@unchainedshop/api 4.8.23 → 4.8.24

package/lib/adminUiPlugins.d.ts

@@ -1,3 +1,27 @@
+export interface AdminUIThemeTokens {
+    surface?: string;
+    'surface-subtle'?: string;
+    'surface-raised'?: string;
+    'surface-input'?: string;
+    border?: string;
+    'border-subtle'?: string;
+    'text-primary'?: string;
+    'text-secondary'?: string;
+    'text-muted'?: string;
+    'text-on-dark'?: string;
+    accent?: string;
+    'accent-hover'?: string;
+    danger?: string;
+    'danger-surface'?: string;
+    success?: string;
+    warning?: string;
+    'focus-ring'?: string;
+    'text-on-accent'?: string;
+}
+export interface AdminUIThemeConfig {
+    light?: AdminUIThemeTokens;
+    dark?: AdminUIThemeTokens;
+}
 export interface AdminUIPluginEntityConfig {
     path: string;
     label: string;

package/lib/auth.d.ts

@@ -2,7 +2,6 @@ export interface AccessTokenPayload {
     iss: string;
     sub: string;
     ver: number;
-    fgp?: string;
     imp?: string;
     jti?: string;
     iat?: number;
@@ -16,14 +15,8 @@ export interface OIDCProviderConfig {
 export interface AuthConfig {
     oidcProviders?: OIDCProviderConfig[];
 }
-export declare function generateFingerprint(): {
-    raw: string;
-    hash: string;
-};
-export declare function verifyFingerprint(raw: string, hash: string): boolean;
 export declare function signAccessToken(userId: string, tokenVersion: number, options?: {
     impersonatorId?: string;
-    fingerprintHash?: string;
 }): Promise<{
     token: string;
     expires: Date;
@@ -37,7 +30,6 @@ export interface AuthHandlerResult {
     userId?: string;
     tokenVersion?: number;
     impersonatorId?: string;
-    fingerprintHash?: string;
     accessToken?: string;
     isApiKey?: boolean;
 }

package/lib/auth.js

@@ -1,6 +1,5 @@
 import { createLogger } from '@unchainedshop/logger';
 import * as jose from 'jose';
-import { createHash } from 'crypto';
 const logger = createLogger('unchained:api:auth');
 const { UNCHAINED_TOKEN_SECRET, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', UNCHAINED_TOKEN_ISSUER = 'unchained-engine', } = process.env;
 const MIN_SECRET_LENGTH = 32;
@@ -11,21 +10,6 @@ function validateSecretStrength(secret) {
             `Current length: ${secret.length}. Generate a secure secret with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
     }
 }
-export function generateFingerprint() {
-    const raw = crypto.randomUUID() + crypto.randomUUID();
-    const hash = createHash('sha256').update(raw).digest('hex');
-    return { raw, hash };
-}
-export function verifyFingerprint(raw, hash) {
-    const computedHash = createHash('sha256').update(raw).digest('hex');
-    if (computedHash.length !== hash.length)
-        return false;
-    let result = 0;
-    for (let i = 0; i < computedHash.length; i++) {
-        result |= computedHash.charCodeAt(i) ^ hash.charCodeAt(i);
-    }
-    return result === 0;
-}
 export async function signAccessToken(userId, tokenVersion, options) {
     if (!UNCHAINED_TOKEN_SECRET) {
         throw new Error('UNCHAINED_TOKEN_SECRET environment variable is required');
@@ -38,9 +22,6 @@ export async function signAccessToken(userId, tokenVersion, options) {
         ver: tokenVersion,
         jti: crypto.randomUUID(),
     };
-    if (options?.fingerprintHash) {
-        payload.fgp = options.fingerprintHash;
-    }
     if (options?.impersonatorId) {
         payload.imp = options.impersonatorId;
     }
@@ -168,7 +149,6 @@ export function createAuthHandler(config) {
                 userId: localPayload.sub,
                 tokenVersion: localPayload.ver,
                 impersonatorId: localPayload.imp,
-                fingerprintHash: localPayload.fgp,
             };
         }
         if (config?.oidcProviders?.length) {

