@raclettejs/core 0.1.19 → 0.1.20

package/services/backend/src/modules/authentication/index.ts

@@ -3,6 +3,214 @@ import jwt from "@fastify/jwt"
 import fastifyPlugin from "fastify-plugin"
 import type { User } from "@shared/types"
 import configService from "@c/config/configService"
+import type { WorkSessionDoc } from "@/corePlugins/raclette__core/backend/datatypes/workSession/workSession.schema"
+import { ForbiddenError } from "@/utils/errors"
+
+const WORK_SESSION_COLLECTION = "raclette__core-worksession"
+const WORK_SESSION_HEADER = "x-work-session-id"
+
+/**
+ * Middleware: allow either authenticated user (JWT) or valid work session (X-Work-Session-Id).
+ * When using this, the route states that it handles permission checks itself (e.g. compare req.workSession with query).
+ * - If JWT present and valid: sets req.user (normal auth).
+ * - If no/invalid JWT but X-Work-Session-Id present: loads work session, validates (active, not expired),
+ *   optionally checks that workSession.pluginData includes the given pluginKey, then sets req.workSession and req.isWorkSession.
+ */
+export const authenticatedOrWorksession = async (
+  req: FastifyRequest,
+  res: FastifyReply,
+  fastify: FastifyInstance,
+  pluginKey: string,
+) => {
+  fastify.log.debug(
+    `[Auth] authenticatedOrWorksession: ${pluginKey} ${req.method} ${req.url}`,
+  )
+
+  const { requireAuthentication } = configService.getConfig()?.global ?? {
+    requireAuthentication: true,
+  }
+  const isAdminTagRequired = configService.isAdminTagRequired()
+
+  if (!requireAuthentication) {
+    const mockUser: Partial<User> = { _id: "SYSTEM" }
+    req.user = mockUser as User
+    return
+  }
+
+  // 1) Try JWT first
+  try {
+    await req.jwtVerify()
+    const payload = req.user as {
+      type?: string
+      sessionId?: string
+      _id?: string
+    }
+    fastify.log.debug(
+      `[Auth] JWT verified, payload type: ${payload.type || "user"}, sessionId: ${payload.sessionId || "none"}, _id: ${payload._id || "none"}`,
+    )
+
+    if (payload.type === "workSession" && payload.sessionId) {
+      fastify.log.info(
+        `[Auth] Work session JWT detected, sessionId: ${payload.sessionId}, pluginKey: ${pluginKey}`,
+      )
+      // Work session JWT: load session and validate
+      const workSession = await loadAndValidateWorkSession(
+        fastify,
+        payload.sessionId,
+        pluginKey,
+      )
+      if (!workSession) {
+        fastify.log.warn(
+          `[Auth] Work session validation failed for sessionId: ${payload.sessionId}`,
+        )
+        return res
+          .status(401)
+          .send({ message: "Invalid or expired work session" })
+      }
+      fastify.log.info(
+        `[Auth] Work session authenticated: sessionId=${payload.sessionId}, pluginKey=${pluginKey}`,
+      )
+      req.workSession = workSession
+      req.isWorkSession = true
+
+      // Set projectId from workSession.project if available
+      if (workSession.project) {
+        req.projectId = workSession.project
+        fastify.log.debug(`[Auth] Work session projectId: ${req.projectId}`)
+      }
+      return
+    }
+    // Normal user JWT: fetch user and set req.user
+    fastify.log.debug(
+      `[Auth] Normal user JWT, fetching user: ${(req.user as any)?._id}`,
+    )
+    const { _id } = req.user
+    const adminTag = await fastify.database
+      .collection("raclette__core-tag")
+      .findOne({ title: "ADMIN", locked: true, type: "system" })
+    let isAdmin = false
+    const user = await fastify.database
+      .collection("raclette__core-user")
+      .findOne({ _id }, { projection: { password: 0, resetKey: 0 } })
+    if (user && user.tags && adminTag) {
+      user.tags.forEach((tag: string) => {
+        if (adminTag._id === tag) isAdmin = true
+      })
+    }
