@raclettejs/core 0.1.19 → 0.1.20

package/services/backend/src/core/sockets/workSessionJoinPayload.ts

@@ -0,0 +1,106 @@
+import { v4 as uuidv4 } from "uuid"
+
+/**
+ * Builds the joinConfirmation payload shape for work-session guests.
+ * Keeps virtual composition and simulated interaction-link logic out of socketManager.
+ */
+
+interface WorkSessionLike {
+  _id: string
+  userId: string
+  createdAt?: Date | string
+  updatedAt?: Date | string
+  [key: string]: unknown
+}
+
+interface CompositionLike {
+  title?: string
+  description?: string
+  tags?: unknown[]
+  icon?: string
+  slotLayout?: string
+  widgetsLayout?: unknown[]
+  status?: string
+  createdAt?: string
+  updatedAt?: string
+  [key: string]: unknown
+}
+
+/** Virtual composition sent to frontend (pathname.default matches route /:workSession/id=...) */
+function buildVirtualComposition(
+  composition: CompositionLike,
+  workSession: WorkSessionLike,
+): Record<string, unknown> {
+  const now = new Date()
+  return {
+    _id: uuidv4(),
+    title: composition.title ?? "Shared Session",
+    description:
+      composition.description ?? "Shared composition for anonymous access",
+    tags: composition.tags ?? [],
+    icon: composition.icon,
+    pathname: { default: "workSession" },
+    slotLayout: composition.slotLayout ?? "full",
+    widgetsLayout: composition.widgetsLayout ?? [],
+    status: composition.status ?? "live",
+    author: workSession.userId,
+    lastEditor: workSession.userId,
+    isDeleted: false,
+    createdAt: composition.createdAt ?? now.toISOString(),
+    updatedAt: composition.updatedAt ?? now.toISOString(),
+  }
+}
+
+/** Simulated interaction link so the frontend can resolve the composition like a normal project. */
+function buildSimulatedInteractionLink(
+  workSession: WorkSessionLike,
+  virtualComposition: { _id: string; [key: string]: unknown },
+): Record<string, unknown> {
+  const created = workSession.createdAt
+    ? new Date(workSession.createdAt)
+    : new Date()
+  const updated = workSession.updatedAt
+    ? new Date(workSession.updatedAt)
+    : new Date()
+  return {
+    _id: `session_${workSession._id}_interactionLink`,
+    composition: virtualComposition._id,
+    slotType: "page",
+    triggers: [],
+    queryParameters: [],
+    description: "Shared session composition",
+    tags: [],
+    author: workSession.userId,
+    lastEditor: workSession.userId,
+    isLandingPage: true,
+    isDeleted: false,
+    createdAt: created,
+    updatedAt: updated,
+  }
+}
+
+export interface WorkSessionJoinPayloadData {
+  compositions: unknown[]
+  interactionLinks: unknown[]
+  projectConfig: Record<string, unknown>
+}
+
+/**
+ * Build the data part of joinConfirmation for a work session (no token).
+ * Socket manager adds token and decoded after creating the JWT.
+ */
+export function buildWorkSessionJoinPayload(
+  workSession: WorkSessionLike,
+  composition: CompositionLike,
+): WorkSessionJoinPayloadData {
+  const virtualComposition = buildVirtualComposition(composition, workSession)
+  const simulatedInteractionLink = buildSimulatedInteractionLink(
+    workSession,
+    virtualComposition as { _id: string; [key: string]: unknown },
+  )
+  return {
+    compositions: [virtualComposition],
+    interactionLinks: [simulatedInteractionLink],
+    projectConfig: {},
+  }
+}

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.get.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import { Type } from "@sinclair/typebox"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.getAll.ts

@@ -1,6 +1,8 @@
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const accountService = fastify.custom.accountService
 
@@ -20,7 +22,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.hardDelete.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -18,29 +19,25 @@ export default (fastify: PluginFastifyInstance) => {
     }>,
     reply: FastifyReply,
   ) => {
-    if (req.user.isAdmin) {
-      try {
-        const { _id } = req.params
-
-        const payload = await accountService.hardDeleteAccount(
-          fastify,
-          req.requestParams,
-          _id,
-        )
-
-        return payload
-      } catch (error: any) {
-        fastify.log.error(error.message)
-        return reply.internalServerError(error.message)
-      }
-    } else {
-      throw new ForbiddenError("Only admins can hard delete this core datatype")
+    try {
+      const { _id } = req.params
+
+      const payload = await accountService.hardDeleteAccount(
+        fastify,
+        req.requestParams,
+        _id,
+      )
+
+      return payload
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return reply.internalServerError(error.message)
     }
   }
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataHardDeleted",
       broadcastChannels: ["accountHardDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.patch.ts

@@ -5,6 +5,8 @@ import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 import { accountSchema } from "../account.schema"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -40,7 +42,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataUpdate",
       broadcastChannels: ["accountUpdated", "broadcastDataUpdated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.post.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { accountSchema } from "../account.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const accountService = fastify.custom.accountService
 
@@ -29,7 +31,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["accountCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.remove.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -35,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataDelete",
       broadcastChannels: ["accountDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/composition.service.ts

@@ -94,11 +94,10 @@ export class CompositionService {
    */
   async _readAllCompositions(
     fastify: PluginFastifyInstance,
-    filters: Record<string, any> = {},
+    filters: Record<string, any> = { isDeleted: false },
   ): Promise<CompositionType[]> {
     try {
-      if (filters.isDeleted !== true && filters.isDeleted !== "true")
-        filters.isDeleted = false
+      filters = { isDeleted: false, ...filters }
       return await this.compositionModel
         .find({
           ...filters,

