@twasik4/pocket-service 1.0.3 → 1.1.0

package/src/workers/auth/strategies.ts

@@ -1,304 +0,0 @@
-import { Request } from "express";
-import { createRemoteJWKSet, JWTPayload, jwtVerify } from "jose";
-import { PeerCertificate, TLSSocket } from "tls";
-import {
-  AuthenticatedUser,
-  AuthStrategy,
-  RouteDefinition,
-} from "../express-types";
-
-type JwtClaimValue = string | string[] | number | boolean | null | undefined;
-
-export type JwtStrategyClaims = {
-  sub?: string;
-  [key: string]: unknown;
-};
-
-export type JwtTokenVerifier = (
-  token: string,
-  req: Request,
-  route: RouteDefinition<any, any, boolean>,
-) => JwtStrategyClaims | null | Promise<JwtStrategyClaims | null>;
-
-export type CreateJwtAuthStrategyOptions = {
-  name?: string;
-  headerName?: string;
-  tokenPrefix?: string;
-  verifyToken: JwtTokenVerifier;
-  mapPayloadToUser?: (
-    claims: JwtStrategyClaims,
-    req: Request,
-    route: RouteDefinition<any, any, boolean>,
-  ) => AuthenticatedUser | null | Promise<AuthenticatedUser | null>;
-  canHandle?: AuthStrategy["canHandle"];
-};
-
-export type CreateJoseJwtVerifierOptions = {
-  jwksUri?: string;
-  secret?: string | Uint8Array;
-  issuer?: string | string[];
-  audience?: string | string[];
-  algorithms?: string[];
-  clockTolerance?: string | number;
-  requiredClaims?: string[];
-};
-
-export type CreateMtlsAuthStrategyOptions = {
-  name?: string;
-  requireAuthorized?: boolean;
-  mapCertificateToUser?: (
-    certificate: PeerCertificate,
-    req: Request,
-    route: RouteDefinition<any, any, boolean>,
-  ) => AuthenticatedUser | null | Promise<AuthenticatedUser | null>;
-  canHandle?: AuthStrategy["canHandle"];
-};
-
-function readAuthTokenFromHeader(
-  req: Request,
-  headerName: string,
-  tokenPrefix: string,
-): string | null {
-  const header = req.headers[headerName.toLowerCase()];
-
-  if (typeof header !== "string") {
-    return null;
-  }
-
-  const value = header.trim();
-  if (!value) {
-    return null;
-  }
-
-  if (!tokenPrefix) {
-    return value;
-  }
-
-  const prefix = `${tokenPrefix} `;
-  if (!value.startsWith(prefix)) {
-    return null;
-  }
-
-  return value.slice(prefix.length).trim() || null;
-}
-
-function isUserValue(
-  value: unknown,
-): value is Exclude<JwtClaimValue, null | undefined> {
-  return (
-    typeof value === "string" ||
-    typeof value === "number" ||
-    typeof value === "boolean" ||
-    (Array.isArray(value) && value.every((v) => typeof v === "string"))
-  );
-}
-
-function claimsToAuthenticatedUser(
-  claims: JwtStrategyClaims,
-): AuthenticatedUser | null {
-  if (typeof claims.sub !== "string" || claims.sub.length === 0) {
-    return null;
-  }
-
-  const user: AuthenticatedUser = { userId: claims.sub };
-  for (const [key, value] of Object.entries(claims)) {
-    if (key === "sub") {
-      continue;
-    }
-
-    if (isUserValue(value)) {
-      user[key] = value;
-    }
-  }
-
-  return user;
-}
-
-function jwtPayloadToStrategyClaims(payload: JWTPayload): JwtStrategyClaims {
-  const claims: JwtStrategyClaims = {};
-
-  for (const [key, value] of Object.entries(payload)) {
-    claims[key] = value;
-  }
-
-  if (typeof payload.sub === "string") {
-    claims.sub = payload.sub;
-  }
-
-  return claims;
-}
-
-function hasRequiredClaims(payload: JWTPayload, requiredClaims: string[]) {
-  return requiredClaims.every((claim) => payload[claim] !== undefined);
-}
-
-export function createJoseJwtVerifier(
-  options: CreateJoseJwtVerifierOptions,
-): JwtTokenVerifier {
-  const requiredClaims = options.requiredClaims ?? ["sub"];
-  const jwtVerifyOptions = {
-    issuer: options.issuer,
-    audience: options.audience,
-    algorithms: options.algorithms,
-    clockTolerance: options.clockTolerance,
-  };
-
-  if (options.jwksUri) {
