@drax/identity-back 0.29.0 → 0.30.0

package/dist/controllers/TenantController.js

@@ -2,6 +2,7 @@ import { AbstractFastifyController } from "@drax/crud-back";
 import { ValidationError, UnauthorizedError } from "@drax/common-back";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 import TenantPermissions from "../permissions/TenantPermissions.js";
+import UserPermissions from "../permissions/UserPermissions.js";
 class TenantController extends AbstractFastifyController {
     constructor() {
         super(TenantServiceFactory(), TenantPermissions);
@@ -10,7 +11,7 @@ class TenantController extends AbstractFastifyController {
         try {
             request.rbac.assertPermission(this.permission.View);
             let tenants = await this.service.fetchAll();
-            if (request.rbac.getAuthUser.tenantId) {
+            if (request.rbac.getAuthUser.tenantId && !request.rbac.hasPermission(UserPermissions.SwitchTenant)) {
                 return tenants.filter(t => t._id === request.rbac.getAuthUser.tenantId);
             }
             else {

package/dist/controllers/UserController.js

@@ -8,6 +8,7 @@ import BadCredentialsError from "../errors/BadCredentialsError.js";
 import { join } from "path";
 import { IdentityConfig } from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
+import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
 const BASE_URL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : '';
@@ -39,6 +40,14 @@ class UserController extends AbstractFastifyController {
                 let user = await userService.findById(request.rbac.userId);
                 user.password = undefined;
                 delete user.password;
+                //handle SwitchTenant setted in accessToken
+                if (request.authUser.tenantId != user?.tenant?._id) {
+                    const tenantService = TenantServiceFactory();
+                    const tenant = await tenantService.findById(request.authUser.tenantId);
+                    if (tenant) {
+                        user.tenant = tenant;
+                    }
+                }
                 return user;
             }
             else {
@@ -49,6 +58,23 @@ class UserController extends AbstractFastifyController {
             this.handleError(e, reply);
         }
     }
+    async switchTenant(request, reply) {
+        try {
+            request.rbac.assertPermission(UserPermissions.SwitchTenant);
+            if (request.authUser && request.token) {
+                const tenantId = request.body.tenantId;
+                const userService = UserServiceFactory();
+                let { accessToken } = await userService.switchTenant(request.token, tenantId);
+                return { accessToken };
+            }
+            else {
+                throw new UnauthorizedError();
+            }
+        }
+        catch (e) {
+            this.handleError(e, reply);
+        }
+    }
     async paginate(request, reply) {
         try {
             request.rbac.assertPermission(UserPermissions.View);

package/dist/graphql/resolvers/user.resolvers.js

@@ -1,11 +1,11 @@
 import UserServiceFactory from "../../factory/UserServiceFactory.js";
 import { GraphQLError } from "graphql";
 import { ValidationErrorToGraphQLError, ValidationError, StoreManager, DraxConfig, CommonConfig } from "@drax/common-back";
-import { IdentityPermissions } from "../../permissions/IdentityPermissions.js";
 import { UnauthorizedError } from "@drax/common-back";
 import BadCredentialsError from "../../errors/BadCredentialsError.js";
 import { join } from "path";
 import IdentityConfig from "../../config/IdentityConfig.js";
+import UserPermissions from "../../permissions/UserPermissions.js";
 export default {
     Query: {
         me: async (_, {}, { authUser }) => {
@@ -25,7 +25,7 @@ export default {
         },
         findUserById: async (_, { id }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.ViewUser);
+                rbac.assertPermission(UserPermissions.View);
                 let userService = UserServiceFactory();
                 let user = await userService.findById(id);
                 user.password = undefined;
@@ -40,7 +40,7 @@ export default {
         },
         paginateUser: async (_, { options = { page: 1, limit: 5, orderBy: "", order: "asc", search: "", filters: [] } }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.ViewUser);
+                rbac.assertPermission(UserPermissions.View);
                 let userService = UserServiceFactory();
                 if (!options.filters) {
                     options.filters = [];
@@ -72,9 +72,26 @@ export default {
                 throw new GraphQLError('error.server');
             }
         },
+        switchTenant: async (_, { input }, { rbac, authUser, token }) => {
+            try {
+                rbac.assertPermission(UserPermissions.SwitchTenant);
+                if (authUser && token) {
+                    const tenantId = input.tenantId;
+                    const userService = UserServiceFactory();
+                    let { accessToken } = await userService.switchTenant(token, tenantId);
+                    return { accessToken };
+                }
+                else {
+                    throw new UnauthorizedError();
+                }
+            }
+            catch (e) {
+                throw new GraphQLError('error.server');
+            }
+        },
         createUser: async (_, { input }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.CreateUser);
+                rbac.assertPermission(UserPermissions.Create);
                 let userService = UserServiceFactory();
                 if (rbac.getAuthUser.tenantId) {
                     input.tenant = rbac.getAuthUser.tenantId;
@@ -95,7 +112,7 @@ export default {
         },
         updateUser: async (_, { id, input }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.UpdateUser);
+                rbac.assertPermission(UserPermissions.Update);
                 let userService = UserServiceFactory();
                 if (rbac.getAuthUser.tenantId) {
                     input.tenant = rbac.getAuthUser.tenantId;
@@ -115,7 +132,7 @@ export default {
         },
         deleteUser: async (_, { id }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.DeleteUser);
+                rbac.assertPermission(UserPermissions.Delete);
                 let userService = UserServiceFactory();
                 return await userService.delete(id);
             }
@@ -151,7 +168,7 @@ export default {
         },
         changeUserPassword: async (_, { userId, newPassword }, { rbac }) => {
             try {
-                rbac.assertPermission(IdentityPermissions.UpdateUser);
+                rbac.assertPermission(UserPermissions.Update);
                 let userService = UserServiceFactory();
                 return await userService.changeUserPassword(userId, newPassword);
             }

