@rpcbase/server 0.628.0 → 0.630.0

package/dist/index.js

@@ -2,11 +2,13 @@ import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-BPOCksWG.js
 import { c as runRtsQuery, d as getDerivedKey, i as normalizeRtsQueryOptions, n as buildRtsAbilityFromRequest, o as resolveRtsRequestTenantId, r as isRtsRequestAuthorized, s as runRtsCount, t as RTS_QUERY_WINDOW_MAX_COUNT, u as syncAuthenticatedSessionMiddleware } from "./queryWindow-NCe5vJHt.js";
 import { i as sendEmail, n as configureEmailTransport, r as createResendEmailTransport, t as EmailDeliveryError } from "./email-6gJ8ibKp.js";
 import { DISPOSABLE_EMAIL_ERROR_CODE, INVALID_EMAIL_DOMAIN_ERROR_CODE, clearEmailDomainValidationCache, getEmailAddressDomain, getEmailAddressValidationErrorCode, isEmailAddressValid, validateEmailDomain } from "./email-validation/index.js";
+import { l as getFileReferencesCollectionName, s as getBucketName, y as resolveStoredUploadAccessScope } from "./shared-B1VLaHsk.js";
+import { r as deleteUploadFileReference } from "./fileReferences-Dcv9PTqD.js";
 import session from "express-session";
 import { RedisStore } from "connect-redis";
 import MongoStore from "connect-mongo";
 import { createClient } from "redis";
-import { MongoClient } from "mongodb";
+import { GridFSBucket, MongoClient, ObjectId } from "mongodb";
 import env from "@rpcbase/env";
 import { RtsSsrRuntimeProvider, SSR_ERROR_STATE_GLOBAL_KEY, STATIC_RPCBASE_RTS_HYDRATION_DATA_KEY, SsrErrorFallback, initApiClient, serializeSsrErrorState } from "@rpcbase/client";
 import { getMongoDirectConnection, getMongoUrl } from "@rpcbase/db/mongo";
@@ -22,6 +24,7 @@ import crypto, { scrypt } from "crypto";
 import httpProxy from "http-proxy-3";
 import inspector from "node:inspector";
 import { fileURLToPath } from "node:url";
+import { getTenantFilesystemDb, models } from "@rpcbase/db";
 import { Transform, Writable } from "node:stream";
 import { StrictMode, createElement } from "react";
 import { renderToPipeableStream, renderToStaticMarkup } from "react-dom/server";
@@ -7744,6 +7747,270 @@ var ssrMiddleware = ({ viteInstance, dataRoutes, errorExtraComponent, getHtmlOut
 	}
 };
 //#endregion
-export { DISPOSABLE_EMAIL_ERROR_CODE, EmailDeliveryError, INVALID_EMAIL_DOMAIN_ERROR_CODE, RPCBASE_SERVICE_WORKER_MESSAGE_SOURCE, RPCBASE_SERVICE_WORKER_PATH, bindShutdownSignals, clearEmailDomainValidationCache, configureEmailTransport, createResendEmailTransport, getDerivedKey, getEmailAddressDomain, getEmailAddressValidationErrorCode, hashPassword, hashPasswordForStorage, initServer, isEmailAddressValid, onShutdown, registerRpcbaseServiceWorkerRoute, rpcbaseServiceWorkerRequestHandler, rpcbaseServiceWorkerSource, sendEmail, ssrMiddleware, validateEmailDomain, verifyPasswordFromStorage };
+//#region src/accountDeletionUploads.ts
+var toTrimmedString$2 = (value) => typeof value === "string" ? value.trim() : "";
+var getNativeDb$1 = (connection) => {
+	if (!connection.db) throw new Error(`Mongo database '${connection.name}' is unavailable.`);
+	return connection.db;
+};
+var deleteGridFsFile = async (db, bucket, bucketName, fileId) => {
+	const variants = await db.collection(`${bucketName}.files`).find({ "metadata.variantOf": fileId.toHexString() }, { projection: { _id: 1 } }).toArray();
+	await bucket.delete(fileId);
+	for (const variant of variants) if (variant._id instanceof ObjectId) await bucket.delete(variant._id);
+};
+var removeUserFromSharedFile = async (files, fileId) => {
+	await files.updateMany({ $or: [{ _id: fileId }, { "metadata.variantOf": fileId.toHexString() }] }, { $unset: { "metadata.userId": "" } });
