@unchainedshop/api 2.12.2 → 3.0.0-alpha2

package/lib/schema/types/user.js

@@ -7,14 +7,9 @@ export default [
     """
     type LoginMethodResponse @cacheControl(maxAge: 0, scope: PRIVATE) {
       """
-      Id of the user logged in user
+      Session ID
       """
-      id: String!
-
-      """
-      Token of the connection
-      """
-      token: String!
+      _id: String!
 
       """
       Expiration date for the token
@@ -91,18 +86,6 @@ export default [
       verified: Boolean!
     }
 
-    type OAuthProvider {
-      _id: String!
-      clientId: String!
-      scopes: [String!]!
-    }
-
-    type OAuthAccount {
-      _id: ID!
-      provider: OAuthProvider!
-      authorizationCode: String!
-    }
-
     type User {
       _id: ID!
       created: DateTime!
@@ -110,7 +93,6 @@ export default [
       deleted: DateTime
       username: String
       isGuest: Boolean!
-      isTwoFactorEnabled: Boolean!
       isInitialPassword: Boolean!
       webAuthnCredentials: [WebAuthnCredentials!]!
       web3Addresses: [Web3Address!]!
@@ -152,7 +134,6 @@ export default [
       ): [Enrollment!]!
       allowedActions: [RoleAction!]!
       tokens: [Token!]!
-      oAuthAccounts: [OAuthAccount!]!
       reviews(limit: Int = 10, offset: Int = 0, sort: [SortOptionInput!]): [ProductReview!]!
       reviewsCount: Int!
     }

package/lib/schema/types/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../src/schema/types/user.ts"],"names":[],"mappings":"AAAA,eAAe;IACb,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6Jb;CACF,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../src/schema/types/user.ts"],"names":[],"mappings":"AAAA,eAAe;IACb,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0Ib;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/api",
-  "version": "2.12.2",
+  "version": "3.0.0-alpha2",
   "main": "lib/api-index.js",
   "exports": {
     ".": "./lib/api-index.js",
@@ -40,35 +40,41 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "peerDependencies": {
-    "@apollo/server": "^4.10.4",
-    "cookie": "~0.6"
+    "graphql-yoga": "^5.6.1"
   },
   "optionalDependencies": {
-    "express": "~4"
+    "connect-mongo": "~5",
+    "cookie-parser": "^1.4.6",
+    "express": "~4",
+    "express-session": "~1",
+    "passport": "^0.7.0",
+    "passport-strategy": "^1.0.0"
   },
   "dependencies": {
-    "@metamask/eth-sig-util": "^7.0.2",
-    "@unchainedshop/core": "^2.12.2",
-    "@unchainedshop/events": "^2.12.2",
-    "@unchainedshop/logger": "^2.12.2",
-    "@unchainedshop/roles": "^2.12.2",
-    "@unchainedshop/utils": "^2.12.2",
+    "@metamask/eth-sig-util": "^7.0.3",
+    "@unchainedshop/core": "^3.0.0-alpha2",
+    "@unchainedshop/events": "^3.0.0-alpha2",
+    "@unchainedshop/logger": "^3.0.0-alpha2",
+    "@unchainedshop/roles": "^3.0.0-alpha2",
+    "@unchainedshop/utils": "^3.0.0-alpha2",
     "accounting": "0.4.1",
     "dataloader": "^2.2.2",
     "graphql-scalars": "^1.23.0",
-    "graphql-upload": "^16.0.2",
     "locale": "0.1.0",
     "lodash.isnumber": "3.0.3",
-    "lru-cache": "^11.0.0"
+    "memoizee": "^0.4.17"
   },
   "devDependencies": {
-    "@types/graphql-upload": "^16.0.7",
     "@types/locale": "^0.1.4",
-    "@types/node": "^20.14.10",
-    "@unchainedshop/types": "^2.12.2",
+    "@types/node": "^20.14.12",
+    "@unchainedshop/types": "^3.0.0-alpha2",
+    "connect-mongo": "^5.1.0",
     "express": "^4.19.2",
+    "express-session": "^1.18.0",
     "jest": "^29.7.0",
-    "ts-jest": "^29.2.2",
-    "typescript": "^5.5.3"
+    "passport": "^0.7.0",
+    "passport-strategy": "^1.0.0",
+    "ts-jest": "^29.2.3",
+    "typescript": "^5.5.4"
   }
 }

