@raclettejs/core 0.1.24 → 0.1.26

package/services/backend/dist/modules/authentication/index.js

@@ -0,0 +1,253 @@
+import jwt from "@fastify/jwt";
+import fastifyPlugin from "fastify-plugin";
+import configService from "@c/config/configService";
+import { ForbiddenError } from "@/utils/errors";
+const WORK_SESSION_COLLECTION = "raclette__core-worksession";
+const WORK_SESSION_HEADER = "x-work-session-id";
+/**
+ * Middleware: allow either authenticated user (JWT) or valid work session (X-Work-Session-Id).
+ * When using this, the route states that it handles permission checks itself (e.g. compare req.workSession with query).
+ * - If JWT present and valid: sets req.user (normal auth).
+ * - If no/invalid JWT but X-Work-Session-Id present: loads work session, validates (active, not expired),
+ *   optionally checks that workSession.pluginData includes the given pluginKey, then sets req.workSession and req.isWorkSession.
+ */
+export const authenticatedOrWorksession = async (req, res, fastify, pluginKey) => {
+    fastify.log.debug(`[Auth] authenticatedOrWorksession: ${pluginKey} ${req.method} ${req.url}`);
+    const { requireAuthentication } = configService.getConfig()?.global ?? {
+        requireAuthentication: true,
+    };
+    const isAdminTagRequired = configService.isAdminTagRequired();
+    if (!requireAuthentication) {
+        const mockUser = { _id: "SYSTEM" };
+        req.user = mockUser;
+        return;
+    }
+    // 1) Try JWT first
+    try {
+        await req.jwtVerify();
+        const payload = req.user;
+        fastify.log.debug(`[Auth] JWT verified, payload type: ${payload.type || "user"}, sessionId: ${payload.sessionId || "none"}, _id: ${payload._id || "none"}`);
+        if (payload.type === "workSession" && payload.sessionId) {
+            fastify.log.info(`[Auth] Work session JWT detected, sessionId: ${payload.sessionId}, pluginKey: ${pluginKey}`);
+            // Work session JWT: load session and validate
+            const workSession = await loadAndValidateWorkSession(fastify, payload.sessionId, pluginKey);
+            if (!workSession) {
+                fastify.log.warn(`[Auth] Work session validation failed for sessionId: ${payload.sessionId}`);
+                return res
+                    .status(401)
+                    .send({ message: "Invalid or expired work session" });
+            }
+            fastify.log.info(`[Auth] Work session authenticated: sessionId=${payload.sessionId}, pluginKey=${pluginKey}`);
+            req.workSession = workSession;
+            req.isWorkSession = true;
+            // Set projectId from workSession.project if available
+            if (workSession.project) {
+                req.projectId = workSession.project;
+                fastify.log.debug(`[Auth] Work session projectId: ${req.projectId}`);
+            }
+            return;
+        }
+        // Normal user JWT: fetch user and set req.user
+        fastify.log.debug(`[Auth] Normal user JWT, fetching user: ${req.user?._id}`);
+        const { _id } = req.user;
+        const adminTag = await fastify.database
+            .collection("raclette__core-tag")
+            .findOne({ title: "ADMIN", locked: true, type: "system" });
+        let isAdmin = false;
+        const user = await fastify.database
+            .collection("raclette__core-user")
+            .findOne({ _id }, { projection: { password: 0, resetKey: 0 } });
+        if (user && user.tags && adminTag) {
+            user.tags.forEach((tag) => {
+                if (adminTag._id === tag)
+                    isAdmin = true;
+            });
+        }
+        if (isAdminTagRequired && !isAdmin) {
+            fastify.log.error("User not allowed in workbench");
+            return res.status(403).send({ message: "User not allowed in workbench" });
+        }
+        if (isAdmin)
+            user.isAdmin = true;
