@unchainedshop/api 4.7.2 → 4.8.1

package/lib/acl.js

@@ -1,17 +1,5 @@
 import { Roles } from '@unchainedshop/roles';
-import { emit } from '@unchainedshop/events';
 import { NoPermissionError, PermissionSystemError } from "./errors.js";
-import { API_EVENTS } from "./events.js";
-const SENSITIVE_ACTION_PREFIXES = [
-    'manageUser',
-    'login',
-    'logout',
-    'reset',
-    'forgot',
-    'impersonate',
-    'updateUser',
-    'createUser',
-];
 const defaultOptions = {
     showKey: true,
     mapArgs: (...args) => args,
@@ -31,27 +19,11 @@ export const ensureIsFunction = (fn, action, options, key) => {
         });
     }
 };
-const isSensitiveAction = (action) => {
-    return SENSITIVE_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix));
-};
 const checkAction = async (context, action, args = emptyArray, options = emptyObject) => {
     const { key } = options || emptyObject;
     const hasPermission = await Roles.userHasPermission(context, action, args);
-    if (hasPermission) {
-        if (isSensitiveAction(action)) {
-            await emit(API_EVENTS.ACL_GRANTED_SENSITIVE, {
-                userId: context.userId,
-                action,
-                key,
-            });
-        }
+    if (hasPermission)
         return;
-    }
-    await emit(API_EVENTS.ACL_DENIED, {
-        userId: context.userId,
-        action,
-        key,
-    });
     const keyText = key && key !== '' ? ` in "${key}"` : '';
     throw new NoPermissionError({
         userId: context.userId,

package/lib/api-index.d.ts

@@ -8,7 +8,6 @@ export * from './loaders/index.ts';
 export * from './errors.ts';
 export * as acl from './acl.ts';
 export * as roles from './roles/index.ts';
-export type { OIDCProviderConfig, AuthConfig } from './auth.ts';
 export { createContextResolver, getCurrentContextResolver, setCurrentContextResolver };
 export type UnchainedServerOptions = {
     roles?: any;

package/lib/chat/generateImageHandler.js

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v4-mini';
 import mime from 'mime/lite';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
@@ -12,9 +12,9 @@ try {
 catch {
 }
 const inputSchema = z.object({
-    prompt: z.string().describe('The prompt to generate the image from'),
+    prompt: z.string().check(z.describe('The prompt to generate the image from')),
     size: z
-        .enum([
+        .optional(z.enum([
         '512x512',
         '768x768',
         '1024x1024',
@@ -26,9 +26,8 @@ const inputSchema = z.object({
         '1120x640',
         '1344x768',
         '1792x1024',
-    ])
-        .optional()
-        .describe('The size of the image (default is 1024x1024).'),
+    ]))
+        .check(z.describe('The size of the image (default is 1024x1024).')),
 });
 const generateImageHandler = (req) => ({ model, uploadUrl = `${process.env.ROOT_URL}/temp-upload`, }) => {
     return tool({

package/lib/context.d.ts

@@ -16,7 +16,6 @@ export interface UnchainedUserContext {
     userId?: string;
     impersonatorId?: string;
     accessToken?: string;
-    tokenVersion?: number;
     user?: User;
 }
 export interface CustomAdminUiProperties {

package/lib/context.js

@@ -6,7 +6,7 @@ export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {
     context = newContext;
 };
-export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, tokenVersion, login, logout, }) => {
+export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, login, logout, }) => {
     const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader };
     const loaders = instantiateLoaders(unchainedAPI);
     const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
@@ -21,13 +21,8 @@ export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({
     if (userId && !userContext.userId) {
         const user = await unchainedAPI.modules.users.findUserById(userId);
         if (user) {
-            const userTokenVersion = user.tokenVersion ?? 1;
-            if (tokenVersion !== undefined && tokenVersion !== userTokenVersion) {
-            }
-            else {
-                userContext.user = user;
-                userContext.userId = user._id;
-            }
+            userContext.user = user;
+            userContext.userId = user._id;
         }
     }
     return {

package/lib/events.d.ts

@@ -1,7 +1,5 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
     readonly API_LOGOUT: "API_LOGOUT";
-    readonly ACL_DENIED: "ACL_DENIED";
-    readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";
 };
 export type API_EVENTS = (typeof API_EVENTS)[keyof typeof API_EVENTS];

package/lib/events.js

@@ -1,6 +1,4 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
     API_LOGOUT: 'API_LOGOUT',
-    ACL_DENIED: 'ACL_DENIED',
-    ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',
 };

