@loomcore/api 0.2.9 → 0.2.11

package/dist/services/user.service.d.ts

@@ -1,9 +1,13 @@
-import { type IUser, type IUserContext } from "@loomcore/common/models";
+import { type IQueryOptions, type IUser, type IUserContext } from "@loomcore/common/models";
 import type { AppIdType } from "@loomcore/common/types";
 import type { IDatabase } from "../databases/models/index.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase);
     fullUpdateById(_userContext: IUserContext, _id: AppIdType, _entity: IUser): Promise<IUser>;
-    preProcessEntity(userContext: IUserContext, entity: Partial<IUser>, isCreate: boolean, _allowId?: boolean): Promise<Partial<IUser>>;
+    update(userContext: IUserContext, queryObject: IQueryOptions, entity: Partial<IUser>): Promise<IUser[]>;
+    batchUpdate(userContext: IUserContext, entities: Partial<IUser>[]): Promise<IUser[]>;
+    partialUpdateById(userContext: IUserContext, id: AppIdType, entity: Partial<IUser>, allowPasswordUpdate?: boolean): Promise<IUser>;
+    private assertPasswordUpdateAllowed;
+    preProcessEntity(userContext: IUserContext, entity: Partial<IUser>, isCreate: boolean, allowId?: boolean): Promise<Partial<IUser>>;
 }

package/dist/services/user.service.js

@@ -1,5 +1,5 @@
 import { UserSpec, } from "@loomcore/common/models";
-import { ServerError } from "../errors/index.js";
+import { BadRequestError, ServerError } from "../errors/index.js";
 import { passwordUtils } from "../utils/password.utils.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export class UserService extends MultiTenantApiService {
@@ -9,8 +9,36 @@ export class UserService extends MultiTenantApiService {
     async fullUpdateById(_userContext, _id, _entity) {
         throw new ServerError("User full update is not allowed.");
     }
-    async preProcessEntity(userContext, entity, isCreate, _allowId = false) {
-        const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate);
+    async update(userContext, queryObject, entity) {
+        this.assertPasswordUpdateAllowed(userContext, null, entity, false);
+        return super.update(userContext, queryObject, entity);
+    }
+    async batchUpdate(userContext, entities) {
+        for (const entity of entities) {
+            this.assertPasswordUpdateAllowed(userContext, null, entity, false);
+        }
+        return super.batchUpdate(userContext, entities);
+    }
+    async partialUpdateById(userContext, id, entity, allowPasswordUpdate = false) {
+        this.assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate);
+        return super.partialUpdateById(userContext, id, entity);
+    }
+    assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate) {
+        if (!("password" in entity)) {
+            return;
+        }
+        if (!entity.password) {
+            throw new BadRequestError("Password cannot be empty.");
+        }
+        if (!allowPasswordUpdate) {
+            throw new ServerError("Use auth change password endpoint to update password.");
+        }
+        if (userContext.user._id !== id) {
+            throw new ServerError("You can only update your own password.");
+        }
+    }
+    async preProcessEntity(userContext, entity, isCreate, allowId = false) {
+        const preparedEntity = await super.preProcessEntity(userContext, entity, isCreate, allowId);
         if (preparedEntity.email) {
             preparedEntity.email = preparedEntity.email.toLowerCase();
         }

package/dist/utils/auth/change-password.util.js

@@ -6,7 +6,7 @@ export async function changePassword(database, userContext, password) {
         password: password,
         _lastPasswordChange: moment().utc().toDate(),
     };
-    await userService.partialUpdateById(userContext, userContext.user._id, updates);
+    await userService.partialUpdateById(userContext, userContext.user._id, updates, true);
     return {
         success: true,
         count: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {