@unchainedshop/api 2.14.2 → 3.0.0-alpha3

package/src/express/createERCMetadataMiddleware.ts

@@ -2,10 +2,7 @@ import { IncomingMessage } from 'http';
 import path from 'path';
 import { createLogger } from '@unchainedshop/logger';
 import { systemLocale } from '@unchainedshop/utils';
-import localePkg from 'locale';
-import { getCurrentContextResolver } from '../context.js';
-
-const { Locale } = localePkg;
+import { Context } from '../types.js';
 
 const logger = createLogger('unchained:erc-metadata');
 
@@ -21,15 +18,17 @@ const methodWrongHandler = (res) => () => {
   res.end();
 };
 
-export default async function ercMetadataMiddleware(req: IncomingMessage, res) {
+export default async function ercMetadataMiddleware(
+  req: IncomingMessage & { unchainedContext: Context },
+  res,
+) {
   try {
     if (req.method !== 'GET') {
       methodWrongHandler(res)();
       return;
     }
 
-    const contextResolver = getCurrentContextResolver();
-    const context = await contextResolver({ req, res });
+    const context = req.unchainedContext;
     const url = new URL(req.url, process.env.ROOT_URL);
     const parsedPath = path.parse(url.pathname);
 
@@ -54,7 +53,7 @@ export default async function ercMetadataMiddleware(req: IncomingMessage, res) {
       {
         token,
         product,
-        locale: new Locale(locale),
+        locale: new Intl.Locale(locale),
         referenceDate: new Date(),
       },
       context,

package/src/express/index.ts

@@ -1,48 +1,151 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
-import { UnchainedCore } from '@unchainedshop/types/core.js';
-import { ApolloServer } from '@apollo/server';
 import type e from 'express';
 import { getCurrentContextResolver } from '../context.js';
 import createBulkImportMiddleware from './createBulkImportMiddleware.js';
 import createERCMetadataMiddleware from './createERCMetadataMiddleware.js';
-import createApolloMiddleware from './createApolloMiddleware.js';
-import createSingleSignOnMiddleware from './createSingleSignOnMiddleware.js';
+import session from 'express-session';
+import MongoStore from 'connect-mongo';
+import { YogaServer } from 'graphql-yoga';
+import setupPassport from './passport/setup.js';
+import { mongodb } from '@unchainedshop/mongodb';
+import { UnchainedCore } from '@unchainedshop/core';
+import { emit } from '@unchainedshop/events';
+import { API_EVENTS } from '../events.js';
+import { User } from '@unchainedshop/core-users';
+import { IncomingMessage } from 'http';
+
+const resolveUserRemoteAddress = (req: IncomingMessage) => {
+  const remoteAddress =
+    (req.headers['x-real-ip'] as string) ||
+    (req.headers['x-forwarded-for'] as string) ||
+    req.socket?.remoteAddress;
+
+  const remotePort = req.socket?.remotePort;
+
+  return { remoteAddress, remotePort };
+};
 
 const {
   BULK_IMPORT_API_PATH = '/bulk-import',
   ERC_METADATA_API_PATH = '/erc-metadata',
   GRAPHQL_API_PATH = '/graphql',
+  UNCHAINED_COOKIE_NAME = 'unchained_token',
+  UNCHAINED_COOKIE_PATH = '/',
+  UNCHAINED_COOKIE_DOMAIN,
+  NODE_ENV,
 } = process.env;
 
