@onlineapps/service-wrapper 2.1.59 → 2.1.60

package/config/runtime-defaults.json

@@ -45,6 +45,12 @@
       },
       "validation": {
         "enabled": true
+      },
+      "accountContext": {
+        "enabled": true,
+        "headerName": "account-id",
+        "requirePathPrefixes": ["/api/"],
+        "excludePathPrefixes": ["/api/v1/specification"]
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/service-wrapper",
-  "version": "2.1.59",
+  "version": "2.1.60",
   "description": "Thin orchestration layer for microservices - delegates all infrastructure concerns to specialized connectors",
   "main": "src/index.js",
   "scripts": {

package/src/createAccountContextMiddleware.js

@@ -0,0 +1,88 @@
+'use strict';
+
+/**
+ * Create an Express middleware that enforces required account context for business APIs.
+ *
+ * Rules:
+ * - Applies only for paths that match `requirePathPrefixes` and do NOT match `excludePathPrefixes`.
+ * - Requires header `headerName` to be a positive integer.
+ * - Sets `req.account_id` as integer.
+ *
+ * @param {Object} options
+ * @param {string} options.serviceName
+ * @param {Object} options.accountContext
+ * @param {boolean} options.accountContext.enabled
+ * @param {string} options.accountContext.headerName
+ * @param {string[]} options.accountContext.requirePathPrefixes
+ * @param {string[]} options.accountContext.excludePathPrefixes
+ * @returns {Function} Express middleware
+ */
+function createAccountContextMiddleware(options = {}) {
+  const serviceName = options.serviceName;
+  const accountContext = options.accountContext || {};
+
+  if (!serviceName || typeof serviceName !== 'string') {
+    throw new Error('[service-wrapper][AccountContext] Missing dependency - Expected serviceName (string)');
+  }
+  if (typeof accountContext !== 'object' || Array.isArray(accountContext)) {
+    throw new Error('[service-wrapper][AccountContext] Invalid configuration - Expected accountContext to be an object');
+  }
+
+  const {
+    enabled,
+    headerName,
+    requirePathPrefixes,
+    excludePathPrefixes
+  } = accountContext;
+
+  if (typeof enabled !== 'boolean') {
+    throw new Error(`[service-wrapper][AccountContext] Invalid configuration - wrapper.accountContext.enabled must be boolean, got: ${typeof enabled}`);
+  }
+  if (typeof headerName !== 'string' || headerName.trim() === '') {
+    throw new Error(`[service-wrapper][AccountContext] Invalid configuration - wrapper.accountContext.headerName must be non-empty string, got: ${headerName}`);
+  }
+  if (!Array.isArray(requirePathPrefixes) || requirePathPrefixes.some(p => typeof p !== 'string')) {
+    throw new Error('[service-wrapper][AccountContext] Invalid configuration - wrapper.accountContext.requirePathPrefixes must be string[]');
+  }
+  if (!Array.isArray(excludePathPrefixes) || excludePathPrefixes.some(p => typeof p !== 'string')) {
+    throw new Error('[service-wrapper][AccountContext] Invalid configuration - wrapper.accountContext.excludePathPrefixes must be string[]');
+  }
+
+  const requirePrefixes = requirePathPrefixes;
+  const excludePrefixes = excludePathPrefixes;
+
+  return function accountContextMiddleware(req, res, next) {
+    if (!enabled) {
+      return next();
+    }
+
+    const path = req && typeof req.path === 'string' ? req.path : '';
+    if (!requirePrefixes.some(prefix => path.startsWith(prefix))) {
+      return next();
+    }
+    if (excludePrefixes.some(prefix => path.startsWith(prefix))) {
+      return next();
+    }
+
+    const rawAccountId = req.headers ? req.headers[headerName] : undefined;
+    if (!rawAccountId) {
+      return res.status(400).json({
+        error: `[${serviceName}][Multitenancy] Missing account context - Expected request header '${headerName}' (INT)`
+      });
+    }
+
+    const accountId = Number.parseInt(String(rawAccountId), 10);
+    if (!Number.isInteger(accountId) || accountId <= 0) {
+      return res.status(400).json({
+        error: `[${serviceName}][Multitenancy] Invalid account context - Expected '${headerName}' to be a positive integer`
+      });
+    }
+
+    req.account_id = accountId;
+    return next();
+  };
+}
+
+module.exports = { createAccountContextMiddleware };
+
+

package/src/index.js

@@ -16,6 +16,7 @@ const ServiceWrapper = require('./ServiceWrapper');
 const { ConfigLoader } = require('./ConfigLoader');
 const runtimeCfg = require('./config');
 const pkg = require('../package.json');
+const { createAccountContextMiddleware } = require('./createAccountContextMiddleware');
 
 // Note: WorkflowProcessor and ApiCaller functionality has been moved to connectors:
 // - WorkflowProcessor -> @onlineapps/conn-orch-orchestrator
@@ -58,6 +59,14 @@ async function bootstrap(serviceRoot, options = {}) {
 
   console.log(`Starting ${config.service.name} v${config.service.version}...`);
 
+  // 0. Apply shared request context middleware (account context for multitenancy)
+  // Enforced centrally for all business services: /api/** must have account-id (except /api/v1/specification).
+  const accountContextMw = createAccountContextMiddleware({
+    serviceName: config.service.name,
+    accountContext: config.wrapper?.accountContext
+  });
+  app.use(accountContextMw);
+
   // 1. Start HTTP server
   const PORT = config.service.port;
   const server = app.listen(PORT, () => {