@nymphjs/server 1.0.0-beta.12 → 1.0.0-beta.121

package/dist/createServer.js

@@ -1,29 +1,38 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createServer = void 0;
-const express_1 = __importDefault(require("express"));
-const cookie_parser_1 = __importDefault(require("cookie-parser"));
-const nymph_1 = require("@nymphjs/nymph");
-const nymph_2 = require("@nymphjs/nymph");
-const statusDescriptions_1 = require("./statusDescriptions");
+import express from 'express';
+import cookieParser from 'cookie-parser';
+import { Entity, EntityConflictError, InvalidParametersError, TilmeldAccessLevels, classNamesToEntityConstructors, } from '@nymphjs/nymph';
+import { EntityInvalidDataError } from '@nymphjs/nymph';
+import { statusDescriptions } from './statusDescriptions.js';
 const NOT_FOUND_ERROR = 'Entity is not found.';
-function createServer(nymph, { jsonOptions = {} } = {}) {
-    const rest = (0, express_1.default)();
-    rest.use((0, cookie_parser_1.default)());
-    rest.use(express_1.default.json(jsonOptions || {}));
+export class ForbiddenClassError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ForbiddenClassError';
+    }
+}
+/**
+ * A REST server middleware creator for Nymph.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@port87.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+export function createServer(nymph, { jsonOptions = {} } = {}) {
+    const rest = express();
+    rest.use(cookieParser());
+    rest.use(express.json(jsonOptions || {}));
     function instantiateNymph(_request, response, next) {
         response.locals.nymph = nymph.clone();
         next();
     }
-    function authenticateTilmeld(request, response, next) {
+    async function authenticateTilmeld(request, response, next) {
         if (response.locals.nymph.tilmeld) {
             response.locals.nymph.tilmeld.request = request;
             response.locals.nymph.tilmeld.response = response;
             try {
-                response.locals.nymph.tilmeld.authenticate();
+                await response.locals.nymph.tilmeld.authenticate(false, request.header('x-tilmeld-token-renewal') === 'off');
             }
             catch (e) {
                 httpError(response, 500, e);
@@ -67,7 +76,9 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
             };
         }
     }
+    // Create a new instance of Nymph for the request/response.
     rest.use(instantiateNymph);
+    // Authenticate before the request.
     rest.use(authenticateTilmeld);
     rest.get('/', async (request, response) => {
         try {
@@ -94,6 +105,10 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 let EntityClass;
                 try {
                     EntityClass = response.locals.nymph.getEntityClass(data[0].class);
+                    if (!EntityClass.restEnabled) {
+                        httpError(response, 403);
+                        return;
+                    }
                 }
                 catch (e) {
                     httpError(response, 400, e);
@@ -102,7 +117,22 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 options.class = EntityClass;
                 options.source = 'client';
                 options.skipAc = false;
-                selectors = (0, nymph_1.classNamesToEntityConstructors)(response.locals.nymph, selectors);
+                if (options.return === 'object') {
+                    options.return = 'entity';
+                }
+                try {
+                    selectors = classNamesToEntityConstructors(response.locals.nymph, selectors, true);
+                }
+                catch (e) {
+                    if (e?.message === 'Not accessible.') {
+                        httpError(response, 403);
+                        return;
+                    }
+                    else {
+                        httpError(response, 500, e);
+                        return;
+                    }
+                }
                 let result;
                 try {
                     if (action === 'entity') {
@@ -132,7 +162,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     return;
                 }
                 if (response.locals.nymph.tilmeld) {
-                    if (!response.locals.nymph.tilmeld.checkClientUIDPermissions(data, nymph_1.TilmeldAccessLevels.READ_ACCESS)) {
+                    if (!(await response.locals.nymph.tilmeld.checkClientUIDPermissions(data, TilmeldAccessLevels.READ_ACCESS))) {
                         httpError(response, 403);
                         return;
                     }
@@ -179,6 +209,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 let invalidRequest = false;
                 let conflict = false;
                 let notfound = false;
+                let forbidden = false;
                 let lastException = null;
                 for (let entData of data) {
                     if (entData.guid) {
@@ -191,13 +222,16 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                         entity = await loadEntity(entData, response.locals.nymph);
                     }
                     catch (e) {
-                        if (e instanceof nymph_1.EntityConflictError) {
+                        if (e instanceof EntityConflictError) {
                             conflict = true;
                         }
