@unchainedshop/api 4.6.1 → 4.7.2

package/lib/express/mountRoutes.js

@@ -0,0 +1,57 @@
+import { createServerAdapter } from '@whatwg-node/server';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('express');
+export function mountRoutes(app, unchainedAPI, routes) {
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    logger.info(`Mounting ${routes.length} route(s): ${endpoints}`);
+    for (const route of routes) {
+        const adapter = createServerAdapter(async (request, serverContext) => {
+            const context = {
+                ...unchainedAPI,
+                ...serverContext.unchainedContext,
+                params: serverContext.params || {},
+                rawRequest: serverContext.rawRequest,
+            };
+            try {
+                return await route.handler(request, context);
+            }
+            catch (error) {
+                logger.error(`Error in route handler ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return new Response(JSON.stringify({
+                    error: error instanceof Error ? error.message : 'Internal Server Error',
+                }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        });
+        const method = route.method.toLowerCase();
+        const expressHandler = async (req, res) => {
+            try {
+                await adapter.handleNodeRequestAndResponse(req, res, {
+                    unchainedContext: req.unchainedContext,
+                    params: req.params,
+                    rawRequest: req,
+                });
+            }
+            catch (error) {
+                logger.error(`Error handling request for ${route.method} ${route.path}`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (!res.headersSent) {
+                    res.status(500).json({ error: 'Internal Server Error' });
+                }
+            }
+        };
+        if (method === 'all') {
+            app.use(route.path, expressHandler);
+        }
+        else {
+            app[method](route.path, expressHandler);
+        }
+    }
+}

package/lib/fastify/index.d.ts

@@ -1,5 +1,5 @@
+import type { AuthConfig } from '../auth.ts';
 import type { YogaServerInstance } from 'graphql-yoga';
-import type { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
@@ -9,18 +9,15 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
-export declare const connect: (fastify: FastifyInstance, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: FastifyInstance, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export declare const adminUIRouter: FastifyPluginAsync<AdminUIRouterOptions>;
-export declare const fastifyRouter: FastifyPluginAsync<AdminUIRouterOptions>;
 export { connectChat };

