@unchainedshop/api 2.13.0 → 3.0.0-alpha2

package/src/context.ts

@@ -1,8 +1,7 @@
-import { UnchainedContextResolver, AdminUiConfig } from '@unchainedshop/types/api.js';
+import { AdminUiConfig, Context, UnchainedHTTPServerContext } from '@unchainedshop/types/api.js';
 import { UnchainedCore } from '@unchainedshop/types/core.js';
 import instantiateLoaders from './loaders/index.js';
 import { getLocaleContext } from './locale-context.js';
-import { getUserContext } from './user-context.js';
 
 let context;
 
@@ -12,6 +11,18 @@ export const setCurrentContextResolver = (newContext: UnchainedContextResolver)
   context = newContext;
 };
 
+export type UnchainedContextResolver = (
+  params: UnchainedHTTPServerContext & {
+    cookies?: Record<string, string>;
+    remoteAddress?: string;
+    remotePort?: number;
+    user?: any;
+    userId?: string;
+    login: (user: any) => Promise<{ _id: string; user: any; tokenExpires: Date }>;
+    logout: () => Promise<boolean>;
+  },
+) => Promise<Context>;
+
 export const createContextResolver =
   (
     unchainedAPI: UnchainedCore,
@@ -19,21 +30,23 @@ export const createContextResolver =
     version: string,
     adminUiConfig?: AdminUiConfig,
   ): UnchainedContextResolver =>
-  async ({ req, res, ...apolloContext }) => {
-    const loaders = await instantiateLoaders(req, res, unchainedAPI);
-    const userContext = await getUserContext(req, res, unchainedAPI);
-    const localeContext = await getLocaleContext(req, res, unchainedAPI);
+  async ({ getHeader, setHeader, cookies, remoteAddress, remotePort, user, userId, login, logout }) => {
+    const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader, cookies };
+    const loaders = await instantiateLoaders(unchainedAPI);
+    const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
 
     return {
-      req,
-      res,
-      ...apolloContext,
       ...unchainedAPI,
-      ...userContext,
       ...localeContext,
+      user,
+      userId,
+      login,
+      logout,
       loaders,
       roles,
       version,
       adminUiConfig,
+      setHeader,
+      getHeader,
     };
   };

package/src/createGraphQLServer.ts

@@ -1,28 +1,10 @@
-import { ApolloServer } from '@apollo/server';
-import { log, LogLevel } from '@unchainedshop/logger';
-import { GraphQLFormattedError } from 'graphql';
+import { createLogger } from '@unchainedshop/logger';
 import { buildDefaultTypeDefs } from './schema/index.js';
 import resolvers from './resolvers/index.js';
 import { actions } from './roles/index.js';
+import { createYoga, createSchema } from 'graphql-yoga';
 
-const logGraphQLServerError = (error: GraphQLFormattedError) => {
-  try {
-    const {
-      message,
-      extensions: { stacktrace, ...parameters },
-      ...rest
-    } = error;
-
-    const nativeError = new Error(message);
-    nativeError.stack = (stacktrace as string[]).join('\n');
-    nativeError.name = parameters.code as string;
-    log(nativeError, {
-      level: LogLevel.Error,
-      ...parameters,
-      ...rest,
-    });
-  } catch (e) {} // eslint-disable-line
-};
+const logger = createLogger('unchained:api');
 
 export default async (options) => {
   const {
@@ -30,24 +12,31 @@ export default async (options) => {
     resolvers: additionalResolvers = [],
     events = [],
     workTypes = [],
-    ...apolloServerOptions
+    schema: customSchema,
+    ...graphQLServerOptions
   } = options || {};
 
