@erxes/api-shared 0.0.0-stage → 3.2.19-2

package/src/core-modules/notifications/definitions/notificationSettings.ts

@@ -0,0 +1,67 @@
+import { Schema } from 'mongoose';
+
+export interface NotificationChannelMetadata {
+  [key: string]: unknown;
+}
+
+export interface NotificationChannel {
+  enabled: boolean;
+  metadata?: NotificationChannelMetadata;
+}
+
+export interface NotificationEvent {
+  enabled: boolean;
+  channels: string[];
+}
+
+export interface NotificationSettings {
+  userId: string;
+  channels: Map<string, NotificationChannel>;
+  events: Map<string, NotificationEvent>;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+const notificationChannelSchema = new Schema(
+  {
+    enabled: { type: Boolean, default: false },
+    metadata: Schema.Types.Mixed,
+  },
+  { _id: false },
+);
+
+const notifcationEventSchema = new Schema(
+  {
+    enabled: { type: Boolean, default: false },
+    channels: { type: [String], default: [] },
+  },
+  {
+    _id: false,
+  },
+);
+
+export const notificationSettingsSchema = new Schema(
+  {
+    userId: {
+      type: String,
+      required: true,
+      unique: true,
+      index: true,
+    },
+
+    channels: {
+      type: Map,
+      of: notificationChannelSchema,
+      default: {},
+    },
+
+    events: {
+      type: Map,
+      of: notifcationEventSchema,
+      default: {},
+    },
+  },
+  {
+    timestamps: true,
+  },
+);

package/src/core-modules/notifications/definitions/notifications.ts

@@ -0,0 +1,130 @@
+import { Document, Schema } from 'mongoose';
+
+// Notification schema for in-app notifications
+export interface INotificationDocument extends Document {
+  _id: string;
+  title: string;
+  message: string;
+  type: 'info' | 'success' | 'warning' | 'error';
+
+  // Recipients and sender
+  userId: string;
+  fromUserId?: string;
+
+  // Source information for plugin widgets
+  contentType: string;
+  contentTypeId?: string; // target object ID
+
+  // Status
+  isRead: boolean;
+  readAt?: Date;
+
+  // Additional data
+  priority: 'low' | 'medium' | 'high' | 'urgent';
+  priorityLevel: 1 | 2 | 3 | 4;
+  metadata?: any; // plugin-specific data
+  action?: string;
+
+  // Timestamps
+  createdAt: Date;
+  expiresAt?: Date; // Auto-cleanup old notifications
+  updatedAt?: Date;
+  kind: 'system' | 'user';
+}
+
+export const notificationSchema = new Schema(
+  {
+    title: {
+      type: String,
+      required: true,
+      maxlength: 200,
+    },
+
+    message: {
+      type: String,
+      required: true,
+      maxlength: 1000,
+    },
+
+    type: {
+      type: String,
+      enum: ['info', 'success', 'warning', 'error'],
+      required: true,
+      default: 'info',
+    },
+
+    userId: {
+      type: String,
+      required: true,
+    },
+
+    fromUserId: {
+      type: String,
+    },
+
+    contentType: {
+      type: String,
+    },
+
+    contentTypeId: {
+      type: String,
+    },
+
+    isRead: {
+      type: Boolean,
+      default: false,
+      index: true,
+    },
+
+    readAt: {
+      type: Date,
+    },
+
+    priority: {
+      type: String,
+      enum: ['low', 'medium', 'high', 'urgent'],
+      default: 'medium',
+    },
+
+    priorityLevel: {
+      type: String,
+      enum: [1, 2, 3, 4],
+      default: 2,
+      required: true,
+    },
+
+    metadata: {
+      type: Schema.Types.Mixed,
+    },
+
+    createdAt: {
+      type: Date,
+      default: Date.now,
+      index: true,
+    },
+
+    expiresAt: {
+      type: Date,
+    },
+
+    action: {
+      type: String,
+      index: true,
+      optional: true,
+    },
+
+    kind: {
+      type: String,
+      enum: ['system', 'user'],
+      default: 'user',
+      index: true,
+    },
+  },
+  { timestamps: true },
+);
+
+// Compound indexes for efficient queries
+notificationSchema.index({ userId: 1, createdAt: -1 });
+notificationSchema.index({ userId: 1, isRead: 1, createdAt: -1 });
+notificationSchema.index({ contentType: 1, contentTypeId: 1 });
+notificationSchema.index({ expiresAt: 1 }); // MongoDB TTL index

