@ozdao/martyrs 0.2.477 → 0.2.479

package/dist/globals.server.cjs

@@ -0,0 +1,446 @@
+"use strict";
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
+const abac = require("./abac-XF1JVCLI.cjs");
+const cookie = require("cookie");
+const jwt = require("jsonwebtoken");
+const uWS = require("uWebSockets.js");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const cookie__namespace = /* @__PURE__ */ _interopNamespaceDefault(cookie);
+class WebSocketManager {
+  constructor() {
+    this.app = uWS.App();
+    this.modules = /* @__PURE__ */ new Map();
+    this.userConnections = /* @__PURE__ */ new Map();
+    this.rpcMethods = /* @__PURE__ */ new Map();
+    this.app.ws("/api/ws", {
+      maxPayloadLength: 16 * 1024 * 1024,
+      idleTimeout: 120,
+      compression: uWS.SHARED_COMPRESSOR,
+      maxBackpressure: 1024 * 1024,
+      // Обработчик аутентификации и апгрейда соединения
+      upgrade: (res, req, context) => {
+        let userId = null;
+        const headers = {};
+        req.forEach((key, value) => {
+          headers[key.toLowerCase()] = value;
+        });
+        const secWebSocketKey = headers["sec-websocket-key"] || "";
+        const secWebSocketProtocol = headers["sec-websocket-protocol"] || "";
+        const secWebSocketExtensions = headers["sec-websocket-extensions"] || "";
+        try {
+          if (headers.cookie) {
+            const cookies = cookie__namespace.parse(headers.cookie);
+            if (cookies.user) {
+              const token = JSON.parse(decodeURIComponent(cookies.user));
+              const decoded = jwt.verify(token.accessToken, process.env.SECRET_KEY);
+              userId = decoded._id;
+            }
+          }
+        } catch (err) {
+          console.error("Invalid token:", err);
+        }
+        if (process.env.REQUIRE_AUTH === "true" && !userId) {
+          res.writeStatus("401 Unauthorized").end("Authentication required");
+          return;
+        }
+        const userData = { userId };
+        res.upgrade(userData, secWebSocketKey, secWebSocketProtocol, secWebSocketExtensions, context);
+      },
+      // Обработчик открытия соединения
+      open: (ws) => {
+        ws.userId = ws.getUserData().userId;
+        ws.subscriptions = /* @__PURE__ */ new Set();
+        if (ws.userId) {
+          this._trackUserConnection(ws.userId, ws);
+        }
+      },
+      // Обработчик входящих сообщений
+      message: async (ws, message, isBinary) => {
+        if (!isBinary) {
+          try {
+            const msgStr = new TextDecoder().decode(message);
+            const msg = JSON.parse(msgStr);
+            if (msg.type === "subscribe" && msg.module && this.modules.has(msg.module)) {
+              ws.subscriptions.add(msg.module);
+              return;
+            } else if (msg.type === "unsubscribe" && msg.module) {
+              ws.subscriptions.delete(msg.module);
+              return;
+            }
+            if (msg.type === "rpc") {
+              await this._handleRpcCall(ws, msg);
+              return;
+            }
+            const moduleName = msg.module;
+            if (moduleName && this.modules.has(moduleName)) {
+              const handler = this.modules.get(moduleName);
+              Promise.resolve(handler(ws, msg)).catch((err) => {
+                console.error(`Error in handler for module ${moduleName}:`, err);
+              });
+            }
+          } catch (err) {
+            console.error("Invalid message or handler error:", err);
+            if (err instanceof Error) {
+              try {
+                ws.send(
+                  JSON.stringify({
+                    type: "error",
+                    error: {
+                      message: err.message,
+                      code: err.code || "INTERNAL_ERROR"
+                    }
+                  }),
+                  false
+                );
+              } catch (sendErr) {
+                console.error("Error sending error response:", sendErr);
+              }
+            }
+          }
+        }
+      },
+      // Обработчик закрытия соединения
+      close: (ws, code, message) => {
+        const userId = ws.userId;
+        if (userId && this.userConnections.has(userId)) {
+          this.userConnections.get(userId).delete(ws);
+          if (this.userConnections.get(userId).size === 0) {
+            this.userConnections.delete(userId);
+          }
+        }
+        if (ws.subscriptions && typeof ws.subscriptions.clear === "function") {
+          ws.subscriptions.clear();
+        }
+      }
+    });
+    this.listenSocket = null;
+  }
+  // Метод для запуска сервера
+  listen(port, callback) {
+    this.app.listen(port, (listenSocket) => {
+      if (listenSocket) {
+        this.listenSocket = listenSocket;
+        if (callback) callback(null, this.app);
+      } else {
+        if (callback) callback(new Error("Failed to listen"), null);
+      }
+    });
+    return this;
+  }
+  _trackUserConnection(userId, ws) {
+    if (!this.userConnections.has(userId)) {
+      this.userConnections.set(userId, /* @__PURE__ */ new Set());
