@loomcore/api 0.1.36 → 0.1.38

package/dist/databases/migrations/migration-runner.d.ts

@@ -0,0 +1,15 @@
+export type DbType = 'postgres' | 'mongo';
+export interface MigrationConfig {
+    dbType: DbType;
+    dbUrl: string;
+    migrationsDir: string;
+}
+export declare class MigrationRunner {
+    private config;
+    constructor(config: MigrationConfig);
+    private parseSql;
+    private getMigrator;
+    private wipeDatabase;
+    run(command: 'up' | 'down' | 'reset'): Promise<void>;
+    private closeConnection;
+}

package/dist/databases/migrations/migration-runner.js

@@ -0,0 +1,118 @@
+import { Umzug, MongoDBStorage } from 'umzug';
+import { Pool } from 'pg';
+import { MongoClient } from 'mongodb';
+import fs from 'fs';
+import path from 'path';
+export class MigrationRunner {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    parseSql(content) {
+        const upMatch = content.match(/--\s*up\s([\s\S]+?)(?=--\s*down|$)/i);
+        const downMatch = content.match(/--\s*down\s([\s\S]+)/i);
+        return {
+            up: upMatch ? upMatch[1].trim() : '',
+            down: downMatch ? downMatch[1].trim() : ''
+        };
+    }
+    async getMigrator() {
+        const { dbType, dbUrl, migrationsDir } = this.config;
+        if (dbType === 'postgres') {
+            const pool = new Pool({ connectionString: dbUrl });
+            return new Umzug({
+                migrations: {
+                    glob: path.join(migrationsDir, '*.sql'),
+                    resolve: ({ name, path: filePath, context }) => {
+                        const content = fs.readFileSync(filePath, 'utf8');
+                        const { up, down } = this.parseSql(content);
+                        return {
+                            name,
+                            up: async () => context.query(up),
+                            down: async () => context.query(down)
+                        };
+                    }
+                },
+                context: pool,
+                storage: {
+                    async executed({ context }) {
+                        await context.query(`CREATE TABLE IF NOT EXISTS migrations (name text)`);
+                        const result = await context.query(`SELECT name FROM migrations`);
+                        return result.rows.map((r) => r.name);
+                    },
+                    async logMigration({ name, context }) {
+                        await context.query(`INSERT INTO migrations (name) VALUES ($1)`, [name]);
+                    },
+                    async unlogMigration({ name, context }) {
+                        await context.query(`DELETE FROM migrations WHERE name = $1`, [name]);
+                    }
+                },
+                logger: console,
+            });
+        }
+        else if (dbType === 'mongo') {
+            const client = await MongoClient.connect(dbUrl);
+            const db = client.db();
+            return new Umzug({
+                migrations: { glob: path.join(migrationsDir, '*.ts') },
+                context: db,
+                storage: new MongoDBStorage({ collection: db.collection('migrations') }),
+                logger: console,
+            });
+        }
+        throw new Error(`Unsupported DB_TYPE: ${dbType}`);
+    }
+    async wipeDatabase() {
+        const { dbType, dbUrl } = this.config;
+        console.log(`⚠️  Wiping ${dbType} database...`);
+        if (dbType === 'postgres') {
+            const pool = new Pool({ connectionString: dbUrl });
+            try {
+                await pool.query('DROP SCHEMA public CASCADE; CREATE SCHEMA public;');
+            }
+            finally {
+                await pool.end();
+            }
+        }
+        else if (dbType === 'mongo') {
+            const client = await MongoClient.connect(dbUrl);
+            await client.db().dropDatabase();
+            await client.close();
+        }
+        console.log('✅ Database wiped.');
+    }
+    async run(command) {
+        try {
+            if (command === 'reset') {
+                await this.wipeDatabase();
+                console.log('🚀 Restarting migrations...');
+                const migrator = await this.getMigrator();
+                await migrator.up();
+                await this.closeConnection(migrator);
+                console.log('✅ Reset complete.');
+                return;
+            }
+            const migrator = await this.getMigrator();
+            switch (command) {
+                case 'up':
+                    await migrator.up();
+                    console.log('✅ Migrations up to date.');
+                    break;
+                case 'down':
+                    await migrator.down();
+                    console.log('✅ Reverted last migration.');
+                    break;
+            }
+            await this.closeConnection(migrator);
+        }
+        catch (err) {
+            console.error('❌ Migration failed:', err);
+            process.exit(1);
+        }
+    }
+    async closeConnection(migrator) {
+        if (this.config.dbType === 'postgres') {
+            await migrator.context.end();
+        }
+    }
+}