+    if (isAdminTagRequired && !isAdmin) {
+      fastify.log.error("User not allowed in workbench")
+      return res.status(403).send({ message: "User not allowed in workbench" })
+    }
+    if (isAdmin) user.isAdmin = true
+    if (!user) {
+      fastify.log.error("User not found")
+      return res.status(401).send({ message: "User not found" })
+    }
+    const account = await fastify.database
+      .collection("raclette__core-account")
+      .findOne({ _id: user.account })
+    user.account = account
+    req.user = user
+    // Set projectId from user's lastProjectId (for requestData.project in payload wrappers)
+    if (user.ux?.lastProjectId) {
+      req.projectId = user.ux.lastProjectId
+      fastify.log.debug(`[Auth] User projectId: ${req.projectId}`)
+    }
+    return
+  } catch (error: any) {
+    // JWT missing or invalid: try work session via header
+    fastify.log.debug(
+      `[Auth] JWT verification failed: ${error.message}, trying work session header`,
+    )
+  }
+
+  // 2) Try X-Work-Session-Id header
+  const sessionId = req.headers[WORK_SESSION_HEADER] as string | undefined
+  if (sessionId) {
+    const workSession = await loadAndValidateWorkSession(
+      fastify,
+      sessionId,
+      pluginKey,
+    )
+    if (workSession) {
+      req.workSession = workSession
+      req.isWorkSession = true
+
+      // Set projectId from workSession.project if available
+      // workaround for how projects/spaces are currently handled - tbd
+      if (workSession.project) {
+        req.projectId = workSession.project
+      }
+      return
+    } else {
+      fastify.log.warn(
+        `[Auth] Work session validation failed for header sessionId: ${sessionId}`,
+      )
+    }
+  }
+
+  return res.status(401).send({ message: "Authentication required" })
+}
+
+async function loadAndValidateWorkSession(
+  fastify: FastifyInstance,
+  sessionId: string,
+  pluginKey: string,
+): Promise<WorkSessionDoc | null> {
+  fastify.log.debug(
+    `[WorkSession Auth] Loading and validating work session: sessionId=${sessionId}, pluginKey=${pluginKey}`,
+  )
+
+  if (!sessionId || typeof sessionId !== "string") {
+    fastify.log.warn(`[WorkSession Auth] Invalid sessionId: ${sessionId}`)
+    return null
+  }
+
+  fastify.log.debug(`[WorkSession Auth] Querying database for work session`)
+  const doc = await fastify.database
+    .collection(WORK_SESSION_COLLECTION)
+    .findOne({ _id: sessionId })
+
+  if (!doc) {
+    fastify.log.warn(`[WorkSession Auth] Work session not found: ${sessionId}`)
+    return null
+  }
+
+  if (!doc.isActive) {
+    fastify.log.warn(
+      `[WorkSession Auth] Work session is not active: ${sessionId}`,
+    )
+    return null
+  }
+
+  const expiry = doc.expiryDate ? new Date(doc.expiryDate) : null
+  if (expiry && expiry.getTime() < Date.now()) {
+    fastify.log.warn(
+      `[WorkSession Auth] Work session expired: ${sessionId}, expiryDate: ${expiry.toISOString()}`,
+    )
+    return null
+  }
+
+  // Check that this plugin is part of the work session (pluginData keys are "pluginKey:widgetName")
+  const pluginData = doc.pluginData || {}
+  const pluginKeys = Object.keys(pluginData)
+
+  const hasPlugin =
+    pluginKeys.some((k) => k.startsWith(pluginKey + ":")) ||
+    Object.prototype.hasOwnProperty.call(pluginData, pluginKey)
+
+  if (!hasPlugin) {
+    fastify.log.warn(
+      `[WorkSession Auth] Plugin ${pluginKey} not found in work session pluginData: ${pluginKeys.join(", ")}`,
+    )
+    return null
+  }
+
+  fastify.log.info(
+    `[WorkSession Auth] Work session validated successfully: sessionId=${sessionId}, pluginKey=${pluginKey}`,
+  )
+  return doc as WorkSessionDoc
+}
 
 export const authenticate = async (
   req: FastifyRequest,
@@ -20,12 +228,18 @@ export const authenticate = async (
         _id: "SYSTEM",
       }
 