-  const server = new ApolloServer({
-    typeDefs: [
-      ...buildDefaultTypeDefs({
-        actions: Object.keys(actions),
-        events,
-        workTypes,
-      }),
-      ...additionalTypeDefs,
-    ],
-    resolvers: [resolvers, ...additionalResolvers],
-    formatError: (error) => {
-      logGraphQLServerError(error);
-      return error;
+  const schema =
+    customSchema ||
+    createSchema({
+      typeDefs: [
+        ...buildDefaultTypeDefs({
+          actions: Object.keys(actions),
+          events,
+          workTypes,
+        }),
+        ...additionalTypeDefs,
+      ],
+      resolvers: [resolvers, ...additionalResolvers],
+    });
+
+  const server = createYoga({
+    schema,
+    logging: logger,
+    context: async (ctx: any) => {
+      return (ctx.req as any)?.unchainedContext;
     },
-    ...apolloServerOptions,
+    ...graphQLServerOptions,
   });
 
   return server;

package/src/errors.ts

@@ -217,12 +217,12 @@ export const CyclicAssortmentLinkNotSupportedError = createError(
 
 export const EmailAlreadyExistsError = createError(
   'EmailAlreadyExists',
-  'Email already exist in the database',
+  'Email already exists or is invalid',
 );
 
 export const UsernameAlreadyExistsError = createError(
   'UsernameAlreadyExists',
-  'Username already exist in the database',
+  'Username already exists or is invalid',
 );
 
 export const UsernameOrEmailRequiredError = createError(
@@ -230,28 +230,27 @@ export const UsernameOrEmailRequiredError = createError(
   'No username or email is provided.',
 );
 
-export const TwoFactorCodeDidNotMatchError = createError(
-  'TwoFactorCodeDidNotMatch',
-  "2FA code didn't match",
+export const PasswordInvalidError = createError(
+  'PasswordInvalidError',
+  'The provided password is invalid, maybe too insecure',
 );
 
-export const TwoFactorCodeRequiredError = createError('TwoFactorCodeRequired', '2FA code required');
-
-export const TwoFactorAlreadySetError = createError('TwoFactorAlreadySet', '2FA already set for user');
-
-export const TwoFactorNotSetError = createError('TwoFactorNotSet', '2FA not set for user');
+export const PasswordOrWebAuthnPublicKeyRequiredError = createError(
+  'PasswordOrWebAuthnPublicKeyRequired',
+  'A password or a WebAuthn public key is required',
+);
 
 export const InvalidCredentialsError = createError('InvalidCredentials', 'Invalid credentials provided');
 
-export const InvalidResetTokenError = createError('InvalidResetTokenError', 'Token validation failed');
-
-export const NoEmailSetError = createError('NoEmailSet', 'User has no email set');
+export const InvalidResetTokenError = createError('InvalidResetTokenError', 'Token invalid or expired');
 
-export const ResetPasswordLinkExpiredError = createError(
-  'ResetPasswordLinkExpired',
-  'Token does not exist or is expired',
+export const InvalidEmailVerificationTokenError = createError(
+  'InvalidEmailVerificationTokenError',
+  'Token invalid or expired',
 );
 
+export const NoEmailSetError = createError('NoEmailSet', 'User has no email set');
+
 export const ResetPasswordLinkUnknownAddressError = createError(
   'ResetPasswordLinkUnknownAddress',
   'Valid token but no email address found for the entry',
@@ -292,11 +291,6 @@ export const ProductLinkedToQuotationError = createError(
   'Product is part of a requested/proposed quotations item, remove it from any requested/proposed quotations item before deleting',
 );
 
-export const ImpersonatingAdminUserError = createError(
-  'ImpersonatingAdminUserError',
-  'Can not impersonate a admin user account',
-);
-
 export const FileNotFoundError = createError('FileNotFoundError', 'File not found');
 
 export const FileUploadExpiredError = createError('FileUploadExpired', 'File upload has expired');

package/src/events.ts

@@ -0,0 +1,8 @@
+import { registerEvents } from '@unchainedshop/events';
+
+export enum API_EVENTS {
+  API_LOGIN_TOKEN_CREATED = 'API_LOGIN_TOKEN_CREATED',
+  API_LOGOUT = 'API_LOGOUT',
+}
+
+registerEvents(Object.keys(API_EVENTS));

package/src/express/createBulkImportMiddleware.ts

@@ -1,7 +1,8 @@
 import { createLogger } from '@unchainedshop/logger';
 import { checkAction } from '../acl.js';
 import { actions } from '../roles/index.js';
-import { getCurrentContextResolver } from '../context.js';
+import { IncomingMessage } from 'http';
+import { Context } from '@unchainedshop/types/api.js';
 
 const logger = createLogger('unchained:bulk-import');
 
