@erxes/api-shared 0.0.0-stage → 3.2.19-1

package/src/utils/sanitize.ts

@@ -0,0 +1,73 @@
+import * as path from 'path';
+
+const Segmenter = (Intl as any).Segmenter;
+const segmenter = new Segmenter(undefined, { granularity: 'grapheme' });
+
+const truncate = (input: string, length: number): string => {
+  const segItr = segmenter.segment(input);
+  const segArr = Array.from(segItr, ({ segment }) => segment);
+  return segArr.slice(0, length).join('');
+};
+
+// Use a non-backtracking approach to remove trailing spaces and dots
+const removeTrailingSpacesAndDots = (str: string): string => {
+  let end = str.length;
+  while (end > 0 && (str[end - 1] === ' ' || str[end - 1] === '.')) {
+    end--;
+  }
+  return str.substring(0, end);
+};
+
+const illegalRe = /[/?<>\\:*|"]/g;
+// eslint-disable-next-line no-control-regex
+const controlRe = /[\x00-\x1f\x80-\x9f]/g;
+const reservedRe = /^\.+$/g;
+const windowsReservedRe = /^(con|prn|aux|nul|com\d|lpt\d)(\..*)?$/gi;
+
+export const sanitizeFilename = (input: string) => {
+  if (typeof input !== 'string') {
+    throw new TypeError('Input must be string');
+  }
+
+  let sanitized = input
+    .replaceAll(illegalRe, '')
+    .replaceAll(controlRe, '')
+    .replaceAll(reservedRe, '')
+    .replaceAll(windowsReservedRe, '');
+
+  sanitized = removeTrailingSpacesAndDots(sanitized);
+
+  return truncate(sanitized, 255);
+};
+
+export const sanitizeKey = (key: string): string => {
+  // Disallow empty keys
+  if (!key) throw new Error('Key cannot be empty');
+
+  // Disallow protocol schemes to prevent external URLs
+  if (/^https?:\/\//i.test(key)) {
+    throw new Error('Invalid key: protocol scheme not allowed');
+  }
+
+  // Disallow path traversal sequences
+  if (key.includes('..')) {
+    throw new Error('Invalid key: path traversal is not allowed');
+  }
+
+  // Allow alphanumeric, Unicode letters/marks (for non-Latin filenames),
+  // slash, dash, underscore, space, parentheses, and dot
+  if (!/^[a-zA-Z0-9/_\-., ()#@\p{L}\p{M}]+$/u.test(key)) {
+    throw new Error('Invalid key: contains disallowed characters');
+  }
+
+  // Normalize the key to remove redundant slashes or segments
+  // This uses path.posix to ensure forward slash normalization regardless of OS
+  const normalizedKey = path.posix.normalize(key);
+
+  // After normalization, check again for path traversal
+  if (normalizedKey.startsWith('..') || normalizedKey.includes('../')) {
+    throw new Error('Invalid key: path traversal detected after normalization');
+  }
+
+  return normalizedKey;
+};

