@unchainedshop/api 4.6.2 → 4.7.2

package/lib/acl.js

@@ -1,5 +1,17 @@
 import { Roles } from '@unchainedshop/roles';
+import { emit } from '@unchainedshop/events';
 import { NoPermissionError, PermissionSystemError } from "./errors.js";
+import { API_EVENTS } from "./events.js";
+const SENSITIVE_ACTION_PREFIXES = [
+    'manageUser',
+    'login',
+    'logout',
+    'reset',
+    'forgot',
+    'impersonate',
+    'updateUser',
+    'createUser',
+];
 const defaultOptions = {
     showKey: true,
     mapArgs: (...args) => args,
@@ -19,11 +31,27 @@ export const ensureIsFunction = (fn, action, options, key) => {
         });
     }
 };
+const isSensitiveAction = (action) => {
+    return SENSITIVE_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix));
+};
 const checkAction = async (context, action, args = emptyArray, options = emptyObject) => {
     const { key } = options || emptyObject;
     const hasPermission = await Roles.userHasPermission(context, action, args);
-    if (hasPermission)
+    if (hasPermission) {
+        if (isSensitiveAction(action)) {
+            await emit(API_EVENTS.ACL_GRANTED_SENSITIVE, {
+                userId: context.userId,
+                action,
+                key,
+            });
+        }
         return;
+    }
+    await emit(API_EVENTS.ACL_DENIED, {
+        userId: context.userId,
+        action,
+        key,
+    });
     const keyText = key && key !== '' ? ` in "${key}"` : '';
     throw new NoPermissionError({
         userId: context.userId,

package/lib/api-index.d.ts

@@ -8,6 +8,7 @@ export * from './loaders/index.ts';
 export * from './errors.ts';
 export * as acl from './acl.ts';
 export * as roles from './roles/index.ts';
+export type { OIDCProviderConfig, AuthConfig } from './auth.ts';
 export { createContextResolver, getCurrentContextResolver, setCurrentContextResolver };
 export type UnchainedServerOptions = {
     roles?: any;

package/lib/auth.js

@@ -73,6 +73,7 @@ export async function verifyLocalToken(token) {
             logger.debug('Token expired');
         }
         else if (error instanceof jose.errors.JWTInvalid ||
+            error instanceof jose.errors.JWSInvalid ||
             error instanceof jose.errors.JWSSignatureVerificationFailed ||
             error instanceof jose.errors.JWTClaimValidationFailed) {
             logger.debug('Invalid token signature or claims');

package/lib/context.d.ts

@@ -16,6 +16,7 @@ export interface UnchainedUserContext {
     userId?: string;
     impersonatorId?: string;
     accessToken?: string;
+    tokenVersion?: number;
     user?: User;
 }
 export interface CustomAdminUiProperties {

package/lib/context.js

@@ -6,7 +6,7 @@ export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {
     context = newContext;
 };
-export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, login, logout, }) => {
+export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, tokenVersion, login, logout, }) => {
     const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader };
     const loaders = instantiateLoaders(unchainedAPI);
     const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
@@ -21,8 +21,13 @@ export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({
     if (userId && !userContext.userId) {
         const user = await unchainedAPI.modules.users.findUserById(userId);
         if (user) {
-            userContext.user = user;
-            userContext.userId = user._id;
+            const userTokenVersion = user.tokenVersion ?? 1;
+            if (tokenVersion !== undefined && tokenVersion !== userTokenVersion) {
+            }
+            else {
+                userContext.user = user;
+                userContext.userId = user._id;
+            }
         }
     }
     return {

package/lib/events.d.ts

@@ -1,5 +1,7 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
     readonly API_LOGOUT: "API_LOGOUT";
+    readonly ACL_DENIED: "ACL_DENIED";
+    readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";
 };
 export type API_EVENTS = (typeof API_EVENTS)[keyof typeof API_EVENTS];

package/lib/events.js

@@ -1,4 +1,6 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
     API_LOGOUT: 'API_LOGOUT',
+    ACL_DENIED: 'ACL_DENIED',
+    ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',
 };

package/lib/express/index.d.ts

@@ -1,7 +1,7 @@
 import e from 'express';
 import type { YogaServerInstance } from 'graphql-yoga';
-import { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
+import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
 export interface AdminUIRouterOptions {
@@ -9,17 +9,14 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const adminUIRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
-export declare const connect: (expressApp: e.Express, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (expressApp: e.Express, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: e.Express, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
-export declare const expressRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export { connectChat };