package/src/core-modules/notifications/emailUtils.ts

@@ -0,0 +1,88 @@
+import { IUserDocument } from '../../core-types';
+import { sendTRPCMessage } from '../../utils';
+import { INotificationData } from './utils';
+
+export const getUserDetail = async (subdomain: string, userId?: string) => {
+  if (!userId) {
+    return;
+  }
+
+  const user: IUserDocument = await sendTRPCMessage({
+    subdomain,
+
+    pluginName: 'core',
+    method: 'query',
+    module: 'users',
+    action: 'findOne',
+    input: { query: { _id: userId } },
+    defaultValue: {},
+  });
+
+  if (user.details) {
+    return `${user.details?.firstName || ''} ${user.details?.lastName || ''}`;
+  }
+
+  return user.email;
+};
+
+export const sendNotificationEmail = async (
+  subdomain: string,
+  notification: {
+    userIds: string[];
+    notificationType?: string;
+    fromUserId?: string;
+  } & Partial<INotificationData>,
+) => {
+  const { userIds, message, fromUserId } = notification || {};
+
+  const toEmails: string[] = [];
+
+  const users: IUserDocument[] = await sendTRPCMessage({
+    subdomain,
+
+    pluginName: 'core',
+    method: 'query',
+    module: 'users',
+    action: 'find',
+    input: { query: { _id: { $in: userIds }, isActive: true } },
+    defaultValue: [],
+  });
+
+  for (const user of users) {
+    const { _id, email, isActive } = user || {};
+
+    if (!userIds.includes(_id)) {
+      continue;
+    }
+
+    if (!email || !isActive) {
+      continue;
+    }
+
+    toEmails.push(email);
+  }
+
+  await sendTRPCMessage({
+    subdomain,
+
+    pluginName: 'core',
+    method: 'mutation',
+    module: 'notifications',
+    action: 'sendEmail',
+    input: {
+      toEmails,
+      title: 'Notification',
+      template: {
+        name: 'notification',
+        data: {
+          notification,
+          action: message,
+          userName: await getUserDetail(subdomain, fromUserId),
+          date: new Date().toLocaleString(),
+        },
+      },
+      userId: fromUserId,
+    },
+    defaultValue: [],
+  });
+};

package/src/core-modules/notifications/index.ts

@@ -0,0 +1,7 @@
+export * from './definitions/emailAddresses';
+export * from './definitions/emailDeliveries';
+export * from './definitions/emailRamp';
+export * from './definitions/emailSenders';
+export * from './definitions/notifications';
+export * from './definitions/notificationSettings';
+export * from './utils';

