@loomcore/api 0.1.37 → 0.1.39

package/README.md

@@ -8,7 +8,7 @@ This library provides a foundational structure for creating robust APIs, with a
 
 - **Generic API Controller**: A base `ApiController` that automatically scaffolds a full suite of RESTful endpoints for any data model. This includes support for CRUD operations, batch updates, pagination, and counting.
 - **Built-in Multi-tenancy**: Optional, configuration-driven multi-tenancy. When enabled, all database operations are automatically scoped to the current user's organization, ensuring strict data isolation.
-- **Authentication & Authorization**: Integrated JWT-based authentication middleware (`isAuthenticated`) to easily secure endpoints and support for OAuth 2.0 Code Flow, including the use of refresh tokens.
+- **Authentication & Authorization**: Integrated JWT-based authentication middleware (`isAuthorized`) to easily secure endpoints and support for OAuth 2.0 Code Flow, including the use of refresh tokens.
 - **User & Organization Management**: Pre-built services and controllers for common user and organization management tasks.
 - **Password Management**: Includes services for handling password reset requests and workflows.
 - **Email Service Integration**: A ready-to-use service for sending transactional emails (e.g., for password resets or welcome messages).

package/dist/__tests__/common-test.utils.js

@@ -131,17 +131,8 @@ async function simulateloginWithTestUser() {
     return `Bearer ${loginResponse.tokens.accessToken}`;
 }
 function getAuthToken() {
-    const metaOrgUser = getTestMetaOrgUser();
-    const metaOrg = getTestMetaOrg();
-    const payload = {
-        user: {
-            _id: metaOrgUser._id,
-            email: metaOrgUser.email
-        },
-        organization: metaOrg,
-        _orgId: metaOrgUser._orgId
-    };
-    const token = JwtService.sign(payload, JWT_SECRET, { expiresIn: 3600 });
+    const userContext = getTestMetaOrgUserContext();
+    const token = JwtService.sign(userContext, JWT_SECRET, { expiresIn: 3600 });
     return `Bearer ${token}`;
 }
 function verifyToken(token) {

package/dist/controllers/api.controller.js

@@ -1,7 +1,7 @@
 import { BadRequestError } from '../errors/index.js';
 import { entityUtils } from '@loomcore/common/utils';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class ApiController {
     app;
     service;
@@ -19,15 +19,15 @@ export class ApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthenticated, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthenticated, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthenticated, this.getById.bind(this));
-        app.post(`/api/${this.slug}`, isAuthenticated, this.create.bind(this));
-        app.patch(`/api/${this.slug}/batch`, isAuthenticated, this.batchUpdate.bind(this));
-        app.put(`/api/${this.slug}/:id`, isAuthenticated, this.fullUpdateById.bind(this));
-        app.patch(`/api/${this.slug}/:id`, isAuthenticated, this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, isAuthenticated, this.deleteById.bind(this));
+        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, isAuthorized(), this.create.bind(this));
+        app.patch(`/api/${this.slug}/batch`, isAuthorized(), this.batchUpdate.bind(this));
+        app.put(`/api/${this.slug}/:id`, isAuthorized(), this.fullUpdateById.bind(this));
+        app.patch(`/api/${this.slug}/:id`, isAuthorized(), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, isAuthorized(), this.deleteById.bind(this));
     }
     validate(entity, isPartial = false) {
         const validationErrors = this.service.validate(entity, isPartial);

package/dist/controllers/auth.controller.js

@@ -1,9 +1,9 @@
 import { LoginResponseSpec, TokenResponseSpec, UserSpec, PublicUserSpec, passwordValidator, PublicUserContextSpec, } from '@loomcore/common/models';
 import { entityUtils } from '@loomcore/common/utils';
 import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
 import { AuthService } from '../services/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class AuthController {
     authService;
     constructor(app, database) {
@@ -13,10 +13,10 @@ export class AuthController {
     }
     mapRoutes(app) {
         app.post(`/api/auth/login`, this.login.bind(this), this.afterAuth.bind(this));
-        app.post(`/api/auth/register`, isAuthenticated, this.registerUser.bind(this));
+        app.post(`/api/auth/register`, isAuthorized(), this.registerUser.bind(this));
         app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
-        app.get(`/api/auth/get-user-context`, isAuthenticated, this.getUserContext.bind(this));
-        app.patch(`/api/auth/change-password`, isAuthenticated, this.changePassword.bind(this));
+        app.get(`/api/auth/get-user-context`, isAuthorized(), this.getUserContext.bind(this));
+        app.patch(`/api/auth/change-password`, isAuthorized(), this.changePassword.bind(this));
         app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
         app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
     }