package/lib/express/index.js

@@ -1,17 +1,12 @@
 import e from 'express';
-import session from 'express-session';
-import multer from 'multer';
-import MongoStore from "../mongo-store.js";
-import { Passport } from 'passport';
-import { mongodb } from '@unchainedshop/mongodb';
-import { emit } from '@unchainedshop/events';
+import cookieParser from 'cookie-parser';
+import { pluginRegistry } from '@unchainedshop/core';
 import { getCurrentContextResolver } from "../context.js";
-import createBulkImportMiddleware from "./createBulkImportMiddleware.js";
-import createERCMetadataMiddleware from "./createERCMetadataMiddleware.js";
-import createTempUploadMiddleware from "./createTempUploadMiddleware.js";
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
-import { API_EVENTS } from "../events.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
 export const adminUIRouter = (enabled = true) => {
     const router = e.Router();
     const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -24,87 +19,53 @@ export const adminUIRouter = (enabled = true) => {
     }
     return router;
 };
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const storage = multer.memoryStorage();
-const upload = multer({ storage: storage });
-const { BULK_IMPORT_API_PATH = '/bulk-import', ERC_METADATA_API_PATH = '/erc-metadata', TEMP_UPLOAD_API_PATH = '/temp-upload', MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const addContext = async function middlewareWithContext(req, res, next) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createAddContextMiddleware = (authConfig, trustProxy = false) => async function middlewareWithContext(req, res, next) {
     try {
         const setHeader = (key, value) => res.setHeader(key, value);
         const getHeader = (key) => req.headers[key];
-        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-        const context = getCurrentContextResolver();
-        const login = async (user, options = {}) => {
-            const { impersonator } = options;
-            await new Promise((resolve, reject) => {
-                req.login(user, (error, result) => {
-                    if (error) {
-                        return reject(error);
-                    }
-                    req.session.impersonatorId = impersonator?._id;
-                    return resolve(result);
-                });
-            });
-            const tokenObject = {
-                _id: req.sessionID,
-                userId: user._id,
-                tokenExpires: new Date(req.session?.cookie._expires),
-            };
-            await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-            user._inLoginMethodResponse = true;
-            return { user, ...tokenObject };
-        };
-        const logout = async (sessionId) => {
-            const { user } = req;
-            if (!user)
-                return false;
-            const currentSessionId = req.sessionID;
-            const targetSessionId = sessionId || currentSessionId;
-            const tokenObject = {
-                _id: targetSessionId,
-                userId: user._id,
-            };
-            if (sessionId && sessionId !== currentSessionId) {
-                await new Promise((resolve, reject) => {
-                    req.sessionStore.destroy(sessionId, (error) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        return resolve();
-                    });
-                });
-            }
-            else {
-                await new Promise((resolve, reject) => {
-                    req.logout((error, result) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        req.session.impersonatorId = null;
-                        return resolve(result);
-                    });
-                });
-            }
-            await emit(API_EVENTS.API_LOGOUT, tokenObject);
-            return true;
+        const getCookie = (name) => req.cookies?.[name];
+        const setCookie = (name, value, options) => res.cookie(name, value, options);
+        const clearCookie = (name, options) => res.clearCookie(name, { ...options, maxAge: 0 });
+        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+        const authContextParams = {
+            setHeader,
+            getHeader,
+            getCookie,
+            setCookie,
+            clearCookie,
+            remoteAddress,
+            remotePort,
         };
-        const [, accessToken] = req.headers.authorization?.split(' ') || [];
+        const authContext = await createAuthContext(authContextParams, authConfig);
+        const context = getCurrentContextResolver();
         req.unchainedContext = await context({
             setHeader,
             getHeader,
             remoteAddress,
             remotePort,
-            login,
-            logout,
-            accessToken,
-            userId: req.user?._id,
-            impersonatorId: req.session.impersonatorId,
+            login: authContext.login,
+            logout: authContext.logout,
+            accessToken: authContext.accessToken,
+            userId: authContext.userId,
+            impersonatorId: authContext.impersonatorId,
+            tokenVersion: authContext.tokenVersion,
         }, req, res);
         next();
     }
@@ -112,8 +73,12 @@ const addContext = async function middlewareWithContext(req, res, next) {
         next(error);
     }
 };
-export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         expressApp.set('trust proxy', 1);
         expressApp.use((req, res, next) => {
             req.headers['x-forwarded-proto'] = 'https';
@@ -125,59 +90,21 @@ export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { all
             next();
         });
     }
-    const passport = new Passport();
-    passport.serializeUser(function serialize(user, done) {
-        done(null, user._id);
-    });
-    passport.deserializeUser(function deserialize(_id, done) {
-        done(null, { _id });
-    });
-    const name = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
-    expressApp.use(session({
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-            touchAfter: 24 * 3600,
-        }),
-        name,
-        saveUninitialized: false,
-        resave: false,
-        cookie: {
-            domain,
-            path,
-            sameSite,
-            secure,
-            httpOnly: true,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    }), passport.initialize(), passport.session(), addContext);
-    expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
-    expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
-    expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-    expressApp.use(TEMP_UPLOAD_API_PATH, upload.any(), createTempUploadMiddleware);
+    expressApp.use(cookieParser());
+    expressApp.use(createAddContextMiddleware(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
+    expressApp.use(graphqlHandler.graphqlEndpoint, graphqlHandler.handle);
     expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
     expressApp.use(MCP_API_PATH, createMCPMiddleware);
     if (chat) {
         connectChat(expressApp, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(expressApp, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(expressApp, unchainedAPI, routes);
     if (adminUI) {
         expressApp.use(typeof adminUI === 'object' ? adminUI.prefix : '/', adminUIRouter(true));
     }
 };
-export const expressRouter = adminUIRouter;
 export { connectChat };

