@unchainedshop/api 2.13.0 → 3.0.0-alpha2

package/src/resolvers/mutations/accounts/changePassword.ts

@@ -1,30 +1,40 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { AuthOperationFailedError, InvalidCredentialsError } from '../../../errors.js';
+import { InvalidCredentialsError, PasswordInvalidError } from '../../../errors.js';
 
 export default async function changePassword(
   root: Root,
   params: {
-    oldPlainPassword?: string;
-    newPlainPassword?: string;
+    oldPassword?: string;
+    newPassword?: string;
   },
   { modules, userId }: Context,
 ) {
   log('mutation changePassword', { userId });
 
-  if (!params.newPlainPassword) {
+  if (!params.newPassword) {
     throw new Error('New password is required');
   }
-  if (!params.oldPlainPassword) {
+  if (!params.oldPassword) {
     throw new Error('Old password is required');
   }
+
+  const user = await modules.users.findUserById(userId);
+
+  const isValidCurrentPassword =
+    user.services?.password &&
+    (await modules.users.verifyPassword(user.services?.password, params.oldPassword));
+  if (!isValidCurrentPassword) throw new InvalidCredentialsError({});
+
   let success = false;
+
   try {
-    success = await modules.accounts.changePassword(userId, params);
+    await modules.users.setPassword(user._id, params.newPassword);
+    success = true;
   } catch (e) {
     success = false;
-    if (e.code === 'InvalidCredentials') throw new InvalidCredentialsError({});
-    else throw new AuthOperationFailedError({});
+    if (e.cause === 'PASSWORD_INVALID') throw new PasswordInvalidError({ userId });
+    else throw e;
   }
 
   return { success };

package/src/resolvers/mutations/accounts/createUser.ts

@@ -1,12 +1,13 @@
-import { UserData } from '@unchainedshop/types/accounts.js';
+import { UserData } from '@unchainedshop/types/user.js';
 import { Context, Root } from '@unchainedshop/types/api.js';
 import { log } from '@unchainedshop/logger';
-import { hashPassword } from '../../../hashPassword.js';
 import {
   AuthOperationFailedError,
   EmailAlreadyExistsError,
   UsernameAlreadyExistsError,
   UsernameOrEmailRequiredError,
+  PasswordOrWebAuthnPublicKeyRequiredError,
+  PasswordInvalidError,
 } from '../../../errors.js';
 
 export default async function createUser(root: Root, params: UserData, context: Context) {
@@ -14,48 +15,40 @@ export default async function createUser(root: Root, params: UserData, context:
 
   log('mutation createUser', { email: params.email, username: params.username, userId });
 
-  if (!params.plainPassword && !params.webAuthnPublicKeyCredentials) {
-    throw new Error('Password or Public Key is required');
+  if (!params.username && !params.email) {
+    throw new UsernameOrEmailRequiredError({ username: params?.username });
   }
 
-  const mappedUser = { ...params };
-  if (mappedUser.plainPassword) {
-    mappedUser.password = hashPassword(mappedUser.plainPassword);
-  }
-  delete mappedUser.plainPassword;
-  delete mappedUser.webAuthnPublicKeyCredentials;
-
-  const webAuthnService =
-    params.webAuthnPublicKeyCredentials &&
-    (await modules.accounts.webAuthn.verifyCredentialCreation(
-      params.username,
-      params.webAuthnPublicKeyCredentials,
-    ));
-  let newUserId;
-  try {
-    newUserId = await modules.accounts.createUser(mappedUser, {
-      skipPasswordEnrollment: !!webAuthnService,
-    });
-  } catch (e) {
-    if (e.code === 'EmailAlreadyExists') throw new EmailAlreadyExistsError({ email: params?.email });
-    else if (e.code === 'UsernameAlreadyExists')
-      throw new UsernameAlreadyExistsError({ username: params?.username });
-    else if (e.code === 'UsernameOrEmailRequired')
-      throw new UsernameOrEmailRequiredError({ username: params?.username });
-    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  if (!params.password && !params.webAuthnPublicKeyCredentials) {
+    throw new PasswordOrWebAuthnPublicKeyRequiredError({ username: params?.username });
   }
 
