@unchainedshop/api 3.1.10 → 3.1.12

package/lib/mcp/tools/listProducts.js

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+/**
+ * Zod schema for the list_products tool (as raw object for MCP)
+ */
+export const ListProductsSchema = {
+    // Search & Filter
+    queryString: z.string().optional().describe('Text search across product fields'),
+    tags: z.array(z.string()).optional().describe('Filter by product tags'),
+    productIds: z.array(z.string()).optional().describe('Filter by specific product IDs'),
+    filterQuery: z
+        .array(z.object({
+        key: z.string().describe('Filter key'),
+        value: z.string().optional().describe('Filter value'),
+    }))
+        .optional()
+        .describe('Key-value filter pairs'),
+    assortmentId: z.string().optional().describe('Filter by assortment'),
+    includeInactive: z.boolean().default(false).describe('Include inactive products'),
+    // Pagination
+    limit: z.number().min(1).max(100).default(20).describe('Results per page'),
+    offset: z.number().min(0).default(0).describe('Skip results for pagination'),
+    // Sorting
+    sort: z
+        .array(z.object({
+        key: z.string().describe('Sort field'),
+        value: z.enum(['ASC', 'DESC']).describe('Sort direction'),
+    }))
+        .optional()
+        .describe('Sort options'),
+};
+/**
+ * Zod object schema for type inference
+ */
+export const ListProductsZodSchema = z.object(ListProductsSchema);
+/**
+ * Implementation of the list_products tool
+ */
+export async function listProductsHandler(context, params) {
+    const { queryString, tags, productIds, filterQuery, assortmentId, includeInactive = false, limit = 20, offset = 0, sort, } = params;
+    try {
+        let filteredProductIds = productIds;
+        // If assortmentId is provided, get product IDs from assortment
+        if (assortmentId) {
+            const assortmentProductIds = await context.modules.assortments.products.findProductIds({
+                assortmentId,
+            });
+            if (filteredProductIds) {
+                // Intersection of both sets
+                filteredProductIds = filteredProductIds.filter((id) => assortmentProductIds.includes(id));
+            }
+            else {
+                filteredProductIds = assortmentProductIds;
+            }
+        }
+        const searchResult = await context.services.filters.searchProducts({
+            queryString,
+            productIds: filteredProductIds,
+            includeInactive,
+            filterQuery: filterQuery?.filter((f) => f.key),
+        }, {
+            locale: context.locale,
+        });
+        const products = await context.modules.products.findProducts({
+            productIds: searchResult.aggregatedFilteredProductIds,
+            tags,
+            limit,
+            offset,
+            sort: sort?.filter((s) => s.key),
+        });
+        const productTexts = await context.loaders.productTextLoader.loadMany(searchResult.aggregatedFilteredProductIds.map((productId) => ({
+            productId,
+            locale: context.locale,
+        })));
+        // iterate all products and add texts
+        products.forEach((product) => {
+            const texts = productTexts.filter((text) => text.productId === product._id);
+            product.texts = texts;
+        });
+        // const htmlContent = generateProductsHTML(products, productTexts, {
+        //   offset,
+        //   limit,
+        //   total,
+        // });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        products,
+                        total: searchResult.aggregatedTotalProductIds.length,
+                        filtered: searchResult.aggregatedFilteredProductIds.length,
+                    }),
+                },
+                // {
+                //   type: 'resource',
+                //   resource: {
+                //     text: htmlContent,
+                //     uri: `data:text/html,charset=UTF-8,${encodeURIComponent(htmlContent)}`,
+                //     mimeType: 'text/html',
+                //   },
+                // },
+            ],
+        };
+    }
+    catch (error) {
+        return {
+            content: [{ type: 'text', text: `Error listing products: ${error.message}` }],
+        };
+    }
+}
+//# sourceMappingURL=listProducts.js.map

