@devopsplaybook.io/common-utils 1.10.1-beta.23.b1906d7 → 1.11.0-beta.24.d8f9aef

package/src/users/UsersData.ts

@@ -1,141 +0,0 @@
-import { StandardTracer } from "@devopsplaybook.io/otel-utils";
-import { Span } from "@opentelemetry/sdk-trace-base";
-import { DbUtilsExecSQL, DbUtilsQuerySQL } from "../DbUtils";
-import { User } from "./User";
-
-let tracer: StandardTracer;
-
-/**
- * Injects the OTel tracer instance used by the users data module.
- * Must be called once at startup, before any `UsersData*` function.
- */
-export function UsersDataSetOTel(tracerIn: StandardTracer): void {
-  tracer = tracerIn;
-}
-
-export async function UsersDataGet(
-  context: Span | undefined,
-  id: string,
-): Promise<User | null> {
-  const span = tracer.startSpan("UsersDataGet", context);
-  const usersRaw = await DbUtilsQuerySQL(span, SQL_QUERIES.GET_USER_BY_ID, [
-    id,
-  ]);
-  let user: User | null = null;
-  if (usersRaw.length > 0) {
-    user = fromRaw(usersRaw[0]);
-  }
-  span.end();
-  return user;
-}
-
-export async function UsersDataGetByName(
-  context: Span | undefined,
-  name: string,
-): Promise<User | null> {
-  const span = tracer.startSpan("UsersDataGetByName", context);
-  const usersRaw = await DbUtilsQuerySQL(span, SQL_QUERIES.GET_USER_BY_NAME, [
-    name,
-  ]);
-  let user: User | null = null;
-  if (usersRaw.length > 0) {
-    user = fromRaw(usersRaw[0]);
-  }
-  span.end();
-  return user;
-}
-
-export async function UsersDataList(
-  context: Span | undefined,
-): Promise<User[]> {
-  const span = tracer.startSpan("UsersDataList", context);
-  const usersRaw = await DbUtilsQuerySQL(span, SQL_QUERIES.LIST_USERS);
-  const users: User[] = [];
-  for (const userRaw of usersRaw) {
-    users.push(fromRaw(userRaw));
-  }
-  span.end();
-  return users;
-}
-
-export async function UsersDataAdd(
-  context: Span | undefined,
-  user: User,
-): Promise<void> {
-  const span = tracer.startSpan("UsersDataAdd", context);
-  await DbUtilsExecSQL(span, SQL_QUERIES.INSERT_USER, [
-    user.id,
-    user.name,
-    user.passwordEncrypted,
-    user.role,
-    JSON.stringify(user.scopes),
-  ]);
-  span.end();
-}
-
-export async function UsersDataUpdatePassword(
-  context: Span | undefined,
-  user: User,
-): Promise<void> {
-  const span = tracer.startSpan("UsersDataUpdatePassword", context);
-  await DbUtilsExecSQL(span, SQL_QUERIES.UPDATE_PASSWORD, [
-    user.passwordEncrypted,
-    user.id,
-  ]);
-  span.end();
-}
-
-export async function UsersDataUpdateUser(
-  context: Span | undefined,
-  user: User,
-): Promise<void> {
-  const span = tracer.startSpan("UsersDataUpdateUser", context);
-  await DbUtilsExecSQL(span, SQL_QUERIES.UPDATE_USER, [
-    user.role,
-    JSON.stringify(user.scopes),
-    user.id,
-  ]);
-  span.end();
-}
-
-export async function UsersDataDelete(
-  context: Span | undefined,
-  id: string,
-): Promise<void> {
-  const span = tracer.startSpan("UsersDataDelete", context);
-  await DbUtilsExecSQL(span, SQL_QUERIES.DELETE_USER, [id]);
-  span.end();
-}
-
-// Private Functions
-
-function fromRaw(userRaw: any): User {
-  const user = new User();
-  user.id = userRaw.id;
-  user.name = userRaw.name;
-  user.passwordEncrypted = userRaw.passwordEncrypted;
-  user.role = userRaw.role || "user";
-  if (userRaw.scopes) {
-    try {
-      user.scopes = JSON.parse(userRaw.scopes);
-    } catch {
-      user.scopes = [...User.DEFAULT_SCOPES];
-    }
-  }
-  return user;
-}
-
-// SQL
-// Written SQLite-first with quoted identifiers (valid for both backends);
-// the DbUtils facade converts `?` placeholders for Postgres.
