@ozdao/martyrs 0.2.585 → 0.2.586

package/dist/{core.websocket-C2FxNmZ1.js → core.websocket-Cl76z2wT.js}

@@ -1,6 +1,7 @@
 import * as cookie from "cookie";
 import jwt from "jsonwebtoken";
 import uWS from "uWebSockets.js";
+import { g as getSessionsService } from "./sessions.service-COcwjd0f.js";
 class WebSocketManager {
   constructor(options = {}) {
     if (options.ssl) {
@@ -24,9 +25,14 @@ class WebSocketManager {
       idleTimeout: 120,
       compression: uWS.SHARED_COMPRESSOR,
       maxBackpressure: 1024 * 1024,
-      // Обработчик аутентификации и апгрейда соединения
+      // Обработчик аутентификации и апгрейда соединения (синхронный - uWS требует)
       upgrade: (res, req, context) => {
         let userId = null;
+        let sessionId = null;
+        let aborted = false;
+        res.onAborted(() => {
+          aborted = true;
+        });
         const headers = {};
         req.forEach((key, value) => {
           headers[key.toLowerCase()] = value;
@@ -41,22 +47,47 @@ class WebSocketManager {
               const token = JSON.parse(decodeURIComponent(cookies.user));
               const decoded = jwt.verify(token.accessToken, process.env.SECRET_KEY);
               userId = decoded._id;
+              sessionId = decoded.session_id;
             }
           }
         } catch (err) {
           console.error("Invalid token:", err);
         }
+        if (aborted) return;
         if (process.env.REQUIRE_AUTH === "true" && !userId) {
           res.writeStatus("401 Unauthorized").end("Authentication required");
           return;
         }
-        const userData = { userId };
+        const userData = { userId, sessionId, needsSessionValidation: !!sessionId };
         res.upgrade(userData, secWebSocketKey, secWebSocketProtocol, secWebSocketExtensions, context);
       },
-      // Обработчик открытия соединения
-      open: (ws) => {
-        ws.userId = ws.getUserData().userId;
+      // Обработчик открытия соединения (async безопасен здесь)
+      open: async (ws) => {
+        const userData = ws.getUserData();
+        ws.userId = userData.userId;
+        ws.sessionId = userData.sessionId;
         ws.subscriptions = /* @__PURE__ */ new Set();
+        ws.lastSeenAt = Date.now();
+        if (userData.needsSessionValidation) {
+          try {
+            const sessionsService = getSessionsService();
+            const session = await sessionsService.validateSession({
+              sessionId: userData.sessionId,
+              userId: userData.userId
+            });
+            if (!session) {
+              ws.end(4001, "Session expired or revoked");
+              return;
+            }
+            sessionsService.touchSession(userData.sessionId).catch((err) => {
+              console.error("Error updating session lastSeenAt:", err);
+            });
+          } catch (err) {
+            console.error("Session validation error:", err);
+            ws.end(4002, "Session validation failed");
+            return;
+          }
+        }
         if (ws.userId) {
           this._trackUserConnection(ws.userId, ws);
         } else {
@@ -82,6 +113,11 @@ class WebSocketManager {
               await this._handleRpcCall(ws, msg);
               return;
             }
+            if (msg.type === "ping") {
+              ws.lastSeenAt = Date.now();
+              ws.send(JSON.stringify({ type: "pong" }), false);
+              return;
+            }
             const moduleName = msg.module;
             console.log(`[WebSocket Server] Message from ${ws.userId || "anonymous"}, module: ${moduleName}, type: ${msg.type}, subscriptions:`, Array.from(ws.subscriptions));
             if (moduleName && this.modules.has(moduleName)) {

package/dist/{crud-q1ye5IhV.js → crud-DpOXTZep.js}

@@ -1,4 +1,4 @@
-import { m as middlewareFactory } from "./authJwt-J1csaMWA.js";
+import { m as middlewareFactory } from "./authJwt-DKbMMjw0.js";
 import { q as queryProcessorCore } from "./queryProcessor-C_5Iipam.js";
 import { O as ObserverNamespaced } from "./core.observer-MZsqaE6F.js";
 import { L as LoggerNamespaced } from "./abac-BPl9Bmf9.js";