-    const jwksKeySource = createRemoteJWKSet(new URL(options.jwksUri));
-
-    return async (token) => {
-      try {
-        const { payload } = await jwtVerify(
-          token,
-          jwksKeySource,
-          jwtVerifyOptions,
-        );
-
-        if (!hasRequiredClaims(payload, requiredClaims)) {
-          return null;
-        }
-
-        return jwtPayloadToStrategyClaims(payload);
-      } catch {
-        return null;
-      }
-    };
-  }
-
-  const secretKey =
-    typeof options.secret === "string"
-      ? new TextEncoder().encode(options.secret)
-      : options.secret;
-
-  if (!(secretKey instanceof Uint8Array)) {
-    throw new Error("createJoseJwtVerifier requires either jwksUri or secret.");
-  }
-
-  return async (token) => {
-    try {
-      const { payload } = await jwtVerify(token, secretKey, jwtVerifyOptions);
-
-      if (!hasRequiredClaims(payload, requiredClaims)) {
-        return null;
-      }
-
-      return jwtPayloadToStrategyClaims(payload);
-    } catch {
-      return null;
-    }
-  };
-}
-
-function parseSubjectAltNames(subjectAltName?: string): string[] {
-  if (!subjectAltName) {
-    return [];
-  }
-
-  return subjectAltName
-    .split(",")
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-}
-
-function resolveMtlsIdentity(certificate: PeerCertificate): string | null {
-  const sans = parseSubjectAltNames(certificate.subjectaltname);
-  const uriSan = sans.find((value) => value.startsWith("URI:"));
-  if (uriSan) {
-    return uriSan.slice(4).trim() || null;
-  }
-
-  const dnsSan = sans.find((value) => value.startsWith("DNS:"));
-  if (dnsSan) {
-    return dnsSan.slice(4).trim() || null;
-  }
-
-  const subjectCn = certificate.subject?.CN;
-  if (typeof subjectCn === "string" && subjectCn.length > 0) {
-    return subjectCn;
-  }
-  if (Array.isArray(subjectCn) && subjectCn.length > 0) {
-    const first = subjectCn[0];
-    if (typeof first === "string" && first.length > 0) {
-      return first;
-    }
-  }
-
-  if (certificate.fingerprint256) {
-    return certificate.fingerprint256;
-  }
-
-  return null;
-}
-
-export function createJwtAuthStrategy(
-  options: CreateJwtAuthStrategyOptions,
-): AuthStrategy {
-  const headerName = options.headerName ?? "authorization";
-  const tokenPrefix = options.tokenPrefix ?? "Bearer";
-
-  return {
-    name: options.name ?? "jwt",
-    canHandle: options.canHandle,
-    authenticate: async (req, route) => {
-      const token = readAuthTokenFromHeader(req, headerName, tokenPrefix);
-      if (!token) {
-        return null;
-      }
-
-      const claims = await options.verifyToken(token, req, route);
-      if (!claims) {
-        return null;
-      }
-
-      if (options.mapPayloadToUser) {
-        return options.mapPayloadToUser(claims, req, route);
-      }
-
-      return claimsToAuthenticatedUser(claims);
-    },
-  };
-}
-
-export function createMtlsAuthStrategy(
-  options: CreateMtlsAuthStrategyOptions = {},
-): AuthStrategy {
-  const requireAuthorized = options.requireAuthorized ?? true;
-
-  return {
-    name: options.name ?? "mtls",
-    canHandle: options.canHandle,
-    authenticate: async (req, route) => {
-      const socket = req.socket as TLSSocket;
-      if (typeof socket.getPeerCertificate !== "function") {
-        return null;
-      }
-
-      if (requireAuthorized && socket.authorized !== true) {
-        return null;
-      }
-
-      const certificate = socket.getPeerCertificate(true);
-      if (!certificate || Object.keys(certificate).length === 0) {
-        return null;
-      }
-
-      if (options.mapCertificateToUser) {
-        return options.mapCertificateToUser(certificate, req, route);
-      }
-
-      const userId = resolveMtlsIdentity(certificate);
-      if (!userId) {
-        return null;
-      }
-
-      return {
-        userId,
