@loomcore/api 0.2.51 → 0.2.52

package/dist/__tests__/common-test.utils.d.ts

@@ -24,6 +24,7 @@ declare function setupTestUsers(): Promise<{
 declare function deleteTestUser(): Promise<void>;
 declare function simulateloginWithTestUser(): Promise<string>;
 declare function getAuthToken(): string;
+declare function getAdminAuthToken(): string;
 declare function getExpiredAuthToken(): string;
 declare function verifyToken(token: string): any;
 export declare class CategoryService extends GenericApiService<ICategory> {
@@ -66,6 +67,7 @@ declare const testUtils: {
     deleteMetaOrg: typeof deleteMetaOrg;
     deleteTestUser: typeof deleteTestUser;
     getAuthToken: typeof getAuthToken;
+    getAdminAuthToken: typeof getAdminAuthToken;
     getExpiredAuthToken: typeof getExpiredAuthToken;
     getTestMetaOrgRefererUrl: typeof testObjectsModule.getTestMetaOrgRefererUrl;
     initialize: typeof initialize;

package/dist/__tests__/common-test.utils.js

@@ -13,7 +13,7 @@ import { MultiTenantApiService } from '../services/multi-tenant-api.service.js';
 import { OrganizationService } from '../services/organization.service.js';
 import { OrganizationDomainService } from '../services/organization-domain.service.js';
 import * as testObjectsModule from './test-objects.js';
-const { getTestMetaOrg, getTestMetaOrgDomain, getTestMetaOrgRefererUrl, getTestOrg, getTestOrgDomain, getTestMetaOrgUser, getTestMetaOrgUserContext, getTestOrgUser, getTestOrgUserContext, setTestOrgId, setTestMetaOrgId, setTestMetaOrgUserId, setTestOrgUserId, TEST_META_ORG_DOMAIN, TEST_ORG_DOMAIN, } = testObjectsModule;
+const { getTestMetaOrg, getTestMetaOrgDomain, getTestMetaOrgRefererUrl, getTestOrg, getTestOrgDomain, getTestMetaOrgAdminUserContext, getTestMetaOrgUser, getTestMetaOrgUserContext, getTestOrgUser, getTestOrgUserContext, setTestOrgId, setTestMetaOrgId, setTestMetaOrgUserId, setTestOrgUserId, TEST_META_ORG_DOMAIN, TEST_ORG_DOMAIN, } = testObjectsModule;
 import { entityUtils } from '@loomcore/common/utils';
 import { config, setBaseApiConfig } from '../config/index.js';
 import { attemptLogin } from '../utils/auth/index.js';
@@ -208,6 +208,11 @@ function getAuthToken() {
     const token = jwt.sign(userContext, JWT_SECRET, { expiresIn: 3600 });
     return `Bearer ${token}`;
 }
+function getAdminAuthToken() {
+    const userContext = getTestMetaOrgAdminUserContext();
+    const token = jwt.sign(userContext, JWT_SECRET, { expiresIn: 3600 });
+    return `Bearer ${token}`;
+}
 function getExpiredAuthToken() {
     const userContext = getTestMetaOrgUserContext();
     const token = jwt.sign(userContext, JWT_SECRET, { expiresIn: -1 });
@@ -407,6 +412,7 @@ const testUtils = {
     deleteMetaOrg,
     deleteTestUser,
     getAuthToken,
+    getAdminAuthToken,
     getExpiredAuthToken,
     getTestMetaOrgRefererUrl,
     initialize,