package/dist/controllers/organizations.controller.js

@@ -1,8 +1,8 @@
 import { ApiController } from './api.controller.js';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
 import { BadRequestError } from '../errors/index.js';
 import { OrganizationService } from '../services/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class OrganizationsController extends ApiController {
     orgService;
     constructor(app, database) {
@@ -12,8 +12,8 @@ export class OrganizationsController extends ApiController {
     }
     mapRoutes(app) {
         super.mapRoutes(app);
-        app.get(`/api/${this.slug}/get-by-name/:name`, isAuthenticated, this.getByName.bind(this));
-        app.get(`/api/${this.slug}/get-by-code/:code`, isAuthenticated, this.getByCode.bind(this));
+        app.get(`/api/${this.slug}/get-by-name/:name`, isAuthorized(), this.getByName.bind(this));
+        app.get(`/api/${this.slug}/get-by-code/:code`, isAuthorized(), this.getByCode.bind(this));
     }
     async getByName(req, res, next) {
         console.log('in OrganizationController.getByName');

package/dist/controllers/users.controller.js

@@ -1,6 +1,6 @@
 import { UserSpec, PublicUserSpec } from '@loomcore/common/models';
 import { ApiController } from './api.controller.js';
-import { isAuthenticated } from '../middleware/index.js';
+import { isAuthorized } from '../middleware/index.js';
 import { UserService } from '../services/index.js';
 export class UsersController extends ApiController {
     userService;
@@ -10,13 +10,13 @@ export class UsersController extends ApiController {
         this.userService = userService;
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthenticated, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/find`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthenticated, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthenticated, this.getById.bind(this));
-        app.post(`/api/${this.slug}`, isAuthenticated, this.create.bind(this));
-        app.patch(`/api/${this.slug}/:id`, isAuthenticated, this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, isAuthenticated, this.deleteById.bind(this));
+        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/find`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, isAuthorized(), this.create.bind(this));
+        app.patch(`/api/${this.slug}/:id`, isAuthorized(), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, isAuthorized(), this.deleteById.bind(this));
     }
 }

package/dist/databases/migrations/migration-runner.d.ts

@@ -0,0 +1,15 @@
+export type DbType = 'postgres' | 'mongo';
+export interface MigrationConfig {
+    dbType: DbType;
+    dbUrl: string;
+    migrationsDir: string;
+}
+export declare class MigrationRunner {
+    private config;
+    constructor(config: MigrationConfig);
+    private parseSql;
+    private getMigrator;
+    private wipeDatabase;
+    run(command: 'up' | 'down' | 'reset'): Promise<void>;
+    private closeConnection;
+}

package/dist/databases/migrations/migration-runner.js

@@ -0,0 +1,118 @@
+import { Umzug, MongoDBStorage } from 'umzug';
+import { Pool } from 'pg';
+import { MongoClient } from 'mongodb';
+import fs from 'fs';
+import path from 'path';
+export class MigrationRunner {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    parseSql(content) {
+        const upMatch = content.match(/--\s*up\s([\s\S]+?)(?=--\s*down|$)/i);
+        const downMatch = content.match(/--\s*down\s([\s\S]+)/i);
+        return {
+            up: upMatch ? upMatch[1].trim() : '',
+            down: downMatch ? downMatch[1].trim() : ''
+        };
+    }
+    async getMigrator() {
+        const { dbType, dbUrl, migrationsDir } = this.config;
+        if (dbType === 'postgres') {
+            const pool = new Pool({ connectionString: dbUrl });
+            return new Umzug({
+                migrations: {
+                    glob: path.join(migrationsDir, '*.sql'),
+                    resolve: ({ name, path: filePath, context }) => {
+                        const content = fs.readFileSync(filePath, 'utf8');
+                        const { up, down } = this.parseSql(content);
+                        return {
+                            name,
+                            up: async () => context.query(up),
+                            down: async () => context.query(down)
+                        };
+                    }
+                },
+                context: pool,
+                storage: {
+                    async executed({ context }) {
+                        await context.query(`CREATE TABLE IF NOT EXISTS migrations (name text)`);
+                        const result = await context.query(`SELECT name FROM migrations`);
+                        return result.rows.map((r) => r.name);
+                    },
+                    async logMigration({ name, context }) {
+                        await context.query(`INSERT INTO migrations (name) VALUES ($1)`, [name]);
+                    },
+                    async unlogMigration({ name, context }) {
+                        await context.query(`DELETE FROM migrations WHERE name = $1`, [name]);
+                    }
+                },
+                logger: console,
+            });
+        }
+        else if (dbType === 'mongo') {
+            const client = await MongoClient.connect(dbUrl);
+            const db = client.db();
+            return new Umzug({
+                migrations: { glob: path.join(migrationsDir, '*.ts') },
+                context: db,
+                storage: new MongoDBStorage({ collection: db.collection('migrations') }),
+                logger: console,
+            });
+        }
+        throw new Error(`Unsupported DB_TYPE: ${dbType}`);
+    }
+    async wipeDatabase() {
+        const { dbType, dbUrl } = this.config;
+        console.log(`⚠️  Wiping ${dbType} database...`);
+        if (dbType === 'postgres') {
+            const pool = new Pool({ connectionString: dbUrl });
+            try {
+                await pool.query('DROP SCHEMA public CASCADE; CREATE SCHEMA public;');
+            }
+            finally {
+                await pool.end();
+            }
+        }
+        else if (dbType === 'mongo') {
+            const client = await MongoClient.connect(dbUrl);
+            await client.db().dropDatabase();
+            await client.close();
+        }
+        console.log('✅ Database wiped.');
+    }
+    async run(command) {
+        try {
+            if (command === 'reset') {
+                await this.wipeDatabase();
+                console.log('🚀 Restarting migrations...');
+                const migrator = await this.getMigrator();
+                await migrator.up();
+                await this.closeConnection(migrator);
+                console.log('✅ Reset complete.');
+                return;
+            }
+            const migrator = await this.getMigrator();
+            switch (command) {
+                case 'up':
+                    await migrator.up();
+                    console.log('✅ Migrations up to date.');
+                    break;
+                case 'down':
+                    await migrator.down();
+                    console.log('✅ Reverted last migration.');
+                    break;
+            }
+            await this.closeConnection(migrator);
+        }
+        catch (err) {
+            console.error('❌ Migration failed:', err);
+            process.exit(1);
+        }
+    }
+    async closeConnection(migrator) {
+        if (this.config.dbType === 'postgres') {
+            await migrator.context.end();
+        }
+    }
+}