-        certSubjectCn: certificate.subject?.CN ?? "",
-        certIssuerCn: certificate.issuer?.CN ?? "",
-        certFingerprint256: certificate.fingerprint256 ?? "",
-        certSerialNumber: certificate.serialNumber ?? "",
-        mtlsAuthorized: socket.authorized,
-      };
-    },
-  };
-}

package/src/workers/db/clickhouse/index.ts

@@ -1,76 +0,0 @@
-import { createClient } from "@clickhouse/client";
-
-export interface ClickhouseTable<TSchema extends Record<string, any>> {
-  name: string;
-  createSQL: string;
-  schema: () => TSchema;
-}
-
-export interface ClickhouseConfig<
-  TTables extends Record<string, ClickhouseTable<any>>
-> {
-  url: string;
-  username?: string;
-  password?: string;
-  tables: TTables;
-}
-
-export function createTypedClickhouse<
-  TTables extends Record<string, ClickhouseTable<any>>
->(config: ClickhouseConfig<TTables>) {
-  const client = createClient({
-    host: config.url,
-    username: config.username,
-    password: config.password,
-  });
-
-  async function ensureTables() {
-    for (const { createSQL } of Object.values(config.tables || {})) {
-      await client.command({ query: createSQL });
-    }
-  }
-
-  const api = Object.fromEntries(
-    Object.entries(config.tables || {}).map(([key, table]) => {
-      type Row = ReturnType<typeof table.schema>;
-      type Filter = Partial<Row>;
-
-      const select = async (where?: Filter): Promise<Row[]> => {
-        let query = `SELECT * FROM ${table.name}`;
-        if (where && Object.keys(where).length > 0) {
-          const conditions = Object.keys(where)
-            .map(([k, value]) => {
-              if (typeof value === "string") return `${k} = '${value}'`;
-              return `${k} = ${value}`;
-            })
-            .join(" AND ");
-          query += ` WHERE ${conditions}`;
-        }
-        const res = await client.query({
-          query,
-        });
-        const rows = await res.json<{ data: any[] }>();
-        return rows.data as Row[];
-      };
-
-      const insert = async (rows: Row[]) => {
-        await client.insert({
-          table: table.name,
-          values: rows,
-          format: "JSONEachRow",
-        });
-      };
-
-      return [key, { select, insert }];
-    })
-  ) as {
-    [K in keyof TTables]: {
-      select(
-        where?: Partial<ReturnType<TTables[K]["schema"]>>
-      ): Promise<ReturnType<TTables[K]["schema"]>[]>;
-      insert(rows: ReturnType<TTables[K]["schema"]>[]): Promise<void>;
-    };
-  };
-
-  return { client, ensureTables, ...api };
-}

package/src/workers/db/mongo/collection.ts

@@ -1,292 +0,0 @@
-import {
-  Collection,
-  Document,
-  Filter,
-  ObjectId,
-  OptionalUnlessRequiredId,
-  UpdateFilter,
-  WithId,
-} from "mongodb";
-
-export type SchemaParser<T extends Document> = {
-  parse: (input: unknown) => T;
-  shape?: unknown;
-  _def?: {
-    shape?: unknown | (() => unknown);
-  };
-};
-
-export class CollectionWrapper<T extends Document> {
-  constructor(
-    private readonly collection: Collection<T>,
-    private readonly schema?: SchemaParser<T>,
-    private readonly revision?: Collection<T>,
-  ) {}
-
-  private parseWrite(doc: unknown): T {
-    if (!this.schema) {
-      return doc as T;
-    }
-    return this.schema.parse(doc);
-  }
-
-  private parseRead(doc: WithId<T>): WithId<T> {
-    if (!this.schema) {
-      return doc;
-    }
-
-    const parsed = this.schema.parse(doc) as T;
-
-    return {
-      ...(parsed as Document),
-      _id: doc._id,
-    } as WithId<T>;
-  }
-
-  private async trackRevision(doc: T) {
-    if (this.revision) {
-      const clone = {
-        ...doc,
-        _id: new ObjectId(),
-      } as OptionalUnlessRequiredId<T>;
-      await this.revision.insertOne(clone);
-    }
-  }
-
-  /**
-   * Get all documents from the collection.
