@unchainedshop/api 4.6.1 → 4.6.2

package/lib/auth.d.ts

@@ -0,0 +1,44 @@
+export interface AccessTokenPayload {
+    iss: string;
+    sub: string;
+    ver: number;
+    fgp?: string;
+    imp?: string;
+    jti?: string;
+    iat?: number;
+    exp?: number;
+}
+export interface OIDCProviderConfig {
+    issuer: string;
+    jwksUri?: string;
+    audience?: string | string[];
+}
+export interface AuthConfig {
+    oidcProviders?: OIDCProviderConfig[];
+}
+export declare function generateFingerprint(): {
+    raw: string;
+    hash: string;
+};
+export declare function verifyFingerprint(raw: string, hash: string): boolean;
+export declare function signAccessToken(userId: string, tokenVersion: number, options?: {
+    impersonatorId?: string;
+    fingerprintHash?: string;
+}): Promise<{
+    token: string;
+    expires: Date;
+}>;
+export declare function verifyLocalToken(token: string): Promise<AccessTokenPayload | null>;
+export declare function verifyOIDCToken(token: string, providers: OIDCProviderConfig[]): Promise<{
+    userId: string;
+    roles?: string[];
+} | null>;
+export interface AuthHandlerResult {
+    userId?: string;
+    tokenVersion?: number;
+    impersonatorId?: string;
+    fingerprintHash?: string;
+    accessToken?: string;
+    isApiKey?: boolean;
+}
+export declare function createAuthHandler(config?: AuthConfig): (token: string) => Promise<AuthHandlerResult>;