package/lib/loaders/assortmentLinksLoader.js

@@ -1,38 +1,40 @@
 import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
-    const parentAssortmentIds = queries.flatMap((q) => q.parentAssortmentId).filter(Boolean);
-    const childAssortmentIds = queries.flatMap((q) => q.childAssortmentId).filter(Boolean);
-    const assortmentIds = queries.flatMap((q) => q.assortmentId).filter(Boolean);
+    const parentAssortmentIds = [
+        ...new Set(queries.flatMap((q) => q.parentAssortmentId).filter(Boolean)),
+    ];
+    const childAssortmentIds = [
+        ...new Set(queries.flatMap((q) => q.childAssortmentId).filter(Boolean)),
+    ];
+    const assortmentIds = [
+        ...new Set(queries.flatMap((q) => q.assortmentId).filter(Boolean)),
+    ];
     const allLinks = await unchainedAPI.modules.assortments.links.findLinks({
-        assortmentIds: [...new Set([...parentAssortmentIds, ...childAssortmentIds, ...assortmentIds])],
+        ...(parentAssortmentIds.length ? { parentAssortmentIds } : {}),
+        ...(childAssortmentIds.length ? { childAssortmentIds } : {}),
+        ...(assortmentIds.length ? { assortmentIds } : {}),
     });
-    const parentAssortmentLinkMap = {};
-    const childAssortmentLinkMap = {};
+    const parentAssortmentLinkMap = new Map();
+    const childAssortmentLinkMap = new Map();
     for (const link of allLinks) {
-        if (!parentAssortmentLinkMap[link.parentAssortmentId]) {
-            parentAssortmentLinkMap[link.parentAssortmentId] = [link];
-        }
-        else {
-            parentAssortmentLinkMap[link.parentAssortmentId].push(link);
-        }
-        if (!childAssortmentLinkMap[link.childAssortmentId]) {
-            childAssortmentLinkMap[link.childAssortmentId] = [link];
-        }
-        else {
-            childAssortmentLinkMap[link.childAssortmentId].push(link);
-        }
+        const parentLinks = parentAssortmentLinkMap.get(link.parentAssortmentId) || [];
+        parentLinks.push(link);
+        parentAssortmentLinkMap.set(link.parentAssortmentId, parentLinks);
+        const childLinks = childAssortmentLinkMap.get(link.childAssortmentId) || [];
+        childLinks.push(link);
+        childAssortmentLinkMap.set(link.childAssortmentId, childLinks);
     }
     return queries.map((q) => {
         if (q.parentAssortmentId) {
-            return parentAssortmentLinkMap[q.parentAssortmentId] || [];
+            return parentAssortmentLinkMap.get(q.parentAssortmentId) || [];
         }
         else if (q.childAssortmentId) {
-            return childAssortmentLinkMap[q.childAssortmentId] || [];
+            return childAssortmentLinkMap.get(q.childAssortmentId) || [];
         }
         if (q.assortmentId) {
             return [
-                ...(parentAssortmentLinkMap[q.assortmentId] || []),
-                ...(childAssortmentLinkMap[q.assortmentId] || []),
+                ...(parentAssortmentLinkMap.get(q.assortmentId) || []),
+                ...(childAssortmentLinkMap.get(q.assortmentId) || []),
             ];
         }
         return [];

package/lib/loaders/assortmentProductLoader.js

@@ -1,13 +1,16 @@
 import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
+    const productIds = [...new Set(queries.map((q) => q.productId).filter(Boolean))];
     const assortmentProducts = await unchainedAPI.modules.assortments.products.findAssortmentProducts({
         assortmentIds,
+        productIds,
     });
-    const assortmentProductMap = {};
+    const assortmentProductMap = new Map();
     for (const assortmentProduct of assortmentProducts) {
-        assortmentProductMap[assortmentProduct.assortmentId + assortmentProduct.productId] =
-            assortmentProduct;
+        const productsById = assortmentProductMap.get(assortmentProduct.assortmentId) || new Map();
+        productsById.set(assortmentProduct.productId, assortmentProduct);
+        assortmentProductMap.set(assortmentProduct.assortmentId, productsById);
     }
-    return queries.map((q) => assortmentProductMap[q.assortmentId + q.productId]);
+    return queries.map((q) => assortmentProductMap.get(q.assortmentId)?.get(q.productId));
 });

