@fluyappgocore/commons-backend 1.0.210 → 1.0.212

package/build/lib/ensureDatabase.d.ts

@@ -1,5 +1,6 @@
 /**
- * Ensures a PostgreSQL database exists before connecting.
+ * Ensures a database exists before connecting.
+ * Supports PostgreSQL, MySQL, and MSSQL.
  * Uses dynamic require of 'sequelize' which is available in each MS.
  */
 export declare function ensureDatabase(opts: {
@@ -8,4 +9,6 @@ export declare function ensureDatabase(opts: {
     dbPassword: string;
     dbHost: string;
     ssl?: boolean;
+    dialect?: string;
+    port?: number;
 }): Promise<void>;

package/build/lib/ensureDatabase.js

@@ -38,58 +38,82 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureDatabase = void 0;
 /**
- * Ensures a PostgreSQL database exists before connecting.
+ * Ensures a database exists before connecting.
+ * Supports PostgreSQL, MySQL, and MSSQL.
  * Uses dynamic require of 'sequelize' which is available in each MS.
  */
 function ensureDatabase(opts) {
     var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var dbName, dbUser, dbPassword, dbHost, ssl, Sequelize, adminConnection, results, error_1, _b;
+        var dbName, dbUser, dbPassword, dbHost, ssl, dialect, port, Sequelize, systemDb, adminConnection, results, results, error_1, code, _b;
         return __generator(this, function (_c) {
             switch (_c.label) {
                 case 0:
                     dbName = opts.dbName, dbUser = opts.dbUser, dbPassword = opts.dbPassword, dbHost = opts.dbHost, ssl = opts.ssl;
+                    dialect = opts.dialect || process.env.DB_DIALECT || "postgres";
+                    port = opts.port || parseInt(process.env.DB_PORT || "5432", 10);
                     _c.label = 1;
                 case 1:
-                    _c.trys.push([1, 10, , 11]);
+                    _c.trys.push([1, 16, , 17]);
                     Sequelize = require("sequelize").Sequelize;
-                    adminConnection = new Sequelize("postgres", dbUser, dbPassword, {
+                    systemDb = dialect === "mssql" ? "master" : dialect === "mysql" ? undefined : "postgres";
+                    adminConnection = new Sequelize(systemDb || "", dbUser, dbPassword, {
                         host: dbHost,
-                        dialect: "postgres",
+                        port: port,
+                        dialect: dialect,
                         logging: false,
-                        dialectOptions: ssl
-                            ? { ssl: { require: true, rejectUnauthorized: false } }
-                            : {},
+                        dialectOptions: dialect === "mssql"
+                            ? { options: { encrypt: !!ssl, trustServerCertificate: true } }
+                            : ssl
+                                ? { ssl: { require: true, rejectUnauthorized: false } }
+                                : {},
                     });
                     _c.label = 2;
                 case 2:
-                    _c.trys.push([2, 6, 7, 9]);
-                    return [4 /*yield*/, adminConnection.query("SELECT 1 FROM pg_database WHERE datname = '" + dbName + "'")];
+                    _c.trys.push([2, 12, 13, 15]);
+                    if (!(dialect === "mssql")) return [3 /*break*/, 6];
+                    return [4 /*yield*/, adminConnection.query("SELECT name FROM sys.databases WHERE name = N'" + dbName + "'")];
                 case 3:
                     results = (_c.sent())[0];
                     if (!(results.length === 0)) return [3 /*break*/, 5];
-                    return [4 /*yield*/, adminConnection.query("CREATE DATABASE \"" + dbName + "\"")];
+                    return [4 /*yield*/, adminConnection.query("CREATE DATABASE [" + dbName + "]")];
                 case 4:
                     _c.sent();
-                    console.log("[DB] Database \"" + dbName + "\" created successfully");
+                    console.log("[DB] Database \"" + dbName + "\" created (mssql)");
                     _c.label = 5;
-                case 5: return [3 /*break*/, 9];
+                case 5: return [3 /*break*/, 11];
                 case 6:
+                    if (!(dialect === "mysql" || dialect === "mariadb")) return [3 /*break*/, 8];
+                    return [4 /*yield*/, adminConnection.query("CREATE DATABASE IF NOT EXISTS `" + dbName + "`")];
+                case 7:
+                    _c.sent();
+                    return [3 /*break*/, 11];
+                case 8: return [4 /*yield*/, adminConnection.query("SELECT 1 FROM pg_database WHERE datname = '" + dbName + "'")];
+                case 9:
+                    results = (_c.sent())[0];
+                    if (!(results.length === 0)) return [3 /*break*/, 11];
+                    return [4 /*yield*/, adminConnection.query("CREATE DATABASE \"" + dbName + "\"")];
+                case 10:
+                    _c.sent();
+                    console.log("[DB] Database \"" + dbName + "\" created (postgres)");
+                    _c.label = 11;
+                case 11: return [3 /*break*/, 15];
+                case 12:
                     error_1 = _c.sent();
-                    // 42P04 = database already exists (race condition safe)
-                    if (((_a = error_1 === null || error_1 === void 0 ? void 0 : error_1.original) === null || _a === void 0 ? void 0 : _a.code) !== "42P04") {
+                    code = (_a = error_1 === null || error_1 === void 0 ? void 0 : error_1.original) === null || _a === void 0 ? void 0 : _a.code;
+                    if (code !== "42P04" && code !== 1007 && code !== "S0001") {
                         console.error("[DB] Error ensuring database \"" + dbName + "\":", error_1.message);
                     }
-                    return [3 /*break*/, 9];
-                case 7: return [4 /*yield*/, adminConnection.close()];
-                case 8:
+                    return [3 /*break*/, 15];
+                case 13: return [4 /*yield*/, adminConnection.close()];
+                case 14:
                     _c.sent();
                     return [7 /*endfinally*/];
-                case 9: return [3 /*break*/, 11];
-                case 10:
+                case 15: return [3 /*break*/, 17];
+                case 16:
                     _b = _c.sent();
-                    return [3 /*break*/, 11];
-                case 11: return [2 /*return*/];
+                    return [3 /*break*/, 17];
+                case 17: return [2 /*return*/];
             }
         });
     });

