@loomcore/api 0.2.57 → 0.2.58

package/dist/__tests__/common-test.utils.d.ts

@@ -46,8 +46,8 @@ export declare class ProductsController extends ApiController<IProduct> {
 export declare class MultiTenantProductService extends MultiTenantApiService<IProduct> {
     private db;
     constructor(database: IDatabase);
-    prepareQuery(userContext: IUserContext, queryObject: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+    prepareQuery(userContext: IUserContext, queryOptions: IQueryOptions, operations: Operation[]): {
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     postProcessEntity(userContext: IUserContext, single: any): any;

package/dist/__tests__/common-test.utils.js

@@ -58,19 +58,20 @@ async function createMetaOrg() {
         throw new Error('OrganizationService not initialized. Call initialize() first.');
     }
     try {
-        const existingMetaOrg = await organizationService.getMetaOrg(EmptyUserContext);
+        const systemUserContext = getSystemUserContext();
+        const existingMetaOrg = await organizationService.getMetaOrg(systemUserContext);
         if (!existingMetaOrg) {
-            const metaOrgInsertResult = await organizationService.create(EmptyUserContext, getTestMetaOrg());
+            const metaOrgInsertResult = await organizationService.create(systemUserContext, getTestMetaOrg());
             if (metaOrgInsertResult) {
                 setTestMetaOrgId(metaOrgInsertResult._id);
-                await organizationDomainService.create(EmptyUserContext, getTestMetaOrgDomain(metaOrgInsertResult._id));
+                await organizationDomainService.create(systemUserContext, getTestMetaOrgDomain(metaOrgInsertResult._id));
             }
         }
         else {
             setTestMetaOrgId(existingMetaOrg._id);
-            const existingDomain = await organizationDomainService.findOne(EmptyUserContext, { filters: { domain: { eq: TEST_META_ORG_DOMAIN } } });
+            const existingDomain = await organizationDomainService.findOne(systemUserContext, { filters: { domain: { eq: TEST_META_ORG_DOMAIN } } });
             if (!existingDomain) {
-                await organizationDomainService.create(EmptyUserContext, getTestMetaOrgDomain(existingMetaOrg._id));
+                await organizationDomainService.create(systemUserContext, getTestMetaOrgDomain(existingMetaOrg._id));
             }
         }
     }
@@ -120,13 +121,13 @@ async function createTestUsers() {
                 throw new Error('Failed to create test organization');
             }
             setTestOrgId(createdTestOrg._id);
-            await organizationDomainService.create(EmptyUserContext, getTestOrgDomain(createdTestOrg._id));
+            await organizationDomainService.create(getSystemUserContext(), getTestOrgDomain(createdTestOrg._id));
         }
         else {
             setTestOrgId(existingTestOrg._id);
             const existingDomain = await organizationDomainService.findOne(EmptyUserContext, { filters: { domain: { eq: TEST_ORG_DOMAIN } } });
             if (!existingDomain) {
-                await organizationDomainService.create(EmptyUserContext, getTestOrgDomain(existingTestOrg._id));
+                await organizationDomainService.create(getSystemUserContext(), getTestOrgDomain(existingTestOrg._id));
             }
         }
         const createdTestOrgUser = await userService.create(getTestOrgUserContext(), getTestOrgUser());
@@ -271,9 +272,9 @@ export function setupTestConfig(isMultiTenant = true, dbType) {
         },
     });
 }
-const prepareQueryCustom = (userContext, queryObject, operations) => {
+const prepareQueryCustom = (userContext, queryOptions, operations) => {
     return {
-        queryObject: queryObject,
+        queryOptions: queryOptions,
         operations: [
             ...operations,
             new LeftJoin('categories', 'category_id', '_id', 'category'),
@@ -342,12 +343,12 @@ export class MultiTenantProductService extends MultiTenantApiService {
         super(database, 'products', 'product', ProductSpec);
         this.db = database;
     }
-    prepareQuery(userContext, queryObject, operations) {
+    prepareQuery(userContext, queryOptions, operations) {
         const newOperations = [
             ...operations,
             new LeftJoin('categories', 'categoryId', '_id', 'category'),
         ];
-        return super.prepareQuery(userContext, queryObject, newOperations);
+        return super.prepareQuery(userContext, queryOptions, newOperations);
     }
     postProcessEntity(userContext, single) {
         if (single && single.category) {

package/dist/__tests__/mongo-db.test-database.js

@@ -1,7 +1,7 @@
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import { MongoClient, ObjectId } from 'mongodb';
 import testUtils from './common-test.utils.js';
-import { initSystemUserContext } from '../config/base-api-config.js';
+import { config, initSystemUserContext } from '../config/base-api-config.js';
 import { MongoDBDatabase } from '../databases/index.js';
 function isPortBindError(error) {
     const code = error?.code;
@@ -64,6 +64,10 @@ export class TestMongoDatabase {
             this.database = testDatabase;
             testUtils.initialize(testDatabase);
             await this.createIndexes(this.mongoDb);
+            const { initializeSystemUserContext, isSystemUserContextInitialized } = await import('@loomcore/common/models');
+            if (!isSystemUserContextInitialized()) {
+                initializeSystemUserContext(config.email?.systemEmailAddress || 'system@test.com', undefined);
+            }
             await testUtils.createMetaOrg();
         }
         await initSystemUserContext(this.database);

package/dist/controllers/auth.controller.d.ts

@@ -21,6 +21,7 @@ export declare class AuthController {
     login(req: Request, res: Response): Promise<void>;
     requestTokenUsingRefreshToken(req: Request, res: Response): Promise<void>;
     getUserContext(req: Request, res: Response): Promise<void>;
+    impersonate(req: Request, res: Response): Promise<void>;
     afterAuth(_req: Request, _res: Response, _loginResponse: ILoginResponse): Promise<void>;
     changePassword(req: Request, res: Response): Promise<void>;
     forgotPassword(req: Request, res: Response): Promise<void>;

