@nymphjs/server 1.0.0-beta.13 → 1.0.0-beta.131

package/src/createServer.ts

@@ -3,39 +3,46 @@ import express, { NextFunction, Request, Response } from 'express';
 import cookieParser from 'cookie-parser';
 import {
   Nymph,
-  Entity,
   EntityConflictError,
   EntityConstructor,
   EntityInterface,
   EntityJson,
   EntityPatch,
-  EntityReference,
   InvalidParametersError,
   TilmeldAccessLevels,
   classNamesToEntityConstructors,
+  referencesToEntities,
   Options,
   Selector,
 } from '@nymphjs/nymph';
 import { EntityInvalidDataError } from '@nymphjs/nymph';
 
-import { statusDescriptions } from './statusDescriptions';
+import { statusDescriptions } from './statusDescriptions.js';
 
 type NymphResponse = Response<any, { nymph: Nymph }>;
 
 const NOT_FOUND_ERROR = 'Entity is not found.';
 
+export class ForbiddenClassError extends Error {
+  constructor(message: string) {
+    super(message);
+
+    this.name = 'ForbiddenClassError';
+  }
+}
+
 /**
  * A REST server middleware creator for Nymph.
  *
  * Written by Hunter Perrin for SciActive.
  *
- * @author Hunter Perrin <hperrin@gmail.com>
+ * @author Hunter Perrin <hperrin@port87.com>
  * @copyright SciActive Inc
  * @see http://nymph.io/
  */
 export function createServer(
   nymph: Nymph,
-  { jsonOptions = {} }: { jsonOptions?: OptionsJson } = {}
+  { jsonOptions = {} }: { jsonOptions?: OptionsJson } = {},
 ) {
   const rest = express();
   rest.use(cookieParser());
@@ -44,22 +51,25 @@ export function createServer(
   function instantiateNymph(
     _request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     response.locals.nymph = nymph.clone();
     next();
   }
 