package/lib/auth.js

@@ -0,0 +1,186 @@
+import { createLogger } from '@unchainedshop/logger';
+import * as jose from 'jose';
+import { createHash } from 'crypto';
+const logger = createLogger('unchained:api:auth');
+const { UNCHAINED_TOKEN_SECRET, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', UNCHAINED_TOKEN_ISSUER = 'unchained-engine', } = process.env;
+const MIN_SECRET_LENGTH = 32;
+const jwksCache = new Map();
+function validateSecretStrength(secret) {
+    if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(`UNCHAINED_TOKEN_SECRET must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for security. ` +
+            `Current length: ${secret.length}. Generate a secure secret with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
+    }
+}
+export function generateFingerprint() {
+    const raw = crypto.randomUUID() + crypto.randomUUID();
+    const hash = createHash('sha256').update(raw).digest('hex');
+    return { raw, hash };
+}
+export function verifyFingerprint(raw, hash) {
+    const computedHash = createHash('sha256').update(raw).digest('hex');
+    if (computedHash.length !== hash.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < computedHash.length; i++) {
+        result |= computedHash.charCodeAt(i) ^ hash.charCodeAt(i);
+    }
+    return result === 0;
+}
+export async function signAccessToken(userId, tokenVersion, options) {
+    if (!UNCHAINED_TOKEN_SECRET) {
+        throw new Error('UNCHAINED_TOKEN_SECRET environment variable is required');
+    }
+    validateSecretStrength(UNCHAINED_TOKEN_SECRET);
+    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
+    const now = Math.floor(Date.now() / 1000);
+    const payload = {
+        sub: userId,
+        ver: tokenVersion,
+        jti: crypto.randomUUID(),
+    };
+    if (options?.fingerprintHash) {
+        payload.fgp = options.fingerprintHash;
+    }
+    if (options?.impersonatorId) {
+        payload.imp = options.impersonatorId;
+    }
+    const secret = new TextEncoder().encode(UNCHAINED_TOKEN_SECRET);
+    const token = await new jose.SignJWT(payload)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt(now)
+        .setIssuer(UNCHAINED_TOKEN_ISSUER)
+        .setExpirationTime(now + expirySeconds)
+        .sign(secret);
+    const expires = new Date((now + expirySeconds) * 1000);
+    return { token, expires };
+}
+export async function verifyLocalToken(token) {
+    if (!UNCHAINED_TOKEN_SECRET) {
+        logger.warn('UNCHAINED_TOKEN_SECRET not set, cannot verify local tokens');
+        return null;
+    }
+    try {
+        validateSecretStrength(UNCHAINED_TOKEN_SECRET);
+        const secret = new TextEncoder().encode(UNCHAINED_TOKEN_SECRET);
+        const { payload } = await jose.jwtVerify(token, secret, {
+            algorithms: ['HS256'],
+            issuer: UNCHAINED_TOKEN_ISSUER,
+        });
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            logger.debug('Token expired');
+        }
+        else if (error instanceof jose.errors.JWTInvalid ||
+            error instanceof jose.errors.JWSSignatureVerificationFailed ||
+            error instanceof jose.errors.JWTClaimValidationFailed) {
+            logger.debug('Invalid token signature or claims');
+        }
+        else {
+            logger.error('Token verification error:', {
+                message: error.message,
+                name: error.name,
+            });
+        }
+        return null;
+    }
+}
+function getJWKS(jwksUri) {
+    let jwks = jwksCache.get(jwksUri);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cooldownDuration: 30000,
+            cacheMaxAge: 600000,
+        });
+        jwksCache.set(jwksUri, jwks);
+    }
+    return jwks;
+}
+export async function verifyOIDCToken(token, providers) {
+    let decodedPayload;
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            logger.debug('Invalid JWT format');
+            return null;
+        }
+        decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    }
+    catch {
+        logger.debug('Failed to decode JWT');
+        return null;
+    }
+    const { iss, sub } = decodedPayload;
+    if (!iss || !sub || typeof iss !== 'string' || typeof sub !== 'string') {
+        logger.debug('OIDC token missing issuer or subject');
+        return null;
+    }
+    const provider = providers.find((p) => p.issuer === iss);
+    if (!provider) {
+        logger.debug('No matching OIDC provider for issuer:', { iss });
+        return null;
+    }
+    const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
+    try {
+        const JWKS = getJWKS(jwksUri);
+        const verifyOptions = {
+            issuer: provider.issuer,
+        };
+        if (provider.audience) {
+            verifyOptions.audience = provider.audience;
+        }
+        const { payload } = await jose.jwtVerify(token, JWKS, verifyOptions);
+        logger.debug('OIDC token verified successfully', { issuer: iss, subject: sub });
+        return {
+            userId: payload.sub,
+            roles: payload.roles,
+        };
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            logger.debug('OIDC token expired');
+        }
+        else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            logger.debug('OIDC token claim validation failed:', { message: error.message });
+        }
+        else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            logger.debug('OIDC token signature verification failed');
+        }
+        else {
+            logger.error('OIDC token verification failed:', {
+                message: error.message,
+                name: error.name,
+            });
+        }
+        return null;
+    }
+}
+export function createAuthHandler(config) {
+    return async function verifyToken(token) {
+        if (!token) {
+            return {};
+        }
+        const localPayload = await verifyLocalToken(token);
+        if (localPayload) {
+            return {
+                userId: localPayload.sub,
+                tokenVersion: localPayload.ver,
+                impersonatorId: localPayload.imp,
+                fingerprintHash: localPayload.fgp,
+            };
+        }
+        if (config?.oidcProviders?.length) {
+            const oidcResult = await verifyOIDCToken(token, config.oidcProviders);
+            if (oidcResult) {
+                return {
+                    userId: oidcResult.userId,
+                };
+            }
+        }
+        return {
+            accessToken: token,
+            isApiKey: true,
+        };
+    };
+}

package/lib/express/mountPluginRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from 'express';
+import type { UnchainedCore } from '@unchainedshop/core';
+export declare function mountPluginRoutes(app: Express, unchainedAPI: UnchainedCore): void;

package/lib/express/mountPluginRoutes.js

@@ -0,0 +1,59 @@
+import { pluginRegistry } from '@unchainedshop/core';
+import { createServerAdapter } from '@whatwg-node/server';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('express');
+export function mountPluginRoutes(app, unchainedAPI) {
+    const routes = pluginRegistry.getRoutes();
+    if (routes.length > 0) {
+        const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+        logger.info(`Mounting ${routes.length} plugin route(s): ${endpoints}`);
+    }
+    for (const route of routes) {
+        const adapter = createServerAdapter(async (request, serverContext) => {
+            const context = {
+                ...unchainedAPI,
+                ...serverContext.unchainedContext,
+                params: serverContext.params || {},
+                rawRequest: serverContext.rawRequest,
+            };
+            try {
+                return await route.handler(request, context);
+            }
+            catch (error) {
+                logger.error(`Error in plugin route handler ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return new Response(JSON.stringify({
+                    error: error instanceof Error ? error.message : 'Internal Server Error',
+                }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        });
+        const method = route.method.toLowerCase();
+        const expressHandler = async (req, res) => {
+            try {
+                await adapter.handleNodeRequestAndResponse(req, res, {
+                    unchainedContext: req.unchainedContext,
+                    params: req.params,
+                    rawRequest: req,
+                });
+            }
+            catch (error) {
+                logger.error(`Error handling request for ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (!res.headersSent) {
+                    res.status(500).json({ error: 'Internal Server Error' });
+                }
+            }
+        };
+        if (method === 'all') {
+            app.use(route.path, expressHandler);
+        }
+        else {
+            app[method](route.path, expressHandler);
+        }
+    }
+}

package/lib/express/mountRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from 'express';
+import type { UnchainedCore, PluginHttpRoute } from '@unchainedshop/core';
+export declare function mountRoutes(app: Express, unchainedAPI: UnchainedCore, routes: PluginHttpRoute[]): void;

package/lib/express/mountRoutes.js

@@ -0,0 +1,57 @@
+import { createServerAdapter } from '@whatwg-node/server';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('express');
+export function mountRoutes(app, unchainedAPI, routes) {
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    logger.info(`Mounting ${routes.length} route(s): ${endpoints}`);
+    for (const route of routes) {
+        const adapter = createServerAdapter(async (request, serverContext) => {
+            const context = {
+                ...unchainedAPI,
+                ...serverContext.unchainedContext,
+                params: serverContext.params || {},
+                rawRequest: serverContext.rawRequest,
+            };
+            try {
+                return await route.handler(request, context);
+            }
+            catch (error) {
+                logger.error(`Error in route handler ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return new Response(JSON.stringify({
+                    error: error instanceof Error ? error.message : 'Internal Server Error',
+                }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        });
+        const method = route.method.toLowerCase();
+        const expressHandler = async (req, res) => {
+            try {
+                await adapter.handleNodeRequestAndResponse(req, res, {
+                    unchainedContext: req.unchainedContext,
+                    params: req.params,
+                    rawRequest: req,
+                });
+            }
+            catch (error) {
+                logger.error(`Error handling request for ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (!res.headersSent) {
+                    res.status(500).json({ error: 'Internal Server Error' });
+                }
+            }
+        };
+        if (method === 'all') {
+            app.use(route.path, expressHandler);
+        }
+        else {
+            app[method](route.path, expressHandler);
+        }
+    }
+}

package/lib/fastify/mountPluginRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+import type { UnchainedCore } from '@unchainedshop/core';
+export declare function mountPluginRoutes(fastify: FastifyInstance, unchainedAPI: UnchainedCore): void;

package/lib/fastify/mountPluginRoutes.js

@@ -0,0 +1,62 @@
+import { pluginRegistry } from '@unchainedshop/core';
+import { createServerAdapter } from '@whatwg-node/server';
+export function mountPluginRoutes(fastify, unchainedAPI) {
+    const routes = pluginRegistry.getRoutes();
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    fastify.log.info(`Mounting ${routes.length} plugin route(s): ${endpoints}`);
+    fastify.register((scope, opts, registered) => {
+        scope.removeAllContentTypeParsers();
+        scope.addContentTypeParser('*', function (request, payload, done) {
+            done(null);
+        });
+        for (const route of routes) {
+            const adapter = createServerAdapter(async (request, serverContext) => {
+                const context = {
+                    ...unchainedAPI,
+                    ...serverContext.unchainedContext,
+                    params: serverContext.params || {},
+                    rawRequest: serverContext.rawRequest,
+                };
+                try {
+                    return await route.handler(request, context);
+                }
+                catch (error) {
+                    fastify.log.error(`Error in plugin route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
+                    return new Response(JSON.stringify({
+                        error: error instanceof Error ? error.message : 'Internal Server Error',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            });
+            let methods;
+            if (route.method === 'ALL') {
+                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+            }
+            else {
+                methods = [route.method];
+            }
+            scope.route({
+                url: route.path,
+                method: methods,
+                handler: async (req, reply) => {
+                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
+                        unchainedContext: req.unchainedContext,
+                        params: req.params,
+                        rawRequest: req.raw,
+                    });
+                    response.headers.forEach((value, key) => {
+                        reply.header(key, value);
+                    });
+                    reply.status(response.status);
+                    reply.send(response.body || undefined);
+                    return reply;
+                },
+            });
+        }
+        registered();
+    });
+}

