@loomcore/api 0.2.32 → 0.2.35

package/dist/controllers/auth.controller.js

@@ -110,16 +110,12 @@ let AuthController = (() => {
             apiUtils.apiResponse(res, 200, { data: loginResponse }, this.loginResponseSpec);
         }
         async requestTokenUsingRefreshToken(req, res) {
-            const userContext = req.userContext;
-            if (!userContext) {
-                throw new BadRequestError("Missing required fields: userContext is required.");
-            }
             const refreshToken = req.query.refreshToken;
             if (!refreshToken || typeof refreshToken !== "string") {
                 throw new BadRequestError("Missing required fields: refreshToken is required.");
             }
             const deviceId = getDeviceIdFromCookie(req);
-            const tokens = await requestTokenUsingRefreshToken(this.database, userContext, refreshToken, deviceId);
+            const tokens = await requestTokenUsingRefreshToken(this.database, refreshToken, deviceId);
             if (!tokens) {
                 throw new UnauthenticatedError();
             }

package/dist/databases/mongo-db/migrations/mongo-initial-schema.js

@@ -58,6 +58,9 @@ export const getMongoInitialSchema = (dbConfig) => {
                         .collection("users")
                         .createIndex({ email: 1 }, { unique: true });
                 }
+                await db
+                    .collection("users")
+                    .createIndex({ externalId: 1 }, { unique: true, sparse: true });
             },
             down: async ({ context: db }) => {
                 await db.collection("users").drop();
@@ -256,7 +259,6 @@ export const getMongoInitialSchema = (dbConfig) => {
                 const email = dbConfig.adminUser.email.toLowerCase();
                 await db.collection("users").insertOne({
                     ...orgDoc,
-                    externalId: "admin-user-external-id",
                     email,
                     password: hashedPassword,
                     displayName: "Admin User",

package/dist/databases/mongo-db/utils/build-mongo-url.util.js

@@ -18,5 +18,5 @@ export function buildMongoUrl(config) {
     if (!port) {
         throw new Error("Database configuration must include port to build a non-SRV MongoDB URL.");
     }
-    return `mongodb://${encodedUsername}:${encodedPassword}@${host}:${port}/${name}`;
+    return `mongodb://${encodedUsername}:${encodedPassword}@${host}:${port}/${name}?authSource=admin`;
 }

package/dist/databases/postgres/postgres.database.d.ts

@@ -30,5 +30,4 @@ export declare class PostgresDatabase implements IDatabase {
     deleteMany(queryObject: IQueryOptions, pluralResourceName: string): Promise<DeleteResult>;
     find<T extends IEntity>(queryObject: IQueryOptions, pluralResourceName: string): Promise<T[]>;
     findOne<T extends IEntity>(queryObject: IQueryOptions, pluralResourceName: string): Promise<T | null>;
-    getUserFeatures(userId: AppIdType, orgId?: AppIdType): Promise<string[]>;
 }

package/dist/databases/postgres/postgres.database.js

@@ -77,31 +77,4 @@ export class PostgresDatabase {
     async findOne(queryObject, pluralResourceName) {
         return findOneQuery(this.connection, queryObject, pluralResourceName);
     }
-    async getUserFeatures(userId, orgId) {
-        const now = new Date();
-        let query = `
-            SELECT DISTINCT
-                r."name" as "role",
-                f."name" as "feature",
-                a."config",
-                a."_id",
-                a."_orgId"
-            FROM "user_roles" ur
-            INNER JOIN "roles" r ON ur."role_id" = r."_id"
-            INNER JOIN "authorizations" a ON r."_id" = a."role_id"
-            INNER JOIN "features" f ON a."feature_id" = f."_id"
-            WHERE ur."user_id" = $1
-                AND ur."_deleted" IS NULL
-                AND a."_deleted" IS NULL
-                AND (a."start_date" IS NULL OR a."start_date" <= $2)
-                AND (a."end_date" IS NULL OR a."end_date" >= $2)
-        `;
-        const values = [userId, now];
-        if (orgId) {
-            query += ` AND ur."_orgId" = $3 AND r."_orgId" = $3 AND a."_orgId" = $3 AND f."_orgId" = $3`;
-            values.push(orgId);
-        }
-        const result = await this.connection.query(query, values);
-        return result.rows.map((row) => row.feature);
-    }
 }

package/dist/services/authorizations.service.d.ts

@@ -1,7 +1,10 @@
-import { IAuthorization, IUserContext } from "@loomcore/common/models";
-import { IDatabase } from "../databases/index.js";
+import { type IAuthorization, type IUser, type IUserContext } from "@loomcore/common/models";
+import type { IDatabase } from "../databases/index.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export declare class AuthorizationsService extends MultiTenantApiService<IAuthorization> {
+    private userRolesService;
+    private featuresService;
     constructor(database: IDatabase);
     preProcessEntity(userContext: IUserContext, entity: Partial<IAuthorization>, isCreate: boolean, allowId?: boolean): Promise<Partial<IAuthorization>>;
+    getUserContextFeatures(user: IUser): Promise<string[]>;
 }

