@loomcore/api 0.2.27 → 0.2.28

package/README.md

@@ -8,7 +8,7 @@ This library provides a foundational structure for creating robust APIs, with a
 
 - **Generic API Controller**: A base `ApiController` that automatically scaffolds a full suite of RESTful endpoints for any data model. This includes support for CRUD operations, batch updates, pagination, and counting.
 - **Built-in Multi-tenancy**: Optional, configuration-driven multi-tenancy. When enabled, all database operations are automatically scoped to the current user's organization, ensuring strict data isolation.
-- **Authentication & Authorization**: Integrated JWT-based authentication middleware (`isAuthorized`) to easily secure endpoints and support for OAuth 2.0 Code Flow, including the use of refresh tokens.
+- **Authentication & Authorization**: Integrated JWT-based authentication with `@Authorize` / `@AllowAnonymous` decorators to secure endpoints, plus support for OAuth 2.0 Code Flow including refresh tokens.
 - **User & Organization Management**: Pre-built services and controllers for common user and organization management tasks.
 - **Password Management**: Includes services for handling password reset requests and workflows.
 - **Email Service Integration**: A ready-to-use service for sending transactional emails (e.g., for password resets or welcome messages).

package/dist/__tests__/common-test.utils.js

@@ -5,7 +5,6 @@ import { Value } from "@sinclair/typebox/value";
 import jwt from "jsonwebtoken";
 import { ObjectId } from "mongodb";
 import { ApiController } from "../controllers/api.controller.js";
-import { authenticated } from "../middleware/index.js";
 import { MongoDBDatabase } from "../databases/mongo-db/mongo-db.database.js";
 import { LeftJoin } from "../databases/operations/left-join.operation.js";
 import { PostgresDatabase } from "../databases/postgres/postgres.database.js";
@@ -220,7 +219,7 @@ export class CategoryService extends GenericApiService {
 export class CategoryController extends ApiController {
     constructor(app, database) {
         const categoryService = new CategoryService(database);
-        super("categories", app, categoryService, authenticated, "category", CategorySpec);
+        super("categories", app, categoryService, "category", CategorySpec);
     }
 }
 export function setupTestConfig(isMultiTenant = true, dbType) {
@@ -285,7 +284,7 @@ export class ProductService extends GenericApiService {
 export class ProductsController extends ApiController {
     constructor(app, database) {
         const productService = new ProductService(database);
-        super("products", app, productService, authenticated, "product", ProductSpec);
+        super("products", app, productService, "product", ProductSpec);
     }
     async get(req, res, next) {
         res.set("Content-Type", "application/json");
@@ -316,14 +315,15 @@ export class ProductsController extends ApiController {
         if (!idParam) {
             throw new Error("ID parameter is required");
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const entity = await this.service.getById(userContext, id, prepareQueryCustom, postProcessEntityCustom);
-            apiUtils.apiResponse(res, 200, { data: entity }, ProductWithCategorySpec, ProductWithCategoryPublicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new Error(`Invalid ID format: ${error.message || error}`);
         }
+        const entity = await this.service.getById(userContext, id, prepareQueryCustom, postProcessEntityCustom);
+        apiUtils.apiResponse(res, 200, { data: entity }, ProductWithCategorySpec, ProductWithCategoryPublicSpec);
     }
 }
 export class MultiTenantProductService extends MultiTenantApiService {
@@ -360,7 +360,7 @@ export class MultiTenantProductsController extends ApiController {
             "internalNumber",
         ]);
         const PublicAggregatedProductSpec = entityUtils.getModelSpec(PublicAggregatedProductSchema);
-        super("multi-tenant-products", app, productService, authenticated, "product", ProductSpec, PublicAggregatedProductSpec);
+        super("multi-tenant-products", app, productService, "product", ProductSpec, PublicAggregatedProductSpec);
     }
 }
 function configureJwtSecret() {