 const addContext = async function middlewareWithContext(
-  req: IncomingMessage & { unchainedContext: UnchainedCore },
-  res: OutgoingMessage,
-  next,
+  req: e.Request,
+  res: e.Response,
+  next: e.NextFunction,
 ) {
   try {
+    const setHeader = (key, value) => res.setHeader(key, value);
+    const getHeader = (key) => req.headers[key];
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
+
     const context = getCurrentContextResolver();
-    req.unchainedContext = await context({ req, res });
+
+    const login = async (user: User) => {
+      await new Promise((resolve, reject) => {
+        (req as any).login(user, (error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      const tokenObject = {
+        _id: (req as any).sessionID,
+        /* eslint-disable-next-line */
+        tokenExpires: new Date((req as any).session?.cookie._expires),
+      };
+
+      await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, { userId: user._id, ...tokenObject });
+
+      /* eslint-disable-next-line */
+      (user as any)._inLoginMethodResponse = true;
+      return { user, ...tokenObject };
+    };
+
+    const logout = async (sessionId?: string) => { /* eslint-disable-line */
+      // TODO: this should only logout an explicitly provided session if sessionID
+      // has been provided
+      // express-session destroy
+      const { user } = req as any;
+      if (!user) return false;
+
+      const tokenObject = {
+        _id: sessionId || (req as any).sessionID,
+        userId: user._id,
+      };
+
+      await new Promise((resolve, reject) => {
+        (req as any).logout((error, result) => {
+          if (error) {
+            return reject(error);
+          }
+          return resolve(result);
+        });
+      });
+
+      await emit(API_EVENTS.API_LOGOUT, tokenObject);
+      return true;
+    };
+
+    (req as any).unchainedContext = await context({
+      setHeader,
+      getHeader,
+      remoteAddress,
+      remotePort,
+      login,
+      logout,
+      user: (req as any).user,
+      userId: (req as any).user?._id,
+    });
     next();
   } catch (error) {
     next(error);
   }
 };
 
-export const useMiddlewareWithCurrentContext = (expressApp, path, ...middleware) => {
-  if (!path) {
-    throw new Error('Path is required for useMiddlewareWithCurrentContext');
-  }
-
-  expressApp.use(path, addContext, ...middleware);
-};
-
 export const connect = (
   expressApp: e.Express,
-  { apolloGraphQLServer }: { apolloGraphQLServer: ApolloServer },
-  options?: { corsOrigins?: any },
+  {
+    graphqlHandler,
+    db,
+    unchainedAPI,
+  }: { graphqlHandler: YogaServer<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
 ) => {
-  expressApp.use(GRAPHQL_API_PATH, createApolloMiddleware(apolloGraphQLServer, options));
+  const passport = setupPassport(unchainedAPI);
+
+  expressApp.use(
+    session({
+      secret: process.env.UNCHAINED_TOKEN_SECRET,
+      store: MongoStore.create({
+        client: (db as any).client,
+        dbName: db.databaseName,
+        collectionName: 'sessions',
+      }),
+      name: UNCHAINED_COOKIE_NAME,
+      saveUninitialized: false,
+      resave: false,
+      cookie: {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        httpOnly: Boolean(NODE_ENV === 'production'),
+        path: UNCHAINED_COOKIE_PATH,
+        sameSite: 'lax',
+        secure: NODE_ENV === 'production',
+        maxAge: 1000 * 60 * 60 * 24 * 7,
+      },
+    }),
+    passport.initialize(),
+    passport.session(),
+    passport.authenticate('access-token', { session: false }),
+    addContext,
+  );
+  expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
   expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
   expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-  expressApp.use(['/', '/.well-known/unchained/cloud-sso'], createSingleSignOnMiddleware);
 };

package/src/express/passport/access-token-strategy.ts

@@ -0,0 +1,39 @@
+import Strategy from 'passport-strategy';
+
+export default class AccessTokenStrategy extends Strategy {
+  name: string;
+
+  pass: any;
+
+  _verify: any;
+
+  success: any;
+
+  constructor(verify) {
+    super();
+
+    if (!verify) {
+      throw new TypeError('AccessTokenStrategy requires a verify callback');
+    }
+    // eslint-disable-next-line
+    this._verify = verify;
+
+    // Set the default name of our strategy
+    this.name = 'access-token';
+  }
+
+  authenticate(req) {
+    if (req.headers.authorization) {
+      const [type, token] = req.headers.authorization.split(' ');
+      if (type === 'Bearer') {
+        // eslint-disable-next-line
+        this._verify(token, (err, user) => {
+          if (!user || err) return this.pass();
+          this.success(user);
+        });
+        return;
+      }
+    }
+    this.pass();
+  }
+}

