@intranefr/superbackend 1.4.3

package/src/controllers/waitingList.controller.js

@@ -0,0 +1,167 @@
+const WaitingList = require('../models/WaitingList');
+const { validateEmail, sanitizeString } = require('../utils/validation');
+
+// Subscribe to waiting list
+exports.subscribe = async (req, res) => {
+  try {
+    const { email, type, referralSource } = req.body;
+
+    // Validate and sanitize email
+    if (!email) {
+      return res.status(400).json({ 
+        error: 'Email address is required',
+        field: 'email'
+      });
+    }
+
+    const sanitizedEmail = sanitizeString(email);
+    if (!validateEmail(sanitizedEmail)) {
+      return res.status(400).json({ 
+        error: 'Please enter a valid email address',
+        field: 'email'
+      });
+    }
+
+    // Validate type (generic)
+    const sanitizedType = sanitizeString(type);
+    if (!sanitizedType || typeof sanitizedType !== 'string' || !sanitizedType.trim()) {
+      return res.status(400).json({ 
+        error: 'Please select your interest type',
+        field: 'type'
+      });
+    }
+
+    // Check if email already exists
+    const existingEntry = await WaitingList.findOne({ email: sanitizedEmail.toLowerCase() });
+    if (existingEntry) {
+      return res.status(409).json({ 
+        error: 'This email is already on our waiting list',
+        field: 'email'
+      });
+    }
+
+    // Create new waiting list entry
+    const waitingListEntry = new WaitingList({
+      email: sanitizedEmail.toLowerCase(),
+      type: sanitizedType.trim(),
+      referralSource: sanitizeString(referralSource) || 'website'
+    });
+
+    await waitingListEntry.save();
+
+    // Return success response without sensitive data
+    const response = waitingListEntry.toJSON();
+    delete response.email; // Don't return email in response for privacy
+
+    res.status(201).json({
+      message: 'Successfully joined the waiting list!',
+      data: response
+    });
+  } catch (error) {
+    console.error('Waiting list subscription error:', error);
+    
+    // Handle specific MongoDB errors
+    if (error.code === 11000) {
+      return res.status(409).json({ 
+        error: 'This email is already on our waiting list',
+        field: 'email'
+      });
+    }
+    
+    if (error.name === 'ValidationError') {
+      const field = Object.keys(error.errors)[0];
+      return res.status(400).json({ 
+        error: error.errors[field].message,
+        field: field
+      });
+    }
+    
+    res.status(500).json({ 
+      error: 'Something went wrong. Please try again later.',
+      field: 'general'
+    });
+  }
+};
+
+// Get waiting list stats (public)
+exports.getStats = async (req, res) => {
+  try {
+    const totalSubscribers = await WaitingList.countDocuments({ status: 'active' });
+
+    const typeAgg = await WaitingList.aggregate([
+      { $match: { status: 'active' } },
+      { $group: { _id: '$type', count: { $sum: 1 } } },
+      { $sort: { count: -1, _id: 1 } },
+    ]);
+
+    const typeCounts = (typeAgg || []).reduce((acc, row) => {
+      if (!row?._id) return acc;
+      acc[String(row._id)] = row.count || 0;
+      return acc;
+    }, {});
+
+    // Backward compatibility fields (legacy UI/tests)
+    const buyerCount = (typeCounts.buyer || 0) + (typeCounts.both || 0);
+    const sellerCount = (typeCounts.seller || 0) + (typeCounts.both || 0);
+
+    // Add some mock growth data for demonstration
+    const growthThisWeek = Math.floor(totalSubscribers * 0.05); // 5% growth
+    
+    res.json({
+      totalSubscribers,
+      buyerCount,
+      sellerCount,
+      typeCounts,
+      growthThisWeek,
+      lastUpdated: new Date().toISOString()
+    });
+  } catch (error) {
+    console.error('Waiting list stats error:', error);
+    res.status(500).json({ 
+      error: 'Unable to load statistics',
+      field: 'general'
+    });
+  }
+};
+
+// Admin list waiting list entries (includes email)
+exports.adminList = async (req, res) => {
+  try {
+    const {
+      status,
+      type,
+      email,
+      limit = 50,
+      offset = 0,
+    } = req.query;
+
+    const query = {};
+    if (status) query.status = String(status);
+    if (type) query.type = String(type);
+    if (email) query.email = String(email).trim().toLowerCase();
+
+    const parsedLimit = Math.min(500, Math.max(1, parseInt(limit, 10) || 50));
+    const parsedOffset = Math.max(0, parseInt(offset, 10) || 0);
+
+    const entries = await WaitingList.find(query)
+      .sort({ createdAt: -1 })
+      .limit(parsedLimit)
+      .skip(parsedOffset)
+      .select('email type status referralSource createdAt updatedAt')
+      .lean();
+
+    const total = await WaitingList.countDocuments(query);
+
+    return res.json({
+      entries,
+      pagination: {
+        total,
+        limit: parsedLimit,
+        offset: parsedOffset,
+      },
+    });
+  } catch (error) {
+    console.error('Waiting list admin list error:', error);
+    return res.status(500).json({ error: 'Failed to list entries' });
+  }
+};