package/dist/events.server.js

@@ -2,11 +2,11 @@ import { q as queryProcessorCore } from "./queryProcessor-C_5Iipam.js";
 import { c as createFriendlyURL, a as applyMetadataSchema } from "./metadata.schema-CIRR_WQ-.js";
 import Stripe from "stripe";
 import { Types } from "mongoose";
-import { c as controllerFactory } from "./tickets.controller-B7r0mK-5.js";
+import { c as controllerFactory } from "./tickets.controller-DdF85W-i.js";
 import { a as applyCommonSchema } from "./common.schema-DswiUXKB.js";
 import { a as applyEngagementSchema } from "./engagement.schema-fh6W1fb_.js";
 import { a as applyOwnershipSchema } from "./ownership.schema-fwwDf_e5.js";
-import { m as middlewareIndexFactory$1 } from "./index-_Edcmck_.js";
+import { m as middlewareIndexFactory$1 } from "./index-kvBwwb0w.js";
 import { c as coreabac } from "./abac-BPl9Bmf9.js";
 class serviceIntegrations {
   async createProduct(event) {

package/dist/files.server.js

@@ -1,4 +1,4 @@
-import { m as middlewareIndexFactory$1 } from "./index-_Edcmck_.js";
+import { m as middlewareIndexFactory$1 } from "./index-kvBwwb0w.js";
 import busboy from "busboy";
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";

package/dist/gallery.server.js

@@ -3,7 +3,7 @@ import path from "path";
 import { a as applyCommonSchema } from "./common.schema-DswiUXKB.js";
 import { a as applyEngagementSchema } from "./engagement.schema-fh6W1fb_.js";
 import { a as applyOwnershipSchema } from "./ownership.schema-fwwDf_e5.js";
-import { m as middlewareIndexFactory } from "./index-_Edcmck_.js";
+import { m as middlewareIndexFactory } from "./index-kvBwwb0w.js";
 const controllerFactory = (db) => {
   const Photo = db.photo;
   const read = async (req, res) => {