-  if (newUserId && webAuthnService) {
-    await modules.users.updateUser(
-      { _id: newUserId },
+  try {
+    const newUserId = await modules.users.createUser(
       {
-        $push: {
-          'services.webAuthn': webAuthnService,
-        },
+        ...params,
+        initialPassword: false,
       },
       {},
     );
-  }
 
-  return modules.accounts.createLoginToken(newUserId, context);
+    let user = await modules.users.findUserById(newUserId);
+
+    user = await context.modules.users.updateHeartbeat(user._id, {
+      remoteAddress: context.remoteAddress,
+      remotePort: context.remotePort,
+      userAgent: context.userAgent,
+      locale: context.localeContext.normalized,
+      countryCode: context.countryContext,
+    });
+
+    return context.login(user);
+  } catch (e) {
+    if (e.cause === 'EMAIL_INVALID') throw new EmailAlreadyExistsError({ email: params?.email });
+    else if (e.cause === 'USERNAME_INVALID')
+      throw new UsernameAlreadyExistsError({ username: params?.username });
+    else if (e.cause === 'PASSWORD_INVALID')
+      throw new PasswordInvalidError({ username: params?.username });
+    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  }
 }

package/src/resolvers/mutations/accounts/createWebAuthnCredentialCreationOptions.ts

@@ -4,14 +4,14 @@ import { Context, Root } from '@unchainedshop/types/api.js';
 export default async function createWebAuthnCredentialCreationOptions(
   root: Root,
   { extensionOptions, username }: { username: string; extensionOptions: any },
-  { modules, userId, req }: Context,
+  { modules, userId, getHeader }: Context,
 ) {
   log(`mutation createWebAuthnCredentialCreationOptions ${username}`, {
     userId,
   });
 
-  const options = await modules.accounts.webAuthn.createCredentialCreationOptions(
-    req.headers.origin,
+  const options = await modules.users.webAuthn.createCredentialCreationOptions(
+    getHeader('origin') as string,
     username,
     extensionOptions,
   );

package/src/resolvers/mutations/accounts/createWebAuthnCredentialRequestOptions.ts

@@ -4,20 +4,20 @@ import { Context, Root } from '@unchainedshop/types/api.js';
 export default async function createWebAuthnCredentialRequestOptions(
   root: Root,
   { extensionOptions, username }: { username: string; extensionOptions: any },
-  { modules, userId, req }: Context,
+  { modules, userId, getHeader }: Context,
 ) {
   log(`mutation createWebAuthnCredentialRequestOptions ${username}`, {
     userId,
   });
 
-  const options = await modules.accounts.webAuthn.createCredentialRequestOptions(
-    req.headers.origin,
+  const options = await modules.users.webAuthn.createCredentialRequestOptions(
+    getHeader('origin') as string,
     username,
     extensionOptions,
   );
 
   if (username) {
-    const user = await modules.users.findUser({ username });
+    const user = await modules.users.findUserByUsername(username);
     options.allowCredentials = user?.services?.webAuthn?.map(({ id, type }) => ({
       id,
       type: type || options.type || 'public-key',

package/src/resolvers/mutations/accounts/enrollUser.ts

@@ -1,10 +1,10 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { UserData } from '@unchainedshop/types/accounts.js';
-import { hashPassword } from '../../../hashPassword.js';
+import { UserData } from '@unchainedshop/types/user.js';
 import {
   AuthOperationFailedError,
   EmailAlreadyExistsError,
+  PasswordInvalidError,
   UsernameAlreadyExistsError,
   UsernameOrEmailRequiredError,
 } from '../../../errors.js';
@@ -14,27 +14,28 @@ export default async function enrollUser(root: Root, params: UserData, context:
 
   log('mutation enrollUser', { email: params.email, userId: context.userId });
 
