@unchainedshop/api 4.8.24 → 4.8.26

package/lib/fastify/mountPluginRoutes.js

@@ -1,62 +0,0 @@
-import { pluginRegistry } from '@unchainedshop/core';
-import { createServerAdapter } from '@whatwg-node/server';
-export function mountPluginRoutes(fastify, unchainedAPI) {
-    const routes = pluginRegistry.getRoutes();
-    if (routes.length === 0)
-        return;
-    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
-    fastify.log.info(`Mounting ${routes.length} plugin route(s): ${endpoints}`);
-    fastify.register((scope, opts, registered) => {
-        scope.removeAllContentTypeParsers();
-        scope.addContentTypeParser('*', function (request, payload, done) {
-            done(null);
-        });
-        for (const route of routes) {
-            const adapter = createServerAdapter(async (request, serverContext) => {
-                const context = {
-                    ...unchainedAPI,
-                    ...serverContext.unchainedContext,
-                    params: serverContext.params || {},
-                    rawRequest: serverContext.rawRequest,
-                };
-                try {
-                    return await route.handler(request, context);
-                }
-                catch (error) {
-                    fastify.log.error(`Error in plugin route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
-                    return new Response(JSON.stringify({
-                        error: error instanceof Error ? error.message : 'Internal Server Error',
-                    }), {
-                        status: 500,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-            });
-            let methods;
-            if (route.method === 'ALL') {
-                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
-            }
-            else {
-                methods = [route.method];
-            }
-            scope.route({
-                url: route.path,
-                method: methods,
-                handler: async (req, reply) => {
-                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
-                        unchainedContext: req.unchainedContext,
-                        params: req.params,
-                        rawRequest: req.raw,
-                    });
-                    response.headers.forEach((value, key) => {
-                        reply.header(key, value);
-                    });
-                    reply.status(response.status);
-                    reply.send(response.body || undefined);
-                    return reply;
-                },
-            });
-        }
-        registered();
-    });
-}

package/lib/fastify/mountRoutes.d.ts

@@ -1,3 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import type { UnchainedCore, PluginHttpRoute } from '@unchainedshop/core';
-export declare function mountRoutes(fastify: FastifyInstance, unchainedAPI: UnchainedCore, routes: PluginHttpRoute[]): void;

package/lib/fastify/mountRoutes.js

@@ -1,60 +0,0 @@
-import { createServerAdapter } from '@whatwg-node/server';
-export function mountRoutes(fastify, unchainedAPI, routes) {
-    if (routes.length === 0)
-        return;
-    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
-    fastify.log.info(`Mounting ${routes.length} route(s): ${endpoints}`);
-    fastify.register((scope, opts, registered) => {
-        scope.removeAllContentTypeParsers();
-        scope.addContentTypeParser('*', function (request, payload, done) {
-            done(null);
-        });
-        for (const route of routes) {
-            const adapter = createServerAdapter(async (request, serverContext) => {
-                const context = {
-                    ...unchainedAPI,
-                    ...serverContext.unchainedContext,
-                    params: serverContext.params || {},
-                    rawRequest: serverContext.rawRequest,
-                };
-                try {
-                    return await route.handler(request, context);
-                }
-                catch (error) {
-                    fastify.log.error(`Error in route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
-                    return new Response(JSON.stringify({
-                        error: error instanceof Error ? error.message : 'Internal Server Error',
-                    }), {
-                        status: 500,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-            });
-            let methods;
-            if (route.method === 'ALL') {
-                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
-            }
-            else {
-                methods = [route.method];
-            }
-            scope.route({
-                url: route.path,
-                method: methods,
-                handler: async (req, reply) => {
-                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
-                        unchainedContext: req.unchainedContext,
-                        params: req.params,
-                        rawRequest: req.raw,
-                    });
-                    response.headers.forEach((value, key) => {
-                        reply.header(key, value);
-                    });
-                    reply.status(response.status);
-                    reply.send(response.body || undefined);
-                    return reply;
-                },
-            });
-        }
-        registered();
-    });
-}

package/lib/handlers/createBackchannelLogoutHandler.d.ts

@@ -1,4 +0,0 @@
-import type { PluginHttpRoute } from '@unchainedshop/core';
-import type { OIDCProviderConfig } from '../auth.ts';
-export declare function createBackchannelLogoutRoute(providers: OIDCProviderConfig[]): PluginHttpRoute;
-export default createBackchannelLogoutRoute;

package/lib/handlers/createBackchannelLogoutHandler.js

@@ -1,170 +0,0 @@
-import * as jose from 'jose';
-import { createLogger } from '@unchainedshop/logger';
-const logger = createLogger('unchained:api:backchannel-logout');
-function normalizeIssuer(url) {
-    try {
-        const parsed = new URL(url);
-        return parsed.origin + parsed.pathname.replace(/\/$/, '');
-    }
-    catch {
-        return url;
-    }
-}
-const jwksCache = new Map();
-function getJWKS(jwksUri) {
-    let jwks = jwksCache.get(jwksUri);
-    if (!jwks) {
-        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
-            cooldownDuration: 30000,
-            cacheMaxAge: 600000,
-        });
-        jwksCache.set(jwksUri, jwks);
-    }
-    return jwks;
-}
-export function createBackchannelLogoutRoute(providers) {
-    return {
-        path: '/backchannel-logout',
-        method: 'ALL',
-        handler: async (request, context) => {
-            if (request.method !== 'POST') {
-                return new Response(JSON.stringify({ error: 'method_not_allowed' }), {
-                    status: 405,
-                    headers: { 'Content-Type': 'application/json' },
-                });
-            }
-            try {
-                let logoutToken = null;
-                const contentType = request.headers.get('content-type') || '';
-                if (contentType.includes('application/x-www-form-urlencoded')) {
-                    const formData = await request.formData();
-                    logoutToken = formData.get('logout_token');
-                }
-                else if (contentType.includes('application/json')) {
-                    const body = (await request.json());
-                    logoutToken = body.logout_token || null;
-                }
-                if (!logoutToken) {
-                    logger.warn('Back-channel logout request missing logout_token');
-                    return new Response(JSON.stringify({ error: 'missing_logout_token' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                let decodedPayload;
-                try {
-                    const parts = logoutToken.split('.');
-                    if (parts.length !== 3) {
-                        logger.warn('Invalid logout token format: not a valid JWT');
-                        return new Response(JSON.stringify({ error: 'invalid_token' }), {
-                            status: 400,
-                            headers: { 'Content-Type': 'application/json' },
-                        });
-                    }
-                    decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-                }
-                catch {
-                    logger.warn('Failed to decode logout token');
-                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                const { iss } = decodedPayload;
-                if (!iss || typeof iss !== 'string') {
-                    logger.warn('Logout token missing issuer (iss)');
-                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                const normalizedIss = normalizeIssuer(iss);
-                const provider = providers.find((p) => normalizeIssuer(p.issuer) === normalizedIss);
-                if (!provider) {
-                    logger.warn('Unknown issuer in logout token:', { iss });
-                    return new Response(JSON.stringify({ error: 'unknown_issuer' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
-                let verifiedPayload;
-                try {
-                    const JWKS = getJWKS(jwksUri);
-                    const verifyOptions = {
-                        issuer: provider.issuer,
-                    };
-                    if (provider.audience) {
-                        verifyOptions.audience = provider.audience;
-                    }
-                    const { payload } = await jose.jwtVerify(logoutToken, JWKS, verifyOptions);
-                    verifiedPayload = payload;
-                }
-                catch (error) {
-                    if (error instanceof jose.errors.JWTExpired) {
-                        logger.warn('Logout token expired');
-                        return new Response(JSON.stringify({ error: 'token_expired' }), {
-                            status: 400,
-                            headers: { 'Content-Type': 'application/json' },
-                        });
-                    }
-                    else if (error instanceof jose.errors.JWTClaimValidationFailed) {
-                        logger.warn('Logout token claim validation failed:', { message: error.message });
-                        return new Response(JSON.stringify({ error: 'invalid_claims' }), {
-                            status: 400,
-                            headers: { 'Content-Type': 'application/json' },
-                        });
-                    }
-                    else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
-                        logger.warn('Logout token signature verification failed - possible forgery attempt');
-                        return new Response(JSON.stringify({ error: 'invalid_signature' }), {
-                            status: 400,
-                            headers: { 'Content-Type': 'application/json' },
-                        });
-                    }
-                    else {
-                        logger.error('Logout token verification failed:', { error });
-                        return new Response(JSON.stringify({ error: 'verification_failed' }), {
-                            status: 400,
-                            headers: { 'Content-Type': 'application/json' },
-                        });
-                    }
-                }
-                const { sub, events } = verifiedPayload;
-                if (!events?.['http://schemas.openid.net/event/backchannel-logout']) {
-                    logger.warn('Token is not a back-channel logout token (missing events claim)');
-                    return new Response(JSON.stringify({ error: 'invalid_token_type' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                if (!sub) {
-                    logger.warn('Logout token missing subject (sub)');
-                    return new Response(JSON.stringify({ error: 'missing_subject' }), {
-                        status: 400,
-                        headers: { 'Content-Type': 'application/json' },
-                    });
-                }
-                const user = await context.modules.users.findUserById(sub);
-                if (!user) {
-                    logger.info('User not found for back-channel logout:', { sub });
-                    return new Response('', { status: 200 });
-                }
-                await context.modules.users.updateOidcLogoutAt(user._id, new Date());
-                logger.info('Back-channel logout processed successfully:', {
-                    userId: user._id,
-                    issuer: iss,
-                });
-                return new Response('', { status: 200 });
-            }
-            catch (error) {
-                logger.error('Back-channel logout error:', { error });
-                return new Response(JSON.stringify({ error: 'internal_error' }), {
-                    status: 500,
-                    headers: { 'Content-Type': 'application/json' },
-                });
-            }
-        },
-    };
-}
-export default createBackchannelLogoutRoute;

