@unchainedshop/api 2.0.0-beta7 → 2.0.0-beta9

package/src/express/createApolloMiddleware.ts

@@ -0,0 +1,40 @@
+import cors from 'cors';
+import { expressMiddleware } from '@apollo/server/express4';
+import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.mjs';
+import e from 'express';
+
+export default function createApolloMiddleware(
+  contextResolver,
+  { apolloGraphQLServer, corsOrigins = undefined },
+) {
+  const originFn =
+    corsOrigins && Array.isArray(corsOrigins)
+      ? (origin, callback) => {
+          if (corsOrigins.length === 0 || !origin) {
+            callback(null, true);
+            return;
+          }
+          if (corsOrigins.indexOf(origin) !== -1) {
+            callback(null, true);
+          } else {
+            callback(new Error('Not allowed by CORS'));
+          }
+        }
+      : corsOrigins;
+
+  return [
+    cors(
+      !originFn
+        ? undefined
+        : {
+            origin: originFn,
+            credentials: true,
+          },
+    ),
+    e.json(),
+    graphqlUploadExpress({ maxFileSize: 10000000, maxFiles: 10 }),
+    expressMiddleware(apolloGraphQLServer, {
+      context: contextResolver,
+    }),
+  ];
+}

package/src/express/createBulkImportMiddleware.ts

@@ -0,0 +1,87 @@
+import { createLogger } from '@unchainedshop/logger';
+import { UnchainedContextResolver } from '@unchainedshop/types/api';
+import fs from 'fs';
+import { checkAction } from '../acl';
+import { actions } from '../roles';
+
+const logger = createLogger('unchained:bulk-import');
+
+const { BULK_IMPORT_PAYLOAD_CACHE_DIRECTORY } = process.env;
+
+const errorHandler = (res) => (e) => {
+  logger.error(e.message);
+  res.writeHead(503);
+  res.end(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+};
+
+const methodWrongHandler = (res) => () => {
+  logger.error('Method not supported, return 404');
+  res.writeHead(404);
+  res.end();
+};
+
+const createWriteStreamToFilesystem = (cacheDirectory) => {
+  const date = new Date().toISOString();
+  const payloadFilePath = `${cacheDirectory}/${date}.json`;
+  const stream = fs.createWriteStream(payloadFilePath, { flags: 'a' });
+  return stream;
+};
+
+const createWriteStreamToMongoDB = (BulkImportPayloads) => {
+  const date = new Date().toISOString();
+  const stream = BulkImportPayloads.openUploadStreamWithId(date, `${date}.json`, {
+    contentType: 'application/json',
+  });
+  return stream;
+};
+
+export default function bulkImportMiddleware(contextResolver: UnchainedContextResolver) {
+  return async (req, res) => {
+    try {
+      if (req.method !== 'POST') {
+        methodWrongHandler(res)();
+        return;
+      }
+
+      const context = await contextResolver({ req, res });
+      await checkAction(context, (actions as any).bulkImport);
+
+      const input: any = {
+        createShouldUpsertIfIDExists: !!req.query?.createShouldUpsertIfIDExists,
+        skipCacheInvalidation: !!req.query?.skipCacheInvalidation,
+        fsPayloadCacheDirectory: BULK_IMPORT_PAYLOAD_CACHE_DIRECTORY,
+        remoteAddress: context.remoteAddress,
+      };
+
+      const stream = input.fsPayloadCacheDirectory
+        ? createWriteStreamToFilesystem(input.fsPayloadCacheDirectory)
+        : createWriteStreamToMongoDB(context.bulkImporter.BulkImportPayloads);
+
+      req
+        .pipe(stream)
+        .on('error', errorHandler(res))
+        .on('finish', async (file) => {
+          try {
+            if (input.fsPayloadCacheDirectory) {
+              input.payloadFilePath = stream.path;
+            } else {
+              input.payloadId = file._id;
+              input.payloadSize = file.length;
+            }
+            const work = await context.modules.worker.addWork({
+              type: 'BULK_IMPORT',
+              input: Object.fromEntries(Object.entries(input).filter(([, value]) => Boolean(value))),
+              retries: 0,
+              priority: 10,
+            });
+            res.writeHead(200);
+            res.end(JSON.stringify(work));
+          } catch (e) {
+            errorHandler(res)(e);
+          }
+        });
+    } catch (e) {
+      errorHandler(res)(e);
+    }
+  };
+}