package/src/utils/sentry-init.ts

@@ -0,0 +1,128 @@
+/**
+ * Shared Sentry initialization utilities for erxes services.
+ *
+ * Extracted to eliminate duplication across sentry-instrument.ts files
+ * (shared, core-api, gateway).
+ */
+
+import * as Sentry from '@sentry/node';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+function findUp(startDir: string, predicate: (dir: string) => boolean) {
+  let dir = startDir;
+  for (let i = 0; i < 25; i++) {
+    if (predicate(dir)) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return undefined;
+}
+
+function readTextSafe(filePath: string) {
+  try {
+    return fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return undefined;
+  }
+}
+
+function resolveGitSha(repoRoot: string) {
+  const gitDir = path.join(repoRoot, '.git');
+  const head = readTextSafe(path.join(gitDir, 'HEAD'))?.trim();
+  if (!head) return undefined;
+
+  if (!head.startsWith('ref:')) {
+    return head;
+  }
+
+  const ref = head.slice('ref:'.length).trim(); // refs/heads/main
+  const refPath = path.join(gitDir, ref);
+  const shaFromRef = readTextSafe(refPath)?.trim();
+  if (shaFromRef) return shaFromRef;
+
+  const packedRefs = readTextSafe(path.join(gitDir, 'packed-refs'));
+  if (!packedRefs) return undefined;
+
+  const lines = packedRefs.split('\n');
+  for (const line of lines) {
+    if (!line || line.startsWith('#') || line.startsWith('^')) continue;
+    const [sha, packedRef] = line.split(' ');
+    if (packedRef === ref && sha) return sha.trim();
+  }
+
+  return undefined;
+}
+
+function resolveRepoVersion(repoRoot: string) {
+  const pkgJson = readTextSafe(path.join(repoRoot, 'package.json'));
+  if (!pkgJson) return undefined;
+  try {
+    const parsed = JSON.parse(pkgJson) as { version?: string };
+    return parsed.version;
+  } catch {
+    return undefined;
+  }
+}
+
+function getSentryRelease() {
+  const fromEnv = process.env.SENTRY_RELEASE || process.env.RELEASE;
+  if (fromEnv) {
+    const normalized = fromEnv.trim();
+    const placeholders = new Set([
+      'master',
+      'main',
+      'latest',
+      'erxes-<git-sha-or-version>',
+      'erxes@<git-sha-or-version>',
+    ]);
+
+    if (!placeholders.has(normalized.toLowerCase())) {
+      return normalized;
+    }
+  }
+
+  const fromCiSha =
+    process.env.GIT_SHA ||
+    process.env.GITHUB_SHA ||
+    process.env.CI_COMMIT_SHA ||
+    process.env.VERCEL_GIT_COMMIT_SHA ||
+    process.env.BUILDKITE_COMMIT;
+  if (fromCiSha) return `erxes@${fromCiSha.slice(0, 12)}`;
+
+  const cwd = process.cwd();
+  const repoRoot = findUp(cwd, (dir) => fs.existsSync(path.join(dir, '.git')));
+  if (repoRoot) {
+    const sha = resolveGitSha(repoRoot);
+    if (sha) return `erxes@${sha.slice(0, 12)}`;
+
+    const version = resolveRepoVersion(repoRoot);
+    if (version) return `erxes@v${version}`;
+  }
+
+  return undefined;
+}
+
+/**
+ * Initialize Sentry with the standard erxes configuration.
+ *
+ * @param beforeSend - Optional beforeSend hook (e.g. sentryExpectedErrorFilter)
+ * @param serverName - Optional server name override (defaults to env or 'erxes')
+ */
+export function initErxesSentry(
+  beforeSend?: (event: Sentry.ErrorEvent, hint?: Sentry.EventHint) => PromiseLike<Sentry.ErrorEvent | null> | Sentry.ErrorEvent | null,
+  serverName?: string,
+) {
+  const dsn = process.env.SENTRY_DSN;
+  if (!dsn) return;
+
+  Sentry.init({
+    dsn,
+    environment: process.env.SENTRY_ENVIRONMENT || process.env.NODE_ENV,
+    release: getSentryRelease(),
+    serverName: serverName || process.env.SENTRY_SERVER_NAME,
+    tracesSampleRate: Number(process.env.SENTRY_TRACES_SAMPLE_RATE || 0),
+    ...(beforeSend ? { beforeSend } : {}),
+  });
+}

package/src/utils/sentry-instrument.ts

@@ -0,0 +1,5 @@
+import { initErxesSentry } from './sentry-init';
+import { sentryExpectedErrorFilter } from './errorClassifier';
+
+// Ensure to call this before importing any other modules!
+initErxesSentry(sentryExpectedErrorFilter);