@@ -17,15 +18,18 @@ const methodWrongHandler = (res) => () => {
   res.end();
 };
 
-export default async function bulkImportMiddleware(req, res) {
+export default async function bulkImportMiddleware(
+  req: IncomingMessage & { query?: any; unchainedContext: Context },
+  res,
+) {
   try {
+    const context = req.unchainedContext;
+
     if (req.method !== 'POST') {
       methodWrongHandler(res)();
       return;
     }
 
-    const contextResolver = getCurrentContextResolver();
-    const context = await contextResolver({ req, res });
     await checkAction(context, (actions as any).bulkImport);
 
     const input: any = {

package/src/express/createERCMetadataMiddleware.ts

@@ -3,7 +3,7 @@ import path from 'path';
 import { createLogger } from '@unchainedshop/logger';
 import { systemLocale } from '@unchainedshop/utils';
 import localePkg from 'locale';
-import { getCurrentContextResolver } from '../context.js';
+import { Context } from '@unchainedshop/types/api.js';
 
 const { Locale } = localePkg;
 
@@ -21,15 +21,17 @@ const methodWrongHandler = (res) => () => {
   res.end();
 };
 
-export default async function ercMetadataMiddleware(req: IncomingMessage, res) {
+export default async function ercMetadataMiddleware(
+  req: IncomingMessage & { unchainedContext: Context },
+  res,
+) {
   try {
     if (req.method !== 'GET') {
       methodWrongHandler(res)();
       return;
     }
 
-    const contextResolver = getCurrentContextResolver();
-    const context = await contextResolver({ req, res });
+    const context = req.unchainedContext;
     const url = new URL(req.url, process.env.ROOT_URL);
     const parsedPath = path.parse(url.pathname);
 

package/src/express/index.ts

@@ -1,48 +1,154 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
-import { UnchainedCore } from '@unchainedshop/types/core.js';
-import { ApolloServer } from '@apollo/server';
 import type e from 'express';
 import { getCurrentContextResolver } from '../context.js';
 import createBulkImportMiddleware from './createBulkImportMiddleware.js';
 import createERCMetadataMiddleware from './createERCMetadataMiddleware.js';
-import createApolloMiddleware from './createApolloMiddleware.js';
-import createSingleSignOnMiddleware from './createSingleSignOnMiddleware.js';
+import cookieParser from 'cookie-parser';
+import session from 'express-session';
+import MongoStore from 'connect-mongo';
+import { YogaServer } from 'graphql-yoga';
+import setupPassport from './passport/setup.js';
+import { mongodb } from '@unchainedshop/mongodb';
+import { UnchainedCore } from '@unchainedshop/types/core.js';
+import { emit } from '@unchainedshop/events';
+import { API_EVENTS } from '../events.js';
+
+const resolveUserRemoteAddress = (req) => {
+  const remoteAddress =
+    req.headers['x-real-ip'] ||
+    req.headers['x-forwarded-for'] ||
+    req.connection?.remoteAddress ||
+    req.socket?.remoteAddress ||
+    req.connection?.socket?.remoteAddress;
+
+  const remotePort =
+    req.connection?.remotePort || req.socket?.remotePort || req.connection?.socket?.remotePort;
+
+  return { remoteAddress, remotePort };
+};
 
