@loomcore/api 0.1.38 → 0.1.39

package/README.md

@@ -8,7 +8,7 @@ This library provides a foundational structure for creating robust APIs, with a
 
 - **Generic API Controller**: A base `ApiController` that automatically scaffolds a full suite of RESTful endpoints for any data model. This includes support for CRUD operations, batch updates, pagination, and counting.
 - **Built-in Multi-tenancy**: Optional, configuration-driven multi-tenancy. When enabled, all database operations are automatically scoped to the current user's organization, ensuring strict data isolation.
-- **Authentication & Authorization**: Integrated JWT-based authentication middleware (`isAuthenticated`) to easily secure endpoints and support for OAuth 2.0 Code Flow, including the use of refresh tokens.
+- **Authentication & Authorization**: Integrated JWT-based authentication middleware (`isAuthorized`) to easily secure endpoints and support for OAuth 2.0 Code Flow, including the use of refresh tokens.
 - **User & Organization Management**: Pre-built services and controllers for common user and organization management tasks.
 - **Password Management**: Includes services for handling password reset requests and workflows.
 - **Email Service Integration**: A ready-to-use service for sending transactional emails (e.g., for password resets or welcome messages).

package/dist/__tests__/common-test.utils.js

@@ -131,17 +131,8 @@ async function simulateloginWithTestUser() {
     return `Bearer ${loginResponse.tokens.accessToken}`;
 }
 function getAuthToken() {
-    const metaOrgUser = getTestMetaOrgUser();
-    const metaOrg = getTestMetaOrg();
-    const payload = {
-        user: {
-            _id: metaOrgUser._id,
-            email: metaOrgUser.email
-        },
-        organization: metaOrg,
-        _orgId: metaOrgUser._orgId
-    };
-    const token = JwtService.sign(payload, JWT_SECRET, { expiresIn: 3600 });
+    const userContext = getTestMetaOrgUserContext();
+    const token = JwtService.sign(userContext, JWT_SECRET, { expiresIn: 3600 });
     return `Bearer ${token}`;
 }
 function verifyToken(token) {

package/dist/controllers/api.controller.js

@@ -1,7 +1,7 @@
 import { BadRequestError } from '../errors/index.js';
 import { entityUtils } from '@loomcore/common/utils';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class ApiController {
     app;
     service;
@@ -19,15 +19,15 @@ export class ApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthenticated, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthenticated, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthenticated, this.getById.bind(this));
-        app.post(`/api/${this.slug}`, isAuthenticated, this.create.bind(this));
-        app.patch(`/api/${this.slug}/batch`, isAuthenticated, this.batchUpdate.bind(this));
-        app.put(`/api/${this.slug}/:id`, isAuthenticated, this.fullUpdateById.bind(this));
-        app.patch(`/api/${this.slug}/:id`, isAuthenticated, this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, isAuthenticated, this.deleteById.bind(this));
+        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, isAuthorized(), this.create.bind(this));
+        app.patch(`/api/${this.slug}/batch`, isAuthorized(), this.batchUpdate.bind(this));
+        app.put(`/api/${this.slug}/:id`, isAuthorized(), this.fullUpdateById.bind(this));
+        app.patch(`/api/${this.slug}/:id`, isAuthorized(), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, isAuthorized(), this.deleteById.bind(this));
     }
     validate(entity, isPartial = false) {
         const validationErrors = this.service.validate(entity, isPartial);

package/dist/controllers/auth.controller.js

@@ -1,9 +1,9 @@
 import { LoginResponseSpec, TokenResponseSpec, UserSpec, PublicUserSpec, passwordValidator, PublicUserContextSpec, } from '@loomcore/common/models';
 import { entityUtils } from '@loomcore/common/utils';
 import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
 import { AuthService } from '../services/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class AuthController {
     authService;
     constructor(app, database) {
@@ -13,10 +13,10 @@ export class AuthController {
     }
     mapRoutes(app) {
         app.post(`/api/auth/login`, this.login.bind(this), this.afterAuth.bind(this));
-        app.post(`/api/auth/register`, isAuthenticated, this.registerUser.bind(this));
+        app.post(`/api/auth/register`, isAuthorized(), this.registerUser.bind(this));
         app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
-        app.get(`/api/auth/get-user-context`, isAuthenticated, this.getUserContext.bind(this));
-        app.patch(`/api/auth/change-password`, isAuthenticated, this.changePassword.bind(this));
+        app.get(`/api/auth/get-user-context`, isAuthorized(), this.getUserContext.bind(this));
+        app.patch(`/api/auth/change-password`, isAuthorized(), this.changePassword.bind(this));
         app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
         app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
     }