package/src/controllers/webhook.controller.js

@@ -0,0 +1,200 @@
+const Webhook = require('../models/Webhook');
+const webhookService = require('../services/webhook.service');
+
+const webhookController = {
+  /**
+   * Get all webhooks for the current organization
+   */
+  async getAll(req, res) {
+    try {
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id;
+      
+      // If superadmin (Basic Auth), allow fetching all webhooks if no org context
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+      
+      const query = {};
+      if (organizationId) {
+        query.organizationId = organizationId;
+      } else if (!isBasicAuth) {
+        return res.status(400).json({ error: 'Organization context required' });
+      }
+
+      const webhooks = await Webhook.find(query);
+      res.json(webhooks);
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Create a new webhook
+   */
+  async create(req, res) {
+    try {
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id || req.body.organizationId || null;
+      const { name, targetUrl, events, metadata, timeout, isAsync } = req.body;
+
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+
+      if (!organizationId && !isBasicAuth) {
+        return res.status(400).json({ error: 'Organization context required' });
+      }
+
+      if (!targetUrl || !events || !Array.isArray(events)) {
+        return res.status(400).json({ error: 'targetUrl and events (array) are required' });
+      }
+
+      // Check name uniqueness if provided
+      if (name) {
+        const existing = await Webhook.findOne({ name, organizationId });
+        if (existing) {
+          return res.status(400).json({ error: 'A webhook with this name already exists in this organization' });
+        }
+      }
+
+      const webhook = new Webhook({
+        name: name || undefined, // Let mongoose default trigger if name is empty
+        targetUrl,
+        events,
+        organizationId,
+        timeout: timeout || 5000,
+        isAsync: isAsync === true,
+        metadata: metadata || {}
+      });
+
+      await webhook.save();
+      res.status(201).json(webhook);
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Update a webhook
+   */
+  async update(req, res) {
+    try {
+      const { id } = req.params;
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id;
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+      const { name, targetUrl, events, status, metadata, timeout, isAsync } = req.body;
+
+      const query = { _id: id };
+      if (!isBasicAuth && organizationId) {
+        query.organizationId = organizationId;
+      }
+
+      const webhook = await Webhook.findOne(query);
+      if (!webhook) {
+        return res.status(404).json({ error: 'Webhook not found' });
+      }
+
+      if (name && name !== webhook.name) {
+        const existing = await Webhook.findOne({ name, organizationId: webhook.organizationId, _id: { $ne: id } });
+        if (existing) {
+          return res.status(400).json({ error: 'A webhook with this name already exists in this organization' });
+        }
+        webhook.name = name;
+      }
+
+      if (targetUrl) webhook.targetUrl = targetUrl;
+      if (events && Array.isArray(events)) webhook.events = events;
+      if (status) webhook.status = status;
+      if (metadata) webhook.metadata = metadata;
+      if (timeout !== undefined) webhook.timeout = timeout;
+      if (isAsync !== undefined) webhook.isAsync = isAsync;
+
+      await webhook.save();
+      res.json(webhook);
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Delete a webhook
+   */
+  async delete(req, res) {
+    try {
+      const { id } = req.params;
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id;
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+
+      const query = { _id: id };
+      if (!isBasicAuth && organizationId) {
+        query.organizationId = organizationId;
+      }
+
+      const result = await Webhook.deleteOne(query);
+      if (result.deletedCount === 0) {
+        return res.status(404).json({ error: 'Webhook not found' });
+      }
+
+      res.json({ message: 'Webhook deleted successfully' });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Test a webhook delivery
+   */
+  async test(req, res) {
+    try {
+      const { id } = req.params;
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id;
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+
+      const query = { _id: id };
+      if (!isBasicAuth && organizationId) {
+        query.organizationId = organizationId;
+      }
+
+      const webhook = await Webhook.findOne(query);
+      if (!webhook) {
+        return res.status(404).json({ error: 'Webhook not found' });
+      }
+
+      await webhookService.test(id);
+      res.json({ message: 'Test payload dispatched' });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Get delivery history for a webhook
+   */
+  async getHistory(req, res) {
+    try {
+      const { id } = req.params;
+      const organizationId = req.orgId || req.currentOrganization?._id || req.org?._id;
+      const isBasicAuth = req.headers.authorization?.startsWith('Basic ');
+      const AuditEvent = require('../models/AuditEvent');
+
+      const query = { _id: id };
+      if (!isBasicAuth && organizationId) {
+        query.organizationId = organizationId;
+      }
+
+      const webhook = await Webhook.findOne(query);
+      if (!webhook) {
+        return res.status(404).json({ error: 'Webhook not found' });
+      }
+
+      const history = await AuditEvent.find({
+        entityType: 'Webhook',
+        entityId: id,
+        action: { $in: ['WEBHOOK_DELIVERY_SUCCESS', 'WEBHOOK_DELIVERY_FAILURE'] }
+      })
+      .sort({ createdAt: -1 })
+      .limit(50);
+
+      res.json(history);
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  }
+};
+
+module.exports = webhookController;