package/src/express/passport/setup.ts

@@ -0,0 +1,44 @@
+import { UnchainedCore } from '@unchainedshop/core';
+import { Passport } from 'passport';
+import AccessTokenStrategy from './access-token-strategy.js';
+
+const setupPassport = (unchainedAPI: UnchainedCore) => {
+  const passport = new Passport();
+
+  passport.serializeUser(function serialize(user, done) {
+    done(null, user._id);
+  });
+
+  passport.deserializeUser(function deserialize(_id, done) {
+    unchainedAPI.modules.users.findUserById(_id).then(
+      (user) => {
+        done(null, user);
+      },
+      (error) => {
+        done(error, null);
+      },
+    );
+  });
+
+  passport.use(
+    new AccessTokenStrategy(function verify(userToken, done) {
+      const [username] = userToken.split(':');
+      unchainedAPI.modules.users.findUserByToken(userToken).then(
+        (user) => {
+          if (user?.username === username) {
+            done(null, user);
+            return;
+          }
+          done(null, null);
+        },
+        (error) => {
+          done(error, null);
+        },
+      );
+    }),
+  );
+
+  return passport;
+};
+
+export default setupPassport;

package/src/loaders/index.ts

@@ -1,27 +1,23 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
 import DataLoader from 'dataloader';
 import { systemLocale } from '@unchainedshop/utils';
-import localePkg from 'locale';
-import { UnchainedCore } from '@unchainedshop/types/core.js';
+import { UnchainedCore } from '@unchainedshop/core';
 import { ProductStatus } from '@unchainedshop/core-products';
-import { UnchainedLoaders } from '@unchainedshop/types/api.js';
+import { UnchainedLoaders } from '../types.js';
 
-const { Locale } = localePkg;
-
-function getLocaleStrings(localeObj) {
-  return [localeObj.normalized, localeObj.language, systemLocale.normalized, systemLocale.language];
+function getLocaleStrings(localeObj: Intl.Locale) {
+  return [localeObj.baseName, localeObj.language, systemLocale.baseName, systemLocale.language];
 }
 
 function findMatchingText(texts, localeStrings) {
   return localeStrings.reduce((acc, localeString) => {
     if (acc) return acc;
-    return texts.find((p) => p.locale === localeString);
+    return texts.find((p) => p.locale.toLowerCase() === localeString.toLowerCase());
   }, null);
 }
 
 function getFilteredQueries({ queries, texts, filterFn }) {
   return queries.map(({ locale, ...queryParams }) => {
-    const localeObj = new Locale(locale);
+    const localeObj = new Intl.Locale(locale);
 
     const filteredTexts = texts.filter(filterFn(queryParams));
     if (!filteredTexts.length) return null;
@@ -32,11 +28,7 @@ function getFilteredQueries({ queries, texts, filterFn }) {
   });
 }
 
-const loaders = async (
-  req: IncomingMessage,
-  res: OutgoingMessage,
-  unchainedAPI: UnchainedCore,
-): Promise<UnchainedLoaders['loaders']> => {
+const loaders = async (unchainedAPI: UnchainedCore): Promise<UnchainedLoaders['loaders']> => {
   return {
     assortmentLoader: new DataLoader(
       async (queries) => {
@@ -216,7 +208,6 @@ const loaders = async (
           ({ filterId, filterOptionValue }) =>
           (text) =>
             text.filterId === filterId && text.filterOptionValue === filterOptionValue;
-
         return getFilteredQueries({ queries, texts, filterFn });
       },
       { batchScheduleFn: (cb) => setImmediate(cb) },

package/src/locale-context.ts

@@ -1,22 +1,18 @@
-import { IncomingMessage, OutgoingMessage } from 'http';
-import { UnchainedLocaleContext } from '@unchainedshop/types/api.js';
-import localePkg from 'locale';
-import 'abort-controller/polyfill.js';
 import { log, LogLevel } from '@unchainedshop/logger';
 import {
   resolveBestCountry,
   resolveBestSupported,
   resolveBestCurrency,
-  resolveUserRemoteAddress,
   systemLocale,
 } from '@unchainedshop/utils';
-import { UnchainedCore } from '@unchainedshop/types/core.js';
+import { UnchainedCore } from '@unchainedshop/core';
 import memoizee from 'memoizee';
-
-const { Locales } = localePkg;
+import { UnchainedHTTPServerContext, UnchainedLocaleContext } from './types.js';
 
 const { NODE_ENV } = process.env;
 