package/dist/__tests__/mongo-db.test-database.js

@@ -3,6 +3,35 @@ import { MongoClient, ObjectId } from 'mongodb';
 import testUtils from './common-test.utils.js';
 import { initSystemUserContext } from '../config/base-api-config.js';
 import { MongoDBDatabase } from '../databases/index.js';
+function isPortBindError(error) {
+    const code = error?.code;
+    const message = error instanceof Error ? error.message : String(error);
+    return code === 'EACCES' || code === 'EADDRINUSE' || message.includes('EACCES') || message.includes('EADDRINUSE');
+}
+async function createMongoMemoryServer() {
+    const maxAttempts = 5;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            return await MongoMemoryServer.create({
+                instance: {
+                    ip: '127.0.0.1',
+                    port: 0,
+                },
+                binary: {
+                    downloadDir: process.env.HOME ? `${process.env.HOME}/.cache/mongodb-binaries` : undefined,
+                },
+            });
+        }
+        catch (error) {
+            lastError = error;
+            if (!isPortBindError(error) || attempt === maxAttempts) {
+                throw error;
+            }
+        }
+    }
+    throw lastError;
+}
 export class TestMongoDatabase {
     mongoServer = null;
     mongoClient = null;
@@ -14,22 +43,20 @@ export class TestMongoDatabase {
             return this.initPromise;
         }
         this.initPromise = this._performInit();
-        return this.initPromise;
+        try {
+            return await this.initPromise;
+        }
+        catch (error) {
+            this.initPromise = null;
+            throw error;
+        }
     }
     getRandomId() {
         return new ObjectId().toString();
     }
     async _performInit() {
         if (!this.database) {
-            this.mongoServer = await MongoMemoryServer.create({
-                instance: {
-                    ip: '127.0.0.1',
-                    port: 0,
-                },
-                binary: {
-                    downloadDir: process.env.HOME ? `${process.env.HOME}/.cache/mongodb-binaries` : undefined,
-                }
-            });
+            this.mongoServer = await createMongoMemoryServer();
             const uri = this.mongoServer.getUri();
             this.mongoClient = await MongoClient.connect(uri);
             this.mongoDb = this.mongoClient.db();
@@ -57,8 +84,15 @@ export class TestMongoDatabase {
         }
     }
     async cleanup() {
-        await testUtils.cleanup();
-        await this.clearCollections();
+        if (this.database) {
+            await testUtils.cleanup();
+        }
+        if (this.mongoDb) {
+            const collections = await this.mongoDb.collections();
+            for (const collection of collections) {
+                await collection.deleteMany({});
+            }
+        }
         if (this.mongoClient) {
             await this.mongoClient.close();
         }

package/dist/__tests__/test-express-app.js

@@ -64,13 +64,17 @@ async function clearCollections() {
     }
 }
 async function cleanup() {
-    if (testDatabase) {
-        await testDatabase.cleanup();
+    try {
+        if (testDatabase) {
+            await testDatabase.cleanup();
+        }
+    }
+    finally {
+        initPromise = null;
+        app = undefined;
+        database = undefined;
+        testDatabase = undefined;
     }
-    initPromise = null;
-    app = undefined;
-    database = undefined;
-    testDatabase = undefined;
 }
 export const TestExpressApp = {
     init,

package/dist/controllers/api.controller.d.ts

@@ -11,6 +11,7 @@ export declare abstract class ApiController<T extends IEntity> {
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
     protected constructor(slug: string, app: Application, service: IGenericApiService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected authorize(method: string): import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
     mapRoutes(app: Application): void;
     protected validate(entity: any, isPartial?: boolean): void;
     protected validateMany(entities: any[], isPartial?: boolean): void;

package/dist/controllers/api.controller.js

@@ -26,17 +26,19 @@ export class ApiController {
             this.publicSpec = publicSpec;
         }
     }
+    authorize(method) {
+        return authorizeMethod(this, method);
+    }
     mapRoutes(app) {
-        const authorize = (method) => authorizeMethod(this, method);
-        app.get(`/api/${this.slug}`, authorize('get'), this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, authorize('getAll'), this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, authorize('getCount'), this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, authorize('getById'), this.getById.bind(this));
-        app.post(`/api/${this.slug}`, authorize('create'), this.create.bind(this));
-        app.patch(`/api/${this.slug}/batch`, authorize('batchUpdate'), this.batchUpdate.bind(this));
-        app.put(`/api/${this.slug}/:id`, authorize('fullUpdateById'), this.fullUpdateById.bind(this));
-        app.patch(`/api/${this.slug}/:id`, authorize('partialUpdateById'), this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, authorize('deleteById'), this.deleteById.bind(this));
+        app.get(`/api/${this.slug}`, this.authorize('get'), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, this.authorize('getAll'), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, this.authorize('getCount'), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, this.authorize('getById'), this.getById.bind(this));
+        app.post(`/api/${this.slug}`, this.authorize('create'), this.create.bind(this));
+        app.patch(`/api/${this.slug}/batch`, this.authorize('batchUpdate'), this.batchUpdate.bind(this));
+        app.put(`/api/${this.slug}/:id`, this.authorize('fullUpdateById'), this.fullUpdateById.bind(this));
+        app.patch(`/api/${this.slug}/:id`, this.authorize('partialUpdateById'), this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, this.authorize('deleteById'), this.deleteById.bind(this));
     }
     validate(entity, isPartial = false) {
         const validationErrors = this.service.validate(entity, isPartial);

