@unchainedshop/api 4.6.1 → 4.7.2

package/lib/acl.js

@@ -1,5 +1,17 @@
 import { Roles } from '@unchainedshop/roles';
+import { emit } from '@unchainedshop/events';
 import { NoPermissionError, PermissionSystemError } from "./errors.js";
+import { API_EVENTS } from "./events.js";
+const SENSITIVE_ACTION_PREFIXES = [
+    'manageUser',
+    'login',
+    'logout',
+    'reset',
+    'forgot',
+    'impersonate',
+    'updateUser',
+    'createUser',
+];
 const defaultOptions = {
     showKey: true,
     mapArgs: (...args) => args,
@@ -19,11 +31,27 @@ export const ensureIsFunction = (fn, action, options, key) => {
         });
     }
 };
+const isSensitiveAction = (action) => {
+    return SENSITIVE_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix));
+};
 const checkAction = async (context, action, args = emptyArray, options = emptyObject) => {
     const { key } = options || emptyObject;
     const hasPermission = await Roles.userHasPermission(context, action, args);
-    if (hasPermission)
+    if (hasPermission) {
+        if (isSensitiveAction(action)) {
+            await emit(API_EVENTS.ACL_GRANTED_SENSITIVE, {
+                userId: context.userId,
+                action,
+                key,
+            });
+        }
         return;
+    }
+    await emit(API_EVENTS.ACL_DENIED, {
+        userId: context.userId,
+        action,
+        key,
+    });
     const keyText = key && key !== '' ? ` in "${key}"` : '';
     throw new NoPermissionError({
         userId: context.userId,

package/lib/api-index.d.ts

@@ -8,6 +8,7 @@ export * from './loaders/index.ts';
 export * from './errors.ts';
 export * as acl from './acl.ts';
 export * as roles from './roles/index.ts';
+export type { OIDCProviderConfig, AuthConfig } from './auth.ts';
 export { createContextResolver, getCurrentContextResolver, setCurrentContextResolver };
 export type UnchainedServerOptions = {
     roles?: any;

package/lib/auth.d.ts

@@ -0,0 +1,44 @@
+export interface AccessTokenPayload {
+    iss: string;
+    sub: string;
+    ver: number;
+    fgp?: string;
+    imp?: string;
+    jti?: string;
+    iat?: number;
+    exp?: number;
+}
+export interface OIDCProviderConfig {
+    issuer: string;
+    jwksUri?: string;
+    audience?: string | string[];
+}
+export interface AuthConfig {
+    oidcProviders?: OIDCProviderConfig[];
+}
+export declare function generateFingerprint(): {
+    raw: string;
+    hash: string;
+};
+export declare function verifyFingerprint(raw: string, hash: string): boolean;
+export declare function signAccessToken(userId: string, tokenVersion: number, options?: {
+    impersonatorId?: string;
+    fingerprintHash?: string;
+}): Promise<{
+    token: string;
+    expires: Date;
+}>;
+export declare function verifyLocalToken(token: string): Promise<AccessTokenPayload | null>;
+export declare function verifyOIDCToken(token: string, providers: OIDCProviderConfig[]): Promise<{
+    userId: string;
+    roles?: string[];
+} | null>;
+export interface AuthHandlerResult {
+    userId?: string;
+    tokenVersion?: number;
+    impersonatorId?: string;
+    fingerprintHash?: string;
+    accessToken?: string;
+    isApiKey?: boolean;
+}
+export declare function createAuthHandler(config?: AuthConfig): (token: string) => Promise<AuthHandlerResult>;