package/dist/services/authorizations.service.js

@@ -1,12 +1,62 @@
-import { AuthorizationModelSpec } from "@loomcore/common/models";
-import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+import { AuthorizationModelSpec, getSystemUserContext, } from "@loomcore/common/models";
 import { assertUserHasFeature } from "../utils/index.js";
+import { FeaturesService } from "./features.service.js";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+import { UserRolesService } from "./user-roles.service.js";
 export class AuthorizationsService extends MultiTenantApiService {
+    userRolesService;
+    featuresService;
     constructor(database) {
         super(database, "authorizations", "authorization", AuthorizationModelSpec);
+        this.userRolesService = new UserRolesService(database);
+        this.featuresService = new FeaturesService(database);
     }
     async preProcessEntity(userContext, entity, isCreate, allowId = true) {
-        assertUserHasFeature(userContext, ['admin', 'system', 'authorizations']);
+        assertUserHasFeature(userContext, ["admin", "system", "authorizations"]);
         return super.preProcessEntity(userContext, entity, isCreate, allowId);
     }
+    async getUserContextFeatures(user) {
+        const systemUserContext = getSystemUserContext();
+        const now = new Date();
+        const userRoleQueryOptions = {
+            filters: { userId: { eq: user._id } },
+        };
+        if (user._orgId !== undefined) {
+            userRoleQueryOptions.filters._orgId = { eq: user._orgId };
+        }
+        const userRoles = await this.userRolesService.find(systemUserContext, userRoleQueryOptions);
+        const roleIds = [
+            ...new Set(userRoles
+                .filter((userRole) => !userRole._deleted)
+                .map((userRole) => userRole.roleId)),
+        ];
+        if (roleIds.length === 0) {
+            return [];
+        }
+        const authorizationQuery = {
+            filters: { roleId: { in: roleIds } },
+        };
+        if (user._orgId !== undefined) {
+            authorizationQuery.filters._orgId = { eq: user._orgId };
+        }
+        const authorizations = await this.find(systemUserContext, authorizationQuery);
+        const featureIds = [
+            ...new Set(authorizations
+                .filter((authorization) => !authorization._deleted &&
+                (!authorization.startDate || authorization.startDate <= now) &&
+                (!authorization.endDate || authorization.endDate >= now))
+                .map((authorization) => authorization.featureId)),
+        ];
+        if (featureIds.length === 0) {
+            return [];
+        }
+        const featureQuery = {
+            filters: { _id: { in: featureIds } },
+        };
+        if (user._orgId !== undefined) {
+            featureQuery.filters._orgId = { eq: user._orgId };
+        }
+        const features = await this.featuresService.find(systemUserContext, featureQuery);
+        return [...new Set(features.map((feature) => feature.name))];
+    }
 }

package/dist/services/multi-tenant-api.service.js

@@ -1,3 +1,4 @@
+import { getSystemUserId } from "@loomcore/common/validation";
 import { config } from "../config/base-api-config.js";
 import { BadRequestError } from "../errors/bad-request.error.js";
 import { ServerError } from "../errors/index.js";
@@ -12,7 +13,8 @@ export class MultiTenantApiService extends GenericApiService {
         }
     }
     prepareQuery(userContext, queryOptions, operations) {
-        if (!config?.app?.isMultiTenant || userContext?.user?._id === "system") {
+        if (!config?.app?.isMultiTenant ||
+            userContext?.user?._id === getSystemUserId()) {
             return super.prepareQuery(userContext, queryOptions, operations);
         }
         if (!userContext?.organization?._id) {
@@ -32,7 +34,7 @@ export class MultiTenantApiService extends GenericApiService {
             throw new BadRequestError("A valid userContext was not provided to MultiTenantApiService.prepareEntity");
         }
         const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate, allowId);
-        if (isCreate && userContext.user._id !== "system") {
+        if (isCreate && userContext.user._id !== getSystemUserId()) {
             preparedEntity._orgId = userContext.organization?._id;
         }
         return preparedEntity;

package/dist/utils/auth/attempt-login.util.d.ts

@@ -1,4 +1,5 @@
 import { type ILoginResponse, type IOrganization } from "@loomcore/common/models";
 import type { IDatabase } from "../../databases/models/index.js";
+import { AuthorizationsService } from "../../services/authorizations.service.js";
 import { UserService } from "../../services/user.service.js";
-export declare function attemptLogin(database: IDatabase, email: string, password: string, deviceId: string, organization: IOrganization | null, userService?: UserService): Promise<ILoginResponse>;
+export declare function attemptLogin(database: IDatabase, email: string, password: string, deviceId: string, organization: IOrganization | null, userService?: UserService, authorizationsService?: AuthorizationsService): Promise<ILoginResponse>;