package/lib/express/createMCPMiddleware.js

@@ -1,4 +1,3 @@
-import initMCPServer from "../mcp/index.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
 let StreamableHTTPServerTransport;
@@ -35,6 +34,7 @@ const handlePostRequest = async (req, res) => {
             }
         };
         const roles = req.unchainedContext.user?.roles || [];
+        const { default: initMCPServer } = await import("../mcp/index.js");
         const server = initMCPServer(new McpServer({
             name: 'Unchained MCP Server',
             version: '1.0.0',

package/lib/express/index.d.ts

@@ -1,7 +1,7 @@
 import e from 'express';
 import type { YogaServerInstance } from 'graphql-yoga';
+import { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
-import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
 export interface AdminUIRouterOptions {
@@ -9,14 +9,17 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const adminUIRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
-export declare const connect: (expressApp: e.Express, { graphqlHandler, unchainedAPI, }: {
+export declare const connect: (expressApp: e.Express, { graphqlHandler, db, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
+    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    authConfig?: AuthConfig;
-    trustProxy?: boolean;
-}) => Promise<void>;
+    initPluginMiddlewares?: (app: e.Express, { unchainedAPI }: {
+        unchainedAPI: UnchainedCore;
+    }) => void;
+}) => void;
+export declare const expressRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
 export { connectChat };