package/src/core-modules/notifications/utils.ts

@@ -0,0 +1,143 @@
+import { Types } from 'mongoose';
+import { z } from 'zod';
+import { sendTRPCMessage } from '../../utils';
+import { sendNotificationEmail } from './emailUtils';
+
+const baseNotificationSchema = z.object({
+  title: z.string(),
+  message: z.string(),
+  type: z.enum(['info', 'success', 'warning', 'error']),
+  priority: z.enum(['low', 'medium', 'high', 'urgent']).optional(),
+  metadata: z.record(z.any()).optional(),
+
+  contentType: z.string(),
+  content: z.string().optional(),
+});
+
+const systemNotificationSchema = baseNotificationSchema.extend({
+  kind: z.literal('system'),
+});
+
+// User notification
+const userNotificationSchema = baseNotificationSchema.extend({
+  kind: z.literal('user').default('user'),
+  fromUserId: z.string(),
+  action: z.string(),
+  notificationType: z.string(),
+  allowMultiple: z.boolean().default(false),
+
+  contentTypeId: z.union([z.string(), z.instanceof(Types.ObjectId)]),
+});
+
+// Union for notification
+export const notificationZTypeSchema = z.discriminatedUnion('kind', [
+  systemNotificationSchema,
+  userNotificationSchema,
+]);
+
+export type INotificationData = z.infer<typeof notificationZTypeSchema>;
+
+export const sendNotification = async (
+  subdomain: string,
+  data: {
+    userIds: string[];
+    notificationType?: string;
+  } & Partial<INotificationData>,
+) => {
+  const { userIds, kind, notificationType, ...notificationData } = data;
+
+  const parsedData = notificationZTypeSchema.parse({
+    ...notificationData,
+    notificationType,
+    kind: kind ?? 'user',
+  });
+
+  await sendTRPCMessage({
+    subdomain,
+
+    pluginName: 'core',
+    method: 'mutation',
+    module: 'notifications',
+    action: 'create',
+    input: { data: parsedData, userIds },
+    defaultValue: [],
+  });
+
+  if (notificationType) {
+    await sendNotificationChannels(subdomain, data);
+  }
+};
+
+export const sendNotificationChannels = async (
+  subdomain: string,
+  notification: {
+    userIds: string[];
+    notificationType?: string;
+    fromUserId?: string;
+  } & Partial<INotificationData>,
+) => {
+  const {
+    notificationType: eventName,
+    userIds,
+    contentType,
+    fromUserId,
+  } = notification || {};
+
+  if (!contentType) return;
+
+  const [pluginName = '', moduleName = ''] = contentType.split(':');
+
+  const userNotificationSettings = await sendTRPCMessage({
+    subdomain,
+
+    pluginName: 'core',
+    method: 'query',
+    module: 'notifications',
+    action: 'settings',
+    input: { userIds },
+    defaultValue: [],
+  });
+
+  const recipientIds: Record<string, string[]> = { email: [] };
+
+  for (const userNotificationSetting of userNotificationSettings) {
+    const { userId, events } = userNotificationSetting || {};
+
+    if (fromUserId && userId === fromUserId) {
+      continue;
+    }
+
+    if (!userIds.includes(userId)) {
+      continue;
+    }
+
+    if (!events?.[pluginName]?.enabled) {
+      continue;
+    }
+
+    if (!events?.[`${pluginName}:${moduleName}`]?.enabled) {
+      continue;
+    }
+
+    if (!events?.[`${pluginName}:${moduleName}:${eventName}`]?.enabled) {
+      continue;
+    }
+
+    const channels = events?.[pluginName]?.channels || [];
+
+    if (!channels.length) {
+      continue;
+    }
+
+    if (channels.includes('email')) {
+      recipientIds['email'].push(userId);
+    }
+  }
+
+  if (recipientIds['email']?.length) {
+    await sendNotificationEmail(subdomain, {
+      ...notification,
+      userIds: recipientIds['email'],
+    });
+  }
+};

package/src/core-modules/permissions/db/definitions/permissions.ts

@@ -0,0 +1,82 @@
+import { Schema } from 'mongoose';
+import { mongooseField, schemaWrapper } from '../../../../utils';
+
+export const permissionGroupSchema = schemaWrapper(
+  new Schema(
+    {
+      _id: mongooseField({ pkey: true }),
+      name: mongooseField({ type: String, label: 'Name' }),
+      description: mongooseField({ type: String, label: 'Description' }),
+      permissions: mongooseField({
+        type: [
+          {
+            plugin: { type: String },
+            module: { type: String },
+            actions: { type: [String] },
+            scope: { type: String, enum: ['own', 'group', 'all'] },
+          },
+        ],
+        default: [],
+        label: 'Permissions',
+      }),
+    },
+    { timestamps: true },
+  ),
+);
+
+// DEPRECATED - Keep for migration, remove later
+export const userGroupSchema = schemaWrapper(
+  new Schema({
+    _id: mongooseField({ pkey: true }),
+    name: mongooseField({ type: String, unique: true, label: 'Name' }),
+    description: mongooseField({ type: String, label: 'Description' }),
+    branchIds: mongooseField({
+      type: [String],
+      label: 'Branches',
+      optional: true,
+    }),
+    departmentIds: mongooseField({
+      type: [String],
+      label: 'Departments',
+      optional: true,
+    }),
+  }),
+);
+
+// DEPRECATED - Keep for migration, remove later
+export const permissionSchema = schemaWrapper(
+  new Schema({
+    _id: mongooseField({ pkey: true }),
+    plugin: mongooseField({ type: String, label: 'Plugin' }),
+    module: mongooseField({ type: String, label: 'Module' }),
+    action: mongooseField({ type: String, label: 'Action' }),
+    userId: mongooseField({ type: String, label: 'User' }),
+    groupId: mongooseField({ type: String, label: 'User group' }),
+    requiredActions: mongooseField({
+      type: [String],
+      default: [],
+      label: 'Required actions',
+    }),
+    allowed: mongooseField({ type: Boolean, default: false, label: 'Allowed' }),
+  }),
+);
+
+// DEPRECATED - Remove
+export const roleSchema = new Schema(
+  {
+    userId: {
+      type: String,
+      label: 'User',
+      index: true,
+      unique: true,
+      required: true,
+    },
+    role: {
+      type: String,
+      label: 'Role',
+      index: true,
+      required: true,
+    },
+  },
+  { timestamps: true },
+);

