@haiiro/docuflow 0.0.12 → 0.0.13

package/src/logic-functions/docflow-app-session.logic-function.ts

@@ -0,0 +1,54 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import {
+  type LogicFunctionExecutionContext,
+  type RoutePayload,
+} from 'twenty-sdk/logic-function';
+
+import { readAccessTokenClaims } from 'src/shared/app/docflow-app.util';
+import { jsonResponse } from 'src/server/http-response';
+import { DOCFLOW_APP_SESSION_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER } from 'src/universal-identifiers';
+
+// The session of the standalone page: the token the CRM gave this call on
+// behalf of the signed-in person (30 minutes, the person's rights). Called
+// with the CRM sign-in cookie on the CRM address and in the sign-in popup;
+// with the current token to renew it inside the Bitrix24 frame, where the
+// cookie does not reach.
+const handler = async (event: RoutePayload, context: LogicFunctionExecutionContext) => {
+  // Only the page itself: another site must not get a token through the
+  // person's cookie.
+  if (event.headers['sec-fetch-site'] === 'cross-site') {
+    return jsonResponse(403, { message: 'Запрос с другого сайта' });
+  }
+
+  const token = process.env.TWENTY_APP_ACCESS_TOKEN ?? '';
+  const isOnBehalfOfPerson =
+    context.userWorkspaceId !== null &&
+    token.length > 0 &&
+    token !== process.env.TWENTY_APP_APPLICATION_ACCESS_TOKEN;
+  const claims = isOnBehalfOfPerson ? readAccessTokenClaims(token) : undefined;
+
+  if (claims?.userId === undefined || claims.expiresAt === undefined) {
+    return jsonResponse(401, { message: 'Войдите в CRM' });
+  }
+
+  return jsonResponse(200, {
+    token,
+    expiresAt: claims.expiresAt,
+    userId: claims.userId,
+    workspaceMemberId: context.workspaceMemberId,
+  });
+};
+
+export default defineLogicFunction({
+  universalIdentifier: DOCFLOW_APP_SESSION_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER,
+  name: 'docflow-app-session',
+  description: 'Сессия отдельной страницы документооборота от имени вошедшего сотрудника',
+  timeoutSeconds: 10,
+  handler,
+  httpRouteTriggerSettings: {
+    path: '/docflow/app/session',
+    httpMethod: 'POST',
+    isAuthRequired: true,
+    forwardedRequestHeaders: ['sec-fetch-site'],
+  },
+});