package/lib/mcp/tools/listProducts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listProducts.js","sourceRoot":"","sources":["../../../src/mcp/tools/listProducts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kBAAkB;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACrF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;KACtD,CAAC,CACH;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,wBAAwB,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACpE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAEjF,aAAa;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAE5E,UAAU;IACV,IAAI,EAAE,CAAC;SACJ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KAC1D,CAAC,CACH;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,cAAc,CAAC;CAC5B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAOlE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,MAA0B;IACpF,MAAM,EACJ,WAAW,EACX,IAAI,EACJ,UAAU,EACV,WAAW,EACX,YAAY,EACZ,eAAe,GAAG,KAAK,EACvB,KAAK,GAAG,EAAE,EACV,MAAM,GAAG,CAAC,EACV,IAAI,GACL,GAAG,MAAM,CAAC;IAEX,IAAI,CAAC;QACH,IAAI,kBAAkB,GAAG,UAAU,CAAC;QAEpC,+DAA+D;QAC/D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACrF,YAAY;aACb,CAAC,CAAC;YAEH,IAAI,kBAAkB,EAAE,CAAC;gBACvB,4BAA4B;gBAC5B,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,oBAAoB,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAChE;YACE,WAAW;YACX,UAAU,EAAE,kBAAkB;YAC9B,eAAe;YACf,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAsC;SACpF,EACD;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CACF,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC3D,UAAU,EAAE,YAAY,CAAC,4BAA4B;YACrD,IAAI;YACJ,KAAK;YACL,MAAM;YACN,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAA4C;SAC5E,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CACnE,YAAY,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5D,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC,CACJ,CAAC;QAEF,qCAAqC;QACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAoB,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5F,OAAe,CAAC,KAAK,GAAG,KAAK,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,YAAY;QACZ,WAAW;QACX,WAAW;QACX,MAAM;QAEN,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,QAAQ;wBACR,KAAK,EAAE,YAAY,CAAC,yBAAyB,CAAC,MAAM;wBACpD,QAAQ,EAAE,YAAY,CAAC,4BAA4B,CAAC,MAAM;qBAC3D,CAAC;iBACH;gBACD,IAAI;gBACJ,sBAAsB;gBACtB,gBAAgB;gBAChB,yBAAyB;gBACzB,8EAA8E;gBAC9E,6BAA6B;gBAC7B,OAAO;gBACP,KAAK;aACN;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,2BAA4B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/mcp/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared types for MCP tools
+ */
+/**
+ * Base tool response type
+ */
+export interface ToolResponse {
+    content: {
+        type: 'text' | 'resource';
+        text?: string;
+        resource?: {
+            text: string;
+            uri: string;
+            mimeType: string;
+        };
+    }[];
+}
+/**
+ * Error response type
+ */
+export interface ErrorResponse {
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/mcp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE;YACT,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,EAAE,CAAC;CACL;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;CACL"}

package/lib/mcp/types.js

@@ -0,0 +1,5 @@
+/**
+ * Shared types for MCP tools
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/lib/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/mcp/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/lib/mcp/utils/html.d.ts

@@ -0,0 +1,16 @@
+/**
+ * HTML generation utilities for MCP server responses
+ */
+/**
+ * Escape HTML special characters to prevent XSS
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * Generate HTML output for products list with Unchained styling
+ */
+export declare function generateProductsHTML(products: any[], productTexts: any[], pagination: {
+    offset: number;
+    limit: number;
+    total: number;
+}): string;
+//# sourceMappingURL=html.d.ts.map

package/lib/mcp/utils/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/mcp/utils/html.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ/C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,GAAG,EAAE,EACf,YAAY,EAAE,GAAG,EAAE,EACnB,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3D,MAAM,CAuCR"}