-  function authenticateTilmeld(
+  async function authenticateTilmeld(
     request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     if (response.locals.nymph.tilmeld) {
       response.locals.nymph.tilmeld.request = request;
       response.locals.nymph.tilmeld.response = response;
       try {
-        response.locals.nymph.tilmeld.authenticate();
+        await response.locals.nymph.tilmeld.authenticate(
+          false,
+          request.header('x-tilmeld-token-renewal') === 'off',
+        );
       } catch (e: any) {
         httpError(response, 500, e);
         return;
@@ -71,7 +81,7 @@ export function createServer(
   function unauthenticateTilmeld(
     _request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     if (response.locals.nymph.tilmeld) {
       response.locals.nymph.tilmeld.request = null;
@@ -137,20 +147,41 @@ export function createServer(
           return;
         }
         let [options, ...selectors] = data as [Options, ...Selector[]];
-        let EntityClass;
+        options.source = 'client';
+        options.skipAc = false;
+        if (options.return === 'object') {
+          options.return = 'entity';
+        }
         try {
-          EntityClass = response.locals.nymph.getEntityClass(data[0].class);
+          options = classNamesToEntityConstructors(
+            response.locals.nymph,
+            options,
+            true,
+          );
         } catch (e: any) {
-          httpError(response, 400, e);
-          return;
+          if (e?.message === 'Not accessible.') {
+            httpError(response, 403);
+            return;
+          } else {
+            httpError(response, 500, e);
+            return;
+          }
+        }
+        try {
+          selectors = classNamesToEntityConstructors(
+            response.locals.nymph,
+            referencesToEntities(selectors, response.locals.nymph, false, true),
+            true,
+          );
+        } catch (e: any) {
+          if (e?.message === 'Not accessible.') {
+            httpError(response, 403);
+            return;
+          } else {
+            httpError(response, 500, e);
+            return;
+          }
         }
-        options.class = EntityClass;
-        options.source = 'client';
-        options.skipAc = false;
-        selectors = classNamesToEntityConstructors(
-          response.locals.nymph,
-          selectors
-        );
         let result:
           | EntityInterface
           | EntityInterface[]
@@ -162,12 +193,12 @@ export function createServer(
           if (action === 'entity') {
             result = await response.locals.nymph.getEntity(
               options,
-              ...selectors
+              ...selectors,
             );
           } else {
             result = await response.locals.nymph.getEntities(
               options,
-              ...selectors
+              ...selectors,
             );
           }
         } catch (e: any) {
@@ -192,10 +223,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.READ_ACCESS
-            )
+              TilmeldAccessLevels.READ_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -241,6 +272,7 @@ export function createServer(
         let invalidRequest = false;
         let conflict = false;
         let notfound = false;
+        let forbidden = false;
         let lastException = null;
         for (let entData of data) {
           if (entData.guid) {
@@ -250,15 +282,34 @@ export function createServer(
           }
           let entity: EntityInterface;
           try {
-            entity = await loadEntity(entData, response.locals.nymph);
+            entity = await loadEntity(
+              classNamesToEntityConstructors(
+                response.locals.nymph,
+                referencesToEntities(
+                  entData,
+                  response.locals.nymph,
+                  false,
+                  true,
+                ),
+                true,
+              ),
+              response.locals.nymph,
+            );
           } catch (e: any) {
             if (e instanceof EntityConflictError) {
               conflict = true;
+              lastException = e;
+            } else if (e instanceof ForbiddenClassError) {
+              forbidden = true;
+              lastException = e;
             } else if (e.message === NOT_FOUND_ERROR) {
               notfound = true;
             } else if (e instanceof InvalidParametersError) {
               invalidRequest = true;
               lastException = e;
+            } else if (e.message === 'Not accessible.') {
+              forbidden = true;
+              lastException = e;
             } else {
               lastException = e;
             }
@@ -271,12 +322,9 @@ export function createServer(
             continue;
           }
           try {
-            if (await entity.$save()) {
-              created.push(entity);
-              hadSuccess = true;
-            } else {
-              created.push(false);
-            }
+            await entity.$save();
+            created.push(entity);
+            hadSuccess = true;
           } catch (e: any) {
             if (e instanceof EntityInvalidDataError) {
               invalidRequest = true;
@@ -291,7 +339,10 @@ export function createServer(
             httpError(response, 400, lastException);
             return;
           } else if (conflict) {
-            httpError(response, 409);
+            httpError(response, 409, lastException);
+            return;
+          } else if (forbidden) {
+            httpError(response, 403, lastException);
             return;
           } else if (notfound) {
             httpError(response, 404);
@@ -313,92 +364,178 @@ export function createServer(
           httpError(response, 400);
           return;
         }
-        const params = referencesToEntities(
-          [...data.params],
-          response.locals.nymph
-        );
-        if (data.static) {
-          let EntityClass: EntityConstructor;
-          try {
-            EntityClass = response.locals.nymph.getEntityClass(data.class);
-          } catch (e: any) {
-            httpError(response, 400);
-            return;
-          }
-          if (
-            EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1
-          ) {
-            httpError(response, 403);
-            return;
-          }
-          if (!(data.method in EntityClass)) {
-            httpError(response, 400);
-            return;
-          }
-          // @ts-ignore Dynamic methods make TypeScript sad.
-          const method: Function = EntityClass[data.method];
-          if (typeof method !== 'function') {
-            httpError(response, 400);
-            return;
-          }
-          try {
-            const result = method.call(EntityClass, ...params);
-            let ret = result;
-            if (result instanceof Promise) {
-              ret = await result;
+        try {
+          const params = classNamesToEntityConstructors(
+            response.locals.nymph,
+            referencesToEntities(
+              [...data.params],
+              response.locals.nymph,
+              false,
+              true,
+            ),
+            true,
+          );
+          if (data.static) {
+            let EntityClass: EntityConstructor;
+            try {
+              EntityClass = response.locals.nymph.getEntityClass(data.class);
+              if (!EntityClass.restEnabled) {
+                httpError(response, 403);
+                return;
+              }
+            } catch (e: any) {
+              httpError(response, 400);
+              return;
             }
-            response.status(200);
-            response.setHeader('Content-Type', 'application/json');
-            response.send({ return: ret });
-          } catch (e: any) {
-            httpError(response, 500, e);
-            return;
-          }
-        } else {
-          let entity: EntityInterface;
-          try {
-            entity = await loadEntity(data.entity, response.locals.nymph);
-          } catch (e: any) {
-            if (e instanceof EntityConflictError) {
-              httpError(response, 409);
-            } else if (e.message === NOT_FOUND_ERROR) {
-              httpError(response, 404, e);
-            } else if (e instanceof InvalidParametersError) {
-              httpError(response, 400, e);
+            if (
+              EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1
+            ) {
+              httpError(response, 403);
+              return;
+            }
+            if (!(data.method in EntityClass)) {
+              httpError(response, 400);
+              return;
+            }
+            // @ts-ignore Dynamic methods make TypeScript sad.
+            const method: Function = EntityClass[data.method];
+            if (typeof method !== 'function') {
+              httpError(response, 400);
+              return;
+            }
+            if (data.iterator) {
+              // Ping every 15 seconds to keep connection alive.
+              const interval = setInterval(() => {
+                if (response.headersSent) {
+                  response.write('event: ping\n');
+                  response.write(`data: ${new Date().toISOString()}\n\n`);
+                }
+              }, 15000);
+
+              try {
+                response.set({
+                  'Cache-Control': 'no-cache',
+                  'Content-Type': 'text/event-stream',
+                  Connection: 'keep-alive',
+                });
+                response.flushHeaders();
+
+                const result:
+                  | Iterator<any, any, boolean>
+                  | AsyncIterator<any, any, boolean> = method.call(
+                  EntityClass,
+                  ...params,
+                );
+                let sequence = result;
+                if (result instanceof Promise) {
+                  sequence = await result;
+                }
+
+                let { value, done } = await sequence.next(response.destroyed);
+                while (!done) {
+                  response.write('event: next\n');
+                  response.write(`data: ${JSON.stringify(value)}\n\n`);
+                  // Wait for an event loop each iteration, to allow data to flush.
+                  await new Promise((resolve) => setImmediate(resolve));