 const {
   BULK_IMPORT_API_PATH = '/bulk-import',
   ERC_METADATA_API_PATH = '/erc-metadata',
   GRAPHQL_API_PATH = '/graphql',
+  UNCHAINED_COOKIE_NAME = 'unchained_token',
+  UNCHAINED_COOKIE_PATH = '/',
+  UNCHAINED_COOKIE_DOMAIN,
+  NODE_ENV,
 } = process.env;
 
 const addContext = async function middlewareWithContext(
-  req: IncomingMessage & { unchainedContext: UnchainedCore },
-  res: OutgoingMessage,
-  next,
+  req: e.Request & { cookies: any },
+  res: e.Response,
+  next: e.NextFunction,
 ) {
   try {
+    const setHeader = (key, value) => res.setHeader(key, value);
+    const getHeader = (key) => req.headers[key];
+    const cookies = req.cookies;
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
+
     const context = getCurrentContextResolver();
-    req.unchainedContext = await context({ req, res });
+
+    const login = async (user) => {
+      await new Promise((resolve, reject) => {
+        (req as any).login(user, (error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      const tokenObject = {
+        _id: (req as any).sessionID,
+        /* eslint-disable-next-line */
+        tokenExpires: new Date((req as any).session?.cookie._expires),
+      };
+
+      await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, { userId: user._id, ...tokenObject });
+
+      /* eslint-disable-next-line */
+      (user as any)._inLoginMethodResponse = true;
+      return { user, ...tokenObject };
+    };
+
+    const logout = async (sessionId?: string) => { /* eslint-disable-line */
+      // TODO: this should only logout an explicitly provided session if sessionID
+      // has been provided
+      // express-session destroy
+      const { user } = req as any;
+      if (!user) return false;
+
+      const tokenObject = {
+        _id: sessionId || (req as any).sessionID,
+        userId: user._id,
+      };
+
+      await new Promise((resolve, reject) => {
+        (req as any).logout((error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      await emit(API_EVENTS.API_LOGOUT, tokenObject);
+      return true;
+    };
+
+    (req as any).unchainedContext = await context({
+      setHeader,
+      getHeader,
+      cookies,
+      remoteAddress,
+      remotePort,
+      login,
+      logout,
+      user: (req as any).user,
+      userId: (req as any).user?._id,
+    });
     next();
   } catch (error) {
     next(error);
   }
 };
 
-export const useMiddlewareWithCurrentContext = (expressApp, path, ...middleware) => {
-  if (!path) {
-    throw new Error('Path is required for useMiddlewareWithCurrentContext');
-  }
-
-  expressApp.use(path, addContext, ...middleware);
-};
-
 export const connect = (
   expressApp: e.Express,
-  { apolloGraphQLServer }: { apolloGraphQLServer: ApolloServer },
-  options?: { corsOrigins?: any },
+  {
+    yogaServer,
+    db,
+    unchainedAPI,
+  }: { yogaServer: YogaServer<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
 ) => {
-  expressApp.use(GRAPHQL_API_PATH, createApolloMiddleware(apolloGraphQLServer, options));
+  expressApp.use(cookieParser(), addContext);
+  const passport = setupPassport(unchainedAPI);
+  expressApp.use(passport.initialize());
+  expressApp.use(
+    session({
+      secret: process.env.UNCHAINED_TOKEN_SECRET,
+      store: MongoStore.create({
+        client: (db as any).client,
+        dbName: db.databaseName,
+        collectionName: 'sessions',
+      }),
+      name: UNCHAINED_COOKIE_NAME,
+      saveUninitialized: false,
+      resave: false,
+      cookie: {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        httpOnly: true,
+        path: UNCHAINED_COOKIE_PATH,
+        sameSite: NODE_ENV === 'production' ? 'lax' : 'none',
+        secure: NODE_ENV === 'production',
+        maxAge: 1000 * 60 * 60 * 24 * 7,
+      },
+    }),
+  );
+  expressApp.use(passport.session());
+  expressApp.use(passport.authenticate('access-token', { session: false }));
+  expressApp.use(GRAPHQL_API_PATH, yogaServer.handle);
   expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
   expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-  expressApp.use(['/', '/.well-known/unchained/cloud-sso'], createSingleSignOnMiddleware);
 };