package/dist/graphql/types/user.graphql

@@ -56,9 +56,13 @@ input AuthInput{
     password: String!
 }
 
+input SwitchTenantInput{
+    tenantId: String!
+}
 
 type Mutation{
     auth(input: AuthInput): Auth
+    switchTenant(input: SwitchTenantInput): Auth
     createUser(input: UserCreateInput): User
     updateUser(id: ID!, input: UserUpdateInput): User
     deleteUser(id: ID!): Boolean

package/dist/middleware/jwtMiddleware.js

@@ -10,6 +10,7 @@ function jwtMiddleware(request, reply, done) {
             const authUser = AuthUtils.verifyToken(token);
             if (authUser) {
                 request.authUser = authUser;
+                request.token = token;
             }
         }
         done();

package/dist/permissions/UserPermissions.js

@@ -5,6 +5,7 @@ var UserPermissions;
     UserPermissions["Delete"] = "user:delete";
     UserPermissions["View"] = "user:view";
     UserPermissions["Manage"] = "user:manage";
+    UserPermissions["SwitchTenant"] = "user:switchTenant";
 })(UserPermissions || (UserPermissions = {}));
 export default UserPermissions;
 export { UserPermissions };

package/dist/routes/UserRoutes.js

@@ -5,6 +5,7 @@ import { LoginBodyRequestSchema, LoginBodyResponseSchema } from "../schemas/Logi
 import { UserSchema, UserCreateSchema, UserUpdateSchema } from "../schemas/UserSchema.js";
 import { RegisterBodyRequestSchema, RegisterBodyResponseSchema } from "../schemas/RegisterSchema.js";
 import { MyPasswordBodyRequestSchema, PasswordBodyRequestSchema, PasswordBodyResponseSchema } from "../schemas/PasswordSchema.js";
+import { SwitchTenantBodyRequestSchema, SwitchTenantBodyResponseSchema } from "../schemas/SwitchTenantSchema.js";
 async function UserRoutes(fastify, options) {
     const controller = new UserController();
     const schemas = new CrudSchemaBuilder(UserSchema, UserCreateSchema, UserUpdateSchema, 'tenant', 'openApi3', ['Identity']);
@@ -34,6 +35,16 @@ async function UserRoutes(fastify, options) {
             },
         },
     }, (req, rep) => controller.me(req, rep));
+    fastify.post('/api/auth/switch-tenant', {
+        schema: {
+            tags: ['Auth'],
+            body: zodToJsonSchema(SwitchTenantBodyRequestSchema),
+            response: {
+                200: zodToJsonSchema(SwitchTenantBodyResponseSchema),
+                400: schemas.jsonErrorBodyResponse,
+            },
+        },
+    }, (req, rep) => controller.switchTenant(req, rep));
     fastify.post('/api/users/register', {
         schema: {
             tags: ['Auth'],

package/dist/schemas/SwitchTenantSchema.js

@@ -0,0 +1,8 @@
+import z from "zod";
+const SwitchTenantBodyRequestSchema = z.object({
+    tenantId: z.string(),
+});
+const SwitchTenantBodyResponseSchema = z.object({
+    accessToken: z.string()
+});
+export { SwitchTenantBodyRequestSchema, SwitchTenantBodyResponseSchema };