package/lib/fastify/index.js

@@ -1,64 +1,59 @@
 import { getCurrentContextResolver } from "../context.js";
-import bulkImportHandler from "./bulkImportHandler.js";
-import ercMetadataHandler from "./ercMetadataHandler.js";
-import MongoStore from "../mongo-store.js";
-import { emit } from '@unchainedshop/events';
-import { API_EVENTS } from "../events.js";
-import fastifySession from '@fastify/session';
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
+import { pluginRegistry } from '@unchainedshop/core';
 import fastifyCookie from '@fastify/cookie';
-import fastifyMultipart from '@fastify/multipart';
 import { createLogger } from '@unchainedshop/logger';
 import mcpHandler from "./mcpHandler.js";
-import tempUploadHandler from "./tempUploadHandler.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
 import { readFileSync } from 'node:fs';
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const { MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', BULK_IMPORT_API_PATH = '/bulk-import', TEMP_UPLOAD_API_PATH = '/temp-upload', ERC_METADATA_API_PATH = '/erc-metadata/:productId/:localeOrTokenFilename/:tokenFileName?', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const middlewareHook = async function middlewareHook(req, reply) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createMiddlewareHook = (authConfig, trustProxy = false) => async function middlewareHook(req, reply) {
     const setHeader = (key, value) => reply.header(key, value);
     const getHeader = (key) => req.headers[key];
-    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-    const context = getCurrentContextResolver();
-    const login = async function (user, options = {}) {
-        const { impersonator } = options;
-        req.session.userId = user._id;
-        req.session.impersonatorId = impersonator?._id;
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: user._id,
-            tokenExpires: new Date(req.session.cookie._expires),
-        };
-        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-        user._inLoginMethodResponse = true;
-        return { user, ...tokenObject };
-    };
-    const logout = async function logout() {
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: req.session?.userId,
-        };
-        req.session.userId = null;
-        req.session.impersonatorId = null;
-        await emit(API_EVENTS.API_LOGOUT, tokenObject);
-        return true;
+    const getCookie = (name) => req.cookies?.[name];
+    const setCookie = (name, value, options) => reply.setCookie(name, value, options);
+    const clearCookie = (name, options) => reply.clearCookie(name, { ...options, maxAge: 0 });
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+    const authContextParams = {
+        setHeader,
+        getHeader,
+        getCookie,
+        setCookie,
+        clearCookie,
+        remoteAddress,
+        remotePort,
     };
-    const [, accessToken] = req.headers.authorization?.split(' ') || [];
+    const authContext = await createAuthContext(authContextParams, authConfig);
+    const context = getCurrentContextResolver();
     req.unchainedContext = await context({
         setHeader,
         getHeader,
         remoteAddress,
         remotePort,
-        login,
-        logout,
-        accessToken,
-        userId: req.session.userId,
-        impersonatorId: req.session.impersonatorId,
+        login: authContext.login,
+        logout: authContext.logout,
+        accessToken: authContext.accessToken,
+        userId: authContext.userId,
+        impersonatorId: authContext.impersonatorId,
+        tokenVersion: authContext.tokenVersion,
     }, req, reply);
 };
 export const unchainedLogger = (prefix) => {
@@ -77,8 +72,12 @@ export const unchainedLogger = (prefix) => {
     };
     return new Logger();
 };
-export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         fastify.addHook('preHandler', async function (request) {
             request.headers['x-forwarded-proto'] = 'https';
         });
@@ -92,94 +91,34 @@ export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowR
             });
         });
     }
-    const cookieName = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
     if (!fastify.hasPlugin('@fastify/cookie')) {
         fastify.register(fastifyCookie);
     }
-    fastify.register(fastifySession, {
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        cookieName,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-        }),
-        cookie: {
-            domain,
-            httpOnly: true,
-            path,
-            secure,
-            sameSite,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    });
     fastify.decorateRequest('unchainedContext');
-    fastify.addHook('onRequest', middlewareHook);
+    fastify.addHook('onRequest', createMiddlewareHook(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
     fastify.route({
-        url: GRAPHQL_API_PATH,
+        url: graphqlHandler.graphqlEndpoint,
         method: ['GET', 'POST', 'OPTIONS'],
         handler: async (req, reply) => {
-            const response = await graphqlHandler.handleNodeRequestAndResponse(req, reply, {
+            return graphqlHandler.handleNodeRequestAndResponse(req, reply, {
                 req,
                 reply,
             });
-            response.headers.forEach((value, key) => {
-                reply.header(key, value);
-            });
-            reply.status(response.status);
-            reply.send(response.body);
-            return reply;
         },
     });
-    fastify.route({
-        url: ERC_METADATA_API_PATH,
-        method: ['GET'],
-        handler: ercMetadataHandler,
-    });
     fastify.route({
         url: MCP_API_PATH,
         method: ['GET', 'POST', 'DELETE'],
         handler: mcpHandler,
     });
-    fastify.register((s, opts, registered) => {
-        s.register(fastifyMultipart, { throwFileSizeLimit: true, limits: { fileSize: 1024 * 1024 * 35 } });
-        s.route({
-            url: TEMP_UPLOAD_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 35,
-            handler: tempUploadHandler,
-        });
-        registered();
-    });
-    fastify.register((s, opts, registered) => {
-        s.removeAllContentTypeParsers();
-        s.addContentTypeParser('*', function (req, payload, done) {
-            done(null);
-        });
-        s.route({
-            url: BULK_IMPORT_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 1024 * 5,
-            handler: bulkImportHandler,
-        });
-        registered();
-    });
     if (chat) {
         connectChat(fastify, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(fastify, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(fastify, unchainedAPI, routes);
     if (adminUI) {
         fastify.register(adminUIRouter, {
             enabled: true,
@@ -243,5 +182,4 @@ export const adminUIRouter = async (fastify, opts) => {
         }
     }
 };
-export const fastifyRouter = adminUIRouter;
 export { connectChat };

package/lib/fastify/mountPluginRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+import type { UnchainedCore } from '@unchainedshop/core';
+export declare function mountPluginRoutes(fastify: FastifyInstance, unchainedAPI: UnchainedCore): void;

package/lib/fastify/mountPluginRoutes.js

@@ -0,0 +1,62 @@
+import { pluginRegistry } from '@unchainedshop/core';
+import { createServerAdapter } from '@whatwg-node/server';
+export function mountPluginRoutes(fastify, unchainedAPI) {
+    const routes = pluginRegistry.getRoutes();
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    fastify.log.info(`Mounting ${routes.length} plugin route(s): ${endpoints}`);
+    fastify.register((scope, opts, registered) => {
+        scope.removeAllContentTypeParsers();
+        scope.addContentTypeParser('*', function (request, payload, done) {
+            done(null);
+        });
+        for (const route of routes) {
+            const adapter = createServerAdapter(async (request, serverContext) => {
+                const context = {
+                    ...unchainedAPI,
+                    ...serverContext.unchainedContext,
+                    params: serverContext.params || {},
+                    rawRequest: serverContext.rawRequest,
+                };
+                try {
+                    return await route.handler(request, context);
+                }
+                catch (error) {
+                    fastify.log.error(`Error in plugin route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
+                    return new Response(JSON.stringify({
+                        error: error instanceof Error ? error.message : 'Internal Server Error',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            });
+            let methods;
+            if (route.method === 'ALL') {
+                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+            }
+            else {
+                methods = [route.method];
+            }
+            scope.route({
+                url: route.path,
+                method: methods,
+                handler: async (req, reply) => {
+                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
+                        unchainedContext: req.unchainedContext,
+                        params: req.params,
+                        rawRequest: req.raw,
+                    });
+                    response.headers.forEach((value, key) => {
+                        reply.header(key, value);
+                    });
+                    reply.status(response.status);
+                    reply.send(response.body || undefined);
+                    return reply;
+                },
+            });
+        }
+        registered();
+    });
+}