package/dist/controllers/auth.controller.js

@@ -37,7 +37,7 @@ import { entityUtils } from '@loomcore/common/utils';
 import { config } from '../config/base-api-config.js';
 import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
 import { OrganizationService, UserService } from '../services/index.js';
-import { attemptLogin, authorizeMethod, changePassword, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, } from '../utils/auth/index.js';
+import { attemptLogin, authorizeMethod, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, } from '../utils/auth/index.js';
 import { apiUtils } from '../utils/index.js';
 import { Authorize } from '../decorators/authorize.decorator.js';
 let AuthController = (() => {
@@ -135,7 +135,11 @@ let AuthController = (() => {
             const password = req.body?.password;
             const validationErrors = entityUtils.validate(this.userSpec, { password: password }, true, passwordValidator);
             entityUtils.handleValidationResult(validationErrors, 'AuthController.changePassword');
-            const updateResult = await changePassword(this.database, userContext, userContext.user._id, password, this.userService);
+            await this.userService.changePassword(userContext, userContext.user._id, password);
+            const updateResult = {
+                success: true,
+                count: 1,
+            };
             apiUtils.apiResponse(res, 200, { data: updateResult });
         }
         async forgotPassword(req, res) {

package/dist/controllers/features.controller.js

@@ -1,9 +1,61 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { FeatureModelSpec } from '@loomcore/common/models';
+import { Authorize } from '../decorators/authorize.decorator.js';
 import { FeatureService } from '../services/feature.service.js';
 import { ApiController } from './api.controller.js';
-export class FeaturesController extends ApiController {
-    constructor(app, database) {
-        const featureService = new FeatureService(database);
-        super('features', app, featureService, 'feature', FeatureModelSpec);
-    }
-}
+let FeaturesController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var FeaturesController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            FeaturesController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(app, database) {
+            const featureService = new FeatureService(database);
+            super('features', app, featureService, 'feature', FeatureModelSpec);
+        }
+    };
+    return FeaturesController = _classThis;
+})();
+export { FeaturesController };

package/dist/controllers/organizations.controller.js

@@ -34,7 +34,7 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 };
 import { BadRequestError } from '../errors/index.js';
 import { OrganizationService } from '../services/index.js';
-import { apiUtils, authorizeMethod } from '../utils/index.js';
+import { apiUtils } from '../utils/index.js';
 import { ApiController } from './api.controller.js';
 import { Authorize } from '../decorators/authorize.decorator.js';
 let OrganizationsController = (() => {
@@ -60,9 +60,8 @@ let OrganizationsController = (() => {
         }
         mapRoutes(app) {
             super.mapRoutes(app);
-            const authorize = (method) => authorizeMethod(this, method);
-            app.get(`/api/${this.slug}/get-by-name/:name`, authorize('getByName'), this.getByName.bind(this));
-            app.get(`/api/${this.slug}/get-by-code/:code`, authorize('getByCode'), this.getByCode.bind(this));
+            app.get(`/api/${this.slug}/get-by-name/:name`, this.authorize('getByName'), this.getByName.bind(this));
+            app.get(`/api/${this.slug}/get-by-code/:code`, this.authorize('getByCode'), this.getByCode.bind(this));
         }
         async getByName(req, res, next) {
             const { name } = req.params;

package/dist/controllers/query-api.controller.d.ts

@@ -11,6 +11,7 @@ export declare abstract class QueryApiController<T extends IEntity> {
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
     protected constructor(slug: string, app: Application, service: IGenericQueryService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected authorize(method: string): import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
     mapRoutes(app: Application): void;
     getAll(req: Request, res: Response, next: NextFunction): Promise<void>;
     get(req: Request, res: Response, next: NextFunction): Promise<void>;

package/dist/controllers/query-api.controller.js

@@ -20,12 +20,14 @@ export class QueryApiController {
         this.idSchema = getIdSchema();
         this.mapRoutes(app);
     }
+    authorize(method) {
+        return authorizeMethod(this, method);
+    }
     mapRoutes(app) {
-        const authorize = (method) => authorizeMethod(this, method);
-        app.get(`/api/${this.slug}`, authorize('get'), this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, authorize('getAll'), this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, authorize('getCount'), this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, authorize('getById'), this.getById.bind(this));
+        app.get(`/api/${this.slug}`, this.authorize('get'), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, this.authorize('getAll'), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, this.authorize('getCount'), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, this.authorize('getById'), this.getById.bind(this));
     }
     async getAll(req, res, next) {
         res.set('Content-Type', 'application/json');

