@unchainedshop/api 4.4.0 → 4.6.0

package/README.md

@@ -149,6 +149,210 @@ import { createMCPServer } from '@unchainedshop/api/mcp';
 const mcpServer = createMCPServer(unchainedCore);
 ```
 
+## Security
+
+The API layer implements comprehensive security controls.
+
+### Access Control
+
+- **128+ permission actions** covering all API operations
+- **Role-Based Access Control (RBAC)** with built-in and custom roles
+- **ACL enforcement** on all GraphQL mutations
+- **Ownership validation** ensuring users can only access their resources
+
+### Session Security
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `UNCHAINED_TOKEN_SECRET` | Session encryption (min 32 chars) | Required |
+| `UNCHAINED_COOKIE_NAME` | Cookie name | `unchained_token` |
+| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `none` |
+| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag | `false` |
+
+Cookies are `httpOnly` and `secure` by default.
+
+### Error Handling
+
+Errors are designed to prevent information leakage:
+- Generic authentication error messages
+- No distinction between "invalid" vs "expired" tokens
+- Permission errors don't reveal action details
+
+### CORS Configuration
+
+CORS behavior depends on `NODE_ENV`:
+
+| Environment | Default Behavior |
+|-------------|------------------|
+| `development` | Permissive CORS (reflects any origin) + trust proxy headers |
+| `production` | No CORS headers (reverse proxy should handle it) |
+
+#### Environment Variable
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `UNCHAINED_CORS_ORIGINS` | Allowed CORS origins | Auto (see above) |
+
+#### Programmatic Configuration
+
+```typescript
+// Auto behavior (recommended) - permissive in dev, none in prod
+connect(app, { graphqlHandler, db, unchainedAPI });
+
+// Explicit whitelist (production)
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+// Force permissive (not recommended in production)
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: true,
+});
+
+// Disable CORS entirely
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: false,
+});
+```
+
+### Deployment Scenarios
+
+#### Scenario 1: Direct TLS (No Reverse Proxy)
+
+For simple deployments where the Node.js server handles TLS directly:
+
+```typescript
+import express from 'express';
+import https from 'https';
+import fs from 'fs';
+import { connect } from '@unchainedshop/api/express';
+
+const app = express();
+
+// Configure CORS for your frontend origins
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+// Create HTTPS server with your certificates
+https.createServer({
+  key: fs.readFileSync('/path/to/privkey.pem'),
+  cert: fs.readFileSync('/path/to/fullchain.pem'),
+}, app).listen(443);
+```
+
+Environment:
+```bash
+NODE_ENV=production
+UNCHAINED_CORS_ORIGINS=https://shop.example.com,https://admin.example.com
+UNCHAINED_TOKEN_SECRET=your-32-char-secret-here
+```
+
+#### Scenario 2: Behind Reverse Proxy (Recommended)
+
+For production deployments behind nginx, Caddy, or a cloud load balancer:
+
+```typescript
+import express from 'express';
+import { connect } from '@unchainedshop/api/express';
+
+const app = express();
+
+// Trust the reverse proxy for client IP headers
+app.set('trust proxy', 1);
+
+// Let the proxy handle CORS, or configure here
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+app.listen(4010); // Internal port, not exposed
+```
+
+**Nginx configuration:**
+```nginx
+server {
+  listen 443 ssl http2;
+  server_name api.example.com;
+
+  ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
+
+  location / {
+    # Pass client IP to the app
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Host $host;
+
+    proxy_pass http://localhost:4010;
+  }
+}
+```
+
+**Caddy configuration:**
+```caddyfile
+api.example.com {
+  reverse_proxy localhost:4010
+}
+```
+
+#### Scenario 3: Proxy Handles CORS
+
+For complex multi-origin setups, let the reverse proxy manage CORS:
+
+```typescript
+// Don't set corsOrigins - let proxy handle it
+app.set('trust proxy', 1);
+connect(app, { graphqlHandler, db, unchainedAPI });
+```
+
+**Nginx with CORS:**
+```nginx
+location / {
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+
+  # CORS whitelist
+  set $cors "";
+  if ($http_origin ~* "^https://(shop|admin)\.example\.com$") {
+    set $cors $http_origin;
+  }
+  add_header 'Access-Control-Allow-Origin' $cors always;
+  add_header 'Access-Control-Allow-Credentials' 'true' always;
+  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
+  add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type' always;
+
+  if ($request_method = 'OPTIONS') { return 204; }
+
+  proxy_pass http://localhost:4010;
+}
+```
+
+### Trust Proxy
+
+In development mode (`NODE_ENV=development`), trust proxy is automatically enabled.
+
+In production, configure it on your Express/Fastify app before calling `connect()`:
+
+```typescript
+// Express
+app.set('trust proxy', 1);  // Trust first hop
+app.set('trust proxy', 'loopback');  // Trust loopback addresses
+app.set('trust proxy', '10.0.0.0/8');  // Trust specific CIDR
+
+// Fastify
+const fastify = Fastify({ trustProxy: true });
+```
+
+**SECURITY**: Only enable trust proxy if your reverse proxy:
+1. Strips incoming `X-Real-IP` and `X-Forwarded-For` headers from clients
+2. Sets `X-Real-IP` to the actual client IP
+3. Is the only way to reach your API server
+
+See [SECURITY.md](../../SECURITY.md) for complete security documentation including FIPS 140-3 mode.
+
 ## License
 
 EUPL-1.2

package/lib/api-index.js

@@ -1,5 +1,7 @@
+import { registerEvents } from '@unchainedshop/events';
 import createGraphQLServer, {} from "./createGraphQLServer.js";
 import { createContextResolver, setCurrentContextResolver, getCurrentContextResolver, } from "./context.js";
+import { API_EVENTS } from "./events.js";
 export * from "./events.js";
 export * from "./context.js";
 export * from "./locale-context.js";
@@ -12,6 +14,7 @@ import { buildDefaultTypeDefs } from "./schema/index.js";
 import resolvers from "./resolvers/index.js";
 import { actions } from "./roles/index.js";
 export const startAPIServer = async (options) => {
+    registerEvents(Object.keys(API_EVENTS));
     const { unchainedAPI, context: customContext, roles, adminUiConfig = {}, ...serverOptions } = options;
     const contextResolver = createContextResolver(unchainedAPI, {
         roles,

package/lib/chat/generateImageHandler.d.ts

@@ -2,5 +2,11 @@ import type * as aiTypes from 'ai';
 declare const generateImageHandler: (req: any) => ({ model, uploadUrl, }: {
     model: aiTypes.ImageModel;
     uploadUrl?: string;
-}) => aiTypes.Tool<never, any>;
+}) => aiTypes.Tool<{
+    prompt: string;
+    size?: "512x512" | "768x768" | "1024x1024" | "512x896" | "640x1120" | "768x1344" | "1024x1792" | "896x512" | "1120x640" | "1344x768" | "1792x1024" | undefined;
+}, string | {
+    imageUrl: any;
+    prompt: string;
+}>;
 export default generateImageHandler;

package/lib/chat/generateImageHandler.js

@@ -2,12 +2,12 @@ import { z } from 'zod';
 import mime from 'mime/lite';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
-let experimental_generateImage;
+let generateImage;
 let tool;
 try {
     const aiTools = await import('ai');
     tool = aiTools.tool;
-    experimental_generateImage = aiTools.experimental_generateImage;
+    generateImage = aiTools.generateImage;
 }
 catch {
 }
@@ -33,11 +33,10 @@ const inputSchema = z.object({
 const generateImageHandler = (req) => ({ model, uploadUrl = `${process.env.ROOT_URL}/temp-upload`, }) => {
     return tool({
         description: 'Generate an image based on the prompt',
-        inputSchema: inputSchema,
-        name: 'generate_image',
+        inputSchema,
         execute: async ({ prompt, size = '1024x1024' }) => {
             try {
-                const { image } = await experimental_generateImage({
+                const { image } = await generateImage({
                     model,
                     prompt,
                     size: size,

package/lib/context.js

@@ -1,22 +1,11 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import instantiateLoaders, {} from "./loaders/index.js";
 import { getLocaleContext } from "./locale-context.js";
+const { npm_package_version, UNCHAINED_API_VERSION } = process.env;
 let context;
 export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {
     context = newContext;
 };
-const { default: packageJson } = await import(__rewriteRelativeImportExtension(`${import.meta.dirname}/../package.json`), {
-    with: { type: 'json' },
-});
-const { UNCHAINED_API_VERSION = packageJson?.version || process.env.npm_package_version || 'n/a' } = process.env;
 export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, login, logout, }) => {
     const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader };
     const loaders = instantiateLoaders(unchainedAPI);
@@ -43,6 +32,6 @@ export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({
         ...userContext,
         ...abstractHttpServerContext,
         loaders,
-        version: UNCHAINED_API_VERSION,
+        version: UNCHAINED_API_VERSION || npm_package_version || 'n/a',
     };
 };

package/lib/errors.d.ts

@@ -66,6 +66,7 @@ export declare const UsernameAlreadyExistsError: any;
 export declare const UsernameOrEmailRequiredError: any;
 export declare const PasswordInvalidError: any;
 export declare const PasswordOrWebAuthnPublicKeyRequiredError: any;
+export declare const WebAuthnVerificationFailedError: any;
 export declare const InvalidCredentialsError: any;
 export declare const InvalidResetTokenError: any;
 export declare const InvalidEmailVerificationTokenError: any;

package/lib/errors.js

@@ -1,6 +1,6 @@
 import { GraphQLError } from 'graphql';
 export const createError = (code, message) => class extends GraphQLError {
