@loomcore/api 0.2.24 → 0.2.26

package/dist/controllers/auth.controller.d.ts

@@ -3,9 +3,10 @@ import type { Application, Request, Response } from "express";
 import type { IDatabase } from "../databases/models/index.js";
 import { OrganizationService, UserService } from "../services/index.js";
 export interface AuthControllerOptions {
-    userService?: UserService;
-    userSpec?: IModelSpec;
-    publicUserSpec?: IModelSpec;
+    userService: UserService;
+    userSpec: IModelSpec;
+    publicUserSpec: IModelSpec;
+    publicUserContextSpec: IModelSpec;
 }
 export declare class AuthController {
     database: IDatabase;
@@ -13,7 +14,7 @@ export declare class AuthController {
     organizationService: OrganizationService;
     userSpec: IModelSpec;
     publicUserSpec: IModelSpec;
-    publicUserContextSpec: IModelSpec;
+    userContextSpec: IModelSpec;
     loginResponseSpec: IModelSpec;
     constructor(app: Application, database: IDatabase, options?: AuthControllerOptions);
     mapRoutes(app: Application): void;

package/dist/controllers/auth.controller.js

@@ -1,10 +1,10 @@
-import { EmptyUserContext, passwordValidator, TokenResponseSpec, UserSpec, } from "@loomcore/common/models";
+import { EmptyUserContext, passwordValidator, PublicUserContextSpec, PublicUserSpec, TokenResponseSpec, UserSpec, } from "@loomcore/common/models";
 import { entityUtils } from "@loomcore/common/utils";
 import { config } from "../config/base-api-config.js";
 import { BadRequestError, UnauthenticatedError } from "../errors/index.js";
 import { isAuthorized } from "../middleware/index.js";
 import { OrganizationService, UserService } from "../services/index.js";
-import { attemptLogin, changePassword, createUserContextSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, resolveAuthUserSpecs, sendResetPasswordEmail, setAuthUserContextSpec, } from "../utils/auth/index.js";
+import { attemptLogin, changePassword, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, setAuthUserContextSpec, } from "../utils/auth/index.js";
 import { apiUtils } from "../utils/index.js";
 export class AuthController {
     database;
@@ -12,29 +12,22 @@ export class AuthController {
     organizationService;
     userSpec;
     publicUserSpec;
-    publicUserContextSpec;
+    userContextSpec;
     loginResponseSpec;
-    constructor(app, database, options = {}) {
+    constructor(app, database, options = {
+        userService: new UserService(database),
+        userSpec: UserSpec,
+        publicUserSpec: PublicUserSpec,
+        publicUserContextSpec: PublicUserContextSpec,
+    }) {
         this.database = database;
-        const userSpecFromService = options.userService?.getModelSpec();
-        const inheritedUserSpec = userSpecFromService && userSpecFromService !== UserSpec
-            ? userSpecFromService
-            : undefined;
-        const resolved = resolveAuthUserSpecs({
-            userSpec: options.userSpec ?? inheritedUserSpec,
-            publicUserSpec: options.publicUserSpec,
-        });
-        this.userSpec = resolved.userSpec;
-        this.publicUserSpec = resolved.publicUserSpec;
-        this.publicUserContextSpec = resolved.publicUserContextSpec;
-        this.loginResponseSpec = resolved.loginResponseSpec;
-        this.userService =
-            options.userService ?? new UserService(database, this.userSpec);
+        this.userSpec = options.userSpec;
+        this.publicUserSpec = options.publicUserSpec;
+        this.userContextSpec = options.publicUserContextSpec;
+        setAuthUserContextSpec(this.userContextSpec);
+        this.loginResponseSpec = createLoginResponseSpec(this.userContextSpec);
+        this.userService = options.userService;
         this.organizationService = new OrganizationService(database);
-        const jwtUserModelSpec = options.userSpec ?? inheritedUserSpec ?? options.publicUserSpec;
-        if (jwtUserModelSpec) {
-            setAuthUserContextSpec(createUserContextSpec(jwtUserModelSpec));
-        }
         this.mapRoutes(app);
     }
     mapRoutes(app) {
@@ -87,7 +80,7 @@ export class AuthController {
     }
     async getUserContext(req, res) {
         const userContext = req.userContext;
-        apiUtils.apiResponse(res, 200, { data: userContext }, this.publicUserContextSpec);
+        apiUtils.apiResponse(res, 200, { data: userContext }, this.userContextSpec);
     }
     afterAuth(_req, _res, _loginResponse) {
         console.log("in afterAuth");