-      req.user = mockUser
+      req.user = mockUser as User
       return
     }
 
     try {
       await req.jwtVerify()
+      const payload = req.user as { type?: string }
+      if (payload.type === "workSession") {
+        return res
+          .status(401)
+          .send({ message: "Work session token not allowed on this route" })
+      }
       // fetch current user data from the db
       const { _id } = req.user
       const adminTag = await fastify.database
@@ -73,17 +287,42 @@ export const authenticate = async (
     }
   }
 }
-
+export const checkPermissions = async (
+  req: FastifyRequest,
+  res: FastifyReply,
+  fastify: FastifyInstance,
+  permissions: Array<String>,
+) => {
+  {
+    try {
+      if (!permissions.length) {
+        fastify.log.error("No permissions given for permission check")
+        throw new Error("No Permissions")
+      }
+      // TODO implement proper Permission lookup here
+      permissions.forEach((permissionStr) => {
+        if (permissionStr === "user.isAdmin") {
+          if (!req.user.isAdmin) {
+            throw new ForbiddenError("User not permitted to action")
+          }
+        }
+      })
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return res.send(error.message)
+    }
+  }
+}
 export default fastifyPlugin(async (fastify: FastifyInstance, opts = {}) => {
   // provide some sensible options
   const defaults = {
     secret: false,
     decode: { complete: true },
     sign: {
-      iss: "api.projectjournal.pacifico.info",
+      iss: "api.raclettejs.info",
       expiresIn: "30d",
     },
-    verify: { allowedIss: "api.projectjournal.pacifico.info" },
+    verify: { allowedIss: "api.raclettejs.info" },
   }
 
   // merge proved opts with defaults
@@ -96,4 +335,16 @@ export default fastifyPlugin(async (fastify: FastifyInstance, opts = {}) => {
   fastify.decorate("authenticate", (req, res) => {
     return authenticate(req, res, fastify)
   })
+
+  fastify.decorate(
+    "authenticatedOrWorksession",
+    (pluginKey: string) => (req: FastifyRequest, res: FastifyReply) =>
+      authenticatedOrWorksession(req, res, fastify, pluginKey),
+  )
+  fastify.decorate(
+    "checkPermissions",
+    (permissionsArr: Array<String>) =>
+      (req: FastifyRequest, res: FastifyReply) =>
+        checkPermissions(req, res, fastify, permissionsArr),
+  )
 })

package/services/backend/src/modules/hooks/rate-limiter.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from "fastify"
+import fastifyPlugin from "fastify-plugin"
+import rateLimit from "@fastify/rate-limit"
+import configService from "@c/config/configService"
+
+export default fastifyPlugin(async (fastify: FastifyInstance) => {
+  const opts = configService.getFastifyRateLimits()
+  fastify.log.info("Fastify Ratelimiter with opts " + JSON.stringify(opts))
+  await fastify.register(rateLimit, opts)
+  fastify.setNotFoundHandler(
+    {
+      preHandler: fastify.rateLimit({
+        max: 4,
+        timeWindow: 500,
+      }),
+    },
+    function (request, reply) {
+      reply.code(404).send({ why: "you do dat?" })
+    },
+  )
+})

package/services/backend/src/types/custom-fastify.d.ts

@@ -12,11 +12,22 @@ import { HttpService } from "../core/http/httpTypes"
 import { UserDoc } from "@c/user/user.schema"
 import { FrontendPayloadRequestData } from "@/utils/request.utils"
 import { FastifyRequest, FastifyReply } from "fastify"
+import type RateLimit from "@fastify/rate-limit"
+import type { RequestWorkSession } from "@/corePlugins/raclette__core/backend/datatypes/workSession/workSession.schema"
+
+export type { RequestWorkSession }
 
