@unchainedshop/api 4.8.12 → 4.8.14

package/lib/adminUiTheme.d.ts

@@ -0,0 +1,25 @@
+export interface AdminUIThemeTokens {
+    surface?: string;
+    'surface-subtle'?: string;
+    'surface-raised'?: string;
+    'surface-input'?: string;
+    border?: string;
+    'border-subtle'?: string;
+    'text-primary'?: string;
+    'text-secondary'?: string;
+    'text-muted'?: string;
+    'text-on-dark'?: string;
+    accent?: string;
+    'accent-hover'?: string;
+    danger?: string;
+    'danger-surface'?: string;
+    success?: string;
+    warning?: string;
+    'focus-ring'?: string;
+    'text-on-accent'?: string;
+}
+export interface AdminUIThemeConfig {
+    light?: AdminUIThemeTokens;
+    dark?: AdminUIThemeTokens;
+}
+export declare const generateThemeCSS: (theme?: AdminUIThemeConfig) => string;

package/lib/adminUiTheme.js

@@ -0,0 +1,34 @@
+const CSS_VALUE_RE = /^[a-zA-Z0-9#().,/%\s\-_]+$/;
+const sanitizeCSSValue = (value) => {
+    const trimmed = value.trim();
+    if (!trimmed || !CSS_VALUE_RE.test(trimmed))
+        return null;
+    return trimmed;
+};
+const buildTokenBlock = (selector, tokens) => {
+    const vars = Object.entries(tokens)
+        .map(([key, value]) => {
+        const safe = sanitizeCSSValue(value);
+        return safe ? `  --token-${key}: ${safe};` : null;
+    })
+        .filter(Boolean);
+    if (vars.length === 0)
+        return null;
+    return `${selector} {\n${vars.join('\n')}\n}`;
+};
+export const generateThemeCSS = (theme) => {
+    if (!theme)
+        return '/* default theme */';
+    const blocks = [];
+    if (theme.light) {
+        const block = buildTokenBlock(':root:root', theme.light);
+        if (block)
+            blocks.push(block);
+    }
+    if (theme.dark) {
+        const block = buildTokenBlock('.dark.dark', theme.dark);
+        if (block)
+            blocks.push(block);
+    }
+    return blocks.length > 0 ? blocks.join('\n\n') : '/* default theme */';
+};

package/lib/express/createMCPMiddleware.js

@@ -17,15 +17,27 @@ catch {
 const transports = {};
 const handlePostRequest = async (req, res) => {
     const sessionId = req.headers['mcp-session-id'];
+    const currentUserId = req.unchainedContext.user._id;
     let transport;
     if (sessionId && transports[sessionId]) {
-        transport = transports[sessionId];
+        if (transports[sessionId].userId !== currentUserId) {
+            res.status(404).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: 'Bad Request: No valid session ID provided',
+                },
+                id: null,
+            });
+            return;
+        }
+        transport = transports[sessionId].transport;
     }
     else if (!sessionId && isInitializeRequest(req.body)) {
         transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => crypto.randomUUID(),
             onsessioninitialized: (sessionId) => {
-                transports[sessionId] = transport;
+                transports[sessionId] = { transport, userId: currentUserId };
             },
         });
         transport.onclose = () => {
@@ -56,15 +68,18 @@ const handlePostRequest = async (req, res) => {
 };
 const handleSessionRequest = async (req, res) => {
     const sessionId = req.headers['mcp-session-id'];
-    if (!sessionId || !transports[sessionId]) {
+    if (!sessionId ||
+        !transports[sessionId] ||
+        transports[sessionId].userId !== req.unchainedContext.user._id) {
         res.status(400).send('Invalid or missing session ID');
         return;
     }
-    const transport = transports[sessionId];
+    const transport = transports[sessionId].transport;
     await transport.handleRequest(req, res);
 };
 const createMCPMiddleware = (req, res, next) => {
-    if (!req.unchainedContext.user) {
+    const user = req.unchainedContext.user;
+    if (!user) {
         res.status(401);
         res.header('WWW-Authenticate', `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`);
         res.json({
@@ -73,6 +88,10 @@ const createMCPMiddleware = (req, res, next) => {
         });
         return;
     }
+    if (!(user.roles || []).includes('admin')) {
+        res.status(403).json({ error: 'forbidden', message: 'MCP requires admin privileges' });
+        return;
+    }
     if (req.method === 'POST') {
         return handlePostRequest(req, res, next);
     }

