@efa-one/sdk 1.10.1

package/backend/auth.js

@@ -0,0 +1,233 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAuth = requireAuth;
+exports.requireAdmin = requireAdmin;
+exports.requirePermission = requirePermission;
+exports.requireAdminOrPermission = requireAdminOrPermission;
+exports.requireRegistryKey = requireRegistryKey;
+exports.requireInternalOrAuth = requireInternalOrAuth;
+exports.requireInternalOrAdminOrPermission = requireInternalOrAdminOrPermission;
+exports.createExchangeRouter = createExchangeRouter;
+const express_1 = require("express");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const permissionClient_1 = require("./permissionClient");
+const JWT_ISSUER = 'converge';
+const JWT_AUDIENCE = 'converge';
+function getPlatformPublicKey() {
+    const s = process.env.JWT_PUBLIC_KEY;
+    if (!s)
+        throw new Error('JWT_PUBLIC_KEY environment variable is required');
+    return Buffer.from(s, 'base64').toString('utf8');
+}
+function getSessionSecret() {
+    const s = process.env.APP_SESSION_SECRET;
+    if (!s)
+        throw new Error('APP_SESSION_SECRET environment variable is required');
+    return s;
+}
+function getCookieName() {
+    return process.env.APP_SESSION_COOKIE_NAME || 'app_session';
+}
+function setSessionCookie(res, token) {
+    const secure = process.env.COOKIE_SECURE
+        ? ['1', 'true', 'yes', 'on'].includes(process.env.COOKIE_SECURE.toLowerCase())
+        : process.env.NODE_ENV === 'production';
+    res.cookie(getCookieName(), token, {
+        httpOnly: true,
+        sameSite: 'lax',
+        maxAge: 8 * 60 * 60 * 1000,
+        secure,
+        path: '/',
+    });
+}
+function requireAuth(req, res, next) {
+    const token = req.cookies?.[getCookieName()];
+    if (!token) {
+        res.status(401).json({ error: 'Not authenticated' });
+        return;
+    }
+    try {
+        const payload = jsonwebtoken_1.default.verify(token, getSessionSecret(), { algorithms: ['HS256'] });
+        req.user = payload;
+        next();
+    }
+    catch {
+        res.status(401).json({ error: 'Session invalid or expired' });
+    }
+}
+function requireAdmin(req, res, next) {
+    requireAuth(req, res, () => {
+        (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
+            .then((keys) => {
+            if (!keys.includes('converge-admin')) {
+                res.status(403).json({ error: 'Admin access required' });
+                return;
+            }
+            next();
+        })
+            .catch((err) => {
+            console.error(JSON.stringify({ level: 'error', msg: 'requireAdmin: permission lookup failed', err: String(err) }));
+            res.status(503).json({ error: 'Permission service unavailable' });
+        });
+    });
+}
+function requirePermission(permission) {
+    return (req, res, next) => {
+        requireAuth(req, res, () => {
+            (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
+                .then((keys) => {
+                if (!keys.includes(permission)) {
+                    res.status(403).json({ error: `Permission required: ${permission}` });
+                    return;
+                }
+                next();
+            })
+                .catch((err) => {
+                console.error(JSON.stringify({ level: 'error', msg: 'requirePermission: permission lookup failed', err: String(err) }));
+                res.status(503).json({ error: 'Permission service unavailable' });
+            });
+        });
+    };
+}
+function requireAdminOrPermission(...permissionKeys) {
+    return (req, res, next) => {
+        requireAuth(req, res, () => {
+            (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
+                .then((keys) => {
+                if (keys.includes('converge-admin')) {
+                    next();
+                    return;
+                }
+                if (permissionKeys.some((k) => keys.includes(k))) {
+                    next();
+                    return;
+                }
+                res.status(403).json({ error: 'Forbidden – missing permission' });
+            })
+                .catch((err) => {
+                console.error(JSON.stringify({ level: 'error', msg: 'requireAdminOrPermission: permission lookup failed', err: String(err) }));
+                res.status(503).json({ error: 'Permission service unavailable' });
+            });
+        });
+    };
+}
+const PROVENANCE_ISSUER = 'converge-gateway';
+function hasValidServiceProvenance(req) {
+    const token = req.headers['x-service-token'];
+    if (!token)
+        return false;
+    const audience = process.env.SERVICE_KEY;
+    if (!audience)
+        return false;
+    try {
+        jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
+            algorithms: ['RS256'],
+            issuer: PROVENANCE_ISSUER,
+            audience,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function requireRegistryKey(req, res, next) {
+    if (hasValidServiceProvenance(req)) {
+        next();
+        return;
+    }
+    res.status(401).json({ error: 'Service provenance token required' });
+}
+function requireInternalOrAuth(req, res, next) {
+    if (hasValidServiceProvenance(req)) {
+        next();
+        return;
+    }
+    requireAuth(req, res, next);
+}
+function requireInternalOrAdminOrPermission(...permissionKeys) {
+    return (req, res, next) => {
+        if (hasValidServiceProvenance(req)) {
+            next();
+            return;
+        }
+        requireAdminOrPermission(...permissionKeys)(req, res, next);
+    };
+}
+function createExchangeRouter(pool) {
+    const router = (0, express_1.Router)();
+    router.post('/exchange', async (req, res) => {
+        const { token } = req.body;
+        if (!token) {
+            res.status(400).json({ error: 'token required' });
+            return;
+        }
+        let convergePayload;
+        try {
+            convergePayload = jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
+                algorithms: ['RS256'],
+                issuer: JWT_ISSUER,
+                audience: JWT_AUDIENCE,
+            });
+        }
+        catch {
+            res.status(401).json({ error: 'Invalid or expired platform token' });
+            return;
+        }
+        try {
+            const { rows } = await pool.query(`INSERT INTO app_users (converge_id, email, name, last_seen_at)
+         VALUES ($1, $2, $3, NOW())
+         ON CONFLICT (converge_id) DO UPDATE
+           SET last_seen_at = NOW(),
+               email = EXCLUDED.email,
+               name = EXCLUDED.name
+         RETURNING id`, [
+                convergePayload.sub,
+                convergePayload.email ?? null,
+                convergePayload.name,
+            ]);
+            const appUser = rows[0];
+            const sessionPayload = {
+                sub: appUser.id,
+                convergeId: convergePayload.sub,
+                name: convergePayload.name,
+                email: convergePayload.email ?? null,
+                language: convergePayload.language,
+                tenant: convergePayload.tenant,
+            };
+            const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: '8h' });
+            setSessionCookie(res, sessionToken);
+            res.json({
+                user: {
+                    id: appUser.id,
+                    convergeId: convergePayload.sub,
+                    name: convergePayload.name,
+                    email: convergePayload.email ?? null,
+                    tenant: convergePayload.tenant,
+                },
+            });
+        }
+        catch (err) {
+            console.error(JSON.stringify({ level: 'error', msg: 'Exchange error', err: String(err) }));
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    router.post('/logout', (_req, res) => {
+        res.clearCookie(getCookieName());
+        res.json({ ok: true });
+    });
+    router.get('/permissions', requireAuth, async (req, res) => {
+        try {
+            const keys = await (0, permissionClient_1.getUserPermissions)(req.user.convergeId);
+            res.json({ keys });
+        }
+        catch (err) {
+            console.error(JSON.stringify({ level: 'error', msg: 'Permissions lookup failed', err: String(err) }));
+            res.status(503).json({ error: 'Permission service unavailable' });
+        }
+    });
+    return router;
+}