package/lib/middleware/createAuthMiddleware.d.ts

@@ -1,29 +0,0 @@
-import { type AuthConfig } from '../auth.ts';
-import type { LoginFn, LogoutFn } from '../context.ts';
-export interface AuthContextParams {
-    getHeader: (key: string) => string | undefined;
-    setHeader: (key: string, value: string) => void;
-    getCookie: (name: string) => string | undefined;
-    setCookie: (name: string, value: string, options: CookieOptions) => void;
-    clearCookie: (name: string, options: CookieOptions) => void;
-    remoteAddress?: string;
-    remotePort?: number;
-}
-export interface CookieOptions {
-    domain?: string;
-    path?: string;
-    secure?: boolean;
-    httpOnly?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none' | boolean;
-    maxAge?: number;
-    expires?: Date;
-}
-export interface AuthContext {
-    userId?: string;
-    tokenVersion?: number;
-    impersonatorId?: string;
-    accessToken?: string;
-    login: LoginFn;
-    logout: LogoutFn;
-}
-export declare function createAuthContext(params: AuthContextParams, authConfig?: AuthConfig): Promise<AuthContext>;

package/lib/middleware/createAuthMiddleware.js

@@ -1,89 +0,0 @@
-import { emit } from '@unchainedshop/events';
-import { signAccessToken, createAuthHandler } from "../auth.js";
-import { API_EVENTS } from "../events.js";
-import { createLogger } from '@unchainedshop/logger';
-const logger = createLogger('unchained:api:auth-middleware');
-const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
-function getTokenCookieOptions(expires) {
-    const secure = !UNCHAINED_COOKIE_INSECURE;
-    const sameSite = {
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || 'lax';
-    if (!secure && process.env.NODE_ENV === 'production') {
-        logger.warn('SECURITY WARNING: Running with UNCHAINED_COOKIE_INSECURE in production is not recommended');
-    }
-    if (sameSite === 'none' && !secure) {
-        logger.warn('SECURITY WARNING: SameSite=None requires Secure flag to be effective');
-    }
-    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
-    return {
-        domain: UNCHAINED_COOKIE_DOMAIN,
-        path: UNCHAINED_COOKIE_PATH,
-        secure,
-        httpOnly: true,
-        sameSite: sameSite,
-        maxAge: expires ? undefined : expirySeconds * 1000,
-        expires,
-    };
-}
-function extractBearerToken(authHeader) {
-    if (!authHeader)
-        return undefined;
-    const parts = authHeader.split(' ');
-    if (parts.length !== 2)
-        return undefined;
-    const [scheme, token] = parts;
-    if (scheme.toLowerCase() !== 'bearer') {
-        logger.debug('Authorization header present but not Bearer scheme');
-        return undefined;
-    }
-    return token;
-}
-export async function createAuthContext(params, authConfig) {
-    const { getHeader, getCookie, setCookie, clearCookie } = params;
-    const authHeader = getHeader('authorization');
-    const headerToken = extractBearerToken(authHeader);
-    const cookieToken = getCookie(UNCHAINED_COOKIE_NAME);
-    const token = headerToken || cookieToken;
-    const verifyToken = createAuthHandler(authConfig);
-    const authResult = token ? await verifyToken(token) : {};
-    const login = async (user, options = {}) => {
-        const { impersonator } = options;
-        const tokenVersion = user.tokenVersion ?? 1;
-        const { token: newToken, expires } = await signAccessToken(user._id, tokenVersion, {
-            impersonatorId: impersonator?._id,
-        });
-        setCookie(UNCHAINED_COOKIE_NAME, newToken, getTokenCookieOptions(expires));
-        const tokenObject = {
-            _id: crypto.randomUUID(),
-            userId: user._id,
-            tokenExpires: expires,
-        };
-        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-        user._inLoginMethodResponse = true;
-        return { user, ...tokenObject };
-    };
-    const logout = async () => {
-        clearCookie(UNCHAINED_COOKIE_NAME, getTokenCookieOptions());
-        if (authResult.userId) {
-            const tokenObject = {
-                _id: crypto.randomUUID(),
-                userId: authResult.userId,
-            };
-            await emit(API_EVENTS.API_LOGOUT, tokenObject);
-        }
-        return true;
-    };
-    return {
-        userId: authResult.userId,
-        tokenVersion: authResult.tokenVersion,
-        impersonatorId: authResult.impersonatorId,
-        accessToken: authResult.isApiKey ? authResult.accessToken : undefined,
-        login,
-        logout,
-    };
-}