package/dist/controllers/roles.controller.js

@@ -1,9 +1,61 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { RoleModelSpec } from '@loomcore/common/models';
+import { Authorize } from '../decorators/authorize.decorator.js';
 import { RoleService } from '../services/role.service.js';
 import { ApiController } from './api.controller.js';
-export class RolesController extends ApiController {
-    constructor(app, database) {
-        const roleService = new RoleService(database);
-        super('roles', app, roleService, 'role', RoleModelSpec);
-    }
-}
+let RolesController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var RolesController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            RolesController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(app, database) {
+            const roleService = new RoleService(database);
+            super('roles', app, roleService, 'role', RoleModelSpec);
+        }
+    };
+    return RolesController = _classThis;
+})();
+export { RolesController };

package/dist/controllers/user-roles.controller.js

@@ -1,9 +1,61 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { UserRoleModelSpec } from '@loomcore/common/models';
+import { Authorize } from '../decorators/authorize.decorator.js';
 import { UserRoleService } from '../services/user-role.service.js';
 import { ApiController } from './api.controller.js';
-export class UserRolesController extends ApiController {
-    constructor(app, database) {
-        const userRoleService = new UserRoleService(database);
-        super('user-roles', app, userRoleService, 'user-role', UserRoleModelSpec);
-    }
-}
+let UserRolesController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var UserRolesController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            UserRolesController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(app, database) {
+            const userRoleService = new UserRoleService(database);
+            super('user-roles', app, userRoleService, 'user-role', UserRoleModelSpec);
+        }
+    };
+    return UserRolesController = _classThis;
+})();
+export { UserRolesController };

package/dist/controllers/users.controller.d.ts

@@ -1,5 +1,5 @@
 import { type IModelSpec, type IUser } from '@loomcore/common/models';
-import type { Application } from 'express';
+import type { Application, Request, Response } from 'express';
 import type { IDatabase } from '../databases/models/index.js';
 import { UserService } from '../services/index.js';
 import { ApiController } from './api.controller.js';
@@ -11,4 +11,7 @@ export interface UsersControllerOptions {
 export declare class UsersController extends ApiController<IUser> {
     userService: UserService;
     constructor(app: Application, database: IDatabase, options?: UsersControllerOptions);
+    mapRoutes(app: Application): void;
+    getSelf(req: Request, res: Response): Promise<void>;
+    partialUpdateSelf(req: Request, res: Response): Promise<void>;
 }

package/dist/controllers/users.controller.js

@@ -1,14 +1,90 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
 import { PublicUserSpec, UserSpec, } from '@loomcore/common/models';
+import { Authorize } from '../decorators/authorize.decorator.js';
 import { UserService } from '../services/index.js';
+import { apiUtils } from '../utils/index.js';
 import { ApiController } from './api.controller.js';
-export class UsersController extends ApiController {
-    userService;
-    constructor(app, database, options = {
-        userService: new UserService(database),
-        userSpec: UserSpec,
-        publicUserSpec: PublicUserSpec,
-    }) {
-        super('users', app, options.userService, 'user', options.userSpec, options.publicUserSpec);
-        this.userService = options.userService;
-    }
-}
+let UsersController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    let _instanceExtraInitializers = [];
+    let _getSelf_decorators;
+    let _partialUpdateSelf_decorators;
+    var UsersController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _getSelf_decorators = [Authorize()];
+            _partialUpdateSelf_decorators = [Authorize()];
+            __esDecorate(this, null, _getSelf_decorators, { kind: "method", name: "getSelf", static: false, private: false, access: { has: obj => "getSelf" in obj, get: obj => obj.getSelf }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _partialUpdateSelf_decorators, { kind: "method", name: "partialUpdateSelf", static: false, private: false, access: { has: obj => "partialUpdateSelf" in obj, get: obj => obj.partialUpdateSelf }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            UsersController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        userService = __runInitializers(this, _instanceExtraInitializers);
+        constructor(app, database, options = {
+            userService: new UserService(database),
+            userSpec: UserSpec,
+            publicUserSpec: PublicUserSpec,
+        }) {
+            super('users', app, options.userService, 'user', options.userSpec, options.publicUserSpec);
+            this.userService = options.userService;
+        }
+        mapRoutes(app) {
+            app.get(`/api/${this.slug}/me`, this.authorize('getSelf'), this.getSelf.bind(this));
+            app.patch(`/api/${this.slug}/me`, this.authorize('partialUpdateSelf'), this.partialUpdateSelf.bind(this));
+            super.mapRoutes(app);
+        }
+        async getSelf(req, res) {
+            res.set('Content-Type', 'application/json');
+            const user = await this.userService.getById(req.userContext, req.userContext.user._id);
+            apiUtils.apiResponse(res, 200, { data: user }, this.modelSpec, this.publicSpec);
+        }
+        async partialUpdateSelf(req, res) {
+            res.set('Content-Type', 'application/json');
+            this.validate(req.body, true);
+            const user = await this.userService.partialUpdateById(req.userContext, req.userContext.user._id, req.body);
+            apiUtils.apiResponse(res, 200, { data: user }, this.modelSpec, this.publicSpec);
+        }
+    };
+    return UsersController = _classThis;
+})();
+export { UsersController };

