationId || "NOT_AUTHORIZED"
+            email: identityContext.user.email || "NOT_AUTHORIZED",
+            ...rawUserMetaData.organizationId ? {
+              organizationId: rawUserMetaData.organizationId || "NOT_AUTHORIZED"
+            } : rawUserMetaData.organizationId ? {
+              exchangeOfficeId: rawUserMetaData.exchangeOfficeId || "NOT_AUTHORIZED"
+            } : null
           },
           metadata: {
             ip: getRequestIpAddress(context.req),
@@ -198,15 +229,27 @@ const logger = () => {
       );
       logResponse(responseLog);
       if (!context.env.MIDDLEWARE_LOGGER_AUDITLOG_DISABLED) {
-        const userContext = context.get("user");
+        const identityContext = context.get("identity");
+        const rawUserMetaDataString = identityContext.user.rawUserMetaData;
+        const rawUserMetaData = rawUserMetaDataString ? JSON.parse(rawUserMetaDataString) : null;
+        const identityId = rawUserMetaData.organizationId ?? rawUserMetaData.exchangeOfficeId;
+        if (!identityId) {
+          throw new HTTPException(422, {
+            message: "User data integrity check failed."
+          });
+        }
         const auditLogContext = context.get("auditLog");
         await context.env.AUDITLOG_SERVICE.processLog({
           type: "RESPONSE",
           method: responseLog.method,
           path: responseLog.path,
           actor: {
-            email: userContext?.email || "NOT_AUTHORIZED",
-            organizationId: userContext?.organizationId || "NOT_AUTHORIZED"
+            email: identityContext.user.email || "NOT_AUTHORIZED",
+            ...rawUserMetaData.organizationId ? {
+              organizationId: rawUserMetaData.organizationId || "NOT_AUTHORIZED"
+            } : rawUserMetaData.organizationId ? {
+              exchangeOfficeId: rawUserMetaData.exchangeOfficeId || "NOT_AUTHORIZED"
+            } : null
           },
           metadata: {
             ip: getRequestIpAddress(context.req),
@@ -236,14 +279,17 @@ const signature = () => {
         });
       }
       const payload = JSON.stringify(await context.req.json().catch(() => null));
-      const user = context.get("user");
-      if (!user.organizationId) {
+      const identityContext = context.get("identity");
+      const rawUserMetaDataString = identityContext.user.rawUserMetaData;
+      const rawUserMetaData = rawUserMetaDataString ? JSON.parse(rawUserMetaDataString) : null;
+      const identityId = rawUserMetaData.organizationId ?? rawUserMetaData.exchangeOfficeId;
+      if (!identityId) {
         throw new HTTPException(401, {
-          message: "Failed to retrieve request organization ID."
+          message: "Failed to retrieve request identity ID."
         });
       }
       const { data: organization, error } = await context.env.ORGANIZATION_SERVICE.getOrganization({
-        organizationId: user.organizationId
+        organizationId: identityId
       });
       if (!organization || error) {
         throw new HTTPException(404, {
@@ -273,4 +319,4 @@ const signature = () => {
   });
 };
 
-export { idempotency, ip, jwt, logger, signature };
+export { access, idempotency, ip, jwt, logger, signature };

package/dist/utils/signature.util.d.mts

@@ -1,11 +1,12 @@
-declare const createSignatureKeyPair: () => Promise<{
-    publicKey: string;
-    privateKey: string;
-}>;
 declare const signPayload: ({ payload, privateKey, }: {
     payload: string;
     privateKey: string;
 }) => Promise<string>;
+
+declare const createSignatureKeyPair: () => Promise<{
+    publicKey: string;
+    privateKey: string;
+}>;
 declare const algParams: {
     [key: string]: {
         name: string;

package/dist/utils/signature.util.d.ts

@@ -1,11 +1,12 @@
-declare const createSignatureKeyPair: () => Promise<{
-    publicKey: string;
-    privateKey: string;
-}>;
 declare const signPayload: ({ payload, privateKey, }: {
     payload: string;
     privateKey: string;
 }) => Promise<string>;
+
+declare const createSignatureKeyPair: () => Promise<{
+    publicKey: string;
+    privateKey: string;
+}>;
 declare const algParams: {
     [key: string]: {
         name: string;

package/dist/utils/signature.util.mjs

@@ -1,21 +1,3 @@
-const createSignatureKeyPair = async () => {
-  const { publicKey, privateKey } = await crypto.subtle.generateKey(
-    {
-      name: "RSASSA-PKCS1-v1_5",
-      modulusLength: 4096,
-      publicExponent: new Uint8Array([1, 0, 1]),
-      hash: "SHA-256"
-    },
-    true,
-    ["sign", "verify"]
-  );
-  const exportedPublicKey = await crypto.subtle.exportKey("spki", publicKey);
-  const exportedPrivateKey = await crypto.subtle.exportKey("pkcs8", privateKey);
-  return {
-    publicKey: Buffer.from(exportedPublicKey).toString("base64"),
-    privateKey: Buffer.from(exportedPrivateKey).toString("base64")
-  };
-};
 const signPayload = async ({
   payload,
   privateKey
@@ -47,6 +29,25 @@ const signPayload = async ({
   );
   return base64Signature;
 };
+
+const createSignatureKeyPair = async () => {
+  const { publicKey, privateKey } = await crypto.subtle.generateKey(
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      modulusLength: 4096,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: "SHA-256"
+    },
+    true,
+    ["sign", "verify"]
+  );
+  const exportedPublicKey = await crypto.subtle.exportKey("spki", publicKey);
+  const exportedPrivateKey = await crypto.subtle.exportKey("pkcs8", privateKey);
+  return {
+    publicKey: Buffer.from(exportedPublicKey).toString("base64"),
+    privateKey: Buffer.from(exportedPrivateKey).toString("base64")
+  };
+};
 const algParams = {
   RSA: {
     name: "RSASSA-PKCS1-v1_5",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@develit-io/backend-sdk",
-  "version": "9.3.0",
+  "version": "9.4.0",
   "description": "Develit Backend SDK",
   "author": "Develit.io",
   "license": "ISC",