-    constructor({ message: explicitMessage, ...data }) {
+    constructor({ message: explicitMessage, ...data } = {}) {
         super(explicitMessage || message, {
             extensions: {
                 code,
@@ -76,6 +76,7 @@ export const UsernameAlreadyExistsError = createError('UsernameAlreadyExists', '
 export const UsernameOrEmailRequiredError = createError('UsernameOrEmailRequired', 'No username or email is provided.');
 export const PasswordInvalidError = createError('PasswordInvalidError', 'The provided password is invalid, maybe too insecure');
 export const PasswordOrWebAuthnPublicKeyRequiredError = createError('PasswordOrWebAuthnPublicKeyRequired', 'A password or a WebAuthn public key is required');
+export const WebAuthnVerificationFailedError = createError('WebAuthnVerificationFailedError', 'WebAuthn credential verification failed');
 export const InvalidCredentialsError = createError('InvalidCredentials', 'Invalid credentials provided');
 export const InvalidResetTokenError = createError('InvalidResetTokenError', 'Token invalid or expired');
 export const InvalidEmailVerificationTokenError = createError('InvalidEmailVerificationTokenError', 'Token invalid or expired');

package/lib/events.js

@@ -1,6 +1,4 @@
-import { registerEvents } from '@unchainedshop/events';
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
     API_LOGOUT: 'API_LOGOUT',
 };
-registerEvents(Object.keys(API_EVENTS));

package/lib/express/chatHandler.js

@@ -21,7 +21,7 @@ try {
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
-    createMCPClient = mcpTools.experimental_createMCPClient;
+    createMCPClient = mcpTools.createMCPClient;
 }
 catch {
     logger.warn(`optional peer npm packages 'ai', '@ai-sdk/mcp' and '@modelcontextprotocol/sdk' not installed, chat will not work`);
@@ -76,7 +76,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                             }
                         }
                         catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}:`, e);
+                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
                         }
                         return null;
                     }));
@@ -85,7 +85,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 }
             }
             catch (e) {
-                logger.error('Failed to fetch MCP resources:', e);
+                logger.error(`Failed to fetch MCP resources: ${e.message}`);
             }
             const tools = {
                 ...defaultUnchainedTools,
@@ -111,7 +111,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     anthropic: { cacheControl: { type: 'ephemeral' } },
                 },
             };
-            const normalizedMessages = convertToModelMessages(messages, { tools: cacheControlledTools });
+            const normalizedMessages = await convertToModelMessages(messages, { tools: cacheControlledTools });
             if (normalizedMessages.length > 0) {
                 const lastIndex = normalizedMessages.length - 1;
                 normalizedMessages[lastIndex] = {

package/lib/express/createERCMetadataMiddleware.js

@@ -1,6 +1,5 @@
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:erc-metadata');
-const { ROOT_URL = 'http://localhost:4010' } = process.env;
 const methodWrongHandler = (res) => {
     logger.error('Method not supported, return 404');
     res.status(404).end();
@@ -11,6 +10,7 @@ const ercMetadataMiddleware = async (req, res) => {
         if (req.method !== 'GET') {
             return methodWrongHandler(res);
         }
+        const { ROOT_URL = 'http://localhost:4010' } = process.env;
         const { services, modules, loaders, locale } = req.unchainedContext;
         const url = new URL(req.url, ROOT_URL);
         const pathname = url.pathname;

package/lib/express/index.js

@@ -64,19 +64,33 @@ const addContext = async function middlewareWithContext(req, res, next) {
             const { user } = req;
             if (!user)
                 return false;
+            const currentSessionId = req.sessionID;
+            const targetSessionId = sessionId || currentSessionId;
             const tokenObject = {
-                _id: sessionId || req.sessionID,
+                _id: targetSessionId,
                 userId: user._id,
             };
-            await new Promise((resolve, reject) => {
-                req.logout((error, result) => {
-                    if (error) {
-                        return reject(error);
-                    }
-                    req.session.impersonatorId = null;
-                    return resolve(result);
+            if (sessionId && sessionId !== currentSessionId) {
+                await new Promise((resolve, reject) => {
+                    req.sessionStore.destroy(sessionId, (error) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        return resolve();
+                    });
                 });
-            });
+            }
+            else {
+                await new Promise((resolve, reject) => {