package/lib/fastify/mountRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+import type { UnchainedCore, PluginHttpRoute } from '@unchainedshop/core';
+export declare function mountRoutes(fastify: FastifyInstance, unchainedAPI: UnchainedCore, routes: PluginHttpRoute[]): void;

package/lib/fastify/mountRoutes.js

@@ -0,0 +1,60 @@
+import { createServerAdapter } from '@whatwg-node/server';
+export function mountRoutes(fastify, unchainedAPI, routes) {
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    fastify.log.info(`Mounting ${routes.length} route(s): ${endpoints}`);
+    fastify.register((scope, opts, registered) => {
+        scope.removeAllContentTypeParsers();
+        scope.addContentTypeParser('*', function (request, payload, done) {
+            done(null);
+        });
+        for (const route of routes) {
+            const adapter = createServerAdapter(async (request, serverContext) => {
+                const context = {
+                    ...unchainedAPI,
+                    ...serverContext.unchainedContext,
+                    params: serverContext.params || {},
+                    rawRequest: serverContext.rawRequest,
+                };
+                try {
+                    return await route.handler(request, context);
+                }
+                catch (error) {
+                    fastify.log.error(`Error in route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
+                    return new Response(JSON.stringify({
+                        error: error instanceof Error ? error.message : 'Internal Server Error',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            });
+            let methods;
+            if (route.method === 'ALL') {
+                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+            }
+            else {
+                methods = [route.method];
+            }
+            scope.route({
+                url: route.path,
+                method: methods,
+                handler: async (req, reply) => {
+                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
+                        unchainedContext: req.unchainedContext,
+                        params: req.params,
+                        rawRequest: req.raw,
+                    });
+                    response.headers.forEach((value, key) => {
+                        reply.header(key, value);
+                    });
+                    reply.status(response.status);
+                    reply.send(response.body || undefined);
+                    return reply;
+                },
+            });
+        }
+        registered();
+    });
+}

package/lib/handlers/createBackchannelLogoutHandler.d.ts

@@ -0,0 +1,4 @@
+import type { PluginHttpRoute } from '@unchainedshop/core';
+import type { OIDCProviderConfig } from '../auth.ts';
+export declare function createBackchannelLogoutRoute(providers: OIDCProviderConfig[]): PluginHttpRoute;
+export default createBackchannelLogoutRoute;