package/lib/express/index.js

@@ -1,12 +1,17 @@
 import e from 'express';
-import cookieParser from 'cookie-parser';
-import { pluginRegistry } from '@unchainedshop/core';
+import session from 'express-session';
+import multer from 'multer';
+import MongoStore from "../mongo-store.js";
+import { Passport } from 'passport';
+import { mongodb } from '@unchainedshop/mongodb';
+import { emit } from '@unchainedshop/events';
 import { getCurrentContextResolver } from "../context.js";
-import { createAuthContext } from "../middleware/createAuthMiddleware.js";
+import createBulkImportMiddleware from "./createBulkImportMiddleware.js";
+import createERCMetadataMiddleware from "./createERCMetadataMiddleware.js";
+import createTempUploadMiddleware from "./createTempUploadMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
+import { API_EVENTS } from "../events.js";
 import { connectChat } from "./chatHandler.js";
-import { mountRoutes } from "./mountRoutes.js";
-import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
 export const adminUIRouter = (enabled = true) => {
     const router = e.Router();
     const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -19,53 +24,87 @@ export const adminUIRouter = (enabled = true) => {
     }
     return router;
 };
-const resolveUserRemoteAddress = (req, trustProxy = false) => {
-    let remoteAddress;
-    if (trustProxy) {
-        const forwardedFor = req.headers['x-forwarded-for'];
-        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
-        remoteAddress =
-            req.headers['x-real-ip'] ||
-                forwardedIps?.[forwardedIps.length - 1] ||
-                req.socket?.remoteAddress;
-    }
-    else {
-        remoteAddress = req.socket?.remoteAddress;
-    }
+const resolveUserRemoteAddress = (req) => {
+    const remoteAddress = req.headers['x-real-ip'] ||
+        req.headers['x-forwarded-for'] ||
+        req.socket?.remoteAddress;
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const { MCP_API_PATH = '/mcp' } = process.env;
-const createAddContextMiddleware = (authConfig, trustProxy = false) => async function middlewareWithContext(req, res, next) {
+const storage = multer.memoryStorage();
+const upload = multer({ storage: storage });
+const { BULK_IMPORT_API_PATH = '/bulk-import', ERC_METADATA_API_PATH = '/erc-metadata', TEMP_UPLOAD_API_PATH = '/temp-upload', MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
+const addContext = async function middlewareWithContext(req, res, next) {
     try {
         const setHeader = (key, value) => res.setHeader(key, value);
         const getHeader = (key) => req.headers[key];
-        const getCookie = (name) => req.cookies?.[name];
-        const setCookie = (name, value, options) => res.cookie(name, value, options);
-        const clearCookie = (name, options) => res.clearCookie(name, { ...options, maxAge: 0 });
-        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
-        const authContextParams = {
-            setHeader,
-            getHeader,
-            getCookie,
-            setCookie,
-            clearCookie,
-            remoteAddress,
-            remotePort,
-        };
-        const authContext = await createAuthContext(authContextParams, authConfig);
+        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
         const context = getCurrentContextResolver();
+        const login = async (user, options = {}) => {
+            const { impersonator } = options;
+            await new Promise((resolve, reject) => {
+                req.login(user, (error, result) => {
+                    if (error) {
+                        return reject(error);
+                    }
+                    req.session.impersonatorId = impersonator?._id;
+                    return resolve(result);
+                });
+            });
+            const tokenObject = {
+                _id: req.sessionID,
+                userId: user._id,
+                tokenExpires: new Date(req.session?.cookie._expires),
+            };
+            await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
+            user._inLoginMethodResponse = true;
+            return { user, ...tokenObject };
+        };
+        const logout = async (sessionId) => {
+            const { user } = req;
+            if (!user)
+                return false;
+            const currentSessionId = req.sessionID;
+            const targetSessionId = sessionId || currentSessionId;
+            const tokenObject = {
+                _id: targetSessionId,
+                userId: user._id,
+            };
+            if (sessionId && sessionId !== currentSessionId) {
+                await new Promise((resolve, reject) => {
+                    req.sessionStore.destroy(sessionId, (error) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        return resolve();
+                    });
+                });
+            }
+            else {
+                await new Promise((resolve, reject) => {
+                    req.logout((error, result) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        req.session.impersonatorId = null;
+                        return resolve(result);
+                    });
+                });
+            }
+            await emit(API_EVENTS.API_LOGOUT, tokenObject);
+            return true;
+        };
+        const [, accessToken] = req.headers.authorization?.split(' ') || [];
         req.unchainedContext = await context({
             setHeader,
             getHeader,
             remoteAddress,
             remotePort,
-            login: authContext.login,
-            logout: authContext.logout,
-            accessToken: authContext.accessToken,
-            userId: authContext.userId,
-            impersonatorId: authContext.impersonatorId,
-            tokenVersion: authContext.tokenVersion,
+            login,
+            logout,
+            accessToken,
+            userId: req.user?._id,
+            impersonatorId: req.session.impersonatorId,
         }, req, res);
         next();
     }
@@ -73,12 +112,8 @@ const createAddContextMiddleware = (authConfig, trustProxy = false) => async fun
         next(error);
     }
 };
-export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
+export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
-        if (process.env.NODE_ENV === 'production') {
-            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
-                'Configure a proper CORS policy with specific allowed origins instead.');
-        }
         expressApp.set('trust proxy', 1);
         expressApp.use((req, res, next) => {
             req.headers['x-forwarded-proto'] = 'https';
@@ -90,21 +125,59 @@ export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { a
             next();
         });
     }
-    expressApp.use(cookieParser());
-    expressApp.use(createAddContextMiddleware(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
-    expressApp.use(graphqlHandler.graphqlEndpoint, graphqlHandler.handle);
+    const passport = new Passport();
+    passport.serializeUser(function serialize(user, done) {
+        done(null, user._id);
+    });
+    passport.deserializeUser(function deserialize(_id, done) {
+        done(null, { _id });
+    });
+    const name = UNCHAINED_COOKIE_NAME;
+    const domain = UNCHAINED_COOKIE_DOMAIN;
+    const path = UNCHAINED_COOKIE_PATH;
+    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
+    const sameSite = ({
+        none: 'none',
+        lax: 'lax',
+        strict: 'strict',
+        '1': true,
+        '0': false,
+    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
+    expressApp.use(session({
+        secret: process.env.UNCHAINED_TOKEN_SECRET,
+        store: MongoStore.create({
+            client: db.client,
+            dbName: db.databaseName,
+            collectionName: 'sessions',
+            touchAfter: 24 * 3600,
+        }),
+        name,
+        saveUninitialized: false,
+        resave: false,
+        cookie: {
+            domain,
+            path,
+            sameSite,
+            secure,
+            httpOnly: true,
+            maxAge: 1000 * 60 * 60 * 24 * 7,
+        },
+    }), passport.initialize(), passport.session(), addContext);
+    expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
+    expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
+    expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
+    expressApp.use(TEMP_UPLOAD_API_PATH, upload.any(), createTempUploadMiddleware);
     expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
     expressApp.use(MCP_API_PATH, createMCPMiddleware);
     if (chat) {
         connectChat(expressApp, chat);
     }
-    const routes = pluginRegistry.getRoutes();
-    if (authConfig?.oidcProviders?.length) {
-        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
+    if (initPluginMiddlewares) {
+        initPluginMiddlewares(expressApp, { unchainedAPI });
     }
-    mountRoutes(expressApp, unchainedAPI, routes);
     if (adminUI) {
         expressApp.use(typeof adminUI === 'object' ? adminUI.prefix : '/', adminUIRouter(true));
     }
 };
+export const expressRouter = adminUIRouter;
 export { connectChat };

