@raclettejs/core 0.1.30 → 0.1.32-nightly

package/services/backend/dist/modules/authentication/index.js

@@ -0,0 +1,253 @@
+import jwt from "@fastify/jwt";
+import fastifyPlugin from "fastify-plugin";
+import configService from "@c/config/configService";
+import { ForbiddenError } from "@/utils/errors";
+const WORK_SESSION_COLLECTION = "raclette__core-worksession";
+const WORK_SESSION_HEADER = "x-work-session-id";
+/**
+ * Middleware: allow either authenticated user (JWT) or valid work session (X-Work-Session-Id).
+ * When using this, the route states that it handles permission checks itself (e.g. compare req.workSession with query).
+ * - If JWT present and valid: sets req.user (normal auth).
+ * - If no/invalid JWT but X-Work-Session-Id present: loads work session, validates (active, not expired),
+ *   optionally checks that workSession.pluginData includes the given pluginKey, then sets req.workSession and req.isWorkSession.
+ */
+export const authenticatedOrWorksession = async (req, res, fastify, pluginKey) => {
+    fastify.log.debug(`[Auth] authenticatedOrWorksession: ${pluginKey} ${req.method} ${req.url}`);
+    const { requireAuthentication } = configService.getConfig()?.global ?? {
+        requireAuthentication: true,
+    };
+    const isAdminTagRequired = configService.isAdminTagRequired();
+    if (!requireAuthentication) {
+        const mockUser = { _id: "SYSTEM" };
+        req.user = mockUser;
+        return;
+    }
+    // 1) Try JWT first
+    try {
+        await req.jwtVerify();
+        const payload = req.user;
+        fastify.log.debug(`[Auth] JWT verified, payload type: ${payload.type || "user"}, sessionId: ${payload.sessionId || "none"}, _id: ${payload._id || "none"}`);
+        if (payload.type === "workSession" && payload.sessionId) {
+            fastify.log.info(`[Auth] Work session JWT detected, sessionId: ${payload.sessionId}, pluginKey: ${pluginKey}`);
+            // Work session JWT: load session and validate
+            const workSession = await loadAndValidateWorkSession(fastify, payload.sessionId, pluginKey);
+            if (!workSession) {
+                fastify.log.warn(`[Auth] Work session validation failed for sessionId: ${payload.sessionId}`);
+                return res
+                    .status(401)
+                    .send({ message: "Invalid or expired work session" });
+            }
+            fastify.log.info(`[Auth] Work session authenticated: sessionId=${payload.sessionId}, pluginKey=${pluginKey}`);
+            req.workSession = workSession;
+            req.isWorkSession = true;
+            // Set projectId from workSession.project if available
+            if (workSession.project) {
+                req.projectId = workSession.project;
+                fastify.log.debug(`[Auth] Work session projectId: ${req.projectId}`);
+            }
+            return;
+        }
+        // Normal user JWT: fetch user and set req.user
+        fastify.log.debug(`[Auth] Normal user JWT, fetching user: ${req.user?._id}`);
+        const { _id } = req.user;
+        const adminTag = await fastify.database
+            .collection("raclette__core-tag")
+            .findOne({ title: "ADMIN", locked: true, type: "system" });
+        let isAdmin = false;
+        const user = await fastify.database
+            .collection("raclette__core-user")
+            .findOne({ _id }, { projection: { password: 0, resetKey: 0 } });
+        if (user && user.tags && adminTag) {
+            user.tags.forEach((tag) => {
+                if (adminTag._id === tag)
+                    isAdmin = true;
+            });
+        }
+        if (isAdminTagRequired && !isAdmin) {
+            fastify.log.error("User not allowed in workbench");
+            return res.status(403).send({ message: "User not allowed in workbench" });
+        }
+        if (isAdmin)
+            user.isAdmin = true;
+        if (!user) {
+            fastify.log.error("User not found");
+            return res.status(401).send({ message: "User not found" });
+        }
+        const account = await fastify.database
+            .collection("raclette__core-account")
+            .findOne({ _id: user.account });
+        user.account = account;
+        req.user = user;
+        // Set projectId from user's lastProjectId (for requestData.project in payload wrappers)
+        if (user.ux?.lastProjectId) {
+            req.projectId = user.ux.lastProjectId;
+            fastify.log.debug(`[Auth] User projectId: ${req.projectId}`);
+        }
+        return;
+    }
+    catch (error) {
+        // JWT missing or invalid: try work session via header
+        fastify.log.debug(`[Auth] JWT verification failed: ${error.message}, trying work session header`);
+    }
+    // 2) Try X-Work-Session-Id header
+    const sessionId = req.headers[WORK_SESSION_HEADER];
+    if (sessionId) {
+        const workSession = await loadAndValidateWorkSession(fastify, sessionId, pluginKey);
+        if (workSession) {
+            req.workSession = workSession;
+            req.isWorkSession = true;
+            // Set projectId from workSession.project if available
+            // workaround for how projects/spaces are currently handled - tbd
+            if (workSession.project) {
+                req.projectId = workSession.project;
+            }
+            return;
+        }
+        else {
+            fastify.log.warn(`[Auth] Work session validation failed for header sessionId: ${sessionId}`);
+        }
+    }
+    return res.status(401).send({ message: "Authentication required" });
+};
+async function loadAndValidateWorkSession(fastify, sessionId, pluginKey) {
+    fastify.log.debug(`[WorkSession Auth] Loading and validating work session: sessionId=${sessionId}, pluginKey=${pluginKey}`);
+    if (!sessionId || typeof sessionId !== "string") {