package/dist/controllers/users.controller.d.ts

@@ -1,15 +1,14 @@
 import { type IModelSpec, type IUser } from "@loomcore/common/models";
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
-import type { MethodAuth } from "../middleware/index.js";
+import { type MethodAuth } from "../middleware/index.js";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
-export declare const usersRouteAuth: MethodAuth;
 export interface UsersControllerOptions {
-    userService?: UserService;
-    userSpec?: IModelSpec;
-    publicUserSpec?: IModelSpec;
-    routeAuth?: MethodAuth;
+    userService: UserService;
+    userSpec: IModelSpec;
+    publicUserSpec: IModelSpec;
+    methodAuth: MethodAuth;
 }
 export declare class UsersController extends ApiController<IUser> {
     userService: UserService;

package/dist/controllers/users.controller.js

@@ -1,19 +1,16 @@
 import { PublicUserSpec, UserSpec, } from "@loomcore/common/models";
+import { authenticated } from "../middleware/index.js";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
-export const usersRouteAuth = {
-    read: true,
-    create: true,
-    update: true,
-    delete: ["admin"],
-};
 export class UsersController extends ApiController {
     userService;
-    constructor(app, database, options = {}) {
-        const userSpec = options.userSpec ?? UserSpec;
-        const publicUserSpec = options.publicUserSpec ?? PublicUserSpec;
-        const userService = options.userService ?? new UserService(database, userSpec);
-        super("users", app, userService, options.routeAuth ?? usersRouteAuth, "user", userSpec, publicUserSpec);
-        this.userService = userService;
+    constructor(app, database, options = {
+        userService: new UserService(database),
+        userSpec: UserSpec,
+        publicUserSpec: PublicUserSpec,
+        methodAuth: authenticated,
+    }) {
+        super("users", app, options.userService, options.methodAuth, "user", options.userSpec, options.publicUserSpec);
+        this.userService = options.userService;
     }
 }

package/dist/middleware/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
 export * from "./is-authorized.js";
-export * from "./method-auth.model.js";
+export * from "../models/method-auth.model.js";
 export * from "./request-lifecycle.js";

package/dist/middleware/index.js

@@ -1,5 +1,5 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
 export * from "./is-authorized.js";
-export * from "./method-auth.model.js";
+export * from "../models/method-auth.model.js";
 export * from "./request-lifecycle.js";

package/dist/middleware/is-authorized.d.ts

@@ -1,4 +1,4 @@
 import type { NextFunction, Request, Response } from "express";
-import type { MethodAuth } from "./method-auth.model.js";
+import type { MethodAuth } from "../models/method-auth.model.js";
 declare const isAuthorized: (config: MethodAuth) => (req: Request, _res: Response, next: NextFunction) => void;
 export { isAuthorized };