package/dist/index-kvBwwb0w.js

@@ -0,0 +1,427 @@
+import { m as middlewareFactory$5 } from "./authJwt-DKbMMjw0.js";
+import crypto from "crypto";
+import * as mongodb from "mongodb";
+import { m as mailing } from "./mailing-DT7nbNjZ.js";
+const middlewareFactory$4 = () => {
+  const verifySecret = (method, endpoint, secret) => async (req, res, next) => {
+    const requestSignature = req.headers.signature;
+    const signature = crypto.createHmac("sha256", secret).update(method + endpoint).digest("hex");
+    if (signature === requestSignature) {
+      return next();
+    }
+    res.status(403).send("Forbidden");
+  };
+  return { verifySecret };
+};
+const middlewareFactory$3 = (db) => {
+  const User = db.user;
+  db.role;
+  const checkDuplicateUsernameOrEmail = async (req, res, next) => {
+    const { type, email, phone } = req.body;
+    let query;
+    if (type === "phone" && phone) {
+      query = { phone };
+    }
+    if (type === "email" && email) {
+      query = { email };
+    }
+    try {
+      const user = await User.findOne(query).exec();
+      if (user) {
+        console.log(`USER_ALREADY_REGISTERED`);
+        res.status(400).send({ errorCode: "USER_ALREADY_REGISTERED" });
+        return;
+      }
+      next();
+    } catch (err) {
+      console.log(err);
+      res.status(500).send({ message: err.message });
+    }
+  };
+  const checkRolesExisted = (req, res, next) => {
+    next();
+  };
+  return {
+    checkDuplicateUsernameOrEmail,
+    checkRolesExisted
+  };
+};
+const middlewareFactory$2 = (db) => {
+  const User = db.user;
+  db.role;
+  const checkOwnership = (req, res, next) => {
+    if (!req.userId || req.userId !== req.params._id) {
+      return res.status(403).json({ errorCode: "FORBIDDEN", message: "Cannot modify other users" });
+    }
+    next();
+  };
+  const checkDuplicateUsername = async (req, res, next) => {
+    const { username } = req.body;
+    if (!username) {
+      return next();
+    }
+    try {
+      const user = await User.findOne({
+        username,
+        _id: { $ne: req.body._id }
+        // Исключаем текущего пользователя из поиска
+      });
+      if (user) {
+        console.log(`USERNAME_ALREADY_USED`);
+        res.status(400).send({ errorCode: "USERNAME_ALREADY_USED" });
+        return;
+      }
+      next();
+    } catch (err) {
+      console.log(err);
+      res.status(500).send({ message: err.message });
+    }
+  };
+  const checkDuplicateEmail = async (req, res, next) => {
+    const { email } = req.body;
+    if (!email) {
+      return next();
+    }
+    try {
+      const user = await User.findOne({
+        email,
+        _id: { $ne: req.params._id }
+      });
+      if (user) {
+        return res.status(400).json({ errorCode: "EMAIL_ALREADY_USED" });
+      }
+      next();
+    } catch (err) {
+      res.status(500).send({ message: err.message });
+    }
+  };
+  const checkDuplicatePhone = async (req, res, next) => {
+    const { phone } = req.body;
+    if (!phone) {
+      return next();
+    }
+    try {
+      const user = await User.findOne({
+        phone,
+        _id: { $ne: req.params._id }
+      });
+      if (user) {
+        return res.status(400).json({ errorCode: "PHONE_ALREADY_USED" });
+      }
+      next();
+    } catch (err) {
+      res.status(500).send({ message: err.message });
+    }
+  };
+  const checkUserExist = async (req, res, next) => {
+    const { type, identifier } = req.body;
+    if (!type || !identifier) {
+      return res.status(400).json({ errorCode: "MISSING_IDENTIFIER" });
+    }
+    const query = type === "phone" ? { phone: identifier } : { email: identifier };
+    try {
+      const user = await User.findOne(query).exec();
+      if (!user) {
+        return res.status(400).json({ errorCode: "USER_NOT_REGISTERED_YET" });
+      }
+      next();
+    } catch (err) {
+      res.status(500).send({ message: err.message });
+    }
+  };
+  return {
+    checkOwnership,
+    checkDuplicateUsername,
+    checkDuplicateEmail,
+    checkDuplicatePhone,
+    checkUserExist
+  };
+};
+const { ObjectId } = mongodb;
+const middlewareFactory$1 = (db) => {
+  const User = db.user;
+  const Invite = db.invite;
+  const Membership = db.membership;
+  const checkInviteExist = async (req, res, next) => {
+    for (let invite of req.body.invites) {
+      let query;
+      if (invite.contact.includes("@")) {
+        query = { invitedEmail: invite.contact };
+      } else {
+        query = { invitedPhone: invite.contact };
+      }
+      query["owner.target"] = req.body.owner.target;
+      const userInvite = await Invite.findOne(query).exec();
+      if (userInvite) {
+        console.log(userInvite);
+        res.status(400).send({ message: "Инвайт c таким email или телефоном уже создан!" });
+        return;
+      }
+    }
+    next();
+  };
+  const checkUsersExist = async (req, res, next) => {