package/lib/handlers/createBackchannelLogoutHandler.js

@@ -0,0 +1,170 @@
+import * as jose from 'jose';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:api:backchannel-logout');
+function normalizeIssuer(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.origin + parsed.pathname.replace(/\/$/, '');
+    }
+    catch {
+        return url;
+    }
+}
+const jwksCache = new Map();
+function getJWKS(jwksUri) {
+    let jwks = jwksCache.get(jwksUri);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cooldownDuration: 30000,
+            cacheMaxAge: 600000,
+        });
+        jwksCache.set(jwksUri, jwks);
+    }
+    return jwks;
+}
+export function createBackchannelLogoutRoute(providers) {
+    return {
+        path: '/backchannel-logout',
+        method: 'ALL',
+        handler: async (request, context) => {
+            if (request.method !== 'POST') {
+                return new Response(JSON.stringify({ error: 'method_not_allowed' }), {
+                    status: 405,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            try {
+                let logoutToken = null;
+                const contentType = request.headers.get('content-type') || '';
+                if (contentType.includes('application/x-www-form-urlencoded')) {
+                    const formData = await request.formData();
+                    logoutToken = formData.get('logout_token');
+                }
+                else if (contentType.includes('application/json')) {
+                    const body = (await request.json());
+                    logoutToken = body.logout_token || null;
+                }
+                if (!logoutToken) {
+                    logger.warn('Back-channel logout request missing logout_token');
+                    return new Response(JSON.stringify({ error: 'missing_logout_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                let decodedPayload;
+                try {
+                    const parts = logoutToken.split('.');
+                    if (parts.length !== 3) {
+                        logger.warn('Invalid logout token format: not a valid JWT');
+                        return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+                }
+                catch {
+                    logger.warn('Failed to decode logout token');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const { iss } = decodedPayload;
+                if (!iss || typeof iss !== 'string') {
+                    logger.warn('Logout token missing issuer (iss)');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const normalizedIss = normalizeIssuer(iss);
+                const provider = providers.find((p) => normalizeIssuer(p.issuer) === normalizedIss);
+                if (!provider) {
+                    logger.warn('Unknown issuer in logout token:', { iss });
+                    return new Response(JSON.stringify({ error: 'unknown_issuer' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
+                let verifiedPayload;
+                try {
+                    const JWKS = getJWKS(jwksUri);
+                    const verifyOptions = {
+                        issuer: provider.issuer,
+                    };
+                    if (provider.audience) {
+                        verifyOptions.audience = provider.audience;
+                    }
+                    const { payload } = await jose.jwtVerify(logoutToken, JWKS, verifyOptions);
+                    verifiedPayload = payload;
+                }
+                catch (error) {
+                    if (error instanceof jose.errors.JWTExpired) {
+                        logger.warn('Logout token expired');
+                        return new Response(JSON.stringify({ error: 'token_expired' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+                        logger.warn('Logout token claim validation failed:', { message: error.message });
+                        return new Response(JSON.stringify({ error: 'invalid_claims' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+                        logger.warn('Logout token signature verification failed - possible forgery attempt');
+                        return new Response(JSON.stringify({ error: 'invalid_signature' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else {
+                        logger.error('Logout token verification failed:', { error });
+                        return new Response(JSON.stringify({ error: 'verification_failed' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                }
+                const { sub, events } = verifiedPayload;
+                if (!events?.['http://schemas.openid.net/event/backchannel-logout']) {
+                    logger.warn('Token is not a back-channel logout token (missing events claim)');
+                    return new Response(JSON.stringify({ error: 'invalid_token_type' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                if (!sub) {
+                    logger.warn('Logout token missing subject (sub)');
+                    return new Response(JSON.stringify({ error: 'missing_subject' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const user = await context.modules.users.findUserById(sub);
+                if (!user) {
+                    logger.info('User not found for back-channel logout:', { sub });
+                    return new Response('', { status: 200 });
+                }
+                await context.modules.users.updateOidcLogoutAt(user._id, new Date());
+                logger.info('Back-channel logout processed successfully:', {
+                    userId: user._id,
+                    issuer: iss,
+                });
+                return new Response('', { status: 200 });
+            }
+            catch (error) {
+                logger.error('Back-channel logout error:', { error });
+                return new Response(JSON.stringify({ error: 'internal_error' }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        },
+    };
+}
+export default createBackchannelLogoutRoute;

package/lib/middleware/createAuthMiddleware.d.ts

@@ -0,0 +1,29 @@
+import { type AuthConfig } from '../auth.ts';
+import type { LoginFn, LogoutFn } from '../context.ts';
+export interface AuthContextParams {
+    getHeader: (key: string) => string | undefined;
+    setHeader: (key: string, value: string) => void;
+    getCookie: (name: string) => string | undefined;
+    setCookie: (name: string, value: string, options: CookieOptions) => void;
+    clearCookie: (name: string, options: CookieOptions) => void;
+    remoteAddress?: string;
+    remotePort?: number;
+}
+export interface CookieOptions {
+    domain?: string;
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none' | boolean;
+    maxAge?: number;
+    expires?: Date;
+}
+export interface AuthContext {
+    userId?: string;
+    tokenVersion?: number;
+    impersonatorId?: string;
+    accessToken?: string;
+    login: LoginFn;
+    logout: LogoutFn;
+}
+export declare function createAuthContext(params: AuthContextParams, authConfig?: AuthConfig): Promise<AuthContext>;