package/src/core-modules/permissions/index.ts

@@ -0,0 +1,3 @@
+export * from './db/definitions/permissions';
+export * from './user-actions-map';
+export * from './utils';

package/src/core-modules/permissions/oauth-scopes.test.ts

@@ -0,0 +1,102 @@
+const mockRedis = { get: jest.fn(), set: jest.fn(), del: jest.fn() };
+const mockGetActivePlugins = jest.fn();
+const mockGetPlugin = jest.fn();
+const mockSendTRPCMessage = jest.fn();
+
+jest.mock('../../utils', () => ({
+  redis: mockRedis,
+  getActivePlugins: (...args: unknown[]) => mockGetActivePlugins(...args),
+  getPlugin: (...args: unknown[]) => mockGetPlugin(...args),
+  sendTRPCMessage: (...args: unknown[]) => mockSendTRPCMessage(...args),
+  ExpectedError: class ExpectedError extends Error {},
+}));
+
+import type { IUserDocument } from '../../core-types';
+import { checkPermissionGroup, resolveActionOAuthScopes } from './utils';
+
+const user = (overrides: Record<string, unknown> = {}) =>
+  ({
+    _id: 'user-1',
+    permissionGroupIds: [],
+    customPermissions: [],
+    ...overrides,
+  }) as unknown as IUserDocument;
+
+const salesPlugin = {
+  config: {
+    meta: {
+      permissions: {
+        modules: [
+          {
+            name: 'deal',
+            actions: [
+              { name: 'showDeals', title: 'Show deals', description: '' },
+              { name: 'dealsAdd', title: 'Add deals', description: '' },
+            ],
+          },
+        ],
+      },
+    },
+  },
+};
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockRedis.get.mockResolvedValue(null);
+  mockRedis.set.mockResolvedValue(undefined);
+  mockRedis.del.mockResolvedValue(undefined);
+  mockGetActivePlugins.mockResolvedValue(['sales']);
+  mockGetPlugin.mockResolvedValue(salesPlugin);
+  mockSendTRPCMessage.mockResolvedValue([]);
+});
+
+describe('oauth scopes for plugin actions', () => {
+  it('keeps declared scopes and derives a module scope when none is declared', () => {
+    expect(
+      resolveActionOAuthScopes(
+        'core',
+        { name: 'contact' },
+        { oauthScope: 'contacts:read' },
+      ),
+    ).toEqual(['contacts:read']);
+    expect(
+      resolveActionOAuthScopes(
+        'core',
+        { name: 'contact' },
+        { oauthScopes: ['contacts:read', 'contacts:create'] },
+      ),
+    ).toEqual(['contacts:read', 'contacts:create']);
+    expect(resolveActionOAuthScopes('sales', { name: 'deal' }, {})).toEqual([
+      'sales-deal:manage',
+    ]);
+  });
+
+  it('lets an oauth token with the derived module scope call plugin actions', async () => {
+    const check = checkPermissionGroup(
+      'sub',
+      user({ isOwner: true, oauthScopes: ['sales-deal:manage'] }),
+    );
+    await expect(check('dealsAdd')).resolves.toBeUndefined();
+  });
+
+  it('still rejects an oauth token that lacks the module scope', async () => {
+    const check = checkPermissionGroup(
+      'sub',
+      user({ isOwner: true, oauthScopes: ['contacts:read'] }),
+    );
+    await expect(check('dealsAdd')).rejects.toThrow('OAuth scope required');
+  });
+
+  it('refuses an oauth token that was granted no scopes at all', async () => {
+    const check = checkPermissionGroup(
+      'sub',
+      user({ isOwner: true, oauthScopes: [] }),
+    );
+    await expect(check('dealsAdd')).rejects.toThrow('OAuth scope required');
+  });
+
+  it('does not scope-check non-oauth sessions', async () => {
+    const check = checkPermissionGroup('sub', user({ isOwner: true }));
+    await expect(check('dealsAdd')).resolves.toBeUndefined();
+  });
+});