package/dist/controllers/auth.controller.js

@@ -37,19 +37,22 @@ import { entityUtils } from '@loomcore/common/utils';
 import { config } from '../config/base-api-config.js';
 import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
 import { OrganizationService, UserService } from '../services/index.js';
-import { attemptLogin, authorizeMethod, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, } from '../utils/auth/index.js';
+import { attemptLogin, authorizeMethod, createLoginResponseSpec, getAndSetDeviceIdCookie, getDeviceIdFromCookie, impersonateUser, requestTokenUsingRefreshToken, resetPassword, sendResetPasswordEmail, } from '../utils/auth/index.js';
 import { apiUtils } from '../utils/index.js';
 import { Authorize } from '../decorators/authorize.decorator.js';
 let AuthController = (() => {
     let _instanceExtraInitializers = [];
     let _getUserContext_decorators;
+    let _impersonate_decorators;
     let _changePassword_decorators;
     return class AuthController {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
             _getUserContext_decorators = [Authorize()];
-            _changePassword_decorators = [Authorize()];
+            _impersonate_decorators = [Authorize('admin')];
+            _changePassword_decorators = [Authorize({ denyOnImpersonation: true })];
             __esDecorate(this, null, _getUserContext_decorators, { kind: "method", name: "getUserContext", static: false, private: false, access: { has: obj => "getUserContext" in obj, get: obj => obj.getUserContext }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _impersonate_decorators, { kind: "method", name: "impersonate", static: false, private: false, access: { has: obj => "impersonate" in obj, get: obj => obj.impersonate }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _changePassword_decorators, { kind: "method", name: "changePassword", static: false, private: false, access: { has: obj => "changePassword" in obj, get: obj => obj.changePassword }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
@@ -80,6 +83,7 @@ let AuthController = (() => {
             app.post(`/api/auth/login`, this.login.bind(this));
             app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
             app.get(`/api/auth/get-user-context`, authorize('getUserContext'), this.getUserContext.bind(this));
+            app.post(`/api/auth/impersonate`, authorize('impersonate'), this.impersonate.bind(this));
             app.patch(`/api/auth/change-password`, authorize('changePassword'), this.changePassword.bind(this));
             app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
             app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
@@ -99,6 +103,9 @@ let AuthController = (() => {
                     throw new BadRequestError('Missing required fields: referer is required.');
                 }
                 const domain = referer.split('/')[2];
+                if (!domain) {
+                    throw new BadRequestError('Missing required fields: domain is required.');
+                }
                 organization = await this.organizationService.findByDomain(EmptyUserContext, domain);
                 if (!organization) {
                     throw new BadRequestError(`No organization found for domain: ${domain}`);
@@ -126,6 +133,26 @@ let AuthController = (() => {
             const userContext = req.userContext;
             apiUtils.apiResponse(res, 200, { data: userContext }, this.userContextSpec);
         }
+        async impersonate(req, res) {
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
+            const refreshToken = req.body.refreshToken;
+            if (!refreshToken || typeof refreshToken !== 'string') {
+                throw new BadRequestError('Missing required fields: refreshToken is required.');
+            }
+            const userId = req.body?.userId;
+            if (!userId) {
+                throw new BadRequestError('Missing required fields: userId is required.');
+            }
+            const deviceId = getDeviceIdFromCookie(req);
+            if (!deviceId || typeof deviceId !== 'string') {
+                throw new UnauthenticatedError();
+            }
+            const tokens = await impersonateUser(this.database, userContext, userId, refreshToken, this.userService);
+            apiUtils.apiResponse(res, 200, { data: tokens }, TokenResponseSpec);
+        }
         async afterAuth(_req, _res, _loginResponse) { }
         async changePassword(req, res) {
             const userContext = req.userContext;
@@ -151,10 +178,13 @@ let AuthController = (() => {
             if (!referer) {
                 throw new BadRequestError('Missing required fields: referer is required.');
             }
-            referer = referer.replace(/\/$/, '');
             let organization = null;
             if (config.app.isMultiTenant) {
-                organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split('/')[2]);
+                const domain = referer.split('/')[2];
+                if (!domain) {
+                    throw new BadRequestError('Missing required fields: domain is required.');
+                }
+                organization = await this.organizationService.findByDomain(EmptyUserContext, domain);
                 if (!organization) {
                     throw new BadRequestError('Missing required fields: organization is required.');
                 }
@@ -179,7 +209,11 @@ let AuthController = (() => {
                 if (!referer) {
                     throw new BadRequestError('Missing required fields: referer is required.');
                 }
-                organization = await this.organizationService.findByDomain(EmptyUserContext, referer.split('/')[2]);
+                const domain = referer.split('/')[2];
+                if (!domain) {
+                    throw new BadRequestError('Missing required fields: domain is required.');
+                }
+                organization = await this.organizationService.findByDomain(EmptyUserContext, domain);
                 if (!organization) {
                     throw new BadRequestError('Missing required fields: organization is required.');
                 }

package/dist/controllers/authorizations.controller.js

@@ -1,9 +1,61 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { ApiController } from './api.controller.js';
 import { AuthorizationModelSpec } from '@loomcore/common/models';
 import { AuthorizationService } from '../services/authorization.service.js';
-export class AuthorizationsController extends ApiController {
-    constructor(app, database) {
-        const authorizationService = new AuthorizationService(database);
-        super('authorizations', app, authorizationService, 'authorization', AuthorizationModelSpec);
-    }
-}
+import { Authorize } from '../decorators/authorize.decorator.js';
+let AuthorizationsController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var AuthorizationsController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            AuthorizationsController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(app, database) {
+            const authorizationService = new AuthorizationService(database);
+            super('authorizations', app, authorizationService, 'authorization', AuthorizationModelSpec);
+        }
+    };
+    return AuthorizationsController = _classThis;
+})();
+export { AuthorizationsController };

package/dist/controllers/organizations.controller.d.ts

@@ -1,4 +1,4 @@
-import type { IOrganization } from '@loomcore/common/models';
+import { type IOrganization } from '@loomcore/common/models';
 import type { Application, NextFunction, Request, Response } from 'express';
 import type { IDatabase } from '../databases/models/index.js';
 import { OrganizationService } from '../services/index.js';
@@ -13,4 +13,7 @@ export declare class OrganizationsController extends ApiController<IOrganization
     getByCode(req: Request<{
         code: string;
     }>, res: Response, next: NextFunction): Promise<void>;
+    getById(req: Request<{
+        id: string;
+    }>, res: Response, next: NextFunction): Promise<void>;
 }