 declare module "fastify" {
   interface FastifyInstance {
     database: Connection
+    rateLimit: RateLimit
     authenticate: (req: FastifyRequest, res: FastifyReply) => Promise<void>
+    authenticatedOrWorksession: (
+      pluginKey: string,
+    ) => (req: FastifyRequest, res: FastifyReply) => Promise<void>
+    checkPermissions: (
+      permissions: string,
+    ) => (req: FastifyRequest, res: FastifyReply) => Promise<void>
     wss: Socket<DefaultEventsMap, DefaultEventsMap, DefaultEventsMap, any>
     eventbus: EventEmitter
     cache: ValkeyService
@@ -32,6 +43,12 @@ declare module "fastify" {
     database: Connection
     user: UserDoc
     requestParams: FrontendPayloadRequestData
+    /** Set by authenticatedOrWorksession when request is via work session */
+    workSession?: RequestWorkSession
+    /** Set by authenticatedOrWorksession when request is via work session */
+    isWorkSession?: boolean
+    /** Project ID from user (lastProjectId) or workSession.project */
+    projectId?: string
   }
 
   interface RouteOptions {

package/services/backend/src/utils/request.utils.ts

@@ -11,13 +11,16 @@ export const createRequestParams = (
   req: RequestWithCommonHeaders,
   config: FastifyContextConfig,
 ): FrontendPayloadRequestData => {
+  // Get project from req.projectId (set by auth middleware), header, or empty string
+  const projectId = (req as any).projectId ?? req.headers["current-project"] ?? ""
+  
   const requestParams = {
     appSessionId: req.headers["app-session-id"] ?? "",
     appRequestCode: req.headers["app-request-code"] ?? "",
     requestId: req.id ?? "",
     type: "",
     broadcast: req.headers["app-broadcast-channels"] ?? false,
-    project: req.headers["current-project"] ?? "",
+    project: projectId,
     userId: req.user?.id,
     options: {},
     ...config,

package/services/backend/types/index.d.ts

@@ -1 +1,15 @@
-export * from "../src/types"
+export { 
+    RacletteAppMode,
+    RacletteConfig,
+    WorkbenchConfig,
+    ServiceFrontendConfig,
+    ServiceBackendConfig,
+    EnvironmentVariables,
+    VolumeDefinition,
+    CacheConfig,
+    SocketConfig,
+    RacletteModule,
+    PluginMetadata,
+    PackageSourceConfig,
+    PackageTargetsTuple,
+    PackageTarget } from "../src/types"

package/services/backend/yarn.lock

@@ -268,6 +268,15 @@
     "@fastify/forwarded" "^3.0.0"
     ipaddr.js "^2.1.0"
 
+"@fastify/rate-limit@10.3.0":
+  version "10.3.0"
+  resolved "https://registry.yarnpkg.com/@fastify/rate-limit/-/rate-limit-10.3.0.tgz#3cf6a56c0e3dd18fc0a56727675d7ba1d9a9bd7b"
+  integrity sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==
+  dependencies:
+    "@lukeed/ms" "^2.0.2"
+    fastify-plugin "^5.0.0"
+    toad-cache "^3.7.0"
+
 "@fastify/schedule@6.0.0":
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/@fastify/schedule/-/schedule-6.0.0.tgz#0a82d2c49e9f2411b9aee312c5eb178b1dceb3fc"
@@ -760,10 +769,10 @@ avvio@^9.0.0:
     "@fastify/error" "^4.0.0"
     fastq "^1.17.1"
 