+    for (let invite of req.body.invites) {
+      let query;
+      if (invite.contact.includes("@")) {
+        query = { email: invite.contact };
+      } else {
+        query = { phone: invite.contact };
+      }
+      const user = await User.findOne(query).exec();
+      console.log(req.params);
+      if (user) {
+        const membership = await Membership.findOne({
+          user: new ObjectId(user._id),
+          "owner.target": req.body.owner.target
+        }).exec();
+        if (membership) {
+          console.log(membership);
+          res.status(400).send({
+            message: "Пользователь с таким email или телефоном уже добавлен в организацию!"
+          });
+          return;
+        }
+      }
+    }
+    next();
+  };
+  return {
+    checkInviteExist,
+    checkUsersExist
+  };
+};
+const { sendEmail, sendSms } = mailing;
+const RATE_LIMIT_SECONDS = 30;
+const MAX_ATTEMPTS = 3;
+const generateChallengeId = () => crypto.randomBytes(32).toString("hex");
+let instance = null;
+function initOtpService(db) {
+  const Otp = db.otp;
+  async function sendOtp({ identifier, type, purpose, target = null }) {
+    const existingOtp = await Otp.findOne({ identifier, purpose }).sort({ createdAt: -1 });
+    if (existingOtp) {
+      const secondsSinceCreated = (Date.now() - existingOtp.createdAt.getTime()) / 1e3;
+      if (secondsSinceCreated < RATE_LIMIT_SECONDS) {
+        return {
+          errorCode: "RATE_LIMITED",
+          status: 429,
+          retryAfter: Math.ceil(RATE_LIMIT_SECONDS - secondsSinceCreated)
+        };
+      }
+    }
+    if (target) {
+      await Otp.updateMany(
+        { target: new db.mongoose.Types.ObjectId(target), purpose, invalidatedAt: null, verifiedAt: null },
+        { invalidatedAt: /* @__PURE__ */ new Date() }
+      );
+    } else if (identifier) {
+      await Otp.updateMany(
+        { identifier, purpose, invalidatedAt: null, verifiedAt: null },
+        { invalidatedAt: /* @__PURE__ */ new Date() }
+      );
+    }
+    const code = String(crypto.randomInt(1e3, 1e4));
+    const challengeId = generateChallengeId();
+    let sent = false;
+    if (type === "email") {
+      sent = await sendEmail(
+        identifier,
+        `${process.env.APP_NAME} Verification Code`,
+        `Your ${process.env.APP_NAME} verification code is ${code}`
+      );
+    } else if (type === "phone") {
+      sent = await sendSms(identifier, `Your ${process.env.APP_NAME} verification code: ${code}`);
+    }
+    if (!sent) {
+      return { errorCode: "SEND_FAILED", status: 500 };
+    }
+    await Otp.create({ identifier, code, type, purpose, target: target ? new db.mongoose.Types.ObjectId(target) : null, challengeId });
+    return { success: true, challengeId };
+  }
+  async function verifyOtp({ challengeId, code, target = null }) {
+    const otp = await Otp.findOneAndUpdate(
+      {
+        challengeId,
+        verifiedAt: null,
+        invalidatedAt: null,
+        createdAt: { $gt: new Date(Date.now() - 10 * 60 * 1e3) },
+        attempts: { $lt: MAX_ATTEMPTS },
+        ...target && { target: new db.mongoose.Types.ObjectId(target) }
+      },
+      { $inc: { attempts: 1 } },
+      { new: true }
+    );
+    if (!otp) {
+      return { errorCode: "CODE_NOT_FOUND" };
+    }
+    if (otp.code !== code) {
+      return { errorCode: "INVALID_CODE", attemptsLeft: MAX_ATTEMPTS - otp.attempts };
+    }
+    const consumed = await Otp.findOneAndUpdate(
+      { _id: otp._id, verifiedAt: null, attempts: { $lte: MAX_ATTEMPTS } },
+      { verifiedAt: /* @__PURE__ */ new Date() }
+    );
+    if (!consumed) {
+      return { errorCode: "ALREADY_USED" };
+    }
+    return { valid: true };
+  }
+  instance = { sendOtp, verifyOtp };
+  return instance;
+}
+function getOtpService() {
+  if (!instance) {
+    throw new Error("OTP service not initialized. Call initOtpService(db) first.");
+  }
+  return instance;
+}
+function maskIdentifier(identifier) {
+  if (identifier.includes("@")) {
+    const [name, domain] = identifier.split("@");
+    return `${name[0]}${"*".repeat(Math.max(name.length - 2, 1))}${name.slice(-1)}@${domain}`;
+  }
+  return `${identifier.slice(0, 2)}${"*".repeat(identifier.length - 4)}${identifier.slice(-2)}`;
+}
+const middlewareFactory = () => {
+  const { sendOtp, verifyOtp } = getOtpService();
+  const stepUp = (purpose, getCredentials) => {
+    return async (req, res, next) => {
+      const { identifier, type, target = null } = getCredentials(req);
+      if (!identifier || !type) {
+        return res.status(400).json({ errorCode: "IDENTIFIER_REQUIRED" });
+      }
+      const { challengeId, otp } = req.body;
+      if (challengeId && otp) {
+        const result2 = await verifyOtp({ challengeId, code: otp, target });
+        if (result2.errorCode) {
+          return res.status(result2.status || 400).json({ errorCode: result2.errorCode, attemptsLeft: result2.attemptsLeft });