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.get.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.getAll.ts

@@ -1,6 +1,8 @@
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const compositionService = fastify.custom.compositionService
 
@@ -21,7 +23,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.hardDelete.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -18,29 +19,25 @@ export default (fastify: PluginFastifyInstance) => {
     }>,
     reply: FastifyReply,
   ) => {
-    if (req.user.isAdmin) {
-      try {
-        const { _id } = req.params
-
-        const payload = await compositionService.hardDeleteComposition(
-          fastify,
-          req.requestParams,
-          _id,
-        )
-
-        return payload
-      } catch (error: any) {
-        fastify.log.error(error.message)
-        return reply.internalServerError(error.message)
-      }
-    } else {
-      throw new ForbiddenError("Only admins can hard delete this core datatype")
+    try {
+      const { _id } = req.params
+
+      const payload = await compositionService.hardDeleteComposition(
+        fastify,
+        req.requestParams,
+        _id,
+      )
+
+      return payload
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return reply.internalServerError(error.message)
     }
   }
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataHardDelete",
       broadcastChannels: ["compositionHardDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.patch.ts

@@ -5,6 +5,8 @@ import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 import { compositionUpdateSchema } from "../composition.schema"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -42,7 +44,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataUpdate",
       broadcastChannels: ["compositionUpdated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.post.bulk.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { compositionCreateSchema } from "../composition.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const compositionService = fastify.custom.compositionService
 
@@ -40,7 +42,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["compositionsCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.post.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { compositionCreateSchema } from "../composition.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const compositionService = fastify.custom.compositionService
 
@@ -30,7 +32,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["compositionCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.remove.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -35,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataDelete",
       broadcastChannels: ["compositionDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.restore.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -17,21 +18,17 @@ export default (fastify: PluginFastifyInstance) => {
     reply: FastifyReply,
   ) => {
     try {
-      if (req.user.isAdmin) {
-        const { _id } = req.params
+      const { _id } = req.params
 
-        const payload = await compositionService.updateComposition(
-          fastify,
-          req.requestParams,
-          _id,
-          { isDeleted: false },
-          req.user._id,
-        )
+      const payload = await compositionService.updateComposition(
+        fastify,
+        req.requestParams,
+        _id,
+        { isDeleted: false },
+        req.user._id,
+      )
 
-        return payload
-      } else {
-        throw new ForbiddenError("Only admins can restore this core datatype")
-      }
+      return payload
     } catch (error: any) {
       fastify.log.error(error.message)
       return reply.internalServerError(error.message)
@@ -40,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRestore",
       broadcastChannels: ["compositionRestored"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/interactionLink.service.ts

@@ -97,11 +97,10 @@ export class InteractionLinkService {
    */
   async _readAllInteractionLinks(
     fastify: PluginFastifyInstance,
-    filters: Record<string, any> = {},
+    filters: Record<string, any> = { isDeleted: false },
   ): Promise<InteractionLinkType[]> {
     try {
-      if (filters.isDeleted !== true && filters.isDeleted !== "true")
-        filters.isDeleted = false
+      filters = { isDeleted: false, ...filters }
       return await this.interactionLinkModel
         .find({
           ...filters,

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.get.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.getAll.ts

@@ -1,5 +1,7 @@
 import type { FastifyReply, FastifyRequest } from "fastify"
-import { PluginFastifyInstance } from "types"
+import type { PluginFastifyInstance } from "types"
+
+const permissions = ["user.isAdmin"]
 
 export default (fastify: PluginFastifyInstance) => {
   const interactionLinkService = fastify.custom.interactionLinkService
@@ -21,7 +23,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.hardDelete.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -19,21 +20,15 @@ export default (fastify: PluginFastifyInstance) => {
     reply: FastifyReply,
   ) => {
     try {
-      if (req.user.isAdmin) {
-        const { _id } = req.params
-
-        const payload = await interactionLinkService.hardDeleteInteractionLink(
-          fastify,
-          req.requestParams,
-          _id,
-        )
-
-        return payload
-      } else {
-        throw new ForbiddenError(
-          "Only admins can hard delete this core datatype",
-        )
-      }
+      const { _id } = req.params
+
+      const payload = await interactionLinkService.hardDeleteInteractionLink(
+        fastify,
+        req.requestParams,
+        _id,
+      )
+
+      return payload
     } catch (error: any) {
       fastify.log.error(error.message)
       return reply.internalServerError(error.message)
@@ -42,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataHardDelete",
       broadcastChannels: ["interactionLinkHardDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.patch.ts

@@ -5,6 +5,8 @@ import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 import { interactionLinkUpdateSchema } from "../interactionLink.schema"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataUpdate",
       broadcastChannels: ["interactionLinkUpdated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.post.bulk.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { interactionLinkCreateSchema } from "../interactionLink.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const interactionLinkService = fastify.custom.interactionLinkService
 
@@ -42,7 +44,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["interactionLinksCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.post.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { interactionLinkCreateSchema } from "../interactionLink.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const interactionLinkService = fastify.custom.interactionLinkService
 
@@ -30,7 +32,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["interactionLinkCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/interactionLink/routes/route.interactionLink.remove.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -35,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataDelete",
       broadcastChannels: ["interactionLinkDeleted"],