package/lib/fastify/index.d.ts

@@ -1,5 +1,5 @@
+import type { AuthConfig } from '../auth.ts';
 import type { YogaServerInstance } from 'graphql-yoga';
-import type { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
@@ -9,18 +9,15 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
-export declare const connect: (fastify: FastifyInstance, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: FastifyInstance, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export declare const adminUIRouter: FastifyPluginAsync<AdminUIRouterOptions>;
-export declare const fastifyRouter: FastifyPluginAsync<AdminUIRouterOptions>;
 export { connectChat };

package/lib/fastify/index.js

@@ -1,64 +1,59 @@
 import { getCurrentContextResolver } from "../context.js";
-import bulkImportHandler from "./bulkImportHandler.js";
-import ercMetadataHandler from "./ercMetadataHandler.js";
-import MongoStore from "../mongo-store.js";
-import { emit } from '@unchainedshop/events';
-import { API_EVENTS } from "../events.js";
-import fastifySession from '@fastify/session';
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
+import { pluginRegistry } from '@unchainedshop/core';
 import fastifyCookie from '@fastify/cookie';
-import fastifyMultipart from '@fastify/multipart';
 import { createLogger } from '@unchainedshop/logger';
 import mcpHandler from "./mcpHandler.js";
-import tempUploadHandler from "./tempUploadHandler.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
 import { readFileSync } from 'node:fs';
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const { MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', BULK_IMPORT_API_PATH = '/bulk-import', TEMP_UPLOAD_API_PATH = '/temp-upload', ERC_METADATA_API_PATH = '/erc-metadata/:productId/:localeOrTokenFilename/:tokenFileName?', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const middlewareHook = async function middlewareHook(req, reply) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createMiddlewareHook = (authConfig, trustProxy = false) => async function middlewareHook(req, reply) {
     const setHeader = (key, value) => reply.header(key, value);
     const getHeader = (key) => req.headers[key];
-    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-    const context = getCurrentContextResolver();
-    const login = async function (user, options = {}) {
-        const { impersonator } = options;
-        req.session.userId = user._id;
-        req.session.impersonatorId = impersonator?._id;
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: user._id,
-            tokenExpires: new Date(req.session.cookie._expires),
-        };
-        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-        user._inLoginMethodResponse = true;
-        return { user, ...tokenObject };
-    };
-    const logout = async function logout() {
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: req.session?.userId,
-        };
-        req.session.userId = null;
-        req.session.impersonatorId = null;
-        await emit(API_EVENTS.API_LOGOUT, tokenObject);
-        return true;
+    const getCookie = (name) => req.cookies?.[name];
+    const setCookie = (name, value, options) => reply.setCookie(name, value, options);
+    const clearCookie = (name, options) => reply.clearCookie(name, { ...options, maxAge: 0 });
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+    const authContextParams = {
+        setHeader,
+        getHeader,
+        getCookie,
+        setCookie,
+        clearCookie,
+        remoteAddress,
+        remotePort,
     };
-    const [, accessToken] = req.headers.authorization?.split(' ') || [];
+    const authContext = await createAuthContext(authContextParams, authConfig);
+    const context = getCurrentContextResolver();
     req.unchainedContext = await context({
         setHeader,
         getHeader,
         remoteAddress,
         remotePort,
-        login,
-        logout,
-        accessToken,
-        userId: req.session.userId,
-        impersonatorId: req.session.impersonatorId,