-
-const SQL_QUERIES = {
-  GET_USER_BY_ID: 'SELECT * FROM users WHERE "id" = ?',
-  GET_USER_BY_NAME: 'SELECT * FROM users WHERE "name" = ?',
-  LIST_USERS: "SELECT * FROM users",
-  INSERT_USER:
-    'INSERT INTO users ("id", "name", "passwordEncrypted", "role", "scopes") VALUES (?, ?, ?, ?, ?)',
-  UPDATE_USER: 'UPDATE users SET "role" = ?, "scopes" = ? WHERE "id" = ?',
-  UPDATE_PASSWORD: 'UPDATE users SET "passwordEncrypted" = ? WHERE "id" = ?',
-  DELETE_USER: 'DELETE FROM users WHERE "id" = ?',
-};

package/src/users/UsersRoutes.ts

@@ -1,374 +0,0 @@
-import { createHash } from "crypto";
-import { Span } from "@opentelemetry/sdk-trace-base";
-import { FastifyInstance, RequestGenericInterface } from "fastify";
-import { v4 as uuidv4 } from "uuid";
-import { AuthGenerateJWT, AuthGetUserSession, AuthMustBeAdmin } from "./Auth";
-import { User } from "./User";
-import { UserApiToken } from "./UserApiToken";
-import {
-  UserPasswordCheckPassword,
-  UserPasswordSetPassword,
-} from "./UserPassword";
-import {
-  UsersDataAdd,
-  UsersDataDelete,
-  UsersDataGet,
-  UsersDataGetByName,
-  UsersDataList,
-  UsersDataUpdatePassword,
-  UsersDataUpdateUser,
-} from "./UsersData";
-import {
-  UsersApiTokensDataAdd,
-  UsersApiTokensDataDelete,
-  UsersApiTokensDataDeleteByUser,
-  UsersApiTokensDataGet,
-  UsersApiTokensDataListByUser,
-} from "./UsersApiTokensData";
-
-/**
- * Retrieves the OTel span attached to the request by the
- * `@devopsplaybook.io/otel-utils-fastify` hooks.
- */
-function requestSpan(req: any): Span | undefined {
-  return req?.tracerSpanApi;
-}
-
-/**
- * Standard user management routes shared across applications:
- * initialization status, login (session), user CRUD and password changes.
- *
- * Register on a fastify instance:
- * ```ts
- * fastify.register(new UsersRoutes().getRoutes, { prefix: "/api/users" });
- * ```
- */
-export class UsersRoutes {
-  //
-
-  public async getRoutes(fastify: FastifyInstance): Promise<void> {
-    //
-    fastify.get("/status/initialization", async (req, res) => {
-      if ((await UsersDataList(requestSpan(req))).length === 0) {
-        res.status(201).send({ initialized: false });
-      } else {
-        res.status(201).send({ initialized: true });
-      }
-    });
-
-    // ==================== SESSION (Login) ====================
-
-    interface PostSession extends RequestGenericInterface {
-      Body: {
-        name: string;
-        password: string;
-      };
-    }
-    fastify.post<PostSession>("/session", async (req, res) => {
-      let user: User | null;
-      // From token
-      const userSession = await AuthGetUserSession(req);
-      if (userSession.isAuthenticated) {
-        // isAuthenticated implies userId is set
-        user = await UsersDataGet(
-          requestSpan(req),
-          userSession.userId as string,
-        );
-        if (!user) {
-          return res.status(403).send({ error: "Authentication Failed" });
-        }
-        return res.status(201).send({
-          success: true,
-          token: await AuthGenerateJWT(user),
-          user: user.toTransportJson(),
-        });
-      }
-
-      // From User/Pass
-      if (!req.body.name) {
-        return res.status(400).send({ error: "Missing: Name" });
-      }
-      if (!req.body.password) {
-        return res.status(400).send({ error: "Missing: Password" });
-      }
-      user = await UsersDataGetByName(requestSpan(req), req.body.name);
-      if (!user) {
-        return res.status(403).send({ error: "Authentication Failed" });
-      } else if (
-        await UserPasswordCheckPassword(
-          requestSpan(req),
-          user,
-          req.body.password,
-        )
-      ) {
-        return res.status(201).send({
-          success: true,
-          token: await AuthGenerateJWT(user),
-          user: user.toTransportJson(),
-        });
-      } else {
-        return res.status(403).send({ error: "Authentication Failed" });
-      }
-    });
-
-    // ==================== LIST USERS (Admin only) ====================
-
-    fastify.get("/", async (req, res) => {
-      try {
-        await AuthMustBeAdmin(req, res);
-      } catch {
-        return;
-      }
-      const users = await UsersDataList(requestSpan(req));