package/dist/__tests__/test-objects.js

@@ -54,30 +54,14 @@ export function getTestMetaOrgUserContext() {
     return {
         user: getTestMetaOrgUser(),
         organization: getTestMetaOrg(),
-        authorizations: [
-            {
-                _id: "6939c54e57a1c6576a40c590",
-                _orgId: getTestMetaOrg()._id,
-                role: "metaorgUser",
-                feature: "metaorgUser",
-                config: {},
-            },
-        ],
+        features: ["metaorgUser"],
     };
 }
 export function getTestMetaOrgAdminUserContext() {
     return {
         user: getTestMetaOrgUser(),
         organization: getTestMetaOrg(),
-        authorizations: [
-            {
-                _id: "6939c54e57a1c6576a40c590",
-                _orgId: getTestMetaOrg()._id,
-                role: "admin",
-                feature: "admin",
-                config: {},
-            },
-        ],
+        features: ["admin"],
     };
 }
 let TEST_ORG_ID = "6926167d06c0073a778a124f";
@@ -122,14 +106,6 @@ export function getTestOrgUserContext() {
     return {
         user: getTestOrgUser(),
         organization: getTestOrg(),
-        authorizations: [
-            {
-                _id: "6939c54e57a1c6576a40c591",
-                _orgId: getTestOrg()._id,
-                role: "testOrgUser",
-                feature: "testOrgUser",
-                config: {},
-            },
-        ],
+        features: ["testOrgUser"],
     };
 }

package/dist/controllers/api.controller.d.ts

@@ -2,17 +2,15 @@ import { Application, NextFunction, Request, Response } from 'express';
 import { IEntity, IModelSpec } from '@loomcore/common/models';
 import type { TSchema } from '@sinclair/typebox';
 import { IGenericApiService } from '../services/index.js';
-import { type MethodAuth } from '../middleware/index.js';
 export declare abstract class ApiController<T extends IEntity> {
     protected app: Application;
     protected service: IGenericApiService<T>;
     protected slug: string;
     protected apiResourceName: string;
-    protected routeAuth: MethodAuth;
     protected modelSpec?: IModelSpec;
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
-    protected constructor(slug: string, app: Application, service: IGenericApiService<T>, routeAuth?: MethodAuth, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected constructor(slug: string, app: Application, service: IGenericApiService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
     mapRoutes(app: Application): void;
     protected validate(entity: any, isPartial?: boolean): void;
     protected validateMany(entities: any[], isPartial?: boolean): void;