package/build/middlewares/guestAuth.middleware.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Guest-JWT auth for the customer-facing portal.
+ *
+ * Three token levels, each signed with the shared JWT_KEY env var so
+ * every microservice (moving, video, agents) can verify them without a
+ * network round-trip:
+ *
+ *   - guest   → "I'm a visitor at entity X, branch Y" (30 min, no ticket)
+ *   - ticket  → "I'm the holder of ticket T at entity X, branch Y" (2 h)
+ *   - (livekit tokens are minted separately by livekit-server-sdk and
+ *      are NOT part of this module — they live inside msvideo)
+ *
+ * Usage in any express app:
+ *
+ *   import { verifyPortalToken, requireScope } from "@fluyappgocore/commons-backend";
+ *
+ *   router.get("/queue",
+ *     verifyPortalToken,
+ *     requireScope("guest"),  // accepts guest OR ticket
+ *     handler,
+ *   );
+ *
+ *   router.get("/tickets/:uuid",
+ *     verifyPortalToken,
+ *     requireScope("ticket"),
+ *     requireTicketMatch("uuid"),
+ *     handler,
+ *   );
+ */
+import { NextFunction, Request, Response } from "express";
+export declare type PortalScope = "guest" | "ticket";
+export interface PortalClaims {
+    /** "guest:<uuid>" or "ticket:<ticketUuid>" — useful for audit/rate-limit */
+    sub: string;
+    /** JWT audience, always "portal" so we don't cross-verify with user tokens */
+    aud: "portal";
+    scope: PortalScope;
+    entityUuid: string;
+    branchUuid: string;
+    /** Present iff scope === "ticket" */
+    ticketUuid?: string;
+    iat: number;
+    exp: number;
+}
+export interface RequestWithPortal extends Request {
+    portalAuth?: PortalClaims;
+}
+/** Issue a fresh guest token for a visitor who just landed on a branch URL. */
+export declare function issueGuestToken(input: {
+    entityUuid: string;
+    branchUuid: string;
+}): {
+    token: string;
+    expiresAt: number;
+};
+/** Upgrade a guest into a ticket holder after POST /tickets succeeds. */
+export declare function issueTicketToken(input: {
+    entityUuid: string;
+    branchUuid: string;
+    ticketUuid: string;
+}): {
+    token: string;
+    expiresAt: number;
+};
+/**
+ * Express middleware: reads `Authorization: Bearer <token>`, verifies the
+ * signature, decodes the claims, attaches them as `req.portalAuth`.
+ *
+ * Rejects anything that isn't a portal-scoped token (aud !== "portal")
+ * so a regular user/agent JWT can NEVER accidentally pass this gate.
+ */
+export declare function verifyPortalToken(req: RequestWithPortal, _res: Response, next: NextFunction): void;
+/**
+ * Gate a route by scope.
+ *
+ * `requireScope("guest")` accepts BOTH guest and ticket tokens (ticket
+ * implies guest, since a ticket holder is also a visitor at that branch).
+ *
+ * `requireScope("ticket")` accepts only ticket tokens.
+ */
+export declare function requireScope(minimum: PortalScope): (req: RequestWithPortal, _res: Response, next: NextFunction) => void;
+/**
+ * Guard that the `ticketUuid` claim inside the JWT matches the URL param.
+ * Prevents a ticket holder from reading someone else's ticket by tampering
+ * with the path.
+ */
+export declare function requireTicketMatch(paramName?: string): (req: RequestWithPortal, _res: Response, next: NextFunction) => void;
+/**
+ * Guard that the `branchUuid` claim inside the JWT matches the URL param
+ * or body field. Same idea, one layer up.
+ */
+export declare function requireBranchMatch(source: "params" | "body", fieldName: string): (req: RequestWithPortal, _res: Response, next: NextFunction) => void;