+                        else if (e instanceof ForbiddenClassError) {
+                            forbidden = true;
+                        }
                         else if (e.message === NOT_FOUND_ERROR) {
                             notfound = true;
                         }
-                        else if (e instanceof nymph_1.InvalidParametersError) {
+                        else if (e instanceof InvalidParametersError) {
                             invalidRequest = true;
                             lastException = e;
                         }
@@ -222,7 +256,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                         }
                     }
                     catch (e) {
-                        if (e instanceof nymph_2.EntityInvalidDataError) {
+                        if (e instanceof EntityInvalidDataError) {
                             invalidRequest = true;
                         }
                         else {
@@ -240,6 +274,10 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                         httpError(response, 409);
                         return;
                     }
+                    else if (forbidden) {
+                        httpError(response, 403);
+                        return;
+                    }
                     else if (notfound) {
                         httpError(response, 404);
                         return;
@@ -263,93 +301,154 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     httpError(response, 400);
                     return;
                 }
-                const params = referencesToEntities([...data.params], response.locals.nymph);
-                if (data.static) {
-                    let EntityClass;
-                    try {
-                        EntityClass = response.locals.nymph.getEntityClass(data.class);
-                    }
-                    catch (e) {
-                        httpError(response, 400);
-                        return;
-                    }
-                    if (EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1) {
-                        httpError(response, 403);
-                        return;
-                    }
-                    if (!(data.method in EntityClass)) {
-                        httpError(response, 400);
-                        return;
-                    }
-                    const method = EntityClass[data.method];
-                    if (typeof method !== 'function') {
-                        httpError(response, 400);
-                        return;
-                    }
-                    try {
-                        const result = method.call(EntityClass, ...params);
-                        let ret = result;
-                        if (result instanceof Promise) {
-                            ret = await result;
+                try {
+                    const params = referencesToEntities([...data.params], response.locals.nymph);
+                    if (data.static) {
+                        let EntityClass;
+                        try {
+                            EntityClass = response.locals.nymph.getEntityClass(data.class);
+                            if (!EntityClass.restEnabled) {
+                                httpError(response, 403);
+                                return;
+                            }
                         }
-                        response.status(200);
-                        response.setHeader('Content-Type', 'application/json');
-                        response.send({ return: ret });
-                    }
-                    catch (e) {
-                        httpError(response, 500, e);
-                        return;
-                    }
-                }
-                else {
-                    let entity;
-                    try {
-                        entity = await loadEntity(data.entity, response.locals.nymph);
-                    }
-                    catch (e) {
-                        if (e instanceof nymph_1.EntityConflictError) {
-                            httpError(response, 409);
+                        catch (e) {
+                            httpError(response, 400);
+                            return;
                         }
-                        else if (e.message === NOT_FOUND_ERROR) {
-                            httpError(response, 404, e);
+                        if (EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1) {
+                            httpError(response, 403);
+                            return;
+                        }
+                        if (!(data.method in EntityClass)) {
+                            httpError(response, 400);
+                            return;
                         }
-                        else if (e instanceof nymph_1.InvalidParametersError) {
-                            httpError(response, 400, e);
+                        // @ts-ignore Dynamic methods make TypeScript sad.
+                        const method = EntityClass[data.method];
+                        if (typeof method !== 'function') {
+                            httpError(response, 400);
+                            return;
+                        }
+                        if (data.iterator) {
+                            // Ping every 15 seconds to keep connection alive.