package/dist/services/UserService.js

@@ -25,6 +25,10 @@ class UserService extends AbstractService {
             throw new BadCredentialsError();
         }
     }
+    async switchTenant(accessToken, tenantId) {
+        const newAccessToken = AuthUtils.switchTenant(accessToken, tenantId);
+        return { accessToken: newAccessToken };
+    }
     async authByEmail(email, createIfNotFound = false, userData) {
         let user = null;
         console.log("auth email", email);

package/dist/utils/AuthUtils.js

@@ -60,6 +60,34 @@ class AuthUtils {
         // Generar el hash en formato hexadecimal
         return hmac.digest('hex');
     }
+    static switchTenant(accessToken, newTenantId) {
+        // Verificar que el token actual sea válido
+        const decodedToken = AuthUtils.verifyToken(accessToken);
+        if (!decodedToken) {
+            throw new Error("Invalid access token");
+        }
+        // Crear el nuevo payload manteniendo todos los datos excepto tenantId
+        const newPayload = {
+            id: decodedToken.id,
+            username: decodedToken.username,
+            roleId: decodedToken.roleId,
+            tenantId: newTenantId,
+            session: decodedToken.session,
+            exp: decodedToken.exp
+        };
+        const JWT_SECRET = DraxConfig.getOrLoad(IdentityConfig.JwtSecret);
+        if (!JWT_SECRET) {
+            throw new Error("JWT_SECRET ENV must be provided");
+        }
+        const JWT_ISSUER = DraxConfig.getOrLoad(IdentityConfig.JwtIssuer) || 'DRAX';
+        const options = {
+            jwtid: decodedToken.id,
+            algorithm: 'HS256',
+            audience: decodedToken.username,
+            issuer: JWT_ISSUER
+        };
+        return jsonwebtoken.sign(newPayload, JWT_SECRET, options);
+    }
 }
 export default AuthUtils;
 export { AuthUtils };

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Identity module for user management, authentication and authorization.",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -28,11 +28,11 @@
   "author": "Cristian Incarnato & Drax Team",
   "license": "ISC",
   "dependencies": {
-    "@drax/common-back": "^0.29.0",
-    "@drax/crud-back": "^0.29.0",
-    "@drax/crud-share": "^0.29.0",
-    "@drax/email-back": "^0.29.0",
-    "@drax/identity-share": "^0.29.0",
+    "@drax/common-back": "^0.30.0",
+    "@drax/crud-back": "^0.30.0",
+    "@drax/crud-share": "^0.30.0",
+    "@drax/email-back": "^0.30.0",
+    "@drax/identity-share": "^0.30.0",
     "bcryptjs": "^2.4.3",
     "graphql": "^16.8.2",
     "jsonwebtoken": "^9.0.2"
@@ -63,5 +63,5 @@
       "debug": "0"
     }
   },
-  "gitHead": "0a3f69beb23eb8768ebe7a3d41d61d4a6d40b104"
+  "gitHead": "f7f06578327be29f20dcb7e2c8a2eac9e9145cab"
 }

package/src/controllers/TenantController.ts

@@ -5,6 +5,7 @@ import {ValidationError, UnauthorizedError} from "@drax/common-back";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 import TenantService from "../services/TenantService.js";
 import TenantPermissions from "../permissions/TenantPermissions.js";
+import UserPermissions from "../permissions/UserPermissions.js";
 
 class TenantController extends AbstractFastifyController<ITenant, ITenantBase, ITenantBase>   {
 
@@ -14,13 +15,11 @@ class TenantController extends AbstractFastifyController<ITenant, ITenantBase, I
         super(TenantServiceFactory(), TenantPermissions)
     }
 
-
-
     async all(request, reply) {
         try {
             request.rbac.assertPermission(this.permission.View)
             let tenants = await this.service.fetchAll()
-            if(request.rbac.getAuthUser.tenantId){
+            if(request.rbac.getAuthUser.tenantId && !request.rbac.hasPermission(UserPermissions.SwitchTenant)){
                 return tenants.filter(t => t._id === request.rbac.getAuthUser.tenantId)
             }else{
                 return tenants

package/src/controllers/UserController.ts

@@ -18,6 +18,7 @@ import {join} from "path";
 import {IdentityConfig} from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
 import {IDraxFieldFilter} from "@drax/crud-share";
+import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
@@ -56,7 +57,18 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 let user = await userService.findById(request.rbac.userId)
                 user.password = undefined
                 delete user.password
+
+                //handle SwitchTenant setted in accessToken
+                if(request.authUser.tenantId != user?.tenant?._id){
+                    const tenantService = TenantServiceFactory()
+                    const tenant = await tenantService.findById(request.authUser.tenantId)
+                    if(tenant){
+                        user.tenant = tenant
+                    }
+                }
+
                 return user
+
             } else {
                 throw new UnauthorizedError()
 