package/dist/controllers/organizations.controller.js

@@ -1,3 +1,10 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
     function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
     var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
@@ -25,34 +32,32 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
-    var useValue = arguments.length > 2;
-    for (var i = 0; i < initializers.length; i++) {
-        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-    }
-    return useValue ? value : void 0;
-};
-import { BadRequestError } from '../errors/index.js';
+import { getSystemUserContext } from '@loomcore/common/models';
+import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
 import { OrganizationService } from '../services/index.js';
 import { apiUtils } from '../utils/index.js';
 import { ApiController } from './api.controller.js';
 import { Authorize } from '../decorators/authorize.decorator.js';
 let OrganizationsController = (() => {
-    let _classDecorators = [Authorize('admin')];
+    let _classDecorators = [Authorize({ features: ['admin'], requireMetaOrg: true })];
     let _classDescriptor;
     let _classExtraInitializers = [];
     let _classThis;
     let _classSuper = ApiController;
+    let _instanceExtraInitializers = [];
+    let _getById_decorators;
     var OrganizationsController = class extends _classSuper {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _getById_decorators = [Authorize('admin')];
+            __esDecorate(this, null, _getById_decorators, { kind: "method", name: "getById", static: false, private: false, access: { has: obj => "getById" in obj, get: obj => obj.getById }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
             OrganizationsController = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
             __runInitializers(_classThis, _classExtraInitializers);
         }
-        orgService;
+        orgService = __runInitializers(this, _instanceExtraInitializers);
         constructor(app, database) {
             const orgService = new OrganizationService(database);
             super('organizations', app, orgService);
@@ -65,9 +70,13 @@ let OrganizationsController = (() => {
         }
         async getByName(req, res, next) {
             const { name } = req.params;
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
             try {
                 res.set('Content-Type', 'application/json');
-                const entity = await this.orgService.findOne(req.userContext, {
+                const entity = await this.orgService.findOne(userContext, {
                     filters: { name: { contains: name } },
                 });
                 if (!entity)
@@ -81,9 +90,13 @@ let OrganizationsController = (() => {
         }
         async getByCode(req, res, next) {
             const { code } = req.params;
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
             try {
                 res.set('Content-Type', 'application/json');
-                const entity = await this.orgService.findOne(req.userContext, {
+                const entity = await this.orgService.findOne(userContext, {
                     filters: { code: { eq: code } },
                 });
                 if (!entity)
@@ -95,6 +108,20 @@ let OrganizationsController = (() => {
                 return;
             }
         }
+        async getById(req, res, next) {
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
+            if (String(req.params.id) === String(userContext.user._orgId)) {
+                return super.getById(req, res, next);
+            }
+            const systemUserContext = getSystemUserContext();
+            if (String(userContext.user._orgId) === String(systemUserContext.user._orgId)) {
+                return super.getById(req, res, next);
+            }
+            throw new BadRequestError('User is not authorized to access this organization');
+        }
     };
     return OrganizationsController = _classThis;
 })();

package/dist/controllers/types.d.ts

@@ -1,7 +1,7 @@
 import { IEntity, IQueryOptions, IUserContext } from '@loomcore/common/models';
 import { Operation } from '../databases/index.js';
-export type PrepareQueryCustomFunction = (userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]) => {
-    queryObject: IQueryOptions;
+export type PrepareQueryCustomFunction = (userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]) => {
+    queryOptions: IQueryOptions;
     operations: Operation[];
 };
 export type PostProcessEntityCustomFunction<TIn extends IEntity, TOut extends IEntity> = (userContext: IUserContext, entity: TIn) => TOut;

package/dist/decorators/allow-anonymous.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare function getValue(entity: any): boolean | undefined;
+export declare function hasAllowAnonymous(entity: any): boolean;
+export declare function AllowAnonymous(): (target: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;

package/dist/decorators/allow-anonymous.decorator.js

@@ -0,0 +1,13 @@
+const ALLOW_ANONYMOUS_METADATA_KEY = Symbol('auth-decorator:allow-anonymous');
+export function getValue(entity) {
+    const value = Reflect.getMetadata(ALLOW_ANONYMOUS_METADATA_KEY, entity);
+    return value;
+}
+export function hasAllowAnonymous(entity) {
+    return Reflect.hasOwnMetadata(ALLOW_ANONYMOUS_METADATA_KEY, entity);
+}
+export function AllowAnonymous() {
+    return function (target, _context) {
+        Reflect.defineMetadata(ALLOW_ANONYMOUS_METADATA_KEY, true, target);
+    };
+}

package/dist/decorators/auth-requirement.interface.d.ts

@@ -0,0 +1,7 @@
+export type MatchMode = 'all' | 'any';
+export interface IAuthRequirement {
+    features?: string[];
+    matchMode?: MatchMode;
+    denyOnImpersonation?: boolean;
+    requireMetaOrg?: boolean;
+}

package/dist/decorators/auth-requirement.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/decorators/authorize.decorator.d.ts

@@ -1,13 +1,9 @@
 import 'reflect-metadata';
-export declare const AUTH_METADATA_KEY: unique symbol;
-export type MatchMode = 'all' | 'any';
-export interface AuthRequirement {
-    features: string[];
-    mode: MatchMode;
-    allowAnonymous?: boolean;
-}
-export declare function Authorize(features?: string | string[], options?: {
-    all?: boolean;
-}): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
-export declare function AllowAnonymous(): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
-export declare function resolveAuthRequirement(controllerConstructor: Function, prototype: any, propertyKey: string): AuthRequirement | undefined;
+import { IAuthRequirement, MatchMode } from './index.js';
+export declare function getAuthRequirement(entity: any): IAuthRequirement | undefined;
+export declare function hasAuthRequirement(entity: any): boolean;
+type AuthorizeDecorator = (target: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
+export declare function Authorize(): AuthorizeDecorator;
+export declare function Authorize(authRequirement: IAuthRequirement): AuthorizeDecorator;
+export declare function Authorize(features: string | string[], matchMode?: MatchMode): AuthorizeDecorator;
+export {};