package/dist/middleware/index.d.ts

@@ -1,3 +1,3 @@
 export * from './error-handler.js';
-export * from './is-authenticated.js';
+export * from './is-authorized.js';
 export * from './ensure-user-context.js';

package/dist/middleware/index.js

@@ -1,3 +1,3 @@
 export * from './error-handler.js';
-export * from './is-authenticated.js';
+export * from './is-authorized.js';
 export * from './ensure-user-context.js';

package/dist/middleware/is-authorized.d.ts

@@ -0,0 +1,3 @@
+import { Request, Response, NextFunction } from 'express';
+declare const isAuthorized: (allowedFeatures?: string[]) => (req: Request, res: Response, next: NextFunction) => void;
+export { isAuthorized };

package/dist/middleware/is-authorized.js

@@ -0,0 +1,40 @@
+import { UserContextSpec } from '@loomcore/common/models';
+import { UnauthenticatedError, UnauthorizedError } from '../errors/index.js';
+import { JwtService } from '../services/index.js';
+import { config } from '../config/index.js';
+const isAuthorized = (allowedFeatures) => {
+    return (req, res, next) => {
+        let token = null;
+        if (req.headers?.authorization) {
+            let authHeader = req.headers.authorization;
+            const authHeaderArray = authHeader.split('Bearer ');
+            if (authHeaderArray?.length > 1) {
+                token = authHeaderArray[1];
+            }
+        }
+        if (!token) {
+            throw new UnauthenticatedError();
+        }
+        try {
+            const rawPayload = JwtService.verify(token, config.clientSecret);
+            const userContext = UserContextSpec.decode(rawPayload);
+            req.userContext = userContext;
+            if (userContext.authorizations.some(authorization => authorization.feature === 'admin')) {
+                next();
+            }
+            else if (allowedFeatures && allowedFeatures.length) {
+                if (!userContext.authorizations.some(authorization => allowedFeatures?.includes(authorization.feature))) {
+                    throw new UnauthorizedError();
+                }
+                next();
+            }
+            else {
+                next();
+            }
+        }
+        catch (err) {
+            throw new UnauthenticatedError();
+        }
+    };
+};
+export { isAuthorized };

package/dist/services/auth.service.js

@@ -70,20 +70,19 @@ export class AuthService extends MultiTenantApiService {
         if (!rawUser) {
             return null;
         }
-        const dbPostprocessed = this.database.postprocessEntity(rawUser, this.modelSpec.fullSchema);
-        return dbPostprocessed;
+        return this.database.postprocessEntity(rawUser, this.modelSpec.fullSchema);
     }
     async createUser(userContext, user) {
-        if (userContext.user?._id === 'system') {
+        if (userContext.user._id === 'system') {
+            if (config.app.isMultiTenant && userContext.organization?._id !== user._orgId) {
+                throw new BadRequestError('User is not authorized to create a user in this organization');
+            }
             if (user._orgId) {
                 const org = await this.organizationService.findOne(userContext, { filters: { _id: { eq: user._orgId } } });
                 if (!org) {
                     throw new BadRequestError('The specified organization does not exist');
                 }
             }
-            if (config.app.isMultiTenant && userContext.organization?._id !== user._orgId) {
-                throw new BadRequestError('User is not authorized to create a user in this organization');
-            }
         }
         if (user.email) {
             const existingUser = await this.getUserByEmail(user.email);