package/src/api-index.ts

@@ -1,19 +1,19 @@
 import fs from 'fs';
 import path from 'path';
-import { UnchainedServerOptions } from '@unchainedshop/types/api.js';
-import type { ApolloServer } from '@apollo/server';
+import { AdminUiConfig } from '@unchainedshop/types/api.js';
 import createGraphQLServer from './createGraphQLServer.js';
 import {
   createContextResolver,
   setCurrentContextResolver,
   getCurrentContextResolver,
 } from './context.js';
+import { YogaServerOptions } from 'graphql-yoga';
+import { UnchainedCore } from '@unchainedshop/types/core.js';
 
 export * from './context.js';
 export * as acl from './acl.js';
 export * as errors from './errors.js';
 export * as express from './express/index.js';
-export { hashPassword } from './hashPassword.js';
 export * as roles from './roles/index.js';
 export { createContextResolver, getCurrentContextResolver, setCurrentContextResolver };
 
@@ -35,14 +35,19 @@ const packageJson = loadJSON('../package.json');
 
 const { UNCHAINED_API_VERSION = packageJson?.version || '2.x' } = process.env;
 
-export const startAPIServer = async (options: UnchainedServerOptions): Promise<ApolloServer> => {
-  const {
-    unchainedAPI,
-    roles,
-    context: customContext,
-    adminUiConfig,
-    ...apolloServerOptions
-  } = options || {};
+export type GraphQLServerOptions = YogaServerOptions<any, any>;
+
+export type UnchainedServerOptions = GraphQLServerOptions & {
+  unchainedAPI: UnchainedCore;
+  roles?: any;
+  context?: any;
+  events: Array<string>;
+  workTypes: Array<string>;
+  adminUiConfig?: AdminUiConfig;
+};
+
+export const startAPIServer = async (options: UnchainedServerOptions) => {
+  const { unchainedAPI, roles, context: customContext, adminUiConfig, ...serverOptions } = options || {};
 
   const contextResolver = createContextResolver(
     unchainedAPI,
@@ -53,11 +58,11 @@ export const startAPIServer = async (options: UnchainedServerOptions): Promise<A
 
   setCurrentContextResolver(
     customContext
-      ? ({ req, res }) => {
-          return customContext({ req, res }, contextResolver);
+      ? (props) => {
+          return customContext(props, contextResolver);
         }
       : contextResolver,
   );
 
-  return createGraphQLServer(apolloServerOptions);
+  return createGraphQLServer(serverOptions);
 };

package/src/context.ts

@@ -1,8 +1,7 @@
-import { UnchainedContextResolver, AdminUiConfig } from '@unchainedshop/types/api.js';
+import { AdminUiConfig, Context, UnchainedHTTPServerContext } from '@unchainedshop/types/api.js';
 import { UnchainedCore } from '@unchainedshop/types/core.js';
 import instantiateLoaders from './loaders/index.js';
 import { getLocaleContext } from './locale-context.js';
-import { getUserContext } from './user-context.js';
 
 let context;
 
@@ -12,6 +11,18 @@ export const setCurrentContextResolver = (newContext: UnchainedContextResolver)
   context = newContext;
 };
 
+export type UnchainedContextResolver = (
+  params: UnchainedHTTPServerContext & {
+    cookies?: Record<string, string>;
+    remoteAddress?: string;
+    remotePort?: number;
+    user?: any;
+    userId?: string;
+    login: (user: any) => Promise<{ _id: string; user: any; tokenExpires: Date }>;
+    logout: () => Promise<boolean>;
+  },
+) => Promise<Context>;
+
 export const createContextResolver =
   (
     unchainedAPI: UnchainedCore,
@@ -19,21 +30,23 @@ export const createContextResolver =
     version: string,
     adminUiConfig?: AdminUiConfig,
   ): UnchainedContextResolver =>
-  async ({ req, res, ...apolloContext }) => {
-    const loaders = await instantiateLoaders(req, res, unchainedAPI);
-    const userContext = await getUserContext(req, res, unchainedAPI);
-    const localeContext = await getLocaleContext(req, res, unchainedAPI);
+  async ({ getHeader, setHeader, cookies, remoteAddress, remotePort, user, userId, login, logout }) => {
+    const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader, cookies };
+    const loaders = await instantiateLoaders(unchainedAPI);
+    const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
 
     return {
-      req,
-      res,
-      ...apolloContext,
       ...unchainedAPI,
-      ...userContext,
       ...localeContext,
+      user,
+      userId,
+      login,
+      logout,
       loaders,
       roles,
       version,
       adminUiConfig,
+      setHeader,
+      getHeader,
     };
   };

package/src/createGraphQLServer.ts

@@ -1,28 +1,10 @@
-import { ApolloServer } from '@apollo/server';
-import { log, LogLevel } from '@unchainedshop/logger';
-import { GraphQLFormattedError } from 'graphql';
+import { createLogger } from '@unchainedshop/logger';
 import { buildDefaultTypeDefs } from './schema/index.js';
 import resolvers from './resolvers/index.js';
 import { actions } from './roles/index.js';
+import { createYoga, createSchema } from 'graphql-yoga';
 