package/lib/auth.js

@@ -0,0 +1,187 @@
+import { createLogger } from '@unchainedshop/logger';
+import * as jose from 'jose';
+import { createHash } from 'crypto';
+const logger = createLogger('unchained:api:auth');
+const { UNCHAINED_TOKEN_SECRET, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', UNCHAINED_TOKEN_ISSUER = 'unchained-engine', } = process.env;
+const MIN_SECRET_LENGTH = 32;
+const jwksCache = new Map();
+function validateSecretStrength(secret) {
+    if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(`UNCHAINED_TOKEN_SECRET must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for security. ` +
+            `Current length: ${secret.length}. Generate a secure secret with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
+    }
+}
+export function generateFingerprint() {
+    const raw = crypto.randomUUID() + crypto.randomUUID();
+    const hash = createHash('sha256').update(raw).digest('hex');
+    return { raw, hash };
+}
+export function verifyFingerprint(raw, hash) {
+    const computedHash = createHash('sha256').update(raw).digest('hex');
+    if (computedHash.length !== hash.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < computedHash.length; i++) {
+        result |= computedHash.charCodeAt(i) ^ hash.charCodeAt(i);
+    }
+    return result === 0;
+}
+export async function signAccessToken(userId, tokenVersion, options) {
+    if (!UNCHAINED_TOKEN_SECRET) {
+        throw new Error('UNCHAINED_TOKEN_SECRET environment variable is required');
+    }
+    validateSecretStrength(UNCHAINED_TOKEN_SECRET);
+    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
+    const now = Math.floor(Date.now() / 1000);
+    const payload = {
+        sub: userId,
+        ver: tokenVersion,
+        jti: crypto.randomUUID(),
+    };
+    if (options?.fingerprintHash) {
+        payload.fgp = options.fingerprintHash;
+    }
+    if (options?.impersonatorId) {
+        payload.imp = options.impersonatorId;
+    }
+    const secret = new TextEncoder().encode(UNCHAINED_TOKEN_SECRET);
+    const token = await new jose.SignJWT(payload)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt(now)
+        .setIssuer(UNCHAINED_TOKEN_ISSUER)
+        .setExpirationTime(now + expirySeconds)
+        .sign(secret);
+    const expires = new Date((now + expirySeconds) * 1000);
+    return { token, expires };
+}
+export async function verifyLocalToken(token) {
+    if (!UNCHAINED_TOKEN_SECRET) {
+        logger.warn('UNCHAINED_TOKEN_SECRET not set, cannot verify local tokens');
+        return null;
+    }
+    try {
+        validateSecretStrength(UNCHAINED_TOKEN_SECRET);
+        const secret = new TextEncoder().encode(UNCHAINED_TOKEN_SECRET);
+        const { payload } = await jose.jwtVerify(token, secret, {
+            algorithms: ['HS256'],
+            issuer: UNCHAINED_TOKEN_ISSUER,
+        });
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            logger.debug('Token expired');
+        }
+        else if (error instanceof jose.errors.JWTInvalid ||
+            error instanceof jose.errors.JWSInvalid ||
+            error instanceof jose.errors.JWSSignatureVerificationFailed ||
+            error instanceof jose.errors.JWTClaimValidationFailed) {
+            logger.debug('Invalid token signature or claims');
+        }
+        else {
+            logger.error('Token verification error:', {
+                message: error.message,
+                name: error.name,
+            });
+        }
+        return null;
+    }
+}
+function getJWKS(jwksUri) {
+    let jwks = jwksCache.get(jwksUri);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cooldownDuration: 30000,
+            cacheMaxAge: 600000,
+        });
+        jwksCache.set(jwksUri, jwks);
+    }
+    return jwks;
+}
+export async function verifyOIDCToken(token, providers) {
+    let decodedPayload;
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            logger.debug('Invalid JWT format');
+            return null;
+        }
+        decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    }
+    catch {
+        logger.debug('Failed to decode JWT');
+        return null;
+    }
+    const { iss, sub } = decodedPayload;
+    if (!iss || !sub || typeof iss !== 'string' || typeof sub !== 'string') {
+        logger.debug('OIDC token missing issuer or subject');
+        return null;
+    }
+    const provider = providers.find((p) => p.issuer === iss);
+    if (!provider) {
+        logger.debug('No matching OIDC provider for issuer:', { iss });
+        return null;
+    }
+    const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
+    try {
+        const JWKS = getJWKS(jwksUri);
+        const verifyOptions = {
+            issuer: provider.issuer,
+        };
+        if (provider.audience) {
+            verifyOptions.audience = provider.audience;
+        }
+        const { payload } = await jose.jwtVerify(token, JWKS, verifyOptions);
+        logger.debug('OIDC token verified successfully', { issuer: iss, subject: sub });
+        return {
+            userId: payload.sub,
+            roles: payload.roles,
+        };
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            logger.debug('OIDC token expired');
+        }
+        else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            logger.debug('OIDC token claim validation failed:', { message: error.message });
+        }
+        else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            logger.debug('OIDC token signature verification failed');
+        }
+        else {
+            logger.error('OIDC token verification failed:', {
+                message: error.message,
+                name: error.name,
+            });
+        }
+        return null;
+    }
+}
+export function createAuthHandler(config) {
+    return async function verifyToken(token) {
+        if (!token) {
+            return {};
+        }
+        const localPayload = await verifyLocalToken(token);
+        if (localPayload) {
+            return {
+                userId: localPayload.sub,
+                tokenVersion: localPayload.ver,
+                impersonatorId: localPayload.imp,
+                fingerprintHash: localPayload.fgp,
+            };
+        }
+        if (config?.oidcProviders?.length) {
+            const oidcResult = await verifyOIDCToken(token, config.oidcProviders);
+            if (oidcResult) {
+                return {
+                    userId: oidcResult.userId,
+                };
+            }
+        }
+        return {
+            accessToken: token,
+            isApiKey: true,
+        };
+    };
+}