package/dist/controllers/organizations.controller.js

@@ -1,8 +1,8 @@
 import { ApiController } from './api.controller.js';
-import { isAuthenticated } from '../middleware/index.js';
 import { apiUtils } from '../utils/index.js';
 import { BadRequestError } from '../errors/index.js';
 import { OrganizationService } from '../services/index.js';
+import { isAuthorized } from '../middleware/index.js';
 export class OrganizationsController extends ApiController {
     orgService;
     constructor(app, database) {
@@ -12,8 +12,8 @@ export class OrganizationsController extends ApiController {
     }
     mapRoutes(app) {
         super.mapRoutes(app);
-        app.get(`/api/${this.slug}/get-by-name/:name`, isAuthenticated, this.getByName.bind(this));
-        app.get(`/api/${this.slug}/get-by-code/:code`, isAuthenticated, this.getByCode.bind(this));
+        app.get(`/api/${this.slug}/get-by-name/:name`, isAuthorized(), this.getByName.bind(this));
+        app.get(`/api/${this.slug}/get-by-code/:code`, isAuthorized(), this.getByCode.bind(this));
     }
     async getByName(req, res, next) {
         console.log('in OrganizationController.getByName');

package/dist/controllers/users.controller.js

@@ -1,6 +1,6 @@
 import { UserSpec, PublicUserSpec } from '@loomcore/common/models';
 import { ApiController } from './api.controller.js';
-import { isAuthenticated } from '../middleware/index.js';
+import { isAuthorized } from '../middleware/index.js';
 import { UserService } from '../services/index.js';
 export class UsersController extends ApiController {
     userService;
@@ -10,13 +10,13 @@ export class UsersController extends ApiController {
         this.userService = userService;
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthenticated, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/find`, isAuthenticated, this.get.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthenticated, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthenticated, this.getById.bind(this));
-        app.post(`/api/${this.slug}`, isAuthenticated, this.create.bind(this));
-        app.patch(`/api/${this.slug}/:id`, isAuthenticated, this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, isAuthenticated, this.deleteById.bind(this));
+        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/find`, isAuthorized(), this.get.bind(this));
+        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, isAuthorized(), this.create.bind(this));
+        app.patch(`/api/${this.slug}/:id`, isAuthorized(), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, isAuthorized(), this.deleteById.bind(this));
     }
 }

package/dist/middleware/index.d.ts

@@ -1,3 +1,3 @@
 export * from './error-handler.js';
-export * from './is-authenticated.js';
+export * from './is-authorized.js';
 export * from './ensure-user-context.js';

package/dist/middleware/index.js

@@ -1,3 +1,3 @@
 export * from './error-handler.js';
-export * from './is-authenticated.js';
+export * from './is-authorized.js';
 export * from './ensure-user-context.js';

package/dist/middleware/is-authorized.d.ts

@@ -0,0 +1,3 @@
+import { Request, Response, NextFunction } from 'express';
+declare const isAuthorized: (allowedFeatures?: string[]) => (req: Request, res: Response, next: NextFunction) => void;
+export { isAuthorized };

package/dist/middleware/is-authorized.js

@@ -0,0 +1,40 @@
+import { UserContextSpec } from '@loomcore/common/models';
+import { UnauthenticatedError, UnauthorizedError } from '../errors/index.js';
+import { JwtService } from '../services/index.js';
+import { config } from '../config/index.js';
+const isAuthorized = (allowedFeatures) => {
+    return (req, res, next) => {
+        let token = null;
+        if (req.headers?.authorization) {
+            let authHeader = req.headers.authorization;
+            const authHeaderArray = authHeader.split('Bearer ');
+            if (authHeaderArray?.length > 1) {
+                token = authHeaderArray[1];
+            }
+        }
+        if (!token) {
+            throw new UnauthenticatedError();
+        }
+        try {
+            const rawPayload = JwtService.verify(token, config.clientSecret);
+            const userContext = UserContextSpec.decode(rawPayload);
+            req.userContext = userContext;
+            if (userContext.authorizations.some(authorization => authorization.feature === 'admin')) {
+                next();
+            }
+            else if (allowedFeatures && allowedFeatures.length) {
+                if (!userContext.authorizations.some(authorization => allowedFeatures?.includes(authorization.feature))) {
+                    throw new UnauthorizedError();
+                }
+                next();
+            }
+            else {
+                next();
+            }
+        }
+        catch (err) {
+            throw new UnauthenticatedError();
+        }
+    };
+};
+export { isAuthorized };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {

package/dist/middleware/is-authenticated.d.ts

@@ -1,2 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-export declare const isAuthenticated: (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/is-authenticated.js

@@ -1,27 +0,0 @@
-import { UserContextSpec } from '@loomcore/common/models';
-import { UnauthenticatedError } from '../errors/index.js';
-import { JwtService } from '../services/index.js';
-import { config } from '../config/index.js';
-export const isAuthenticated = (req, res, next) => {
-    let token = null;
-    if (req.headers?.authorization) {
-        let authHeader = req.headers.authorization;
-        const authHeaderArray = authHeader.split('Bearer ');
-        if (authHeaderArray?.length > 1) {
-            token = authHeaderArray[1];
-        }
-    }
-    if (token) {
-        try {
-            const rawPayload = JwtService.verify(token, config.clientSecret);
-            req.userContext = UserContextSpec.decode(rawPayload);
-            next();
-        }
-        catch (err) {
-            throw new UnauthenticatedError();
-        }
-    }
-    else {
-        throw new UnauthenticatedError();
-    }
-};