package/src/express/createERCMetadataMiddleware.ts

@@ -0,0 +1,73 @@
+import { createLogger } from '@unchainedshop/logger';
+import { UnchainedContextResolver } from '@unchainedshop/types/api';
+import { systemLocale } from '@unchainedshop/utils';
+import { IncomingMessage } from 'http';
+import localePkg from 'locale';
+import path from 'path';
+
+const { Locale } = localePkg;
+
+const logger = createLogger('unchained:erc-metadata');
+
+const errorHandler = (res) => (e) => {
+  logger.error(e.message);
+  res.writeHead(503);
+  res.end(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+};
+
+const methodWrongHandler = (res) => () => {
+  logger.error('Method not supported, return 404');
+  res.writeHead(404);
+  res.end();
+};
+
+export default function ercMetadataMiddleware(contextResolver: UnchainedContextResolver) {
+  return async (req: IncomingMessage, res) => {
+    try {
+      if (req.method !== 'GET') {
+        methodWrongHandler(res)();
+        return;
+      }
+
+      const context = await contextResolver({ req, res });
+      const url = new URL(req.url, process.env.ROOT_URL);
+      const parsedPath = path.parse(url.pathname);
+
+      if (parsedPath.ext !== '.json') throw new Error('Invalid ERC Metadata URI');
+
+      const [, productId, localeOrTokenFilename, tokenFileName] = url.pathname.split('/');
+
+      const locale = tokenFileName ? localeOrTokenFilename : systemLocale.language;
+      const chainTokenId = parsedPath.name;
+
+      const product = await context.modules.products.findProduct({
+        productId,
+      });
+
+      const [token] = await context.modules.warehousing.findTokens({
+        chainTokenId,
+        contractAddress: product?.tokenization?.contractAddress,
+      });
+
+      const ercMetadata = await context.modules.warehousing.tokenMetadata(
+        chainTokenId,
+        {
+          token,
+          product,
+          locale: new Locale(locale),
+          referenceDate: new Date(),
+        },
+        context,
+      );
+
+      const body = JSON.stringify(ercMetadata);
+      res.writeHead(200, {
+        'Content-Length': Buffer.byteLength(body),
+        'Content-Type': 'text/plain',
+      });
+      res.end(body);
+    } catch (e) {
+      errorHandler(res)(e);
+    }
+  };
+}

package/src/express/createSingleSignOnMiddleware.ts

@@ -0,0 +1,84 @@
+/// <reference lib="dom" />
+import { createLogger } from '@unchainedshop/logger';
+import { UnchainedContextResolver } from '@unchainedshop/types/api';
+import { IncomingMessage } from 'http';
+import cookie from 'cookie';
+import { UnchainedCore } from '@unchainedshop/types/core';
+
+const { ROOT_URL, NODE_ENV, UNCHAINED_CLOUD_ENDPOINT } = process.env;
+
+const logger = createLogger('unchained:unchained-cloud-sso');
+
+const loginWithSingleSignOn = async (remoteToken, context: UnchainedCore) => {
+  const domain = process.env.UNCHAINED_COOKIE_DOMAIN || new URL(ROOT_URL).hostname || 'localhost';
+  const result = await fetch(UNCHAINED_CLOUD_ENDPOINT, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({
+      operationName: 'consume',
+      variables: {
+        token: remoteToken,
+      },
+      query:
+        'mutation consume($token: ID!) { controlConsumeSingleSignOnToken(token: $token) { domain } }',
+    }),
+  });
+  const json: any = await result.json();
+  if (json?.errors?.length > 0) {
+    throw new Error(json.errors[0].message);
+  }
+
+  if (domain === 'localhost' || domain === json?.data?.controlConsumeSingleSignOnToken?.domain) {
+    // create sso user if not exist and login
+    const ssoUserId =
+      (await context.modules.users.findUser({ username: 'sso' }))?._id ||
+      (await context.modules.accounts.createUser(
+        {
+          username: 'sso',
+          roles: ['admin'],
+          email: 'sso@unchained.local',
+          password: null,
+          guest: false,
+        },
+        { skipMessaging: true },
+      ));
+    const { tokenExpires, token } = await context.modules.accounts.createLoginToken(ssoUserId, context);
+    const expires = new Date(tokenExpires || new Date().getTime() + 100000);
+    const authCookie = cookie.serialize(process.env.UNCHAINED_COOKIE_NAME, token, {
+      domain,
+      httpOnly: true,
+      expires,
+      path: '/',
+      sameSite: 'strict',
+      secure: NODE_ENV === 'production',
+    });
+
+    return authCookie;
+  }
+  throw new Error('Invalid token/domain pair');
+};
+
+export default function singleSignOnMiddleware(contextResolver: UnchainedContextResolver) {
+  return async (req: IncomingMessage & { query?: any }, res, next) => {
+    try {
+      if (req.query?.token) {
+        const context = await contextResolver({ req, res });
+        const authCookie = await loginWithSingleSignOn(req.query.token, context);
+
+        if (authCookie) {
+          res.writeHead(303, {
+            'Set-Cookie': authCookie,
+            Location: '/',
+          });
+          res.end();
+          return;
+        }
+      }
+    } catch (e) {
+      logger.error(e.message);
+    }
+    next();
+  };
+}