+                    req.logout((error, result) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        req.session.impersonatorId = null;
+                        return resolve(result);
+                    });
+                });
+            }
             await emit(API_EVENTS.API_LOGOUT, tokenObject);
             return true;
         };

package/lib/fastify/chatHandler.js

@@ -20,7 +20,7 @@ try {
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
-    createMCPClient = mcpTools.experimental_createMCPClient;
+    createMCPClient = mcpTools.createMCPClient;
 }
 catch {
     logger.warn(`optional peer npm packages 'ai' and '@ai-sdk/mcp' not installed, chat will not work`);
@@ -73,7 +73,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                             }
                         }
                         catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}:`, e);
+                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
                         }
                         return null;
                     }));
@@ -82,7 +82,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 }
             }
             catch (e) {
-                logger.error('Failed to fetch MCP resources:', e);
+                logger.error(`Failed to fetch MCP resources: ${e.message}`);
             }
             const tools = {
                 ...defaultUnchainedTools,
@@ -107,7 +107,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     anthropic: { cacheControl: { type: 'ephemeral' } },
                 },
             };
-            const normalizedMessages = convertToModelMessages(messages, { tools: cacheControlledTools });
+            const normalizedMessages = await convertToModelMessages(messages, { tools: cacheControlledTools });
             if (normalizedMessages.length > 0) {
                 const lastIndex = normalizedMessages.length - 1;
                 normalizedMessages[lastIndex] = {

package/lib/fastify/ercMetadataHandler.js

@@ -1,7 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { ProductContractStandard } from '@unchainedshop/core-products';
 const logger = createLogger('unchained:api:erc-metadata');
-const { ROOT_URL = 'http://localhost:4010' } = process.env;
 const notFoundHandler = (res) => {
     logger.error('Method not supported, return 404');
     res.status(404);
@@ -9,6 +8,7 @@ const notFoundHandler = (res) => {
 };
 const ercMetadataHandler = async (req, res) => {
     try {
+        const { ROOT_URL = 'http://localhost:4010' } = process.env;
         const { services, modules, locale, loaders } = req.unchainedContext;
         const url = new URL(req.url, ROOT_URL);
         if (!url.pathname.toLowerCase().endsWith('.json'))

package/lib/fastify/index.js

@@ -189,9 +189,15 @@ export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowR
 };
 const fallbackLandingPageHandler = (request, reply) => {
     if (request.raw.method === 'GET') {
-        const staticURL = import.meta.resolve('@unchainedshop/api/index.html');
-        const staticPath = new URL(staticURL).pathname.split('/').slice(0, -1).join('/');
-        return reply.type('text/html').send(readFileSync(staticPath + '/index.html'));
+        try {
+            const staticURL = import.meta.resolve('@unchainedshop/api/index.html');
+            const staticPath = new URL(staticURL).pathname;
+            return reply.type('text/html').send(readFileSync(staticPath));
+        }
+        catch {
+            const fallbackPath = new URL('../../index.html', import.meta.url).pathname;
+            return reply.type('text/html').send(readFileSync(fallbackPath));
+        }
     }
     else {
         return reply.status(404).send();

package/lib/loaders/assortmentMediaTextLoader.js

@@ -3,7 +3,7 @@ import buildTextMap from "./buildTextMap.js";
 import buildLocaleMap from "./buildLocaleMap.js";
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const assortmentMediaIds = [...new Set(queries.map((q) => q.assortmentMediaId).filter(Boolean))];
-    const texts = await unchainedAPI.modules.assortments.media.texts.findMediaTexts({ assortmentMediaId: { $in: assortmentMediaIds } }, {
+    const texts = await unchainedAPI.modules.assortments.media.texts.findMediaTexts({ assortmentMediaIds }, {
         sort: {
             assortmentMediaId: 1,
         },

package/lib/loaders/assortmentMediasLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
     const assortmentMediaItems = await unchainedAPI.modules.assortments.media.findAssortmentMedias({
-        assortmentId: { $in: assortmentIds },
+        assortmentIds,
     });
     const assortmentMediaMap = {};
     for (const assortmentMedia of assortmentMediaItems) {

package/lib/loaders/assortmentTextLoader.js

@@ -3,7 +3,7 @@ import buildTextMap from "./buildTextMap.js";
 import buildLocaleMap from "./buildLocaleMap.js";
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
-    const texts = await unchainedAPI.modules.assortments.texts.findTexts({ assortmentId: { $in: assortmentIds } }, {