package/lib/mcp/utils/html.js

@@ -0,0 +1,102 @@
+/**
+ * HTML generation utilities for MCP server responses
+ */
+/**
+ * Escape HTML special characters to prevent XSS
+ */
+export function escapeHtml(text) {
+    if (!text)
+        return '';
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Generate HTML output for products list with Unchained styling
+ */
+export function generateProductsHTML(products, productTexts, pagination) {
+    const { offset, total } = pagination;
+    const resultsShown = products.length;
+    const startIndex = offset + 1;
+    const endIndex = offset + resultsShown;
+    return `
+  <!DOCTYPE html>
+  <html>
+    <head>
+      <meta charset="UTF-8" />
+      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    </head>
+    <body>
+      <div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui; max-width: 1200px;">
+        <div style="margin-bottom: 16px; display: flex; justify-content: space-between; align-items: center;">
+          <h3 style="color: #343a40; margin: 0;">Products</h3>
+          <span style="color: #6c757d; font-size: 14px;">Showing ${startIndex}-${endIndex} of ${total}</span>
+        </div>
+        
+        <div style="background: white; border-radius: 6px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); overflow: hidden;">
+          <table style="width: 100%; border-collapse: collapse;">
+            <thead style="background: #f8f9fa; border-bottom: 1px solid #e9ecef;">
+              <tr>
+                <th style="padding: 12px; text-align: left; font-weight: 600; color: #343a40;">Image</th>
+                <th style="padding: 12px; text-align: left; font-weight: 600; color: #343a40;">Product</th>
+                <th style="padding: 12px; text-align: left; font-weight: 600; color: #343a40;">SKU</th>
+                <th style="padding: 12px; text-align: left; font-weight: 600; color: #343a40;">Status</th>
+                <th style="padding: 12px; text-align: left; font-weight: 600; color: #343a40;">ID</th>
+              </tr>
+            </thead>
+            <tbody>
+              ${products.map((product, index) => generateProductRow(product, index)).join('')}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </body>
+  </html>`;
+}
+/**
+ * Generate a single product row for the HTML table
+ */
+function generateProductRow(product, index) {
+    const isEven = index % 2 === 0;
+    const backgroundColor = isEven ? '#ffffff' : '#f8f9fa';
+    // Get product title from texts
+    const title = product.texts?.find((t) => t.locale === 'en')?.title || product.title || 'Untitled Product';
+    // Get SKU from warehousing info
+    const sku = product.warehousing?.sku || 'N/A';
+    // Get status with proper formatting
+    const status = product.status || 'DRAFT';
+    const statusColor = status === 'ACTIVE' ? '#28a745' : status === 'DRAFT' ? '#ffc107' : '#6c757d';
+    // Product ID (shortened for display)
+    const productId = product._id?.toString() || 'N/A';
+    const shortId = productId.length > 12 ? `${productId.substring(0, 12)}...` : productId;
+    return `
+        <tr style="background: ${backgroundColor}; border-bottom: 1px solid #e9ecef;">
+          <td style="padding: 12px;">
+            <div style="width: 40px; height: 40px; background: #e9ecef; border-radius: 4px; display: flex; align-items: center; justify-content: center; color: #6c757d; font-size: 12px;">
+              IMG
+            </div>
+          </td>
+          <td style="padding: 12px;">
+            <div style="font-weight: 500; color: #343a40;">${escapeHtml(title)}</div>
+            ${product.tags?.length
+        ? `<div style="font-size: 12px; color: #6c757d; margin-top: 4px;">${product.tags
+            .slice(0, 3)
+            .map((tag) => `<span style="background: #e9ecef; padding: 2px 6px; border-radius: 3px; margin-right: 4px;">${escapeHtml(tag)}</span>`)
+            .join('')}</div>`
+        : ''}
+          </td>
+          <td style="padding: 12px;">
+            <span style="color: #343a40; font-family: monospace;">${escapeHtml(sku)}</span>
+          </td>
+          <td style="padding: 12px;">
+            <span style="color: ${statusColor}; font-weight: 500; font-size: 12px; text-transform: uppercase; background: ${statusColor}20; padding: 4px 8px; border-radius: 12px;">${status}</span>
+          </td>
+          <td style="padding: 12px;">
+            <span style="color: #6c757d; font-family: monospace; font-size: 12px;" title="${escapeHtml(productId)}">${escapeHtml(shortId)}</span>
+          </td>
+        </tr>`;
+}
+//# sourceMappingURL=html.js.map

package/lib/mcp/utils/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/mcp/utils/html.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAe,EACf,YAAmB,EACnB,UAA4D;IAE5D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC;IAEvC,OAAO;;;;;;;;;;;mEAW0D,UAAU,IAAI,QAAQ,OAAO,KAAK;;;;;;;;;;;;;;;gBAerF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;;;;;UAMnF,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAY,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvD,+BAA+B;IAC/B,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAEnG,gCAAgC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,KAAK,CAAC;IAE9C,oCAAoC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,qCAAqC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,OAAO;iCACwB,eAAe;;;;;;;6DAOa,UAAU,CAAC,KAAK,CAAC;cAEhE,OAAO,CAAC,IAAI,EAAE,MAAM;QAClB,CAAC,CAAC,kEAAkE,OAAO,CAAC,IAAI;aAC3E,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CACF,CAAC,GAAW,EAAE,EAAE,CACd,+FAA+F,UAAU,CAAC,GAAG,CAAC,SAAS,CAC1H;aACA,IAAI,CAAC,EAAE,CAAC,QAAQ;QACrB,CAAC,CAAC,EACN;;;oEAGwD,UAAU,CAAC,GAAG,CAAC;;;kCAGjD,WAAW,+EAA+E,WAAW,+CAA+C,MAAM;;;4FAGhG,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC;;cAE3H,CAAC;AACf,CAAC"}

package/lib/middleware/accountLockout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountLockout.d.ts","sourceRoot":"","sources":["../../src/middleware/accountLockout.ts"],"names":[],"mappings":"AAuCA,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB3E;AAED,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChF;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E"}

package/lib/middleware/accountLockout.js

@@ -0,0 +1,84 @@
+import { GraphQLError } from 'graphql';
+// Store login attempts by user identifier (username/email)
+const loginAttempts = new Map();
+// Configuration
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes
+const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes
+// Clean up old entries periodically
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, attempt] of loginAttempts.entries()) {
+        // Remove entries older than 24 hours
+        if (now - attempt.lastAttempt > 24 * 60 * 60 * 1000) {
+            loginAttempts.delete(key);
+        }
+    }
+}, 60 * 60 * 1000); // Clean every hour
+async function createIdentifierHash(identifier) {
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(identifier.toLowerCase());
+    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+export async function checkAccountLockout(identifier) {
+    const hashedIdentifier = await createIdentifierHash(identifier);
+    const attempt = loginAttempts.get(hashedIdentifier);
+    if (!attempt)
+        return;
+    const now = Date.now();
+    // Check if account is locked
+    if (attempt.lockedUntil && attempt.lockedUntil > now) {
+        const remainingMinutes = Math.ceil((attempt.lockedUntil - now) / 60000);
+        throw new GraphQLError(`Account is locked. Please try again in ${remainingMinutes} minutes.`, {
+            extensions: {
+                code: 'ACCOUNT_LOCKED',
+                lockedUntil: attempt.lockedUntil,
+                remainingMinutes,
+            },
+        });
+    }
+    // Reset attempts if outside the window
+    if (now - attempt.firstAttempt > ATTEMPT_WINDOW) {
+        loginAttempts.delete(hashedIdentifier);
+    }
+}
+export async function recordFailedLoginAttempt(identifier) {
+    const hashedIdentifier = await createIdentifierHash(identifier);
+    const now = Date.now();
+    let attempt = loginAttempts.get(hashedIdentifier);
+    if (!attempt || now - attempt.firstAttempt > ATTEMPT_WINDOW) {
+        // Create new attempt record or reset if outside window
+        attempt = {
+            count: 1,
+            firstAttempt: now,
+            lastAttempt: now,
+        };
+    }
+    else {
+        // Increment existing attempt
+        attempt.count++;
+        attempt.lastAttempt = now;
+        // Lock account if max attempts exceeded
+        if (attempt.count >= MAX_ATTEMPTS) {
+            attempt.lockedUntil = now + LOCKOUT_DURATION;
+        }
+    }
+    loginAttempts.set(hashedIdentifier, attempt);
+    // Provide warning about remaining attempts
+    if (attempt.count >= 3 && attempt.count < MAX_ATTEMPTS) {
+        const remainingAttempts = MAX_ATTEMPTS - attempt.count;
+        throw new GraphQLError(`Invalid credentials. ${remainingAttempts} attempts remaining before account lockout.`, {
+            extensions: {
+                code: 'INVALID_CREDENTIALS',
+                remainingAttempts,
+            },
+        });
+    }
+}
+export async function clearLoginAttempts(identifier) {
+    const hashedIdentifier = await createIdentifierHash(identifier);
+    loginAttempts.delete(hashedIdentifier);
+}
+//# sourceMappingURL=accountLockout.js.map

package/lib/middleware/accountLockout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountLockout.js","sourceRoot":"","sources":["../../src/middleware/accountLockout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AASvC,2DAA2D;AAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD,gBAAgB;AAChB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AACtD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAEpD,oCAAoC;AACpC,WAAW,CACT,GAAG,EAAE;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,qCAAqC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACpD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC,EACD,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC,CAAC,mBAAmB;AAEtB,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACpD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,6BAA6B;IAC7B,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACxE,MAAM,IAAI,YAAY,CAAC,0CAA0C,gBAAgB,WAAW,EAAE;YAC5F,UAAU,EAAE;gBACV,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,gBAAgB;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,cAAc,EAAE,CAAC;QAChD,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAC/D,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,cAAc,EAAE,CAAC;QAC5D,uDAAuD;QACvD,OAAO,GAAG;YACR,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,GAAG;YACjB,WAAW,EAAE,GAAG;SACjB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;QAE1B,wCAAwC;QACxC,IAAI,OAAO,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,OAAO,CAAC,WAAW,GAAG,GAAG,GAAG,gBAAgB,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,YAAY,EAAE,CAAC;QACvD,MAAM,iBAAiB,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;QACvD,MAAM,IAAI,YAAY,CACpB,wBAAwB,iBAAiB,6CAA6C,EACtF;YACE,UAAU,EAAE;gBACV,IAAI,EAAE,qBAAqB;gBAC3B,iBAAiB;aAClB;SACF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC"}

package/lib/middleware/rateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAEA,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAkCD,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAS,gBAAqB,MAmBnE,SAAS,GAAG,qBA8B3B,CAAC;AAGF,eAAO,MAAM,eAAe,YAjCH,GAAG,qBAqC1B,CAAC;AAEH,eAAO,MAAM,wBAAwB,YAvCZ,GAAG,qBAiD1B,CAAC;AAEH,eAAO,MAAM,uBAAuB,YAnDX,GAAG,qBA4D1B,CAAC"}

package/lib/middleware/rateLimiter.js

@@ -0,0 +1,91 @@
+import { GraphQLError } from 'graphql';
+const stores = {};
+// Clean up expired entries periodically
+setInterval(() => {
+    const now = Date.now();
+    Object.keys(stores).forEach((storeName) => {
+        const store = stores[storeName];
+        Object.keys(store).forEach((key) => {
+            if (store[key].resetTime < now) {
+                delete store[key];
+            }
+        });
+    });
+}, 60000); // Clean every minute
+// Helper to create hash using WebCrypto
+async function createHash(data) {
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(data);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+export const createRateLimiter = (storeName, options = {}) => {
+    const { windowMs = 15 * 60 * 1000, // 15 minutes default
+    max = 5, // 5 requests per window default
+    message = 'Too many requests, please try again later.', keyGenerator = async (context) => {
+        // Default key generator uses IP + userId
+        const ip = context.req?.ip || context.req?.connection?.remoteAddress || 'unknown';
+        const userId = context.userId || 'anonymous';
+        return createHash(`${ip}-${userId}`);
+    }, } = options;
+    // Initialize store for this limiter
+    if (!stores[storeName]) {
+        stores[storeName] = {};
+    }
+    const store = stores[storeName];
+    return async (context) => {
+        const key = await keyGenerator(context);
+        const now = Date.now();
+        // Get or create rate limit entry
+        let entry = store[key];
+        if (!entry || entry.resetTime < now) {
+            entry = {
+                count: 0,
+                resetTime: now + windowMs,
+            };
+            store[key] = entry;
+        }
+        // Increment counter
+        entry.count++;
+        // Check if limit exceeded
+        if (entry.count > max) {
+            const retryAfter = Math.ceil((entry.resetTime - now) / 1000);
+            throw new GraphQLError(message, {
+                extensions: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    retryAfter,
+                },
+            });
+        }
+        return true;
+    };
+};
+// Pre-configured rate limiters for common use cases
+export const authRateLimiter = createRateLimiter('auth', {
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 5, // 5 attempts per 15 minutes
+    message: 'Too many authentication attempts. Please try again later.',
+});
+export const passwordResetRateLimiter = createRateLimiter('passwordReset', {
+    windowMs: 60 * 60 * 1000, // 1 hour
+    max: 3, // 3 attempts per hour
+    message: 'Too many password reset requests. Please try again later.',
+    keyGenerator: async (context) => {
+        // Rate limit by email/username instead of IP for password reset
+        const { email, username } = context.args || {};
+        const identifier = email || username || 'unknown';
+        return createHash(identifier.toLowerCase());
+    },
+});
+export const registrationRateLimiter = createRateLimiter('registration', {
+    windowMs: 60 * 60 * 1000, // 1 hour
+    max: 10, // 10 registrations per hour per IP
+    message: 'Too many registration attempts. Please try again later.',
+    keyGenerator: async (context) => {
+        // Rate limit by IP only for registrations
+        const ip = context.req?.ip || context.req?.connection?.remoteAddress || 'unknown';
+        return createHash(ip);
+    },
+});
+//# sourceMappingURL=rateLimiter.js.map

package/lib/middleware/rateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.js","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiBvC,MAAM,MAAM,GAAmC,EAAE,CAAC;AAElD,wCAAwC;AACxC,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB;AAEhC,wCAAwC;AACxC,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,UAA4B,EAAE,EAAE,EAAE;IACrF,MAAM,EACJ,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,qBAAqB;IAChD,GAAG,GAAG,CAAC,EAAE,gCAAgC;IACzC,OAAO,GAAG,4CAA4C,EACtD,YAAY,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,yCAAyC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,IAAI,SAAS,CAAC;QAClF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;QAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,GACF,GAAG,OAAO,CAAC;IAEZ,oCAAoC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,EAAE,OAAY,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,iCAAiC;QACjC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG;gBACN,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,QAAQ;aAC1B,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,0BAA0B;QAC1B,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE;gBAC9B,UAAU,EAAE;oBACV,IAAI,EAAE,qBAAqB;oBAC3B,UAAU;iBACX;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,GAAG,EAAE,CAAC,EAAE,4BAA4B;IACpC,OAAO,EAAE,2DAA2D;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,eAAe,EAAE;IACzE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IACnC,GAAG,EAAE,CAAC,EAAE,sBAAsB;IAC9B,OAAO,EAAE,2DAA2D;IACpE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,gEAAgE;QAChE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,IAAI,QAAQ,IAAI,SAAS,CAAC;QAClD,OAAO,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,cAAc,EAAE;IACvE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IACnC,GAAG,EAAE,EAAE,EAAE,mCAAmC;IAC5C,OAAO,EAAE,yDAAyD;IAClE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,0CAA0C;QAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,IAAI,SAAS,CAAC;QAClF,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;CACF,CAAC,CAAC"}

package/lib/plugins/inputValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputValidation.d.ts","sourceRoot":"","sources":["../../src/plugins/inputValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA6DtC,MAAM,WAAW,sBAAsB;IAErC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAErD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CA6C/E"}

package/lib/plugins/inputValidation.js

@@ -0,0 +1,95 @@
+import { GraphQLError } from 'graphql';
+// Dangerous patterns to check for
+const DANGEROUS_PATTERNS = [
+    /<script/i, // Script tags
+    /<iframe/i, // Iframes
+    /<object/i, // Object embeds
+    /<embed/i, // Embed tags
+    /<link/i, // Link tags (can load CSS)
+    /javascript:/i, // JavaScript protocol
+    /vbscript:/i, // VBScript protocol
+    /on\w+\s*=/i, // Event handlers (onclick, onload, etc)
+    /<meta/i, // Meta tags
+    /data:text\/html/i, // Data URLs with HTML
+    /<svg.*onload/i, // SVG with event handlers
+    /&#x?[0-9a-f]+;/i, // HTML entities (could be obfuscation)
+    /\\u[0-9a-f]{4}/i, // Unicode escapes
+    /expression\s*\(/i, // CSS expressions
+    /@import/i, // CSS imports
+    /<!--|-->/, // HTML comments
+];
+function checkForDangerousContent(value, path) {
+    for (const dangerous of DANGEROUS_PATTERNS) {
+        if (dangerous.test(value)) {
+            throw new GraphQLError(`Potentially dangerous content detected in ${path}`, {
+                extensions: {
+                    code: 'DANGEROUS_INPUT',
+                    path,
+                },
+            });
+        }
+    }
+}
+function validateValue(value, path = '') {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        checkForDangerousContent(value, path);
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item, index) => validateValue(item, `${path}[${index}]`));
+    }
+    if (typeof value === 'object') {
+        const validated = {};
+        for (const [key, val] of Object.entries(value)) {
+            validated[key] = validateValue(val, path ? `${path}.${key}` : key);
+        }
+        return validated;
+    }
+    return value;
+}
+export function useInputValidation(options = {}) {
+    const { skipOperations = [], skipFields = [], customValidator, logErrors = false } = options;
+    return {
+        onParams({ params, setParams }) {
+            // Get operation name from the request
+            const operationName = params.operationName || '';
+            // Skip if operation is in skip list
+            if (operationName && skipOperations.includes(operationName)) {
+                return;
+            }
+            try {
+                // Validate variables
+                if (params.variables) {
+                    const validatedVariables = {};
+                    for (const [key, value] of Object.entries(params.variables)) {
+                        if (!skipFields.includes(key)) {
+                            validatedVariables[key] = validateValue(value, `variables.${key}`);
+                            // Run custom validator if provided
+                            if (customValidator) {
+                                customValidator(value, `variables.${key}`);
+                            }
+                        }
+                        else {
+                            validatedVariables[key] = value;
+                        }
+                    }
+                    // Update params with validated variables
+                    setParams({
+                        ...params,
+                        variables: validatedVariables,
+                    });
+                }
+            }
+            catch (error) {
+                if (logErrors) {
+                    console.error('Input validation error:', error);
+                }
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=inputValidation.js.map

package/lib/plugins/inputValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputValidation.js","sourceRoot":"","sources":["../../src/plugins/inputValidation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,kCAAkC;AAClC,MAAM,kBAAkB,GAAG;IACzB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,gBAAgB;IAC5B,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,2BAA2B;IACrC,cAAc,EAAE,sBAAsB;IACtC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,wCAAwC;IACtD,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,sBAAsB;IAC1C,eAAe,EAAE,0BAA0B;IAC3C,iBAAiB,EAAE,uCAAuC;IAC1D,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE,kBAAkB;IACtC,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,gBAAgB;CAC7B,CAAC;AAEF,SAAS,wBAAwB,CAAC,KAAa,EAAE,IAAY;IAC3D,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,6CAA6C,IAAI,EAAE,EAAE;gBAC1E,UAAU,EAAE;oBACV,IAAI,EAAE,iBAAiB;oBACvB,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAU,EAAE,IAAI,GAAG,EAAE;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACrE,MAAM,EAAE,cAAc,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7F,OAAO;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE;YAC5B,sCAAsC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,qBAAqB;gBACrB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,kBAAkB,GAAQ,EAAE,CAAC;oBAEnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC9B,kBAAkB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;4BAEnE,mCAAmC;4BACnC,IAAI,eAAe,EAAE,CAAC;gCACpB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;4BAC7C,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,kBAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBAClC,CAAC;oBACH,CAAC;oBAED,yCAAyC;oBACzC,SAAS,CAAC;wBACR,GAAG,MAAM;wBACT,SAAS,EAAE,kBAAkB;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/schema/mutation.js

@@ -339,7 +339,7 @@ export default [
       """
       Set a new password for a specific user
       """
-      setPassword(newPassword!: String, userId: ID!): User!
+      setPassword(newPassword: String!, userId: ID!): User!
 
       """
       Set roles of a user

package/lib/utils/inputValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputValidation.d.ts","sourceRoot":"","sources":["../../src/utils/inputValidation.ts"],"names":[],"mappings":"AAuBA,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAU5D;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,SAAK,GAAG,GAAG,CAmBvD"}