package/src/utils/serializablePayload.test.ts

@@ -0,0 +1,65 @@
+import { toSerializablePayload } from './serializablePayload';
+
+describe('toSerializablePayload', () => {
+  test('keeps an object that is referenced twice', () => {
+    const scheduleDate = { type: 'pre', dateTime: '2026-09-21T04:00:00.000Z' };
+
+    // The shape a change log sends: the diff names the same subdocument the
+    // document it came from already carries.
+    const result = toSerializablePayload({
+      currentDocument: { _id: 'x', scheduleDate },
+      updateDescription: { added: { scheduleDate } },
+    });
+
+    expect(result.updateDescription.added.scheduleDate).toEqual(scheduleDate);
+    expect(result.currentDocument.scheduleDate).toEqual(scheduleDate);
+  });
+
+  test('keeps a whole document sent under two keys', () => {
+    const currentDocument = { _id: 'x', title: 'Campaign' };
+
+    const result = toSerializablePayload({
+      currentDocument,
+      fullDocument: currentDocument,
+    });
+
+    expect(result.fullDocument).toEqual(currentDocument);
+  });
+
+  test('breaks a value that contains itself', () => {
+    const parent: Record<string, unknown> = { name: 'parent' };
+    parent.self = parent;
+
+    expect(toSerializablePayload(parent)).toEqual({ name: 'parent' });
+  });
+
+  test('breaks a cycle through an array', () => {
+    const node: Record<string, unknown> = { name: 'node' };
+    node.children = [{ parent: node }];
+
+    expect(toSerializablePayload(node)).toEqual({
+      name: 'node',
+      children: [{}],
+    });
+  });
+
+  test('keeps siblings that are the same array', () => {
+    const tags = ['a', 'b'];
+
+    const result = toSerializablePayload({ before: tags, after: tags });
+
+    expect(result).toEqual({ before: ['a', 'b'], after: ['a', 'b'] });
+  });
+
+  test('leaves undefined alone', () => {
+    expect(toSerializablePayload(undefined)).toBeUndefined();
+  });
+
+  test('turns dates into strings, as the queue carries them', () => {
+    const at = new Date('2026-09-21T04:00:00.000Z');
+
+    expect(toSerializablePayload({ at })).toEqual({
+      at: '2026-09-21T04:00:00.000Z',
+    });
+  });
+});

package/src/utils/serializablePayload.ts

@@ -0,0 +1,44 @@
+/**
+ * A payload as the queue can carry it, with any cycle broken.
+ *
+ * A value is only a cycle when it contains itself, so the chain of holders is
+ * what is checked rather than everything met so far. Treating every second
+ * sighting of an object as a cycle dropped shared references, which is how a
+ * change log's `added` lost the very subdocument it was reporting: the diff
+ * names the same object the document it came from already carried.
+ */
+export const toSerializablePayload = <T>(payload: T): T => {
+  if (typeof payload === 'undefined') {
+    return payload;
+  }
+
+  const ancestors: unknown[] = [];
+
+  return JSON.parse(
+    JSON.stringify(
+      payload,
+      function (this: unknown, _key: string, value: unknown) {
+        if (typeof value !== 'object' || value === null) {
+          return value;
+        }
+
+        // `this` is the object holding the value, so unwinding to it leaves
+        // exactly this value's ancestors on the stack.
+        while (
+          ancestors.length &&
+          ancestors[ancestors.length - 1] !== this
+        ) {
+          ancestors.pop();
+        }
+
+        if (ancestors.includes(value)) {
+          return undefined;
+        }
+
+        ancestors.push(value);
+
+        return value;
+      },
+    ),
+  );
+};