package/build/middlewares/guestAuth.middleware.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireBranchMatch = exports.requireTicketMatch = exports.requireScope = exports.verifyPortalToken = exports.issueTicketToken = exports.issueGuestToken = void 0;
+var jwt = __importStar(require("jsonwebtoken"));
+var exceptions_1 = require("../exceptions");
+var SECRET = process.env.JWT_KEY || "";
+var GUEST_TTL_SEC = 30 * 60; // 30 minutes
+var TICKET_TTL_SEC = 2 * 60 * 60; // 2 hours
+function randomId() {
+    return (Date.now().toString(36) +
+        Math.random().toString(36).slice(2, 10));
+}
+/** Issue a fresh guest token for a visitor who just landed on a branch URL. */
+function issueGuestToken(input) {
+    var now = Math.floor(Date.now() / 1000);
+    var exp = now + GUEST_TTL_SEC;
+    var payload = {
+        sub: "guest:" + randomId(),
+        aud: "portal",
+        scope: "guest",
+        entityUuid: input.entityUuid,
+        branchUuid: input.branchUuid,
+        iat: now,
+        exp: exp,
+    };
+    var token = jwt.sign(payload, SECRET, { algorithm: "HS256" });
+    return { token: token, expiresAt: exp * 1000 };
+}
+exports.issueGuestToken = issueGuestToken;
+/** Upgrade a guest into a ticket holder after POST /tickets succeeds. */
+function issueTicketToken(input) {
+    var now = Math.floor(Date.now() / 1000);
+    var exp = now + TICKET_TTL_SEC;
+    var payload = {
+        sub: "ticket:" + input.ticketUuid,
+        aud: "portal",
+        scope: "ticket",
+        entityUuid: input.entityUuid,
+        branchUuid: input.branchUuid,
+        ticketUuid: input.ticketUuid,
+        iat: now,
+        exp: exp,
+    };
+    var token = jwt.sign(payload, SECRET, { algorithm: "HS256" });
+    return { token: token, expiresAt: exp * 1000 };
+}
+exports.issueTicketToken = issueTicketToken;
+/**
+ * Express middleware: reads `Authorization: Bearer <token>`, verifies the
+ * signature, decodes the claims, attaches them as `req.portalAuth`.
+ *
+ * Rejects anything that isn't a portal-scoped token (aud !== "portal")
+ * so a regular user/agent JWT can NEVER accidentally pass this gate.
+ */
+function verifyPortalToken(req, _res, next) {
+    var _a;
+    var auth = (_a = req.headers) === null || _a === void 0 ? void 0 : _a.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) {
+        return next(new exceptions_1.HttpException(401, "Missing portal token"));
+    }
+    var token = auth.slice("Bearer ".length).trim();
+    try {
+        var decoded = jwt.verify(token, SECRET, {
+            algorithms: ["HS256"],
+        });
+        if (decoded.aud !== "portal") {
+            return next(new exceptions_1.HttpException(401, "Invalid token audience"));
+        }
+        req.portalAuth = decoded;
+        return next();
+    }
+    catch (err) {
+        return next(new exceptions_1.HttpException(401, (err === null || err === void 0 ? void 0 : err.name) === "TokenExpiredError"
+            ? "Portal token expired"
+            : "Invalid portal token"));
+    }
+}