+                            const interval = setInterval(() => {
+                                if (response.headersSent) {
+                                    response.write('event: ping\n');
+                                    response.write(`data: ${new Date().toISOString()}\n\n`);
+                                }
+                            }, 15000);
+                            try {
+                                response.set({
+                                    'Cache-Control': 'no-cache',
+                                    'Content-Type': 'text/event-stream',
+                                    Connection: 'keep-alive',
+                                });
+                                response.flushHeaders();
+                                const result = method.call(EntityClass, ...params);
+                                let sequence = result;
+                                if (result instanceof Promise) {
+                                    sequence = await result;
+                                }
+                                let { value, done } = await sequence.next(response.destroyed);
+                                while (!done) {
+                                    response.write('event: next\n');
+                                    response.write(`data: ${JSON.stringify(value)}\n\n`);
+                                    // Wait for an event loop each iteration, to allow data to flush.
+                                    await new Promise((resolve) => setImmediate(resolve));
+                                    ({ value, done } = await sequence.next(response.destroyed));
+                                }
+                                clearInterval(interval);
+                                response.write('event: finished\n');
+                                response.write('data: \n\n');
+                                response.end();
+                            }
+                            catch (e) {
+                                clearInterval(interval);
+                                eventStreamError(response, 500, e);
+                                return;
+                            }
                         }
                         else {
-                            httpError(response, 500, e);
+                            try {
+                                const result = method.call(EntityClass, ...params);
+                                let ret = result;
+                                if (result instanceof Promise) {
+                                    ret = await result;
+                                }
+                                response.status(200);
+                                response.setHeader('Content-Type', 'application/json');
+                                response.send({ return: ret });
+                            }
+                            catch (e) {
+                                httpError(response, 500, e);
+                                return;
+                            }
                         }
-                        return;
                     }
-                    if (data.entity.guid && !entity.guid) {
-                        httpError(response, 400);
-                        return;
-                    }
-                    if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
-                        httpError(response, 403);
-                        return;
-                    }
-                    if (!(data.method in entity) ||
-                        typeof entity[data.method] !== 'function') {
-                        httpError(response, 400);
-                        return;
-                    }
-                    try {
-                        const result = entity[data.method](...params);
-                        let ret = result;
-                        if (result instanceof Promise) {
-                            ret = await result;
+                    else {
+                        let entity;
+                        try {
+                            entity = await loadEntity(data.entity, response.locals.nymph);
                         }
-                        response.status(200);
-                        response.setHeader('Content-Type', 'application/json');
-                        if (data.stateless) {
-                            response.send({ return: ret });
+                        catch (e) {
+                            if (e instanceof EntityConflictError) {
+                                httpError(response, 409);
+                            }
+                            else if (e instanceof ForbiddenClassError) {
+                                httpError(response, 403);
+                            }
+                            else if (e.message === NOT_FOUND_ERROR) {
+                                httpError(response, 404, e);
+                            }
+                            else if (e instanceof InvalidParametersError) {
+                                httpError(response, 400, e);
+                            }
+                            else {
+                                httpError(response, 500, e);
+                            }
+                            return;
                         }
-                        else {
-                            response.send({ entity: entity, return: ret });
+                        if (data.entity.guid && !entity.guid) {
+                            httpError(response, 400);
+                            return;
+                        }
+                        if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
+                            httpError(response, 403);
+                            return;
+                        }
+                        if (!(data.method in entity) ||
+                            typeof entity[data.method] !== 'function') {
+                            httpError(response, 400);
+                            return;
+                        }
+                        try {
+                            const result = entity[data.method](...params);
+                            let ret = result;
+                            if (result instanceof Promise) {
+                                ret = await result;
+                            }
+                            response.status(200);