-axios@1.12.2:
-  version "1.12.2"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.12.2.tgz#6c307390136cf7a2278d09cec63b136dfc6e6da7"
-  integrity sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==
+axios@1.13.2:
+  version "1.13.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.13.2.tgz#9ada120b7b5ab24509553ec3e40123521117f687"
+  integrity sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==
   dependencies:
     follow-redirects "^1.15.6"
     form-data "^4.0.4"

package/services/frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" href="/favicon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>raclette - Come in and have some Cheese</title>
+    <title>racletteJS - Come in and have some Cheese</title>
     <link rel="manifest" href="./manifest.json" accept-version="*" />
     <script>
       window.configs = false

package/services/frontend/src/core/lib/configService.ts

@@ -59,7 +59,7 @@ export class ConfigService {
   public getConfig() {
     if (!this.config) {
       if (!cachedConfig) {
-        console.error("Failed to load Raclette configuration")
+        console.error("Failed to load racletteJS configuration")
       }
       this.config = cachedConfig
     }

package/services/frontend/src/core/lib/dataHelper.ts

@@ -389,7 +389,7 @@ const addItemDefaulAttributes = (item, user) => {
  * Will store the current time to the localStorage to determine the last time we had contact with the backend
  */
 const rememberLastDataUpdateRetrieval = (projectId) => {
-  const currentProject = projectId || globalApplicationName
+  const currentProject = projectId
 
   log.api("rememberLastDataUpdateRetrieval", currentProject)
   localStorage.setItem(`lastUpdate_${currentProject}`, new Date().toISOString())

package/services/frontend/src/core/lib/eggs/snow.ts

@@ -1,5 +1,6 @@
 export default () => {
-  let snowflakes_count = 100
+  // Reduced default count for better performance
+  let snowflakes_count = 20
 
   if (typeof total !== "undefined") {
     snowflakes_count = total
@@ -27,11 +28,11 @@ export default () => {
 
       // Set CSS custom properties for each snowflake
       const randomX = Math.random() * 100
-      const randomScale = 0.3 + Math.random() * 0.7 // Scale between 0.3 and 1
-      const randomDuration = 8 + Math.random() * 15 // Duration between 8-23s
-      const randomDelay = Math.random() * 10 // Delay between 0-10s
-      const randomOpacity = 0.3 + Math.random() * 0.7 // Opacity between 0.3-1
-      const randomAnimation = Math.floor(Math.random() * 3) + 1 // Choose from 3 animations
+      const randomScale = 0.3 + Math.random() * 0.7
+      const randomDuration = 10 + Math.random() * 15 // Slower = less GPU work
+      const randomDelay = Math.random() * 15
+      const randomOpacity = 0.4 + Math.random() * 0.6
+      const randomAnimation = Math.floor(Math.random() * 3) + 1
 
       snowflake.style.setProperty("--start-x", `${randomX}%`)
       snowflake.style.setProperty("--scale", randomScale.toString())
@@ -46,7 +47,7 @@ export default () => {
     document.getElementById("snow")?.appendChild(fragment)
   }
 
-  // Optimized CSS with GPU acceleration and simplified animations
+  // Highly optimized CSS with maximum performance settings
   const createOptimizedCSS = () => {
     const css = `
       #snow {
@@ -58,46 +59,74 @@ export default () => {
         pointer-events: none;
         z-index: 1000;
         overflow: hidden;
+        /* Contain layout calculations */
+        contain: layout style paint;
       }
 
       .snowflake {
         position: absolute;
         top: -10px;
-        width: 8px;
-        height: 8px;
-        background: white;
+        width: 6px;
+        height: 6px;
+        background: rgba(255, 255, 255, 0.9);
         border-radius: 50%;
         
-        /* GPU acceleration - critical for performance */
+        /* Critical GPU optimizations */
         will-change: transform;
         transform: translateZ(0);
         backface-visibility: hidden;
         
-        /* Simplified glow effect - much lighter than drop-shadow filter */
-        box-shadow: 0 0 6px rgba(255, 255, 255, 0.6);
+        /* REMOVED box-shadow - this is a major performance killer */
+        /* Even lightweight shadows are expensive with many elements */
         