package/lib/context.d.ts

@@ -16,6 +16,7 @@ export interface UnchainedUserContext {
     userId?: string;
     impersonatorId?: string;
     accessToken?: string;
+    tokenVersion?: number;
     user?: User;
 }
 export interface CustomAdminUiProperties {

package/lib/context.js

@@ -6,7 +6,7 @@ export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {
     context = newContext;
 };
-export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, login, logout, }) => {
+export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, tokenVersion, login, logout, }) => {
     const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader };
     const loaders = instantiateLoaders(unchainedAPI);
     const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
@@ -21,8 +21,13 @@ export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({
     if (userId && !userContext.userId) {
         const user = await unchainedAPI.modules.users.findUserById(userId);
         if (user) {
-            userContext.user = user;
-            userContext.userId = user._id;
+            const userTokenVersion = user.tokenVersion ?? 1;
+            if (tokenVersion !== undefined && tokenVersion !== userTokenVersion) {
+            }
+            else {
+                userContext.user = user;
+                userContext.userId = user._id;
+            }
         }
     }
     return {

package/lib/events.d.ts

@@ -1,5 +1,7 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
     readonly API_LOGOUT: "API_LOGOUT";
+    readonly ACL_DENIED: "ACL_DENIED";
+    readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";
 };
 export type API_EVENTS = (typeof API_EVENTS)[keyof typeof API_EVENTS];

package/lib/events.js

@@ -1,4 +1,6 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
     API_LOGOUT: 'API_LOGOUT',
+    ACL_DENIED: 'ACL_DENIED',
+    ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',
 };

package/lib/express/index.d.ts

@@ -1,7 +1,7 @@
 import e from 'express';
 import type { YogaServerInstance } from 'graphql-yoga';
-import { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
+import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
 export interface AdminUIRouterOptions {
@@ -9,17 +9,14 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const adminUIRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
-export declare const connect: (expressApp: e.Express, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (expressApp: e.Express, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: e.Express, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
-export declare const expressRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export { connectChat };