+        if (!user) {
+            fastify.log.error("User not found");
+            return res.status(401).send({ message: "User not found" });
+        }
+        const account = await fastify.database
+            .collection("raclette__core-account")
+            .findOne({ _id: user.account });
+        user.account = account;
+        req.user = user;
+        // Set projectId from user's lastProjectId (for requestData.project in payload wrappers)
+        if (user.ux?.lastProjectId) {
+            req.projectId = user.ux.lastProjectId;
+            fastify.log.debug(`[Auth] User projectId: ${req.projectId}`);
+        }
+        return;
+    }
+    catch (error) {
+        // JWT missing or invalid: try work session via header
+        fastify.log.debug(`[Auth] JWT verification failed: ${error.message}, trying work session header`);
+    }
+    // 2) Try X-Work-Session-Id header
+    const sessionId = req.headers[WORK_SESSION_HEADER];
+    if (sessionId) {
+        const workSession = await loadAndValidateWorkSession(fastify, sessionId, pluginKey);
+        if (workSession) {
+            req.workSession = workSession;
+            req.isWorkSession = true;
+            // Set projectId from workSession.project if available
+            // workaround for how projects/spaces are currently handled - tbd
+            if (workSession.project) {
+                req.projectId = workSession.project;
+            }
+            return;
+        }
+        else {
+            fastify.log.warn(`[Auth] Work session validation failed for header sessionId: ${sessionId}`);
+        }
+    }
+    return res.status(401).send({ message: "Authentication required" });
+};
+async function loadAndValidateWorkSession(fastify, sessionId, pluginKey) {
+    fastify.log.debug(`[WorkSession Auth] Loading and validating work session: sessionId=${sessionId}, pluginKey=${pluginKey}`);
+    if (!sessionId || typeof sessionId !== "string") {
+        fastify.log.warn(`[WorkSession Auth] Invalid sessionId: ${sessionId}`);
+        return null;
+    }
+    fastify.log.debug(`[WorkSession Auth] Querying database for work session`);
+    const doc = await fastify.database
+        .collection(WORK_SESSION_COLLECTION)
+        .findOne({ _id: sessionId });
+    if (!doc) {
+        fastify.log.warn(`[WorkSession Auth] Work session not found: ${sessionId}`);
+        return null;
+    }
+    if (!doc.isActive) {
+        fastify.log.warn(`[WorkSession Auth] Work session is not active: ${sessionId}`);
+        return null;
+    }
+    const expiry = doc.expiryDate ? new Date(doc.expiryDate) : null;
+    if (expiry && expiry.getTime() < Date.now()) {
+        fastify.log.warn(`[WorkSession Auth] Work session expired: ${sessionId}, expiryDate: ${expiry.toISOString()}`);
+        return null;
+    }
+    // Check that this plugin is part of the work session (pluginData keys are "pluginKey:widgetName")
+    const pluginData = doc.pluginData || {};
+    const pluginKeys = Object.keys(pluginData);
+    const hasPlugin = pluginKeys.some((k) => k.startsWith(pluginKey + ":")) ||
+        Object.prototype.hasOwnProperty.call(pluginData, pluginKey);
+    if (!hasPlugin) {
+        fastify.log.warn(`[WorkSession Auth] Plugin ${pluginKey} not found in work session pluginData: ${pluginKeys.join(", ")}`);
+        return null;
+    }
+    fastify.log.info(`[WorkSession Auth] Work session validated successfully: sessionId=${sessionId}, pluginKey=${pluginKey}`);
+    return doc;
+}
+export const authenticate = async (req, res, fastify) => {
+    {
+        const { requireAuthentication } = configService.getConfig()?.global ?? {
+            requireAuthentication: true,
+        };
+        const isAdminTagRequired = configService.isAdminTagRequired();
+        // Skip JWT verification and database queries, if global.requireAuthentication is configured to false
+        if (!requireAuthentication) {