package/dist/middleware/is-authorized.js

@@ -1,5 +1,5 @@
 import jwt from "jsonwebtoken";
-import { UnauthenticatedError, UnauthorizedError, } from "../errors/index.js";
+import { BadRequestError, UnauthenticatedError, UnauthorizedError, } from "../errors/index.js";
 import { getAuthUserContextSpec } from "../utils/auth/auth-user-specs.util.js";
 import { getAuthConfig } from "../utils/auth/get-auth-config.util.js";
 function resolveAuthMethod(req) {
@@ -18,13 +18,6 @@ function resolveAuthMethod(req) {
             return null;
     }
 }
-function userHasFeature(userContext, feature) {
-    return userContext.authorizations.some((authorization) => authorization.feature === feature);
-}
-function isAdmin(userContext) {
-    return (userHasFeature(userContext, "admin") ||
-        userHasFeature(userContext, "system"));
-}
 function assertFeatureRequirement(userContext, requirement) {
     if (requirement === undefined) {
         throw new UnauthorizedError();
@@ -32,7 +25,7 @@ function assertFeatureRequirement(userContext, requirement) {
     if (requirement === true) {
         return;
     }
-    if (!requirement.some((feature) => userHasFeature(userContext, feature))) {
+    if (!requirement.some((feature) => userContext.authorizations.some((authorization) => authorization.feature === feature))) {
         throw new UnauthorizedError();
     }
 }
@@ -53,13 +46,9 @@ const isAuthorized = (config) => {
         const rawPayload = jwt.verify(token, authConfig.clientSecret);
         const userContext = getAuthUserContextSpec().decode(rawPayload);
         req.userContext = userContext;
-        if (isAdmin(userContext)) {
-            next();
-            return;
-        }
         const method = resolveAuthMethod(req);
         if (!method) {
-            throw new UnauthorizedError();
+            throw new BadRequestError("Invalid HTTP method");
         }
         assertFeatureRequirement(userContext, config[method]);
         next();

package/dist/services/user.service.d.ts

@@ -4,9 +4,6 @@ import type { IDatabase } from "../databases/models/index.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase, modelSpec?: IModelSpec);
-    private isAdmin;
-    private assertAdmin;
-    private assertSelfOrAdmin;
     getById(userContext: IUserContext, id: AppIdType): Promise<IUser>;
     get(userContext: IUserContext, queryOptions?: IQueryOptions): Promise<IPagedResult<IUser>>;
     getAll(userContext: IUserContext): Promise<IUser[]>;

package/dist/services/user.service.js

@@ -1,61 +1,45 @@
 import { UserSpec, } from "@loomcore/common/models";
-import { BadRequestError, ServerError, UnauthorizedError, } from "../errors/index.js";
+import { BadRequestError, ServerError } from "../errors/index.js";
+import { assertAdmin, assertSelfOrAdmin, } from "../utils/auth/index.js";
 import { passwordUtils } from "../utils/password.utils.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export class UserService extends MultiTenantApiService {
     constructor(database, modelSpec = UserSpec) {
         super(database, "users", "user", modelSpec);
     }
-    isAdmin(userContext) {
-        return userContext.authorizations.some((authorization) => authorization.feature === "admin" ||
-            authorization.feature === "system");
-    }
-    assertAdmin(userContext) {
-        if (!this.isAdmin(userContext)) {
-            throw new UnauthorizedError();
-        }
-    }
-    assertSelfOrAdmin(userContext, id) {
-        if (this.isAdmin(userContext)) {
-            return;
-        }
-        if (userContext.user._id !== id) {
-            throw new UnauthorizedError();
-        }
-    }
     async getById(userContext, id) {
-        this.assertSelfOrAdmin(userContext, id);
+        assertSelfOrAdmin(userContext, id);
         return super.getById(userContext, id);
     }
     async get(userContext, queryOptions) {
-        this.assertAdmin(userContext);
+        assertAdmin(userContext);
         return super.get(userContext, queryOptions);
     }
     async getAll(userContext) {
-        this.assertAdmin(userContext);
+        assertAdmin(userContext);
         return super.getAll(userContext);
     }
     async getCount(userContext) {
-        this.assertAdmin(userContext);
+        assertAdmin(userContext);
         return super.getCount(userContext);
     }
     async fullUpdateById(_userContext, _id, _entity) {
         throw new ServerError("User full update is not allowed.");
     }
     async update(userContext, queryObject, entity) {
-        this.assertAdmin(userContext);
+        assertAdmin(userContext);
         this.assertPasswordUpdateAllowed(userContext, null, entity, false);
         return super.update(userContext, queryObject, entity);
     }
     async batchUpdate(userContext, entities) {
-        this.assertAdmin(userContext);
+        assertAdmin(userContext);
         for (const entity of entities) {
             this.assertPasswordUpdateAllowed(userContext, null, entity, false);
         }
         return super.batchUpdate(userContext, entities);
     }
     async partialUpdateById(userContext, id, entity, allowPasswordUpdate = false) {
-        this.assertSelfOrAdmin(userContext, id);
+        assertSelfOrAdmin(userContext, id);
         this.assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate);
         return super.partialUpdateById(userContext, id, entity);
     }