@@ -66,6 +78,22 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
         }
     }
 
+    async switchTenant(request, reply) {
+        try {
+            request.rbac.assertPermission(UserPermissions.SwitchTenant)
+            if (request.authUser && request.token) {
+                const tenantId = request.body.tenantId
+                const userService = UserServiceFactory()
+                let {accessToken} = await userService.switchTenant(request.token, tenantId)
+                return {accessToken}
+            } else {
+                throw new UnauthorizedError()
+            }
+        } catch (e) {
+            this.handleError(e,reply)
+        }
+    }
+
     async paginate(request, reply) {
         try {
             request.rbac.assertPermission(UserPermissions.View)

package/src/graphql/resolvers/user.resolvers.ts

@@ -7,12 +7,12 @@ import {
     DraxConfig,
     CommonConfig
 } from "@drax/common-back";
-import {IdentityPermissions} from "../../permissions/IdentityPermissions.js";
 import {UnauthorizedError} from "@drax/common-back";
 import BadCredentialsError from "../../errors/BadCredentialsError.js";
 import {join} from "path";
 import IdentityConfig from "../../config/IdentityConfig.js";
 import {IDraxPaginateOptions} from "@drax/crud-share";
+import UserPermissions from "../../permissions/UserPermissions.js";
 
 export default {
     Query: {
@@ -33,7 +33,7 @@ export default {
         },
         findUserById: async (_, {id}, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.ViewUser)
+                rbac.assertPermission(UserPermissions.View)
                 let userService = UserServiceFactory()
                 let user =  await userService.findById(id)
                 user.password = undefined
@@ -48,7 +48,7 @@ export default {
         },
         paginateUser: async (_, { options= {page:1, limit:5, orderBy:"", order:"asc", search:"", filters: []} as IDraxPaginateOptions }, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.ViewUser)
+                rbac.assertPermission(UserPermissions.View)
                 let userService = UserServiceFactory()
 
                 if(!options.filters){
@@ -80,10 +80,26 @@ export default {
                 throw new GraphQLError('error.server')
             }
 
+        },
+        switchTenant: async (_, {input},{rbac, authUser, token}) => {
+            try {
+                rbac.assertPermission(UserPermissions.SwitchTenant)
+                if (authUser && token) {
+                    const tenantId = input.tenantId
+                    const userService = UserServiceFactory()
+                    let {accessToken} = await userService.switchTenant(token, tenantId)
+                    return {accessToken}
+                } else {
+                    throw new UnauthorizedError()
+                }
+            } catch (e) {
+                throw new GraphQLError('error.server')
+            }
+
         },
         createUser: async (_, {input}, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.CreateUser)
+                rbac.assertPermission(UserPermissions.Create)
                 let userService = UserServiceFactory()
                 if (rbac.getAuthUser.tenantId) {
                     input.tenant = rbac.getAuthUser.tenantId
@@ -103,7 +119,7 @@ export default {
         },
         updateUser: async (_, {id, input}, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.UpdateUser)
+                rbac.assertPermission(UserPermissions.Update)
                 let userService = UserServiceFactory()
                 if (rbac.getAuthUser.tenantId) {
                     input.tenant = rbac.getAuthUser.tenantId
@@ -121,7 +137,7 @@ export default {
         },
         deleteUser: async (_, {id}, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.DeleteUser)
+                rbac.assertPermission(UserPermissions.Delete)
                 let userService = UserServiceFactory()
                 return await userService.delete(id)
             } catch (e) {
@@ -153,7 +169,7 @@ export default {
         },
         changeUserPassword: async (_, {userId, newPassword}, {rbac}) => {
             try {
-                rbac.assertPermission(IdentityPermissions.UpdateUser)
+                rbac.assertPermission(UserPermissions.Update)
                 let userService = UserServiceFactory()
                 return await userService.changeUserPassword(userId, newPassword)
             } catch (e) {