+exports.verifyPortalToken = verifyPortalToken;
+/**
+ * Gate a route by scope.
+ *
+ * `requireScope("guest")` accepts BOTH guest and ticket tokens (ticket
+ * implies guest, since a ticket holder is also a visitor at that branch).
+ *
+ * `requireScope("ticket")` accepts only ticket tokens.
+ */
+function requireScope(minimum) {
+    return function (req, _res, next) {
+        if (!req.portalAuth) {
+            return next(new exceptions_1.HttpException(401, "Portal token not verified"));
+        }
+        if (minimum === "ticket" && req.portalAuth.scope !== "ticket") {
+            return next(new exceptions_1.HttpException(403, "Ticket-scoped token required"));
+        }
+        return next();
+    };
+}
+exports.requireScope = requireScope;
+/**
+ * Guard that the `ticketUuid` claim inside the JWT matches the URL param.
+ * Prevents a ticket holder from reading someone else's ticket by tampering
+ * with the path.
+ */
+function requireTicketMatch(paramName) {
+    if (paramName === void 0) { paramName = "uuid"; }
+    return function (req, _res, next) {
+        var _a, _b;
+        var claimed = (_a = req.portalAuth) === null || _a === void 0 ? void 0 : _a.ticketUuid;
+        var requested = (_b = req.params) === null || _b === void 0 ? void 0 : _b[paramName];
+        if (!claimed || !requested || claimed !== requested) {
+            return next(new exceptions_1.HttpException(403, "Ticket id mismatch"));
+        }
+        return next();
+    };
+}
+exports.requireTicketMatch = requireTicketMatch;
+/**
+ * Guard that the `branchUuid` claim inside the JWT matches the URL param
+ * or body field. Same idea, one layer up.
+ */
+function requireBranchMatch(source, fieldName) {
+    return function (req, _res, next) {
+        var _a, _b, _c;
+        var claimed = (_a = req.portalAuth) === null || _a === void 0 ? void 0 : _a.branchUuid;
+        var requested = source === "params" ? (_b = req.params) === null || _b === void 0 ? void 0 : _b[fieldName] : (_c = req.body) === null || _c === void 0 ? void 0 : _c[fieldName];
+        if (!claimed || !requested || claimed !== requested) {
+            return next(new exceptions_1.HttpException(403, "Branch id mismatch"));
+        }
+        return next();
+    };
+}
+exports.requireBranchMatch = requireBranchMatch;

package/build/middlewares/index.d.ts

@@ -2,3 +2,4 @@ export * from './auth.middleware';
 export * from './error.middleware';
 export * from './validation.middleware';
 export * from './licenseGuard.middleware';
+export * from './guestAuth.middleware';

package/build/middlewares/index.js

@@ -14,3 +14,4 @@ __exportStar(require("./auth.middleware"), exports);
 __exportStar(require("./error.middleware"), exports);
 __exportStar(require("./validation.middleware"), exports);
 __exportStar(require("./licenseGuard.middleware"), exports);
+__exportStar(require("./guestAuth.middleware"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fluyappgocore/commons-backend",
-  "version": "1.0.210",
+  "version": "1.0.212",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",