-  const mappedUserData = params;
-  mappedUserData.initialPassword = true;
-  if (mappedUserData.plainPassword) {
-    mappedUserData.password = hashPassword(mappedUserData.plainPassword);
+  if (!params.username && !params.email) {
+    throw new UsernameOrEmailRequiredError({});
   }
-  delete mappedUserData.plainPassword;
 
-  // Skip Messaging when password is set so we
-  // don't send a verification e-mail after enrollment
   try {
-    const userId = await modules.accounts.createUser(mappedUserData, {
-      skipMessaging: !!mappedUserData.password,
-    });
+    const userId = await modules.users.createUser(
+      {
+        ...params,
+        initialPassword: true,
+      },
+      {
+        skipMessaging: !!params.password,
+      },
+    );
 
     return modules.users.findUserById(userId);
   } catch (e) {
-    if (e.code === 'EmailAlreadyExists') throw new EmailAlreadyExistsError({ email: params?.email });
-    else if (e.code === 'UsernameAlreadyExists')
-      throw new UsernameAlreadyExistsError({ username: params?.username, email: params.email });
-    else if (e.code === 'UsernameOrEmailRequired')
-      throw new UsernameOrEmailRequiredError({ username: params?.username, email: params.email });
+    if (e.cause === 'EMAIL_INVALID') throw new EmailAlreadyExistsError({ email: params?.email });
+    else if (e.cause === 'USERNAME_INVALID')
+      throw new UsernameAlreadyExistsError({ username: params?.username });
+    else if (e.cause === 'PASSWORD_INVALID')
+      throw new PasswordInvalidError({ username: params?.username });
     else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
   }
 }

package/src/resolvers/mutations/accounts/forgotPassword.ts

@@ -1,6 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { AuthOperationFailedError, UserNotFoundError } from '../../../errors.js';
+import { UserNotFoundError } from '../../../errors.js';
 
 export default async function forgotPassword(
   root: Root,
@@ -9,13 +9,17 @@ export default async function forgotPassword(
 ) {
   log('mutation forgotPassword', { email, userId });
 
-  let success = false;
+  const user = await modules.users.findUserByEmail(email);
+  if (!user) throw new UserNotFoundError({ email });
+
   try {
-    success = await modules.accounts.sendResetPasswordEmail(email);
+    await modules.users.sendResetPasswordEmail(user._id, email);
+    return {
+      success: true,
+    };
   } catch (e) {
-    if (e.code === 'UserNotFound') throw new UserNotFoundError({ email });
-    else throw new AuthOperationFailedError({ email });
+    return {
+      success: false,
+    };
   }
-
-  return { success };
 }

package/src/resolvers/mutations/accounts/loginAsGuest.ts

@@ -1,12 +1,31 @@
 import { Context, Root } from '@unchainedshop/types/api.js';
 import { log } from '@unchainedshop/logger';
+import moniker from 'moniker';
+import { randomValueHex } from '@unchainedshop/utils';
 
 export default async function loginAsGuest(root: Root, _: any, context: Context) {
-  const { modules } = context;
-
   log('mutation loginAsGuest');
 
-  const loginToken = await modules.accounts.loginWithService({ service: 'guest' }, context);
+  const guestname = `${moniker.choose()}-${randomValueHex(5)}`;
+  const guestUserId = await context.modules.users.createUser(
+    {
+      email: `${guestname}@unchained.local`,
+      guest: true,
+      password: null,
+      initialPassword: true,
+    },
+    { skipMessaging: true },
+  );
+
+  let user = await context.modules.users.findUserById(guestUserId);
+
+  user = await context.modules.users.updateHeartbeat(user._id, {
+    remoteAddress: context.remoteAddress,
+    remotePort: context.remotePort,
+    userAgent: context.userAgent,
+    locale: context.localeContext.normalized,
+    countryCode: context.countryContext,
+  });
 