package/src/middleware/auth.js

@@ -0,0 +1,66 @@
+const { verifyAccessToken } = require("../utils/jwt");
+const User = require("../models/User");
+
+const authenticate = async (req, res, next) => {
+  try {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return res.status(401).json({ error: "No token provided" });
+    }
+
+    const token = authHeader.substring(7);
+    const decoded = verifyAccessToken(token);
+
+    const user = await User.findById(decoded.userId);
+    if (!user) {
+      return res.status(401).json({ error: "User not found" });
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    return res
+      .status(401)
+      .json({ error: error.message || "Authentication failed" });
+  }
+};
+
+// Basic auth middleware for admin routes
+const basicAuth = (req, res, next) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith("Basic ")) {
+    res.setHeader("WWW-Authenticate", 'Basic realm="Admin Area"');
+    return res.status(401).json({ error: "Authentication required" });
+  }
+
+  const credentials = Buffer.from(authHeader.substring(6), "base64").toString(
+    "utf-8",
+  );
+  const [username, password] = credentials.split(":");
+
+  const adminUsername = process.env.ADMIN_USERNAME || "admin";
+  const adminPassword = process.env.ADMIN_PASSWORD || "admin";
+
+  if (username === adminUsername && password === adminPassword) {
+    next();
+  } else {
+    res.setHeader("WWW-Authenticate", 'Basic realm="Admin Area"');
+    return res.status(401).json({ error: "Invalid credentials" });
+  }
+};
+
+// Admin role middleware - requires authentication and admin role
+const requireAdmin = (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({ error: "Authentication required" });
+  }
+  
+  if (req.user.role !== 'admin') {
+    return res.status(403).json({ error: "Admin access required" });
+  }
+  
+  next();
+};
+
+module.exports = { authenticate, basicAuth, requireAdmin };