package/src/utils/service-discovery.ts

@@ -0,0 +1,256 @@
+import * as dotenv from 'dotenv';
+import { redis } from './redis';
+import { getSaasOrganizationDetail } from './saas';
+import { getEnv } from './utils';
+import { IOrganizationCharge } from '../core-types';
+import { sendWorkerQueue } from './mq-worker';
+
+dotenv.config();
+
+const { NODE_ENV, LOAD_BALANCER_ADDRESS, MONGO_URL } = process.env;
+const GATEWAY_ROUTER_UPDATE_LOCK_KEY = 'gateway:update-apollo-router:pending';
+
+interface PluginConfig {
+  name: string;
+  port: number;
+  hasSubscriptions?: boolean;
+  meta?: any;
+}
+
+export const isDev = NODE_ENV === 'development';
+
+export const keyForConfig = (name: string) => `erxesservice:config:${name}`;
+
+export const getPlugins = async (): Promise<string[]> => {
+  const enabledServices: any[] =
+    process.env.ENABLED_PLUGINS?.split(',').map((plugin) => `${plugin}`) || [];
+
+  const enabledApiPlugins: any[] =
+    process.env.ENABLED_PLUGINS_ONLY_API?.split(',').map(
+      (plugin) => `${plugin}`,
+    ) || [];
+
+  return ['core', ...enabledServices, ...enabledApiPlugins];
+};
+
+const ACTIVE_PLUGINS_KEY = 'erxes-active-plugins';
+
+export const setActivePlugins = async (plugins: string[]): Promise<void> => {
+  await redis.set(ACTIVE_PLUGINS_KEY, JSON.stringify(plugins));
+};
+
+export const getActivePlugins = async (): Promise<string[]> => {
+  const data = await redis.get(ACTIVE_PLUGINS_KEY);
+
+  if (!data) {
+    return ['core'];
+  }
+
+  return JSON.parse(data);
+};
+
+export const getAvailablePlugins = async (
+  subdomain: string,
+): Promise<string[]> => {
+  const ENABLED_PLUGINS = getEnv({ name: 'ENABLED_PLUGINS' });
+  const ENABLED_API_PLUGINS = getEnv({ name: 'ENABLED_PLUGINS_ONLY_API' });
+
+  const VERSION = getEnv({ name: 'VERSION', defaultValue: 'os' });
+
+  if (VERSION && VERSION === 'saas') {
+    const organizationInfo = await getSaasOrganizationDetail({
+      subdomain,
+    });
+
+    const charges = organizationInfo.charge as IOrganizationCharge;
+
+    const plugins: string[] = [];
+
+    Object.keys(charges).forEach((key) => {
+      if (
+        (charges[key].purchased && charges[key].purchased > 0) ||
+        (charges[key].free && charges[key].free > 0)
+      ) {
+        const pluginName = key.split(':')[0];
+
+        const enabledPluginsArray = ENABLED_PLUGINS.split(',');
+        enabledPluginsArray.push(...ENABLED_API_PLUGINS.split(','));
+
+        if (enabledPluginsArray.includes(pluginName)) {
+          plugins.push(pluginName);
+        }
+      }
+    });
+    return ['core', ...plugins];
+  } else {
+    return getPlugins();
+  }
+};
+
+type ServiceInfo = { address: string; config: any };
+const serviceInfoCache: { [name in string]: Readonly<ServiceInfo> } = {};
+const pluginAddressCache = {} as any;
+
+export const clearServiceDiscoveryCache = (name?: string) => {
+  if (name) {
+    delete serviceInfoCache[name];
+    delete pluginAddressCache[name];
+    return;
+  }
+
+  Object.keys(serviceInfoCache).forEach((key) => delete serviceInfoCache[key]);
+  Object.keys(pluginAddressCache).forEach(
+    (key) => delete pluginAddressCache[key],
+  );
+};
+
+export const getPlugin = async (
+  name: string,
+): Promise<Readonly<ServiceInfo>> => {
+  if (serviceInfoCache[name]) {
+    return serviceInfoCache[name];
+  }
+
+  const result: ServiceInfo = {
+    address: (await redis.get(`erxes-service-${name}`)) || '',
+    config: { meta: {} },
+  };
+
+  const configJson = await redis.get(keyForConfig(name));