         /* Use CSS custom properties for individual variations */
         left: var(--start-x);
         opacity: var(--opacity);
         animation: var(--animation-name) var(--duration) var(--delay) linear infinite;
+        
+        /* Reduce repaints by using contain */
+        contain: layout style paint;
       }
 
-      /* Simplified to 3 falling patterns - uses only transform for best performance */
+      /* Ultra-optimized animations - only transform property */
+      /* Grouped transforms reduce compositing work */
       @keyframes fall-1 {
-        to { 
-          transform: translateY(100vh) translateX(20px) scale(var(--scale)) translateZ(0);
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(20px, 100vh, 0) scale(var(--scale));
         }
       }
 
       @keyframes fall-2 {
-        to { 
-          transform: translateY(100vh) translateX(-20px) scale(var(--scale)) translateZ(0);
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(-20px, 100vh, 0) scale(var(--scale));
         }
       }
 
       @keyframes fall-3 {
-        to { 
-          transform: translateY(100vh) translateX(0px) scale(var(--scale)) translateZ(0);
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(0, 100vh, 0) scale(var(--scale));
+        }
+      }
+
+      /* Pause animations when snow container is hidden to save resources */
+      #snow[style*="display: none"] .snowflake {
+        animation-play-state: paused;
+      }
+
+      /* Reduce motion for users who prefer it */
+      @media (prefers-reduced-motion: reduce) {
+        .snowflake {
+          animation: none;
+          display: none;
         }
       }
     `

package/services/frontend/src/core/lib/helpers/index.ts

@@ -0,0 +1 @@
+export * from "./removeEmpty"

package/services/frontend/src/core/lib/helpers/removeEmpty.ts

@@ -0,0 +1,69 @@
+type EmptyCheckConfig = {
+  removeNull?: boolean
+  removeUndefined?: boolean
+  removeFalse?: boolean
+  removeEmptyString?: boolean
+  removeZero?: boolean
+  removeEmptyArray?: boolean
+  removeEmptyObject?: boolean
+  customCheck?: (value: unknown) => boolean
+}
+
+const DEFAULT_CONFIG: Required<Omit<EmptyCheckConfig, "customCheck">> = {
+  removeNull: true,
+  removeUndefined: true,
+  removeFalse: false,
+  removeEmptyString: false,
+  removeZero: false,
+  removeEmptyArray: false,
+  removeEmptyObject: false,
+}
+
+const isEmpty = (value: unknown, config: EmptyCheckConfig): boolean => {
+  const checks: Array<() => boolean> = [
+    () => config.removeNull === true && value === null,
+    () => config.removeUndefined === true && value === undefined,
+    () => config.removeFalse === true && value === false,
+    () => config.removeEmptyString === true && value === "",
+    () => config.removeZero === true && value === 0,
+    () =>
+      config.removeEmptyArray === true &&
+      Array.isArray(value) &&
+      value.length === 0,
+    () =>
+      config.removeEmptyObject === true &&
+      typeof value === "object" &&
+      value !== null &&
+      !Array.isArray(value) &&
+      Object.keys(value).length === 0,
+    () => config.customCheck?.(value) ?? false,
+  ]
+
+  return checks.some((check) => check())
+}
+
+const recurse = (value: unknown, config: EmptyCheckConfig): unknown => {
+  if (Array.isArray(value)) {
+    return value
+      .map((item) => recurse(item, config))
+      .filter((item) => !isEmpty(item, config))
+  }
+
+  if (typeof value === "object" && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value)
+        .map(([key, val]) => [key, recurse(val, config)] as const)
+        .filter(([, val]) => !isEmpty(val, config)),
+    )
+  }
+
+  return value
+}
+
+export const removeEmptyValues = <T extends object>(
+  obj: T,
+  config: EmptyCheckConfig = {},
+): Partial<T> => {
+  const mergedConfig = { ...DEFAULT_CONFIG, ...config }
+  return recurse(obj, mergedConfig) as Partial<T>
+}