package/lib/resolvers/mutations/accounts/logoutAllSessions.d.ts

@@ -1,4 +0,0 @@
-import type { Context } from '../../../context.ts';
-export default function logoutAllSessions(root: never, _: never, context: Context): Promise<{
-    success: boolean;
-}>;

package/lib/resolvers/mutations/accounts/logoutAllSessions.js

@@ -1,11 +0,0 @@
-import { log } from '@unchainedshop/logger';
-export default async function logoutAllSessions(root, _, context) {
-    const { userId, modules } = context;
-    log('mutation logoutAllSessions', { userId });
-    const result = await modules.users.incrementTokenVersion(userId);
-    if (!result) {
-        throw new Error('Failed to logout all sessions', { cause: 'LOGOUT_FAILED' });
-    }
-    await context.logout();
-    return { success: true };
-}

package/lib/resolvers/type/order/order-payment-base.d.ts

@@ -1,7 +0,0 @@
-import type { OrderPayment } from '@unchainedshop/core-orders';
-import type { Context } from '../../../context.ts';
-export declare const OrderPaymentBase: {
-    status(obj: OrderPayment, _: never, { modules }: Context): import("@unchainedshop/core-orders").OrderPaymentStatus;
-    provider(obj: OrderPayment, _: never, { loaders }: Context): Promise<import("@unchainedshop/core-payment").PaymentProvider>;
-    discounts(obj: OrderPayment, _: never, { loaders, services }: Context): Promise<import("@unchainedshop/core/lib/services/getPaymentDiscounts.js").PaymentDiscountPrice[]>;
-};

package/lib/resolvers/type/order/order-payment-base.js

@@ -1,14 +0,0 @@
-export const OrderPaymentBase = {
-    status(obj, _, { modules }) {
-        return modules.orders.payments.normalizedStatus(obj);
-    },
-    async provider(obj, _, { loaders }) {
-        return loaders.paymentProviderLoader.load({
-            paymentProviderId: obj.paymentProviderId,
-        });
-    },
-    async discounts(obj, _, { loaders, services }) {
-        const order = await loaders.orderLoader.load({ orderId: obj.orderId });
-        return services.payment.getPaymentDiscounts(obj, order.currencyCode);
-    },
-};

package/lib/schema/types/common.d.ts

@@ -1,2 +0,0 @@
-declare const _default: string[];
-export default _default;

package/lib/schema/types/common.js

@@ -1,12 +0,0 @@
-export default [
-    `
-    type SuccessResponse @cacheControl(maxAge: 0, scope: PRIVATE) {
-      success: Boolean
-    }
-
-    enum SortDirection {
-      ASC
-      DESC
-    }
-  `,
-];

package/lib/utils/mapServiceError.d.ts

@@ -1 +0,0 @@
-export declare function mapServiceError(error: unknown): never;