package/src/express/index.ts

@@ -0,0 +1,48 @@
+import { UnchainedCore } from '@unchainedshop/types/core';
+import { IncomingMessage, OutgoingMessage } from 'http';
+import { ApolloServer } from '@apollo/server';
+import type e from 'express';
+import { getCurrentContextResolver } from '../context';
+import createBulkImportMiddleware from './createBulkImportMiddleware';
+import createERCMetadataMiddleware from './createERCMetadataMiddleware';
+import createApolloMiddleware from './createApolloMiddleware';
+import createSingleSignOnMiddleware from './createSingleSignOnMiddleware';
+
+const {
+  BULK_IMPORT_API_PATH = '/bulk-import',
+  ERC_METADATA_API_PATH = '/erc-metadata',
+  GRAPHQL_API_PATH = '/graphql',
+} = process.env;
+
+export const useMiddlewareWithCurrentContext = (expressApp, path, ...middleware) => {
+  const context = getCurrentContextResolver();
+  const addContext = async function middlewareWithContext(
+    req: IncomingMessage & { unchainedContext: UnchainedCore },
+    res: OutgoingMessage,
+    next,
+  ) {
+    try {
+      req.unchainedContext = await context({ req, res });
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+
+  expressApp.use(path, addContext, ...middleware);
+};
+
+export const connect = (
+  expressApp: e.Express,
+  { apolloGraphQLServer }: { apolloGraphQLServer: ApolloServer },
+) => {
+  const contextResolver = getCurrentContextResolver();
+
+  expressApp.use(GRAPHQL_API_PATH, createApolloMiddleware(contextResolver, { apolloGraphQLServer }));
+  expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware(contextResolver));
+  expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware(contextResolver));
+  expressApp.use(
+    ['/', '/.well-known/unchained/cloud-sso'],
+    createSingleSignOnMiddleware(contextResolver),
+  );
+};

package/src/loaders/index.ts

@@ -17,27 +17,22 @@ export default async (
   unchainedAPI: UnchainedCore,
 ): Promise<UnchainedLoaders['loaders']> => {
   return {
-    assortmentLoader: new DataLoader<{ assortmentId: string; includeInactive: boolean }, Assortment>(
-      async (queries) => {
-        const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
+    assortmentLoader: new DataLoader<{ assortmentId: string }, Assortment>(async (queries) => {
+      const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
 
-        const assortments = await unchainedAPI.modules.assortments.findAssortments({
-          assortmentIds,
-          includeInactive: true,
-          includeLeaves: true,
-        });
+      const assortments = await unchainedAPI.modules.assortments.findAssortments({
+        assortmentIds,
+        includeInactive: true,
+        includeLeaves: true,
+      });
 
-        return queries.map(({ assortmentId, includeInactive }) => {
-          return assortments.find((assortment) => {
-            if (assortment._id !== assortmentId) return false;
-            if (!includeInactive) {
-              return assortment.isActive === true;
-            }
-            return true;
-          });
+      return queries.map(({ assortmentId }) => {
+        return assortments.find((assortment) => {
+          if (assortment._id !== assortmentId) return false;
+          return true;
         });
-      },
-    ),
+      });
+    }),
 
     assortmentTextLoader: new DataLoader<{ assortmentId: string; locale: string }, AssortmentText>(
       async (queries) => {
@@ -118,26 +113,23 @@ export default async (
       });
     }),
 
-    productLoader: new DataLoader<{ productId: string; includeDrafts: boolean }, Product>(
-      async (queries) => {
-        const productIds = [...new Set(queries.map((q) => q.productId).filter(Boolean))];
+    productLoader: new DataLoader<{ productId: string }, Product>(async (queries) => {
+      const productIds = [...new Set(queries.map((q) => q.productId).filter(Boolean))];
 
-        const products = await unchainedAPI.modules.products.findProducts({
-          productIds,
-          includeDrafts: true,
-        });
+      const products = await unchainedAPI.modules.products.findProducts({
+        productIds,
+        productSelector: {
+          status: { $in: [null, ProductStatus.ACTIVE, ProductStatus.DELETED] },
+        },
+      });
 