+export type GetHeaderFn = (key: string) => string | string[];
+
 export const resolveDefaultContext = memoizee(
   async ({ acceptLang, acceptCountry }, unchainedAPI) => {
     const languages = await unchainedAPI.modules.languages.findLanguages(
@@ -31,22 +27,24 @@ export const resolveDefaultContext = memoizee(
 
     const currencies = await unchainedAPI.modules.currencies.findCurrencies({ includeInactive: false });
 
-    const supportedLocaleStrings = languages.reduce((accumulator, language) => {
+    const supportedLocaleStrings: Array<string> = languages.reduce((accumulator, language) => {
       const added = countries.map((country) => {
         return `${language.isoCode}-${country.isoCode}`;
       });
       return accumulator.concat(added);
     }, []);
 
-    const supportedLocales = new Locales(supportedLocaleStrings, systemLocale.code);
-
-    const localeContext = resolveBestSupported(acceptLang, supportedLocales);
-    const countryContext = resolveBestCountry(localeContext.country, acceptCountry, countries);
+    const localeContext = resolveBestSupported(
+      acceptLang,
+      supportedLocaleStrings,
+      systemLocale.baseName,
+    );
+    const countryContext = resolveBestCountry(localeContext.region, acceptCountry, countries);
 
     const countryObject = countries.find((country) => country.isoCode === countryContext);
     const currencyContext = resolveBestCurrency(countryObject.defaultCurrencyCode, currencies);
 
-    log(`Locale Context: Resolved ${localeContext.normalized} ${countryContext} ${currencyContext}`, {
+    log(`Locale Context: Resolved ${localeContext.baseName} ${countryContext} ${currencyContext}`, {
       level: LogLevel.Debug,
     });
 
@@ -68,14 +66,19 @@ export const resolveDefaultContext = memoizee(
 );
 
 export const getLocaleContext = async (
-  req: IncomingMessage,
-  res: OutgoingMessage,
+  {
+    remoteAddress,
+    remotePort,
+    getHeader,
+  }: {
+    remoteAddress: string;
+    remotePort: number;
+  } & UnchainedHTTPServerContext,
   unchainedAPI: UnchainedCore,
 ): Promise<UnchainedLocaleContext> => {
-  const userAgent = req.headers['user-agent'];
-  const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
+  const userAgent = getHeader('user-agent');
   const context = await resolveDefaultContext(
-    { acceptLang: req.headers['accept-language'], acceptCountry: req.headers['x-shop-country'] },
+    { acceptLang: getHeader('accept-language'), acceptCountry: getHeader('x-shop-country') },
     unchainedAPI,
   );
   return { remoteAddress, remotePort, userAgent, ...context };

package/src/resolvers/index.ts

@@ -1,5 +1,10 @@
-import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
-import { JSONResolver, TimestampResolver, DateTimeResolver, DateResolver } from 'graphql-scalars';
+import {
+  JSONResolver,
+  TimestampResolver,
+  DateTimeResolver,
+  DateResolver,
+  LocaleResolver,
+} from 'graphql-scalars';
 import Query from './queries/index.js';
 import Mutation from './mutations/index.js';
 import Types from './type/index.js';
@@ -8,11 +13,11 @@ import CustomScalars from './scalars/index.js';
 export default {
   ...Types,
   ...CustomScalars,
-  Upload: GraphQLUpload,
   JSON: JSONResolver,
   Query,
   Mutation,
   DateTime: DateTimeResolver,
   Date: DateResolver,
   Timestamp: TimestampResolver,
+  Locale: LocaleResolver,
 } as unknown as Record<string, any>;