package/lib/middleware/createAuthMiddleware.js

@@ -1,9 +1,9 @@
 import { emit } from '@unchainedshop/events';
-import { signAccessToken, createAuthHandler, generateFingerprint, verifyFingerprint, } from "../auth.js";
+import { signAccessToken, createAuthHandler } from "../auth.js";
 import { API_EVENTS } from "../events.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:auth-middleware');
-const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_FINGERPRINT_COOKIE_NAME = '__Secure-fgp', UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
+const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
 function getTokenCookieOptions(expires) {
     const secure = !UNCHAINED_COOKIE_INSECURE;
     const sameSite = {
@@ -30,19 +30,6 @@ function getTokenCookieOptions(expires) {
         expires,
     };
 }
-function getFingerprintCookieOptions(expires) {
-    const secure = !UNCHAINED_COOKIE_INSECURE;
-    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
-    return {
-        domain: UNCHAINED_COOKIE_DOMAIN,
-        path: UNCHAINED_COOKIE_PATH,
-        secure,
-        httpOnly: true,
-        sameSite: 'strict',
-        maxAge: expires ? undefined : expirySeconds * 1000,
-        expires,
-    };
-}
 function extractBearerToken(authHeader) {
     if (!authHeader)
         return undefined;
@@ -62,38 +49,15 @@ export async function createAuthContext(params, authConfig) {
     const headerToken = extractBearerToken(authHeader);
     const cookieToken = getCookie(UNCHAINED_COOKIE_NAME);
     const token = headerToken || cookieToken;
-    const fingerprintCookie = getCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME);
     const verifyToken = createAuthHandler(authConfig);
     const authResult = token ? await verifyToken(token) : {};
-    if (authResult.fingerprintHash && fingerprintCookie) {
-        const fingerprintValid = verifyFingerprint(fingerprintCookie, authResult.fingerprintHash);
-        if (!fingerprintValid) {
-            logger.warn('Token sidejacking detected: fingerprint mismatch', {
-                userId: authResult.userId,
-            });
-            authResult.userId = undefined;
-            authResult.tokenVersion = undefined;
-            authResult.impersonatorId = undefined;
-        }
-    }
-    else if (authResult.fingerprintHash && !fingerprintCookie) {
-        logger.warn('Token sidejacking detected: fingerprint cookie missing', {
-            userId: authResult.userId,
-        });
-        authResult.userId = undefined;
-        authResult.tokenVersion = undefined;
-        authResult.impersonatorId = undefined;
-    }
     const login = async (user, options = {}) => {
         const { impersonator } = options;
         const tokenVersion = user.tokenVersion ?? 1;
-        const { raw: fingerprintRaw, hash: fingerprintHash } = generateFingerprint();
         const { token: newToken, expires } = await signAccessToken(user._id, tokenVersion, {
             impersonatorId: impersonator?._id,
-            fingerprintHash,
         });
         setCookie(UNCHAINED_COOKIE_NAME, newToken, getTokenCookieOptions(expires));
-        setCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, fingerprintRaw, getFingerprintCookieOptions(expires));
         const tokenObject = {
             _id: crypto.randomUUID(),
             userId: user._id,
@@ -105,7 +69,6 @@ export async function createAuthContext(params, authConfig) {
     };
     const logout = async () => {
         clearCookie(UNCHAINED_COOKIE_NAME, getTokenCookieOptions());
-        clearCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, getFingerprintCookieOptions());
         if (authResult.userId) {
             const tokenObject = {
                 _id: crypto.randomUUID(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "4.8.23",
+  "version": "4.8.24",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",

package/lib/adminUiTheme.d.ts

@@ -1,25 +0,0 @@
-export interface AdminUIThemeTokens {
-    surface?: string;
-    'surface-subtle'?: string;
-    'surface-raised'?: string;
-    'surface-input'?: string;
-    border?: string;
-    'border-subtle'?: string;
-    'text-primary'?: string;
-    'text-secondary'?: string;
-    'text-muted'?: string;
-    'text-on-dark'?: string;
-    accent?: string;
-    'accent-hover'?: string;
-    danger?: string;
-    'danger-surface'?: string;
-    success?: string;
-    warning?: string;
-    'focus-ring'?: string;
-    'text-on-accent'?: string;
-}
-export interface AdminUIThemeConfig {
-    light?: AdminUIThemeTokens;
-    dark?: AdminUIThemeTokens;
-}
-export declare const generateThemeCSS: (theme?: AdminUIThemeConfig) => string;

package/lib/adminUiTheme.js

@@ -1,34 +0,0 @@
-const CSS_VALUE_RE = /^[a-zA-Z0-9#().,/%\s\-_]+$/;
-const sanitizeCSSValue = (value) => {
-    const trimmed = value.trim();
-    if (!trimmed || !CSS_VALUE_RE.test(trimmed))
-        return null;
-    return trimmed;
-};
-const buildTokenBlock = (selector, tokens) => {
-    const vars = Object.entries(tokens)
-        .map(([key, value]) => {
-        const safe = sanitizeCSSValue(value);
-        return safe ? `  --token-${key}: ${safe};` : null;
-    })
-        .filter(Boolean);
-    if (vars.length === 0)
-        return null;
-    return `${selector} {\n${vars.join('\n')}\n}`;
-};
-export const generateThemeCSS = (theme) => {
-    if (!theme)
-        return '/* default theme */';
-    const blocks = [];
-    if (theme.light) {
-        const block = buildTokenBlock(':root:root', theme.light);
-        if (block)
-            blocks.push(block);
-    }
-    if (theme.dark) {
-        const block = buildTokenBlock('.dark.dark', theme.dark);
-        if (block)
-            blocks.push(block);
-    }
-    return blocks.length > 0 ? blocks.join('\n\n') : '/* default theme */';
-};