package/lib/utils/mapServiceError.js

@@ -1,59 +0,0 @@
-import { GraphQLError } from 'graphql';
-import * as errors from "../errors.js";
-const errorMap = {
-    ProductNotFoundError: errors.ProductNotFoundError,
-    ProductWrongStatusError: errors.ProductWrongStatusError,
-    ProductWrongTypeError: errors.ProductWrongTypeError,
-    CyclicProductBundlingNotSupportedError: errors.CyclicProductBundlingNotSupportedError,
-    ProductVariationInfinityLoop: errors.ProductVariationInfinityLoop,
-    ProductVariationVectorInvalid: errors.ProductVariationVectorInvalid,
-    ProductVariationVectorAlreadySet: errors.ProductVariationVectorAlreadySet,
-    ProductLinkedToActiveBundleError: errors.ProductLinkedToActiveBundleError,
-    ProductLinkedToActiveVariationError: errors.ProductLinkedToActiveVariationError,
-    ProductLinkedToQuotationError: errors.ProductLinkedToQuotationError,
-    ProductLinkedToEnrollmentError: errors.ProductLinkedToEnrollmentError,
-    EnrollmentNotFoundError: errors.EnrollmentNotFoundError,
-    EnrollmentWrongStatusError: errors.EnrollmentWrongStatusError,
-    EnrollmentPlanUpdateNotAllowedError: errors.EnrollmentWrongStatusError,
-    OrderNotFoundError: errors.OrderNotFoundError,
-    OrderWrongStatusError: errors.OrderWrongStatusError,
-    OrderItemNotFoundError: errors.OrderItemNotFoundError,
-    OrderQuantityTooLowError: errors.OrderQuantityTooLowError,
-    OrderPaymentNotFoundError: errors.OrderPaymentNotFoundError,
-    OrderWrongPaymentStatusError: errors.OrderWrongPaymentStatusError,
-    OrderDeliveryNotFoundError: errors.OrderDeliveryNotFoundError,
-    OrderWrongDeliveryStatusError: errors.OrderWrongDeliveryStatusError,
-    QuotationNotFoundError: errors.QuotationNotFoundError,
-    QuotationWrongStatusError: errors.QuotationWrongStatusError,
-    QuotationItemConfigurationError: errors.QuotationItemConfigurationError,
-    BookmarkNotFoundError: errors.BookmarkNotFoundError,
-    MultipleBookmarksFound: errors.MultipleBookmarksFound,
-    BookmarkAlreadyExistsError: errors.BookmarkAlreadyExistsError,
-    OrderDiscountCodeAlreadyPresentError: errors.OrderDiscountCodeAlreadyPresentError,
-    OrderDiscountCodeNotValidError: errors.OrderDiscountCodeNotValidError,
-    UserNotFoundError: errors.UserNotFoundError,
-    ImpersonatingAdminUserError: errors.ImpersonatingAdminUserError,
-    InvalidEmailVerificationTokenError: errors.InvalidEmailVerificationTokenError,
-    UsernameOrEmailRequiredError: errors.UsernameOrEmailRequiredError,
-    PasswordOrWebAuthnPublicKeyRequiredError: errors.PasswordOrWebAuthnPublicKeyRequiredError,
-    EmailAlreadyExistsError: errors.EmailAlreadyExistsError,
-    UsernameAlreadyExistsError: errors.UsernameAlreadyExistsError,
-    PasswordInvalidError: errors.PasswordInvalidError,
-    WebAuthnVerificationFailedError: errors.WebAuthnVerificationFailedError,
-    AuthOperationFailedError: errors.AuthOperationFailedError,
-    InvalidCredentialsError: errors.InvalidCredentialsError,
-    InvalidResetTokenError: errors.InvalidResetTokenError,
-    InvalidIdError: errors.InvalidIdError,
-    ProviderConfigurationInvalid: errors.ProviderConfigurationInvalid,
-};
-export function mapServiceError(error) {
-    if (error instanceof GraphQLError) {
-        throw error;
-    }
-    const serviceError = error;
-    const ErrorClass = serviceError.code ? errorMap[serviceError.code] : undefined;
-    if (ErrorClass) {
-        throw new ErrorClass(serviceError.data);
-    }
-    throw error;
-}

package/lib/utils/maskError.d.ts

@@ -1 +0,0 @@
-export declare function createMaskError(isDev: boolean): (error: unknown, message: string) => Error;

package/lib/utils/maskError.js

@@ -1,22 +0,0 @@
-import { GraphQLError } from 'graphql';
-import { maskError as yogaMaskError } from 'graphql-yoga';
-function isKnownError(error) {
-    return error instanceof Error && 'code' in error && typeof error.code === 'string';
-}
-export function createMaskError(isDev) {
-    return function maskError(error, message) {
-        const originalError = error instanceof GraphQLError ? error.originalError || error : error;
-        if (error instanceof GraphQLError && error.extensions?.code) {
-            return error;
-        }
-        if (isKnownError(originalError)) {
-            return new GraphQLError(originalError.message, {
-                extensions: {
-                    code: originalError.code,
-                    ...(originalError.data || {}),
-                },
-            });
-        }
-        return yogaMaskError(error, message, isDev);
-    };
-}