package/dist/utils/auth/attempt-login.util.js

@@ -1,10 +1,10 @@
 import { EmptyUserContext, } from "@loomcore/common/models";
 import { BadRequestError } from "../../errors/index.js";
+import { AuthorizationsService } from "../../services/authorizations.service.js";
 import { UserService } from "../../services/user.service.js";
 import { passwordUtils } from "../password.utils.js";
 import { logUserIn } from "./log-user-in.util.js";
-import { getUserContextFeatures } from "../../services/utils/getUserContextAuthorizations.util.js";
-export async function attemptLogin(database, email, password, deviceId, organization, userService = new UserService(database)) {
+export async function attemptLogin(database, email, password, deviceId, organization, userService = new UserService(database), authorizationsService = new AuthorizationsService(database)) {
     const lowerCaseEmail = email.toLowerCase();
     const userContext = {
         ...EmptyUserContext,
@@ -22,7 +22,7 @@ export async function attemptLogin(database, email, password, deviceId, organiza
     if (!passwordsMatch) {
         throw new BadRequestError("Invalid Credentials");
     }
-    const features = await getUserContextFeatures(database, user);
+    const features = await authorizationsService.getUserContextFeatures(user);
     const authenticatedUserContext = {
         user: user,
         organization: organization ?? undefined,

package/dist/utils/auth/request-token-using-refresh-token.util.d.ts

@@ -1,3 +1,6 @@
-import type { ITokenResponse, IUserContext } from "@loomcore/common/models";
+import { type ITokenResponse } from "@loomcore/common/models";
 import type { IDatabase } from "../../databases/models/index.js";
-export declare function requestTokenUsingRefreshToken(database: IDatabase, userContext: IUserContext, refreshToken: string, deviceId: string): Promise<ITokenResponse | null>;
+import { AuthorizationsService } from "../../services/authorizations.service.js";
+import { OrganizationService } from "../../services/organization.service.js";
+import { UserService } from "../../services/user.service.js";
+export declare function requestTokenUsingRefreshToken(database: IDatabase, refreshToken: string, deviceId: string, userService?: UserService, organizationService?: OrganizationService, authorizationsService?: AuthorizationsService): Promise<ITokenResponse | null>;

package/dist/utils/auth/request-token-using-refresh-token.util.js

@@ -1,9 +1,42 @@
+import { getSystemUserContext, } from "@loomcore/common/models";
+import { AuthorizationsService } from "../../services/authorizations.service.js";
+import { OrganizationService } from "../../services/organization.service.js";
+import { UserService } from "../../services/user.service.js";
+import { config } from "../../config/base-api-config.js";
 import { createNewTokens } from "./create-new-tokens.util.js";
 import { getActiveRefreshToken } from "./get-active-refresh-token.util.js";
-export async function requestTokenUsingRefreshToken(database, userContext, refreshToken, deviceId) {
-    const activeRefreshToken = await getActiveRefreshToken(database, userContext, refreshToken, deviceId);
-    if (activeRefreshToken) {
-        return createNewTokens(userContext, activeRefreshToken);
+import { BadRequestError } from "../../errors/index.js";
+export async function requestTokenUsingRefreshToken(database, refreshToken, deviceId, userService = new UserService(database), organizationService = new OrganizationService(database), authorizationsService = new AuthorizationsService(database)) {
+    const systemUserContext = getSystemUserContext();
+    const activeRefreshToken = await getActiveRefreshToken(database, systemUserContext, refreshToken, deviceId);
+    if (!activeRefreshToken) {
+        return null;
     }
-    return null;
+    let organization = null;
+    if (config.app.isMultiTenant && activeRefreshToken._orgId) {
+        organization =
+            await organizationService.findOne(systemUserContext, {
+                filters: { _id: { eq: activeRefreshToken._orgId } },
+            });
+        if (!organization) {
+            throw new BadRequestError("Organization not found");
+        }
+    }
+    let userQueryOptions = {
+        filters: { _id: { eq: activeRefreshToken.userId } },
+    };
+    if (organization) {
+        userQueryOptions.filters = { ...userQueryOptions.filters, _orgId: { eq: organization._id } };
+    }
+    const user = await userService.findOne(systemUserContext, userQueryOptions);
+    if (!user) {
+        throw new BadRequestError("User not found");
+    }
+    const features = await authorizationsService.getUserContextFeatures(user);
+    const userContext = {
+        user,
+        organization: organization ?? undefined,
+        features,
+    };
+    return createNewTokens(userContext, activeRefreshToken);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.32",
+  "version": "0.2.35",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {
@@ -59,7 +59,7 @@
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@loomcore/common": "^0.0.80",
+    "@loomcore/common": "^0.0.81",
     "@sinclair/typebox": "0.34.33",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",

package/dist/services/utils/getUserContextAuthorizations.util.d.ts

@@ -1,3 +0,0 @@
-import type { IUser } from "@loomcore/common/models";
-import type { IDatabase } from "../../databases/models/index.js";
-export declare function getUserContextFeatures(database: IDatabase, user: IUser): Promise<string[]>;

package/dist/services/utils/getUserContextAuthorizations.util.js

@@ -1,9 +0,0 @@
-import { PostgresDatabase } from "../../databases/postgres/postgres.database.js";
-export async function getUserContextFeatures(database, user) {
-    if (!(database instanceof PostgresDatabase)) {
-        return [];
-    }
-    const orgId = user._orgId;
-    const features = await database.getUserFeatures(user._id, orgId);
-    return features;
-}