+};
+var deleteRpcbaseUserUploads = async (tenantId, userId) => {
+	const modelCtx = { tenantId };
+	const [UploadSession, UploadChunk] = await Promise.all([models.getUnsafe("RBUploadSession", modelCtx), models.getUnsafe("RBUploadChunk", modelCtx)]);
+	const uploadIds = (await UploadSession.find({ userId }, { _id: 1 }).lean()).map((session) => session._id);
+	const filesystemDb = getNativeDb$1(await getTenantFilesystemDb(tenantId));
+	const bucketName = getBucketName();
+	const references = filesystemDb.collection(getFileReferencesCollectionName(bucketName));
+	const userReferences = await references.find({ userId }).toArray();
+	for (const reference of userReferences) {
+		if (resolveStoredUploadAccessScope(reference) === "owner") {
+			await deleteUploadFileReference({
+				tenantId,
+				bucketName,
+				referenceId: reference._id
+			});
+			continue;
+		}
+		await references.updateOne({ _id: reference._id }, { $unset: { userId: "" } });
+	}
+	const files = filesystemDb.collection(`${bucketName}.files`);
+	const userFiles = await files.find({ "metadata.userId": userId }).toArray();
+	const bucket = userFiles.length > 0 ? new GridFSBucket(filesystemDb, { bucketName }) : null;
+	for (const file of userFiles) {
+		if (!(file._id instanceof ObjectId) || !bucket) continue;
+		const metadata = file.metadata ?? {};
+		const deduplication = metadata.deduplication;
+		const isDeduplicated = Boolean(deduplication && typeof deduplication === "object" && toTrimmedString$2(deduplication.key));
+		if (resolveStoredUploadAccessScope(metadata) === "owner" && !isDeduplicated) {
+			await deleteGridFsFile(filesystemDb, bucket, bucketName, file._id);
+			continue;
+		}
+		await removeUserFromSharedFile(files, file._id);
+	}
+	await Promise.all([uploadIds.length > 0 ? UploadChunk.deleteMany({ uploadId: { $in: uploadIds } }) : Promise.resolve(), UploadSession.deleteMany({ userId })]);
+};
+//#endregion
+//#region src/accountDeletion.ts
+var RpcbaseUserAccountNotFoundError = class extends Error {
+	constructor(userId) {
+		super(`RPCBase user account '${userId}' was not found.`);
+		this.name = "RpcbaseUserAccountNotFoundError";
+	}
+};
+var toTrimmedString$1 = (value) => typeof value === "string" ? value.trim() : "";
+var normalizeRequiredId = (value, label) => {
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`${label} is required.`);
+	return normalized;
+};
+var toStringArray = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.map(toTrimmedString$1).filter(Boolean);
+};
+var getTenantRoleIds = (value) => {
+	if (value instanceof Map) return Array.from(value.keys()).map(toTrimmedString$1).filter(Boolean);
+	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+	return Object.keys(value).map(toTrimmedString$1).filter(Boolean);
+};
+var getAccountTenantIds = (user) => Array.from(/* @__PURE__ */ new Set([...toStringArray(user.tenants), ...getTenantRoleIds(user.tenantRoles)]));
+var getNativeDb = (connection) => {
+	if (!connection.db) throw new Error(`Mongo database '${connection.name}' is unavailable.`);
+	return connection.db;
+};
+var listCollectionNames = async (connection) => {
+	return (await getNativeDb(connection).listCollections({}, { nameOnly: true }).toArray()).map((collection) => toTrimmedString$1(collection.name)).filter((collectionName) => collectionName && !collectionName.startsWith("system."));
+};
+var buildTenantMembershipFilter = (tenantId) => {
+	const clauses = [{ tenants: tenantId }];
+	if (!tenantId.includes(".") && !tenantId.startsWith("$")) clauses.push({ [`tenantRoles.${tenantId}`]: { $exists: true } });