package/lib/fastify/index.d.ts

@@ -1,5 +1,5 @@
-import type { AuthConfig } from '../auth.ts';
 import type { YogaServerInstance } from 'graphql-yoga';
+import type { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
@@ -9,15 +9,18 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
-export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {
+export declare const connect: (fastify: FastifyInstance, { graphqlHandler, db, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
+    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    authConfig?: AuthConfig;
-    trustProxy?: boolean;
-}) => Promise<void>;
+    initPluginMiddlewares?: (app: FastifyInstance, { unchainedAPI }: {
+        unchainedAPI: UnchainedCore;
+    }) => void;
+}) => void;
 export declare const adminUIRouter: FastifyPluginAsync<AdminUIRouterOptions>;
+export declare const fastifyRouter: FastifyPluginAsync<AdminUIRouterOptions>;
 export { connectChat };

package/lib/fastify/index.js

@@ -1,59 +1,64 @@
 import { getCurrentContextResolver } from "../context.js";
-import { createAuthContext } from "../middleware/createAuthMiddleware.js";
-import { pluginRegistry } from '@unchainedshop/core';
+import bulkImportHandler from "./bulkImportHandler.js";
+import ercMetadataHandler from "./ercMetadataHandler.js";
+import MongoStore from "../mongo-store.js";
+import { emit } from '@unchainedshop/events';
+import { API_EVENTS } from "../events.js";
+import fastifySession from '@fastify/session';
 import fastifyCookie from '@fastify/cookie';
+import fastifyMultipart from '@fastify/multipart';
 import { createLogger } from '@unchainedshop/logger';
 import mcpHandler from "./mcpHandler.js";
+import tempUploadHandler from "./tempUploadHandler.js";
 import { connectChat } from "./chatHandler.js";
-import { mountRoutes } from "./mountRoutes.js";
 import { readFileSync } from 'node:fs';
-import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-const resolveUserRemoteAddress = (req, trustProxy = false) => {
-    let remoteAddress;
-    if (trustProxy) {
-        const forwardedFor = req.headers['x-forwarded-for'];
-        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
-        remoteAddress =
-            req.headers['x-real-ip'] ||
-                forwardedIps?.[forwardedIps.length - 1] ||
-                req.socket?.remoteAddress;
-    }
-    else {
-        remoteAddress = req.socket?.remoteAddress;
-    }
+const resolveUserRemoteAddress = (req) => {
+    const remoteAddress = req.headers['x-real-ip'] ||
+        req.headers['x-forwarded-for'] ||
+        req.socket?.remoteAddress;
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const { MCP_API_PATH = '/mcp' } = process.env;
-const createMiddlewareHook = (authConfig, trustProxy = false) => async function middlewareHook(req, reply) {
+const { MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', BULK_IMPORT_API_PATH = '/bulk-import', TEMP_UPLOAD_API_PATH = '/temp-upload', ERC_METADATA_API_PATH = '/erc-metadata/:productId/:localeOrTokenFilename/:tokenFileName?', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
+const middlewareHook = async function middlewareHook(req, reply) {
     const setHeader = (key, value) => reply.header(key, value);
     const getHeader = (key) => req.headers[key];
-    const getCookie = (name) => req.cookies?.[name];
-    const setCookie = (name, value, options) => reply.setCookie(name, value, options);
-    const clearCookie = (name, options) => reply.clearCookie(name, { ...options, maxAge: 0 });
-    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
-    const authContextParams = {
-        setHeader,
-        getHeader,
-        getCookie,
-        setCookie,
-        clearCookie,
-        remoteAddress,
-        remotePort,
-    };
-    const authContext = await createAuthContext(authContextParams, authConfig);
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
     const context = getCurrentContextResolver();
+    const login = async function (user, options = {}) {
+        const { impersonator } = options;
+        req.session.userId = user._id;
+        req.session.impersonatorId = impersonator?._id;
+        const tokenObject = {
+            _id: req.session.sessionId,
+            userId: user._id,
+            tokenExpires: new Date(req.session.cookie._expires),
+        };
+        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
+        user._inLoginMethodResponse = true;
+        return { user, ...tokenObject };
+    };
+    const logout = async function logout() {
+        const tokenObject = {
+            _id: req.session.sessionId,
+            userId: req.session?.userId,
+        };
+        req.session.userId = null;
+        req.session.impersonatorId = null;
+        await emit(API_EVENTS.API_LOGOUT, tokenObject);
+        return true;
+    };