-const logGraphQLServerError = (error: GraphQLFormattedError) => {
-  try {
-    const {
-      message,
-      extensions: { stacktrace, ...parameters },
-      ...rest
-    } = error;
-
-    const nativeError = new Error(message);
-    nativeError.stack = (stacktrace as string[]).join('\n');
-    nativeError.name = parameters.code as string;
-    log(nativeError, {
-      level: LogLevel.Error,
-      ...parameters,
-      ...rest,
-    });
-  } catch (e) {} // eslint-disable-line
-};
+const logger = createLogger('unchained:api');
 
 export default async (options) => {
   const {
@@ -30,24 +12,31 @@ export default async (options) => {
     resolvers: additionalResolvers = [],
     events = [],
     workTypes = [],
-    ...apolloServerOptions
+    schema: customSchema,
+    ...graphQLServerOptions
   } = options || {};
 
-  const server = new ApolloServer({
-    typeDefs: [
-      ...buildDefaultTypeDefs({
-        actions: Object.keys(actions),
-        events,
-        workTypes,
-      }),
-      ...additionalTypeDefs,
-    ],
-    resolvers: [resolvers, ...additionalResolvers],
-    formatError: (error) => {
-      logGraphQLServerError(error);
-      return error;
+  const schema =
+    customSchema ||
+    createSchema({
+      typeDefs: [
+        ...buildDefaultTypeDefs({
+          actions: Object.keys(actions),
+          events,
+          workTypes,
+        }),
+        ...additionalTypeDefs,
+      ],
+      resolvers: [resolvers, ...additionalResolvers],
+    });
+
+  const server = createYoga({
+    schema,
+    logging: logger,
+    context: async (ctx: any) => {
+      return (ctx.req as any)?.unchainedContext;
     },
-    ...apolloServerOptions,
+    ...graphQLServerOptions,
   });
 
   return server;

package/src/errors.ts

@@ -217,12 +217,12 @@ export const CyclicAssortmentLinkNotSupportedError = createError(
 
 export const EmailAlreadyExistsError = createError(
   'EmailAlreadyExists',
-  'Email already exist in the database',
+  'Email already exists or is invalid',
 );
 
 export const UsernameAlreadyExistsError = createError(
   'UsernameAlreadyExists',
-  'Username already exist in the database',
+  'Username already exists or is invalid',
 );
 
 export const UsernameOrEmailRequiredError = createError(
@@ -230,28 +230,27 @@ export const UsernameOrEmailRequiredError = createError(
   'No username or email is provided.',
 );
 
-export const TwoFactorCodeDidNotMatchError = createError(
-  'TwoFactorCodeDidNotMatch',
-  "2FA code didn't match",
+export const PasswordInvalidError = createError(
+  'PasswordInvalidError',
+  'The provided password is invalid, maybe too insecure',
 );
 
-export const TwoFactorCodeRequiredError = createError('TwoFactorCodeRequired', '2FA code required');
-
-export const TwoFactorAlreadySetError = createError('TwoFactorAlreadySet', '2FA already set for user');
-
-export const TwoFactorNotSetError = createError('TwoFactorNotSet', '2FA not set for user');
+export const PasswordOrWebAuthnPublicKeyRequiredError = createError(
+  'PasswordOrWebAuthnPublicKeyRequired',
+  'A password or a WebAuthn public key is required',
+);
 
 export const InvalidCredentialsError = createError('InvalidCredentials', 'Invalid credentials provided');
 
-export const InvalidResetTokenError = createError('InvalidResetTokenError', 'Token validation failed');
-
-export const NoEmailSetError = createError('NoEmailSet', 'User has no email set');
+export const InvalidResetTokenError = createError('InvalidResetTokenError', 'Token invalid or expired');
 
-export const ResetPasswordLinkExpiredError = createError(
-  'ResetPasswordLinkExpired',
-  'Token does not exist or is expired',
+export const InvalidEmailVerificationTokenError = createError(
+  'InvalidEmailVerificationTokenError',
+  'Token invalid or expired',
 );
 
+export const NoEmailSetError = createError('NoEmailSet', 'User has no email set');
+
 export const ResetPasswordLinkUnknownAddressError = createError(
   'ResetPasswordLinkUnknownAddress',
   'Valid token but no email address found for the entry',
@@ -292,11 +291,6 @@ export const ProductLinkedToQuotationError = createError(
   'Product is part of a requested/proposed quotations item, remove it from any requested/proposed quotations item before deleting',
 );
 