package/dist/utils/auth/assert-admin.util.d.ts

@@ -0,0 +1,2 @@
+import type { IUserContext } from "@loomcore/common/models";
+export declare function assertAdmin(userContext: IUserContext): void;

package/dist/utils/auth/assert-admin.util.js

@@ -0,0 +1,7 @@
+import { UnauthorizedError } from "../../errors/index.js";
+import { isAdmin } from "./is-admin.util.js";
+export function assertAdmin(userContext) {
+    if (!isAdmin(userContext)) {
+        throw new UnauthorizedError();
+    }
+}

package/dist/utils/auth/assert-owner-or-admin.util.d.ts

@@ -0,0 +1,2 @@
+import type { IAuditable, IUserContext } from "@loomcore/common/models";
+export declare function assertOwnerOrAdmin(userContext: IUserContext, entity: IAuditable): void;

package/dist/utils/auth/assert-owner-or-admin.util.js

@@ -0,0 +1,10 @@
+import { UnauthorizedError } from "../../errors/index.js";
+import { isAdmin } from "./is-admin.util.js";
+export function assertOwnerOrAdmin(userContext, entity) {
+    if (isAdmin(userContext)) {
+        return;
+    }
+    if (userContext.user._id !== entity._createdBy) {
+        throw new UnauthorizedError();
+    }
+}

package/dist/utils/auth/assert-self-or-admin.util.d.ts

@@ -0,0 +1,3 @@
+import type { IUserContext } from "@loomcore/common/models";
+import type { AppIdType } from "@loomcore/common/types";
+export declare function assertSelfOrAdmin(userContext: IUserContext, userId: AppIdType): void;

package/dist/utils/auth/assert-self-or-admin.util.js

@@ -0,0 +1,10 @@
+import { UnauthorizedError } from "../../errors/index.js";
+import { isAdmin } from "./is-admin.util.js";
+export function assertSelfOrAdmin(userContext, userId) {
+    if (isAdmin(userContext)) {
+        return;
+    }
+    if (userContext.user._id !== userId) {
+        throw new UnauthorizedError();
+    }
+}

package/dist/utils/auth/auth-user-specs.util.d.ts

@@ -1,15 +1,4 @@
 import { type IModelSpec } from "@loomcore/common/models";
-export declare function createUserContextSpec(userModelSpec: IModelSpec): IModelSpec;
-export declare function createLoginResponseSpec(publicUserContextSpec: IModelSpec): IModelSpec;
+export declare function createLoginResponseSpec(userContextSpec: IModelSpec): IModelSpec;
 export declare function setAuthUserContextSpec(spec: IModelSpec): void;
 export declare function getAuthUserContextSpec(): IModelSpec;
-export declare function resetAuthUserContextSpec(): void;
-export declare function resolveAuthUserSpecs(options: {
-    userSpec?: IModelSpec;
-    publicUserSpec?: IModelSpec;
-}): {
-    userSpec: IModelSpec;
-    publicUserSpec: IModelSpec;
-    publicUserContextSpec: IModelSpec;
-    loginResponseSpec: IModelSpec;
-};