-      return res.status(200).send(users.map((u) => u.toTransportJson()));
-    });
-
-    // ==================== CREATE USER ====================
-
-    interface PostUser extends RequestGenericInterface {
-      Body: {
-        name: string;
-        password: string;
-        role?: string;
-        scopes?: string[];
-      };
-    }
-    fastify.post<PostUser>("/", async (req, res) => {
-      const context = requestSpan(req);
-      let isInitialized = true;
-      if ((await UsersDataList(context)).length === 0) {
-        isInitialized = false;
-      }
-
-      // If initialized, only admin can create users
-      if (isInitialized) {
-        try {
-          await AuthMustBeAdmin(req, res);
-        } catch {
-          return;
-        }
-      }
-
-      if (!req.body.name) {
-        return res.status(400).send({ error: "Missing: Name" });
-      }
-      if (!req.body.password) {
-        return res.status(400).send({ error: "Missing: Password" });
-      }
-      if (await UsersDataGetByName(context, req.body.name)) {
-        return res.status(400).send({ error: "Username Already Exists" });
-      }
-
-      const newUser = new User();
-      newUser.name = req.body.name;
-      // First user is always admin
-      if (isInitialized) {
-        newUser.role = req.body.role === "admin" ? "admin" : "user";
-        if (req.body.scopes && Array.isArray(req.body.scopes)) {
-          newUser.scopes = req.body.scopes.filter((s) =>
-            User.ALL_SCOPES.includes(s),
-          );
-        }
-      } else {
-        newUser.role = "admin";
-        newUser.scopes = [...User.ALL_SCOPES];
-      }
-      await UserPasswordSetPassword(context, newUser, req.body.password);
-      await UsersDataAdd(context, newUser);
-      res.status(201).send({ user: newUser.toTransportJson() });
-    });
-
-    // ==================== ADMIN: CHANGE OWN PASSWORD ====================
-
-    interface PutOwnPassword extends RequestGenericInterface {
-      Body: {
-        password: string;
-        passwordOld: string;
-      };
-    }
-    fastify.put<PutOwnPassword>("/password", async (req, res) => {
-      const context = requestSpan(req);
-      const userSession = await AuthGetUserSession(req);
-      if (!userSession.isAuthenticated) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      // isAuthenticated implies userId is set
-      const user = await UsersDataGet(context, userSession.userId as string);
-      if (!user) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      if (!req.body.password) {
-        return res.status(400).send({ error: "Missing: Password" });
-      }
-      if (
-        !(await UserPasswordCheckPassword(context, user, req.body.passwordOld))
-      ) {
-        return res.status(403).send({ error: "Old Password Wrong" });
-      }
-      await UserPasswordSetPassword(context, user, req.body.password);
-      await UsersDataUpdatePassword(context, user);
-      res.status(201).send({});
-    });
-
-    // ==================== ADMIN: UPDATE USER (role, scopes, password) ====================
-
-    interface PutUser extends RequestGenericInterface {
-      Params: {
-        id: string;
-      };
-      Body: {
-        role?: string;
-        scopes?: string[];
-        password?: string;
-      };
-    }
-    fastify.put<PutUser>("/:id", async (req, res) => {
-      const context = requestSpan(req);
-      try {
-        await AuthMustBeAdmin(req, res);
-      } catch {
-        return;
-      }
-
-      const user = await UsersDataGet(context, req.params.id);
-      if (!user) {
-        return res.status(404).send({ error: "User Not Found" });
-      }
-
-      if (req.body.role) {
-        user.role = req.body.role === "admin" ? "admin" : "user";
-      }
-      if (req.body.scopes && Array.isArray(req.body.scopes)) {
-        user.scopes = req.body.scopes.filter((s) =>
-          User.ALL_SCOPES.includes(s),
-        );
-      }
-
-      await UsersDataUpdateUser(context, user);
-
-      // If password change requested
-      if (req.body.password) {
-        await UserPasswordSetPassword(context, user, req.body.password);
-        await UsersDataUpdatePassword(context, user);
-      }
-
-      res.status(201).send({ user: user.toTransportJson() });
-    });
-
-    // ==================== ADMIN: DELETE USER ====================