package/dist/services/auth.service.js

@@ -11,6 +11,7 @@ import { OrganizationService } from './organization.service.js';
 import { passwordUtils } from '../utils/index.js';
 import { config } from '../config/index.js';
 import { refreshTokenModelSpec } from '../models/refresh-token.model.js';
+import { getUserContextAuthorizations } from './utils/getUserContextAuthorizations.util.js';
 export class AuthService extends MultiTenantApiService {
     refreshTokenService;
     passwordResetTokenService;
@@ -34,10 +35,11 @@ export class AuthService extends MultiTenantApiService {
         if (!passwordsMatch) {
             throw new BadRequestError('Invalid Credentials');
         }
+        const authorizations = await getUserContextAuthorizations(this.database, user);
         const userContext = {
             user: user,
             organization: organization ?? undefined,
-            authorizations: []
+            authorizations: authorizations
         };
         const deviceId = this.getAndSetDeviceIdCookie(req, res);
         const loginResponse = await this.logUserIn(userContext, deviceId);
@@ -68,20 +70,19 @@ export class AuthService extends MultiTenantApiService {
         if (!rawUser) {
             return null;
         }
-        const dbPostprocessed = this.database.postprocessEntity(rawUser, this.modelSpec.fullSchema);
-        return dbPostprocessed;
+        return this.database.postprocessEntity(rawUser, this.modelSpec.fullSchema);
     }
     async createUser(userContext, user) {
-        if (userContext.user?._id === 'system') {
+        if (userContext.user._id === 'system') {
+            if (config.app.isMultiTenant && userContext.organization?._id !== user._orgId) {
+                throw new BadRequestError('User is not authorized to create a user in this organization');
+            }
             if (user._orgId) {
                 const org = await this.organizationService.findOne(userContext, { filters: { _id: { eq: user._orgId } } });
                 if (!org) {
                     throw new BadRequestError('The specified organization does not exist');
                 }
             }
-            if (config.app.isMultiTenant && userContext.organization?._id !== user._orgId) {
-                throw new BadRequestError('User is not authorized to create a user in this organization');
-            }
         }
         if (user.email) {
             const existingUser = await this.getUserByEmail(user.email);
@@ -98,10 +99,11 @@ export class AuthService extends MultiTenantApiService {
             const systemUserContext = getSystemUserContext();
             const user = await this.getById(systemUserContext, activeRefreshToken.userId);
             const organization = await this.organizationService.findOne(EmptyUserContext, { filters: { _id: { eq: user?._orgId } } });
+            const authorizations = await getUserContextAuthorizations(this.database, user);
             const userContext = {
                 user: user,
                 organization: organization ?? undefined,
-                authorizations: []
+                authorizations: authorizations
             };
             tokens = await this.createNewTokens(userContext, activeRefreshToken);
         }

package/dist/services/user.service.d.ts

@@ -1,12 +1,8 @@
-import { IUser, IUserContext, IPagedResult, IQueryOptions } from '@loomcore/common/models';
+import { IUser, IUserContext } from '@loomcore/common/models';
 import { MultiTenantApiService } from './index.js';
 import { IDatabase } from '../databases/models/index.js';
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase);
     fullUpdateById(userContext: IUserContext, id: string, entity: IUser): Promise<IUser>;
-    getById(userContext: IUserContext, id: string): Promise<IUser>;
-    get(userContext: IUserContext, queryOptions: IQueryOptions): Promise<IPagedResult<IUser>>;
-    getAll(userContext: IUserContext): Promise<IUser[]>;
     preprocessEntity(userContext: IUserContext, entity: Partial<IUser>, isCreate: boolean, allowId?: boolean): Promise<Partial<IUser>>;
-    private getUserContextAuthorizations;
 }

