@solidxai/core 0.1.11 → 0.1.12-beta.1

package/src/services/active-session-storage.service.ts

@@ -0,0 +1,24 @@
+import { CACHE_MANAGER } from "@nestjs/cache-manager";
+import { Inject, Injectable } from "@nestjs/common";
+import { Cache } from "cache-manager";
+
+@Injectable()
+export class ActiveSessionStorageService {
+  constructor(@Inject(CACHE_MANAGER) private readonly cacheManager: Cache) {}
+
+  async setActiveSession(userId: number, sessionId: string): Promise<void> {
+    await this.cacheManager.set(this.getKey(userId), sessionId);
+  }
+
+  async getActiveSession(userId: number): Promise<string | undefined> {
+    return this.cacheManager.get(this.getKey(userId));
+  }
+
+  async clearActiveSession(userId: number): Promise<void> {
+    await this.cacheManager.del(this.getKey(userId));
+  }
+
+  private getKey(userId: number): string {
+    return `active-session-${userId}`;
+  }
+}

package/src/services/authentication.service.ts

@@ -39,6 +39,7 @@ import { SignUpDto } from "../dtos/sign-up.dto";
 import { User } from "../entities/user.entity";
 import { EventDetails, EventType } from "../interfaces";
 import { ActiveUserData } from "../interfaces/active-user-data.interface";
+import { ActiveSessionStorageService } from "./active-session-storage.service";
 import { HashingService } from "./hashing.service";
 import {
   InvalidatedRefreshTokenError,
@@ -74,6 +75,7 @@ export class AuthenticationService {
     private readonly userRepository: UserRepository,
     private readonly hashingService: HashingService,
     private readonly jwtService: JwtService,
+    private readonly activeSessionStorage: ActiveSessionStorageService,
     private readonly refreshTokenIdsStorage: RefreshTokenIdsStorageService,
     private readonly httpService: HttpService,
     // private readonly mailService: SMTPEMailService,
@@ -1711,8 +1713,16 @@ export class AuthenticationService {
   }
 
   async generateTokens(user: User) {
+    const sessionId = this.shouldPreventConcurrentLogins()
+      ? randomUUID()
+      : undefined;
+    if (sessionId) {
+      await this.activeSessionStorage.setActiveSession(user.id, sessionId);
+    } else {
+      await this.activeSessionStorage.clearActiveSession(user.id);
+    }
     const [accessToken, refreshToken] = await Promise.all([
-      await this.generateAccessToken(user),
+      await this.generateAccessToken(user, sessionId),
       await this.generateRefreshToken(user),
     ]);
 
@@ -1722,16 +1732,24 @@ export class AuthenticationService {
     };
   }
 
-  async generateAccessToken(user: User) {
+  async generateAccessToken(user: User, sessionId?: string) {
     // const userRoleNames = user.roles.map((role) => role.name).join(';')
     const userRoleNames = user.roles.map((role) => role.name);
+    const resolvedSessionId = this.shouldPreventConcurrentLogins()
+      ? sessionId ?? (await this.activeSessionStorage.getActiveSession(user.id))
+      : undefined;
 
     const accessTokenTtl =
       this.settingService.getConfigValue<SolidCoreSetting>("accessTokenTtl");
     const accessToken = await this.signToken<Partial<ActiveUserData>>(
       user.id,
       accessTokenTtl,
-      { username: user.username, email: user.email, roles: userRoleNames },
+      {
+        username: user.username,
+        email: user.email,
+        roles: userRoleNames,
+        ...(resolvedSessionId ? { sessionId: resolvedSessionId } : {}),
+      },
     );
 
     return accessToken;
@@ -2150,6 +2168,14 @@ export class AuthenticationService {
     );
   }
 
+  private shouldPreventConcurrentLogins(): boolean {
+    return (
+      this.settingService.getConfigValue<SolidCoreSetting>(
+        "preventConcurrentLogins",
+      ) === true
+    );
+  }
+
   private checkAccountBlocked(user: User): void {
     const maxFailedAttempts =
       this.settingService.getConfigValue<SolidCoreSetting>(
@@ -2206,6 +2232,7 @@ export class AuthenticationService {
 
       const userId = payload.sub;
       await this.refreshTokenIdsStorage.invalidate(userId);
+      await this.activeSessionStorage.clearActiveSession(userId);
       const user = await this.userRepository.findOne({
         where: {
           id: userId,

package/src/services/chatter-message.service.ts

@@ -23,6 +23,7 @@ import { ChatterMessage } from '../entities/chatter-message.entity';
 import { getMediaStorageProvider } from './mediaStorageProviders';
 import { RequestContextService } from './request-context.service';
 import { Logger } from '@nestjs/common';
+import { SolidIntrospectService } from './solid-introspect.service';
 