package/dist/controllers/api.controller.js

@@ -2,22 +2,19 @@ import { BadRequestError } from '../errors/index.js';
 import { entityUtils } from '@loomcore/common/utils';
 import { Value } from '@sinclair/typebox/value';
 import { getIdSchema } from '@loomcore/common/validation';
-import { apiUtils } from '../utils/index.js';
-import { authenticated, isAuthorized, } from '../middleware/index.js';
+import { apiUtils, authorizeMethod } from '../utils/index.js';
 export class ApiController {
     app;
     service;
     slug;
     apiResourceName;
-    routeAuth;
     modelSpec;
     publicSpec;
     idSchema;
-    constructor(slug, app, service, routeAuth = authenticated, resourceName = '', modelSpec, publicSpec) {
+    constructor(slug, app, service, resourceName = '', modelSpec, publicSpec) {
         this.slug = slug;
         this.app = app;
         this.service = service;
-        this.routeAuth = routeAuth;
         this.apiResourceName = resourceName;
         this.modelSpec = modelSpec;
         this.publicSpec = publicSpec;
@@ -25,16 +22,16 @@ export class ApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        const auth = isAuthorized(this.routeAuth);
-        app.get(`/api/${this.slug}`, auth, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, auth, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, auth, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, auth, this.getById.bind(this));
-        app.post(`/api/${this.slug}`, auth, this.create.bind(this));
-        app.patch(`/api/${this.slug}/batch`, auth, this.batchUpdate.bind(this));
-        app.put(`/api/${this.slug}/:id`, auth, this.fullUpdateById.bind(this));
-        app.patch(`/api/${this.slug}/:id`, auth, this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, auth, this.deleteById.bind(this));
+        const authorize = (method) => authorizeMethod(this, method);
+        app.get(`/api/${this.slug}`, authorize('get'), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, authorize('getAll'), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, authorize('getCount'), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, authorize('getById'), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, authorize('create'), this.create.bind(this));
+        app.patch(`/api/${this.slug}/batch`, authorize('batchUpdate'), this.batchUpdate.bind(this));
+        app.put(`/api/${this.slug}/:id`, authorize('fullUpdateById'), this.fullUpdateById.bind(this));
+        app.patch(`/api/${this.slug}/:id`, authorize('partialUpdateById'), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, authorize('deleteById'), this.deleteById.bind(this));
     }
     validate(entity, isPartial = false) {
         const validationErrors = this.service.validate(entity, isPartial);
@@ -61,14 +58,15 @@ export class ApiController {
         if (!idParam) {
             throw new BadRequestError('ID parameter is required');
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const entity = await this.service.getById(req.userContext, id);
-            apiUtils.apiResponse(res, 200, { data: entity }, this.modelSpec, this.publicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new BadRequestError(`Invalid ID format: ${error.message || error}`);
         }
+        const entity = await this.service.getById(req.userContext, id);
+        apiUtils.apiResponse(res, 200, { data: entity }, this.modelSpec, this.publicSpec);
     }
     async getCount(req, res, next) {
         res.set('Content-Type', 'application/json');
@@ -110,14 +108,15 @@ export class ApiController {
         if (!idParam) {
             throw new BadRequestError('ID parameter is required');
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const updateResult = await this.service.fullUpdateById(req.userContext, id, req.body);
-            apiUtils.apiResponse(res, 200, { data: updateResult }, this.modelSpec, this.publicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new BadRequestError(`Invalid ID format: ${error.message || error}`);
         }
+        const updateResult = await this.service.fullUpdateById(req.userContext, id, req.body);
+        apiUtils.apiResponse(res, 200, { data: updateResult }, this.modelSpec, this.publicSpec);
     }
     async partialUpdateById(req, res, next) {
         res.set('Content-Type', 'application/json');
@@ -126,14 +125,15 @@ export class ApiController {
         if (!idParam) {
             throw new BadRequestError('ID parameter is required');
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const updateResult = await this.service.partialUpdateById(req.userContext, id, req.body);
-            apiUtils.apiResponse(res, 200, { data: updateResult }, this.modelSpec, this.publicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new BadRequestError(`Invalid ID format: ${error.message || error}`);
         }
+        const updateResult = await this.service.partialUpdateById(req.userContext, id, req.body);
+        apiUtils.apiResponse(res, 200, { data: updateResult }, this.modelSpec, this.publicSpec);
     }
     async deleteById(req, res, next) {
         res.set('Content-Type', 'application/json');
@@ -141,13 +141,14 @@ export class ApiController {
         if (!idParam) {
             throw new BadRequestError('ID parameter is required');
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const deleteResult = await this.service.deleteById(req.userContext, id);
-            apiUtils.apiResponse(res, 200, { data: deleteResult }, this.modelSpec, this.publicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new BadRequestError(`Invalid ID format: ${error.message || error}`);
         }
+        const deleteResult = await this.service.deleteById(req.userContext, id);
+        apiUtils.apiResponse(res, 200, { data: deleteResult }, this.modelSpec, this.publicSpec);
     }
 }