package/dist/decorators/authorize.decorator.js

@@ -1,33 +1,22 @@
 import 'reflect-metadata';
-export const AUTH_METADATA_KEY = Symbol('authorize:features');
-export function Authorize(features = [], options = {}) {
-    const requirement = {
-        features: Array.isArray(features) ? features : [features],
-        mode: options.all ? 'all' : 'any',
-    };
-    return function (value, _context) {
-        Reflect.defineMetadata(AUTH_METADATA_KEY, requirement, value);
-    };
+const AUTHORIZE_METADATA_KEY = Symbol('auth-decorator:authorize');
+export function getAuthRequirement(entity) {
+    const value = Reflect.getMetadata(AUTHORIZE_METADATA_KEY, entity);
+    return value;
 }
-export function AllowAnonymous() {
-    return function (value, _context) {
-        const metadataValue = {
-            features: [],
-            mode: 'any',
-            allowAnonymous: true,
-        };
-        Reflect.defineMetadata(AUTH_METADATA_KEY, metadataValue, value);
-    };
+export function hasAuthRequirement(entity) {
+    return Reflect.hasOwnMetadata(AUTHORIZE_METADATA_KEY, entity);
 }
-export function resolveAuthRequirement(controllerConstructor, prototype, propertyKey) {
-    const method = prototype[propertyKey];
-    if (typeof method === 'function') {
-        const methodLevel = Reflect.getMetadata(AUTH_METADATA_KEY, method);
-        if (methodLevel)
-            return methodLevel;
-    }
-    const classLevel = Reflect.getMetadata(AUTH_METADATA_KEY, controllerConstructor);
-    if (classLevel)
-        return classLevel;
-    return undefined;
+export function Authorize(authRequirementOrFeatures, matchMode) {
+    return function (target, _context) {
+        let authRequirement;
+        if (typeof authRequirementOrFeatures === 'string' || Array.isArray(authRequirementOrFeatures)) {
+            const featureList = Array.isArray(authRequirementOrFeatures) ? authRequirementOrFeatures : [authRequirementOrFeatures];
+            authRequirement = { features: featureList, matchMode: matchMode ?? 'any' };
+        }
+        else {
+            authRequirement = authRequirementOrFeatures;
+        }
+        Reflect.defineMetadata(AUTHORIZE_METADATA_KEY, authRequirement, target);
+    };
 }

package/dist/decorators/index.d.ts

@@ -1 +1,3 @@
-export { Authorize, AllowAnonymous } from './authorize.decorator.js';
+export { Authorize } from './authorize.decorator.js';
+export { AllowAnonymous } from './allow-anonymous.decorator.js';
+export type { IAuthRequirement, MatchMode } from './auth-requirement.interface.js';

package/dist/decorators/index.js

@@ -1 +1,2 @@
-export { Authorize, AllowAnonymous } from './authorize.decorator.js';
+export { Authorize } from './authorize.decorator.js';
+export { AllowAnonymous } from './allow-anonymous.decorator.js';

package/dist/decorators/resolve-allow-anonymous.util.d.ts

@@ -0,0 +1 @@
+export declare function resolveAllowAnonymous(controllerConstructor: Function, prototype: any, propertyKey: string): boolean | undefined;

package/dist/decorators/resolve-allow-anonymous.util.js

@@ -0,0 +1,6 @@
+import { getValue } from './allow-anonymous.decorator.js';
+import { resolveAuthDecoratorTarget } from './resolve-auth-decorator-target.util.js';
+export function resolveAllowAnonymous(controllerConstructor, prototype, propertyKey) {
+    const target = resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey);
+    return getValue(target);
+}

package/dist/decorators/resolve-auth-decorator-target.util.d.ts

@@ -0,0 +1 @@
+export declare function resolveAuthDecoratorTarget(controllerConstructor: Function, prototype: any, propertyKey: string): Function;

package/dist/decorators/resolve-auth-decorator-target.util.js

@@ -0,0 +1,9 @@
+import { hasAllowAnonymous } from './allow-anonymous.decorator.js';
+import { hasAuthRequirement } from './authorize.decorator.js';
+export function resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey) {
+    const method = prototype?.[propertyKey];
+    if (typeof method === 'function' && (hasAuthRequirement(method) || hasAllowAnonymous(method))) {
+        return method;
+    }
+    return controllerConstructor;
+}

package/dist/decorators/resolve-auth-requirement.util.d.ts

@@ -0,0 +1,2 @@
+import { IAuthRequirement } from './auth-requirement.interface.js';
+export declare function resolveAuthRequirement(controllerConstructor: Function, prototype: any, propertyKey: string): IAuthRequirement | undefined;

package/dist/decorators/resolve-auth-requirement.util.js

@@ -0,0 +1,6 @@
+import { getAuthRequirement } from './authorize.decorator.js';
+import { resolveAuthDecoratorTarget } from './resolve-auth-decorator-target.util.js';
+export function resolveAuthRequirement(controllerConstructor, prototype, propertyKey) {
+    const target = resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey);
+    return getAuthRequirement(target);
+}

package/dist/errors/unauthorized.error.d.ts

@@ -1,7 +1,7 @@
 import { CustomError } from '@loomcore/common/errors';
 export declare class UnauthorizedError extends CustomError {
     statusCode: number;
-    constructor(missing?: string[]);
+    constructor(message?: string);
     serializeErrors(): {
         message: string;
     }[];

package/dist/errors/unauthorized.error.js

@@ -1,10 +1,8 @@
 import { CustomError } from '@loomcore/common/errors';
 export class UnauthorizedError extends CustomError {
     statusCode = 403;
-    constructor(missing) {
-        super(missing?.length
-            ? `Missing required feature(s): ${missing.join(', ')}`
-            : 'Unauthorized');
+    constructor(message) {
+        super(message ?? 'Unauthorized');
         Object.setPrototypeOf(this, UnauthorizedError.prototype);
     }
     serializeErrors() {

package/dist/middleware/authorize/authorize.middleware.d.ts

@@ -1,3 +1,3 @@
 import type { RequestHandler } from 'express';
-import { AuthRequirement } from '../../decorators/authorize.decorator.js';
-export declare function buildAuthGuard(requirement: AuthRequirement | undefined): RequestHandler;
+import { IAuthRequirement } from '../../decorators/auth-requirement.interface.js';
+export declare function buildAuthGuard(requirement: IAuthRequirement | undefined): RequestHandler;