package/backend/customPermissions.d.ts

@@ -0,0 +1,11 @@
+export interface CustomPermissionInput {
+    serviceKey: string;
+    key: string;
+    displayName: string;
+}
+export interface CustomPermissionResult {
+    id: string;
+    key: string;
+}
+export declare function createCustomPermission(input: CustomPermissionInput): Promise<CustomPermissionResult>;
+export declare function deleteCustomPermission(id: string): Promise<void>;

package/backend/customPermissions.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCustomPermission = createCustomPermission;
+exports.deleteCustomPermission = deleteCustomPermission;
+const serviceClient_1 = require("./serviceClient");
+async function createCustomPermission(input) {
+    if (!input.serviceKey)
+        throw new Error('createCustomPermission: serviceKey required');
+    if (!input.key)
+        throw new Error('createCustomPermission: key required');
+    if (!input.displayName)
+        throw new Error('createCustomPermission: displayName required');
+    return serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/permissions', {
+        serviceKey: input.serviceKey,
+        key: input.key,
+        displayName: input.displayName,
+    });
+}
+async function deleteCustomPermission(id) {
+    if (!id)
+        throw new Error('deleteCustomPermission: id required');
+    await serviceClient_1.serviceClient.call('converge_access', 'DELETE', `/api/internal/permissions/${encodeURIComponent(id)}`);
+}