package/dist/controllers/auth.controller.js

@@ -1,147 +1,195 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
 import { EmptyUserContext, passwordValidator, PublicUserContextSpec, PublicUserSpec, TokenResponseSpec, UserSpec, } from "@loomcore/common/models";
 import { entityUtils } from "@loomcore/common/utils";
 import { config } from "../config/base-api-config.js";
 import { BadRequestError, UnauthenticatedError } from "../errors/index.js";
-import { isAuthorized } from "../middleware/index.js";
 import { OrganizationService, UserService } from "../services/index.js";
-import { attemptLogin, changePassword, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, setAuthUserContextSpec, } from "../utils/auth/index.js";
+import { attemptLogin, authorizeMethod, changePassword, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, } from "../utils/auth/index.js";
 import { apiUtils } from "../utils/index.js";
-export class AuthController {
-    database;
-    userService;
-    organizationService;
-    userSpec;
-    publicUserSpec;
-    userContextSpec;
-    loginResponseSpec;
-    constructor(app, database, options = {
-        userService: new UserService(database),
-        userSpec: UserSpec,
-        publicUserSpec: PublicUserSpec,
-        publicUserContextSpec: PublicUserContextSpec,
-    }) {
-        this.database = database;
-        this.userSpec = options.userSpec;
-        this.publicUserSpec = options.publicUserSpec;
-        this.userContextSpec = options.publicUserContextSpec;
-        setAuthUserContextSpec(this.userContextSpec);
-        this.loginResponseSpec = createLoginResponseSpec(this.userContextSpec);
-        this.userService = options.userService;
-        this.organizationService = new OrganizationService(database);
-        this.mapRoutes(app);
-    }
-    mapRoutes(app) {
-        app.post(`/api/auth/login`, this.login.bind(this), this.afterAuth.bind(this));
-        app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
-        app.get(`/api/auth/get-user-context`, isAuthorized({ read: true }), this.getUserContext.bind(this));
-        app.patch(`/api/auth/change-password`, isAuthorized({ update: true }), this.changePassword.bind(this));
-        app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
-        app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
-    }
-    async login(req, res) {
-        const { email, password } = req.body;
-        if (!email || typeof email !== "string") {
-            throw new BadRequestError("Missing required fields: email is required.");
+import { Authorize } from "../decorators/authorize.decorator.js";
+let AuthController = (() => {
+    let _instanceExtraInitializers = [];
+    let _getUserContext_decorators;
+    let _changePassword_decorators;
+    return class AuthController {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _getUserContext_decorators = [Authorize()];
+            _changePassword_decorators = [Authorize()];
+            __esDecorate(this, null, _getUserContext_decorators, { kind: "method", name: "getUserContext", static: false, private: false, access: { has: obj => "getUserContext" in obj, get: obj => obj.getUserContext }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _changePassword_decorators, { kind: "method", name: "changePassword", static: false, private: false, access: { has: obj => "changePassword" in obj, get: obj => obj.changePassword }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        if (!password || typeof password !== "string") {
-            throw new BadRequestError("Missing required fields: password is required.");
+        database = __runInitializers(this, _instanceExtraInitializers);
+        userService;
+        organizationService;
+        userSpec;
+        publicUserSpec;
+        userContextSpec;
+        loginResponseSpec;
+        constructor(app, database, options = {
+            userService: new UserService(database),
+            userSpec: UserSpec,
+            publicUserSpec: PublicUserSpec,
+            publicUserContextSpec: PublicUserContextSpec,
+        }) {
+            this.database = database;
+            this.userSpec = options.userSpec;
+            this.publicUserSpec = options.publicUserSpec;
+            this.userContextSpec = options.publicUserContextSpec;
+            this.loginResponseSpec = createLoginResponseSpec(this.userContextSpec);
+            this.userService = options.userService;
+            this.organizationService = new OrganizationService(database);
+            this.mapRoutes(app);
         }
-        let organization = null;
-        if (config.app.isMultiTenant) {
-            const referer = req.get("referer") || req.headers.referer;
-            if (!referer) {
-                throw new BadRequestError("Missing required fields: referer is required.");
+        mapRoutes(app) {
+            const authorize = (method) => authorizeMethod(this, method);
+            app.post(`/api/auth/login`, this.login.bind(this), this.afterAuth.bind(this));
+            app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
+            app.get(`/api/auth/get-user-context`, authorize('getUserContext'), this.getUserContext.bind(this));
+            app.patch(`/api/auth/change-password`, authorize('changePassword'), this.changePassword.bind(this));
+            app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
+            app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
+        }
+        async login(req, res) {
+            const { email, password } = req.body;
+            if (!email || typeof email !== "string") {
+                throw new BadRequestError("Missing required fields: email is required.");
             }
-            organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
-            if (!organization) {
-                throw new BadRequestError("Missing required fields: organization is required.");
+            if (!password || typeof password !== "string") {
+                throw new BadRequestError("Missing required fields: password is required.");
             }
+            let organization = null;
+            if (config.app.isMultiTenant) {
+                const referer = req.get("referer") || req.headers.referer;
+                if (!referer) {
+                    throw new BadRequestError("Missing required fields: referer is required.");
+                }
+                organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
+                if (!organization) {
+                    throw new BadRequestError("Missing required fields: organization is required.");
+                }
+            }
+            res.set("Content-Type", "application/json");
+            const deviceId = getAndSetDeviceIdCookie(req, res);
+            const loginResponse = await attemptLogin(this.database, email, password, deviceId, organization, this.userService);
+            apiUtils.apiResponse(res, 200, { data: loginResponse }, this.loginResponseSpec);
         }
-        res.set("Content-Type", "application/json");
-        const deviceId = getAndSetDeviceIdCookie(req, res);
-        const loginResponse = await attemptLogin(this.database, email, password, deviceId, organization, this.userService);
-        apiUtils.apiResponse(res, 200, { data: loginResponse }, this.loginResponseSpec);
-    }
-    async requestTokenUsingRefreshToken(req, res) {
-        const userContext = req.userContext;
-        if (!userContext) {
-            throw new BadRequestError("Missing required fields: userContext is required.");
-        }
-        const refreshToken = req.query.refreshToken;