package/dist/middleware/authorize/authorize.middleware.js

@@ -1,23 +1,28 @@
 import { UnauthorizedError } from '../../errors/index.js';
 import { authenticateRequest } from './authenticate-request.js';
+import { getSystemUserContext } from '@loomcore/common/models';
 export function buildAuthGuard(requirement) {
     return (req, _res, next) => {
-        if (requirement?.allowAnonymous) {
-            return next();
-        }
         const userContext = authenticateRequest(req);
         req.userContext = userContext;
-        if (!requirement || requirement.features.length === 0) {
-            return next();
+        if (requirement?.denyOnImpersonation && userContext.impersonatorId !== undefined) {
+            throw new UnauthorizedError('Unauthorized: Endpoint requires non-impersonated user.');
+        }
+        const systemUserContext = getSystemUserContext();
+        if (requirement?.requireMetaOrg && userContext.user._orgId !== systemUserContext.user._orgId) {
+            throw new UnauthorizedError('Unauthorized: Endpoint requires meta organization user.');
         }
-        const userFeatures = new Set(userContext.features);
-        const hasAccess = requirement.mode === 'all'
-            ? requirement.features.every((f) => userFeatures.has(f))
-            : requirement.features.some((f) => userFeatures.has(f));
-        if (!hasAccess) {
-            const missing = requirement.features.filter((f) => !userFeatures.has(f));
-            throw new UnauthorizedError(missing);
+        if (requirement?.features?.length) {
+            const userFeatures = new Set(userContext.features);
+            const hasFeatures = requirement.matchMode === 'all'
+                ? requirement.features?.every((f) => userFeatures.has(f))
+                : requirement.features?.some((f) => userFeatures.has(f));
+            if (!hasFeatures) {
+                const missing = requirement.features?.filter((f) => !userFeatures.has(f));
+                throw new UnauthorizedError(`Unauthorized: Missing required feature(s): ${missing?.join(', ')}`);
+            }
         }
         next();
     };
 }
+;

package/dist/services/generic-api-service/generic-api-service.interface.d.ts

@@ -8,8 +8,8 @@ export interface IGenericApiService<T extends IEntity> {
     getModelSpec(): IModelSpec;
     validate(doc: any, isPartial?: boolean): ValueError[] | null;
     validateMany(docs: any[], isPartial?: boolean): ValueError[] | null;
-    prepareQuery(userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+    prepareQuery(userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]): {
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     preProcessEntity(userContext: IUserContext, entity: Partial<T>, isCreate: boolean, allowId: boolean): Promise<Partial<T>>;

package/dist/services/generic-api-service/generic-api.service.d.ts

@@ -15,8 +15,8 @@ export declare class GenericApiService<T extends IEntity> implements IGenericApi
     getModelSpec(): IModelSpec;
     getAll(userContext: IUserContext): Promise<T[]>;
     getAll<TCustom extends IEntity>(userContext: IUserContext, prepareQueryCustom: PrepareQueryCustomFunction, postProcessEntityCustom: PostProcessEntityCustomFunction<T, TCustom>): Promise<TCustom[]>;
-    prepareQuery(userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+    prepareQuery(userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]): {
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     validate(doc: any, isPartial?: boolean): ValueError[] | null;
@@ -35,9 +35,9 @@ export declare class GenericApiService<T extends IEntity> implements IGenericApi
     fullUpdateById(userContext: IUserContext, id: AppIdType, entity: T): Promise<T>;
     partialUpdateById(userContext: IUserContext, id: AppIdType, entity: Partial<T>): Promise<T>;
     partialUpdateByIdWithoutPreAndPostProcessing(userContext: IUserContext, id: AppIdType, entity: Partial<T>): Promise<T>;
-    update(userContext: IUserContext, queryObject: IQueryOptions, entity: Partial<T>): Promise<T[]>;
+    update(userContext: IUserContext, queryOptions: IQueryOptions, entity: Partial<T>): Promise<T[]>;
     deleteById(userContext: IUserContext, id: AppIdType): Promise<DeleteResult>;
-    deleteMany(userContext: IUserContext, queryObject: IQueryOptions): Promise<DeleteResult>;
-    find(userContext: IUserContext, queryObject: IQueryOptions): Promise<T[]>;
-    findOne(userContext: IUserContext, queryObject: IQueryOptions): Promise<T | null>;
+    deleteMany(userContext: IUserContext, queryOptions: IQueryOptions): Promise<DeleteResult>;
+    find(userContext: IUserContext, queryOptions: IQueryOptions): Promise<T[]>;
+    findOne(userContext: IUserContext, queryOptions: IQueryOptions): Promise<T | null>;
 }