-  return loginToken;
+  return context.login(user);
 }

package/src/resolvers/mutations/accounts/loginWithPassword.ts

@@ -1,54 +1,51 @@
 import { log } from '@unchainedshop/logger';
+
 import { Context, Root } from '@unchainedshop/types/api.js';
-import {
-  AuthenticationFailedError,
-  AuthOperationFailedError,
-  InvalidCredentialsError,
-  TwoFactorCodeDidNotMatchError,
-  TwoFactorCodeRequiredError,
-  UserDeactivatedError,
-} from '../../../errors.js';
-import { hashPassword } from '../../../hashPassword.js';
+import { InvalidCredentialsError } from '../../../errors.js';
 
 export default async function loginWithPassword(
   root: Root,
   params: {
     username?: string;
     email?: string;
-    plainPassword?: string;
-    totpCode?: string;
+    password?: string;
   },
   context: Context,
 ) {
-  const { modules } = context;
-  const { username, email, plainPassword, totpCode } = params;
-
+  const { username, email, password } = params;
   log('mutation loginWithPassword', { username, email });
 
-  if (!plainPassword) {
+  if (!password) {
     throw new Error('Password is required');
   }
 
-  const mappedUserLoginParams = {
-    user: email ? { email } : { username },
-    password: hashPassword(plainPassword),
-    code: totpCode,
-  };
-
-  try {
-    const result = await modules.accounts.loginWithService(
-      { service: 'password', ...mappedUserLoginParams },
-      context,
-    );
-    return result;
-  } catch (e) {
-    if (e.code === 'AuthenticationFailed') throw new AuthenticationFailedError({ username, email });
-    else if (e.code === 'UserDeactivated') throw new UserDeactivatedError({ username, email });
-    else if (e.code === 'InvalidCredentials') throw new InvalidCredentialsError({ username, email });
-    else if (e?.message?.includes('2FA code required'))
-      throw new TwoFactorCodeRequiredError({ username, email });
-    else if (e?.message?.includes("2FA code didn't match"))
-      throw new TwoFactorCodeDidNotMatchError({ submittedCode: params.totpCode, username, email });
-    else throw new AuthOperationFailedError({ submittedCode: params.totpCode, username, email });
+  let user = username
+    ? await context.modules.users.findUserByUsername(username)
+    : await context.modules.users.findUserByEmail(email);
+
+  const verified =
+    user.services?.password &&
+    (await context.modules.users.verifyPassword(user.services.password, password));
+
+  if (!verified) throw new InvalidCredentialsError({ username, email });
+
+  if (user.guest) {
+    await context.modules.users.updateGuest(user, false);
+  }
+
+  user = await context.modules.users.updateHeartbeat(user._id, {
+    remoteAddress: context.remoteAddress,
+    remotePort: context.remotePort,
+    userAgent: context.userAgent,
+    locale: context.localeContext.normalized,
+    countryCode: context.countryContext,
+  });
+
+  if (context.userId) {
+    await context.services.users.migrateUserData(context.userId, user._id, context);
   }
+
+  await context.services.orders.nextUserCart({ user, countryCode: context.countryContext }, context);
+
+  return context.login(user);
 }

package/src/resolvers/mutations/accounts/loginWithWebAuthn.ts

@@ -1,10 +1,5 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import {
-  AuthenticationFailedError,
-  AuthOperationFailedError,
-  UserDeactivatedError,
-} from '../../../errors.js';
 