+            const mockUser = {
+                _id: "SYSTEM",
+            };
+            req.user = mockUser;
+            return;
+        }
+        try {
+            await req.jwtVerify();
+            const payload = req.user;
+            if (payload.type === "workSession") {
+                return res
+                    .status(401)
+                    .send({ message: "Work session token not allowed on this route" });
+            }
+            // fetch current user data from the db
+            const { _id } = req.user;
+            const adminTag = await fastify.database
+                .collection("raclette__core-tag")
+                .findOne({ title: "ADMIN", locked: true, type: "system" });
+            // IMPORTANT
+            // due to some very weird behaviour, mongoose always returns empty results
+            // so we are using mongodb directly until we fix this
+            let isAdmin = false;
+            const user = await fastify.database
+                .collection("raclette__core-user")
+                .findOne({ _id }, { projection: { password: 0, resetKey: 0 } });
+            if (user && user.tags && adminTag) {
+                user.tags.forEach((tag) => {
+                    if (adminTag._id === tag) {
+                        isAdmin = true;
+                    }
+                });
+            }
+            if (isAdminTagRequired && !isAdmin) {
+                fastify.log.error("User not allowed in workbench");
+                throw new Error("User not allowed in workbench");
+            }
+            if (isAdmin) {
+                user.isAdmin = true;
+            }
+            if (!user) {
+                fastify.log.error("User not found");
+                throw new Error("User not found");
+            }
+            const account = await fastify.database
+                .collection("raclette__core-account")
+                .findOne({ _id: user.account });
+            user.account = account;
+            req.user = user;
+        }
+        catch (error) {
+            return res.send(error);
+        }
+    }
+};
+export const checkPermissions = async (req, res, fastify, permissions) => {
+    {
+        try {
+            if (!permissions.length) {
+                fastify.log.error("No permissions given for permission check");
+                throw new Error("No Permissions");
+            }
+            // TODO implement proper Permission lookup here
+            permissions.forEach((permissionStr) => {
+                if (permissionStr === "user.isAdmin") {
+                    if (!req.user.isAdmin) {
+                        throw new ForbiddenError("User not permitted to action");
+                    }
+                }
+            });
+        }
+        catch (error) {
+            fastify.log.error(error.message);
+            return res.send(error.message);
+        }
+    }
+};
+export default fastifyPlugin(async (fastify, opts = {}) => {
+    // provide some sensible options
+    const defaults = {
+        secret: false,
+        decode: { complete: true },
+        sign: {
+            iss: "api.raclettejs.info",
+            expiresIn: "30d",
+        },
+        verify: { allowedIss: "api.raclettejs.info" },
+    };
+    // merge proved opts with defaults
+    const mergedOptions = { ...defaults, ...opts };
+    /* register the plugin */
+    fastify.register(jwt, mergedOptions);
+    // decorate the fastify instance, so we can call it anywhere
+    fastify.decorate("authenticate", (req, res) => {
+        return authenticate(req, res, fastify);
+    });
+    fastify.decorate("authenticatedOrWorksession", (pluginKey) => (req, res) => authenticatedOrWorksession(req, res, fastify, pluginKey));
+    fastify.decorate("checkPermissions", (permissionsArr) => (req, res) => checkPermissions(req, res, fastify, permissionsArr));
+});