+        }
+        return next();
+      }
+      const result = await sendOtp({ identifier, type, purpose, target });
+      if (result.errorCode) {
+        return res.status(result.status || 500).json({ errorCode: result.errorCode, retryAfter: result.retryAfter });
+      }
+      return res.status(200).json({
+        status: "requires_otp",
+        challenge: {
+          challengeId: result.challengeId,
+          identifier: maskIdentifier(identifier)
+        }
+      });
+    };
+  };
+  const dualVerify = (field) => {
+    return async (req, res, next) => {
+      const target = req.userId;
+      const targetId = req.params._id;
+      if (target !== targetId) {
+        return res.status(403).json({ errorCode: "FORBIDDEN" });
+      }
+      const oldContact = req.user[field];
+      const newContact = req.body[field];
+      if (!newContact) {
+        return res.status(400).json({ errorCode: "MISSING_FIELD", field });
+      }
+      if (!oldContact) {
+        const { challengeId, otp } = req.body;
+        if (challengeId && otp) {
+          const result2 = await verifyOtp({ challengeId, code: otp, target });
+          if (result2.errorCode) {
+            return res.status(result2.status || 400).json({ errorCode: result2.errorCode, attemptsLeft: result2.attemptsLeft });
+          }
+          return next();
+        }
+        const result = await sendOtp({ identifier: newContact, type: field, purpose: `add-${field}`, target });
+        if (result.errorCode) {
+          return res.status(result.status || 500).json({ errorCode: result.errorCode, retryAfter: result.retryAfter });
+        }
+        return res.status(200).json({
+          status: "requires_otp",
+          challenge: {
+            challengeId: result.challengeId,
+            identifier: maskIdentifier(newContact)
+          }
+        });
+      }
+      const hasChallenges = req.body.challenges && Array.isArray(req.body.challenges) && req.body.challenges.length > 0;
+      if (!hasChallenges) {
+        const oldResult = await sendOtp({ identifier: oldContact, type: field, purpose: `change-${field}-old`, target });
+        if (oldResult.errorCode) {
+          return res.status(oldResult.status || 500).json({
+            errorCode: oldResult.errorCode,
+            retryAfter: oldResult.retryAfter,
+            field: "old"
+          });
+        }
+        const newResult = await sendOtp({ identifier: newContact, type: field, purpose: `change-${field}-new`, target });
+        if (newResult.errorCode) {
+          return res.status(newResult.status || 500).json({
+            errorCode: newResult.errorCode,
+            retryAfter: newResult.retryAfter,
+            field: "new"
+          });
+        }
+        return res.json({
+          status: "requires_otp",
+          mode: "dual",
+          challenges: [
+            { challengeId: oldResult.challengeId, identifier: maskIdentifier(oldContact), label: "old" },
+            { challengeId: newResult.challengeId, identifier: maskIdentifier(newContact), label: "new" }
+          ]
+        });
+      }
+      const { challenges } = req.body;
+      if (!Array.isArray(challenges) || challenges.length !== 2) {
+        return res.status(400).json({ errorCode: "INVALID_CHALLENGES" });
+      }
+      for (const c of challenges) {
+        if (typeof c.challengeId !== "string" || c.challengeId.length !== 64) {
+          return res.status(400).json({ errorCode: "INVALID_CHALLENGE_ID" });
+        }
+        if (typeof c.code !== "string" || c.code.length !== 4) {
+          return res.status(400).json({ errorCode: "INVALID_CODE_FORMAT" });
+        }
+      }
+      const oldValid = await verifyOtp({ challengeId: challenges[0].challengeId, code: challenges[0].code, target });
+      if (oldValid.errorCode) {
+        return res.status(oldValid.status || 400).json({
+          errorCode: oldValid.errorCode,
+          field: "old",
+          attemptsLeft: oldValid.attemptsLeft
+        });
+      }
+      const newValid = await verifyOtp({ challengeId: challenges[1].challengeId, code: challenges[1].code, target });
+      if (newValid.errorCode) {
+        return res.status(newValid.status || 400).json({
+          errorCode: newValid.errorCode,
+          field: "new",
+          attemptsLeft: newValid.attemptsLeft
+        });
+      }
+      next();
+    };
+  };
+  return { stepUp, dualVerify };
+};
+const middlewareIndexFactory = (db) => {
+  const authJwt = middlewareFactory$5(db);
+  const authSecret = middlewareFactory$4();
+  const verifySignUp = middlewareFactory$3(db);
+  const verifyUser = middlewareFactory$2(db);
+  const verifyInvites = middlewareFactory$1(db);
+  const otp = middlewareFactory();
+  return {
+    authJwt,
+    authSecret,
+    verifySignUp,
+    verifyUser,
+    verifyInvites,
+    otp
+  };
+};
+export {
+  initOtpService as i,
+  middlewareIndexFactory as m
+};