package/lib/fastify/mcpHandler.js

@@ -16,7 +16,8 @@ catch {
 }
 const transports = {};
 const mcpHandler = async (req, res) => {
-    if (!req.unchainedContext.user) {
+    const user = req.unchainedContext.user;
+    if (!user) {
         res.status(401);
         res.header('WWW-Authenticate', `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`);
         return res.send(JSON.stringify({
@@ -24,18 +25,33 @@ const mcpHandler = async (req, res) => {
             resource_metadata: `${process.env.ROOT_URL || 'http://localhost:4010'}/.well-known/oauth-protected-resource`,
         }));
     }
+    if (!(user.roles || []).includes('admin')) {
+        res.status(403);
+        return res.send(JSON.stringify({ error: 'forbidden', message: 'MCP requires admin privileges' }));
+    }
+    const currentUserId = user._id;
     try {
         if (req.method === 'POST') {
             const sessionId = req.headers['mcp-session-id'];
             let transport;
             if (sessionId && transports[sessionId]) {
-                transport = transports[sessionId];
+                if (transports[sessionId].userId !== currentUserId) {
+                    return res.status(404).send(JSON.stringify({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32000,
+                            message: 'Bad Request: No valid session ID provided',
+                        },
+                        id: null,
+                    }));
+                }
+                transport = transports[sessionId].transport;
             }
             else if (!sessionId && isInitializeRequest(req.body)) {
                 transport = new StreamableHTTPServerTransport({
                     sessionIdGenerator: () => crypto.randomUUID(),
                     onsessioninitialized: (sessionId) => {
-                        transports[sessionId] = transport;
+                        transports[sessionId] = { transport, userId: currentUserId };
                     },
                 });
                 transport.onclose = () => {
@@ -43,7 +59,7 @@ const mcpHandler = async (req, res) => {
                         delete transports[transport.sessionId];
                     }
                 };
-                const roles = req.unchainedContext.user.roles || [];
+                const roles = user.roles || [];
                 const { default: initMCPServer } = await import("../mcp/index.js");
                 const server = initMCPServer(new McpServer({
                     name: 'Unchained MCP Server',
@@ -66,10 +82,10 @@ const mcpHandler = async (req, res) => {
         }
         else if (req.method === 'GET' || req.method === 'DELETE') {
             const sessionId = req.headers['mcp-session-id'];
-            if (!sessionId || !transports[sessionId]) {
+            if (!sessionId || !transports[sessionId] || transports[sessionId].userId !== currentUserId) {
                 return res.status(400).send('Invalid or missing session ID');
             }
-            const transport = transports[sessionId];
+            const transport = transports[sessionId].transport;
             await transport.handleRequest(req.raw, res.raw);
             return res;
         }

package/lib/loaders/cartLoader.d.ts

@@ -0,0 +1,13 @@
+import type { UnchainedCore } from '@unchainedshop/core';
+import type { Order } from '@unchainedshop/core-orders';
+import DataLoader from 'dataloader';
+declare const _default: (unchainedAPI: UnchainedCore) => DataLoader<{
+    userId: string;
+    countryCode?: string;
+    orderNumber?: string;
+}, Order | null, {
+    userId: string;
+    countryCode?: string;
+    orderNumber?: string;
+}>;
+export default _default;

package/lib/loaders/cartLoader.js

@@ -0,0 +1,8 @@
+import DataLoader from 'dataloader';
+export default (unchainedAPI) => new DataLoader(async (queries) => {
+    const userIds = [...new Set(queries.map((q) => q.userId).filter(Boolean))];
+    const carts = await unchainedAPI.modules.orders.findCarts({ userIds });
+    return queries.map((q) => carts.find((cart) => cart.userId === q.userId &&
+        (!q.countryCode || cart.countryCode === q.countryCode) &&
+        (!q.orderNumber || cart.orderNumber === q.orderNumber)) || null);
+});

package/lib/loaders/index.d.ts

@@ -166,6 +166,15 @@ declare const loaders: (unchainedAPI: UnchainedCore) => {
     }, import("@unchainedshop/core-orders").Order, {
         orderId: string;
     }>;
+    cartLoader: import("dataloader")<{
+        userId: string;
+        countryCode?: string;
+        orderNumber?: string;
+    }, import("@unchainedshop/core-orders").Order | null, {
+        userId: string;
+        countryCode?: string;
+        orderNumber?: string;
+    }>;
     orderPaymentLoader: import("dataloader")<{
         orderPaymentId: string;
     }, import("@unchainedshop/core-orders").OrderPayment | null, {

package/lib/loaders/index.js

@@ -26,6 +26,7 @@ import deliveryProviderLoader from "./deliveryProviderLoader.js";
 import paymentProviderLoader from "./paymentProviderLoader.js";
 import warehousingProviderLoader from "./warehousingProviderLoader.js";
 import orderLoader from "./orderLoader.js";
+import cartLoader from "./cartLoader.js";
 import orderPaymentLoader from "./orderPaymentLoader.js";
 import orderDeliveryLoader from "./orderDeliveryLoader.js";
 import orderPositionsLoader from "./orderPositionsLoader.js";
@@ -63,6 +64,7 @@ const loaders = (unchainedAPI) => {
         paymentProviderLoader: paymentProviderLoader(unchainedAPI),
         warehousingProviderLoader: warehousingProviderLoader(unchainedAPI),
         orderLoader: orderLoader(unchainedAPI),
+        cartLoader: cartLoader(unchainedAPI),
         orderPaymentLoader: orderPaymentLoader(unchainedAPI),
         orderDeliveryLoader: orderDeliveryLoader(unchainedAPI),
         orderPositionsLoader: orderPositionsLoader(unchainedAPI),

package/lib/middleware/createAuthMiddleware.js

@@ -65,9 +65,8 @@ export async function createAuthContext(params, authConfig) {
     const fingerprintCookie = getCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME);
     const verifyToken = createAuthHandler(authConfig);
     const authResult = token ? await verifyToken(token) : {};
-    let fingerprintValid = true;
     if (authResult.fingerprintHash && fingerprintCookie) {
-        fingerprintValid = verifyFingerprint(fingerprintCookie, authResult.fingerprintHash);
+        const fingerprintValid = verifyFingerprint(fingerprintCookie, authResult.fingerprintHash);
         if (!fingerprintValid) {
             logger.warn('Token sidejacking detected: fingerprint mismatch', {
                 userId: authResult.userId,
@@ -81,7 +80,6 @@ export async function createAuthContext(params, authConfig) {
         logger.warn('Token sidejacking detected: fingerprint cookie missing', {
             userId: authResult.userId,
         });
-        fingerprintValid = false;
         authResult.userId = undefined;
         authResult.tokenVersion = undefined;
         authResult.impersonatorId = undefined;

package/lib/resolvers/mutations/index.js

@@ -231,7 +231,7 @@ export default {
     addCartProduct: acl(actions.updateCart)(addCartProduct),
     addMultipleCartProducts: acl(actions.updateCart)(addMultipleCartProducts),
     addCartDiscount: acl(actions.updateCart)(addCartDiscount),
-    addCartQuotation: acl(actions.updateCart)(addCartQuotation),
+    addCartQuotation: acl(actions.addCartQuotation)(addCartQuotation),
     updateCart: acl(actions.updateCart)(updateCart),
     emptyCart: acl(actions.updateCart)(emptyCart),
     checkoutCart: acl(actions.checkoutCart)(checkoutCart),
@@ -301,7 +301,7 @@ export default {
     verifyQuotation: acl(actions.manageQuotations)(verifyQuotation),
     makeQuotationProposal: acl(actions.manageQuotations)(makeQuotationProposal),
     bookmark: acl(actions.bookmarkProduct)(bookmark),
-    createBookmark: acl(actions.manageBookmarks)(createBookmark),
+    createBookmark: acl(actions.createBookmark)(createBookmark),
     removeBookmark: acl(actions.manageBookmarks)(removeBookmark),
     addWork: acl(actions.manageWorker)(addWork),
     allocateWork: acl(actions.manageWorker)(allocateWork),
@@ -309,6 +309,6 @@ export default {
     removeWork: acl(actions.manageWorker)(removeWork),
     processNextWork: acl(actions.manageWorker)(processNextWork),
     signPaymentProviderForCredentialRegistration: acl(actions.registerPaymentCredentials)(signPaymentProviderForCredentialRegistration),
-    signPaymentProviderForCheckout: acl(actions.registerPaymentCredentials)(signPaymentProviderForCheckout),
+    signPaymentProviderForCheckout: acl(actions.updateOrderPayment)(signPaymentProviderForCheckout),
     removeUserProductReviews: acl(actions.updateUser)(removeUserProductReviews),
 };