+        fastify.log.warn(`[WorkSession Auth] Invalid sessionId: ${sessionId}`);
+        return null;
+    }
+    fastify.log.debug(`[WorkSession Auth] Querying database for work session`);
+    const doc = await fastify.database
+        .collection(WORK_SESSION_COLLECTION)
+        .findOne({ _id: sessionId });
+    if (!doc) {
+        fastify.log.warn(`[WorkSession Auth] Work session not found: ${sessionId}`);
+        return null;
+    }
+    if (!doc.isActive) {
+        fastify.log.warn(`[WorkSession Auth] Work session is not active: ${sessionId}`);
+        return null;
+    }
+    const expiry = doc.expiryDate ? new Date(doc.expiryDate) : null;
+    if (expiry && expiry.getTime() < Date.now()) {
+        fastify.log.warn(`[WorkSession Auth] Work session expired: ${sessionId}, expiryDate: ${expiry.toISOString()}`);
+        return null;
+    }
+    // Check that this plugin is part of the work session (pluginData keys are "pluginKey:widgetName")
+    const pluginData = doc.pluginData || {};
+    const pluginKeys = Object.keys(pluginData);
+    const hasPlugin = pluginKeys.some((k) => k.startsWith(pluginKey + ":")) ||
+        Object.prototype.hasOwnProperty.call(pluginData, pluginKey);
+    if (!hasPlugin) {
+        fastify.log.warn(`[WorkSession Auth] Plugin ${pluginKey} not found in work session pluginData: ${pluginKeys.join(", ")}`);
+        return null;
+    }
+    fastify.log.info(`[WorkSession Auth] Work session validated successfully: sessionId=${sessionId}, pluginKey=${pluginKey}`);
+    return doc;
+}
+export const authenticate = async (req, res, fastify) => {
+    {
+        const { requireAuthentication } = configService.getConfig()?.global ?? {
+            requireAuthentication: true,
+        };
+        const isAdminTagRequired = configService.isAdminTagRequired();
+        // Skip JWT verification and database queries, if global.requireAuthentication is configured to false
+        if (!requireAuthentication) {
+            const mockUser = {
+                _id: "SYSTEM",
+            };
+            req.user = mockUser;
+            return;
+        }
+        try {
+            await req.jwtVerify();
+            const payload = req.user;
+            if (payload.type === "workSession") {
+                return res
+                    .status(401)
+                    .send({ message: "Work session token not allowed on this route" });
+            }
+            // fetch current user data from the db
+            const { _id } = req.user;
+            const adminTag = await fastify.database
+                .collection("raclette__core-tag")
+                .findOne({ title: "ADMIN", locked: true, type: "system" });
+            // IMPORTANT
+            // due to some very weird behaviour, mongoose always returns empty results
+            // so we are using mongodb directly until we fix this
+            let isAdmin = false;
+            const user = await fastify.database
+                .collection("raclette__core-user")
+                .findOne({ _id }, { projection: { password: 0, resetKey: 0 } });
+            if (user && user.tags && adminTag) {
+                user.tags.forEach((tag) => {
+                    if (adminTag._id === tag) {
+                        isAdmin = true;
+                    }
+                });
+            }
+            if (isAdminTagRequired && !isAdmin) {
+                fastify.log.error("User not allowed in workbench");
+                throw new Error("User not allowed in workbench");
+            }
+            if (isAdmin) {
+                user.isAdmin = true;
+            }
+            if (!user) {
+                fastify.log.error("User not found");
+                throw new Error("User not found");
+            }
+            const account = await fastify.database
+                .collection("raclette__core-account")
+                .findOne({ _id: user.account });
+            user.account = account;
+            req.user = user;
+        }
+        catch (error) {
+            return res.send(error);
+        }
+    }
+};
+export const checkPermissions = async (req, res, fastify, permissions) => {
+    {
+        try {
+            if (!permissions.length) {
+                fastify.log.error("No permissions given for permission check");
+                throw new Error("No Permissions");
+            }
+            // TODO implement proper Permission lookup here
+            permissions.forEach((permissionStr) => {
+                if (permissionStr === "user.isAdmin") {
+                    if (!req.user.isAdmin) {
+                        throw new ForbiddenError("User not permitted to action");
+                    }
+                }
+            });
+        }
+        catch (error) {
+            fastify.log.error(error.message);
+            return res.send(error.message);
+        }
+    }
+};
+export default fastifyPlugin(async (fastify, opts = {}) => {
+    // provide some sensible options
+    const defaults = {
+        secret: false,
+        decode: { complete: true },
+        sign: {
+            iss: "api.raclettejs.info",
+            expiresIn: "30d",
+        },
+        verify: { allowedIss: "api.raclettejs.info" },
+    };
+    // merge proved opts with defaults
+    const mergedOptions = { ...defaults, ...opts };
+    /* register the plugin */
+    fastify.register(jwt, mergedOptions);
+    // decorate the fastify instance, so we can call it anywhere
+    fastify.decorate("authenticate", (req, res) => {
+        return authenticate(req, res, fastify);
+    });
+    fastify.decorate("authenticatedOrWorksession", (pluginKey) => (req, res) => authenticatedOrWorksession(req, res, fastify, pluginKey));
+    fastify.decorate("checkPermissions", (permissionsArr) => (req, res) => checkPermissions(req, res, fastify, permissionsArr));
+});