-
-    interface DeleteUser extends RequestGenericInterface {
-      Params: {
-        id: string;
-      };
-    }
-    fastify.delete<DeleteUser>("/:id", async (req, res) => {
-      const context = requestSpan(req);
-      try {
-        await AuthMustBeAdmin(req, res);
-      } catch {
-        return;
-      }
-
-      const userSession = await AuthGetUserSession(req);
-
-      // Cannot delete yourself
-      if (userSession.userId === req.params.id) {
-        return res.status(400).send({ error: "Cannot Delete Yourself" });
-      }
-
-      const user = await UsersDataGet(context, req.params.id);
-      if (!user) {
-        return res.status(404).send({ error: "User Not Found" });
-      }
-
-      // Check that at least 1 admin remains
-      if (user.role === "admin") {
-        const admins = (await UsersDataList(context)).filter(
-          (u) => u.role === "admin",
-        );
-        if (admins.length <= 1) {
-          return res
-            .status(400)
-            .send({ error: "At least 1 admin must be defined" });
-        }
-      }
-
-      await UsersDataDelete(context, req.params.id);
-      await UsersApiTokensDataDeleteByUser(context, req.params.id);
-      res.status(201).send({});
-    });
-
-    // ==================== API TOKENS (self-service) ====================
-
-    interface PostApiToken extends RequestGenericInterface {
-      Body: {
-        name: string;
-      };
-    }
-    fastify.post<PostApiToken>("/tokens", async (req, res) => {
-      const context = requestSpan(req);
-      const userSession = await AuthGetUserSession(req);
-      if (!userSession.isAuthenticated) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      if (!req.body || !req.body.name) {
-        return res.status(400).send({ error: "Missing: Name" });
-      }
-      const apiToken = new UserApiToken();
-      apiToken.name = req.body.name;
-      // isAuthenticated implies userId is set
-      apiToken.userId = userSession.userId as string;
-      apiToken.dateCreated = new Date().toISOString();
-      const token = uuidv4();
-      apiToken.tokenHash = createHash("sha256").update(token).digest("hex");
-      await UsersApiTokensDataAdd(context, apiToken);
-      // The plaintext token is returned once; only its hash is stored.
-      return res.status(201).send({
-        token,
-        ...apiToken.toTransportJson(),
-      });
-    });
-
-    fastify.get("/tokens", async (req, res) => {
-      const context = requestSpan(req);
-      const userSession = await AuthGetUserSession(req);
-      if (!userSession.isAuthenticated) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      const apiTokens = await UsersApiTokensDataListByUser(
-        context,
-        userSession.userId as string,
-      );
-      return res
-        .status(200)
-        .send(apiTokens.map((t) => t.toTransportJson()));
-    });
-
-    interface DeleteApiToken extends RequestGenericInterface {
-      Params: {
-        id: string;
-      };
-    }
-    fastify.delete<DeleteApiToken>("/tokens/:id", async (req, res) => {
-      const context = requestSpan(req);
-      const userSession = await AuthGetUserSession(req);
-      if (!userSession.isAuthenticated) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      const apiToken = await UsersApiTokensDataGet(context, req.params.id);
-      if (!apiToken) {
-        return res.status(404).send({ error: "API Token Not Found" });
-      }
-      // Owner can always revoke; admins can revoke any token
-      if (
-        apiToken.userId !== userSession.userId &&
-        userSession.role !== "admin"
-      ) {
-        return res.status(403).send({ error: "Access Denied" });
-      }
-      await UsersApiTokensDataDelete(context, apiToken.id);
-      return res.status(201).send({});
-    });
-  }
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2019",
-    "lib": ["ES2019", "ES2022.Error"],
-    "module": "commonjs",
-    "declaration": true,
-    "outDir": "./dist",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true
-  },
-  "include": ["index.ts", "src/**/*"],
-  "exclude": ["**/*.spec.ts"]
-}

package/tsconfig.spec.json

@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "types": ["jest", "node"]
-  },
-  "include": ["src/**/*.spec.ts"],
-  "exclude": []
-}