package/dist/services/authorization.service.js

@@ -1,5 +1,4 @@
 import { AuthorizationModelSpec, getSystemUserContext, } from '@loomcore/common/models';
-import { assertUserHasFeature } from '../utils/index.js';
 import { FeatureService } from './feature.service.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 import { UserRoleService } from './user-role.service.js';
@@ -12,7 +11,6 @@ export class AuthorizationService extends MultiTenantApiService {
         this.featuresService = new FeatureService(database);
     }
     async preProcessEntity(userContext, entity, isCreate, allowId = true) {
-        assertUserHasFeature(userContext, ['admin', 'system', 'authorizations']);
         return super.preProcessEntity(userContext, entity, isCreate, allowId);
     }
     async getUserContextFeatures(user) {

package/dist/services/feature.service.d.ts

@@ -1,7 +1,6 @@
-import { IFeature, IUserContext } from '@loomcore/common/models';
+import { IFeature } from '@loomcore/common/models';
 import { IDatabase } from '../databases/index.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 export declare class FeatureService extends MultiTenantApiService<IFeature> {
     constructor(database: IDatabase);
-    preProcessEntity(userContext: IUserContext, entity: Partial<IFeature>, isCreate: boolean, allowId?: boolean): Promise<Partial<IFeature>>;
 }

package/dist/services/feature.service.js

@@ -1,12 +1,7 @@
 import { FeatureModelSpec } from '@loomcore/common/models';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
-import { assertUserHasFeature } from '../utils/index.js';
 export class FeatureService extends MultiTenantApiService {
     constructor(database) {
         super(database, 'features', 'feature', FeatureModelSpec);
     }
-    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
-        assertUserHasFeature(userContext, ['admin', 'system', 'features']);
-        return super.preProcessEntity(userContext, entity, isCreate, allowId);
-    }
 }

package/dist/services/role.service.d.ts

@@ -1,7 +1,6 @@
-import { IRole, IUserContext } from '@loomcore/common/models';
+import { IRole } from '@loomcore/common/models';
 import { IDatabase } from '../databases/index.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 export declare class RoleService extends MultiTenantApiService<IRole> {
     constructor(database: IDatabase);
-    preProcessEntity(userContext: IUserContext, entity: Partial<IRole>, isCreate: boolean, allowId?: boolean): Promise<Partial<IRole>>;
 }

package/dist/services/role.service.js

@@ -1,12 +1,7 @@
 import { RoleModelSpec } from '@loomcore/common/models';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
-import { assertUserHasFeature } from '../utils/index.js';
 export class RoleService extends MultiTenantApiService {
     constructor(database) {
         super(database, 'roles', 'role', RoleModelSpec);
     }
-    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
-        assertUserHasFeature(userContext, ['admin', 'system', 'roles']);
-        return super.preProcessEntity(userContext, entity, isCreate, allowId);
-    }
 }

package/dist/services/user-role.service.d.ts

@@ -1,7 +1,6 @@
-import { IUserContext, IUserRole } from '@loomcore/common/models';
+import { IUserRole } from '@loomcore/common/models';
 import { IDatabase } from '../databases/index.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 export declare class UserRoleService extends MultiTenantApiService<IUserRole> {
     constructor(database: IDatabase);
-    preProcessEntity(userContext: IUserContext, entity: Partial<IUserRole>, isCreate: boolean, allowId?: boolean): Promise<Partial<IUserRole>>;
 }