+	return { $or: clauses };
+};
+var deleteRpcbaseTenantUserData = async (tenantId, userId) => {
+	const modelCtx = { tenantId };
+	const [Notification, NotificationDelivery, NotificationSettings] = await Promise.all([
+		models.getUnsafe("RBNotification", modelCtx),
+		models.getUnsafe("RBNotificationDelivery", modelCtx),
+		models.getUnsafe("RBNotificationSettings", modelCtx)
+	]);
+	await Promise.all([
+		Notification.deleteMany({ userId }),
+		NotificationDelivery.deleteMany({ userId }),
+		NotificationSettings.deleteMany({ userId }),
+		deleteRpcbaseUserUploads(tenantId, userId)
+	]);
+};
+var deleteTenantGlobalData = async (connection, collectionNames, userCollectionName, tenantId, session) => {
+	for (const collectionName of collectionNames) {
+		if (collectionName === userCollectionName) continue;
+		const collection = connection.collection(collectionName);
+		if (await collection.findOne({ tenantId }, {
+			projection: { _id: 1 },
+			session
+		})) await collection.deleteMany({ tenantId }, { session });
+	}
+};
+var deleteGlobalUserAccount = async ({ connection, users, userDocumentId }) => {
+	const collectionNames = await listCollectionNames(connection);
+	const session = await connection.startSession();
+	let result = {
+		tenantIds: [],
+		deletedTenantIds: []
+	};
+	try {
+		await session.withTransaction(async () => {
+			const user = await users.findOne({ _id: userDocumentId }, {
+				projection: {
+					_id: 1,
+					tenants: 1,
+					tenantRoles: 1
+				},
+				session
+			});
+			if (!user) throw new RpcbaseUserAccountNotFoundError(String(userDocumentId));
+			const tenantIds = getAccountTenantIds(user);
+			const deletedTenantIds = [];
+			for (const tenantId of tenantIds) if (!await users.findOne({
+				_id: { $ne: userDocumentId },
+				...buildTenantMembershipFilter(tenantId)
+			}, {
+				projection: { _id: 1 },
+				session
+			})) deletedTenantIds.push(tenantId);
+			for (const tenantId of deletedTenantIds) await deleteTenantGlobalData(connection, collectionNames, users.collectionName, tenantId, session);
+			if ((await users.deleteOne({ _id: userDocumentId }, { session })).deletedCount !== 1) throw new Error("RPCBase user account was not deleted.");
+			result = {
+				tenantIds,
+				deletedTenantIds
+			};
+		});
+		return result;
+	} finally {
+		await session.endSession();
+	}
+};
+var dropTenantDatabases = async (tenantId) => {
+	const tenantModel = await models.getUnsafe("RBNotification", { tenantId });
+	const filesystemConnection = await getTenantFilesystemDb(tenantId);
+	return (await Promise.allSettled([tenantModel.db.dropDatabase(), filesystemConnection.dropDatabase()])).every((result) => result.status === "fulfilled");
+};
+var deleteRpcbaseUserAccount = async ({ userId: rawUserId, deleteTenantUserData }) => {
+	const userId = normalizeRequiredId(rawUserId, "User ID");
+	const User = await models.getGlobal("RBUser", { req: { session: null } });
+	const account = await User.findById(userId, {
+		_id: 1,
+		tenants: 1,
+		tenantRoles: 1
+	}).lean();
+	if (!account?._id) throw new RpcbaseUserAccountNotFoundError(userId);
+	const initialTenantIds = getAccountTenantIds(account);
+	for (const tenantId of initialTenantIds) {
+		await deleteTenantUserData?.({
+			tenantId,
+			userId
+		});
+		await deleteRpcbaseTenantUserData(tenantId, userId);
+	}
+	const users = User.collection;
+	const globalDeletion = await deleteGlobalUserAccount({
+		connection: User.db,
+		users,
+		userDocumentId: account._id
+	});
+	const failedTenantDatabaseIds = [];
