@ossy/platform 1.39.2 → 3.0.1

package/src/users.middleware.js

@@ -5,8 +5,20 @@ import { User } from '@ossy/users/server'
 import { Token } from '@ossy/tokens/server'
 import { ConfigService } from './config.service.js'
 import { PoliciesQueries } from '@ossy/policies/server'
+import {
+  OperationTimeoutError,
+  resolveTimeoutMs,
+  withTimeout,
+} from './request-diagnostics.js'
 
 const log = createLogger('users')
+const AUTH_TIMEOUT_MS = resolveTimeoutMs('OSSY_AUTH_TIMEOUT_MS', 10_000)
+
+function normalizeAuthToken (token) {
+  const trimmed = String(token ?? '').trim()
+  if (!trimmed) return ''
+  return trimmed.replace(/^Bearer\s+/i, '').trim()
+}
 
 /**
  * Express middleware for user authentication and context resolution.
@@ -34,8 +46,9 @@ export class UsersMiddleware {
    * or to the anonymous principal. Authorization / role checks belong in a separate step.
    */
   static AuthenticateUser (req, res, next) {
-    const authToken = req.signedCookies.auth
-      || req.get('Authorization')
+    const authToken = normalizeAuthToken(
+      req.signedCookies.auth || req.get('Authorization'),
+    )
 
     const asAnonymous = () => {
       req.userId = ConfigService.AnonymousUserId
@@ -51,24 +64,55 @@ export class UsersMiddleware {
     log.info('[UsersMiddleware] Authenticating')
     log.debug('[UsersMiddleware] authToken', { authToken })
 
-    TokenService.verify(authToken)
-      .then(UsersMiddleware.assertApiTokenActive)
-      .then(({ sub }) => Aggregate.Of(User, sub))
-      .then(Aggregate.View())
-      .then(user => {
-        const workspaces = user.workspaces ?? []
+    const authStarted = performance.now()
+    let authFinished = false
+    const finishAuth = (apply) => {
+      if (authFinished) return
+      authFinished = true
+      apply()
+    }
 
-        return PoliciesQueries.GetPoliciesForUser(user.id)
-          .then(policies => {
-            log.info('[UsersMiddleware] Resolved user')
-            req.userId = user.id
-            req.user = { ...user, workspaces, policies }
-            next()
-          })
-      })
+    withTimeout(
+      TokenService.verify(authToken)
+        .then(UsersMiddleware.assertApiTokenActive)
+        .then(payload => {
+          req.authPayload = payload
+          req.tokenScopes = payload?.type === 'Api' ? (payload.scopes ?? ['*']) : null
+          return payload
+        })
+        .then(({ sub }) => Aggregate.Of(User, sub))
+        .then(Aggregate.View())
+        .then(user => {
+          const workspaces = user.workspaces ?? []
+
+          return PoliciesQueries.GetPoliciesForUser(user.id)
+            .then(policies => {
+              finishAuth(() => {
+                log.info('[UsersMiddleware] Resolved user', {
+                  elapsedMs: Math.round(performance.now() - authStarted),
+                })
+                req.userId = user.id
+                req.user = { ...user, workspaces, policies }
+                next()
+              })
+            })
+        }),
+      AUTH_TIMEOUT_MS,
+      'UsersMiddleware.AuthenticateUser',
+    )
       .catch(error => {
+        if (error instanceof OperationTimeoutError) {
+          log.warn('[UsersMiddleware] Auth timed out', {
+            timeoutMs: error.timeoutMs,
+            elapsedMs: Math.round(performance.now() - authStarted),
+          })
+          finishAuth(() => {
+            res.status(504).json({ error: 'Authentication timed out', code: 'AUTH_TIMEOUT' })
+          })
+          return
+        }
         log.debug('[UsersMiddleware] Auth failed; anonymous', { error })
-        asAnonymous()
+        finishAuth(asAnonymous)
       })
   }
 