+                            response.setHeader('Content-Type', 'application/json');
+                            if (data.stateless) {
+                                response.send({ return: ret });
+                            }
+                            else {
+                                response.send({ entity: entity, return: ret });
+                            }
+                        }
+                        catch (e) {
+                            httpError(response, 500, e);
+                            return;
                         }
                     }
-                    catch (e) {
+                }
+                catch (e) {
+                    if (e instanceof ForbiddenClassError) {
+                        httpError(response, 403);
+                        return;
+                    }
+                    else {
                         httpError(response, 500, e);
                         return;
                     }
@@ -361,7 +460,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     return;
                 }
                 if (response.locals.nymph.tilmeld) {
-                    if (!response.locals.nymph.tilmeld.checkClientUIDPermissions(data, nymph_1.TilmeldAccessLevels.WRITE_ACCESS)) {
+                    if (!(await response.locals.nymph.tilmeld.checkClientUIDPermissions(data, TilmeldAccessLevels.WRITE_ACCESS))) {
                         httpError(response, 403);
                         return;
                     }
@@ -423,7 +522,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 return;
             }
             if (response.locals.nymph.tilmeld) {
-                if (!response.locals.nymph.tilmeld.checkClientUIDPermissions(data.name, nymph_1.TilmeldAccessLevels.FULL_ACCESS)) {
+                if (!(await response.locals.nymph.tilmeld.checkClientUIDPermissions(data.name, TilmeldAccessLevels.FULL_ACCESS))) {
                     httpError(response, 403);
                     return;
                 }
@@ -452,6 +551,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
             let hadSuccess = false;
             let invalidRequest = false;
             let conflict = false;
+            let forbidden = false;
             let notfound = false;
             let lastException = null;
             for (let entData of data) {
@@ -465,13 +565,16 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     entity = await loadEntity(entData, response.locals.nymph, patch);
                 }
                 catch (e) {
-                    if (e instanceof nymph_1.EntityConflictError) {
+                    if (e instanceof EntityConflictError) {
                         conflict = true;
                     }
+                    else if (e instanceof ForbiddenClassError) {
+                        forbidden = true;
+                    }
                     else if (e.message === NOT_FOUND_ERROR) {
                         notfound = true;
                     }
-                    else if (e instanceof nymph_1.InvalidParametersError) {
+                    else if (e instanceof InvalidParametersError) {
                         invalidRequest = true;
                         lastException = e;
                     }
@@ -496,7 +599,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     }
                 }
                 catch (e) {
-                    if (e instanceof nymph_2.EntityInvalidDataError) {
+                    if (e instanceof EntityInvalidDataError) {
                         invalidRequest = true;
                     }
                     else {
@@ -509,6 +612,9 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 if (invalidRequest) {
                     httpError(response, 400, lastException);
                 }
+                else if (forbidden) {
+                    httpError(response, 403);
+                }
                 else if (conflict) {
                     httpError(response, 409);
                 }
@@ -555,6 +661,10 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     let EntityClass;
                     try {
                         EntityClass = response.locals.nymph.getEntityClass(entData.class);
+                        if (!EntityClass.restEnabled) {
+                            httpError(response, 403);
+                            return;
+                        }
                     }
                     catch (e) {
                         invalidRequest = true;
@@ -615,7 +725,7 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                     return;
                 }
                 if (response.locals.nymph.tilmeld) {
-                    if (!response.locals.nymph.tilmeld.checkClientUIDPermissions(data, nymph_1.TilmeldAccessLevels.FULL_ACCESS)) {
+                    if (!(await response.locals.nymph.tilmeld.checkClientUIDPermissions(data, TilmeldAccessLevels.FULL_ACCESS))) {
                         httpError(response, 403);
                         return;
                     }
@@ -642,12 +752,17 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
             return;
         }
     });
+    // Unauthenticate after the request.
     rest.use(unauthenticateTilmeld);
     async function loadEntity(entityData, nymph, patch = false, allowConflict = false) {
         if (entityData.class === 'Entity') {
-            throw new nymph_1.InvalidParametersError("Can't use Entity class directly from the front end.");
+            // Don't let clients use the `Entity` class, since it has no validity/AC checks.
+            throw new InvalidParametersError("Can't use Entity class directly from the front end.");
         }
         let EntityClass = nymph.getEntityClass(entityData.class);
+        if (!EntityClass.restEnabled) {
+            throw new ForbiddenClassError('Not accessible.');
+        }
         let entity;
         if (entityData.guid) {
             entity = await nymph.getEntity({ class: EntityClass, source: 'client' }, {
@@ -669,11 +784,25 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
         }
         return entity;
     }
+    /**
+     * Check if an item is a reference, and if it is, convert it to an entity.
+     *
+     * This function will recurse into deeper arrays and objects.
+     *
+     * @param item The item to check.
+     * @returns The item, converted.