+        login: authContext.login,
+        logout: authContext.logout,
+        accessToken: authContext.accessToken,
+        userId: authContext.userId,
+        impersonatorId: authContext.impersonatorId,
+        tokenVersion: authContext.tokenVersion,
     }, req, reply);
 };
 export const unchainedLogger = (prefix) => {
@@ -77,8 +72,12 @@ export const unchainedLogger = (prefix) => {
     };
     return new Logger();
 };
-export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         fastify.addHook('preHandler', async function (request) {
             request.headers['x-forwarded-proto'] = 'https';
         });
@@ -92,94 +91,34 @@ export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowR
             });
         });
     }
-    const cookieName = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
     if (!fastify.hasPlugin('@fastify/cookie')) {
         fastify.register(fastifyCookie);
     }
-    fastify.register(fastifySession, {
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        cookieName,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-        }),
-        cookie: {
-            domain,
-            httpOnly: true,
-            path,
-            secure,
-            sameSite,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    });
     fastify.decorateRequest('unchainedContext');
-    fastify.addHook('onRequest', middlewareHook);
+    fastify.addHook('onRequest', createMiddlewareHook(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
     fastify.route({
-        url: GRAPHQL_API_PATH,
+        url: graphqlHandler.graphqlEndpoint,
         method: ['GET', 'POST', 'OPTIONS'],
         handler: async (req, reply) => {
-            const response = await graphqlHandler.handleNodeRequestAndResponse(req, reply, {
+            return graphqlHandler.handleNodeRequestAndResponse(req, reply, {
                 req,
                 reply,
             });
-            response.headers.forEach((value, key) => {
-                reply.header(key, value);
-            });
-            reply.status(response.status);
-            reply.send(response.body);
-            return reply;
         },
     });
-    fastify.route({
-        url: ERC_METADATA_API_PATH,
-        method: ['GET'],
-        handler: ercMetadataHandler,
-    });
     fastify.route({
         url: MCP_API_PATH,
         method: ['GET', 'POST', 'DELETE'],
         handler: mcpHandler,
     });
-    fastify.register((s, opts, registered) => {
-        s.register(fastifyMultipart, { throwFileSizeLimit: true, limits: { fileSize: 1024 * 1024 * 35 } });
-        s.route({
-            url: TEMP_UPLOAD_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 35,
-            handler: tempUploadHandler,
-        });
-        registered();
-    });
-    fastify.register((s, opts, registered) => {
-        s.removeAllContentTypeParsers();
-        s.addContentTypeParser('*', function (req, payload, done) {
-            done(null);
-        });
-        s.route({
-            url: BULK_IMPORT_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 1024 * 5,
-            handler: bulkImportHandler,
-        });
-        registered();
-    });
     if (chat) {
         connectChat(fastify, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(fastify, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(fastify, unchainedAPI, routes);
     if (adminUI) {
         fastify.register(adminUIRouter, {
             enabled: true,
@@ -243,5 +182,4 @@ export const adminUIRouter = async (fastify, opts) => {
         }
     }
 };
-export const fastifyRouter = adminUIRouter;
 export { connectChat };

package/lib/mcp/tools/localization/getLocalizationsConfig.d.ts

@@ -1,3 +1,3 @@
 import type { Context } from 'vm';
-import type { LocalizationType, LocalizationModuleConfig } from './types.ts';
+import type { LocalizationType, LocalizationModuleConfig } from './schemas.ts';
 export declare const getLocalizationsConfig: (context: Context, localizationType: LocalizationType) => LocalizationModuleConfig;