package/src/resolvers/mutations/accounts/addEmail.ts

@@ -1,9 +1,9 @@
 import { log } from '@unchainedshop/logger';
-import { Context, Root } from '@unchainedshop/types/api.js';
-import { UserNotFoundError } from '../../../errors.js';
+import { EmailAlreadyExistsError, UserNotFoundError } from '../../../errors.js';
+import { Context } from '../../../types.js';
 
 export default async function addEmail(
-  root: Root,
+  root: never,
   params: { email: string; userId?: string },
   { modules, userId }: Context,
 ) {
@@ -14,7 +14,12 @@ export default async function addEmail(
   if (!(await modules.users.userExists({ userId: normalizedUserId })))
     throw new UserNotFoundError({ userId: normalizedUserId });
 
-  await modules.accounts.addEmail(normalizedUserId, params.email);
+  try {
+    await modules.users.addEmail(normalizedUserId, params.email);
+  } catch (e) {
+    if (e.cause === 'EMAIL_INVALID') throw new EmailAlreadyExistsError({ email: params?.email });
+    else throw e;
+  }
 
   return modules.users.findUserById(normalizedUserId);
 }

package/src/resolvers/mutations/accounts/addWeb3Address.ts

@@ -1,9 +1,9 @@
 import { log } from '@unchainedshop/logger';
-import { Context, Root } from '@unchainedshop/types/api.js';
 import { UserWeb3InvalidAddressError } from '../../../errors.js';
+import { Context } from '../../../types.js';
 
 export default async function addWeb3Address(
-  root: Root,
+  root: never,
   { address }: { address: any },
   { modules, userId, user }: Context,
 ) {

package/src/resolvers/mutations/accounts/addWebAuthnCredentials.ts

@@ -1,8 +1,8 @@
 import { log } from '@unchainedshop/logger';
-import { Context, Root } from '@unchainedshop/types/api.js';
+import { Context } from '../../../types.js';
 
 export default async function addWebAuthnCredentials(
-  root: Root,
+  root: never,
   { credentials }: { credentials: any },
   { modules, userId, user }: Context,
 ) {
@@ -10,7 +10,7 @@ export default async function addWebAuthnCredentials(
     userId,
   });
 
-  const webAuthnService = await modules.accounts.webAuthn.verifyCredentialCreation(
+  const webAuthnService = await modules.users.webAuthn.verifyCredentialCreation(
     user.username,
     credentials,
   );

package/src/resolvers/mutations/accounts/changePassword.ts

@@ -1,30 +1,40 @@
 import { log } from '@unchainedshop/logger';
-import { Context, Root } from '@unchainedshop/types/api.js';
-import { AuthOperationFailedError, InvalidCredentialsError } from '../../../errors.js';
+import { InvalidCredentialsError, PasswordInvalidError } from '../../../errors.js';
+import { Context } from '../../../types.js';
 
 export default async function changePassword(
-  root: Root,
+  root: never,
   params: {
-    oldPlainPassword?: string;
-    newPlainPassword?: string;
+    oldPassword?: string;
+    newPassword?: string;
   },
   { modules, userId }: Context,
 ) {
   log('mutation changePassword', { userId });
 
-  if (!params.newPlainPassword) {
+  if (!params.newPassword) {
     throw new Error('New password is required');
   }
-  if (!params.oldPlainPassword) {
+  if (!params.oldPassword) {
     throw new Error('Old password is required');
   }
+
+  const user = await modules.users.findUserById(userId);
+
+  const isValidCurrentPassword =
+    user.services?.password &&
+    (await modules.users.verifyPassword(user.services?.password, params.oldPassword));
+  if (!isValidCurrentPassword) throw new InvalidCredentialsError({});
+
   let success = false;
+
   try {
-    success = await modules.accounts.changePassword(userId, params);
+    await modules.users.setPassword(user._id, params.newPassword);
+    success = true;
   } catch (e) {
     success = false;
-    if (e.code === 'InvalidCredentials') throw new InvalidCredentialsError({});
-    else throw new AuthOperationFailedError({});
+    if (e.cause === 'PASSWORD_INVALID') throw new PasswordInvalidError({ userId });
+    else throw e;
   }
 