package/backend/health.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { Pool } from 'pg';
+export declare function createHealthRouter(pool: Pool): Router;

package/backend/health.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHealthRouter = createHealthRouter;
+const express_1 = require("express");
+function createHealthRouter(pool) {
+    const router = (0, express_1.Router)();
+    router.get('/', (_req, res) => {
+        res.json({
+            status: 'ok',
+            version: process.env.npm_package_version ?? 'unknown',
+        });
+    });
+    router.get('/ready', async (_req, res) => {
+        try {
+            await pool.query('SELECT 1');
+            res.json({ status: 'ok' });
+        }
+        catch (err) {
+            res.json({ status: 'degraded', error: 'Database unreachable' });
+        }
+    });
+    return router;
+}

package/backend/i18n-backend.d.ts

@@ -0,0 +1,2 @@
+export declare function loadLocales(localesDir: string, languages?: string[]): void;
+export declare function t(key: string, lang?: string): string;

package/backend/i18n-backend.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadLocales = loadLocales;
+exports.t = t;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const locales = {};
+function loadLocales(localesDir, languages = ['de', 'en']) {
+    for (const lang of languages) {
+        try {
+            const data = (0, fs_1.readFileSync)((0, path_1.join)(localesDir, `${lang}.json`), 'utf-8');
+            locales[lang] = JSON.parse(data);
+        }
+        catch {
+            console.warn(`i18n: locale file for '${lang}' not found in ${localesDir}`);
+        }
+    }
+}
+function t(key, lang = 'de') {
+    return locales[lang]?.[key] ?? locales['de']?.[key] ?? key;
+}

package/backend/index.d.ts

@@ -0,0 +1,14 @@
+export * from './auth';
+export * from './health';
+export * from './audit';
+export * from './reporting';
+export * from './mail';
+export * from './notifications';
+export * from './permissions';
+export * from './permissionClient';
+export * from './permissionCheck';
+export * from './customPermissions';
+export * from './serviceClient';
+export * from './serviceDiscovery';
+export * from './apiRegistry';
+export * from './i18n-backend';

package/backend/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth"), exports);
+__exportStar(require("./health"), exports);
+__exportStar(require("./audit"), exports);
+__exportStar(require("./reporting"), exports);
+__exportStar(require("./mail"), exports);
+__exportStar(require("./notifications"), exports);
+__exportStar(require("./permissions"), exports);
+__exportStar(require("./permissionClient"), exports);
+__exportStar(require("./permissionCheck"), exports);
+__exportStar(require("./customPermissions"), exports);
+__exportStar(require("./serviceClient"), exports);
+__exportStar(require("./serviceDiscovery"), exports);
+__exportStar(require("./apiRegistry"), exports);
+__exportStar(require("./i18n-backend"), exports);

package/backend/mail.d.ts

@@ -0,0 +1,18 @@
+export interface MailAttachmentInput {
+    filename: string;
+    content_type: string;
+    data_b64: string;
+}
+export interface SendMailOptions {
+    to: string[];
+    cc?: string[];
+    bcc?: string[];
+    from?: string;
+    reply_to?: string;
+    subject: string;
+    body_text?: string;
+    body_html?: string;
+    attachments?: MailAttachmentInput[];
+    scheduled_for?: string;
+}
+export declare function sendMail(options: SendMailOptions): void;

package/backend/mail.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendMail = sendMail;
+function resolveUrl() {
+    if (process.env.MAIL_URL)
+        return process.env.MAIL_URL;
+    const gateway = process.env.CONVERGE_GATEWAY_URL;
+    if (gateway) {
+        return `${gateway.replace(/\/$/, '')}/api/gateway/converge_mail/api/mail/send`;
+    }
+    return null;
+}
+function sendMail(options) {
+    const url = resolveUrl();
+    if (!url)
+        return;
+    const headers = { 'Content-Type': 'application/json' };
+    const registryKey = process.env.SERVICE_AUTH_KEY;
+    if (registryKey)
+        headers['X-Service-Auth-Key'] = registryKey;
+    const sourceService = process.env.SERVICE_KEY ?? process.env.APP_NAME ?? 'unknown';
+    headers['X-Source-Service'] = sourceService;
+    const body = JSON.stringify({
+        to: options.to,
+        cc: options.cc ?? [],
+        bcc: options.bcc ?? [],
+        from: options.from,
+        reply_to: options.reply_to,
+        subject: options.subject,
+        body_text: options.body_text,
+        body_html: options.body_html,
+        attachments: options.attachments,
+        scheduled_for: options.scheduled_for,
+    });
+    fetch(url, { method: 'POST', headers, body }).catch((err) => {
+        console.error(JSON.stringify({
+            level: 'error',
+            msg: 'Mail send failed',
+            subject: options.subject,
+            err: String(err),
+        }));
+    });
+}