package/dist/services/generic-api-service/generic-api.service.js

@@ -24,9 +24,7 @@ export class GenericApiService {
         if (prepareQueryCustom) {
             operations = prepareQueryCustom(userContext, {}, []).operations;
         }
-        else {
-            operations = this.prepareQuery(userContext, {}, []).operations;
-        }
+        operations = this.prepareQuery(userContext, {}, operations).operations;
         const entities = await this.database.getAll(operations, this.pluralResourceName);
         return entities.map((entity) => {
             const dbProcessed = this.postProcessEntity(userContext, entity);
@@ -36,8 +34,8 @@ export class GenericApiService {
             return dbProcessed;
         });
     }
-    prepareQuery(userContext, queryObject, operations) {
-        return { queryObject, operations };
+    prepareQuery(userContext, queryOptions, operations) {
+        return { queryOptions, operations };
     }
     validate(doc, isPartial = false) {
         return entityUtils.validate(this.modelSpec, doc, isPartial);
@@ -77,15 +75,12 @@ export class GenericApiService {
         return this.database.postProcessEntity(entity, this.modelSpec.fullSchema);
     }
     async get(userContext, queryOptions = { ...DefaultQueryOptions }, prepareQueryCustom, postProcessEntityCustom) {
-        const preparedOptions = this.prepareQueryOptions(userContext, queryOptions);
         let operations = [];
         if (prepareQueryCustom) {
-            operations = prepareQueryCustom(userContext, {}, []).operations;
+            ({ queryOptions, operations } = prepareQueryCustom(userContext, {}, []));
         }
-        else {
-            operations = this.prepareQuery(userContext, {}, []).operations;
-        }
-        const pagedResult = await this.database.get(operations, preparedOptions, this.modelSpec, this.pluralResourceName);
+        ({ queryOptions, operations } = this.prepareQuery(userContext, queryOptions, operations));
+        const pagedResult = await this.database.get(operations, queryOptions, this.modelSpec, this.pluralResourceName);
         const transformedEntities = (pagedResult.entities || []).map((entity) => {
             const transformedEntity = this.postProcessEntity(userContext, entity);
             if (postProcessEntityCustom) {
@@ -103,18 +98,12 @@ export class GenericApiService {
     }
     async getById(userContext, id, prepareQueryCustom, postProcessEntityCustom) {
         let operations = [];
-        let queryObject = {};
+        let queryOptions = {};
         if (prepareQueryCustom) {
-            const result = prepareQueryCustom(userContext, {}, []);
-            operations = result.operations;
-            queryObject = result.queryObject;
-        }
-        else {
-            const result = this.prepareQuery(userContext, {}, []);
-            operations = result.operations;
-            queryObject = result.queryObject;
+            ({ operations, queryOptions } = prepareQueryCustom(userContext, {}, []));
         }
-        const entity = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
+        ({ operations, queryOptions } = this.prepareQuery(userContext, queryOptions, operations));
+        const entity = await this.database.getById(operations, queryOptions, id, this.pluralResourceName);
         if (!entity) {
             throw new IdNotFoundError();
         }
@@ -155,14 +144,14 @@ export class GenericApiService {
             return [];
         }
         const preparedEntities = await Promise.all(entities.map((entity) => this.preProcessEntity(userContext, entity, false, true)));
-        const { queryObject, operations } = this.prepareQuery(userContext, {}, []);
-        const rawUpdatedEntities = await this.database.batchUpdate(preparedEntities, operations, queryObject, this.pluralResourceName);
+        const { queryOptions, operations } = this.prepareQuery(userContext, {}, []);
+        const rawUpdatedEntities = await this.database.batchUpdate(preparedEntities, operations, queryOptions, this.pluralResourceName);
         const updatedEntities = rawUpdatedEntities.map((entity) => this.postProcessEntity(userContext, entity));
         return updatedEntities;
     }
     async fullUpdateById(userContext, id, entity) {
-        const { operations, queryObject } = this.prepareQuery(userContext, {}, []);
-        const existingEntity = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
+        const { operations, queryOptions } = this.prepareQuery(userContext, {}, []);
+        const existingEntity = await this.database.getById(operations, queryOptions, id, this.pluralResourceName);
         if (!existingEntity) {
             throw new IdNotFoundError();
         }
@@ -188,8 +177,8 @@ export class GenericApiService {
         const rawUpdatedEntity = await this.database.partialUpdateById([], id, preparedEntity, this.pluralResourceName);
         return this.database.postProcessEntity(rawUpdatedEntity, this.modelSpec.fullSchema);
     }
-    async update(userContext, queryObject, entity) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async update(userContext, queryOptions, entity) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const preparedEntity = await this.preProcessEntity(userContext, entity, false, true);
         const rawUpdatedEntities = await this.database.update(preparedQuery, preparedEntity, operations, this.pluralResourceName);
         const updatedEntities = rawUpdatedEntities.map((entity) => this.postProcessEntity(userContext, entity));
@@ -202,18 +191,18 @@ export class GenericApiService {
         }
         return deleteResult;
     }
-    async deleteMany(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async deleteMany(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const deleteResult = await this.database.deleteMany(preparedQuery, this.pluralResourceName);
         return deleteResult;
     }
-    async find(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async find(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const rawEntities = await this.database.find(preparedQuery, this.pluralResourceName);
         return rawEntities.map((entity) => this.postProcessEntity(userContext, entity));
     }
-    async findOne(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async findOne(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const rawEntity = await this.database.findOne(preparedQuery, this.pluralResourceName);
         return rawEntity ? this.postProcessEntity(userContext, rawEntity) : null;
     }

package/dist/services/multi-tenant-api.service.d.ts

@@ -6,7 +6,7 @@ export declare class MultiTenantApiService<T extends IEntity> extends GenericApi
     private tenantDecorator?;
     constructor(database: IDatabase, pluralResourceName: string, singularResourceName: string, modelSpec: IModelSpec);
     prepareQuery(userContext: IUserContext, queryOptions: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     preProcessEntity(userContext: IUserContext, entity: Partial<T>, isCreate: boolean, allowId?: boolean): Promise<Partial<T>>;

package/dist/services/multi-tenant-api.service.js

@@ -2,6 +2,8 @@ import { getSystemUserId } from '@loomcore/common/validation';
 import { config } from '../config/base-api-config.js';
 import { BadRequestError } from '../errors/bad-request.error.js';
 import { ServerError } from '../errors/index.js';
+import { isMetaOrgAdmin } from '../utils/auth/is-admin.util.js';
+import { isSystemUser } from '../utils/auth/is-system-user.util.js';
 import { GenericApiService } from './generic-api-service/generic-api.service.js';
 import { TenantQueryDecorator } from './tenant-query-decorator.js';
 export class MultiTenantApiService extends GenericApiService {
@@ -23,8 +25,8 @@ export class MultiTenantApiService extends GenericApiService {
         if (!this.tenantDecorator) {
             throw new ServerError('A valid tenantDecorator was not provided to MultiTenantApiService.prepareQuery');
         }
-        const queryObject = this.tenantDecorator.applyTenantToQuery(userContext, queryOptions, this.pluralResourceName);
-        return { queryObject, operations };
+        queryOptions = this.tenantDecorator.applyTenantToQuery(userContext, queryOptions, this.pluralResourceName);
+        return { queryOptions, operations };
     }
     async preProcessEntity(userContext, entity, isCreate, allowId = false) {
         if (!config?.app?.isMultiTenant) {
@@ -34,9 +36,12 @@ export class MultiTenantApiService extends GenericApiService {
             throw new BadRequestError('A valid userContext was not provided to MultiTenantApiService.prepareEntity');
         }
         const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate, allowId);
-        if (isCreate && userContext.user._id !== getSystemUserId()) {
+        if (isCreate && !isSystemUser(userContext) && !isMetaOrgAdmin(userContext)) {
             preparedEntity._orgId = userContext.user._orgId;
         }
+        if (isCreate && isMetaOrgAdmin(userContext)) {
+            preparedEntity._orgId = preparedEntity._orgId ?? userContext.user._orgId;
+        }
         return preparedEntity;
     }
 }