 export default async function loginWithWebAuthn(
   root: Root,
@@ -13,15 +8,27 @@ export default async function loginWithWebAuthn(
   },
   context: Context,
 ) {
-  const { modules } = context;
-
   log('mutation loginWithWebAuthn');
-  try {
-    const result = await modules.accounts.loginWithService({ service: 'webAuthn', ...params }, context);
-    return result;
-  } catch (e) {
-    if (e.code === 'AuthenticationFailed') throw new AuthenticationFailedError({});
-    else if (e.code === 'UserDeactivated') throw new UserDeactivatedError({});
-    else throw new AuthOperationFailedError({});
-  }
+
+  const username =
+    Buffer.from(params.webAuthnPublicKeyCredentials?.response?.userHandle, 'base64').toString() || '';
+
+  let user = await context.modules.users.findUserByUsername(username);
+  if (!user) throw new Error('User not found');
+
+  await context.modules.users.webAuthn.verifyCredentialRequest(
+    user.services?.webAuthn,
+    user.username,
+    params.webAuthnPublicKeyCredentials,
+  );
+
+  user = await context.modules.users.updateHeartbeat(user._id, {
+    remoteAddress: context.remoteAddress,
+    remotePort: context.remotePort,
+    userAgent: context.userAgent,
+    locale: context.localeContext.normalized,
+    countryCode: context.countryContext,
+  });
+
+  return context.login(user);
 }

package/src/resolvers/mutations/accounts/logout.ts

@@ -1,28 +1,12 @@
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { log, LogLevel } from '@unchainedshop/logger';
+import { log } from '@unchainedshop/logger';
 
-export default async function logout(root: Root, { token }: { token: string }, context: Context) {
-  const { modules, userId, setLoginToken } = context;
+export default async function logout(root: Root, _: never, context: Context) {
+  const { userId } = context;
 
   log('mutation logout', { userId });
 
-  const loggedOut = await modules.accounts.logout(
-    {
-      token,
-      loginToken: context.loginToken,
-      userId: context.userId,
-    },
-    context,
-  );
+  const success = await context.logout();
 
-  if (loggedOut.error) {
-    log('Error while logging out', {
-      logLevel: LogLevel.Error,
-      ...loggedOut.error,
-    });
-  } else {
-    setLoginToken(null);
-  }
-
-  return { success: loggedOut.success };
+  return { success };
 }

package/src/resolvers/mutations/accounts/removeEmail.ts

@@ -14,7 +14,7 @@ export default async function removeEmail(
   if (!(await modules.users.userExists({ userId: normalizedUserId })))
     throw new UserNotFoundError({ userId: normalizedUserId });
 
-  await modules.accounts.removeEmail(normalizedUserId, params.email);
+  await modules.users.removeEmail(normalizedUserId, params.email);
 
   return modules.users.findUserById(normalizedUserId);
 }

package/src/resolvers/mutations/accounts/resetPassword.ts

@@ -1,71 +1,68 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { emailRegexOperator } from '@unchainedshop/mongodb';
-import {
-  AuthOperationFailedError,
-  InvalidResetTokenError,
-  NoEmailSetError,
-  ResetPasswordLinkExpiredError,
-  ResetPasswordLinkUnknownAddressError,
-} from '../../../errors.js';
+import { InvalidResetTokenError, PasswordInvalidError } from '../../../errors.js';
 
 export default async function resetPassword(
   root: Root,
-  params: { newPlainPassword?: string; token: string },
+  params: { newPassword?: string; token: string },
   context: Context,
 ) {
   const { modules, userId } = context;
 
   log('mutation resetPassword', { userId });
 
-  if (!params.newPlainPassword) {
+  if (!params.newPassword) {
     throw new Error('Password is required');
   }
-  try {
-    const userWithNewPassword = await modules.accounts.resetPassword(params, context);
+  let user = await modules.users.findUserByResetToken(params.token);
+
+  if (!user) throw new InvalidResetTokenError({});
 
-    const resetTicket = userWithNewPassword?.services?.password?.reset?.find(
-      (t) => t.token === params.token,
-    );
-    if (resetTicket.address) {
-      // Try verifying the E-Mail along the way
-      try {
-        const updatedUser = await modules.users.updateUser(
-          {
-            _id: userWithNewPassword.id,
-            emails: {
-              $elemMatch: {
-                address: emailRegexOperator(resetTicket.address),
-                verified: false,
-              },
-            },
-          },
-          {
-            $set: {
-              'emails.$[email].verified': true,
-            },
-          },
-          {
-            arrayFilters: [{ 'email.address': resetTicket.address }],
-          },
-        );
-        if (updatedUser) {
-          await modules.accounts.emit('VerifyEmailSuccess', updatedUser);
-        }
-      } catch (e) {
-        /* */
-      }
-    }
+  try {
+    await modules.users.setPassword(user._id, params.newPassword);
 