package/dist/services/user.service.js

@@ -1,8 +1,7 @@
 import { Value } from '@sinclair/typebox/value';
 import { UserSpec, PublicUserSchema } from '@loomcore/common/models';
 import { MultiTenantApiService } from './index.js';
-import { IdNotFoundError, ServerError } from '../errors/index.js';
-import { PostgresDatabase } from '../databases/postgres/postgres.database.js';
+import { ServerError } from '../errors/index.js';
 export class UserService extends MultiTenantApiService {
     constructor(database) {
         super(database, 'users', 'user', UserSpec);
@@ -10,28 +9,6 @@ export class UserService extends MultiTenantApiService {
     async fullUpdateById(userContext, id, entity) {
         throw new ServerError('Cannot full update a user. Either use PATCH or /auth/change-password to update password.');
     }
-    async getById(userContext, id) {
-        const { operations, queryObject } = this.prepareQuery(userContext, {}, []);
-        const user = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
-        if (!user) {
-            throw new IdNotFoundError();
-        }
-        return this.postprocessEntity(userContext, user);
-    }
-    async get(userContext, queryOptions) {
-        const { operations, queryObject } = this.prepareQuery(userContext, queryOptions, []);
-        const pagedResult = await this.database.get(operations, queryObject, this.modelSpec, this.pluralResourceName);
-        const transformedEntities = (pagedResult.entities || []).map(entity => this.postprocessEntity(userContext, entity));
-        return {
-            ...pagedResult,
-            entities: transformedEntities
-        };
-    }
-    async getAll(userContext) {
-        const { operations } = this.prepareQuery(userContext, {}, []);
-        const users = await this.database.getAll(operations, this.pluralResourceName);
-        return users.map(user => this.postprocessEntity(userContext, user));
-    }
     async preprocessEntity(userContext, entity, isCreate, allowId = false) {
         const preparedEntity = await super.preprocessEntity(userContext, entity, isCreate);
         if (preparedEntity.email) {
@@ -42,12 +19,4 @@ export class UserService extends MultiTenantApiService {
         }
         return preparedEntity;
     }
-    async getUserContextAuthorizations(user) {
-        if (!(this.database instanceof PostgresDatabase)) {
-            return [];
-        }
-        const orgId = user._orgId;
-        const authorizations = await this.database.getUserAuthorizations(user._id, orgId);
-        return authorizations;
-    }
 }

package/dist/services/utils/getUserContextAuthorizations.util.d.ts

@@ -0,0 +1,3 @@
+import { IUser, IUserContextAuthorization } from "@loomcore/common/models";
+import { IDatabase } from "../../databases/models/index.js";
+export declare function getUserContextAuthorizations(database: IDatabase, user: IUser): Promise<IUserContextAuthorization[]>;

package/dist/services/utils/getUserContextAuthorizations.util.js

@@ -0,0 +1,9 @@
+import { PostgresDatabase } from "../../databases/postgres/postgres.database.js";
+export async function getUserContextAuthorizations(database, user) {
+    if (!(database instanceof PostgresDatabase)) {
+        return [];
+    }
+    const orgId = user._orgId;
+    const authorizations = await database.getUserAuthorizations(user._id, orgId);
+    return authorizations;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {
@@ -62,7 +62,8 @@
     "moment": "^2.30.1",
     "mongodb": "^6.16.0",
     "pg": "^8.15.6",
-    "rxjs": "^7.8.0"
+    "rxjs": "^7.8.0",
+    "umzug": "^3.8.2"
   },
   "devDependencies": {
     "@types/cookie-parser": "^1.4.7",