package/dist/services/organization.service.js

@@ -1,7 +1,7 @@
 import { OrganizationSpec, } from '@loomcore/common/models';
 import { BadRequestError } from '../errors/index.js';
-import { GenericApiService } from './generic-api-service/generic-api.service.js';
 import { OrganizationDomainService } from './organization-domain.service.js';
+import { GenericApiService } from './generic-api-service/generic-api.service.js';
 export class OrganizationService extends GenericApiService {
     organizationDomainService;
     constructor(database) {
@@ -36,12 +36,14 @@ export class OrganizationService extends GenericApiService {
         return orgId;
     }
     async getMetaOrg(userContext) {
-        const org = await this.findOne(userContext, {
+        return this.findOne(userContext, {
             filters: { isMetaOrg: { eq: true } },
         });
-        return org;
     }
     async findByDomain(userContext, domain) {
+        if (!domain) {
+            throw new BadRequestError('Missing required fields: domain is required.');
+        }
         const organizationDomain = await this.organizationDomainService.findOne(userContext, {
             filters: { domain: { eq: domain } },
         });

package/dist/services/tenant-query-decorator.d.ts

@@ -7,7 +7,7 @@ export declare const DEFAULT_TENANT_OPTIONS: ITenantQueryOptions;
 export declare class TenantQueryDecorator {
     private options;
     constructor(options?: Partial<ITenantQueryOptions>);
-    applyTenantToQuery(userContext: IUserContext, queryObject: IQueryOptions, collectionName: string): IQueryOptions;
+    applyTenantToQuery(userContext: IUserContext, queryOptions: IQueryOptions, collectionName: string): IQueryOptions;
     applyTenantToQueryOptions(userContext: IUserContext, queryOptions: IQueryOptions, collectionName: string): IQueryOptions;
     applyTenantToEntity<T extends IEntity>(userContext: IUserContext, entity: T, collectionName: string): T;
     getOrgIdField(): string;

package/dist/services/tenant-query-decorator.js

@@ -1,4 +1,6 @@
 import { ServerError } from '../errors/index.js';
+import { isSystemUser } from '../utils/auth/is-system-user.util.js';
+import { isMetaOrgAdmin } from '../utils/auth/is-admin.util.js';
 export const DEFAULT_TENANT_OPTIONS = {
     orgIdField: '_orgId',
     excludedCollections: [],
@@ -8,16 +10,17 @@ export class TenantQueryDecorator {
     constructor(options = {}) {
         this.options = { ...DEFAULT_TENANT_OPTIONS, ...options };
     }
-    applyTenantToQuery(userContext, queryObject, collectionName) {
-        let result = queryObject;
+    applyTenantToQuery(userContext, queryOptions, collectionName) {
         const shouldApplyTenantFilter = !this.options.excludedCollections?.includes(collectionName) &&
-            userContext?.user._orgId;
+            userContext.user._orgId &&
+            !isSystemUser(userContext) &&
+            !isMetaOrgAdmin(userContext);
         if (shouldApplyTenantFilter) {
             const orgIdField = this.options.orgIdField || '_orgId';
-            result = {
-                ...queryObject,
+            queryOptions = {
+                ...queryOptions,
                 filters: {
-                    ...queryObject.filters,
+                    ...queryOptions.filters,
                     [orgIdField]: { eq: userContext.user._orgId },
                 },
             };
@@ -27,7 +30,7 @@ export class TenantQueryDecorator {
                 throw new ServerError('No _orgId found in userContext');
             }
         }
-        return result;
+        return queryOptions;
     }
     applyTenantToQueryOptions(userContext, queryOptions, collectionName) {
         const result = { ...queryOptions };

package/dist/services/utils/audit-for-create.util.js

@@ -1,8 +1,7 @@
-import { getSystemUserId } from '@loomcore/common/validation';
 import moment from 'moment';
 export function auditForCreate(userContext, doc) {
     const now = moment().utc().toDate();
-    const userId = userContext.user?._id ?? getSystemUserId();
+    const userId = userContext.impersonatorId ?? userContext.user?._id;
     doc._created = now;
     doc._createdBy = userId;
 }

package/dist/services/utils/audit-for-update.util.js

@@ -1,7 +1,6 @@
-import { getSystemUserId } from '@loomcore/common/validation';
 import moment from 'moment';
 export function auditForUpdate(userContext, doc) {
-    const userId = userContext.user?._id ?? getSystemUserId();
+    const userId = userContext.impersonatorId ?? userContext.user?._id;
     doc._updated = moment().utc().toDate();
     doc._updatedBy = userId;
 }

package/dist/utils/auth/authorize-method.util.d.ts

@@ -1,2 +1,2 @@
-import { RequestHandler } from 'express';
+import type { RequestHandler } from 'express';
 export declare function authorizeMethod(instance: object, methodName: string): RequestHandler;

package/dist/utils/auth/authorize-method.util.js

@@ -1,8 +1,19 @@
-import { resolveAuthRequirement } from '../../decorators/authorize.decorator.js';
+import { hasAllowAnonymous } from '../../decorators/allow-anonymous.decorator.js';
+import { hasAuthRequirement } from '../../decorators/authorize.decorator.js';
+import { resolveAllowAnonymous } from '../../decorators/resolve-allow-anonymous.util.js';
+import { resolveAuthRequirement } from '../../decorators/resolve-auth-requirement.util.js';
 import { buildAuthGuard } from '../../middleware/authorize/authorize.middleware.js';
 export function authorizeMethod(instance, methodName) {
     const constructor = instance.constructor;
     const prototype = Object.getPrototypeOf(instance);
-    const requirement = resolveAuthRequirement(constructor, prototype, methodName);
-    return buildAuthGuard(requirement);
+    const method = prototype?.[methodName];
+    const methodHasBoth = typeof method === 'function' && hasAllowAnonymous(method) && hasAuthRequirement(method);
+    const classHasBoth = hasAllowAnonymous(constructor) && hasAuthRequirement(constructor);
+    if (methodHasBoth || classHasBoth) {
+        throw new Error('Allow anonymous and authorize decorators cannot be used together.');
+    }
+    if (resolveAllowAnonymous(constructor, prototype, methodName)) {
+        return (_req, _res, next) => next();
+    }
+    return buildAuthGuard(resolveAuthRequirement(constructor, prototype, methodName));
 }