+    }
+    this.userConnections.get(userId).add(ws);
+  }
+  registerModule(moduleName, handler) {
+    this.modules.set(moduleName, handler);
+  }
+  // Добавляем методы для регистрации RPC
+  registerRpcMethod(moduleName, methodName, handler, options = {}) {
+    const fullMethodName = `${moduleName}.${methodName}`;
+    if (!this.rpcMethods.has(moduleName)) {
+      this.rpcMethods.set(moduleName, /* @__PURE__ */ new Map());
+    }
+    this.rpcMethods.get(moduleName).set(methodName, {
+      handler,
+      options: {
+        requireAuth: options.requireAuth !== false,
+        // По умолчанию true
+        validateParams: options.validateParams || null,
+        rateLimit: options.rateLimit || null,
+        ...options
+      }
+    });
+    console.log(`RPC method registered: ${fullMethodName}`);
+    return this;
+  }
+  // Метод для регистрации группы RPC методов из модуля
+  registerRpcMethods(moduleName, methodsMap) {
+    for (const [methodName, config] of Object.entries(methodsMap)) {
+      const handler = typeof config === "function" ? config : config.handler;
+      const options = typeof config === "function" ? {} : config.options || {};
+      this.registerRpcMethod(moduleName, methodName, handler, options);
+    }
+    return this;
+  }
+  // Обработчик RPC вызовов
+  async _handleRpcCall(ws, message) {
+    const { module: module2, method, params, id } = message;
+    if (!this.rpcMethods.has(module2) || !this.rpcMethods.get(module2).has(method)) {
+      this._sendRpcResponse(ws, id, null, {
+        code: -32601,
+        message: `Method ${module2}.${method} not found`
+      });
+      return;
+    }
+    const { handler, options } = this.rpcMethods.get(module2).get(method);
+    if (options.requireAuth && !ws.userId) {
+      this._sendRpcResponse(ws, id, null, {
+        code: -32e3,
+        message: "Authentication required"
+      });
+      return;
+    }
+    if (options.validateParams && !options.validateParams(params)) {
+      this._sendRpcResponse(ws, id, null, {
+        code: -32602,
+        message: "Invalid params"
+      });
+      return;
+    }
+    try {
+      const context = {
+        userId: ws.userId,
+        ws,
+        sendResponse: (result2) => this._sendRpcResponse(ws, id, result2),
+        sendError: (error) => this._sendRpcResponse(ws, id, null, error)
+      };
+      const result = await handler.call(context, params, context);
+      if (!context.responseSent) {
+        this._sendRpcResponse(ws, id, result);
+      }
+    } catch (error) {
+      console.error(`Error executing RPC method ${module2}.${method}:`, error);
+      this._sendRpcResponse(ws, id, null, {
+        code: -32603,
+        message: error.message || "Internal error"
+      });
+    }
+  }
+  // Отправка ответа на RPC запрос
+  _sendRpcResponse(ws, id, result, error = null) {
+    if (ws.context?.responseSent) return;
+    if (ws.context) ws.context.responseSent = true;
+    const response = {
+      type: "rpc_response",
+      id
+    };
+    if (error) {
+      response.error = {
+        code: error.code || -32603,
+        message: error.message || "Internal error",
+        data: error.data
+      };
+    } else {
+      response.result = result;
+    }
+    try {
+      ws.send(JSON.stringify(response), false);
+    } catch (err) {
+      console.error("Error sending RPC response:", err);
+    }
+  }
+  sendToUserInModule(moduleName, userId, data) {
+    const userIdStr = userId.toString();
+    const sockets = this.userConnections.get(userIdStr);
+    if (!sockets) {
+      console.log(`No sockets found for user ${userIdStr}`);
+      return false;
+    }
+    let sent = false;
+    const message = JSON.stringify(data);
+    for (const ws of sockets) {
+      if (ws.subscriptions.has(moduleName)) {
+        try {
+          const ok = ws.send(message, false);
+          if (!ok) {
+            console.warn("WebSocket backpressure exceeded for user:", userIdStr);
+          } else {
+            sent = true;
+          }
+        } catch (err) {
+          console.warn("Failed to send message to user:", userIdStr, err);
+        }
+      }
+    }
+    return sent;
+  }
+  broadcastToModule(moduleName, data) {
+    const message = JSON.stringify(data);
+    let failedSends = 0;
+    for (const sockets of this.userConnections.values()) {
+      for (const ws of sockets) {
+        if (ws.subscriptions.has(moduleName)) {
+          try {
+            const ok = ws.send(message, false);
+            if (!ok) {
+              failedSends++;
+            }
+          } catch (err) {
+            failedSends++;
+            console.warn("Failed to broadcast message:", err);
+          }
+        }
+      }
+    }
+    if (failedSends > 0) {
+      console.warn(`Failed to send broadcast to ${failedSends} connections due to backpressure or closed sockets`);
+    }
+    return true;
+  }
+  broadcastToModuleWithFilter(moduleName, filterFn, data) {
+    const message = JSON.stringify(data);
+    let failedSends = 0;
+    for (const sockets of this.userConnections.values()) {
