@drttix/drt-sdk 1.0.2 → 1.0.3

package/.claude/admin-auth/auth.middleware.ts.txt

@@ -1,149 +0,0 @@
-import {
-    ForbiddenException,
-    Injectable,
-    Logger,
-    NestMiddleware,
-    UnauthorizedException,
-} from '@nestjs/common';
-import { NextFunction, Request, Response } from 'express';
-import { ErrorCode } from '../shared/consts/errorCodes';
-import { EXCEPTION_PATHS, HEADER_STUDIO_KEY } from '../shared/consts/values';
-import { MssqlService } from '../database/mssql/services/mssql.service';
-import { CacheService } from '../shared/service/cache.service';
-import { CommonService } from '../shared/service/common.service';
-import { DRT } from '@drttix/drt-api';
-
-@Injectable()
-export class AuthMiddleware implements NestMiddleware {
-    constructor(
-        private readonly msSqlService: MssqlService,
-        private readonly cacheService: CacheService,
-        private readonly commonService: CommonService,
-        private readonly logger: Logger,
-    ) {}
-
-    async use(req: Request, res: Response, next: NextFunction): Promise<void> {
-        const headerStudioId = Number(req.headers[HEADER_STUDIO_KEY]);
-
-        if (!headerStudioId) {
-            throw new UnauthorizedException(ErrorCode.MISSING_STUDIO_ID);
-        }
-
-        const shopperGuidKey =
-            this.commonService.formatShopperGuid(headerStudioId);
-
-        let shopperGuid = req.cookies[shopperGuidKey];
-
-        if (!shopperGuid) {
-            shopperGuid = this.commonService.getFormattedGuid();
-            this.logger.log(
-                `[Middleware] Generated NEW shopperGuid=${shopperGuid}`,
-            );
-        } else {
-            this.logger.log(
-                `[Middleware] Using EXISTING cookie shopperGuid=${shopperGuid}`,
-            );
-        }
-
-        const clientIp = req.ip as string;
-
-        try {
-            await this.msSqlService.checkSession(
-                headerStudioId,
-                shopperGuid,
-                clientIp,
-            );
-
-            // Call is here to seed the session service with the correct session.
-            // TODO: Replace this and the above checkSession
-            await DRT.session.getSession(shopperGuid, headerStudioId);
-
-            this.setCookie(res, shopperGuidKey, shopperGuid);
-        } catch (error) {
-            this.logger.error(error);
-            throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
-        }
-
-        // If the route is not in the exceptions list, validate the session and permissions
-        this.logger.log(
-            `[Middleware] req.baseUrl="${req.baseUrl}", req.path="${req.path}", req.originalUrl="${req.originalUrl}"`,
-        );
-        if (!EXCEPTION_PATHS.includes(req.baseUrl)) {
-            const isValidLogin = await this.cacheService.checkStudioLogin(
-                shopperGuid,
-                Number(headerStudioId),
-            );
-
-            if (!isValidLogin) {
-                throw new UnauthorizedException(ErrorCode.INVALID_LOGIN);
-            }
-
-            const isUserPrimary = await this.msSqlService.getPrimaryStatus(
-                shopperGuid,
-                Number(headerStudioId),
-            );
-
-            const isValid = await this.validateRoute(
-                req.baseUrl,
-                req.method,
-                shopperGuid,
-                isUserPrimary,
-            );
-
-            if (!isValid) {
-                throw new ForbiddenException(ErrorCode.FORBIDDEN);
-            }
-        }
-
-        req.cookies = { [`${shopperGuidKey}`]: shopperGuid };
-        next();
-    }
-
-    setCookie(res: Response, key: string, value: string | number): void {
-        res.cookie(key, value, {
-            httpOnly: true,
-            secure: true,
-            sameSite: 'lax',
-            path: '/',
-            // eslint-disable-next-line no-magic-numbers
-            maxAge: 60 * 60 * 24,
-        });
-    }
-
-    async validateRoute(
-        currentRoute: string,
-        currentMethod: string,
-        shopperGuid: string,
-        isUserPrimary: number,
-    ): Promise<boolean> {
-        const cachedRoutes = await this.cacheService.getCachedRoutes();
-        // Replace numbers in the route with a generic 'id'
-        currentRoute = currentRoute.replace(/\d+/g, 'id');
-
-        const routeMatch = cachedRoutes.find(
-            route =>
-                route.route === currentRoute && route.method === currentMethod,
-        );
-
-        if (!routeMatch) {
-            return false;
-        }
-
-        if (routeMatch.primaryUserOnly === 1 && isUserPrimary !== 1) {
-            return false;
-        }
-
-        if (routeMatch.rejectOnFail === 0) {
-            return true;
-        }
-
-        const portalObjects =
-            await this.cacheService.getUserPermissions(shopperGuid);
-
-        if (portalObjects.some(item => item.id === routeMatch.portalObjectId)) {
-            return true;
-        }
-
-        return false;
-    }
-}

package/.claude/admin-auth/superuser.middleware.ts.txt

@@ -1,41 +0,0 @@
-import {
-    ForbiddenException,
-    Injectable,
-    Logger,
-    NestMiddleware,
-} from '@nestjs/common';
-import { NextFunction, Request, Response } from 'express';
-import { MssqlService } from '../database/mssql/services/mssql.service';
-import { ErrorCode } from '../shared/consts/errorCodes';
-import { HEADER_STUDIO_KEY } from '../shared/consts/values';
-import { CommonService } from '../shared/service/common.service';
-
-@Injectable()
-export class SuperUserMiddleware implements NestMiddleware {
-    constructor(
-        private readonly msSqlService: MssqlService,
-        private readonly commonService: CommonService,
-        private readonly logger: Logger,
-    ) {}
-
-    async use(req: Request, res: Response, next: NextFunction): Promise<void> {
-        const headerStudioId = Number(req.headers[HEADER_STUDIO_KEY]);
-
-        const shopperGuidKey =
-            this.commonService.formatShopperGuid(headerStudioId);
-
-        let shopperGuid = req.cookies[shopperGuidKey];
-
-        const adminDetails =
-            await this.msSqlService.getAdminDetails(shopperGuid);
-
-        if (adminDetails.superuser !== 1) {
-            this.logger.log(
-                `Unauthorized access attempt to superuser route by shopperGuid: ${shopperGuid} on Studio: ${headerStudioId}`,
-            );
-            throw new ForbiddenException(ErrorCode.FORBIDDEN);
-        }
-
-        next();
-    }
-}