package/dist/services/user-role.service.js

@@ -1,12 +1,7 @@
 import { UserRoleModelSpec } from '@loomcore/common/models';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
-import { assertUserHasFeature } from '../utils/index.js';
 export class UserRoleService extends MultiTenantApiService {
     constructor(database) {
         super(database, 'userRoles', 'userRole', UserRoleModelSpec);
     }
-    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
-        assertUserHasFeature(userContext, ['admin', 'system', 'user-roles']);
-        return super.preProcessEntity(userContext, entity, isCreate, allowId);
-    }
 }

package/dist/services/user.service.d.ts

@@ -1,17 +1,14 @@
-import { type IModelSpec, type IPagedResult, type IQueryOptions, type IUser, type IUserContext } from '@loomcore/common/models';
+import { type IModelSpec, type IQueryOptions, type IUser, type IUserContext } from '@loomcore/common/models';
 import type { AppIdType } from '@loomcore/common/types';
 import type { IDatabase } from '../databases/models/index.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase, modelSpec?: IModelSpec);
-    getById(userContext: IUserContext, id: AppIdType): Promise<IUser>;
-    get(userContext: IUserContext, queryOptions?: IQueryOptions): Promise<IPagedResult<IUser>>;
-    getAll(userContext: IUserContext): Promise<IUser[]>;
-    getCount(userContext: IUserContext): Promise<number>;
     fullUpdateById(_userContext: IUserContext, _id: AppIdType, _entity: IUser): Promise<IUser>;
     update(userContext: IUserContext, queryObject: IQueryOptions, entity: Partial<IUser>): Promise<IUser[]>;
     batchUpdate(userContext: IUserContext, entities: Partial<IUser>[]): Promise<IUser[]>;
-    partialUpdateById(userContext: IUserContext, id: AppIdType, entity: Partial<IUser>, allowPasswordUpdate?: boolean): Promise<IUser>;
-    private assertPasswordUpdateAllowed;
+    partialUpdateById(userContext: IUserContext, id: AppIdType, entity: Partial<IUser>): Promise<IUser>;
+    changePassword(userContext: IUserContext, id: AppIdType, password: string): Promise<IUser>;
     preProcessEntity(userContext: IUserContext, entity: Partial<IUser>, isCreate: boolean, allowId?: boolean): Promise<Partial<IUser>>;
+    private assertPasswordNotPresent;
 }

package/dist/services/user.service.js

@@ -1,6 +1,5 @@
 import { UserSpec, } from '@loomcore/common/models';
 import { BadRequestError, ServerError } from '../errors/index.js';
-import { assertAdmin, assertUserOrAdmin, isAdmin, } from '../utils/auth/index.js';
 import { passwordUtils } from '../utils/password.utils.js';
 import { MultiTenantApiService } from './multi-tenant-api.service.js';
 import moment from 'moment';
@@ -8,58 +7,31 @@ export class UserService extends MultiTenantApiService {
     constructor(database, modelSpec = UserSpec) {
         super(database, 'users', 'user', modelSpec);
     }
-    async getById(userContext, id) {
-        assertUserOrAdmin(userContext, id);
-        return super.getById(userContext, id);
-    }
-    async get(userContext, queryOptions) {
-        assertAdmin(userContext);
-        return super.get(userContext, queryOptions);
-    }
-    async getAll(userContext) {
-        assertAdmin(userContext);
-        return super.getAll(userContext);
-    }
-    async getCount(userContext) {
-        assertAdmin(userContext);
-        return super.getCount(userContext);
-    }
     async fullUpdateById(_userContext, _id, _entity) {
         throw new ServerError('User full update is not allowed.');
     }
     async update(userContext, queryObject, entity) {
-        assertAdmin(userContext);
-        this.assertPasswordUpdateAllowed(userContext, null, entity, false);
+        this.assertPasswordNotPresent(entity);
         return super.update(userContext, queryObject, entity);
     }
     async batchUpdate(userContext, entities) {
-        assertAdmin(userContext);
         for (const entity of entities) {
-            this.assertPasswordUpdateAllowed(userContext, null, entity, false);
+            this.assertPasswordNotPresent(entity);
         }
         return super.batchUpdate(userContext, entities);
     }
-    async partialUpdateById(userContext, id, entity, allowPasswordUpdate = false) {
-        assertUserOrAdmin(userContext, id);
-        this.assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate);
+    async partialUpdateById(userContext, id, entity) {
+        this.assertPasswordNotPresent(entity);
         return super.partialUpdateById(userContext, id, entity);
     }
-    assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate) {
-        if (!('password' in entity)) {
-            return;
-        }
-        if (!entity.password) {
+    async changePassword(userContext, id, password) {
+        if (!password) {
             throw new BadRequestError('Password cannot be empty.');
         }
-        if (!allowPasswordUpdate) {
-            throw new ServerError('Use auth change password endpoint to update password.');
-        }
-        if (isAdmin(userContext)) {
-            return;
-        }
-        if (userContext.user._id !== id) {
-            throw new ServerError('You can only update your own password.');
-        }
+        const updates = {
+            password: password,
+        };
+        return super.partialUpdateById(userContext, id, updates);
     }
     async preProcessEntity(userContext, entity, isCreate, allowId = false) {
         const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate, allowId);
@@ -74,4 +46,9 @@ export class UserService extends MultiTenantApiService {
         }
         return preparedEntity;
     }
+    assertPasswordNotPresent(entity) {
+        if ('password' in entity) {
+            throw new BadRequestError('Cannot update user with password present on the entity.');
+        }
+    }
 }