package/services/backend/dist/shared/types/core/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/shared/types/dataTypes/index.js

@@ -0,0 +1,6 @@
+export * from "./tags";
+// TODO make the mongoDataTypes dynamic
+export const systemDataTypes = ["account", "projectConfig", "userConfig"];
+export const userContents = ["tag", "user", "project"];
+export const mongoDataTypes = systemDataTypes.concat(userContents);
+export const syncableDatatypes = ["tag", "user", "searchResult"];

package/services/backend/dist/shared/types/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/shared/types/plugins/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/types/index.js

@@ -0,0 +1,12 @@
+export * from "../core/backgroundTasks/taskManagerTypes";
+export * from "../core/config/configTypes";
+export * from "../core/crud/crudTypes";
+export * from "../core/http/httpTypes";
+export * from "../core/http/httpTypes";
+export * from "../core/payload/payloadTypes";
+export * from "../core/pluginSystem/pluginTypes";
+export * from "../core/sockets/socketTypes";
+export * from "../core/validation/schemaTypes";
+export * from "../modules/cache/cacheTypes";
+export * from "../core/validation/schemaTypes";
+export * from "../core/pluginSystem/configGenerator/generatorTypes";

package/services/backend/dist/utils/index.js

@@ -0,0 +1,2 @@
+export * from "./errors";
+export * from "./request.utils";

package/services/backend/package.json

@@ -42,7 +42,7 @@
     "iovalkey": "0.3.3",
     "migrate-mongo": "14.0.7",
     "mongodb": "6.21.0",
-    "mongoose": "8.23.0",
+    "mongoose": "8.18.3",
     "nanoid": "5.1.7",
     "pino": "10.3.1",
     "pino-pretty": "13.1.3",
@@ -65,4 +65,4 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.57.1"
   }
-}
+}

package/services/backend/src/core/config/configService.ts

@@ -126,7 +126,7 @@ export class ConfigService {
   public getFastifyRateLimits() {
     const config = this.getConfig()
 
-    return config?.accessRateLimit ?? { max: 1000, timeWindow: "1 minute" }
+    return config?.accessRateLimit ?? { max: 1000, timeWindow: 60000 }
   }
   // Helper to check if a specific auto-send feature is enabled
   // Default to true unless explicitly set to false

package/services/backend/src/corePlugins/raclette__core/frontend/generated-config.ts

@@ -315,6 +315,18 @@ export default {
             }
           ]
         },
+        updateSelf: {
+          target: "/raclette__core/user/self",
+          method: "patch",
+          storeActionType: "dataUpdate",
+          channels: [
+            {
+              channel: "raclette__core--userUpdated",
+              channelKey: "userUpdated",
+              prefix: "raclette__core"
+            }
+          ]
+        },
         updateRestore: {
           target: (payload) => `/raclette__core/user/${payload._id}/restore`,
           method: "patch",

package/services/backend/src/modules/hooks/rate-limiter.ts

@@ -6,16 +6,5 @@ import configService from "@c/config/configService"
 export default fastifyPlugin(async (fastify: FastifyInstance) => {
   const opts = configService.getFastifyRateLimits()
   fastify.log.info("Fastify Ratelimiter with opts " + JSON.stringify(opts))
-  await fastify.register(rateLimit, opts)
-  fastify.setNotFoundHandler(
-    {
-      preHandler: fastify.rateLimit({
-        max: 4,
-        timeWindow: 500,
-      }),
-    },
-    function (request, reply) {
-      reply.code(404).send({ why: "you do dat?" })
-    },
-  )
+  await fastify.register(rateLimit, { ...opts, global: true })
 })

package/services/backend/src/shared/schemas/core/Account.schema.ts

@@ -12,6 +12,16 @@ export const AccountSchema = {
   $id: "#account/base",
   title: "core/account",
   type: "object",
+  required: [
+    "_id",
+    "name",
+    "active",
+    "blocked",
+    "tags",
+    "isDeleted",
+    "createdAt",
+    "updatedAt",
+  ],
   properties: {
     _id: {
       type: "string",
@@ -63,16 +73,6 @@ export const AccountSchema = {
       type: "string",
     },
   },
-  required: [
-    "_id",
-    "name",
-    "active",
-    "blocked",
-    "tags",
-    "isDeleted",
-    "createdAt",
-    "updatedAt",
-  ],
 }
 
 