+     */
     function referencesToEntities(item, nymph) {
-        if (Array.isArray(item)) {
+        if (item == null) {
+            return item;
+        }
+        else if (Array.isArray(item)) {
             if (item.length === 3 && item[0] === 'nymph_entity_reference') {
                 try {
-                    const EntityClass = nymph.getEntityClass(item[1]);
+                    const EntityClass = nymph.getEntityClass(item[2]);
+                    if (!EntityClass.restEnabled) {
+                        throw new ForbiddenClassError('Not accessible.');
+                    }
                     return EntityClass.factoryReference(item);
                 }
                 catch (e) {
@@ -682,7 +811,8 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
             }
             return item.map((entry) => referencesToEntities(entry, nymph));
         }
-        else if (typeof item === 'object' && !(item instanceof nymph_1.Entity)) {
+        else if (typeof item === 'object' && !(item instanceof Entity)) {
+            // Only do this for non-entity objects.
             const newItem = {};
             for (let curProperty in item) {
                 newItem[curProperty] = referencesToEntities(item[curProperty], nymph);
@@ -691,20 +821,60 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
         }
         return item;
     }
+    /**
+     * Return the request with an HTTP error response.
+     *
+     * @param res The server response object.
+     * @param defaultStatusCode The HTTP status code to use if none is given in the error object.
+     * @param error An optional error object to report.
+     */
     function httpError(res, defaultStatusCode, error) {
         const status = error?.status || defaultStatusCode;
         const statusText = error?.statusText ||
             (error?.status == null
-                ? statusDescriptions_1.statusDescriptions[defaultStatusCode]
-                : error.status in statusDescriptions_1.statusDescriptions &&
-                    statusDescriptions_1.statusDescriptions[error.status]) ||
+                ? statusDescriptions[defaultStatusCode]
+                : error.status in statusDescriptions &&
+                    statusDescriptions[error.status]) ||
             'Internal Server Error';
+        const errorResponse = error
+            ? {
+                textStatus: `${status} ${statusText}`,
+                statusText,
+                message: error.message,
+                error,
+                ...(process.env.NODE_ENV !== 'production'
+                    ? { stack: error.stack }
+                    : {}),
+            }
+            : {
+                textStatus: `${status} ${statusText}`,
+                statusText,
+                message: statusText,
+            };
         if (!res.headersSent) {
             res.status(status);
             res.setHeader('Content-Type', 'application/json');
         }
-        if (error) {
-            res.send({
+        res.send(errorResponse);
+    }
+    /**
+     * End the event stream with an HTTP error response.
+     *
+     * @param res The server response object.
+     * @param defaultStatusCode The HTTP status code to use if none is given in the error object.
+     * @param error An optional error object to report.
+     */
+    function eventStreamError(res, defaultStatusCode, error) {
+        const status = error?.status || defaultStatusCode;
+        const statusText = error?.statusText ||
+            (error?.status == null
+                ? statusDescriptions[defaultStatusCode]
+                : error.status in statusDescriptions &&
+                    statusDescriptions[error.status]) ||
+            'Internal Server Error';
+        const errorResponse = error
+            ? {
+                status,
                 textStatus: `${status} ${statusText}`,
                 statusText,
                 message: error.message,
@@ -712,17 +882,26 @@ function createServer(nymph, { jsonOptions = {} } = {}) {
                 ...(process.env.NODE_ENV !== 'production'
                     ? { stack: error.stack }
                     : {}),
-            });
-        }
-        else {
-            res.send({
+            }
+            : {
+                status,
                 textStatus: `${status} ${statusText}`,
                 statusText,
                 message: statusText,
-            });
+            };
+        if (!res.headersSent) {
+            res.status(status);
+            res.setHeader('Content-Type', 'application/json');
+            res.send(errorResponse);
+        }
+        else {
+            res.write('event: error\n');
+            res.write(`data: ${JSON.stringify(errorResponse)}\n\n`);
+            res.write('event: finished\n');
+            res.write('data: \n\n');
+            res.end();
         }
     }
     return rest;
 }
-exports.createServer = createServer;
 //# sourceMappingURL=createServer.js.map