   return { success };

package/src/resolvers/mutations/accounts/createUser.ts

@@ -1,61 +1,54 @@
-import { UserData } from '@unchainedshop/types/accounts.js';
-import { Context, Root } from '@unchainedshop/types/api.js';
+import { UserData } from '@unchainedshop/core-users';
+import { Context } from '../../../types.js';
 import { log } from '@unchainedshop/logger';
-import { hashPassword } from '../../../hashPassword.js';
 import {
   AuthOperationFailedError,
   EmailAlreadyExistsError,
   UsernameAlreadyExistsError,
   UsernameOrEmailRequiredError,
+  PasswordOrWebAuthnPublicKeyRequiredError,
+  PasswordInvalidError,
 } from '../../../errors.js';
 
-export default async function createUser(root: Root, params: UserData, context: Context) {
+export default async function createUser(root: never, params: UserData, context: Context) {
   const { modules, userId } = context;
 
   log('mutation createUser', { email: params.email, username: params.username, userId });
 
-  if (!params.plainPassword && !params.webAuthnPublicKeyCredentials) {
-    throw new Error('Password or Public Key is required');
+  if (!params.username && !params.email) {
+    throw new UsernameOrEmailRequiredError({ username: params?.username });
   }
 
-  const mappedUser = { ...params };
-  if (mappedUser.plainPassword) {
-    mappedUser.password = hashPassword(mappedUser.plainPassword);
-  }
-  delete mappedUser.plainPassword;
-  delete mappedUser.webAuthnPublicKeyCredentials;
-
-  const webAuthnService =
-    params.webAuthnPublicKeyCredentials &&
-    (await modules.accounts.webAuthn.verifyCredentialCreation(
-      params.username,
-      params.webAuthnPublicKeyCredentials,
-    ));
-  let newUserId;
-  try {
-    newUserId = await modules.accounts.createUser(mappedUser, {
-      skipPasswordEnrollment: !!webAuthnService,
-    });
-  } catch (e) {
-    if (e.code === 'EmailAlreadyExists') throw new EmailAlreadyExistsError({ email: params?.email });
-    else if (e.code === 'UsernameAlreadyExists')
-      throw new UsernameAlreadyExistsError({ username: params?.username });
-    else if (e.code === 'UsernameOrEmailRequired')
-      throw new UsernameOrEmailRequiredError({ username: params?.username });
-    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  if (!params.password && !params.webAuthnPublicKeyCredentials) {
+    throw new PasswordOrWebAuthnPublicKeyRequiredError({ username: params?.username });
   }
 
-  if (newUserId && webAuthnService) {
-    await modules.users.updateUser(
-      { _id: newUserId },
+  try {
+    const newUserId = await modules.users.createUser(
       {
-        $push: {
-          'services.webAuthn': webAuthnService,
-        },
+        ...params,
+        initialPassword: false,
       },
       {},
     );
-  }
 
-  return modules.accounts.createLoginToken(newUserId, context);
+    let user = await modules.users.findUserById(newUserId);
+
+    user = await context.modules.users.updateHeartbeat(user._id, {
+      remoteAddress: context.remoteAddress,
+      remotePort: context.remotePort,
+      userAgent: context.userAgent,
+      locale: context.localeContext.baseName,
+      countryCode: context.countryContext,
+    });
+
+    return context.login(user);
+  } catch (e) {
+    if (e.cause === 'EMAIL_INVALID') throw new EmailAlreadyExistsError({ email: params?.email });
+    else if (e.cause === 'USERNAME_INVALID')
+      throw new UsernameAlreadyExistsError({ username: params?.username });
+    else if (e.cause === 'PASSWORD_INVALID')
+      throw new PasswordInvalidError({ username: params?.username });
+    else throw new AuthOperationFailedError({ username: params?.username, email: params.email });
+  }
 }