package/lib/middleware/createAuthMiddleware.js

@@ -0,0 +1,128 @@
+import { emit } from '@unchainedshop/events';
+import { signAccessToken, createAuthHandler, generateFingerprint, verifyFingerprint, } from "../auth.js";
+import { API_EVENTS } from "../events.js";
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:api:auth-middleware');
+const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_FINGERPRINT_COOKIE_NAME = '__Secure-fgp', UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
+function getTokenCookieOptions(expires) {
+    const secure = !UNCHAINED_COOKIE_INSECURE;
+    const sameSite = {
+        none: 'none',
+        lax: 'lax',
+        strict: 'strict',
+        '1': true,
+        '0': false,
+    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || 'lax';
+    if (!secure && process.env.NODE_ENV === 'production') {
+        logger.warn('SECURITY WARNING: Running with UNCHAINED_COOKIE_INSECURE in production is not recommended');
+    }
+    if (sameSite === 'none' && !secure) {
+        logger.warn('SECURITY WARNING: SameSite=None requires Secure flag to be effective');
+    }
+    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
+    return {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        path: UNCHAINED_COOKIE_PATH,
+        secure,
+        httpOnly: true,
+        sameSite: sameSite,
+        maxAge: expires ? undefined : expirySeconds * 1000,
+        expires,
+    };
+}
+function getFingerprintCookieOptions(expires) {
+    const secure = !UNCHAINED_COOKIE_INSECURE;
+    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
+    return {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        path: UNCHAINED_COOKIE_PATH,
+        secure,
+        httpOnly: true,
+        sameSite: 'strict',
+        maxAge: expires ? undefined : expirySeconds * 1000,
+        expires,
+    };
+}
+function extractBearerToken(authHeader) {
+    if (!authHeader)
+        return undefined;
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2)
+        return undefined;
+    const [scheme, token] = parts;
+    if (scheme.toLowerCase() !== 'bearer') {
+        logger.debug('Authorization header present but not Bearer scheme');
+        return undefined;
+    }
+    return token;
+}
+export async function createAuthContext(params, authConfig) {
+    const { getHeader, getCookie, setCookie, clearCookie } = params;
+    const authHeader = getHeader('authorization');
+    const headerToken = extractBearerToken(authHeader);
+    const cookieToken = getCookie(UNCHAINED_COOKIE_NAME);
+    const token = headerToken || cookieToken;
+    const fingerprintCookie = getCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME);
+    const verifyToken = createAuthHandler(authConfig);
+    const authResult = token ? await verifyToken(token) : {};
+    let fingerprintValid = true;
+    if (authResult.fingerprintHash && fingerprintCookie) {
+        fingerprintValid = verifyFingerprint(fingerprintCookie, authResult.fingerprintHash);
+        if (!fingerprintValid) {
+            logger.warn('Token sidejacking detected: fingerprint mismatch', {
+                userId: authResult.userId,
+            });
+            authResult.userId = undefined;
+            authResult.tokenVersion = undefined;
+            authResult.impersonatorId = undefined;
+        }
+    }
+    else if (authResult.fingerprintHash && !fingerprintCookie) {
+        logger.warn('Token sidejacking detected: fingerprint cookie missing', {
+            userId: authResult.userId,
+        });
+        fingerprintValid = false;
+        authResult.userId = undefined;
+        authResult.tokenVersion = undefined;
+        authResult.impersonatorId = undefined;
+    }
+    const login = async (user, options = {}) => {
+        const { impersonator } = options;
+        const tokenVersion = user.tokenVersion ?? 1;
+        const { raw: fingerprintRaw, hash: fingerprintHash } = generateFingerprint();
+        const { token: newToken, expires } = await signAccessToken(user._id, tokenVersion, {
+            impersonatorId: impersonator?._id,
+            fingerprintHash,
+        });
+        setCookie(UNCHAINED_COOKIE_NAME, newToken, getTokenCookieOptions(expires));
+        setCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, fingerprintRaw, getFingerprintCookieOptions(expires));
+        const tokenObject = {
+            _id: crypto.randomUUID(),
+            userId: user._id,
+            tokenExpires: expires,
+        };
+        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
+        user._inLoginMethodResponse = true;
+        return { user, ...tokenObject };
+    };
+    const logout = async () => {
+        clearCookie(UNCHAINED_COOKIE_NAME, getTokenCookieOptions());
+        clearCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, getFingerprintCookieOptions());
+        if (authResult.userId) {
+            const tokenObject = {
+                _id: crypto.randomUUID(),
+                userId: authResult.userId,
+            };
+            await emit(API_EVENTS.API_LOGOUT, tokenObject);
+        }
+        return true;
+    };
+    return {
+        userId: authResult.userId,
+        tokenVersion: authResult.tokenVersion,
+        impersonatorId: authResult.impersonatorId,
+        accessToken: authResult.isApiKey ? authResult.accessToken : undefined,
+        login,
+        logout,
+    };
+}

package/lib/resolvers/mutations/accounts/logoutAllSessions.d.ts

@@ -0,0 +1,4 @@
+import type { Context } from '../../../context.ts';
+export default function logoutAllSessions(root: never, _: never, context: Context): Promise<{
+    success: boolean;
+}>;