package/services/backend/dist/shared/types/core/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/shared/types/dataTypes/index.js

@@ -0,0 +1,6 @@
+export * from "./tags";
+// TODO make the mongoDataTypes dynamic
+export const systemDataTypes = ["account", "projectConfig", "userConfig"];
+export const userContents = ["tag", "user", "project"];
+export const mongoDataTypes = systemDataTypes.concat(userContents);
+export const syncableDatatypes = ["tag", "user", "searchResult"];

package/services/backend/dist/shared/types/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/shared/types/plugins/index.js

@@ -0,0 +1,8 @@
+/**
+ * ⚠️ WARNING: THIS FILE IS AUTO-GENERATED ⚠️
+ *
+ * This file is generated by the type generation system.
+ * Any manual changes will be overwritten on next server start and should always be committed.
+ *
+ */
+export {};

package/services/backend/dist/types/index.js

@@ -0,0 +1,12 @@
+export * from "../core/backgroundTasks/taskManagerTypes";
+export * from "../core/config/configTypes";
+export * from "../core/crud/crudTypes";
+export * from "../core/http/httpTypes";
+export * from "../core/http/httpTypes";
+export * from "../core/payload/payloadTypes";
+export * from "../core/pluginSystem/pluginTypes";
+export * from "../core/sockets/socketTypes";
+export * from "../core/validation/schemaTypes";
+export * from "../modules/cache/cacheTypes";
+export * from "../core/validation/schemaTypes";
+export * from "../core/pluginSystem/configGenerator/generatorTypes";

package/services/backend/dist/utils/index.js

@@ -0,0 +1,2 @@
+export * from "./errors";
+export * from "./request.utils";

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/user/routes/route.user.patchOwn.ts

@@ -26,7 +26,7 @@ export default (fastify: PluginFastifyInstance) => {
       if (req.body?.email?.length) {
         updateObject.email = req.body.email
         // TODO Creation of the field should be happening in the user.model pre save hook
-        updateObject.email_verified = false
+        // updateObject.email_verified = false
       }
       if (req.body?.firstname?.length) {
         updateObject.firstname = req.body.firstname

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/user/user.service.ts

@@ -135,7 +135,8 @@ export class UserService {
     options: QueryOptions = {},
   ): Promise<UserType[]> {
     try {
-      if (filter.isDeleted !== true && filter.isDeleted !=='true') filter.isDeleted = false
+      if (filter.isDeleted !== true && filter.isDeleted !== "true")
+        filter.isDeleted = false
       // Start building the query
       let query = this.userModel.find(filter)
 
@@ -319,7 +320,27 @@ export class UserService {
       throw error
     }
   }
+  /**
+   * Hard delete a user with payload wrapping and event emission
+   */
+  async hardDeleteUser(
+    fastify: PluginFastifyInstance,
+    requestData: FrontendPayloadRequestData,
+    id: string,
+  ): Promise<FrontendPayload<UserType[]>> {
+    const user = await this._hardDeleteUser(fastify, id)
+
+    const payload = await createUserPayload(fastify, [user], {
+      ...requestData,
+      type: "dataHardDeleted",
+    })
+
+    payload.body.deleted = [user._id]
 
+    fastify.emit("userHardDeleted", payload)
+
+    return payload
+  }
   /**
    * Core function to update user's last accessed project (returns raw data)
    */

package/services/backend/yarn.lock

@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!
 