-   * @param filter - The filter to find documents to retrieve. If no filter is provided, it will return all documents in the collection.
-   * @returns
-   */
-  async get(filter: Filter<T> = {}): Promise<WithId<T>[]> {
-    try {
-      if (this.hasProperty("deletedAt")) {
-        // If the schema has a `deletedAt` field, filter out soft-deleted documents
-        filter = { ...filter, deletedAt: { $exists: false } };
-      }
-      const result = await this.collection.find(filter).toArray();
-      return result.map((doc) => this.parseRead(doc));
-    } catch (err) {
-      return [];
-    }
-  }
-
-  /**
-   * Get a single document from the collection.
-   * @param filter - The filter to find the document to retrieve. If no filter is provided, it will return the first document in the collection.
-   * @returns
-   */
-  async getOne(filter: Filter<T> = {}): Promise<WithId<T> | null> {
-    try {
-      if (this.hasProperty("deletedAt")) {
-        // If the schema has a `deletedAt` field, filter out soft-deleted documents
-        filter = { ...filter, deletedAt: { $exists: false } };
-      }
-      const result = await this.collection.findOne(filter);
-      return result ? this.parseRead(result) : null;
-    } catch (err) {
-      return null;
-    }
-  }
-
-  /**
-   * Get all revisions for a document.
-   * @param filter - The filter to find revisions to retrieve. If no filter is provided, it will return all revisions in the revision collection.
-   * @returns An array of revision documents.
-   */
-  async getRevisions(filter: Filter<T> = {}): Promise<WithId<T>[]> {
-    try {
-      if (!this.revision) {
-        return [];
-      }
-      const result = await this.revision
-        .find(filter, { sort: { revision: 1 } })
-        .toArray();
-      return result.map((doc) => this.parseRead(doc as WithId<T>));
-    } catch (err) {
-      return [];
-    }
-  }
-
-  /**
-   * Get the most recent revision for a document.
-   * @returns Revision document or null if no revisions exist or if revision tracking is not enabled.
-   */
-  async getMostRecentRevision(): Promise<WithId<T> | null> {
-    try {
-      if (!this.revision) {
-        return null;
-      }
-      const result = await this.revision
-        .find({}, { sort: { revision: -1 } })
-        .limit(1)
-        .toArray();
-      return result.length > 0 ? this.parseRead(result[0] as WithId<T>) : null;
-    } catch (err) {
-      return null;
-    }
-  }
-
-  /**
-   * Insert a document into the collection.
-   *
-   * If this collection has revision tracking enabled, it will also insert the document into the revision collection.
-   *
-   * @param doc - The document to insert into the collection.
-   */
-  async insert(doc: T): Promise<void> {
-    try {
-      const parsed = this.parseWrite(doc);
-      await this.collection.insertOne(parsed as OptionalUnlessRequiredId<T>);
-      await this.trackRevision(parsed);
-    } catch (err) {
-      throw new Error(`Failed to insert document: ${(err as Error).message}`);
-    }
-  }
-
-  /**
-   * Update multiple documents by filter with a partial document.
-   * @param filter - The filter to find documents to update.
-   * @param update - The partial document to update.