package/lib/resolvers/mutations/accounts/logoutAllSessions.js

@@ -0,0 +1,11 @@
+import { log } from '@unchainedshop/logger';
+export default async function logoutAllSessions(root, _, context) {
+    const { userId, modules } = context;
+    log('mutation logoutAllSessions', { userId });
+    const result = await modules.users.incrementTokenVersion(userId);
+    if (!result) {
+        throw new Error('Failed to logout all sessions', { cause: 'LOGOUT_FAILED' });
+    }
+    await context.logout();
+    return { success: true };
+}

package/lib/resolvers/queries/orders/orders.js

@@ -2,8 +2,6 @@ import { log } from '@unchainedshop/logger';
 export default async function orders(root, params, { modules, userId }) {
     const { limit, offset, paymentProviderIds, deliveryProviderIds, ...restParams } = params;
     log(`query orders: ${limit} ${offset}  ${restParams?.queryString || ''}`, { userId });
-    const promises = [];
-    await Promise.all(promises);
     const [orderPayments, orderDeliveries] = await Promise.all([
         paymentProviderIds?.length
             ? modules.orders.payments.findOrderPaymentsByProviderIds({ paymentProviderIds })
@@ -19,6 +17,8 @@ export default async function orders(root, params, { modules, userId }) {
     const deliveryIds = orderDeliveries.map((d) => d._id);
     return modules.orders.findOrders({
         ...restParams,
+        limit,
+        offset,
         paymentIds,
         deliveryIds,
     });

package/lib/resolvers/type/order/order-payment-base.d.ts

@@ -0,0 +1,7 @@
+import type { OrderPayment } from '@unchainedshop/core-orders';
+import type { Context } from '../../../context.ts';
+export declare const OrderPaymentBase: {
+    status(obj: OrderPayment, _: never, { modules }: Context): import("@unchainedshop/core-orders").OrderPaymentStatus;
+    provider(obj: OrderPayment, _: never, { loaders }: Context): Promise<import("@unchainedshop/core-payment").PaymentProvider>;
+    discounts(obj: OrderPayment, _: never, { loaders, services }: Context): Promise<import("@unchainedshop/core/lib/services/getPaymentDiscounts.js").PaymentDiscountPrice[]>;
+};

package/lib/resolvers/type/order/order-payment-base.js

@@ -0,0 +1,14 @@
+export const OrderPaymentBase = {
+    status(obj, _, { modules }) {
+        return modules.orders.payments.normalizedStatus(obj);
+    },
+    async provider(obj, _, { loaders }) {
+        return loaders.paymentProviderLoader.load({
+            paymentProviderId: obj.paymentProviderId,
+        });
+    },
+    async discounts(obj, _, { loaders, services }) {
+        const order = await loaders.orderLoader.load({ orderId: obj.orderId });
+        return services.payment.getPaymentDiscounts(obj, order.currencyCode);
+    },
+};

package/lib/schema/types/common.d.ts

@@ -0,0 +1,2 @@
+declare const _default: string[];
+export default _default;

package/lib/schema/types/common.js

@@ -0,0 +1,12 @@
+export default [
+    `
+    type SuccessResponse @cacheControl(maxAge: 0, scope: PRIVATE) {
+      success: Boolean
+    }
+
+    enum SortDirection {
+      ASC
+      DESC
+    }
+  `,
+];

package/lib/utils/mapServiceError.d.ts

@@ -0,0 +1 @@
+export declare function mapServiceError(error: unknown): never;