package/src/graphql/types/user.graphql

@@ -56,9 +56,13 @@ input AuthInput{
     password: String!
 }
 
+input SwitchTenantInput{
+    tenantId: String!
+}
 
 type Mutation{
     auth(input: AuthInput): Auth
+    switchTenant(input: SwitchTenantInput): Auth
     createUser(input: UserCreateInput): User
     updateUser(id: ID!, input: UserUpdateInput): User
     deleteUser(id: ID!): Boolean

package/src/middleware/jwtMiddleware.ts

@@ -15,6 +15,7 @@ function jwtMiddleware (request, reply, done) {
                 const authUser = AuthUtils.verifyToken(token) as IJwtUser
                 if(authUser){
                     request.authUser = authUser
+                    request.token = token
                 }
             }
             done()

package/src/permissions/UserPermissions.ts

@@ -4,7 +4,7 @@ enum UserPermissions {
     Delete = "user:delete",
     View = "user:view",
     Manage = "user:manage",
-
+    SwitchTenant = "user:switchTenant",
 }
 
 export default UserPermissions;

package/src/routes/UserRoutes.ts

@@ -9,6 +9,7 @@ import {
     PasswordBodyRequestSchema,
     PasswordBodyResponseSchema
 } from "../schemas/PasswordSchema.js";
+import {SwitchTenantBodyRequestSchema, SwitchTenantBodyResponseSchema} from "../schemas/SwitchTenantSchema.js";
 
 async function UserRoutes(fastify, options) {
 
@@ -52,6 +53,19 @@ async function UserRoutes(fastify, options) {
         },
     }, (req, rep) => controller.me(req, rep))
 
+    fastify.post('/api/auth/switch-tenant',
+        {
+            schema: {
+                tags: ['Auth'],
+                body: zodToJsonSchema(SwitchTenantBodyRequestSchema),
+                response: {
+                    200: zodToJsonSchema(SwitchTenantBodyResponseSchema),
+                    400: schemas.jsonErrorBodyResponse,
+                },
+            },
+        },
+        (req, rep) => controller.switchTenant(req, rep))
+
 
     fastify.post('/api/users/register', {
         schema: {

package/src/schemas/SwitchTenantSchema.ts

@@ -0,0 +1,11 @@
+import z from "zod"
+
+const SwitchTenantBodyRequestSchema = z.object({
+    tenantId: z.string(),
+});
+
+const SwitchTenantBodyResponseSchema = z.object({
+    accessToken: z.string()
+});
+
+export {SwitchTenantBodyRequestSchema, SwitchTenantBodyResponseSchema}

package/src/services/UserService.ts

@@ -34,6 +34,11 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
         }
     }
 
+    async switchTenant(accessToken: string, tenantId: string) {
+        const newAccessToken = AuthUtils.switchTenant(accessToken, tenantId)
+        return {accessToken: newAccessToken}
+    }
+
     async authByEmail(email: string, createIfNotFound: boolean = false, userData: IUserCreate) {
         let user = null
         console.log("auth email", email)

package/src/utils/AuthUtils.ts

@@ -78,6 +78,42 @@ class AuthUtils{
         // Generar el hash en formato hexadecimal
         return hmac.digest('hex');
     }
+
+    static switchTenant(accessToken: string, newTenantId: string): string {
+        // Verificar que el token actual sea válido
+        const decodedToken = AuthUtils.verifyToken(accessToken) as IJwtUser & { exp?: number };
+
+        if (!decodedToken) {
+            throw new Error("Invalid access token");
+        }
+
+        // Crear el nuevo payload manteniendo todos los datos excepto tenantId
+        const newPayload: IJwtUser = {
+            id: decodedToken.id,
+            username: decodedToken.username,
+            roleId: decodedToken.roleId,
+            tenantId: newTenantId,
+            session: decodedToken.session,
+            exp: decodedToken.exp
+        };
+
+        const JWT_SECRET = DraxConfig.getOrLoad(IdentityConfig.JwtSecret);
+        if (!JWT_SECRET) {
+            throw new Error("JWT_SECRET ENV must be provided");
+        }
+
+        const JWT_ISSUER = DraxConfig.getOrLoad(IdentityConfig.JwtIssuer) || 'DRAX';
+
+        const options: SignOptions = {
+            jwtid: decodedToken.id,
+            algorithm: 'HS256',
+            audience: decodedToken.username,
+            issuer: JWT_ISSUER
+        };
+
+
+        return jsonwebtoken.sign(newPayload, JWT_SECRET, options);
+    }
 }
 
 export default AuthUtils