-        return queries.map(({ productId, includeDrafts }) => {
-          return products.find((product) => {
-            if (product._id !== productId) return false;
-            if (!includeDrafts) {
-              return product.status === ProductStatus.ACTIVE;
-            }
-            return true;
-          });
+      return queries.map(({ productId }) => {
+        return products.find((product) => {
+          if (product._id !== productId) return false;
+          return true;
         });
-      },
-    ),
+      });
+    }),
 
     productTextLoader: new DataLoader<{ productId: string; locale: string }, ProductText>(
       async (queries) => {

package/src/resolvers/mutations/accounts/changePassword.ts

@@ -1,26 +1,31 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api';
+import { AuthOperationFailedError, InvalidCredentialsError } from '../../../errors';
 
 export default async function changePassword(
   root: Root,
   params: {
-    oldPassword?: string;
     oldPlainPassword?: string;
-    newPassword?: string;
     newPlainPassword?: string;
   },
   { modules, userId }: Context,
 ) {
   log('mutation changePassword', { userId });
 
-  if (!params.newPassword && !params.newPlainPassword) {
+  if (!params.newPlainPassword) {
     throw new Error('New password is required');
   }
-  if (!params.oldPassword && !params.oldPlainPassword) {
+  if (!params.oldPlainPassword) {
     throw new Error('Old password is required');
   }
-
-  const success = await modules.accounts.changePassword(userId, params);
+  let success = false;
+  try {
+    success = await modules.accounts.changePassword(userId, params);
+  } catch (e) {
+    success = false;
+    if (e.code === 'InvalidCredentials') throw new InvalidCredentialsError({});
+    else throw new AuthOperationFailedError({});
+  }
 
   return { success };
 }

package/src/resolvers/mutations/accounts/createUser.ts

@@ -2,18 +2,24 @@ import { UserData } from '@unchainedshop/types/accounts';
 import { Context, Root } from '@unchainedshop/types/api';
 import { log } from '@unchainedshop/logger';
 import { hashPassword } from '../../../hashPassword';
+import {
+  AuthOperationFailedError,
+  EmailAlreadyExistsError,
+  UsernameAlreadyExistsError,
+  UsernameOrEmailRequiredError,
+} from '../../../errors';
 
 export default async function createUser(root: Root, params: UserData, context: Context) {
   const { modules, userId } = context;
 
   log('mutation createUser', { email: params.email, username: params.username, userId });
 
-  if (!params.password && !params.plainPassword && !params.webAuthnPublicKeyCredentials) {
+  if (!params.plainPassword && !params.webAuthnPublicKeyCredentials) {
     throw new Error('Password or Public Key is required');
   }
 
   const mappedUser = { ...params };
-  if (!mappedUser.password && mappedUser.plainPassword) {
+  if (mappedUser.plainPassword) {
     mappedUser.password = hashPassword(mappedUser.plainPassword);
   }
   delete mappedUser.plainPassword;
@@ -25,10 +31,19 @@ export default async function createUser(root: Root, params: UserData, context:
       params.username,
       params.webAuthnPublicKeyCredentials,
     ));
-
-  const newUserId = await modules.accounts.createUser(mappedUser, {
-    skipPasswordEnrollment: !!webAuthnService,
-  });
+  let newUserId;
+  try {
+    newUserId = await modules.accounts.createUser(mappedUser, {
+      skipPasswordEnrollment: !!webAuthnService,
+    });
+  } catch (e) {
+    if (e.code === 'EmailAlreadyExists') throw new EmailAlreadyExistsError({ email: params?.email });
+    else if (e.code === 'UsernameAlreadyExists')
+      throw new UsernameAlreadyExistsError({ username: params?.username });
+    else if (e.code === 'UsernameOrEmailRequired')
+      throw new UsernameOrEmailRequiredError({ username: params?.username });
+    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  }
 
   if (newUserId && webAuthnService) {
     await modules.users.updateUser(

package/src/resolvers/mutations/accounts/disableTOTP.ts

@@ -1,6 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api';
-import { UserNotFoundError } from '../../../errors';
+import { TwoFactorCodeDidNotMatchError, TwoFactorNotSetError, UserNotFoundError } from '../../../errors';
 
 export default async function disableTOTP(
   root: Root,
@@ -15,8 +15,18 @@ export default async function disableTOTP(
 