-export const ImpersonatingAdminUserError = createError(
-  'ImpersonatingAdminUserError',
-  'Can not impersonate a admin user account',
-);
-
 export const FileNotFoundError = createError('FileNotFoundError', 'File not found');
 
 export const FileUploadExpiredError = createError('FileUploadExpired', 'File upload has expired');

package/src/events.ts

@@ -0,0 +1,8 @@
+import { registerEvents } from '@unchainedshop/events';
+
+export enum API_EVENTS {
+  API_LOGIN_TOKEN_CREATED = 'API_LOGIN_TOKEN_CREATED',
+  API_LOGOUT = 'API_LOGOUT',
+}
+
+registerEvents(Object.keys(API_EVENTS));

package/src/express/createBulkImportMiddleware.ts

@@ -1,7 +1,8 @@
 import { createLogger } from '@unchainedshop/logger';
 import { checkAction } from '../acl.js';
 import { actions } from '../roles/index.js';
-import { getCurrentContextResolver } from '../context.js';
+import { IncomingMessage } from 'http';
+import { Context } from '@unchainedshop/types/api.js';
 
 const logger = createLogger('unchained:bulk-import');
 
@@ -17,19 +18,23 @@ const methodWrongHandler = (res) => () => {
   res.end();
 };
 
-export default async function bulkImportMiddleware(req, res) {
+export default async function bulkImportMiddleware(
+  req: IncomingMessage & { query?: any; unchainedContext: Context },
+  res,
+) {
   try {
+    const context = req.unchainedContext;
+
     if (req.method !== 'POST') {
       methodWrongHandler(res)();
       return;
     }
 
-    const contextResolver = getCurrentContextResolver();
-    const context = await contextResolver({ req, res });
     await checkAction(context, (actions as any).bulkImport);
 
     const input: any = {
       createShouldUpsertIfIDExists: !!req.query?.createShouldUpsertIfIDExists,
+      updateShouldUpsertIfIDNotExists: !!req.query?.updateShouldUpsertIfIDNotExists,
       skipCacheInvalidation: !!req.query?.skipCacheInvalidation,
       remoteAddress: context.remoteAddress,
     };

package/src/express/createERCMetadataMiddleware.ts

@@ -3,7 +3,7 @@ import path from 'path';
 import { createLogger } from '@unchainedshop/logger';
 import { systemLocale } from '@unchainedshop/utils';
 import localePkg from 'locale';
-import { getCurrentContextResolver } from '../context.js';
+import { Context } from '@unchainedshop/types/api.js';
 
 const { Locale } = localePkg;
 
@@ -21,15 +21,17 @@ const methodWrongHandler = (res) => () => {
   res.end();
 };
 
-export default async function ercMetadataMiddleware(req: IncomingMessage, res) {
+export default async function ercMetadataMiddleware(
+  req: IncomingMessage & { unchainedContext: Context },
+  res,
+) {
   try {
     if (req.method !== 'GET') {
       methodWrongHandler(res)();
       return;
     }
 
-    const contextResolver = getCurrentContextResolver();
-    const context = await contextResolver({ req, res });
+    const context = req.unchainedContext;
     const url = new URL(req.url, process.env.ROOT_URL);
     const parsedPath = path.parse(url.pathname);
 

package/src/express/index.ts

@@ -1,48 +1,154 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
-import { UnchainedCore } from '@unchainedshop/types/core.js';
-import { ApolloServer } from '@apollo/server';
 import type e from 'express';
 import { getCurrentContextResolver } from '../context.js';
 import createBulkImportMiddleware from './createBulkImportMiddleware.js';
 import createERCMetadataMiddleware from './createERCMetadataMiddleware.js';
-import createApolloMiddleware from './createApolloMiddleware.js';
-import createSingleSignOnMiddleware from './createSingleSignOnMiddleware.js';
+import cookieParser from 'cookie-parser';
+import session from 'express-session';
+import MongoStore from 'connect-mongo';
+import { YogaServer } from 'graphql-yoga';
+import setupPassport from './passport/setup.js';
+import { mongodb } from '@unchainedshop/mongodb';
+import { UnchainedCore } from '@unchainedshop/types/core.js';
+import { emit } from '@unchainedshop/events';
+import { API_EVENTS } from '../events.js';
+
+const resolveUserRemoteAddress = (req) => {
+  const remoteAddress =
+    req.headers['x-real-ip'] ||
+    req.headers['x-forwarded-for'] ||
+    req.connection?.remoteAddress ||
+    req.socket?.remoteAddress ||
+    req.connection?.socket?.remoteAddress;
+
+  const remotePort =
+    req.connection?.remotePort || req.socket?.remotePort || req.connection?.socket?.remotePort;
+
+  return { remoteAddress, remotePort };
+};
 