package/dist/inventory.server.js

@@ -1,11 +1,11 @@
 import { a as applyOwnershipSchema } from "./ownership.schema-fwwDf_e5.js";
-import { m as middlewareFactory } from "./authJwt-J1csaMWA.js";
+import { m as middlewareFactory } from "./authJwt-DKbMMjw0.js";
 import { L as LoggerNamespaced, c as coreabac } from "./abac-BPl9Bmf9.js";
 import { q as queryProcessorCore } from "./queryProcessor-C_5Iipam.js";
 import { C as CacheNamespaced } from "./core.cache-DALYFDdy.js";
 import { O as ObserverNamespaced } from "./core.observer-MZsqaE6F.js";
 import { a as Validator, V as Verifier } from "./core.verifier-gPPX_jhf.js";
-import { C as CRUD } from "./crud-q1ye5IhV.js";
+import { C as CRUD } from "./crud-DpOXTZep.js";
 const StockAdjustmentModel = (db) => {
   const StockAdjustmentSchema = new db.mongoose.Schema({
     product: {

package/dist/{mailing-DuEFRsa3.js → mailing-DT7nbNjZ.js}

@@ -41,12 +41,25 @@ async function sendEmail(to, subject, text, files = []) {
   }
 }
 async function sendSms(phone, message) {
-  const sessionUrl = `https://api.sms.to/sms/send?api_key=${process.env.SMS_API_KEY}&to=${phone}&message=${encodeURIComponent(message)}&sender_id=${encodeURIComponent(process.env.APP_NAME)}`;
   try {
-    const response = await axios.get(sessionUrl);
+    const response = await axios.post(
+      "https://api.brevo.com/v3/transactionalSMS/send",
+      {
+        recipient: phone,
+        sender: process.env.APP_NAME?.slice(0, 11) || "App",
+        content: message,
+        type: "transactional"
+      },
+      {
+        headers: {
+          "api-key": process.env.BREVO_API_KEY,
+          "Content-Type": "application/json"
+        }
+      }
+    );
     return true;
   } catch (error) {
-    console.log(error);
+    console.error("SMS send failed");
     return false;
   }
 }