 __metadata:
-  version: 8
+  version: 9
   cacheKey: 10c0
 
 "@colors/colors@npm:1.5.0":

package/services/frontend/package.json

@@ -41,12 +41,12 @@
     "vuetify": "4.0.5"
   },
   "devDependencies": {
+    "@eslint/js": "9.35.0",
     "@types/node": "24.5.1",
     "@types/ramda": "0.31.1",
     "@vitejs/plugin-vue": "6.0.5",
     "@vue/tsconfig": "0.9.0",
     "eslint": "9.35.0",
-    "@eslint/js": "9.35.0",
     "eslint-config-prettier": "9.1.2",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-prefer-arrow-functions": "3.9.1",
@@ -60,4 +60,4 @@
     "vue-eslint-parser": "9.4.3",
     "vue-tsc": "3.2.6"
   }
-}
+}

package/services/frontend/src/core/lib/data/dataApi.ts

@@ -79,10 +79,9 @@ const $writeDataApi = (
       responseSubject$.complete()
     },
     clear: () => {
-      dataSubject$.next({})
+      dataSubject$.next([])
       errorSubject$.next({})
       isLoadingSubject$.next(false)
-      dataSubject$.next({})
     },
   }
 

package/services/frontend/src/orchestrator/ProductOrchestrator.vue

@@ -112,13 +112,14 @@
           rel="noopener noreferrer"
           target="_blank"
           title="raclette"
-          class="tw:text-[0.9rem]"
+          class="tw:text-[0.9rem] tw:text-neutral-500 tw:no-underline hover:tw:no-underline hover:tw:text-neutral-700 tw:transition-colors"
         >
           Cooked with <span class="raclette">raclette 🧀</span></a
         >
         <span
           v-if="configService.getAdvertiseYourself().length"
           v-html="configService.getAdvertiseYourself()"
+          class="footerLink tw:text-[0.9rem] tw:text-neutral-500 tw:no-underline hover:tw:no-underline hover:tw:text-neutral-700 tw:transition-colors"
         ></span>
       </v-footer>
     </v-main>
@@ -285,3 +286,9 @@ window
     }
   })
 </script>
+<style lang="scss">
+.footerLink a {
+  text-decoration: none;
+  color: var(--tw-color-neutral-500);
+}
+</style>

package/services/frontend/src/orchestrator/assets/styles/layers.css

@@ -1,11 +1,8 @@
-@layer tailwind-theme;
-@layer tailwind-reset;
-
 @layer vuetify-core;
 @layer vuetify-components;
 @layer vuetify-overrides;
 @layer vuetify-utilities;
 
-@layer tailwind-utilities;
+@layer tailwind; /* <-- our new utilities */
 
 @layer vuetify-final;

package/services/frontend/src/orchestrator/assets/styles/tailwindStyles.css

@@ -1,9 +1,9 @@
 @source "../../../../index.html";
 @source "/**/*.{vue,js,ts,jsx,tsx,html}";
 
-@import "tailwindcss/theme" layer(tailwind-theme) prefix(tw);
-@import "tailwindcss/preflight" layer(tailwind-reset) prefix(tw);
-@import "tailwindcss/utilities" layer(tailwind-utilities) prefix(tw);
+@import "tailwindcss/theme" layer(tailwind.theme) prefix(tw);
+/*@import "tailwindcss/preflight" layer(tailwind-reset) prefix(tw);*/
+@import "tailwindcss/utilities" layer(tailwind.utilities) prefix(tw);
 
 @custom-variant light (&:where(.v-theme--light, .v-theme--light *));
 @custom-variant dark (&:where(.v-theme--dark, .v-theme--dark *));

package/services/frontend/src/orchestrator/assets/styles/vuetifyStyles.scss

@@ -1,5 +1,8 @@
 @use "@mdi/font/css/materialdesignicons.css";
-
+@use "vuetify/settings" with (
+  $color-pack: false,
+  $utilities: false
+);
 // The styles below are picked from vuetify's reset css (which is disabled)
 
 /* Apply cursor pointer to button elements */