package/lib/utils/mapServiceError.js

@@ -0,0 +1,59 @@
+import { GraphQLError } from 'graphql';
+import * as errors from "../errors.js";
+const errorMap = {
+    ProductNotFoundError: errors.ProductNotFoundError,
+    ProductWrongStatusError: errors.ProductWrongStatusError,
+    ProductWrongTypeError: errors.ProductWrongTypeError,
+    CyclicProductBundlingNotSupportedError: errors.CyclicProductBundlingNotSupportedError,
+    ProductVariationInfinityLoop: errors.ProductVariationInfinityLoop,
+    ProductVariationVectorInvalid: errors.ProductVariationVectorInvalid,
+    ProductVariationVectorAlreadySet: errors.ProductVariationVectorAlreadySet,
+    ProductLinkedToActiveBundleError: errors.ProductLinkedToActiveBundleError,
+    ProductLinkedToActiveVariationError: errors.ProductLinkedToActiveVariationError,
+    ProductLinkedToQuotationError: errors.ProductLinkedToQuotationError,
+    ProductLinkedToEnrollmentError: errors.ProductLinkedToEnrollmentError,
+    EnrollmentNotFoundError: errors.EnrollmentNotFoundError,
+    EnrollmentWrongStatusError: errors.EnrollmentWrongStatusError,
+    EnrollmentPlanUpdateNotAllowedError: errors.EnrollmentWrongStatusError,
+    OrderNotFoundError: errors.OrderNotFoundError,
+    OrderWrongStatusError: errors.OrderWrongStatusError,
+    OrderItemNotFoundError: errors.OrderItemNotFoundError,
+    OrderQuantityTooLowError: errors.OrderQuantityTooLowError,
+    OrderPaymentNotFoundError: errors.OrderPaymentNotFoundError,
+    OrderWrongPaymentStatusError: errors.OrderWrongPaymentStatusError,
+    OrderDeliveryNotFoundError: errors.OrderDeliveryNotFoundError,
+    OrderWrongDeliveryStatusError: errors.OrderWrongDeliveryStatusError,
+    QuotationNotFoundError: errors.QuotationNotFoundError,
+    QuotationWrongStatusError: errors.QuotationWrongStatusError,
+    QuotationItemConfigurationError: errors.QuotationItemConfigurationError,
+    BookmarkNotFoundError: errors.BookmarkNotFoundError,
+    MultipleBookmarksFound: errors.MultipleBookmarksFound,
+    BookmarkAlreadyExistsError: errors.BookmarkAlreadyExistsError,
+    OrderDiscountCodeAlreadyPresentError: errors.OrderDiscountCodeAlreadyPresentError,
+    OrderDiscountCodeNotValidError: errors.OrderDiscountCodeNotValidError,
+    UserNotFoundError: errors.UserNotFoundError,
+    ImpersonatingAdminUserError: errors.ImpersonatingAdminUserError,
+    InvalidEmailVerificationTokenError: errors.InvalidEmailVerificationTokenError,
+    UsernameOrEmailRequiredError: errors.UsernameOrEmailRequiredError,
+    PasswordOrWebAuthnPublicKeyRequiredError: errors.PasswordOrWebAuthnPublicKeyRequiredError,
+    EmailAlreadyExistsError: errors.EmailAlreadyExistsError,
+    UsernameAlreadyExistsError: errors.UsernameAlreadyExistsError,
+    PasswordInvalidError: errors.PasswordInvalidError,
+    WebAuthnVerificationFailedError: errors.WebAuthnVerificationFailedError,
+    AuthOperationFailedError: errors.AuthOperationFailedError,
+    InvalidCredentialsError: errors.InvalidCredentialsError,
+    InvalidResetTokenError: errors.InvalidResetTokenError,
+    InvalidIdError: errors.InvalidIdError,
+    ProviderConfigurationInvalid: errors.ProviderConfigurationInvalid,
+};
+export function mapServiceError(error) {
+    if (error instanceof GraphQLError) {
+        throw error;
+    }
+    const serviceError = error;
+    const ErrorClass = serviceError.code ? errorMap[serviceError.code] : undefined;
+    if (ErrorClass) {
+        throw new ErrorClass(serviceError.data);
+    }
+    throw error;
+}

package/lib/utils/maskError.d.ts

@@ -0,0 +1 @@
+export declare function createMaskError(isDev: boolean): (error: unknown, message: string) => Error;

package/lib/utils/maskError.js

@@ -0,0 +1,22 @@
+import { GraphQLError } from 'graphql';
+import { maskError as yogaMaskError } from 'graphql-yoga';
+function isKnownError(error) {
+    return error instanceof Error && 'code' in error && typeof error.code === 'string';
+}
+export function createMaskError(isDev) {
+    return function maskError(error, message) {
+        const originalError = error instanceof GraphQLError ? error.originalError || error : error;
+        if (error instanceof GraphQLError && error.extensions?.code) {
+            return error;
+        }
+        if (isKnownError(originalError)) {
+            return new GraphQLError(originalError.message, {
+                extensions: {
+                    code: originalError.code,
+                    ...(originalError.data || {}),
+                },
+            });
+        }
+        return yogaMaskError(error, message, isDev);
+    };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "4.6.1",
+  "version": "4.6.2",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",