-        if (!refreshToken || typeof refreshToken !== "string") {
-            throw new BadRequestError("Missing required fields: refreshToken is required.");
-        }
-        const deviceId = getDeviceIdFromCookie(req);
-        const tokens = await requestTokenUsingRefreshToken(this.database, userContext, refreshToken, deviceId);
-        if (!tokens) {
-            throw new UnauthenticatedError();
-        }
-        apiUtils.apiResponse(res, 200, { data: tokens }, TokenResponseSpec);
-    }
-    async getUserContext(req, res) {
-        const userContext = req.userContext;
-        apiUtils.apiResponse(res, 200, { data: userContext }, this.userContextSpec);
-    }
-    afterAuth(_req, _res, _loginResponse) {
-        console.log("in afterAuth");
-    }
-    async changePassword(req, res) {
-        const userContext = req.userContext;
-        if (!userContext) {
-            throw new BadRequestError("Missing required fields: userContext is required.");
+        async requestTokenUsingRefreshToken(req, res) {
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new BadRequestError("Missing required fields: userContext is required.");
+            }
+            const refreshToken = req.query.refreshToken;
+            if (!refreshToken || typeof refreshToken !== "string") {
+                throw new BadRequestError("Missing required fields: refreshToken is required.");
+            }
+            const deviceId = getDeviceIdFromCookie(req);
+            const tokens = await requestTokenUsingRefreshToken(this.database, userContext, refreshToken, deviceId);
+            if (!tokens) {
+                throw new UnauthenticatedError();
+            }
+            apiUtils.apiResponse(res, 200, { data: tokens }, TokenResponseSpec);
         }
-        const password = req.body?.password;
-        const validationErrors = entityUtils.validate(this.userSpec, { password: password }, true, passwordValidator);
-        entityUtils.handleValidationResult(validationErrors, "AuthController.changePassword");
-        const updateResult = await changePassword(this.database, userContext, password, this.userService);
-        apiUtils.apiResponse(res, 200, { data: updateResult });
-    }
-    async forgotPassword(req, res) {
-        const email = req.body?.email;
-        if (!email || typeof email !== "string") {
-            throw new BadRequestError("Missing required fields: email is required.");
+        async getUserContext(req, res) {
+            const userContext = req.userContext;
+            apiUtils.apiResponse(res, 200, { data: userContext }, this.userContextSpec);
         }
-        let referer = req.get("referer") || req.headers.referer;
-        if (!referer) {
-            throw new BadRequestError("Missing required fields: referer is required.");
+        afterAuth(_req, _res, _loginResponse) {
+            console.log("in afterAuth");
         }
-        referer = referer.replace(/\/$/, "");
-        let organization = null;
-        if (config.app.isMultiTenant) {
-            organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
-            if (!organization) {
-                throw new BadRequestError("Missing required fields: organization is required.");
+        async changePassword(req, res) {
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new BadRequestError("Missing required fields: userContext is required.");
             }
+            const password = req.body?.password;
+            const validationErrors = entityUtils.validate(this.userSpec, { password: password }, true, passwordValidator);
+            entityUtils.handleValidationResult(validationErrors, "AuthController.changePassword");
+            const updateResult = await changePassword(this.database, userContext, password, this.userService);
+            apiUtils.apiResponse(res, 200, { data: updateResult });
         }
-        const userContext = {
-            ...EmptyUserContext,
-            organization: organization || undefined,
-        };
-        const user = await this.userService.findOne(userContext, {
-            filters: { email: { eq: email.toLowerCase() } },
-        });
-        if (user) {
-            await sendResetPasswordEmail(this.database, email, referer, organization || undefined);
-        }
-        apiUtils.apiResponse(res, 200);
-    }
-    async resetPassword(req, res) {
-        const { email, token, password } = req.body;
-        if (!email || !token || !password) {
-            throw new BadRequestError("Missing required fields: email, token, and password are required.");
-        }
-        let organization = null;
-        if (config.app.isMultiTenant) {
-            const referer = req.get("referer") || req.headers.referer;
+        async forgotPassword(req, res) {
+            const email = req.body?.email;
+            if (!email || typeof email !== "string") {
+                throw new BadRequestError("Missing required fields: email is required.");
+            }
+            let referer = req.get("referer") || req.headers.referer;
             if (!referer) {
                 throw new BadRequestError("Missing required fields: referer is required.");
             }
-            organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
-            if (!organization) {
-                throw new BadRequestError("Missing required fields: organization is required.");
+            referer = referer.replace(/\/$/, "");
+            let organization = null;
+            if (config.app.isMultiTenant) {
+                organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
+                if (!organization) {
+                    throw new BadRequestError("Missing required fields: organization is required.");
+                }
             }
+            const userContext = {
+                ...EmptyUserContext,
+                organization: organization || undefined,
+            };
+            const user = await this.userService.findOne(userContext, {
+                filters: { email: { eq: email.toLowerCase() } },
+            });
+            if (user) {
+                await sendResetPasswordEmail(this.database, email, referer, organization || undefined);
+            }
+            apiUtils.apiResponse(res, 200);
         }
-        const response = await resetPassword(this.database, email, token, password, organization, this.userService, this.userSpec);
-        apiUtils.apiResponse(res, 200, { data: response });
-    }
-}
+        async resetPassword(req, res) {
+            const { email, token, password } = req.body;
+            if (!email || !token || !password) {
+                throw new BadRequestError("Missing required fields: email, token, and password are required.");
+            }
+            let organization = null;
+            if (config.app.isMultiTenant) {
+                const referer = req.get("referer") || req.headers.referer;
+                if (!referer) {
+                    throw new BadRequestError("Missing required fields: referer is required.");
+                }
+                organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split("/")[2]);
+                if (!organization) {
+                    throw new BadRequestError("Missing required fields: organization is required.");
+                }
+            }
+            const response = await resetPassword(this.database, email, token, password, organization, this.userService, this.userSpec);
+            apiUtils.apiResponse(res, 200, { data: response });
+        }
+    };
+})();
+export { AuthController };