package/src/resources/resource-template.registry.js

@@ -1,29 +0,0 @@
-import { createLogger } from '@ossy/observability'
-
-const log = createLogger('platform')
-
-/** @type {object[]} */
-const systemTemplates = []
-
-/**
- * Register a single resource template POJO (as inlined in `build/manifest.json`).
- * Silently skips duplicates (same `id`) and invalid entries.
- *
- * @param {object} template
- */
-export function registerResourceTemplate(template) {
-  if (!template || typeof template !== 'object' || Array.isArray(template)) return
-  if (typeof template.id !== 'string' || template.id.trim() === '') return
-  if (systemTemplates.find(t => t.id === template.id)) return
-  systemTemplates.push(template)
-  log.info(`[ResourceTemplateRegistry] Registered system template: ${template.id}`)
-}
-
-/**
- * Returns all registered system resource templates.
- *
- * @returns {object[]}
- */
-export function getSystemResourceTemplates() {
-  return systemTemplates
-}

package/src/resources/resource-template.validation.js

@@ -1,232 +0,0 @@
-/** Field input types accepted in resource template definitions (UI + API contract). */
-export const ALLOWED_FIELD_TYPES = new Set([
-  'text',
-  'textarea',
-  'richtext',
-  'number',
-  'select',
-  'multiselect',
-  'image',
-  'boolean',
-  'date',
-])
-
-function isNonEmptyString(value) {
-  return typeof value === 'string' && value.trim().length > 0
-}
-
-function isEmptyValue(value) {
-  if (value === undefined || value === null) return true
-  if (typeof value === 'string' && value.trim() === '') return true
-  return false
-}
-
-/**
- * @param {unknown} template
- * @param {{ reservedIds: Set<string> }} ctx
- * @returns {{ ok: true } | { ok: false, code: string, message: string }}
- */
-function validateOneTemplateShape(template, ctx) {
-  if (template === null || typeof template !== 'object' || Array.isArray(template)) {
-    return { ok: false, code: 'INVALID_TEMPLATE', message: 'Each template must be a non-array object' }
-  }
-
-  if (!isNonEmptyString(template.id)) {
-    return { ok: false, code: 'INVALID_TEMPLATE', message: 'Each template must have a non-empty string id' }
-  }
-
-  if (!isNonEmptyString(template.name)) {
-    return { ok: false, code: 'INVALID_TEMPLATE', message: `Template "${template.id}" must have a non-empty string name` }
-  }
-
-  if (ctx.reservedIds.has(template.id)) {
-    return {
-      ok: false,
-      code: 'RESERVED_TEMPLATE_ID',
-      message: `Template id "${template.id}" is reserved by a system template`,
-    }
-  }
-
-  if (!Array.isArray(template.fields)) {
-    return {
-      ok: false,
-      code: 'INVALID_TEMPLATE',
-      message: `Template "${template.id}" must have a fields array`,
-    }
-  }
-
-  const fieldNames = new Set()
-  for (let i = 0; i < template.fields.length; i++) {
-    const field = template.fields[i]
-    if (field === null || typeof field !== 'object' || Array.isArray(field)) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD',
-        message: `Template "${template.id}" fields[${i}] must be an object`,
-      }
-    }
-    if (!isNonEmptyString(field.name)) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD',
-        message: `Template "${template.id}" fields[${i}] must have a non-empty string name`,
-      }
-    }
-    if (fieldNames.has(field.name)) {
-      return {
-        ok: false,
-        code: 'DUPLICATE_FIELD_NAME',
-        message: `Template "${template.id}" has duplicate field name "${field.name}"`,
-      }
-    }
-    fieldNames.add(field.name)
-
-    if (typeof field.type !== 'string' || !isNonEmptyString(field.type)) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD_TYPE',
-        message: `Template "${template.id}" field "${field.name}" must have a non-empty string type`,
-      }
-    }
-
-    const fieldType = field.type.trim()
-    if (!ALLOWED_FIELD_TYPES.has(fieldType)) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD_TYPE',
-        message: `Template "${template.id}" field "${field.name}" has unsupported type "${fieldType}"`,
-      }
-    }
-
-    if (fieldType === 'select' || fieldType === 'multiselect') {