   const user = await modules.users.findUserById(normalizedUserId);
   if (!user) throw new UserNotFoundError({ userId: normalizedUserId });
-
-  await modules.accounts.disableTOTP(normalizedUserId, params.code);
+  try {
+    await modules.accounts.disableTOTP(normalizedUserId, params.code);
+  } catch (e) {
+    if (e?.message?.includes("2FA code didn't match"))
+      throw new TwoFactorCodeDidNotMatchError({
+        submittedCode: params.code,
+        userId: params?.userId || userId,
+      });
+    else if (e?.message?.includes('2FA not set'))
+      throw new TwoFactorNotSetError({ userId: params?.userId || userId });
+    else throw e;
+  }
 
   return user;
 }

package/src/resolvers/mutations/accounts/enableTOTP.ts

@@ -1,5 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api';
+import { TwoFactorAlreadySetError, TwoFactorCodeDidNotMatchError } from '../../../errors';
 
 export default async function enableTOTP(
   root: Root,
@@ -9,8 +10,14 @@ export default async function enableTOTP(
   log(`mutation enableTOTP ${params.code}`, {
     userId,
   });
-
-  await modules.accounts.enableTOTP(userId, params.secretBase32, params.code);
+  try {
+    await modules.accounts.enableTOTP(userId, params.secretBase32, params.code);
+  } catch (e) {
+    if (e?.message?.includes("2FA code didn't match"))
+      throw new TwoFactorCodeDidNotMatchError({ submittedCode: params.code, userId });
+    else if (e?.message?.includes('2FA already set')) throw new TwoFactorAlreadySetError({ userId });
+    else throw e;
+  }
 
   return modules.users.findUserById(userId);
 }

package/src/resolvers/mutations/accounts/enrollUser.ts

@@ -2,6 +2,12 @@ import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api';
 import { UserData } from '@unchainedshop/types/accounts';
 import { hashPassword } from '../../../hashPassword';
+import {
+  AuthOperationFailedError,
+  EmailAlreadyExistsError,
+  UsernameAlreadyExistsError,
+  UsernameOrEmailRequiredError,
+} from '../../../errors';
 
 export default async function enrollUser(root: Root, params: UserData, context: Context) {
   const { modules } = context;
@@ -10,16 +16,25 @@ export default async function enrollUser(root: Root, params: UserData, context:
 
   const mappedUserData = params;
   mappedUserData.initialPassword = true;
-  if (!mappedUserData.password && mappedUserData.plainPassword) {
+  if (mappedUserData.plainPassword) {
     mappedUserData.password = hashPassword(mappedUserData.plainPassword);
   }
   delete mappedUserData.plainPassword;
 
   // Skip Messaging when password is set so we
   // don't send a verification e-mail after enrollment
-  const userId = await modules.accounts.createUser(mappedUserData, {
-    skipMessaging: !!mappedUserData.password,
-  });
+  try {
+    const userId = await modules.accounts.createUser(mappedUserData, {
+      skipMessaging: !!mappedUserData.password,
+    });
 
-  return modules.users.findUserById(userId);
+    return modules.users.findUserById(userId);
+  } catch (e) {
+    if (e.code === 'EmailAlreadyExists') throw new EmailAlreadyExistsError({ email: params?.email });
+    else if (e.code === 'UsernameAlreadyExists')
+      throw new UsernameAlreadyExistsError({ username: params?.username, email: params.email });
+    else if (e.code === 'UsernameOrEmailRequired')
+      throw new UsernameOrEmailRequiredError({ username: params?.username, email: params.email });
+    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  }
 }

package/src/resolvers/mutations/accounts/forgotPassword.ts

@@ -1,5 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api';
+import { AuthOperationFailedError, UserNotFoundError } from '../../../errors';
 
 export default async function forgotPassword(
   root: Root,
@@ -8,7 +9,13 @@ export default async function forgotPassword(
 ) {
   log('mutation forgotPassword', { email, userId });
 
-  const success = await modules.accounts.sendResetPasswordEmail(email);
+  let success = false;
+  try {
+    success = await modules.accounts.sendResetPasswordEmail(email);
+  } catch (e) {
+    if (e.code === 'UserNotFound') throw new UserNotFoundError({ email });
+    else throw new AuthOperationFailedError({ email });
+  }
 
   return { success };
 }

package/src/resolvers/mutations/accounts/impersonate.ts

@@ -8,7 +8,7 @@ const impersonate = async (root, { userId }, context: Context) => {
   const userToImpersonate = await context.modules.users.findUserById(userId);
 
   if (!userToImpersonate) {
-    throw new UserNotFoundError(`No user with id ${userId}`);
+    throw new UserNotFoundError({ userId });
   }
 
   if ((userToImpersonate.roles || []).includes('admin')) {