+    const texts = await unchainedAPI.modules.assortments.texts.findTexts({ assortmentIds }, {
         sort: {
             assortmentId: 1,
         },

package/lib/loaders/countryLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const isoCodes = [...new Set(queries.map((q) => q.isoCode).filter(Boolean))];
     const countries = await unchainedAPI.modules.countries.findCountries({
-        isoCode: { $in: isoCodes },
+        isoCodes,
         includeInactive: true,
     });
     const countryMap = {};

package/lib/loaders/currencyLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const isoCodes = [...new Set(queries.map((q) => q.isoCode).filter(Boolean))];
     const currencies = await unchainedAPI.modules.currencies.findCurrencies({
-        isoCode: { $in: isoCodes },
+        isoCodes,
         includeInactive: true,
     });
     const currencyMap = {};

package/lib/loaders/deliveryProviderLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const deliveryProviderIds = [...new Set(queries.map((q) => q.deliveryProviderId).filter(Boolean))];
     const deliveryProviders = await unchainedAPI.modules.delivery.findProviders({
-        _id: { $in: deliveryProviderIds },
+        deliveryProviderIds,
         includeDeleted: true,
     });
     const deliveryProviderMap = {};

package/lib/loaders/fileLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const fileIds = [...new Set(queries.map((q) => q.fileId).filter(Boolean))];
     const files = await unchainedAPI.modules.files.findFiles({
-        _id: { $in: fileIds },
+        fileIds,
     });
     const fileMap = {};
     for (const file of files) {

package/lib/loaders/filterTextLoader.js

@@ -3,7 +3,7 @@ import buildLocaleMap from "./buildLocaleMap.js";
 import buildTextMap from "./buildTextMap.js";
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const filterIds = [...new Set(queries.map((q) => q.filterId).filter(Boolean))];
-    const texts = await unchainedAPI.modules.filters.texts.findTexts({ filterId: { $in: filterIds } }, {
+    const texts = await unchainedAPI.modules.filters.texts.findTexts({ filterIds }, {
         sort: {
             filterId: 1,
         },

package/lib/loaders/languageLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const isoCodes = [...new Set(queries.map((q) => q.isoCode).filter(Boolean))];
     const languages = await unchainedAPI.modules.languages.findLanguages({
-        isoCode: { $in: isoCodes },
+        isoCodes,
         includeInactive: true,
     });
     const languageMap = {};

package/lib/loaders/orderLoader.js

@@ -3,7 +3,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const orderIds = [...new Set(queries.map((q) => q.orderId).filter(Boolean))];
     const orders = await unchainedAPI.modules.orders.findOrders({
         includeCarts: true,
-        _id: { $in: orderIds },
+        orderIds,
     });
     const orderMap = {};
     for (const order of orders) {

package/lib/loaders/paymentProviderLoader.js

@@ -2,7 +2,7 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const paymentProviderIds = [...new Set(queries.map((q) => q.paymentProviderId).filter(Boolean))];
     const paymentProviders = await unchainedAPI.modules.payment.paymentProviders.findProviders({
-        _id: { $in: paymentProviderIds },
+        paymentProviderIds,
         includeDeleted: true,
     });
     const paymentProviderMap = {};

package/lib/loaders/productBySKULoader.js

@@ -2,10 +2,8 @@ import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const skus = [...new Set(queries.map((q) => q.sku).filter(Boolean))];
     const products = await unchainedAPI.modules.products.findProducts({
-        productSelector: {
-            'warehousing.sku': { $in: skus },
-            status: { $exists: true },
-        },
+        skus,
+        includeDeleted: true,
     });
     const productMap = {};
     for (const product of products) {

package/lib/loaders/productLoader.js

@@ -3,9 +3,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const productIds = [...new Set(queries.map((q) => q.productId).filter(Boolean))];
     const products = await unchainedAPI.modules.products.findProducts({
         productIds,
-        productSelector: {
-            status: { $exists: true },
-        },
+        includeDeleted: true,
     });
     const productMap = {};
     for (const product of products) {

package/lib/loaders/productMediaTextLoader.js

@@ -3,7 +3,7 @@ import buildLocaleMap from "./buildLocaleMap.js";
 import buildTextMap from "./buildTextMap.js";
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const productMediaIds = [...new Set(queries.map((q) => q.productMediaId).filter(Boolean))];
-    const texts = await unchainedAPI.modules.products.media.texts.findMediaTexts({ productMediaId: { $in: productMediaIds } }, {
+    const texts = await unchainedAPI.modules.products.media.texts.findMediaTexts({ productMediaIds }, {
         sort: {
             productMediaId: 1,
         },