-      if (!Array.isArray(field.options) || field.options.length === 0) {
-        return {
-          ok: false,
-          code: 'INVALID_FIELD_OPTIONS',
-          message: `Template "${template.id}" field "${field.name}" of type ${fieldType} requires a non-empty options array`,
-        }
-      }
-      const badOption = field.options.find(o => typeof o !== 'string' || o.trim() === '')
-      if (badOption !== undefined) {
-        return {
-          ok: false,
-          code: 'INVALID_FIELD_OPTIONS',
-          message: `Template "${template.id}" field "${field.name}" options must be non-empty strings`,
-        }
-      }
-    }
-  }
-
-  return { ok: true }
-}
-
-/**
- * Validates a batch import of workspace resource templates.
- *
- * @param {unknown} templates
- * @param {Set<string>} reservedIds - System template ids that must not be redefined
- * @returns {{ ok: true } | { ok: false, code: string, message: string }}
- */
-export function validateResourceTemplatesForImport(templates, reservedIds) {
-  if (!Array.isArray(templates)) {
-    return { ok: false, code: 'INVALID_PAYLOAD', message: 'Body must be a JSON array of resource templates' }
-  }
-
-  const seenIds = new Set()
-  for (let i = 0; i < templates.length; i++) {
-    const template = templates[i]
-    const shape = validateOneTemplateShape(template, { reservedIds })
-    if (!shape.ok) return shape
-
-    if (seenIds.has(template.id)) {
-      return {
-        ok: false,
-        code: 'DUPLICATE_TEMPLATE_ID',
-        message: `Duplicate template id "${template.id}" in import payload`,
-      }
-    }
-    seenIds.add(template.id)
-  }
-
-  return { ok: true }
-}
-
-/**
- * Strips content to template field names and validates required fields and basic value shapes.
- *
- * @param {unknown} rawContent
- * @param {{ fields?: { name: string, type?: string, required?: boolean, options?: string[] }[] }} template
- * @returns {{ ok: true, content: Record<string, unknown> } | { ok: false, code: string, message: string }}
- */
-export function normalizeAndValidateDocumentContent(rawContent, template) {
-  const fields = template?.fields || []
-
-  let base
-  if (rawContent === undefined || rawContent === null) {
-    base = {}
-  } else if (typeof rawContent !== 'object' || Array.isArray(rawContent)) {
-    return { ok: false, code: 'INVALID_CONTENT', message: 'Content must be a plain object' }
-  } else {
-    base = rawContent
-  }
-
-  const allowedNames = new Set(fields.map(f => f.name))
-  const content = {}
-  for (const name of allowedNames) {
-    if (Object.prototype.hasOwnProperty.call(base, name)) {
-      content[name] = base[name]
-    }
-  }
-
-  for (const field of fields) {
-    const v = content[field.name]
-    const t = typeof field.type === 'string' ? field.type.trim() : field.type
-
-    if (field.required && isEmptyValue(v)) {
-      return {
-        ok: false,
-        code: 'REQUIRED_FIELD_MISSING',
-        message: `Field "${field.name}" is required`,
-      }
-    }
-
-    if (v === undefined) continue
-
-    if (t === 'number' && v !== null && (typeof v !== 'number' || Number.isNaN(v))) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD_VALUE',
-        message: `Field "${field.name}" must be a number`,
-      }
-    }
-
-    if (t === 'select' && v !== null && v !== undefined && !field.options?.includes(v)) {
-      return {
-        ok: false,
-        code: 'INVALID_FIELD_VALUE',
-        message: `Field "${field.name}" must be one of the defined options`,
-      }
-    }
-
-    if (t === 'multiselect' && v !== null && v !== undefined) {
-      if (!Array.isArray(v)) {
-        return {
-          ok: false,
-          code: 'INVALID_FIELD_VALUE',
-          message: `Field "${field.name}" must be an array of option values`,
-        }
-      }
-      const opts = field.options || []
-      const invalid = v.some(item => typeof item !== 'string' || !opts.includes(item))
-      if (invalid) {
-        return {
-          ok: false,
-          code: 'INVALID_FIELD_VALUE',
-          message: `Field "${field.name}" must only contain values from options`,
-        }
-      }
-    }
-  }
-
-  return { ok: true, content }
-}