package/services/backend/src/shared/schemas/core/Composition.schema.ts

@@ -12,6 +12,19 @@ export const CompositionSchema = {
   $id: "#composition/base",
   title: "core/composition",
   type: "object",
+  required: [
+    "_id",
+    "title",
+    "tags",
+    "pathname",
+    "status",
+    "widgetsLayout",
+    "author",
+    "lastEditor",
+    "createdAt",
+    "updatedAt",
+    "isDeleted",
+  ],
   properties: {
     _id: {
       type: "string",
@@ -43,6 +56,9 @@ export const CompositionSchema = {
         },
       },
     },
+    slotLayout: {
+      type: "string",
+    },
     status: {
       default: "inProgress",
       anyOf: [
@@ -67,12 +83,21 @@ export const CompositionSchema = {
         type: "array",
         items: {
           type: "object",
+          required: [
+            "column",
+            "widget",
+          ],
           properties: {
             column: {
               type: "number",
             },
             widget: {
               type: "object",
+              required: [
+                "uuid",
+                "name",
+                "pluginKey",
+              ],
               properties: {
                 uuid: {
                   type: "string",
@@ -86,17 +111,8 @@ export const CompositionSchema = {
                 config: {},
                 public: {},
               },
-              required: [
-                "uuid",
-                "name",
-                "pluginKey",
-              ],
             },
           },
-          required: [
-            "column",
-            "widget",
-          ],
         },
       },
     },
@@ -119,19 +135,6 @@ export const CompositionSchema = {
       type: "boolean",
     },
   },
-  required: [
-    "_id",
-    "title",
-    "tags",
-    "pathname",
-    "status",
-    "widgetsLayout",
-    "author",
-    "lastEditor",
-    "createdAt",
-    "updatedAt",
-    "isDeleted",
-  ],
 }
 
 

package/services/backend/src/shared/schemas/core/CompositionCreate.schema.ts

@@ -12,6 +12,13 @@ export const CompositionCreateSchema = {
   $id: "#composition/create",
   title: "core/composition-create",
   type: "object",
+  required: [
+    "title",
+    "tags",
+    "pathname",
+    "status",
+    "widgetsLayout",
+  ],
   properties: {
     title: {
       minLength: 1,
@@ -40,6 +47,9 @@ export const CompositionCreateSchema = {
         },
       },
     },
+    slotLayout: {
+      type: "string",
+    },
     status: {
       default: "inProgress",
       anyOf: [
@@ -64,12 +74,21 @@ export const CompositionCreateSchema = {
         type: "array",
         items: {
           type: "object",
+          required: [
+            "column",
+            "widget",
+          ],
           properties: {
             column: {
               type: "number",
             },
             widget: {
               type: "object",
+              required: [
+                "uuid",
+                "name",
+                "pluginKey",
+              ],
               properties: {
                 uuid: {
                   type: "string",
@@ -83,28 +102,12 @@ export const CompositionCreateSchema = {
                 config: {},
                 public: {},
               },
-              required: [
-                "uuid",
-                "name",
-                "pluginKey",
-              ],
             },
           },
-          required: [
-            "column",
-            "widget",
-          ],
         },
       },
     },
   },
-  required: [
-    "title",
-    "tags",
-    "pathname",
-    "status",
-    "widgetsLayout",
-  ],
 }
 
 

package/services/backend/src/shared/schemas/core/CompositionUpdate.schema.ts

@@ -12,6 +12,13 @@ export const CompositionUpdateSchema = {
   $id: "#composition/update",
   title: "core/composition-update",
   type: "object",
+  required: [
+    "title",
+    "tags",
+    "pathname",
+    "status",
+    "widgetsLayout",
+  ],
   properties: {
     title: {
       minLength: 1,
@@ -40,6 +47,9 @@ export const CompositionUpdateSchema = {
         },
       },
     },
+    slotLayout: {
+      type: "string",
+    },
     status: {
       default: "inProgress",
       anyOf: [
@@ -64,12 +74,21 @@ export const CompositionUpdateSchema = {
         type: "array",
         items: {
           type: "object",
+          required: [
+            "column",
+            "widget",
+          ],
           properties: {
             column: {
               type: "number",
             },
             widget: {
               type: "object",
+              required: [
+                "uuid",
+                "name",
+                "pluginKey",
+              ],
               properties: {
                 uuid: {
                   type: "string",
@@ -83,28 +102,12 @@ export const CompositionUpdateSchema = {
                 config: {},
                 public: {},
               },
-              required: [
-                "uuid",
-                "name",
-                "pluginKey",
-              ],
             },
           },
-          required: [
-            "column",
-            "widget",
-          ],
         },
       },
     },
   },
-  required: [
-    "title",
-    "tags",
-    "pathname",
-    "status",
-    "widgetsLayout",
-  ],
 }