@loomcore/api 0.2.56 → 0.2.58

package/dist/services/multi-tenant-api.service.js

@@ -2,6 +2,8 @@ import { getSystemUserId } from '@loomcore/common/validation';
 import { config } from '../config/base-api-config.js';
 import { BadRequestError } from '../errors/bad-request.error.js';
 import { ServerError } from '../errors/index.js';
+import { isMetaOrgAdmin } from '../utils/auth/is-admin.util.js';
+import { isSystemUser } from '../utils/auth/is-system-user.util.js';
 import { GenericApiService } from './generic-api-service/generic-api.service.js';
 import { TenantQueryDecorator } from './tenant-query-decorator.js';
 export class MultiTenantApiService extends GenericApiService {
@@ -23,8 +25,8 @@ export class MultiTenantApiService extends GenericApiService {
         if (!this.tenantDecorator) {
             throw new ServerError('A valid tenantDecorator was not provided to MultiTenantApiService.prepareQuery');
         }
-        const queryObject = this.tenantDecorator.applyTenantToQuery(userContext, queryOptions, this.pluralResourceName);
-        return { queryObject, operations };
+        queryOptions = this.tenantDecorator.applyTenantToQuery(userContext, queryOptions, this.pluralResourceName);
+        return { queryOptions, operations };
     }
     async preProcessEntity(userContext, entity, isCreate, allowId = false) {
         if (!config?.app?.isMultiTenant) {
@@ -34,9 +36,12 @@ export class MultiTenantApiService extends GenericApiService {
             throw new BadRequestError('A valid userContext was not provided to MultiTenantApiService.prepareEntity');
         }
         const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate, allowId);
-        if (isCreate && userContext.user._id !== getSystemUserId()) {
+        if (isCreate && !isSystemUser(userContext) && !isMetaOrgAdmin(userContext)) {
             preparedEntity._orgId = userContext.user._orgId;
         }
+        if (isCreate && isMetaOrgAdmin(userContext)) {
+            preparedEntity._orgId = preparedEntity._orgId ?? userContext.user._orgId;
+        }
         return preparedEntity;
     }
 }

package/dist/services/organization.service.js

@@ -1,7 +1,7 @@
 import { OrganizationSpec, } from '@loomcore/common/models';
 import { BadRequestError } from '../errors/index.js';
-import { GenericApiService } from './generic-api-service/generic-api.service.js';
 import { OrganizationDomainService } from './organization-domain.service.js';
+import { GenericApiService } from './generic-api-service/generic-api.service.js';
 export class OrganizationService extends GenericApiService {
     organizationDomainService;
     constructor(database) {
@@ -36,12 +36,14 @@ export class OrganizationService extends GenericApiService {
         return orgId;
     }
     async getMetaOrg(userContext) {
-        const org = await this.findOne(userContext, {
+        return this.findOne(userContext, {
             filters: { isMetaOrg: { eq: true } },
         });
-        return org;
     }
     async findByDomain(userContext, domain) {
+        if (!domain) {
+            throw new BadRequestError('Missing required fields: domain is required.');
+        }
         const organizationDomain = await this.organizationDomainService.findOne(userContext, {
             filters: { domain: { eq: domain } },
         });

package/dist/services/tenant-query-decorator.d.ts

@@ -7,7 +7,7 @@ export declare const DEFAULT_TENANT_OPTIONS: ITenantQueryOptions;
 export declare class TenantQueryDecorator {
     private options;
     constructor(options?: Partial<ITenantQueryOptions>);
-    applyTenantToQuery(userContext: IUserContext, queryObject: IQueryOptions, collectionName: string): IQueryOptions;
+    applyTenantToQuery(userContext: IUserContext, queryOptions: IQueryOptions, collectionName: string): IQueryOptions;
     applyTenantToQueryOptions(userContext: IUserContext, queryOptions: IQueryOptions, collectionName: string): IQueryOptions;
     applyTenantToEntity<T extends IEntity>(userContext: IUserContext, entity: T, collectionName: string): T;
     getOrgIdField(): string;

package/dist/services/tenant-query-decorator.js

@@ -1,4 +1,6 @@
 import { ServerError } from '../errors/index.js';
+import { isSystemUser } from '../utils/auth/is-system-user.util.js';
+import { isMetaOrgAdmin } from '../utils/auth/is-admin.util.js';
 export const DEFAULT_TENANT_OPTIONS = {
     orgIdField: '_orgId',
     excludedCollections: [],
@@ -8,16 +10,17 @@ export class TenantQueryDecorator {
     constructor(options = {}) {
         this.options = { ...DEFAULT_TENANT_OPTIONS, ...options };
     }
-    applyTenantToQuery(userContext, queryObject, collectionName) {
-        let result = queryObject;
+    applyTenantToQuery(userContext, queryOptions, collectionName) {
         const shouldApplyTenantFilter = !this.options.excludedCollections?.includes(collectionName) &&
-            userContext?.user._orgId;
+            userContext.user._orgId &&
+            !isSystemUser(userContext) &&
+            !isMetaOrgAdmin(userContext);
         if (shouldApplyTenantFilter) {
             const orgIdField = this.options.orgIdField || '_orgId';
-            result = {
-                ...queryObject,
+            queryOptions = {
+                ...queryOptions,
                 filters: {
-                    ...queryObject.filters,
+                    ...queryOptions.filters,
                     [orgIdField]: { eq: userContext.user._orgId },
                 },
             };
@@ -27,7 +30,7 @@ export class TenantQueryDecorator {
                 throw new ServerError('No _orgId found in userContext');
             }
         }
-        return result;
+        return queryOptions;
     }
     applyTenantToQueryOptions(userContext, queryOptions, collectionName) {
         const result = { ...queryOptions };