+
+                  ({ value, done } = await sequence.next(response.destroyed));
+                }
+
+                clearInterval(interval);
+
+                response.write('event: finished\n');
+                response.write('data: \n\n');
+                response.end();
+              } catch (e: any) {
+                clearInterval(interval);
+                eventStreamError(response, 500, e);
+                return;
+              }
             } else {
+              try {
+                const result = method.call(EntityClass, ...params);
+                let ret = result;
+                if (result instanceof Promise) {
+                  ret = await result;
+                }
+                response.status(200);
+                response.setHeader('Content-Type', 'application/json');
+                response.send({ return: ret });
+              } catch (e: any) {
+                httpError(response, 500, e);
+                return;
+              }
+            }
+          } else {
+            let entity: EntityInterface;
+            try {
+              entity = await loadEntity(
+                classNamesToEntityConstructors(
+                  response.locals.nymph,
+                  referencesToEntities(
+                    data.entity,
+                    response.locals.nymph,
+                    false,
+                    true,
+                  ),
+                  true,
+                ),
+                response.locals.nymph,
+              );
+            } catch (e: any) {
+              if (e instanceof EntityConflictError) {
+                httpError(response, 409, e);
+              } else if (e instanceof ForbiddenClassError) {
+                httpError(response, 403, e);
+              } else if (e.message === NOT_FOUND_ERROR) {
+                httpError(response, 404, e);
+              } else if (e instanceof InvalidParametersError) {
+                httpError(response, 400, e);
+              } else if (e.message === 'Not accessible.') {
+                httpError(response, 403);
+              } else {
+                httpError(response, 500, e);
+              }
+              return;
+            }
+            if (data.entity.guid && !entity.guid) {
+              httpError(response, 400);
+              return;
+            }
+            if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
+              httpError(response, 403);
+              return;
+            }
+            if (
+              !(data.method in entity) ||
+              typeof entity[data.method] !== 'function'
+            ) {
+              httpError(response, 400);
+              return;
+            }
+            try {
+              const result = entity[data.method](...params);
+              let ret = result;
+              if (result instanceof Promise) {
+                ret = await result;
+              }
+              response.status(200);
+              response.setHeader('Content-Type', 'application/json');
+              if (data.stateless) {
+                response.send({ return: ret });
+              } else {
+                response.send({ entity: entity, return: ret });
+              }
+            } catch (e: any) {
               httpError(response, 500, e);
+              return;
             }
-            return;
-          }
-          if (data.entity.guid && !entity.guid) {
-            httpError(response, 400);
-            return;
           }
-          if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
-            httpError(response, 403);
-            return;
-          }
-          if (
-            !(data.method in entity) ||
-            typeof entity[data.method] !== 'function'
-          ) {
-            httpError(response, 400);
+        } catch (e: any) {
+          if (e instanceof ForbiddenClassError) {
+            httpError(response, 403, e);
             return;
-          }
-          try {
-            const result = entity[data.method](...params);
-            let ret = result;
-            if (result instanceof Promise) {
-              ret = await result;
-            }
-            response.status(200);
-            response.setHeader('Content-Type', 'application/json');
-            if (data.stateless) {
-              response.send({ return: ret });
-            } else {
-              response.send({ entity: entity, return: ret });
-            }
-          } catch (e: any) {
+          } else {
             httpError(response, 500, e);
             return;
           }
@@ -410,10 +547,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.WRITE_ACCESS
-            )
+              TilmeldAccessLevels.WRITE_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -472,7 +609,7 @@ export function createServer(
     response: NymphResponse,
     action: string,
     data: any,
-    patch: boolean
+    patch: boolean,
   ) {
     if (action === 'uid') {
       if (typeof data.name !== 'string' || typeof data.value !== 'number') {
@@ -481,10 +618,10 @@ export function createServer(
       }
       if (response.locals.nymph.tilmeld) {
         if (
-          !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+          !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
             data.name,
-            TilmeldAccessLevels.FULL_ACCESS
-          )
+            TilmeldAccessLevels.FULL_ACCESS,
+          ))
         ) {
           httpError(response, 403);
           return;
@@ -512,6 +649,7 @@ export function createServer(
       let hadSuccess = false;
       let invalidRequest = false;
       let conflict = false;
+      let forbidden = false;
       let notfound = false;
       let lastException = null;
       for (let entData of data) {
@@ -522,15 +660,30 @@ export function createServer(
         }
         let entity: EntityInterface;
         try {
-          entity = await loadEntity(entData, response.locals.nymph, patch);
+          entity = await loadEntity(
+            classNamesToEntityConstructors(
+              response.locals.nymph,
+              referencesToEntities(entData, response.locals.nymph, false, true),
+              true,
+            ),
+            response.locals.nymph,
+            patch,
+          );
         } catch (e: any) {
           if (e instanceof EntityConflictError) {
             conflict = true;
+            lastException = e;
+          } else if (e instanceof ForbiddenClassError) {
+            forbidden = true;
+            lastException = e;
           } else if (e.message === NOT_FOUND_ERROR) {
             notfound = true;
           } else if (e instanceof InvalidParametersError) {
             invalidRequest = true;
             lastException = e;
+          } else if (e.message === 'Not accessible.') {
+            forbidden = true;
+            lastException = e;
           } else {
             lastException = e;
           }
@@ -543,12 +696,9 @@ export function createServer(
           continue;
         }
         try {
-          if (await entity.$save()) {
-            saved.push(entity);
-            hadSuccess = true;
-          } else {
-            saved.push(false);
-          }
+          await entity.$save();
+          saved.push(entity);
+          hadSuccess = true;
         } catch (e: any) {
           if (e instanceof EntityInvalidDataError) {
             invalidRequest = true;
@@ -561,8 +711,10 @@ export function createServer(
       if (!hadSuccess) {
         if (invalidRequest) {
           httpError(response, 400, lastException);
+        } else if (forbidden) {
+          httpError(response, 403, lastException);
         } else if (conflict) {
-          httpError(response, 409);
+          httpError(response, 409, lastException);
         } else if (notfound) {
           httpError(response, 404);
         } else {
@@ -605,6 +757,10 @@ export function createServer(
           let EntityClass: EntityConstructor;
           try {
             EntityClass = response.locals.nymph.getEntityClass(entData.class);
+            if (!EntityClass.restEnabled) {
+              httpError(response, 403);
+              return;
+            }
           } catch (e: any) {
             invalidRequest = true;
             failures = true;
@@ -614,7 +770,7 @@ export function createServer(
           try {
             entity = await response.locals.nymph.getEntity(
               { class: EntityClass },
-              { type: '&', guid: entData.guid }
+              { type: '&', guid: entData.guid },
             );
           } catch (e: any) {
             lastException = e;
@@ -627,9 +783,10 @@ export function createServer(
             continue;
           }
           try {
-            if (await entity.$delete()) {
+            try {
+              await entity.$delete();
               deleted.push(entData.guid);
-            } else {
+            } catch (e: any) {
               failures = true;
             }
           } catch (e: any) {
@@ -661,10 +818,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.FULL_ACCESS
-            )
+              TilmeldAccessLevels.FULL_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -698,15 +855,18 @@ export function createServer(
     entityData: EntityJson | EntityPatch,
     nymph: Nymph,
     patch = false,
-    allowConflict = false
+    allowConflict = false,
   ): Promise<EntityInterface> {
-    if (entityData.class === 'Entity') {
+    let EntityClass = entityData.class;
+    if (EntityClass.class === 'Entity') {
       // Don't let clients use the `Entity` class, since it has no validity/AC checks.
-      throw new InvalidParametersError(
-        "Can't use Entity class directly from the front end."
+      throw new ForbiddenClassError(
+        "Can't use Entity class directly from the front end.",
       );
     }
-    let EntityClass = nymph.getEntityClass(entityData.class);
+    if (!EntityClass.restEnabled) {
+      throw new ForbiddenClassError('Not accessible.');
+    }
     let entity: EntityInterface | null;
     if (entityData.guid) {
       entity = await nymph.getEntity(
@@ -714,7 +874,7 @@ export function createServer(
         {
           type: '&',
           guid: `${entityData['guid']}`,
-        }
+        },
       );
       if (entity === null) {
         throw new Error(NOT_FOUND_ERROR);
@@ -731,46 +891,61 @@ export function createServer(
   }
 