+    const [, accessToken] = req.headers.authorization?.split(' ') || [];
     req.unchainedContext = await context({
         setHeader,
         getHeader,
         remoteAddress,
         remotePort,
-        login: authContext.login,
-        logout: authContext.logout,
-        accessToken: authContext.accessToken,
-        userId: authContext.userId,
-        impersonatorId: authContext.impersonatorId,
-        tokenVersion: authContext.tokenVersion,
+        login,
+        logout,
+        accessToken,
+        userId: req.session.userId,
+        impersonatorId: req.session.impersonatorId,
     }, req, reply);
 };
 export const unchainedLogger = (prefix) => {
@@ -72,12 +77,8 @@ export const unchainedLogger = (prefix) => {
     };
     return new Logger();
 };
-export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
+export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
-        if (process.env.NODE_ENV === 'production') {
-            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
-                'Configure a proper CORS policy with specific allowed origins instead.');
-        }
         fastify.addHook('preHandler', async function (request) {
             request.headers['x-forwarded-proto'] = 'https';
         });
@@ -91,34 +92,94 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
             });
         });
     }
+    const cookieName = UNCHAINED_COOKIE_NAME;
+    const domain = UNCHAINED_COOKIE_DOMAIN;
+    const path = UNCHAINED_COOKIE_PATH;
+    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
+    const sameSite = ({
+        none: 'none',
+        lax: 'lax',
+        strict: 'strict',
+        '1': true,
+        '0': false,
+    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
     if (!fastify.hasPlugin('@fastify/cookie')) {
         fastify.register(fastifyCookie);
     }
+    fastify.register(fastifySession, {
+        secret: process.env.UNCHAINED_TOKEN_SECRET,
+        cookieName,
+        store: MongoStore.create({
+            client: db.client,
+            dbName: db.databaseName,
+            collectionName: 'sessions',
+        }),
+        cookie: {
+            domain,
+            httpOnly: true,
+            path,
+            secure,
+            sameSite,
+            maxAge: 1000 * 60 * 60 * 24 * 7,
+        },
+    });
     fastify.decorateRequest('unchainedContext');
-    fastify.addHook('onRequest', createMiddlewareHook(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
+    fastify.addHook('onRequest', middlewareHook);
     fastify.route({
-        url: graphqlHandler.graphqlEndpoint,
+        url: GRAPHQL_API_PATH,
         method: ['GET', 'POST', 'OPTIONS'],
         handler: async (req, reply) => {
-            return graphqlHandler.handleNodeRequestAndResponse(req, reply, {
+            const response = await graphqlHandler.handleNodeRequestAndResponse(req, reply, {
                 req,
                 reply,
             });
+            response.headers.forEach((value, key) => {
+                reply.header(key, value);
+            });
+            reply.status(response.status);
+            reply.send(response.body);
+            return reply;
         },
     });
+    fastify.route({
+        url: ERC_METADATA_API_PATH,
+        method: ['GET'],
+        handler: ercMetadataHandler,
+    });
     fastify.route({
         url: MCP_API_PATH,
         method: ['GET', 'POST', 'DELETE'],
         handler: mcpHandler,
     });
+    fastify.register((s, opts, registered) => {
+        s.register(fastifyMultipart, { throwFileSizeLimit: true, limits: { fileSize: 1024 * 1024 * 35 } });
+        s.route({
+            url: TEMP_UPLOAD_API_PATH,
+            method: ['POST'],
+            bodyLimit: 1024 * 1024 * 35,
+            handler: tempUploadHandler,
+        });
+        registered();
+    });
+    fastify.register((s, opts, registered) => {
+        s.removeAllContentTypeParsers();
+        s.addContentTypeParser('*', function (req, payload, done) {
+            done(null);
+        });
+        s.route({
+            url: BULK_IMPORT_API_PATH,
+            method: ['POST'],
+            bodyLimit: 1024 * 1024 * 1024 * 5,
+            handler: bulkImportHandler,
+        });
+        registered();
+    });
     if (chat) {
         connectChat(fastify, chat);
     }
-    const routes = pluginRegistry.getRoutes();
-    if (authConfig?.oidcProviders?.length) {
-        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
+    if (initPluginMiddlewares) {
+        initPluginMiddlewares(fastify, { unchainedAPI });
     }
-    mountRoutes(fastify, unchainedAPI, routes);
     if (adminUI) {
         fastify.register(adminUIRouter, {
             enabled: true,
@@ -182,4 +243,5 @@ export const adminUIRouter = async (fastify, opts) => {
         }
     }
 };
+export const fastifyRouter = adminUIRouter;
 export { connectChat };