package/lib/resolvers/type/user-types.js

@@ -49,9 +49,9 @@ export const User = {
         return context.modules.bookmarks.findBookmarksByUserId(user._id);
     },
     async cart(user, params, context) {
-        const { modules, countryCode } = context;
+        const { loaders, countryCode } = context;
         await checkAction(context, viewUserOrders, [user, params]);
-        return modules.orders.cart({
+        return loaders.cartLoader.load({
             countryCode,
             orderNumber: params.orderNumber,
             userId: user._id,

package/lib/roles/index.js

@@ -66,6 +66,7 @@ const actions = [
     'createEnrollment',
     'updateEnrollment',
     'updateCart',
+    'addCartQuotation',
     'checkoutCart',
     'updateOrder',
     'updateOrderDelivery',
@@ -90,6 +91,7 @@ const actions = [
     'manageQuotations',
     'answerQuotation',
     'bookmarkProduct',
+    'createBookmark',
     'manageBookmarks',
     'search',
     'manageWorker',

package/lib/roles/loggedIn.js

@@ -116,6 +116,14 @@ export const loggedIn = (role, actions) => {
             return true;
         return bookmark.userId === userId;
     };
+    const isOwnBookmarkUser = (obj, { userId: bookmarkUserId }, { userId }) => {
+        return !bookmarkUserId || bookmarkUserId === userId;
+    };
+    const isOwnedCartAndQuotation = async (obj, params, context) => {
+        if (!(await isOwnedOrderOrCart(obj, params, context)))
+            return false;
+        return isOwnedQuotation(obj, params, context);
+    };
     const isOwnedPaymentCredential = async (obj, { paymentCredentialsId }, { modules, userId }) => {
         const credentials = await modules.payment.paymentCredentials.findPaymentCredential({
             paymentCredentialsId,
@@ -155,6 +163,7 @@ export const loggedIn = (role, actions) => {
     role.allow(actions.updateOrderPayment, isOwnedOrderPayment);
     role.allow(actions.checkoutCart, isOwnedOrderOrCart);
     role.allow(actions.updateCart, isOwnedOrderOrCart);
+    role.allow(actions.addCartQuotation, isOwnedCartAndQuotation);
     role.allow(actions.createCart, () => true);
     role.allow(actions.viewEnrollment, isOwnedEnrollment);
     role.allow(actions.updateEnrollment, isOwnedEnrollment);
@@ -164,6 +173,7 @@ export const loggedIn = (role, actions) => {
     role.allow(actions.requestQuotation, () => true);
     role.allow(actions.answerQuotation, isOwnedQuotation);
     role.allow(actions.manageBookmarks, isOwnedBookmark);
+    role.allow(actions.createBookmark, isOwnBookmarkUser);
     role.allow(actions.bookmarkProduct, () => true);
     role.allow(actions.voteProductReview, () => true);
     role.allow(actions.changePassword, () => true);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "4.8.12",
+  "version": "4.8.14",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -116,11 +116,11 @@
     }
   },
   "dependencies": {
-    "@unchainedshop/core": "^4.6.0",
-    "@unchainedshop/events": "^4.6.0",
-    "@unchainedshop/logger": "^4.6.0",
-    "@unchainedshop/roles": "^4.6.0",
-    "@unchainedshop/utils": "^4.6.0",
+    "@unchainedshop/core": "^4.8.12",
+    "@unchainedshop/events": "^4.8.12",
+    "@unchainedshop/logger": "^4.8.12",
+    "@unchainedshop/roles": "^4.8.12",
+    "@unchainedshop/utils": "^4.8.12",
     "dataloader": "^2.2.3",
     "expiry-map": "^2.0.0",
     "graphql-scalars": "^1.24.2",