package/dist/services/utils/audit-for-create.util.js

@@ -1,8 +1,7 @@
-import { getSystemUserId } from '@loomcore/common/validation';
 import moment from 'moment';
 export function auditForCreate(userContext, doc) {
     const now = moment().utc().toDate();
-    const userId = userContext.user?._id ?? getSystemUserId();
+    const userId = userContext.impersonatorId ?? userContext.user?._id;
     doc._created = now;
     doc._createdBy = userId;
 }

package/dist/services/utils/audit-for-update.util.js

@@ -1,7 +1,6 @@
-import { getSystemUserId } from '@loomcore/common/validation';
 import moment from 'moment';
 export function auditForUpdate(userContext, doc) {
-    const userId = userContext.user?._id ?? getSystemUserId();
+    const userId = userContext.impersonatorId ?? userContext.user?._id;
     doc._updated = moment().utc().toDate();
     doc._updatedBy = userId;
 }

package/dist/utils/auth/authorize-method.util.d.ts

@@ -1,2 +1,2 @@
-import { RequestHandler } from 'express';
+import type { RequestHandler } from 'express';
 export declare function authorizeMethod(instance: object, methodName: string): RequestHandler;

package/dist/utils/auth/authorize-method.util.js

@@ -1,8 +1,19 @@
-import { resolveAuthRequirement } from '../../decorators/authorize.decorator.js';
+import { hasAllowAnonymous } from '../../decorators/allow-anonymous.decorator.js';
+import { hasAuthRequirement } from '../../decorators/authorize.decorator.js';
+import { resolveAllowAnonymous } from '../../decorators/resolve-allow-anonymous.util.js';
+import { resolveAuthRequirement } from '../../decorators/resolve-auth-requirement.util.js';
 import { buildAuthGuard } from '../../middleware/authorize/authorize.middleware.js';
 export function authorizeMethod(instance, methodName) {
     const constructor = instance.constructor;
     const prototype = Object.getPrototypeOf(instance);
-    const requirement = resolveAuthRequirement(constructor, prototype, methodName);
-    return buildAuthGuard(requirement);
+    const method = prototype?.[methodName];
+    const methodHasBoth = typeof method === 'function' && hasAllowAnonymous(method) && hasAuthRequirement(method);
+    const classHasBoth = hasAllowAnonymous(constructor) && hasAuthRequirement(constructor);
+    if (methodHasBoth || classHasBoth) {
+        throw new Error('Allow anonymous and authorize decorators cannot be used together.');
+    }
+    if (resolveAllowAnonymous(constructor, prototype, methodName)) {
+        return (_req, _res, next) => next();
+    }
+    return buildAuthGuard(resolveAuthRequirement(constructor, prototype, methodName));
 }

package/dist/utils/auth/impersonate-user.util.d.ts

@@ -0,0 +1,6 @@
+import { type ITokenResponse, type IUserContext } from '@loomcore/common/models';
+import type { AppIdType } from '@loomcore/common/types';
+import type { IDatabase } from '../../databases/models/index.js';
+import { AuthorizationService } from '../../services/authorization.service.js';
+import { UserService } from '../../services/user.service.js';
+export declare function impersonateUser(database: IDatabase, impersonatorUserContext: IUserContext, targetUserId: AppIdType, refreshToken: string, userService?: UserService, authorizationsService?: AuthorizationService): Promise<ITokenResponse>;