-   */
-  async update(filter: Filter<T>, update: Partial<T>): Promise<void> {
-    try {
-      const existing = await this.collection.find(filter).toArray();
-      if (!existing.length) return;
-
-      await this.collection.updateMany(filter, { $set: update });
-
-      // record updated versions in revisions
-      if (this.revision) {
-        const updatedDocs = existing.map((doc) => ({
-          ...doc,
-          ...update,
-          _id: new ObjectId(),
-        }));
-        await this.revision.insertMany(
-          updatedDocs as OptionalUnlessRequiredId<T>[],
-        );
-      }
-    } catch (err) {
-      throw new Error(`Failed to update documents: ${(err as Error).message}`);
-    }
-  }
-
-  /**
-   * Update a single document by filter with a partial document. This will automatically set the `updatedAt` field to the current date if it exists in the schema, and increment the `revision` field by 1 if it exists in the schema. It will also insert the updated document into the revision collection if revision tracking is enabled.
-   * @param filter - The filter to find the document to update.
-   * @param update - The partial document to update.
-   */
-  async updateOne(filter: Filter<T>, update: Partial<T>): Promise<void> {
-    try {
-      const incomingUpdate = this.hasProperty("updatedAt")
-        ? { ...update, updatedAt: new Date() }
-        : update;
-      const updateDoc = {
-        $set: incomingUpdate,
-        ...(this.revision ? { $inc: { revision: 1 } } : {}),
-      } as UpdateFilter<T>;
-
-      await this.collection.updateOne(filter, updateDoc);
-      if (this.revision) {
-        await this.collection
-          .aggregate([
-            {
-              $match: filter,
-            },
-            {
-              $set: { ...update, _id: new ObjectId() },
-            },
-            {
-              $merge: {
-                into: {
-                  db: this.collection.dbName,
-                  col: this.revision.collectionName,
-                  on: "_id",
-                  whenNotMatched: "insert",
-                },
-              },
-            },
-          ])
-          .toArray();
-      }
-    } catch (err) {
-      console.error("Failed to update document:", err);
-      throw new Error(`Failed to update document: ${(err as Error).message}`);
-    }
-  }
-
-  /**
-   * Soft delete a document by setting the `deletedAt` field to the current date.
-   * If the schema does not have a `deletedAt` field, it will perform a hard delete.
-   * @param filter - The filter to find documents to delete.
-   */
-  async delete(filter: Filter<T>): Promise<void> {
-    try {
-      if (this.hasProperty("deletedAt")) {
-        const deletedAt = new Date();
-        const update = {
-          $set: {
-            deletedAt,
-          },
-        } as unknown as UpdateFilter<T>;
-        await this.collection.updateMany(filter, update);
-        if (this.revision) {
-          await this.collection
-            .aggregate([
-              {
-                $match: filter,
-              },
-              {
-                $set: { _id: new ObjectId(), deletedAt },
-              },
-              {
-                $merge: {
-                  into: {
-                    db: this.collection.dbName,
-                    col: this.revision.collectionName,
-                    on: "_id",
-                    whenNotMatched: "insert",
-                  },
-                },
-              },
-            ])
-            .toArray();
-        }
-      } else {
-        await this.collection.deleteMany(filter);
-      }
-    } catch (err) {
-      throw new Error(`Failed to delete documents: ${(err as Error).message}`);
-    }
-  }
-
-  /**
-   * Checks if the schema has a given property.
-   * @param schema - The Zod schema to check against.
-   * @param property - The property to check for in the schema.
-   * @returns
-   */
-  private hasProperty(property: string): boolean {
-    if (!this.schema) {
-      return false;
-    }
-
-    const schemaLike = this.schema as SchemaParser<T>;
-    const shapeSource =
-      schemaLike.shape ??
-      (typeof schemaLike._def?.shape === "function"
-        ? schemaLike._def.shape()
-        : schemaLike._def?.shape);
-
-    if (
-      shapeSource !== null &&
-      typeof shapeSource === "object" &&
-      !Array.isArray(shapeSource)
-    ) {
-      return property in shapeSource;
-    }
-
-    return false;
-  }
-}