package/dist/services/user.service.d.ts

@@ -1,11 +1,8 @@
-import { IUser, IUserContext, IPagedResult, IQueryOptions } from '@loomcore/common/models';
+import { IUser, IUserContext } from '@loomcore/common/models';
 import { MultiTenantApiService } from './index.js';
 import { IDatabase } from '../databases/models/index.js';
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase);
     fullUpdateById(userContext: IUserContext, id: string, entity: IUser): Promise<IUser>;
-    getById(userContext: IUserContext, id: string): Promise<IUser>;
-    get(userContext: IUserContext, queryOptions: IQueryOptions): Promise<IPagedResult<IUser>>;
-    getAll(userContext: IUserContext): Promise<IUser[]>;
     preprocessEntity(userContext: IUserContext, entity: Partial<IUser>, isCreate: boolean, allowId?: boolean): Promise<Partial<IUser>>;
 }

package/dist/services/user.service.js

@@ -1,7 +1,7 @@
 import { Value } from '@sinclair/typebox/value';
 import { UserSpec, PublicUserSchema } from '@loomcore/common/models';
 import { MultiTenantApiService } from './index.js';
-import { IdNotFoundError, ServerError } from '../errors/index.js';
+import { ServerError } from '../errors/index.js';
 export class UserService extends MultiTenantApiService {
     constructor(database) {
         super(database, 'users', 'user', UserSpec);
@@ -9,28 +9,6 @@ export class UserService extends MultiTenantApiService {
     async fullUpdateById(userContext, id, entity) {
         throw new ServerError('Cannot full update a user. Either use PATCH or /auth/change-password to update password.');
     }
-    async getById(userContext, id) {
-        const { operations, queryObject } = this.prepareQuery(userContext, {}, []);
-        const user = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
-        if (!user) {
-            throw new IdNotFoundError();
-        }
-        return this.postprocessEntity(userContext, user);
-    }
-    async get(userContext, queryOptions) {
-        const { operations, queryObject } = this.prepareQuery(userContext, queryOptions, []);
-        const pagedResult = await this.database.get(operations, queryObject, this.modelSpec, this.pluralResourceName);
-        const transformedEntities = (pagedResult.entities || []).map(entity => this.postprocessEntity(userContext, entity));
-        return {
-            ...pagedResult,
-            entities: transformedEntities
-        };
-    }
-    async getAll(userContext) {
-        const { operations } = this.prepareQuery(userContext, {}, []);
-        const users = await this.database.getAll(operations, this.pluralResourceName);
-        return users.map(user => this.postprocessEntity(userContext, user));
-    }
     async preprocessEntity(userContext, entity, isCreate, allowId = false) {
         const preparedEntity = await super.preprocessEntity(userContext, entity, isCreate);
         if (preparedEntity.email) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {
@@ -62,7 +62,8 @@
     "moment": "^2.30.1",
     "mongodb": "^6.16.0",
     "pg": "^8.15.6",
-    "rxjs": "^7.8.0"
+    "rxjs": "^7.8.0",
+    "umzug": "^3.8.2"
   },
   "devDependencies": {
     "@types/cookie-parser": "^1.4.7",

package/dist/middleware/is-authenticated.d.ts

@@ -1,2 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-export declare const isAuthenticated: (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/is-authenticated.js

@@ -1,27 +0,0 @@
-import { UserContextSpec } from '@loomcore/common/models';
-import { UnauthenticatedError } from '../errors/index.js';
-import { JwtService } from '../services/index.js';
-import { config } from '../config/index.js';
-export const isAuthenticated = (req, res, next) => {
-    let token = null;
-    if (req.headers?.authorization) {
-        let authHeader = req.headers.authorization;
-        const authHeaderArray = authHeader.split('Bearer ');
-        if (authHeaderArray?.length > 1) {
-            token = authHeaderArray[1];
-        }
-    }
-    if (token) {
-        try {
-            const rawPayload = JwtService.verify(token, config.clientSecret);
-            req.userContext = UserContextSpec.decode(rawPayload);
-            next();
-        }
-        catch (err) {
-            throw new UnauthenticatedError();
-        }
-    }
-    else {
-        throw new UnauthenticatedError();
-    }
-};