@oondemand/oon-core-back 0.6.5 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/core/licensing.js

@@ -0,0 +1,71 @@
+"use strict";
+
+const axios = require("axios");
+const GenericError = require("./errors/GenericError");
+const { operationalRequestHeaders } = require("./utils/instanceActivation");
+const { getBaseUrl, getAppCode } = require("./utils/activationProvider");
+const { isLocalRuntime } = require("./runtime/localDevelopment");
+
+const BLOCKING_CODES = new Set(["APP_LICENSE_REQUIRED", "APP_LICENSE_NOT_STARTED", "APP_LICENSE_EXPIRED", "APP_LICENSE_SUSPENDED", "APP_LICENSE_CANCELLED", "APP_LICENSE_OVERDUE", "APP_LICENSE_INVALID", "LICENSE_REQUIRED", "LICENSE_INACTIVE", "LICENSE_EXPIRED", "LICENSE_NOT_STARTED", "APP_ENTITLEMENT_INACTIVE", "APP_ENTITLEMENT_REQUIRED", "APP_ENTITLEMENT_OUT_OF_TERM"]);
+const TIMEOUT_MS = 3000;
+
+function unavailable() {
+  return new GenericError("Não foi possível consultar a licença. A operação permanece pendente.", { statusCode: 503, code: "LICENSE_AUTHORITY_UNAVAILABLE" });
+}
+function blocked(code) {
+  return new GenericError("A licença não permite iniciar esta operação. Consulte o responsável pelo contrato.", { statusCode: 423, code });
+}
+
+// No positive cache and no retries. Call immediately before each new business effect.
+async function assertBusinessOperation({ tenantId, correlationId } = {}, dependencies = {}) {
+  if (!tenantId) throw new GenericError("Contexto de tenant obrigatório.", { statusCode: 403, code: "TENANT_CONTEXT_REQUIRED" });
+  const headers = await (dependencies.operationalRequestHeaders || operationalRequestHeaders)({ tenantId, correlationId });
+  const appCode = (dependencies.getAppCode || getAppCode)();
+  const baseUrl = (dependencies.getBaseUrl || getBaseUrl)();
+  let response;
+  try {
+    response = await (dependencies.post || axios.post)(`${baseUrl}/licensing/decision`, {}, {
+      timeout: TIMEOUT_MS, maxRedirects: 0, maxContentLength: 16384, headers,
+    });
+  } catch (error) {
+    const code = error.response?.data?.error?.code || error.response?.data?.code;
+    if (BLOCKING_CODES.has(code) && [402, 403, 409, 423].includes(error.response?.status)) throw blocked(code);
+    throw unavailable();
+  }
+  const result = response?.data;
+  if (result?.schemaVersion !== 1 || result.tenantId !== String(tenantId) || result.appCode !== appCode
+      || !["desenvolvimento", "homologacao", "producao"].includes(result.environment)
+      || result.maxAgeSeconds !== 0 || typeof result.allowed !== "boolean") throw unavailable();
+  if (!result.allowed) {
+    if (BLOCKING_CODES.has(result.code)) throw blocked(result.code);
+    throw unavailable();
+  }
+  if (result.code != null || !Number.isSafeInteger(result.version) || result.version < 1) throw unavailable();
+  return Object.freeze({ ...result });
+}
+
+// An integration service authenticates the originating Deployment at the authority.
+// Forward only this allowlist, never the gateway bearer or arbitrary request headers.
+async function verifyConsumerRequest({ headers: input = {}, requireLicense = true } = {}, dependencies = {}) {
+  if (isLocalRuntime()) throw new GenericError("Identidade operacional indisponível localmente.", { statusCode: 403, code: "LOCAL_OPERATION_NOT_SUPPORTED" });
+  const headers = {};
+  for (const key of ["x-oon-deployment-id", "x-oon-deployment-token", "x-app-code", "x-oon-tenant-id"]) {
+    if (typeof input[key] !== "string" || !input[key] || input[key].length > 512) throw new GenericError("Credencial operacional inválida.", { statusCode: 401, code: "OPERATIONAL_CREDENTIAL_REQUIRED" });
+    headers[key] = input[key];
+  }
+  if (requireLicense) {
+    return assertBusinessOperation({ tenantId: headers["x-oon-tenant-id"] }, { ...dependencies,
+      getAppCode: () => headers["x-app-code"], operationalRequestHeaders: async () => headers });
+  }
+  try {
+    const response = await (dependencies.post || axios.post)(`${(dependencies.getBaseUrl || getBaseUrl)()}/licensing/identity`, {}, { timeout: TIMEOUT_MS, maxRedirects: 0, maxContentLength: 16384, headers });
+    const result = response?.data;
+    if (result?.schemaVersion !== 1 || result.appCode !== headers["x-app-code"] || result.tenantId !== headers["x-oon-tenant-id"] || !["desenvolvimento", "homologacao", "producao"].includes(result.environment) || result.maxAgeSeconds !== 0) throw unavailable();
+    return Object.freeze({ appCode: result.appCode, tenantId: result.tenantId, environment: result.environment });
+  } catch (error) {
+    if ([401, 403].includes(error.response?.status)) throw new GenericError("Credencial operacional inválida.", { statusCode: 401, code: "OPERATIONAL_CREDENTIAL_INVALID" });
+    throw unavailable();
+  }
+}
+
+module.exports = { assertBusinessOperation, verifyConsumerRequest, BLOCKING_CODES, TIMEOUT_MS };

package/src/index.js

@@ -76,6 +76,10 @@ module.exports = {
   fields,
   capabilities,
   operationalRequestHeaders,
+  licensing: {
+    assertBusinessOperation: require("./core/licensing").assertBusinessOperation,
+    verifyConsumerRequest: require("./core/licensing").verifyConsumerRequest,
+  },
   localDevelopment,
   localExecutionPolicy,
   PdfRenderingError: capabilities.PdfRenderingError,