package/backend/notifications.d.ts

@@ -0,0 +1,9 @@
+export type NotificationType = 'info' | 'warning' | 'error';
+export interface SendNotificationOptions {
+    userId: string;
+    type?: NotificationType;
+    title: string;
+    body?: string;
+    link?: string;
+}
+export declare function sendNotification(options: SendNotificationOptions): void;

package/backend/notifications.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendNotification = sendNotification;
+function sendNotification(options) {
+    const url = process.env.NOTIFICATION_URL;
+    if (!url)
+        return;
+    const headers = { 'Content-Type': 'application/json' };
+    const registryKey = process.env.SERVICE_AUTH_KEY;
+    if (registryKey) {
+        headers['X-Service-Auth-Key'] = registryKey;
+    }
+    const body = JSON.stringify({
+        userId: options.userId,
+        type: options.type ?? 'info',
+        title: options.title,
+        body: options.body ?? null,
+        link: options.link ?? null,
+        sourceApp: process.env.APP_NAME ?? 'app',
+    });
+    fetch(url, { method: 'POST', headers, body }).catch((err) => {
+        console.error(JSON.stringify({ level: 'error', msg: 'Notification send failed', title: options.title, err: String(err) }));
+    });
+}

package/backend/permissionCheck.d.ts

@@ -0,0 +1 @@
+export declare function checkPermission(convergeId: string, key: string, sourceApp?: string): Promise<boolean>;

package/backend/permissionCheck.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkPermission = checkPermission;
+const serviceClient_1 = require("./serviceClient");
+async function checkPermission(convergeId, key, sourceApp) {
+    if (!convergeId)
+        throw new Error('checkPermission: convergeId required');
+    if (!key)
+        throw new Error('checkPermission: key required');
+    const { granted } = await serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/check-permission', { convergeId, key, sourceApp: sourceApp ?? process.env.APP_NAME ?? null });
+    return Boolean(granted);
+}

package/backend/permissionClient.d.ts

@@ -0,0 +1 @@
+export declare function getUserPermissions(convergeId: string): Promise<string[]>;

package/backend/permissionClient.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserPermissions = getUserPermissions;
+const serviceClient_1 = require("./serviceClient");
+async function getUserPermissions(convergeId) {
+    if (!convergeId) {
+        throw new Error('getUserPermissions: convergeId required');
+    }
+    const { keys } = await serviceClient_1.serviceClient.call('converge_access', 'GET', `/api/internal/users/${encodeURIComponent(convergeId)}/permissions`);
+    return keys ?? [];
+}

package/backend/permissions.d.ts

@@ -0,0 +1,11 @@
+export interface AppPermission {
+    key: string;
+    displayName: string;
+    level: number;
+}
+export declare function registerPermissions(serviceKey: string, permissions: AppPermission[], options?: {
+    registryBaseUrl?: string;
+    retries?: number;
+    retryDelayMs?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<void>;