package/lib/express/index.js

@@ -1,17 +1,12 @@
 import e from 'express';
-import session from 'express-session';
-import multer from 'multer';
-import MongoStore from "../mongo-store.js";
-import { Passport } from 'passport';
-import { mongodb } from '@unchainedshop/mongodb';
-import { emit } from '@unchainedshop/events';
+import cookieParser from 'cookie-parser';
+import { pluginRegistry } from '@unchainedshop/core';
 import { getCurrentContextResolver } from "../context.js";
-import createBulkImportMiddleware from "./createBulkImportMiddleware.js";
-import createERCMetadataMiddleware from "./createERCMetadataMiddleware.js";
-import createTempUploadMiddleware from "./createTempUploadMiddleware.js";
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
-import { API_EVENTS } from "../events.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
 export const adminUIRouter = (enabled = true) => {
     const router = e.Router();
     const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -24,87 +19,53 @@ export const adminUIRouter = (enabled = true) => {
     }
     return router;
 };
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const storage = multer.memoryStorage();
-const upload = multer({ storage: storage });
-const { BULK_IMPORT_API_PATH = '/bulk-import', ERC_METADATA_API_PATH = '/erc-metadata', TEMP_UPLOAD_API_PATH = '/temp-upload', MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const addContext = async function middlewareWithContext(req, res, next) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createAddContextMiddleware = (authConfig, trustProxy = false) => async function middlewareWithContext(req, res, next) {
     try {
         const setHeader = (key, value) => res.setHeader(key, value);
         const getHeader = (key) => req.headers[key];
-        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-        const context = getCurrentContextResolver();
-        const login = async (user, options = {}) => {
-            const { impersonator } = options;
-            await new Promise((resolve, reject) => {
-                req.login(user, (error, result) => {
-                    if (error) {
-                        return reject(error);
-                    }
-                    req.session.impersonatorId = impersonator?._id;
-                    return resolve(result);
-                });
-            });
-            const tokenObject = {
-                _id: req.sessionID,
-                userId: user._id,
-                tokenExpires: new Date(req.session?.cookie._expires),
-            };
-            await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-            user._inLoginMethodResponse = true;
-            return { user, ...tokenObject };
-        };
-        const logout = async (sessionId) => {
-            const { user } = req;
-            if (!user)
-                return false;
-            const currentSessionId = req.sessionID;
-            const targetSessionId = sessionId || currentSessionId;
-            const tokenObject = {
-                _id: targetSessionId,
-                userId: user._id,
-            };
-            if (sessionId && sessionId !== currentSessionId) {
-                await new Promise((resolve, reject) => {
-                    req.sessionStore.destroy(sessionId, (error) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        return resolve();
-                    });
-                });
-            }
-            else {
-                await new Promise((resolve, reject) => {
-                    req.logout((error, result) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        req.session.impersonatorId = null;
-                        return resolve(result);
-                    });
-                });
-            }
-            await emit(API_EVENTS.API_LOGOUT, tokenObject);
-            return true;
+        const getCookie = (name) => req.cookies?.[name];
+        const setCookie = (name, value, options) => res.cookie(name, value, options);
+        const clearCookie = (name, options) => res.clearCookie(name, { ...options, maxAge: 0 });
+        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+        const authContextParams = {
+            setHeader,
+            getHeader,
+            getCookie,
+            setCookie,
+            clearCookie,
+            remoteAddress,
+            remotePort,
         };
-        const [, accessToken] = req.headers.authorization?.split(' ') || [];
+        const authContext = await createAuthContext(authContextParams, authConfig);
+        const context = getCurrentContextResolver();
         req.unchainedContext = await context({
             setHeader,
             getHeader,
             remoteAddress,
             remotePort,
-            login,
-            logout,
-            accessToken,
-            userId: req.user?._id,
-            impersonatorId: req.session.impersonatorId,
+            login: authContext.login,
+            logout: authContext.logout,
+            accessToken: authContext.accessToken,
+            userId: authContext.userId,
+            impersonatorId: authContext.impersonatorId,
+            tokenVersion: authContext.tokenVersion,
         }, req, res);
         next();
     }
@@ -112,8 +73,12 @@ const addContext = async function middlewareWithContext(req, res, next) {
         next(error);
     }
 };
-export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         expressApp.set('trust proxy', 1);
         expressApp.use((req, res, next) => {
             req.headers['x-forwarded-proto'] = 'https';
@@ -125,59 +90,21 @@ export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { all
             next();
         });
     }
-    const passport = new Passport();
-    passport.serializeUser(function serialize(user, done) {
-        done(null, user._id);
-    });
-    passport.deserializeUser(function deserialize(_id, done) {
-        done(null, { _id });
-    });
-    const name = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
-    expressApp.use(session({
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-            touchAfter: 24 * 3600,
-        }),
-        name,
-        saveUninitialized: false,
-        resave: false,
-        cookie: {
-            domain,
-            path,
-            sameSite,
-            secure,
-            httpOnly: true,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    }), passport.initialize(), passport.session(), addContext);
-    expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
-    expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
-    expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-    expressApp.use(TEMP_UPLOAD_API_PATH, upload.any(), createTempUploadMiddleware);
+    expressApp.use(cookieParser());
+    expressApp.use(createAddContextMiddleware(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
+    expressApp.use(graphqlHandler.graphqlEndpoint, graphqlHandler.handle);
     expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
     expressApp.use(MCP_API_PATH, createMCPMiddleware);
     if (chat) {
         connectChat(expressApp, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(expressApp, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(expressApp, unchainedAPI, routes);
     if (adminUI) {
         expressApp.use(typeof adminUI === 'object' ? adminUI.prefix : '/', adminUIRouter(true));
     }
 };
-export const expressRouter = adminUIRouter;
 export { connectChat };