package/dist/utils/auth/auth-user-specs.util.js

@@ -1,17 +1,10 @@
-import { OrganizationSpec, PublicUserSpec, TokenResponseSchema, UserContextAuthorizationSpec, UserContextSpec, UserSpec, } from "@loomcore/common/models";
+import { TokenResponseSchema, UserContextSpec, } from "@loomcore/common/models";
 import { entityUtils } from "@loomcore/common/utils";
 import { Type } from "@sinclair/typebox";
-export function createUserContextSpec(userModelSpec) {
-    return entityUtils.getModelSpec(Type.Object({
-        user: userModelSpec.fullSchema,
-        authorizations: Type.Array(UserContextAuthorizationSpec.fullSchema),
-        organization: OrganizationSpec.fullSchema,
-    }), { isEntity: false });
-}
-export function createLoginResponseSpec(publicUserContextSpec) {
+export function createLoginResponseSpec(userContextSpec) {
     return entityUtils.getModelSpec(Type.Object({
         tokens: TokenResponseSchema,
-        userContext: publicUserContextSpec.fullSchema,
+        userContext: userContextSpec.fullSchema,
     }), { isEntity: false });
 }
 let authUserContextSpec = UserContextSpec;
@@ -21,18 +14,3 @@ export function setAuthUserContextSpec(spec) {
 export function getAuthUserContextSpec() {
     return authUserContextSpec;
 }
-export function resetAuthUserContextSpec() {
-    authUserContextSpec = UserContextSpec;
-}
-export function resolveAuthUserSpecs(options) {
-    const userSpec = options.userSpec ?? UserSpec;
-    const publicUserSpec = options.publicUserSpec ?? PublicUserSpec;
-    const publicUserContextSpec = createUserContextSpec(publicUserSpec);
-    const loginResponseSpec = createLoginResponseSpec(publicUserContextSpec);
-    return {
-        userSpec,
-        publicUserSpec,
-        publicUserContextSpec,
-        loginResponseSpec,
-    };
-}

package/dist/utils/auth/index.d.ts

@@ -1,3 +1,6 @@
+export * from "./assert-admin.util.js";
+export * from "./assert-owner-or-admin.util.js";
+export * from "./assert-self-or-admin.util.js";
 export * from "./attempt-login.util.js";
 export * from "./auth-user-specs.util.js";
 export * from "./change-password.util.js";
@@ -12,6 +15,7 @@ export * from "./get-device-id-from-cookie.util.js";
 export * from "./get-expires-on-from-days.util.js";
 export * from "./get-expires-on-from-minutes.util.js";
 export * from "./get-expires-on-from-seconds.util.js";
+export * from "./is-admin.util.js";
 export * from "./log-user-in.util.js";
 export * from "./request-token-using-refresh-token.util.js";
 export * from "./reset-password.util.js";

package/dist/utils/auth/index.js

@@ -1,3 +1,6 @@
+export * from "./assert-admin.util.js";
+export * from "./assert-owner-or-admin.util.js";
+export * from "./assert-self-or-admin.util.js";
 export * from "./attempt-login.util.js";
 export * from "./auth-user-specs.util.js";
 export * from "./change-password.util.js";
@@ -12,6 +15,7 @@ export * from "./get-device-id-from-cookie.util.js";
 export * from "./get-expires-on-from-days.util.js";
 export * from "./get-expires-on-from-minutes.util.js";
 export * from "./get-expires-on-from-seconds.util.js";
+export * from "./is-admin.util.js";
 export * from "./log-user-in.util.js";
 export * from "./request-token-using-refresh-token.util.js";
 export * from "./reset-password.util.js";

package/dist/utils/auth/is-admin.util.d.ts

@@ -0,0 +1,2 @@
+import type { IUserContext } from "@loomcore/common/models";
+export declare function isAdmin(userContext: IUserContext): boolean;

package/dist/utils/auth/is-admin.util.js

@@ -0,0 +1,4 @@
+export function isAdmin(userContext) {
+    return userContext.authorizations.some((authorization) => authorization.feature === "admin" ||
+        authorization.feature === "system");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {