@unchainedshop/api 4.3.5 → 4.4.0

package/src/roles/all.ts

@@ -1,170 +0,0 @@
-import { Context } from '../context.js';
-
-export const all = (role, actions) => {
-  const isInLoginMutationResponse = (root) => {
-    if (root && root._inLoginMethodResponse) {
-      return true;
-    }
-    return false;
-  };
-
-  const isOwnedToken = async (root: any, params: { tokenId: string } | null, context: Context) => {
-    const { modules, userId, user } = context;
-
-    const tokenId = params?.tokenId || (root && 'tokenSerialNumber' in root && root._id) || null;
-
-    const token = await modules.warehousing.findToken({ tokenId });
-    if (!token) return true;
-
-    const isOwnedByUser =
-      token.userId === userId ||
-      user?.services?.web3?.some((service) => {
-        return service.address === token.walletAddress && service.verified;
-      });
-
-    if (isOwnedByUser) return true;
-
-    const accessKeyHeader = context.getHeader('x-token-accesskey');
-    const accessKey = await context.modules.warehousing.buildAccessKeyForToken(tokenId);
-    if (accessKeyHeader && accessKeyHeader === accessKey) return true;
-
-    return false;
-  };
-
-  const isUsersCollectionEmpty = async (_: never, params: never, context: Context) => {
-    const count = await context.modules.users.count({
-      includeDeleted: true,
-      includeGuests: true,
-    });
-    if (count === 0) return true;
-    return false;
-  };
-
-  const isFilePublic = async (file) => {
-    // Non private files or no files always resolve to true
-    if (!file?.meta?.isPrivate) return true;
-    return false;
-  };
-
-  role.allow(actions.viewEvent, () => false);
-  role.allow(actions.viewEvents, () => false);
-  role.allow(actions.viewUser, () => false);
-  role.allow(actions.viewUsers, () => false);
-  role.allow(actions.viewUserCount, isUsersCollectionEmpty);
-  role.allow(actions.viewPaymentProviders, () => false);
-  role.allow(actions.viewPaymentProvider, () => false);
-  role.allow(actions.viewPaymentInterfaces, () => false);
-  role.allow(actions.viewDeliveryProviders, () => false);
-  role.allow(actions.viewDeliveryProvider, () => false);
-  role.allow(actions.viewDeliveryInterfaces, () => false);
-  role.allow(actions.viewWarehousingProviders, () => false);
-  role.allow(actions.viewWarehousingProvider, () => false);
-  role.allow(actions.viewWarehousingInterfaces, () => false);
-  role.allow(actions.viewOrders, () => false);
-  role.allow(actions.sendEmail, () => false);
-  role.allow(actions.updateUser, () => false);
-  role.allow(actions.updateUsername, () => false);
-  role.allow(actions.manageLanguages, () => false);
-  role.allow(actions.manageCountries, () => false);
-  role.allow(actions.manageProducts, () => false);
-  role.allow(actions.manageCurrencies, () => false);
-  role.allow(actions.managePaymentProviders, () => false);
-  role.allow(actions.manageDeliveryProviders, () => false);
-  role.allow(actions.manageWarehousingProviders, () => false);
-  role.allow(actions.manageAssortments, () => false);
-  role.allow(actions.manageFilters, () => false);
-  role.allow(actions.manageUsers, () => false);
-  role.allow(actions.enrollUser, () => false);
-  role.allow(actions.updateCart, () => false);
-  role.allow(actions.createCart, () => false);
-  role.allow(actions.checkoutCart, () => false);
-  role.allow(actions.updateOrder, () => false);
-  role.allow(actions.updateOrderDiscount, () => false);
-  role.allow(actions.updateOrderItem, () => false);
-  role.allow(actions.updateOrderDelivery, () => false);
-  role.allow(actions.updateOrderPayment, () => false);
-  role.allow(actions.markOrderConfirmed, () => false);
-  role.allow(actions.confirmMediaUpload, () => false);
-  role.allow(actions.markOrderRejected, () => false);
-  role.allow(actions.markOrderPaid, () => false);
-  role.allow(actions.markOrderDelivered, () => false);
-  role.allow(actions.reviewProduct, () => false);
-  role.allow(actions.updateProductReview, () => false);
-  role.allow(actions.manageProductReviews, () => false);
-  role.allow(actions.requestQuotation, () => false);
-  role.allow(actions.viewQuotations, () => false);
-  role.allow(actions.manageQuotations, () => false);
-  role.allow(actions.answerQuotation, () => false);
-  role.allow(actions.manageBookmarks, () => false);
-  role.allow(actions.bookmarkProduct, () => false);
-  role.allow(actions.voteProductReview, () => false);
-  role.allow(actions.manageWorker, () => false);
-  role.allow(actions.viewWorkQueue, () => false);
-  role.allow(actions.viewWork, () => false);
-  role.allow(actions.viewEnrollment, () => false);
-  role.allow(actions.viewEnrollments, () => false);
-  role.allow(actions.updateEnrollment, () => false);
-  role.allow(actions.createEnrollment, () => false);
-  role.allow(actions.registerPaymentCredentials, () => false);
-  role.allow(actions.managePaymentCredentials, () => false);
-  role.allow(actions.bulkImport, () => false);
-  role.allow(actions.viewOrder, () => false);
-  role.allow(actions.viewQuotation, () => false);
-  role.allow(actions.viewEnrollment, () => false);
-  role.allow(actions.viewTokens, () => false);
-  role.allow(actions.viewStatistics, () => false);
-  role.allow(actions.uploadUserAvatar, () => false);
-  role.allow(actions.uploadTempFile, () => false);
-  role.allow(actions.impersonate, () => false);
-  role.allow(actions.viewTranslations, () => false);
-
-  // special case: when doing a login mutation, the user is not logged in technically yet,
-  // but should be able to see user data of the user that is about to be logged in
-  role.allow(actions.viewLogs, isInLoginMutationResponse);
-  role.allow(actions.viewUserRoles, isInLoginMutationResponse);
-  role.allow(actions.viewUserOrders, isInLoginMutationResponse);
-  role.allow(actions.viewUserTokens, isInLoginMutationResponse);
-  role.allow(actions.viewUserQuotations, isInLoginMutationResponse);
-  role.allow(actions.viewUserPrivateInfos, isInLoginMutationResponse);
-  role.allow(actions.viewUserEnrollments, isInLoginMutationResponse);
-  role.allow(actions.viewUserProductReviews, isInLoginMutationResponse);
-
-  // special case: access to token sometimes works via a X-Token-AccessKey Header and thus should also be allowed for anonymous users
-  role.allow(actions.updateToken, isOwnedToken);
-  role.allow(actions.viewToken, isOwnedToken);
-
-  // special case: access to file downloads should work when meta.isPrivate is not set
-  role.allow(actions.downloadFile, isFilePublic);
-
-  // only allow if query is not demanding for drafts or inactive item lists
-  role.allow(actions.viewProducts, (root, { includeDrafts }) => !includeDrafts);
-  role.allow(actions.viewAssortments, (root, { includeInactive }) => !includeInactive);
-  role.allow(actions.viewCountries, (root, { includeInactive }) => !includeInactive);
-  role.allow(actions.viewCurrencies, (root, { includeInactive }) => !includeInactive);
-  role.allow(actions.viewFilters, (root, { includeInactive }) => !includeInactive);
-  role.allow(actions.viewLanguages, (root, { includeInactive }) => !includeInactive);
-  role.allow(actions.search, (root, { includeInactive }) => !includeInactive);
-
-  // public
-  role.allow(actions.viewUserPublicInfos, () => true);
-  role.allow(actions.viewProduct, () => true);
-  role.allow(actions.viewLanguage, () => true);
-  role.allow(actions.viewCountry, () => true);
-  role.allow(actions.viewCurrency, () => true);
-  role.allow(actions.viewShopInfo, () => true);
-  role.allow(actions.viewAssortment, () => true);
-  role.allow(actions.viewFilter, () => true);
-  role.allow(actions.logout, () => true);
-  role.allow(actions.stopImpersonation, () => true);
-  role.allow(actions.loginAsGuest, () => true);
-  role.allow(actions.loginWithPassword, () => true);
-  role.allow(actions.loginWithWebAuthn, () => true);
-  role.allow(actions.verifyEmail, () => true);
-  role.allow(actions.useWebAuthn, () => true);
-  role.allow(actions.pageView, () => true);
-  role.allow(actions.createUser, () => true);
-  role.allow(actions.forgotPassword, () => true);
-  role.allow(actions.resetPassword, () => true);
-  role.allow(actions.changePassword, () => true);
-  role.allow(actions.heartbeat, () => true);
-};

package/src/roles/index.ts

@@ -1,153 +0,0 @@
-import { Roles, Role } from '@unchainedshop/roles';
-import { all } from './all.js';
-import { loggedIn } from './loggedIn.js';
-import { admin } from './admin.js';
-
-const roles = {
-  ADMIN: Roles.adminRole,
-  LOGGEDIN: Roles.loggedInRole,
-  ALL: Roles.allRole,
-};
-
-const allRoles = roles;
-
-const actions: Record<string, string> = [
-  'impersonate',
-  'stopImpersonation',
-  'viewEvent',
-  'viewEvents',
-  'viewUserRoles',
-  'viewUserOrders',
-  'viewUserQuotations',
-  'viewUserPublicInfos',
-  'viewUserPrivateInfos',
-  'viewUserEnrollments',
-  'viewUserTokens',
-  'viewLogs',
-  'viewUser',
-  'viewUsers',
-  'viewUserCount',
-  'viewProduct',
-  'viewProducts',
-  'viewLanguages',
-  'viewLanguage',
-  'viewCountries',
-  'viewCountry',
-  'viewCurrencies',
-  'viewCurrency',
-  'viewPaymentProviders',
-  'viewPaymentProvider',
-  'viewPaymentInterfaces',
-  'viewDeliveryProviders',
-  'viewDeliveryProvider',
-  'viewDeliveryInterfaces',
-  'viewWarehousingProviders',
-  'viewWarehousingProvider',
-  'viewWarehousingInterfaces',
-  'viewTranslations',
-  'viewOrders',
-  'viewOrder',
-  'viewShopInfo',
-  'updateUser',
-  'updateUsername',
-  'sendEmail',
-  'manageUsers',
-  'enrollUser',
-  'manageLanguages',
-  'manageCountries',
-  'manageProducts',
-  'manageCurrencies',
-  'managePaymentProviders',
-  'manageDeliveryProviders',
-  'manageWarehousingProviders',
-  'updateToken',
-  'viewToken',
-  'viewTokens',
-  'manageAssortments',
-  'manageFilters',
-  'createCart',
-  'createEnrollment',
-  'updateEnrollment',
-  'updateCart',
-  'checkoutCart',
-  'updateOrder',
-  'updateOrderDelivery',
-  'updateOrderPayment',
-  'updateOrderDiscount',
-  'updateOrderItem',
-  'markOrderConfirmed',
-  'markOrderRejected',
-  'markOrderPaid',
-  'markOrderDelivered',
-  'viewAssortments',
-  'viewAssortment',
-  'viewFilter',
-  'viewFilters',
-  'reviewProduct',
-  'updateProductReview',
-  'manageProductReviews',
-  'voteProductReview',
-  'requestQuotation',
-  'viewQuotations',
-  'viewQuotation',
-  'manageQuotations',
-  'answerQuotation',
-  'bookmarkProduct',
-  'manageBookmarks',
-  'search',
-  'manageWorker',
-  'viewWorkQueue',
-  'viewWork',
-  'viewEnrollments',
-  'viewEnrollment',
-  'registerPaymentCredentials',
-  'managePaymentCredentials',
-  'bulkImport',
-  'logout',
-  'loginAsGuest',
-  'loginWithPassword',
-  'loginWithWebAuthn',
-  'verifyEmail',
-  'useWebAuthn',
-  'pageView',
-  'createUser',
-  'forgotPassword',
-  'resetPassword',
-  'changePassword',
-  'viewUserProductReviews',
-  'heartbeat',
-  'confirmMediaUpload',
-  'viewStatistics',
-  'removeUser',
-  'downloadFile',
-  'uploadUserAvatar',
-  'uploadTempFile',
-].reduce((oldValue, actionValue) => {
-  const newValue = oldValue;
-  newValue[actionValue] = actionValue;
-  return newValue;
-}, {});
-
-const configureRoles = ({
-  additionalRoles,
-  additionalActions,
-}: {
-  additionalRoles?: Record<string, any>;
-  additionalActions?: string[];
-}) => {
-  additionalActions?.forEach((action) => {
-    actions[action] = action;
-  });
-  Object.entries(additionalRoles || {}).forEach(([key, val]: [string, any]) => {
-    allRoles[key] = new Role(key);
-    val(allRoles[key], actions);
-  });
-
-  all(allRoles.ALL, actions);
-  loggedIn(allRoles.LOGGEDIN, actions);
-  admin(allRoles.ADMIN, actions);
-
-  return allRoles;
-};
-
-export { allRoles, actions, configureRoles };

package/src/roles/loggedIn.ts

@@ -1,252 +0,0 @@
-import { Context } from '../context.js';
-import { User } from '@unchainedshop/core-users';
-
-export const loggedIn = (role: any, actions: Record<string, string>) => {
-  const isMyself = (user: User, params: { userId?: string } = {}, ownUser: { userId?: string } = {}) => {
-    // user wants to access a field of a user
-    if (user && !params.userId) {
-      return user._id === ownUser.userId;
-    }
-    if (params.userId) {
-      // user wants to access a user object by userId
-      return params.userId === ownUser.userId;
-    }
-
-    // user wants to access himself
-    return true;
-  };
-  const canUpdateAvatar = (_, params: { userId?: string } = {}, context: Context) => {
-    const isVerified = context?.user?.emails.some(({ verified }) => verified);
-    if (!isVerified) return false;
-    if (params?.userId) {
-      return params?.userId === context?.userId;
-    }
-    return true;
-  };
-
-  const isOwnedEmailAddress = (obj: any, params: { email?: string }, { user }: Context) => {
-    return user?.emails?.some(
-      (emailRecord) => emailRecord.address?.toLowerCase() === params.email?.toLowerCase(),
-    );
-  };
-
-  const isOwnedOrder = async (obj: any, params: { orderId: string }, { modules, userId }: Context) => {
-    const order = await modules.orders.findOrder(
-      { orderId: params.orderId },
-      {
-        projection: {
-          userId: 1,
-        },
-      },
-    );
-    if (!order) return true;
-    return order.userId === userId;
-  };
-
-  const isOwnedOrderOrCart = async (obj: any, params: { orderId?: string }, context: Context) => {
-    if (params.orderId) {
-      return isOwnedOrder(null, { orderId: params.orderId }, context);
-    }
-    return true;
-  };
-
-  const isOwnedEnrollment = async (
-    obj: any,
-    params: { enrollmentId: string },
-    { modules, userId }: Context,
-  ) => {
-    const enrollment = await modules.enrollments.findEnrollment(
-      { enrollmentId: params.enrollmentId },
-      {
-        projection: {
-          userId: 1,
-        },
-      },
-    );
-    if (!enrollment) return true;
-    return enrollment.userId === userId;
-  };
-
-  const isOwnedOrderPayment = async (obj: any, params: { orderPaymentId: string }, context: Context) => {
-    const payment = await context.modules.orders.payments.findOrderPayment(
-      { orderPaymentId: params.orderPaymentId },
-      {
-        projection: {
-          orderId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!payment) return true;
-    const orderId = payment?.orderId;
-    return isOwnedOrder(null, { orderId }, context);
-  };
-
-  const isOwnedOrderDelivery = async (
-    obj: any,
-    params: { orderDeliveryId: string },
-    context: Context,
-  ) => {
-    const delivery = await context.modules.orders.deliveries.findDelivery(
-      { orderDeliveryId: params.orderDeliveryId },
-      {
-        projection: {
-          orderId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!delivery) return true;
-    const orderId = delivery && delivery.orderId;
-    return isOwnedOrder(null, { orderId }, context);
-  };
-
-  const isOwnedOrderItem = async (obj: any, params: { itemId: string }, context: Context) => {
-    const item = await context.modules.orders.positions.findOrderPosition(
-      { itemId: params.itemId },
-      {
-        projection: {
-          orderId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!item) return true;
-    const orderId = item && item.orderId;
-    return isOwnedOrder(null, { orderId }, context);
-  };
-
-  const isOwnedOrderDiscount = async (obj: any, params: { discountId: string }, context: Context) => {
-    const discount = await context.modules.orders.discounts.findOrderDiscount(
-      { discountId: params.discountId },
-      {
-        projection: {
-          orderId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!discount) return true;
-    const orderId = discount && discount.orderId;
-    return isOwnedOrder(null, { orderId }, context);
-  };
-
-  const isOwnedProductReview = async (
-    obj: any,
-    params: { productReviewId: string },
-    context: Context,
-  ) => {
-    const { productReviewId } = params;
-    const { modules, userId } = context;
-    const review = await modules.products.reviews.findProductReview({
-      productReviewId,
-    });
-    if (!review) return true;
-    return review.authorId === userId;
-  };
-
-  const isOwnedQuotation = async (
-    obj: any,
-    { quotationId }: { quotationId: string },
-    { modules, userId }: Context,
-  ) => {
-    const quotation = await modules.quotations.findQuotation(
-      { quotationId },
-      {
-        projection: {
-          userId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!quotation) return true;
-    return quotation.userId === userId;
-  };
-
-  const isOwnedBookmark = async (
-    obj: any,
-    { bookmarkId }: { bookmarkId: string },
-    { userId, modules }: Context,
-  ) => {
-    const bookmark = await modules.bookmarks.findBookmarkById(bookmarkId);
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!bookmark) return true;
-    return bookmark.userId === userId;
-  };
-
-  const isOwnedPaymentCredential = async (
-    obj: any,
-    { paymentCredentialsId }: { paymentCredentialsId: string },
-    { modules, userId }: Context,
-  ) => {
-    const credentials = await modules.payment.paymentCredentials.findPaymentCredential(
-      {
-        paymentCredentialsId,
-      },
-      {
-        projection: {
-          userId: 1,
-        },
-      },
-    );
-    // return true if db entity not found in order
-    // to let the resolver throw a good exception
-    if (!credentials) return true;
-    return credentials.userId === userId;
-  };
-
-  const isFileAccessible = async (file, _, context) => {
-    const user = context?.user;
-
-    // Non private files or no files always resolve to true
-    if (!file?.meta?.isPrivate) return true;
-
-    // If private file, only return true if owned
-    if (file?.meta?.userId === user?._id) return true;
-
-    return false;
-  };
-
-  role.allow(actions.viewUser, isMyself);
-  role.allow(actions.viewUserRoles, isMyself);
-  role.allow(actions.viewUserOrders, isMyself);
-  role.allow(actions.viewUserQuotations, isMyself);
-  role.allow(actions.viewUserEnrollments, isMyself);
-  role.allow(actions.viewUserPrivateInfos, isMyself);
-  role.allow(actions.viewUserProductReviews, isMyself);
-  role.allow(actions.viewUserTokens, isMyself);
-  role.allow(actions.updateUser, isMyself);
-  role.allow(actions.removeUser, isMyself);
-  role.allow(actions.sendEmail, isOwnedEmailAddress);
-  role.allow(actions.viewOrder, isOwnedOrder);
-  role.allow(actions.updateOrder, isOwnedOrder);
-  role.allow(actions.updateOrderItem, isOwnedOrderItem);
-  role.allow(actions.updateOrderDiscount, isOwnedOrderDiscount);
-  role.allow(actions.updateOrderDelivery, isOwnedOrderDelivery);
-  role.allow(actions.updateOrderPayment, isOwnedOrderPayment);
-  role.allow(actions.checkoutCart, isOwnedOrderOrCart);
-  role.allow(actions.updateCart, isOwnedOrderOrCart);
-  role.allow(actions.createCart, () => true);
-  role.allow(actions.viewEnrollment, isOwnedEnrollment);
-  role.allow(actions.updateEnrollment, isOwnedEnrollment);
-  role.allow(actions.createEnrollment, () => true);
-  role.allow(actions.reviewProduct, () => true);
-  role.allow(actions.updateProductReview, isOwnedProductReview);
-  role.allow(actions.requestQuotation, () => true);
-  role.allow(actions.answerQuotation, isOwnedQuotation);
-  role.allow(actions.manageBookmarks, isOwnedBookmark);
-  role.allow(actions.bookmarkProduct, () => true);
-  role.allow(actions.voteProductReview, () => true);
-  role.allow(actions.registerPaymentCredentials, () => true);
-  role.allow(actions.managePaymentCredentials, isOwnedPaymentCredential);
-  role.allow(actions.confirmMediaUpload, () => true);
-  role.allow(actions.downloadFile, isFileAccessible);
-  role.allow(actions.uploadUserAvatar, canUpdateAvatar);
-  role.allow(actions.uploadTempFile, canUpdateAvatar);
-};

package/src/schema/directives.ts

@@ -1,10 +0,0 @@
-export default [
-  /* GraphQL */ `
-    enum CacheControlScope {
-      PUBLIC
-      PRIVATE
-    }
-
-    directive @cacheControl(maxAge: Int, scope: CacheControlScope) on FIELD_DEFINITION | OBJECT
-  `,
-];

package/src/schema/index.ts

@@ -1,29 +0,0 @@
-import scalars from './scalars.js';
-import directives from './directives.js';
-import types from './types/index.js';
-import inputTypes from './inputTypes.js';
-import query from './query.js';
-import mutation from './mutation.js';
-import { getRegisteredEvents } from '@unchainedshop/events';
-import { WorkerDirector } from '@unchainedshop/core';
-import { createLogger } from '@unchainedshop/logger';
-
-const logger = createLogger('unchained:api');
-
-export const buildDefaultTypeDefs = ({ actions = [] }: { actions: string[] }) => {
-  logger.debug(`${actions.length} role actions added to GraphQL schema`, { actions });
-
-  const events = getRegisteredEvents() || [];
-  logger.debug(`${events.length} event types added to GraphQL schema`, { events });
-
-  const workTypes = WorkerDirector.getActivePluginTypes() || [];
-  logger.debug(`${workTypes.length} work types added to GraphQL schema`, { workTypes });
-
-  const dynamicTypeDefs = [
-    actions?.length ? `extend enum RoleAction { ${actions.join(',')} }` : '',
-    events?.length ? `extend enum EventType { ${events.join(',')} }` : '',
-    workTypes?.length ? `extend enum WorkType { ${workTypes.join(',')} }` : '',
-  ].filter(Boolean);
-
-  return [...scalars, ...directives, ...types, ...inputTypes, ...query, ...mutation, ...dynamicTypeDefs];
-};