package/src/express/passport/access-token-strategy.ts

@@ -0,0 +1,39 @@
+import Strategy from 'passport-strategy';
+
+export default class AccessTokenStrategy extends Strategy {
+  name: string;
+
+  pass: any;
+
+  _verify: any;
+
+  success: any;
+
+  constructor(verify) {
+    super();
+
+    if (!verify) {
+      throw new TypeError('AccessTokenStrategy requires a verify callback');
+    }
+    // eslint-disable-next-line
+    this._verify = verify;
+
+    // Set the default name of our strategy
+    this.name = 'access-token';
+  }
+
+  authenticate(req) {
+    if (req.headers.authorization) {
+      const [type, token] = req.headers.authorization.split(' ');
+      if (type === 'Bearer') {
+        // eslint-disable-next-line
+        this._verify(token, (err, user) => {
+          if (!user || err) return this.pass();
+          this.success(user);
+        });
+        return;
+      }
+    }
+    this.pass();
+  }
+}

package/src/express/passport/setup.ts

@@ -0,0 +1,44 @@
+import { UnchainedCore } from '@unchainedshop/types/core.js';
+import { Passport } from 'passport';
+import AccessTokenStrategy from './access-token-strategy.js';
+
+const setupPassport = (unchainedAPI: UnchainedCore) => {
+  const passport = new Passport();
+
+  passport.serializeUser(function serialize(user, done) {
+    done(null, user._id);
+  });
+
+  passport.deserializeUser(function deserialize(_id, done) {
+    unchainedAPI.modules.users.findUserById(_id).then(
+      (user) => {
+        done(null, user);
+      },
+      (error) => {
+        done(error, null);
+      },
+    );
+  });
+
+  passport.use(
+    new AccessTokenStrategy(function verify(userToken, done) {
+      const [username] = userToken.split(':');
+      unchainedAPI.modules.users.findUserByToken(userToken).then(
+        (user) => {
+          if (user?.username === username) {
+            done(null, user);
+            return;
+          }
+          done(null, null);
+        },
+        (error) => {
+          done(error, null);
+        },
+      );
+    }),
+  );
+
+  return passport;
+};
+
+export default setupPassport;

package/src/loaders/index.ts

@@ -1,4 +1,3 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
 import DataLoader from 'dataloader';
 import { systemLocale } from '@unchainedshop/utils';
 import localePkg from 'locale';
@@ -15,7 +14,7 @@ function getLocaleStrings(localeObj) {
 function findMatchingText(texts, localeStrings) {
   return localeStrings.reduce((acc, localeString) => {
     if (acc) return acc;
-    return texts.find((p) => p.locale === localeString);
+    return texts.find((p) => p.locale.toLowerCase() === localeString.toLowerCase());
   }, null);
 }
 
@@ -32,11 +31,7 @@ function getFilteredQueries({ queries, texts, filterFn }) {
   });
 }
 
-const loaders = async (
-  req: IncomingMessage,
-  res: OutgoingMessage,
-  unchainedAPI: UnchainedCore,
-): Promise<UnchainedLoaders['loaders']> => {
+const loaders = async (unchainedAPI: UnchainedCore): Promise<UnchainedLoaders['loaders']> => {
   return {
     assortmentLoader: new DataLoader(
       async (queries) => {
@@ -216,7 +211,6 @@ const loaders = async (
           ({ filterId, filterOptionValue }) =>
           (text) =>
             text.filterId === filterId && text.filterOptionValue === filterOptionValue;
-
         return getFilteredQueries({ queries, texts, filterFn });
       },
       { batchScheduleFn: (cb) => setImmediate(cb) },