 const {
   BULK_IMPORT_API_PATH = '/bulk-import',
   ERC_METADATA_API_PATH = '/erc-metadata',
   GRAPHQL_API_PATH = '/graphql',
+  UNCHAINED_COOKIE_NAME = 'unchained_token',
+  UNCHAINED_COOKIE_PATH = '/',
+  UNCHAINED_COOKIE_DOMAIN,
+  NODE_ENV,
 } = process.env;
 
 const addContext = async function middlewareWithContext(
-  req: IncomingMessage & { unchainedContext: UnchainedCore },
-  res: OutgoingMessage,
-  next,
+  req: e.Request & { cookies: any },
+  res: e.Response,
+  next: e.NextFunction,
 ) {
   try {
+    const setHeader = (key, value) => res.setHeader(key, value);
+    const getHeader = (key) => req.headers[key];
+    const cookies = req.cookies;
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
+
     const context = getCurrentContextResolver();
-    req.unchainedContext = await context({ req, res });
+
+    const login = async (user) => {
+      await new Promise((resolve, reject) => {
+        (req as any).login(user, (error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      const tokenObject = {
+        _id: (req as any).sessionID,
+        /* eslint-disable-next-line */
+        tokenExpires: new Date((req as any).session?.cookie._expires),
+      };
+
+      await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, { userId: user._id, ...tokenObject });
+
+      /* eslint-disable-next-line */
+      (user as any)._inLoginMethodResponse = true;
+      return { user, ...tokenObject };
+    };
+
+    const logout = async (sessionId?: string) => { /* eslint-disable-line */
+      // TODO: this should only logout an explicitly provided session if sessionID
+      // has been provided
+      // express-session destroy
+      const { user } = req as any;
+      if (!user) return false;
+
+      const tokenObject = {
+        _id: sessionId || (req as any).sessionID,
+        userId: user._id,
+      };
+
+      await new Promise((resolve, reject) => {
+        (req as any).logout((error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      await emit(API_EVENTS.API_LOGOUT, tokenObject);
+      return true;
+    };
+
+    (req as any).unchainedContext = await context({
+      setHeader,
+      getHeader,
+      cookies,
+      remoteAddress,
+      remotePort,
+      login,
+      logout,
+      user: (req as any).user,
+      userId: (req as any).user?._id,
+    });
     next();
   } catch (error) {
     next(error);
   }
 };
 
-export const useMiddlewareWithCurrentContext = (expressApp, path, ...middleware) => {
-  if (!path) {
-    throw new Error('Path is required for useMiddlewareWithCurrentContext');
-  }
-
-  expressApp.use(path, addContext, ...middleware);
-};
-
 export const connect = (
   expressApp: e.Express,
-  { apolloGraphQLServer }: { apolloGraphQLServer: ApolloServer },
-  options?: { corsOrigins?: any },
+  {
+    yogaServer,
+    db,
+    unchainedAPI,
+  }: { yogaServer: YogaServer<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
 ) => {
-  expressApp.use(GRAPHQL_API_PATH, createApolloMiddleware(apolloGraphQLServer, options));
+  expressApp.use(cookieParser(), addContext);
+  const passport = setupPassport(unchainedAPI);
+  expressApp.use(passport.initialize());
+  expressApp.use(
+    session({
+      secret: process.env.UNCHAINED_TOKEN_SECRET,
+      store: MongoStore.create({
+        client: (db as any).client,
+        dbName: db.databaseName,
+        collectionName: 'sessions',
+      }),
+      name: UNCHAINED_COOKIE_NAME,
+      saveUninitialized: false,
+      resave: false,
+      cookie: {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        httpOnly: true,
+        path: UNCHAINED_COOKIE_PATH,
+        sameSite: NODE_ENV === 'production' ? 'lax' : 'none',
+        secure: NODE_ENV === 'production',
+        maxAge: 1000 * 60 * 60 * 24 * 7,
+      },
+    }),
+  );
+  expressApp.use(passport.session());
+  expressApp.use(passport.authenticate('access-token', { session: false }));
+  expressApp.use(GRAPHQL_API_PATH, yogaServer.handle);
   expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
   expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-  expressApp.use(['/', '/.well-known/unchained/cloud-sso'], createSingleSignOnMiddleware);
 };