package/dist/controllers/authorizations.controller.d.ts

@@ -1,7 +1,7 @@
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
-import { type IAuthorization } from "../models/authorization.model.js";
 import { ApiController } from "./api.controller.js";
+import { IAuthorization } from "@loomcore/common/models";
 export declare class AuthorizationsController extends ApiController<IAuthorization> {
     constructor(app: Application, database: IDatabase);
 }

package/dist/controllers/authorizations.controller.js

@@ -1,10 +1,9 @@
-import { adminWrites } from "../middleware/index.js";
-import { AuthorizationModelSpec, } from "../models/authorization.model.js";
-import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
 import { ApiController } from "./api.controller.js";
+import { AuthorizationModelSpec } from "@loomcore/common/models";
+import { AuthorizationsService } from "../services/authorizations.service.js";
 export class AuthorizationsController extends ApiController {
     constructor(app, database) {
-        const authorizationService = new MultiTenantApiService(database, "authorizations", "authorization", AuthorizationModelSpec);
-        super("authorizations", app, authorizationService, adminWrites, "authorization", AuthorizationModelSpec);
+        const authorizationService = new AuthorizationsService(database);
+        super("authorizations", app, authorizationService, "authorization", AuthorizationModelSpec);
     }
 }

package/dist/controllers/features.controller.d.ts

@@ -1,6 +1,6 @@
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
-import { type IFeature } from "../models/feature.model.js";
+import { type IFeature } from "@loomcore/common/models";
 import { ApiController } from "./api.controller.js";
 export declare class FeaturesController extends ApiController<IFeature> {
     constructor(app: Application, database: IDatabase);

package/dist/controllers/features.controller.js

@@ -1,10 +1,9 @@
-import { adminWrites } from "../middleware/index.js";
-import { FeatureModelSpec } from "../models/feature.model.js";
-import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
+import { FeatureModelSpec } from "@loomcore/common/models";
+import { FeaturesService } from "../services/features.service.js";
 import { ApiController } from "./api.controller.js";
 export class FeaturesController extends ApiController {
     constructor(app, database) {
-        const featureService = new MultiTenantApiService(database, "features", "feature", FeatureModelSpec);
-        super("features", app, featureService, adminWrites, "feature", FeatureModelSpec, FeatureModelSpec);
+        const featureService = new FeaturesService(database);
+        super("features", app, featureService, "feature", FeatureModelSpec);
     }
 }