package/dist/utils/auth/impersonate-user.util.d.ts

@@ -0,0 +1,6 @@
+import { type ITokenResponse, type IUserContext } from '@loomcore/common/models';
+import type { AppIdType } from '@loomcore/common/types';
+import type { IDatabase } from '../../databases/models/index.js';
+import { AuthorizationService } from '../../services/authorization.service.js';
+import { UserService } from '../../services/user.service.js';
+export declare function impersonateUser(database: IDatabase, impersonatorUserContext: IUserContext, targetUserId: AppIdType, refreshToken: string, userService?: UserService, authorizationsService?: AuthorizationService): Promise<ITokenResponse>;

package/dist/utils/auth/impersonate-user.util.js

@@ -0,0 +1,35 @@
+import { BadRequestError } from '../../errors/index.js';
+import { AuthorizationService } from '../../services/authorization.service.js';
+import { UserService } from '../../services/user.service.js';
+import { generateJwt, IMPERSONATION_JWT_EXPIRATION_IN_SECONDS } from '../jwt.utils.js';
+import { getExpiresOnFromSeconds } from './get-expires-on-from-seconds.util.js';
+import { isAdmin } from './is-admin.util.js';
+export async function impersonateUser(database, impersonatorUserContext, targetUserId, refreshToken, userService = new UserService(database), authorizationsService = new AuthorizationService(database)) {
+    if (impersonatorUserContext.impersonatorId) {
+        throw new BadRequestError('Already impersonating.');
+    }
+    if (impersonatorUserContext.user._id === targetUserId) {
+        throw new BadRequestError('Cannot impersonate yourself.');
+    }
+    const targetUser = await userService.findOne(impersonatorUserContext, {
+        filters: { _id: { eq: targetUserId } },
+    });
+    if (!targetUser) {
+        throw new BadRequestError('User not found');
+    }
+    const targetFeatures = await authorizationsService.getUserContextFeatures(targetUser);
+    const impersonatedUserContext = {
+        user: targetUser,
+        features: targetFeatures,
+        impersonatorId: impersonatorUserContext.user._id,
+    };
+    if (isAdmin(impersonatedUserContext)) {
+        throw new BadRequestError('Cannot impersonate admin user.');
+    }
+    const accessToken = generateJwt(impersonatedUserContext, IMPERSONATION_JWT_EXPIRATION_IN_SECONDS);
+    return {
+        accessToken,
+        refreshToken,
+        expiresOn: getExpiresOnFromSeconds(IMPERSONATION_JWT_EXPIRATION_IN_SECONDS),
+    };
+}

package/dist/utils/auth/index.d.ts

@@ -11,7 +11,9 @@ export * from './get-device-id-from-cookie.util.js';
 export * from './get-expires-on-from-days.util.js';
 export * from './get-expires-on-from-minutes.util.js';
 export * from './get-expires-on-from-seconds.util.js';
+export * from './impersonate-user.util.js';
 export * from './is-admin.util.js';
+export * from './is-system-user.util.js';
 export * from './log-user-in.util.js';
 export * from './request-token-using-refresh-token.util.js';
 export * from './reset-password.util.js';

package/dist/utils/auth/index.js

@@ -11,7 +11,9 @@ export * from './get-device-id-from-cookie.util.js';
 export * from './get-expires-on-from-days.util.js';
 export * from './get-expires-on-from-minutes.util.js';
 export * from './get-expires-on-from-seconds.util.js';
+export * from './impersonate-user.util.js';
 export * from './is-admin.util.js';
+export * from './is-system-user.util.js';
 export * from './log-user-in.util.js';
 export * from './request-token-using-refresh-token.util.js';
 export * from './reset-password.util.js';

package/dist/utils/auth/is-admin.util.d.ts

@@ -1,2 +1,3 @@
-import type { IUserContext } from '@loomcore/common/models';
+import { type IUserContext } from '@loomcore/common/models';
 export declare function isAdmin(userContext: IUserContext): boolean;
+export declare function isMetaOrgAdmin(userContext: IUserContext): boolean;

package/dist/utils/auth/is-admin.util.js

@@ -1,3 +1,11 @@
+import { getSystemUserContext } from '@loomcore/common/models';
 export function isAdmin(userContext) {
-    return userContext.features.some((feature) => feature === 'admin' || feature === 'system');
+    return userContext.features.some((feature) => feature === 'admin');
+}
+export function isMetaOrgAdmin(userContext) {
+    if (!isAdmin(userContext)) {
+        return false;
+    }
+    const systemUserContext = getSystemUserContext();
+    return userContext.user._orgId === systemUserContext.user._orgId;
 }

package/dist/utils/auth/is-system-user.util.d.ts

@@ -0,0 +1,2 @@
+import type { IUserContext } from '@loomcore/common/models';
+export declare function isSystemUser(userContext: IUserContext): boolean;

package/dist/utils/auth/is-system-user.util.js

@@ -0,0 +1,4 @@
+import { getSystemUserId } from '@loomcore/common/validation';
+export function isSystemUser(userContext) {
+    return userContext.user?._id === getSystemUserId();
+}

package/dist/utils/jwt.utils.d.ts

@@ -1,2 +1,3 @@
 import type { IUserContext } from '@loomcore/common/models';
-export declare function generateJwt(userContext: IUserContext): string;
+export declare const IMPERSONATION_JWT_EXPIRATION_IN_SECONDS = 3600;
+export declare function generateJwt(userContext: IUserContext, expiresInSeconds?: number): string;

package/dist/utils/jwt.utils.js

@@ -1,8 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { getAuthConfig } from './auth/get-auth-config.util.js';
-export function generateJwt(userContext) {
+export const IMPERSONATION_JWT_EXPIRATION_IN_SECONDS = 3600;
+export function generateJwt(userContext, expiresInSeconds) {
     const authConfig = getAuthConfig();
-    const jwtExpiryConfig = authConfig.jwtExpirationInSeconds;
+    const jwtExpiryConfig = expiresInSeconds ?? authConfig.jwtExpirationInSeconds;
     const jwtExpirationInSeconds = typeof jwtExpiryConfig === 'string'
         ? Number.parseInt(jwtExpiryConfig, 10)
         : jwtExpiryConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.57",
+  "version": "0.2.58",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {
@@ -60,7 +60,7 @@
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@loomcore/common": "^0.0.91",
+    "@loomcore/common": "^0.0.92",
     "@sinclair/typebox": "0.34.33",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",