package/src/locale-context.ts

@@ -1,13 +1,10 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
-import { UnchainedLocaleContext } from '@unchainedshop/types/api.js';
+import { UnchainedLocaleContext, UnchainedHTTPServerContext } from '@unchainedshop/types/api.js';
 import localePkg from 'locale';
-import 'abort-controller/polyfill.js';
 import { log, LogLevel } from '@unchainedshop/logger';
 import {
   resolveBestCountry,
   resolveBestSupported,
   resolveBestCurrency,
-  resolveUserRemoteAddress,
   systemLocale,
 } from '@unchainedshop/utils';
 import { UnchainedCore } from '@unchainedshop/types/core.js';
@@ -17,6 +14,8 @@ const { Locales } = localePkg;
 
 const { NODE_ENV } = process.env;
 
+export type GetHeaderFn = (key: string) => string | string[];
+
 export const resolveDefaultContext = memoizee(
   async ({ acceptLang, acceptCountry }, unchainedAPI) => {
     const languages = await unchainedAPI.modules.languages.findLanguages(
@@ -68,14 +67,19 @@ export const resolveDefaultContext = memoizee(
 );
 
 export const getLocaleContext = async (
-  req: IncomingMessage,
-  res: OutgoingMessage,
+  {
+    remoteAddress,
+    remotePort,
+    getHeader,
+  }: {
+    remoteAddress: string;
+    remotePort: number;
+  } & UnchainedHTTPServerContext,
   unchainedAPI: UnchainedCore,
 ): Promise<UnchainedLocaleContext> => {
-  const userAgent = req.headers['user-agent'];
-  const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
+  const userAgent = getHeader('user-agent');
   const context = await resolveDefaultContext(
-    { acceptLang: req.headers['accept-language'], acceptCountry: req.headers['x-shop-country'] },
+    { acceptLang: getHeader('accept-language'), acceptCountry: getHeader('x-shop-country') },
     unchainedAPI,
   );
   return { remoteAddress, remotePort, userAgent, ...context };

package/src/resolvers/index.ts

@@ -1,4 +1,3 @@
-import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 import { JSONResolver, TimestampResolver, DateTimeResolver, DateResolver } from 'graphql-scalars';
 import Query from './queries/index.js';
 import Mutation from './mutations/index.js';
@@ -8,7 +7,6 @@ import CustomScalars from './scalars/index.js';
 export default {
   ...Types,
   ...CustomScalars,
-  Upload: GraphQLUpload,
   JSON: JSONResolver,
   Query,
   Mutation,

package/src/resolvers/mutations/accounts/addEmail.ts

@@ -1,6 +1,6 @@
 import { log } from '@unchainedshop/logger';
 import { Context, Root } from '@unchainedshop/types/api.js';
-import { UserNotFoundError } from '../../../errors.js';
+import { EmailAlreadyExistsError, UserNotFoundError } from '../../../errors.js';
 
 export default async function addEmail(
   root: Root,
@@ -14,7 +14,12 @@ export default async function addEmail(
   if (!(await modules.users.userExists({ userId: normalizedUserId })))
     throw new UserNotFoundError({ userId: normalizedUserId });
 
-  await modules.accounts.addEmail(normalizedUserId, params.email);
+  try {
+    await modules.users.addEmail(normalizedUserId, params.email);
+  } catch (e) {
+    if (e.cause === 'EMAIL_INVALID') throw new EmailAlreadyExistsError({ email: params?.email });
+    else throw e;
+  }
 
   return modules.users.findUserById(normalizedUserId);
 }

package/src/resolvers/mutations/accounts/addWebAuthnCredentials.ts

@@ -10,7 +10,7 @@ export default async function addWebAuthnCredentials(
     userId,
   });
 
-  const webAuthnService = await modules.accounts.webAuthn.verifyCredentialCreation(
+  const webAuthnService = await modules.users.webAuthn.verifyCredentialCreation(
     user.username,
     credentials,
   );