package/src/middleware/errorCapture.js

@@ -0,0 +1,170 @@
+const crypto = require('crypto');
+
+const { logErrorSync, logError } = require('../services/errorLogger');
+const { logAuditSync } = require('../services/auditLogger');
+
+let originalConsoleError = null;
+let isHooked = false;
+
+function hookConsoleError() {
+  if (isHooked) return;
+  isHooked = true;
+  originalConsoleError = console.error;
+
+  console.error = function (...args) {
+    originalConsoleError.apply(console, args);
+
+    try {
+      let errorObj = null;
+      let message = '';
+
+      for (const arg of args) {
+        if (arg instanceof Error) {
+          errorObj = arg;
+          break;
+        }
+      }
+
+      if (errorObj) {
+        message = errorObj.message;
+      } else {
+        message = args
+          .map((a) => {
+            if (typeof a === 'string') return a;
+            try {
+              return JSON.stringify(a);
+            } catch (e) {
+              return String(a);
+            }
+          })
+          .join(' ');
+      }
+
+      logErrorSync({
+        source: 'backend',
+        severity: 'error',
+        errorName: errorObj?.name || 'ConsoleError',
+        message,
+        stack: errorObj?.stack,
+        extra: { consoleArgs: args.length },
+      });
+    } catch (e) {
+      // avoid loops
+    }
+  };
+}
+
+function unhookConsoleError() {
+  if (!isHooked || !originalConsoleError) return;
+  console.error = originalConsoleError;
+  isHooked = false;
+}
+
+function setupProcessHandlers() {
+  process.on('unhandledRejection', (reason) => {
+    try {
+      originalConsoleError
+        ? originalConsoleError('[unhandledRejection]', reason)
+        : console.error('[unhandledRejection]', reason);
+    } catch (e) {
+      // ignore
+    }
+    const error = reason instanceof Error ? reason : new Error(String(reason));
+    logErrorSync({
+      source: 'backend',
+      severity: 'fatal',
+      errorName: 'UnhandledRejection',
+      message: error.message,
+      stack: error.stack,
+      extra: { type: 'unhandledRejection' },
+    });
+  });
+
+  process.on('uncaughtException', (error, origin) => {
+    try {
+      originalConsoleError
+        ? originalConsoleError('[uncaughtException]', error)
+        : console.error('[uncaughtException]', error);
+    } catch (e) {
+      // ignore
+    }
+
+    logError({
+      source: 'backend',
+      severity: 'fatal',
+      errorName: 'UncaughtException',
+      message: error.message,
+      stack: error.stack,
+      extra: { origin },
+    }).finally(() => {
+      if (process.env.EXIT_ON_UNCAUGHT_EXCEPTION === 'true') {
+        process.exit(1);
+      }
+    });
+  });
+}
+
+function expressErrorMiddleware(err, req, res, next) {
+  const statusCode = err.status || err.statusCode || 500;
+
+  logErrorSync({
+    source: 'backend',
+    severity: statusCode >= 500 ? 'error' : 'warn',
+    errorName: err.name || 'Error',
+    errorCode: err.code,
+    message: err.message,
+    stack: err.stack,
+    actor: {
+      userId: req.user?._id || req.user?.id,
+      role: req.user?.role,
+      ip: req.ip || req.headers?.['x-forwarded-for']?.split(',')[0]?.trim(),
+      userAgent: req.headers?.['user-agent'],
+    },
+    request: {
+      method: req.method,
+      path: req.path,
+      statusCode,
+      requestId: req.headers?.['x-request-id'] || req.requestId,
+    },
+  });
+
+  if (statusCode >= 400) {
+    logAuditSync({
+      req,
+      action: 'request.error',
+      outcome: 'failure',
+      entityType: 'request',
+      entityId: req.path,
+      details: {
+        errorName: err.name,
+        statusCode,
+        path: req.path,
+      },
+    });
+  }
+
+  if (res.headersSent) {
+    return next(err);
+  }
+
+  res.status(statusCode).json({
+    error: process.env.NODE_ENV === 'production' ? 'Internal server error' : err.message,
+  });
+}
+
+function requestIdMiddleware(req, res, next) {
+  if (!req.headers['x-request-id']) {
+    req.headers['x-request-id'] = crypto.randomUUID();
+  }
+  req.requestId = req.headers['x-request-id'];
+  res.setHeader('X-Request-Id', req.requestId);
+  next();
+}
+
+module.exports = {
+  hookConsoleError,
+  unhookConsoleError,
+  setupProcessHandlers,
+  expressErrorMiddleware,
+  requestIdMiddleware,
+};

package/src/middleware/headlessApiTokenAuth.js

@@ -0,0 +1,57 @@
+const { authenticateApiToken, tokenAllowsOperation } = require('../services/headlessApiTokens.service');
+
+function extractToken(req) {
+  const headerToken = req.headers['x-api-token'] || req.headers['x-api-key'];
+  if (headerToken) return String(headerToken).trim();
+
+  const auth = req.headers.authorization;
+  if (auth && auth.toLowerCase().startsWith('bearer ')) {
+    return String(auth.slice(7)).trim();
+  }
+
+  return null;
+}
+
+function getOperationFromMethod(method) {
+  const m = String(method || '').toUpperCase();
+  if (m === 'GET') return 'read';
+  if (m === 'POST') return 'create';
+  if (m === 'PUT' || m === 'PATCH') return 'update';
+  if (m === 'DELETE') return 'delete';
+  return null;
+}
+
+function headlessApiTokenAuth() {
+  return async (req, res, next) => {
+    try {
+      const token = extractToken(req);
+      const tokenDoc = await authenticateApiToken(token);
+      if (!tokenDoc) return res.status(401).json({ error: 'Invalid or expired API token' });
+
+      req.headlessApiToken = tokenDoc;
+      return next();
+    } catch (error) {
+      console.error('Headless API token auth error:', error);
+      return res.status(500).json({ error: 'Authentication failed' });
+    }
+  };
+}
+
+function requireHeadlessPermission() {
+  return (req, res, next) => {
+    const modelCode = req.params.modelCode;
+    const operation = getOperationFromMethod(req.method);
+
+    if (!operation) return res.status(400).json({ error: 'Unsupported operation' });
+
+    const ok = tokenAllowsOperation(req.headlessApiToken, modelCode, operation);
+    if (!ok) return res.status(403).json({ error: 'Insufficient permissions' });
+
+    return next();
+  };
+}
+
+module.exports = {
+  headlessApiTokenAuth,
+  requireHeadlessPermission,
+};