package/lib/fastify/mountRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+import type { UnchainedCore, PluginHttpRoute } from '@unchainedshop/core';
+export declare function mountRoutes(fastify: FastifyInstance, unchainedAPI: UnchainedCore, routes: PluginHttpRoute[]): void;

package/lib/fastify/mountRoutes.js

@@ -0,0 +1,60 @@
+import { createServerAdapter } from '@whatwg-node/server';
+export function mountRoutes(fastify, unchainedAPI, routes) {
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    fastify.log.info(`Mounting ${routes.length} route(s): ${endpoints}`);
+    fastify.register((scope, opts, registered) => {
+        scope.removeAllContentTypeParsers();
+        scope.addContentTypeParser('*', function (request, payload, done) {
+            done(null);
+        });
+        for (const route of routes) {
+            const adapter = createServerAdapter(async (request, serverContext) => {
+                const context = {
+                    ...unchainedAPI,
+                    ...serverContext.unchainedContext,
+                    params: serverContext.params || {},
+                    rawRequest: serverContext.rawRequest,
+                };
+                try {
+                    return await route.handler(request, context);
+                }
+                catch (error) {
+                    fastify.log.error(`Error in route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
+                    return new Response(JSON.stringify({
+                        error: error instanceof Error ? error.message : 'Internal Server Error',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            });
+            let methods;
+            if (route.method === 'ALL') {
+                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+            }
+            else {
+                methods = [route.method];
+            }
+            scope.route({
+                url: route.path,
+                method: methods,
+                handler: async (req, reply) => {
+                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
+                        unchainedContext: req.unchainedContext,
+                        params: req.params,
+                        rawRequest: req.raw,
+                    });
+                    response.headers.forEach((value, key) => {
+                        reply.header(key, value);
+                    });
+                    reply.status(response.status);
+                    reply.send(response.body || undefined);
+                    return reply;
+                },
+            });
+        }
+        registered();
+    });
+}

package/lib/handlers/createBackchannelLogoutHandler.d.ts

@@ -0,0 +1,4 @@
+import type { PluginHttpRoute } from '@unchainedshop/core';
+import type { OIDCProviderConfig } from '../auth.ts';
+export declare function createBackchannelLogoutRoute(providers: OIDCProviderConfig[]): PluginHttpRoute;
+export default createBackchannelLogoutRoute;