package/dist/utils/auth/authorize-method.util.d.ts

@@ -1,2 +1,2 @@
 import { RequestHandler } from 'express';
-export declare function authorizeMethod<T extends object>(instance: T, methodName: Extract<keyof T, string>): RequestHandler;
+export declare function authorizeMethod(instance: object, methodName: string): RequestHandler;

package/dist/utils/auth/index.d.ts

@@ -1,11 +1,5 @@
-export * from './assert-admin.util.js';
-export * from './assert-admin-or-feature.util.js';
-export * from './assert-owner-or-admin.util.js';
-export * from './assert-user-or-admin.util.js';
 export * from './attempt-login.util.js';
 export * from './auth-user-specs.util.js';
-export * from './assert-user-has-feature.util.js';
-export * from './change-password.util.js';
 export * from './create-new-refresh-token.util.js';
 export * from './create-new-tokens.util.js';
 export * from './generate-device-id.util.js';

package/dist/utils/auth/index.js

@@ -1,11 +1,5 @@
-export * from './assert-admin.util.js';
-export * from './assert-admin-or-feature.util.js';
-export * from './assert-owner-or-admin.util.js';
-export * from './assert-user-or-admin.util.js';
 export * from './attempt-login.util.js';
 export * from './auth-user-specs.util.js';
-export * from './assert-user-has-feature.util.js';
-export * from './change-password.util.js';
 export * from './create-new-refresh-token.util.js';
 export * from './create-new-tokens.util.js';
 export * from './generate-device-id.util.js';

package/dist/utils/auth/reset-password.util.js

@@ -3,7 +3,6 @@ import { entityUtils } from '@loomcore/common/utils';
 import { BadRequestError, ServerError } from '../../errors/index.js';
 import { PasswordResetTokenService } from '../../services/password-reset-token.service.js';
 import { UserService } from '../../services/user.service.js';
-import { changePassword } from './change-password.util.js';
 export async function resetPassword(database, email, passwordResetToken, password, organization, userService = new UserService(database), userSpec = UserSpec) {
     const validationErrors = entityUtils.validate(userSpec, { password: password }, true, passwordValidator);
     entityUtils.handleValidationResult(validationErrors, 'AuthService.resetPassword');
@@ -26,9 +25,12 @@ export async function resetPassword(database, email, passwordResetToken, passwor
     if (!user) {
         throw new ServerError(`Unable to retrieve user for email: ${lowerCaseEmail}`);
     }
-    const result = await changePassword(database, systemUserContext, user._id, password, userService);
+    const result = await userService.changePassword(systemUserContext, user._id, password);
     console.log(`password changed using forgot-password for email: ${lowerCaseEmail}`);
     await passwordResetTokenService.deleteById(systemUserContext, retrievedPasswordResetToken._id);
     console.log(`passwordResetToken deleted for email: ${lowerCaseEmail}`);
-    return result;
+    return {
+        success: true,
+        count: 1,
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.51",
+  "version": "0.2.52",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {

package/dist/utils/auth/assert-admin-or-feature.util.d.ts

@@ -1,2 +0,0 @@
-import type { IUserContext } from '@loomcore/common/models';
-export declare function assertAdminOrFeature(userContext: IUserContext, features: string[], requireAll?: boolean): void;