   /**
-   * Check if an item is a reference, and if it is, convert it to an entity.
-   *
-   * This function will recurse into deeper arrays and objects.
+   * Return the request with an HTTP error response.
    *
-   * @param item The item to check.
-   * @returns The item, converted.
+   * @param res The server response object.
+   * @param defaultStatusCode The HTTP status code to use if none is given in the error object.
+   * @param error An optional error object to report.
    */
-  function referencesToEntities(item: any, nymph: Nymph): any {
-    if (Array.isArray(item)) {
-      if (item.length === 3 && item[0] === 'nymph_entity_reference') {
-        try {
-          const EntityClass = nymph.getEntityClass(item[1]);
-          return EntityClass.factoryReference(item as EntityReference);
-        } catch (e: any) {
-          return item;
-        }
-      }
-      return item.map((entry) => referencesToEntities(entry, nymph));
-    } else if (typeof item === 'object' && !(item instanceof Entity)) {
-      // Only do this for non-entity objects.
-      const newItem: { [k: string]: any } = {};
-      for (let curProperty in item) {
-        newItem[curProperty] = referencesToEntities(item[curProperty], nymph);
-      }
-      return newItem;
+  function httpError(
+    res: NymphResponse,
+    defaultStatusCode: number,
+    error?: Error & { status?: number; statusText?: string },
+  ) {
+    const status = error?.status || defaultStatusCode;
+    const statusText =
+      error?.statusText ||
+      (error?.status == null
+        ? statusDescriptions[defaultStatusCode]
+        : error.status in statusDescriptions &&
+          statusDescriptions[error.status]) ||
+      'Internal Server Error';
+
+    const errorResponse = error
+      ? {
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: error.message,
+          error,
+          ...(process.env.NODE_ENV !== 'production'
+            ? { stack: error.stack }
+            : {}),
+        }
+      : {
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: statusText,
+        };
+
+    if (!res.headersSent) {
+      res.status(status);
+      res.setHeader('Content-Type', 'application/json');
     }
-    return item;
+
+    res.send(errorResponse);
   }
 