package/lib/handlers/createBackchannelLogoutHandler.js

@@ -0,0 +1,170 @@
+import * as jose from 'jose';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:api:backchannel-logout');
+function normalizeIssuer(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.origin + parsed.pathname.replace(/\/$/, '');
+    }
+    catch {
+        return url;
+    }
+}
+const jwksCache = new Map();
+function getJWKS(jwksUri) {
+    let jwks = jwksCache.get(jwksUri);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cooldownDuration: 30000,
+            cacheMaxAge: 600000,
+        });
+        jwksCache.set(jwksUri, jwks);
+    }
+    return jwks;
+}
+export function createBackchannelLogoutRoute(providers) {
+    return {
+        path: '/backchannel-logout',
+        method: 'ALL',
+        handler: async (request, context) => {
+            if (request.method !== 'POST') {
+                return new Response(JSON.stringify({ error: 'method_not_allowed' }), {
+                    status: 405,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            try {
+                let logoutToken = null;
+                const contentType = request.headers.get('content-type') || '';
+                if (contentType.includes('application/x-www-form-urlencoded')) {
+                    const formData = await request.formData();
+                    logoutToken = formData.get('logout_token');
+                }
+                else if (contentType.includes('application/json')) {
+                    const body = (await request.json());
+                    logoutToken = body.logout_token || null;
+                }
+                if (!logoutToken) {
+                    logger.warn('Back-channel logout request missing logout_token');
+                    return new Response(JSON.stringify({ error: 'missing_logout_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                let decodedPayload;
+                try {
+                    const parts = logoutToken.split('.');
+                    if (parts.length !== 3) {
+                        logger.warn('Invalid logout token format: not a valid JWT');
+                        return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+                }
+                catch {
+                    logger.warn('Failed to decode logout token');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const { iss } = decodedPayload;
+                if (!iss || typeof iss !== 'string') {
+                    logger.warn('Logout token missing issuer (iss)');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const normalizedIss = normalizeIssuer(iss);
+                const provider = providers.find((p) => normalizeIssuer(p.issuer) === normalizedIss);
+                if (!provider) {
+                    logger.warn('Unknown issuer in logout token:', { iss });
+                    return new Response(JSON.stringify({ error: 'unknown_issuer' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
+                let verifiedPayload;
+                try {
+                    const JWKS = getJWKS(jwksUri);
+                    const verifyOptions = {
+                        issuer: provider.issuer,
+                    };
+                    if (provider.audience) {
+                        verifyOptions.audience = provider.audience;
+                    }
+                    const { payload } = await jose.jwtVerify(logoutToken, JWKS, verifyOptions);
+                    verifiedPayload = payload;
+                }
+                catch (error) {
+                    if (error instanceof jose.errors.JWTExpired) {
+                        logger.warn('Logout token expired');
+                        return new Response(JSON.stringify({ error: 'token_expired' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+                        logger.warn('Logout token claim validation failed:', { message: error.message });
+                        return new Response(JSON.stringify({ error: 'invalid_claims' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+                        logger.warn('Logout token signature verification failed - possible forgery attempt');
+                        return new Response(JSON.stringify({ error: 'invalid_signature' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else {
+                        logger.error('Logout token verification failed:', { error });
+                        return new Response(JSON.stringify({ error: 'verification_failed' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                }
+                const { sub, events } = verifiedPayload;
+                if (!events?.['http://schemas.openid.net/event/backchannel-logout']) {
+                    logger.warn('Token is not a back-channel logout token (missing events claim)');
+                    return new Response(JSON.stringify({ error: 'invalid_token_type' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                if (!sub) {
+                    logger.warn('Logout token missing subject (sub)');
+                    return new Response(JSON.stringify({ error: 'missing_subject' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const user = await context.modules.users.findUserById(sub);
+                if (!user) {
+                    logger.info('User not found for back-channel logout:', { sub });
+                    return new Response('', { status: 200 });
+                }
+                await context.modules.users.updateOidcLogoutAt(user._id, new Date());
+                logger.info('Back-channel logout processed successfully:', {
+                    userId: user._id,
+                    issuer: iss,
+                });
+                return new Response('', { status: 200 });
+            }
+            catch (error) {
+                logger.error('Back-channel logout error:', { error });
+                return new Response(JSON.stringify({ error: 'internal_error' }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        },
+    };
+}
+export default createBackchannelLogoutRoute;

package/lib/mcp/tools/localization/getLocalizationsConfig.d.ts

@@ -1,3 +1,3 @@
 import type { Context } from 'vm';
-import type { LocalizationType, LocalizationModuleConfig } from './types.ts';
+import type { LocalizationType, LocalizationModuleConfig } from './schemas.ts';
 export declare const getLocalizationsConfig: (context: Context, localizationType: LocalizationType) => LocalizationModuleConfig;

package/lib/mcp/tools/localization/schemas.d.ts

@@ -1,5 +1,39 @@
 import { z } from 'zod';
 import { SortDirection } from '@unchainedshop/utils';
+export type LocalizationType = 'COUNTRY' | 'CURRENCY' | 'LANGUAGE';
+export interface LocalizationModuleConfig {
+    module: any;
+    NotFoundError: any;
+    entityName: string;
+    idField: string;
+    existsMethod: any;
+    findMethod: any;
+    findMultipleMethod: any;
+}
+export interface LocalizationEntity {
+    isoCode: string;
+    contractAddress?: string;
+    decimals?: number;
+}
+export interface LocalizationUpdateEntity {
+    isoCode?: string;
+    contractAddress?: string;
+    decimals?: number;
+}
+export interface LocalizationListOptions {
+    limit?: number;
+    offset?: number;
+    includeInactive?: boolean;
+    queryString?: string;
+    sort?: {
+        key: string;
+        value: 'ASC' | 'DESC';
+    }[];
+}
+export interface LocalizationCountOptions {
+    includeInactive?: boolean;
+    queryString?: string;
+}
 export declare const sortDirectionKeys: [keyof typeof SortDirection, ...(keyof typeof SortDirection)[]];
 export declare const LocalizationTypeEnum: z.ZodEnum<{
     COUNTRY: "COUNTRY";