package/lib/express/mountPluginRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from 'express';
+import type { UnchainedCore } from '@unchainedshop/core';
+export declare function mountPluginRoutes(app: Express, unchainedAPI: UnchainedCore): void;

package/lib/express/mountPluginRoutes.js

@@ -0,0 +1,59 @@
+import { pluginRegistry } from '@unchainedshop/core';
+import { createServerAdapter } from '@whatwg-node/server';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('express');
+export function mountPluginRoutes(app, unchainedAPI) {
+    const routes = pluginRegistry.getRoutes();
+    if (routes.length > 0) {
+        const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+        logger.info(`Mounting ${routes.length} plugin route(s): ${endpoints}`);
+    }
+    for (const route of routes) {
+        const adapter = createServerAdapter(async (request, serverContext) => {
+            const context = {
+                ...unchainedAPI,
+                ...serverContext.unchainedContext,
+                params: serverContext.params || {},
+                rawRequest: serverContext.rawRequest,
+            };
+            try {
+                return await route.handler(request, context);
+            }
+            catch (error) {
+                logger.error(`Error in plugin route handler ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return new Response(JSON.stringify({
+                    error: error instanceof Error ? error.message : 'Internal Server Error',
+                }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        });
+        const method = route.method.toLowerCase();
+        const expressHandler = async (req, res) => {
+            try {
+                await adapter.handleNodeRequestAndResponse(req, res, {
+                    unchainedContext: req.unchainedContext,
+                    params: req.params,
+                    rawRequest: req,
+                });
+            }
+            catch (error) {
+                logger.error(`Error handling request for ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (!res.headersSent) {
+                    res.status(500).json({ error: 'Internal Server Error' });
+                }
+            }
+        };
+        if (method === 'all') {
+            app.use(route.path, expressHandler);
+        }
+        else {
+            app[method](route.path, expressHandler);
+        }
+    }
+}

package/lib/express/mountRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from 'express';
+import type { UnchainedCore, PluginHttpRoute } from '@unchainedshop/core';
+export declare function mountRoutes(app: Express, unchainedAPI: UnchainedCore, routes: PluginHttpRoute[]): void;