   /**
-   * Return the request with an HTTP error response.
+   * End the event stream with an HTTP error response.
    *
    * @param res The server response object.
    * @param defaultStatusCode The HTTP status code to use if none is given in the error object.
    * @param error An optional error object to report.
    */
-  function httpError(
+  function eventStreamError(
     res: NymphResponse,
     defaultStatusCode: number,
-    error?: Error & { status?: number; statusText?: string }
+    error?: Error & { status?: number; statusText?: string },
   ) {
     const status = error?.status || defaultStatusCode;
     const statusText =
@@ -780,26 +955,37 @@ export function createServer(
         : error.status in statusDescriptions &&
           statusDescriptions[error.status]) ||
       'Internal Server Error';
+
+    const errorResponse = error
+      ? {
+          status,
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: error.message,
+          error,
+          ...(process.env.NODE_ENV !== 'production'
+            ? { stack: error.stack }
+            : {}),
+        }
+      : {
+          status,
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: statusText,
+        };
+
     if (!res.headersSent) {
       res.status(status);
       res.setHeader('Content-Type', 'application/json');
-    }
-    if (error) {
-      res.send({
-        textStatus: `${status} ${statusText}`,
-        statusText,
-        message: error.message,
-        error,
-        ...(process.env.NODE_ENV !== 'production'
-          ? { stack: error.stack }
-          : {}),
-      });
+
+      res.send(errorResponse);
     } else {
-      res.send({
-        textStatus: `${status} ${statusText}`,
-        statusText,
-        message: statusText,
-      });
+      res.write('event: error\n');
+      res.write(`data: ${JSON.stringify(errorResponse)}\n\n`);
+
+      res.write('event: finished\n');
+      res.write('data: \n\n');
+      res.end();
     }
   }