@unchainedshop/api 3.0.0-rc9 → 3.0.1

package/src/fastify/index.ts

@@ -1,4 +1,4 @@
-import { getCurrentContextResolver } from '../context.js';
+import { getCurrentContextResolver, LoginFn, LogoutFn } from '../context.js';
 import bulkImportHandler from './bulkImportHandler.js';
 import ercMetadataHandler from './ercMetadataHandler.js';
 import MongoStore from 'connect-mongo';
@@ -10,7 +10,8 @@ import { API_EVENTS } from '../events.js';
 import { User } from '@unchainedshop/core-users';
 import fastifySession from '@fastify/session';
 import fastifyCookie from '@fastify/cookie';
-import { FastifyInstance, FastifyRequest } from 'fastify';
+import { FastifyBaseLogger, FastifyInstance, FastifyRequest } from 'fastify';
+import { createLogger } from '@unchainedshop/logger';
 
 const resolveUserRemoteAddress = (req: FastifyRequest) => {
   const remoteAddress =
@@ -41,44 +42,69 @@ const middlewareHook = async function middlewareHook(req: any, reply: any) {
 
   const context = getCurrentContextResolver();
 
-  async function login(user: User) {
-    req.session.user = user;
+  const login: LoginFn = async function (user: User, options = {}) {
+    const { impersonator } = options;
+
+    req.session.userId = user._id;
+    req.session.impersonatorId = impersonator?._id;
+
     const tokenObject = {
       _id: req.session.sessionId,
       userId: user._id,
-      /* eslint-disable-next-line */
-      tokenExpires: new Date((req as any).session?.cookie._expires),
+      // eslint-disable-next-line
+      tokenExpires: new Date((req as any).session.cookie._expires),
     };
     await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
     /* eslint-disable-next-line */
     (user as any)._inLoginMethodResponse = true;
     return { user, ...tokenObject };
-  }
+  };
 
-  async function logout() {
+  const logout: LogoutFn = async function logout() {
     /* eslint-disable-line */
-    if (!req.session?.user?._id) return false;
     const tokenObject = {
       _id: (req as any).session.sessionId,
-      userId: req.session?.user?._id,
+      userId: req.session?.userId,
     };
-    req.session.user = null;
+    req.session.userId = null;
     await emit(API_EVENTS.API_LOGOUT, tokenObject);
     return true;
-  }
+  };
 
   const [, accessToken] = req.headers.authorization?.split(' ') || [];
 
-  (req as any).unchainedContext = await context({
-    setHeader,
-    getHeader,
-    remoteAddress,
-    remotePort,
-    login,
-    logout,
-    accessToken,
-    userId: req.session.user?._id,
-  });
+  (req as any).unchainedContext = await context(
+    {
+      setHeader,
+      getHeader,
+      remoteAddress,
+      remotePort,
+      login,
+      logout,
+      accessToken,
+      userId: req.session.userId,
+      impersonatorId: req.session.impersonatorId,
+    },
+    req,
+    reply,
+  );
+};
+
+export const unchainedLogger = (prefix: string): FastifyBaseLogger => {
+  const logger = createLogger(prefix);
+  function Logger(...args) {
+    this.args = args;
+  }
+  Logger.prototype.info = logger.info;
+  Logger.prototype.error = logger.error;
+  Logger.prototype.debug = logger.debug;
+  Logger.prototype.fatal = logger.error;
+  Logger.prototype.warn = logger.warn;
+  Logger.prototype.trace = logger.trace;
+  Logger.prototype.child = function () {
+    return new Logger();
+  };
+  return new Logger();
 };
 
 export const connect = (
@@ -87,7 +113,23 @@ export const connect = (
     graphqlHandler,
     db,
   }: { graphqlHandler: YogaServerInstance<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
+  {
+    allowRemoteToLocalhostSecureCookies = false,
+  }: { allowRemoteToLocalhostSecureCookies?: boolean } = {},
 ) => {
+  if (allowRemoteToLocalhostSecureCookies) {
+    // Workaround: Allow to use sandbox with localhost
+    // https://github.com/fastify/fastify-cookie/issues/308
+    fastify.addHook('preHandler', async function (request) {
+      request.headers['x-forwarded-proto'] = 'https';
+    });
+    fastify.addHook('onSend', async function (_, reply) {
+      reply.headers({
+        'Access-Control-Allow-Private-Network': 'true',
+      });
+    });
+  }
+
   const cookieName = UNCHAINED_COOKIE_NAME;
   const domain = UNCHAINED_COOKIE_DOMAIN;
   const path = UNCHAINED_COOKIE_PATH;
@@ -100,7 +142,9 @@ export const connect = (
     '0': false,
   }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false) as boolean | 'none' | 'lax' | 'strict';
 
-  fastify.register(fastifyCookie);
+  if (!fastify.hasPlugin('@fastify/cookie')) {
+    fastify.register(fastifyCookie);
+  }
   fastify.register(fastifySession, {
     secret: process.env.UNCHAINED_TOKEN_SECRET,
     cookieName,