+      for (const ws of sockets) {
+        if (!ws.subscriptions.has(moduleName)) continue;
+        if (!filterFn(ws)) continue;
+        try {
+          const ok = ws.send(message, false);
+          if (!ok) {
+            failedSends++;
+          }
+        } catch (err) {
+          failedSends++;
+          console.warn("Failed to send filtered broadcast:", err);
+        }
+      }
+    }
+    if (failedSends > 0) {
+      console.warn(`Failed to send filtered broadcast to ${failedSends} connections due to backpressure or closed sockets`);
+    }
+    return true;
+  }
+  getServer() {
+    return this.app;
+  }
+}
+const initGlobalsPolicies = function initializeDefaultPolicies(abacAccessControl) {
+  abacAccessControl.registerGlobalPolicy("AdminModeratorAccessPolicy", async (context) => {
+    const { user, req } = context;
+    if (!user) {
+      return { allow: true, force: false };
+    }
+    try {
+      const userModel = abacAccessControl.db.user;
+      const userDoc = await userModel.findById(user).populate("roles");
+      let userRoles = [];
+      if (userDoc && userDoc.roles) {
+        context.userDoc = userDoc;
+        userRoles = userDoc.roles.map((role) => typeof role === "string" ? role : role.name || role);
+      }
+      const isAdmin = userRoles.includes("admin");
+      const isModerator = userRoles.includes("moderator");
+      if (isAdmin || isModerator) {
+        if (context.req) {
+          context.req.skipFieldPolicies = true;
+        }
+        return {
+          allow: true,
+          force: true,
+          reason: isAdmin ? "ADMIN_ACCESS_GRANTED" : "MODERATOR_ACCESS_GRANTED"
+        };
+      }
+      return { allow: true, force: false };
+    } catch (error) {
+      console.error("Error in AdminModeratorPolicy:", error);
+      return { allow: true, force: false };
+    }
+  });
+  abacAccessControl.registerGlobalPolicy("PersonalResourceOwnerPolicy", async (context) => {
+    let { user, action, data, currentResource, options } = context;
+    const ObjectId = abacAccessControl.db.mongoose.Types.ObjectId;
+    if (action === "create" && data.owner?.type === "user") {
+      if (data.owner.target === user && data.creator.target === user) {
+        return { allow: true, force: false };
+      } else {
+        return {
+          allow: false,
+          force: false,
+          reason: "UNAUTHORIZED_RESOURCE_CREATION"
+        };
+      }
+    }
+    if (action === "read") {
+      const allowedPublicStatuses = ["published", "active", "featured"];
+      if (!user || currentResource && currentResource.creator && !currentResource.creator.target.equals(new ObjectId(user))) {
+        if (context.req && context.req.query) {
+          if (context.req.query.status) {
+            if (Array.isArray(context.req.query.status)) {
+              for (const queryStatus of context.req.query.status) {
+                if (!allowedPublicStatuses.includes(queryStatus)) {
+                  return {
+                    allow: false,
+                    force: true,
+                    // Стопроцентный запрет для неразрешенных статусов
+                    reason: "UNAUTHORIZED_STATUS_ACCESS"
+                  };
+                }
+              }
+            } else {
+              if (!allowedPublicStatuses.includes(context.req.query.status)) {
+                return {
+                  allow: false,
+                  force: true,
+                  // Стопроцентный запрет для неразрешенных статусов
+                  reason: "UNAUTHORIZED_STATUS_ACCESS"
+                };
+              }
+            }
+          }
+        }
+        if (currentResource && !allowedPublicStatuses.includes(currentResource.status)) {
+          return {
+            allow: false,
+            force: true,
+            // Стопроцентный запрет для неразрешенных статусов
+            reason: "UNAUTHORIZED_RESOURCE_ACCESS"
+          };
+        }
+      }
+      return { allow: true, force: false };
+    }
+    if ((action === "edit" || action === "delete") && currentResource && currentResource.owner?.type === "user") {
+      if (currentResource.creator.target.equals(new ObjectId(user))) {
+        return { allow: true, force: false };
+      } else {
+        return {
+          allow: false,
+          force: false,
+          reason: "NOT_RESOURCE_OWNER"
+        };
+      }
+    }
+    return { allow: true, force: false };
+  });
+  return abacAccessControl;
+};
+const { getInstance } = abac.ABAC;
+function initializeGlobals(app, db, origins, publicPath) {
+  db.log = db.mongoose.models.Log || db.mongoose.model(
+    "Log",
+    new db.mongoose.Schema(
+      {
+        timestamp: { type: Date, default: Date.now },
+        level: String,
+        message: String
+      },
+      { versionKey: false }
+    )
+  );
+  const abac2 = getInstance(db);
+  initGlobalsPolicies(abac2);
+}
+const globals_server = {
+  initialize: initializeGlobals,
+  WebSocketManager
+};
+exports.WebSocketManager = WebSocketManager;
+exports.default = globals_server;
+exports.initialize = initializeGlobals;