package/dist/utils/auth/assert-admin-or-feature.util.js

@@ -1,8 +0,0 @@
-import { isAdmin } from './is-admin.util.js';
-import { assertUserHasFeature } from './assert-user-has-feature.util.js';
-export function assertAdminOrFeature(userContext, features, requireAll = false) {
-    if (isAdmin(userContext)) {
-        return;
-    }
-    assertUserHasFeature(userContext, features, requireAll);
-}

package/dist/utils/auth/assert-admin.util.d.ts

@@ -1,2 +0,0 @@
-import type { IUserContext } from '@loomcore/common/models';
-export declare function assertAdmin(userContext: IUserContext): void;

package/dist/utils/auth/assert-admin.util.js

@@ -1,7 +0,0 @@
-import { UnauthorizedError } from '../../errors/index.js';
-import { isAdmin } from './is-admin.util.js';
-export function assertAdmin(userContext) {
-    if (!isAdmin(userContext)) {
-        throw new UnauthorizedError();
-    }
-}

package/dist/utils/auth/assert-owner-or-admin.util.d.ts

@@ -1,2 +0,0 @@
-import type { IAuditable, IUserContext } from '@loomcore/common/models';
-export declare function assertOwnerOrAdmin(userContext: IUserContext, auditable: IAuditable): void;

package/dist/utils/auth/assert-owner-or-admin.util.js

@@ -1,10 +0,0 @@
-import { UnauthorizedError } from '../../errors/index.js';
-import { isAdmin } from './is-admin.util.js';
-export function assertOwnerOrAdmin(userContext, auditable) {
-    if (isAdmin(userContext)) {
-        return;
-    }
-    if (userContext.user._id !== auditable._createdBy) {
-        throw new UnauthorizedError();
-    }
-}

package/dist/utils/auth/assert-user-has-feature.util.d.ts

@@ -1,2 +0,0 @@
-import { IUserContext } from '@loomcore/common/models';
-export declare function assertUserHasFeature(userContext: IUserContext, features: string[], requireAll?: boolean): void;

package/dist/utils/auth/assert-user-has-feature.util.js

@@ -1,18 +0,0 @@
-import { UnauthorizedError } from '../../errors/index.js';
-export function assertUserHasFeature(userContext, features, requireAll = false) {
-    if (features.length === 0) {
-        return;
-    }
-    const missingFeatures = features.filter(feature => !userContext.features.includes(feature));
-    if (requireAll) {
-        if (missingFeatures.length > 0) {
-            throw new UnauthorizedError(missingFeatures);
-        }
-    }
-    else {
-        if (missingFeatures.length === features.length) {
-            throw new UnauthorizedError(missingFeatures);
-        }
-    }
-    return;
-}

package/dist/utils/auth/assert-user-or-admin.util.d.ts

@@ -1,3 +0,0 @@
-import type { IUserContext } from '@loomcore/common/models';
-import type { AppIdType } from '@loomcore/common/types';
-export declare function assertUserOrAdmin(userContext: IUserContext, userId: AppIdType): void;

package/dist/utils/auth/assert-user-or-admin.util.js

@@ -1,10 +0,0 @@
-import { UnauthorizedError } from '../../errors/index.js';
-import { isAdmin } from './is-admin.util.js';
-export function assertUserOrAdmin(userContext, userId) {
-    if (isAdmin(userContext)) {
-        return;
-    }
-    if (userContext.user._id !== userId) {
-        throw new UnauthorizedError();
-    }
-}

package/dist/utils/auth/change-password.util.d.ts

@@ -1,6 +0,0 @@
-import { type IUserContext } from '@loomcore/common/models';
-import type { IDatabase } from '../../databases/models/index.js';
-import type { UpdateResult } from '../../databases/models/update-result.js';
-import { UserService } from '../../services/user.service.js';
-import { AppIdType } from '@loomcore/common/types';
-export declare function changePassword(database: IDatabase, userContext: IUserContext, userId: AppIdType, password: string, userService?: UserService): Promise<UpdateResult>;

package/dist/utils/auth/change-password.util.js

@@ -1,11 +0,0 @@
-import { UserService } from '../../services/user.service.js';
-export async function changePassword(database, userContext, userId, password, userService = new UserService(database)) {
-    const updates = {
-        password: password,
-    };
-    await userService.partialUpdateById(userContext, userId, updates, true);
-    return {
-        success: true,
-        count: 1,
-    };
-}