 @Injectable()
 export class ChatterMessageService extends CRUDService<ChatterMessage> {
@@ -50,6 +51,26 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         super(entityManager, repo, 'chatterMessage', 'solid-core', moduleRef);
     }
 
+    private getCoModelService(coModelName: string): CRUDService<any> {
+        const introspectService = this.moduleRef.get(SolidIntrospectService, { strict: false });
+        const modelSingularName = lowerFirst(coModelName);
+        const coModelService = introspectService?.getCRUDService(modelSingularName);
+        if (!coModelService) {
+            throw new BadRequestException(ERROR_MESSAGES.MODEL_SERVICE_NOT_FOUND(modelSingularName));
+        }
+        return coModelService;
+    }
+
+    private async assertRecordAccess(coModelName: string, coModelEntityId: number) {
+        const activeUser = this.requestContextService.getActiveUser();
+        if (!activeUser) {
+            throw new ForbiddenException(ERROR_MESSAGES.FORBIDDEN);
+        }
+
+        const coModelService = this.getCoModelService(coModelName);
+        await coModelService.findOne(coModelEntityId, {}, { activeUser });
+    }
+
     private resolveMessageUserId(userId?: number | null): number | null {
         if (userId) {
             return userId;
@@ -96,6 +117,8 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
             throw new NotFoundException(`Entity [solid-core.chatterMessage] with id ${id} not found`);
         }
 
+        await this.assertRecordAccess(message.coModelName, message.coModelEntityId);
+
         message.status = CHATTER_MESSAGE_STATUS.COMPLETED;
         return this.repo.save(message);
     }
@@ -111,6 +134,8 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
             throw new NotFoundException(`Entity [solid-core.chatterMessage] with id ${id} not found`);
         }
 
+        await this.assertRecordAccess(message.coModelName, message.coModelEntityId);
+
         if (!this.isEditableCustomNoteMessage(message)) {
             throw new BadRequestException('Only custom note messages can be edited.');
         }
@@ -193,17 +218,20 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
     }
 
     async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = []) {
+        const coModelName = lowerFirst(postDto.coModelName);
+        await this.assertRecordAccess(coModelName, postDto.coModelEntityId);
+
         const chatterMessage = new ChatterMessage();
         chatterMessage.messageType = CHATTER_MESSAGE_TYPE.CUSTOM;
         chatterMessage.messageSubType = postDto.messageSubType || CHATTER_MESSAGE_SUBTYPE.CUSTOM;
         chatterMessage.status = postDto.status ?? CHATTER_MESSAGE_STATUS.PENDING;
         chatterMessage.messageBody = postDto.messageBody;
         chatterMessage.coModelEntityId = postDto.coModelEntityId;
-        chatterMessage.coModelName = postDto.coModelName;
+        chatterMessage.coModelName = coModelName;
         chatterMessage.modelUserKey = postDto.modelUserKey ?? null;
 
         const model = await this.modelMetadataRepo.findOne({
-            where: { singularName: lowerFirst(postDto.coModelName) },
+            where: { singularName: coModelName },
             relations: { userKeyField: true }
         });
         chatterMessage.modelDisplayName = model?.displayName ?? null;
@@ -683,6 +711,8 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         const { limit = 25, offset = 0, populate = [], populateMedia = [], filters } = query;
         this.logHeapUsed('getChatterMessages-start');
 
+        await this.assertRecordAccess(lowerFirst(entityName), entityId);
+
         const model = await this.modelMetadataRepo.findOne({
             where: {
                 singularName: entityName

package/src/services/crud.service.ts

@@ -232,6 +232,7 @@ export class CRUDService<T extends CommonEntity> { // Add two generic value i.e
         // 5. Save the entity
         // For media, we need to use a storage provider and save the media, then save the associated uri against the entity or media table
         const mergedEntity = this.repo.merge(entity, updateDto);
+        delete mergedEntity.updatedAt;
         const savedEntity = await this.repo.save(mergedEntity) as T;
 