-    const result = await modules.accounts.createLoginToken(userWithNewPassword.id, context);
-    return result;
+    // TODO: Verify E-Mail after reset!
+    // if (resetTicket.address) {
+    //   // Try verifying the E-Mail along the way
+    //   try {
+    //     const updatedUser = await modules.users.updateUser(
+    //       {
+    //         _id: userWithNewPassword.id,
+    //         emails: {
+    //           $elemMatch: {
+    //             address: emailRegexOperator(resetTicket.address),
+    //             verified: false,
+    //           },
+    //         },
+    //       },
+    //       {
+    //         $set: {
+    //           'emails.$[email].verified': true,
+    //         },
+    //       },
+    //       {
+    //         arrayFilters: [{ 'email.address': resetTicket.address }],
+    //       },
+    //     );
+    //     if (updatedUser) {
+    //       await modules.accounts.emit('VerifyEmailSuccess', updatedUser);
+    //     }
+    //   } catch (e) {
+    //     /* */
+    //   }
+    // }
   } catch (e) {
-    log(e);
-    if (e.code === 'InvalidToken') throw new InvalidResetTokenError({});
-    if (e.code === 'ResetPasswordLinkExpired') throw new ResetPasswordLinkExpiredError({});
-    if (e.code === 'ResetPasswordLinkUnknownAddress​')
-      throw new ResetPasswordLinkUnknownAddressError({});
-    if (e.code === 'NoEmailSet') throw new NoEmailSetError({});
-    throw new AuthOperationFailedError({});
+    if (e.cause === 'PASSWORD_INVALID') throw new PasswordInvalidError({ userId: user._id });
+    else throw e;
   }
+
+  user = await context.modules.users.updateHeartbeat(user._id, {
+    remoteAddress: context.remoteAddress,
+    remotePort: context.remotePort,
+    userAgent: context.userAgent,
+    locale: context.localeContext.normalized,
+    countryCode: context.countryContext,
+  });
+
+  return context.login(user);
 }

package/src/resolvers/mutations/accounts/sendEnrollmentEmail.ts

@@ -1,5 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
+import { UserNotFoundError } from '../../../errors.js';
 
 export default async function sendEnrollmentEmail(
   root: Root,
@@ -8,8 +9,11 @@ export default async function sendEnrollmentEmail(
 ) {
   log('mutation sendEnrollmentEmail', { email, userId });
 
+  const user = await modules.users.findUserByEmail(email);
+  if (!user) throw new UserNotFoundError({ email });
+
   try {
-    await modules.accounts.sendEnrollmentEmail(email);
+    await modules.users.sendResetPasswordEmail(user._id, email, true);
     return {
       success: true,
     };

package/src/resolvers/mutations/accounts/sendVerificationEmail.ts

@@ -1,5 +1,6 @@
 import { Context, Root } from '@unchainedshop/types/api.js';
 import { log } from '@unchainedshop/logger';
+import { UserNotFoundError } from '../../../errors.js';
 
 export default async function sendVerificationEmail(
   root: Root,
@@ -8,9 +9,17 @@ export default async function sendVerificationEmail(
 ) {
   log('mutation sendVerificationEmail', { email, userId });
 
-  await modules.accounts.sendVerificationEmail(email);
+  const user = await modules.users.findUserByEmail(email);
+  if (!user) throw new UserNotFoundError({ email });
 
-  return {
-    success: true,
-  };
+  try {
+    await modules.users.sendVerificationEmail(user._id, email);
+    return {
+      success: true,
+    };
+  } catch (e) {
+    return {
+      success: false,
+    };
+  }
 }