+  result.config = JSON.parse(configJson || '{}');
+
+  Object.freeze(result);
+  serviceInfoCache[name] = result;
+
+  return result;
+};
+
+export const joinErxesGateway = async ({
+  name,
+  port,
+  hasSubscriptions = false,
+  meta,
+}: PluginConfig) => {
+  const rawVersion = process.env.RELEASE_VERSION;
+  const releaseVersion = rawVersion?.startsWith('3.') ? rawVersion : 'latest';
+  // Lets a plugin serve its own UI remote (a local dev server or its own
+  // versioned CDN path) instead of the plugins.erxes.io release folder.
+  const uiEntry = process.env.UI_ENTRY_URL || undefined;
+
+  const existingConfigJson = await redis.get(keyForConfig(name));
+  const existingConfig = existingConfigJson
+    ? JSON.parse(existingConfigJson)
+    : {};
+
+  await redis.set(
+    keyForConfig(name),
+
+    JSON.stringify({
+      dbConnectionString: MONGO_URL,
+      hasSubscriptions,
+      meta: {
+        ...existingConfig?.meta,
+        ...meta,
+      },
+      releaseVersion,
+      uiEntry,
+    }),
+  );
+
+  const address =
+    LOAD_BALANCER_ADDRESS ||
+    `http://${isDev ? 'localhost' : `plugin-${name}-api`}:${port}`;
+
+  await redis.set(`erxes-service-${name}`, address);
+
+  if (NODE_ENV === 'production') {
+    try {
+      const didAcquireUpdateLock = await redis.set(
+        GATEWAY_ROUTER_UPDATE_LOCK_KEY,
+        '1',
+        'EX',
+        30,
+        'NX',
+      );
+
+      if (!didAcquireUpdateLock) {
+        console.log(
+          `gateway update-apollo-router already queued, skipped ${name}`,
+        );
+        console.log(`erxes-service${name} joined with ${address}`);
+        return;
+      }
+
+      await sendWorkerQueue('gateway', 'update-apollo-router').add(
+        'service-discovery-updated',
+        { pluginName: name },
+        {
+          delay: 10_000,
+          attempts: 3,
+          backoff: {
+            type: 'exponential',
+            delay: 1000,
+          },
+          removeOnComplete: true,
+          removeOnFail: 100,
+        },
+      );
+    } catch (e) {
+      console.error(e);
+    }
+  }
+
+  console.log(`erxes-service${name} joined with ${address}`);
+};
+
+export const leaveErxesGateway = async (name: string, port: number) => {
+  console.log(`erxes-service${name} left ${port}`);
+};
+
+export const isEnabled = async (name: string) => {
+  if (name === 'core') return true;
+
+  const enabledServices = await getPlugins();
+
+  return enabledServices.includes(name);
+};
+
+export const getPluginAddress = async (name: string) => {
+  if (!pluginAddressCache[name]) {
+    pluginAddressCache[name] = await redis.get(`erxes-service-${name}`);
+  }
+  return pluginAddressCache[name];
+};
+
+function getNonFunctionProps<T extends object>(obj: T): Partial<T> {
+  const result: Partial<T> = {};
+
+  for (const key of Object.keys(obj) as (keyof T)[]) {
+    if (typeof obj[key] !== 'function') {
+      result[key] = obj[key];
+    }
+  }
+
+  return result;
+}
+
+export const initializePluginConfig = async <TConfig extends object>(
+  pluginName: string,
+  propertyName: string,
+  config: TConfig,
+) => {
+  const pluginConfig = await redis.get(keyForConfig(pluginName));
+  const configJSON = JSON.parse(pluginConfig || '{}');
+
+  await redis.set(
+    keyForConfig(pluginName),
+
+    JSON.stringify({
+      ...configJSON,
+      meta: {
+        ...configJSON?.meta,
+        [propertyName]: getNonFunctionProps<TConfig>(config),
+      },
+    }),
+  );
+};