package/backend/permissions.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPermissions = registerPermissions;
+function log(level, msg, extra) {
+    console.log(JSON.stringify({ level, msg, timestamp: new Date().toISOString(), ...extra }));
+}
+async function registerPermissions(serviceKey, permissions, options) {
+    if (permissions.length === 0)
+        return;
+    const gatewayUrl = (process.env.CONVERGE_GATEWAY_URL ?? '').replace(/\/$/, '');
+    const legacyUrl = (options?.registryBaseUrl ?? process.env.CONVERGE_REGISTRY_URL ?? '').replace(/\/$/, '');
+    let url;
+    if (gatewayUrl) {
+        url = `${gatewayUrl}/api/gateway/converge_access/api/internal/register`;
+    }
+    else if (legacyUrl) {
+        url = `${legacyUrl}/api/registry/services/${encodeURIComponent(serviceKey)}/permissions`;
+    }
+    else {
+        log('warn', 'registerPermissions: Weder CONVERGE_GATEWAY_URL noch CONVERGE_REGISTRY_URL gesetzt – übersprungen');
+        return;
+    }
+    const maxRetries = options?.retries ?? 3;
+    const retryDelay = options?.retryDelayMs ?? 5000;
+    const fetchImpl = options?.fetchImpl ?? fetch;
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+        try {
+            const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
+            const registryKey = process.env.SERVICE_AUTH_KEY;
+            if (registryKey)
+                headers['X-Service-Auth-Key'] = registryKey;
+            const res = await fetchImpl(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ serviceKey, permissions }),
+            });
+            if (res.ok) {
+                const body = await res.json();
+                log('info', 'Permissions registriert', {
+                    serviceKey,
+                    registered: body.registered,
+                });
+                return;
+            }
+            const errText = await res.text().catch(() => '');
+            log('warn', 'registerPermissions: Plattform antwortete mit Fehler', {
+                status: res.status,
+                body: errText,
+                attempt,
+            });
+        }
+        catch (err) {
+            log('warn', 'registerPermissions: Netzwerkfehler', {
+                err: String(err),
+                attempt,
+            });
+        }
+        if (attempt < maxRetries) {
+            await new Promise((r) => setTimeout(r, retryDelay));
+        }
+    }
+    log('error', 'registerPermissions: Konnte Permissions nicht registrieren nach allen Versuchen', {
+        serviceKey,
+        maxRetries,
+    });
+}

package/backend/reporting.d.ts

@@ -0,0 +1,6 @@
+type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export declare function reportEvent(eventType: string, payload?: Record<string, unknown>, token?: string): void;
+export declare function reportLog(level: LogLevel, message: string, context?: Record<string, unknown>, token?: string): void;
+export declare function reportMetric(metricName: string, value: number, dimensions?: Record<string, unknown>, token?: string): void;
+export declare function reportActivity(action: string, token?: string, userId?: string, resource?: string): void;
+export {};

package/backend/reporting.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportEvent = reportEvent;
+exports.reportLog = reportLog;
+exports.reportMetric = reportMetric;
+exports.reportActivity = reportActivity;
+function ingest(entries, token) {
+    const url = process.env.REPORTING_URL;
+    if (!url)
+        return;
+    const headers = { 'Content-Type': 'application/json' };
+    if (token)
+        headers['Authorization'] = `Bearer ${token}`;
+    fetch(url, { method: 'POST', headers, body: JSON.stringify(entries) }).catch((err) => {
+        console.error(JSON.stringify({ level: 'error', msg: 'Reporting ingest failed', err: String(err) }));
+    });
+}
+const appName = () => process.env.APP_NAME ?? 'app';
+const appVersion = () => process.env.APP_VERSION ?? 'dev';
+function reportEvent(eventType, payload, token) {
+    ingest([{ type: 'event', sourceApp: appName(), appVersion: appVersion(), eventType, payload }], token);
+}
+function reportLog(level, message, context, token) {
+    ingest([{ type: 'log', sourceApp: appName(), appVersion: appVersion(), level, message, context }], token);
+}
+function reportMetric(metricName, value, dimensions, token) {
+    ingest([{ type: 'metric', sourceApp: appName(), appVersion: appVersion(), metricName, value, dimensions }], token);
+}
+function reportActivity(action, token, userId, resource) {
+    ingest([{ type: 'activity', sourceApp: appName(), appVersion: appVersion(), action, resource }], token);
+}

package/backend/serviceClient.d.ts

@@ -0,0 +1,17 @@
+export interface ServiceClientOptions {
+    gatewayUrl?: string;
+    registryKey?: string;
+    fetchImpl?: typeof fetch;
+    retries?: number;
+    retryDelayMs?: number;
+}
+export declare class ServiceClient {
+    private gatewayUrl;
+    private registryKey;
+    private fetchImpl;
+    private retries;
+    private retryDelay;
+    constructor(options?: ServiceClientOptions);
+    call<T = unknown>(serviceKey: string, method: string, path: string, body?: unknown): Promise<T>;
+}
+export declare const serviceClient: ServiceClient;