+	for (const tenantId of globalDeletion.deletedTenantIds) if (!await dropTenantDatabases(tenantId)) failedTenantDatabaseIds.push(tenantId);
+	return {
+		...globalDeletion,
+		failedTenantDatabaseIds
+	};
+};
+//#endregion
+//#region src/userSessionDeletion.ts
+var toTrimmedString = (value) => typeof value === "string" ? value.trim() : "";
+var getSessionStore = (value) => {
+	if (!value || typeof value !== "object") return null;
+	const candidate = value;
+	return typeof candidate.destroy === "function" ? candidate : null;
+};
+var getCurrentSession = (value) => {
+	if (!value || typeof value !== "object") return null;
+	const candidate = value;
+	return typeof candidate.destroy === "function" ? candidate : null;
+};
+var destroyStoredSession = async (store, sessionId) => {
+	await new Promise((resolve, reject) => {
+		store.destroy(sessionId, (error) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve();
+		});
+	});
+};
+var loadStoredSessions = async (store) => {
+	if (!store.all) return null;
+	return await new Promise((resolve, reject) => {
+		store.all?.((error, sessions) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(sessions ?? null);
+		});
+	});
+};
+var destroyOtherUserSessions = async (request, userId) => {
+	const store = getSessionStore(request.sessionStore);
+	if (!store?.all) return 0;
+	const storedSessions = await loadStoredSessions(store);
+	if (!storedSessions) return 0;
+	const currentSessionId = toTrimmedString(request.sessionID);
+	const sessionIds = (Array.isArray(storedSessions) ? storedSessions.map((session) => [toTrimmedString(session.id), session]) : Object.entries(storedSessions)).filter(([, session]) => toTrimmedString(session.user?.id) === userId).map(([sessionId]) => sessionId).filter((sessionId) => sessionId && sessionId !== currentSessionId);
+	await Promise.all(sessionIds.map((sessionId) => destroyStoredSession(store, sessionId)));
+	return sessionIds.length;
+};
+var destroyCurrentSession = async (request) => {
+	const session = getCurrentSession(request.session);
+	if (!session) return 0;
+	session.user = void 0;
+	await new Promise((resolve, reject) => {
+		session.destroy((error) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve();
+		});
+	});
+	return 1;
+};
+var destroyRpcbaseUserSessions = async ({ request, userId: rawUserId }) => {
+	const userId = rawUserId.trim();
+	if (!userId) throw new Error("User ID is required.");
+	const errors = [];
+	let destroyedSessionCount = 0;
+	try {
+		destroyedSessionCount += await destroyOtherUserSessions(request, userId);
+	} catch (error) {
+		errors.push(error);
+	}
+	try {
+		destroyedSessionCount += await destroyCurrentSession(request);
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length === 1) throw errors[0];
+	if (errors.length > 1) throw new AggregateError(errors, "Could not destroy every RPCBase user session.");
+	return { destroyedSessionCount };
+};
+//#endregion
+export { DISPOSABLE_EMAIL_ERROR_CODE, EmailDeliveryError, INVALID_EMAIL_DOMAIN_ERROR_CODE, RPCBASE_SERVICE_WORKER_MESSAGE_SOURCE, RPCBASE_SERVICE_WORKER_PATH, RpcbaseUserAccountNotFoundError, bindShutdownSignals, clearEmailDomainValidationCache, configureEmailTransport, createResendEmailTransport, deleteRpcbaseUserAccount, destroyRpcbaseUserSessions, getDerivedKey, getEmailAddressDomain, getEmailAddressValidationErrorCode, hashPassword, hashPasswordForStorage, initServer, isEmailAddressValid, onShutdown, registerRpcbaseServiceWorkerRoute, rpcbaseServiceWorkerRequestHandler, rpcbaseServiceWorkerSource, sendEmail, ssrMiddleware, validateEmailDomain, verifyPasswordFromStorage };
 
 //# sourceMappingURL=index.js.map