         //FIXME: Skip the many-to-many, and instead fire differential updates and avoid loading the entire association graph for the ids

package/src/services/refresh-token-ids-storage.service.ts

@@ -6,6 +6,11 @@ import { AuthenticationService } from './authentication.service';
 // TODO: Ideally this should be in a separate file - putting this here for brevity
 export class InvalidatedRefreshTokenError extends Error { }
 
+type RefreshTokenState = {
+    currentRefreshToken: string;
+    previousRefreshToken: string;
+};
+
 @Injectable()
 // export class RefreshTokenIdsStorageService implements OnApplicationBootstrap, OnApplicationShutdown {
 export class RefreshTokenIdsStorageService {
@@ -29,10 +34,7 @@ export class RefreshTokenIdsStorageService {
     ) { }
 
     async insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void> {
-        // TODO: save a refresh token object with this shape {"currentRefreshToken": "", "previousRefreshToken": ""}
-        // Save a refresh token object with the shape: { currentRefreshToken: string, previousRefreshToken: string }
-        const existing = (await this.cacheManager.get(this.getKey(userId))) as { currentRefreshToken?: string, previousRefreshToken?: string } | undefined;
-        const refreshTokenState = {
+        const refreshTokenState: RefreshTokenState = {
             currentRefreshToken: refreshToken,
             previousRefreshToken: previousRefreshToken ?? "",
         };
@@ -58,8 +60,7 @@ export class RefreshTokenIdsStorageService {
 
         // TODO: Assume you get this shape out of the cache {"currentRefreshToken": "", "previousRefreshToken": ""}
         // Then you will compare against the currentRefreshToken.
-        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id));
-        console.log("refreshTokenState", refreshTokenState);
+        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id)) as RefreshTokenState | undefined;
 
         // Use the authentication service to generate a new refresh token, set it in the currentRefreshToken in scenario 1 and return.
 
@@ -108,7 +109,7 @@ export class RefreshTokenIdsStorageService {
                 valid = true;
                 // Do not modify cache
                 // Generate new refresh token based on currentRefreshToken
-                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id))) as { currentRefreshToken?: string, previousRefreshToken?: string } | undefined;
+                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id))) as RefreshTokenState | undefined;
                 newRefreshToken = existingRefreshTokenState?.currentRefreshToken;
             }
         }
@@ -126,7 +127,7 @@ export class RefreshTokenIdsStorageService {
         return `user-${userId}`;
     }
 
-    getCurrentRefreshTokenState(userId: number): Promise<any> {
+    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined> {
         return this.cacheManager.get(this.getKey(userId));
     }
 }

package/src/services/settings/default-settings-provider.service.ts

@@ -1201,7 +1201,16 @@ const getSolidCoreSettings = (isProd: boolean) =>
       value: parseInt(process.env.IAM_JWT_REFRESH_TOKEN_TTL ?? "604800", 10),
       level: SettingLevel.SystemEnv,
     },
-
+    {
+      moduleName: "solid-core",
+      key: "preventConcurrentLogins",
+      value: false,
+      level: SettingLevel.SystemAdminEditable,
+      label: "Prevent Concurrent Logins",
+      group: "authentication-settings",
+      sortOrder: 200,
+      controlType: "boolean",
+    },
     // queues-settings-provider.service.ts
     {
       moduleName: "solid-core",

package/src/solid-core.module.ts

@@ -153,6 +153,7 @@ import { TwilioSmsQueueSubscriberRedis } from "./jobs/redis/twilio-sms-subscribe
 import { UserRegistrationListener } from "./listeners/user-registration.listener";
 import { GoogleOauthStrategy } from "./passport-strategies/google-oauth.strategy";
 import { ApiKeyService } from "./services/api-key.service";
+import { ActiveSessionStorageService } from "./services/active-session-storage.service";
 import { AuthenticationService } from "./services/authentication.service";
 import { BcryptService } from "./services/bcrypt.service";
 import { UuidExternalIdEntityComputedFieldProvider } from "./services/computed-fields/entity/uuid-externalid-entity-computed-field-provider.service";
@@ -647,6 +648,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     AccessTokenGuard,
     ApiKeyGuard,
     ApiKeyService,
+    ActiveSessionStorageService,
     AuthenticationService,
     GoogleAuthenticationController,
     RefreshTokenIdsStorageService,