package/dist/utils/auth/impersonate-user.util.js

@@ -0,0 +1,35 @@
+import { BadRequestError } from '../../errors/index.js';
+import { AuthorizationService } from '../../services/authorization.service.js';
+import { UserService } from '../../services/user.service.js';
+import { generateJwt, IMPERSONATION_JWT_EXPIRATION_IN_SECONDS } from '../jwt.utils.js';
+import { getExpiresOnFromSeconds } from './get-expires-on-from-seconds.util.js';
+import { isAdmin } from './is-admin.util.js';
+export async function impersonateUser(database, impersonatorUserContext, targetUserId, refreshToken, userService = new UserService(database), authorizationsService = new AuthorizationService(database)) {
+    if (impersonatorUserContext.impersonatorId) {
+        throw new BadRequestError('Already impersonating.');
+    }
+    if (impersonatorUserContext.user._id === targetUserId) {
+        throw new BadRequestError('Cannot impersonate yourself.');
+    }
+    const targetUser = await userService.findOne(impersonatorUserContext, {
+        filters: { _id: { eq: targetUserId } },
+    });
+    if (!targetUser) {
+        throw new BadRequestError('User not found');
+    }
+    const targetFeatures = await authorizationsService.getUserContextFeatures(targetUser);
+    const impersonatedUserContext = {
+        user: targetUser,
+        features: targetFeatures,
+        impersonatorId: impersonatorUserContext.user._id,
+    };
+    if (isAdmin(impersonatedUserContext)) {
+        throw new BadRequestError('Cannot impersonate admin user.');
+    }
+    const accessToken = generateJwt(impersonatedUserContext, IMPERSONATION_JWT_EXPIRATION_IN_SECONDS);
+    return {
+        accessToken,
+        refreshToken,
+        expiresOn: getExpiresOnFromSeconds(IMPERSONATION_JWT_EXPIRATION_IN_SECONDS),
+    };
+}

package/dist/utils/auth/index.d.ts

@@ -11,7 +11,9 @@ export * from './get-device-id-from-cookie.util.js';
 export * from './get-expires-on-from-days.util.js';
 export * from './get-expires-on-from-minutes.util.js';
 export * from './get-expires-on-from-seconds.util.js';
+export * from './impersonate-user.util.js';
 export * from './is-admin.util.js';
+export * from './is-system-user.util.js';
 export * from './log-user-in.util.js';
 export * from './request-token-using-refresh-token.util.js';
 export * from './reset-password.util.js';

package/dist/utils/auth/index.js

@@ -11,7 +11,9 @@ export * from './get-device-id-from-cookie.util.js';
 export * from './get-expires-on-from-days.util.js';
 export * from './get-expires-on-from-minutes.util.js';
 export * from './get-expires-on-from-seconds.util.js';
+export * from './impersonate-user.util.js';
 export * from './is-admin.util.js';
+export * from './is-system-user.util.js';
 export * from './log-user-in.util.js';
 export * from './request-token-using-refresh-token.util.js';
 export * from './reset-password.util.js';

package/dist/utils/auth/is-admin.util.d.ts

@@ -1,2 +1,3 @@
-import type { IUserContext } from '@loomcore/common/models';
+import { type IUserContext } from '@loomcore/common/models';
 export declare function isAdmin(userContext: IUserContext): boolean;
+export declare function isMetaOrgAdmin(userContext: IUserContext): boolean;

package/dist/utils/auth/is-admin.util.js

@@ -1,3 +1,11 @@
+import { getSystemUserContext } from '@loomcore/common/models';
 export function isAdmin(userContext) {
-    return userContext.features.some((feature) => feature === 'admin' || feature === 'system');
+    return userContext.features.some((feature) => feature === 'admin');
+}
+export function isMetaOrgAdmin(userContext) {
+    if (!isAdmin(userContext)) {
+        return false;
+    }
+    const systemUserContext = getSystemUserContext();
+    return userContext.user._orgId === systemUserContext.user._orgId;
 }

package/dist/utils/auth/is-system-user.util.d.ts

@@ -0,0 +1,2 @@
+import type { IUserContext } from '@loomcore/common/models';
+export declare function isSystemUser(userContext: IUserContext): boolean;

package/dist/utils/auth/is-system-user.util.js

@@ -0,0 +1,4 @@
+import { getSystemUserId } from '@loomcore/common/validation';
+export function isSystemUser(userContext) {
+    return userContext.user?._id === getSystemUserId();
+}

package/dist/utils/jwt.utils.d.ts

@@ -1,2 +1,3 @@
 import type { IUserContext } from '@loomcore/common/models';
-export declare function generateJwt(userContext: IUserContext): string;
+export declare const IMPERSONATION_JWT_EXPIRATION_IN_SECONDS = 3600;
+export declare function generateJwt(userContext: IUserContext, expiresInSeconds?: number): string;

package/dist/utils/jwt.utils.js

@@ -1,8 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { getAuthConfig } from './auth/get-auth-config.util.js';
-export function generateJwt(userContext) {
+export const IMPERSONATION_JWT_EXPIRATION_IN_SECONDS = 3600;
+export function generateJwt(userContext, expiresInSeconds) {
     const authConfig = getAuthConfig();
-    const jwtExpiryConfig = authConfig.jwtExpirationInSeconds;
+    const jwtExpiryConfig = expiresInSeconds ?? authConfig.jwtExpirationInSeconds;
     const jwtExpirationInSeconds = typeof jwtExpiryConfig === 'string'
         ? Number.parseInt(jwtExpiryConfig, 10)
         : jwtExpiryConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.56",
+  "version": "0.2.58",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {
@@ -60,7 +60,7 @@
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@loomcore/common": "^0.0.90",
+    "@loomcore/common": "^0.0.92",
     "@sinclair/typebox": "0.34.33",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",