@unchainedshop/api 4.8.26 → 4.8.27

package/lib/fastify/mountRoutes.js

@@ -0,0 +1,60 @@
+import { createServerAdapter } from '@whatwg-node/server';
+export function mountRoutes(fastify, unchainedAPI, routes) {
+    if (routes.length === 0)
+        return;
+    const endpoints = routes.map((r) => `${r.method} ${r.path}`).join(', ');
+    fastify.log.info(`Mounting ${routes.length} route(s): ${endpoints}`);
+    fastify.register((scope, opts, registered) => {
+        scope.removeAllContentTypeParsers();
+        scope.addContentTypeParser('*', function (request, payload, done) {
+            done(null);
+        });
+        for (const route of routes) {
+            const adapter = createServerAdapter(async (request, serverContext) => {
+                const context = {
+                    ...unchainedAPI,
+                    ...serverContext.unchainedContext,
+                    params: serverContext.params || {},
+                    rawRequest: serverContext.rawRequest,
+                };
+                try {
+                    return await route.handler(request, context);
+                }
+                catch (error) {
+                    fastify.log.error(`Error in route handler ${route.method} ${route.path}: ${error instanceof Error ? error.message : String(error)}`);
+                    return new Response(JSON.stringify({
+                        error: error instanceof Error ? error.message : 'Internal Server Error',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            });
+            let methods;
+            if (route.method === 'ALL') {
+                methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
+            }
+            else {
+                methods = [route.method];
+            }
+            scope.route({
+                url: route.path,
+                method: methods,
+                handler: async (req, reply) => {
+                    const response = await adapter.handleNodeRequestAndResponse(req.raw, reply.raw, {
+                        unchainedContext: req.unchainedContext,
+                        params: req.params,
+                        rawRequest: req.raw,
+                    });
+                    response.headers.forEach((value, key) => {
+                        reply.header(key, value);
+                    });
+                    reply.status(response.status);
+                    reply.send(response.body || undefined);
+                    return reply;
+                },
+            });
+        }
+        registered();
+    });
+}

package/lib/handlers/createBackchannelLogoutHandler.d.ts

@@ -0,0 +1,4 @@
+import type { PluginHttpRoute } from '@unchainedshop/core';
+import type { OIDCProviderConfig } from '../auth.ts';
+export declare function createBackchannelLogoutRoute(providers: OIDCProviderConfig[]): PluginHttpRoute;
+export default createBackchannelLogoutRoute;

package/lib/handlers/createBackchannelLogoutHandler.js

@@ -0,0 +1,170 @@
+import * as jose from 'jose';
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:api:backchannel-logout');
+function normalizeIssuer(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.origin + parsed.pathname.replace(/\/$/, '');
+    }
+    catch {
+        return url;
+    }
+}
+const jwksCache = new Map();
+function getJWKS(jwksUri) {
+    let jwks = jwksCache.get(jwksUri);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cooldownDuration: 30000,
+            cacheMaxAge: 600000,
+        });
+        jwksCache.set(jwksUri, jwks);
+    }
+    return jwks;
+}
+export function createBackchannelLogoutRoute(providers) {
+    return {
+        path: '/backchannel-logout',
+        method: 'ALL',
+        handler: async (request, context) => {
+            if (request.method !== 'POST') {
+                return new Response(JSON.stringify({ error: 'method_not_allowed' }), {
+                    status: 405,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            try {
+                let logoutToken = null;
+                const contentType = request.headers.get('content-type') || '';
+                if (contentType.includes('application/x-www-form-urlencoded')) {
+                    const formData = await request.formData();
+                    logoutToken = formData.get('logout_token');
+                }
+                else if (contentType.includes('application/json')) {
+                    const body = (await request.json());
+                    logoutToken = body.logout_token || null;
+                }
+                if (!logoutToken) {
+                    logger.warn('Back-channel logout request missing logout_token');
+                    return new Response(JSON.stringify({ error: 'missing_logout_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                let decodedPayload;
+                try {
+                    const parts = logoutToken.split('.');
+                    if (parts.length !== 3) {
+                        logger.warn('Invalid logout token format: not a valid JWT');
+                        return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    decodedPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+                }
+                catch {
+                    logger.warn('Failed to decode logout token');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const { iss } = decodedPayload;
+                if (!iss || typeof iss !== 'string') {
+                    logger.warn('Logout token missing issuer (iss)');
+                    return new Response(JSON.stringify({ error: 'invalid_token' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const normalizedIss = normalizeIssuer(iss);
+                const provider = providers.find((p) => normalizeIssuer(p.issuer) === normalizedIss);
+                if (!provider) {
+                    logger.warn('Unknown issuer in logout token:', { iss });
+                    return new Response(JSON.stringify({ error: 'unknown_issuer' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const jwksUri = provider.jwksUri || `${provider.issuer}/.well-known/jwks.json`;
+                let verifiedPayload;
+                try {
+                    const JWKS = getJWKS(jwksUri);
+                    const verifyOptions = {
+                        issuer: provider.issuer,
+                    };
+                    if (provider.audience) {
+                        verifyOptions.audience = provider.audience;
+                    }
+                    const { payload } = await jose.jwtVerify(logoutToken, JWKS, verifyOptions);
+                    verifiedPayload = payload;
+                }
+                catch (error) {
+                    if (error instanceof jose.errors.JWTExpired) {
+                        logger.warn('Logout token expired');
+                        return new Response(JSON.stringify({ error: 'token_expired' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+                        logger.warn('Logout token claim validation failed:', { message: error.message });
+                        return new Response(JSON.stringify({ error: 'invalid_claims' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+                        logger.warn('Logout token signature verification failed - possible forgery attempt');
+                        return new Response(JSON.stringify({ error: 'invalid_signature' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                    else {
+                        logger.error('Logout token verification failed:', { error });
+                        return new Response(JSON.stringify({ error: 'verification_failed' }), {
+                            status: 400,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                }
+                const { sub, events } = verifiedPayload;
+                if (!events?.['http://schemas.openid.net/event/backchannel-logout']) {
+                    logger.warn('Token is not a back-channel logout token (missing events claim)');
+                    return new Response(JSON.stringify({ error: 'invalid_token_type' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                if (!sub) {
+                    logger.warn('Logout token missing subject (sub)');
+                    return new Response(JSON.stringify({ error: 'missing_subject' }), {
+                        status: 400,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                const user = await context.modules.users.findUserById(sub);
+                if (!user) {
+                    logger.info('User not found for back-channel logout:', { sub });
+                    return new Response('', { status: 200 });
+                }
+                await context.modules.users.updateOidcLogoutAt(user._id, new Date());
+                logger.info('Back-channel logout processed successfully:', {
+                    userId: user._id,
+                    issuer: iss,
+                });
+                return new Response('', { status: 200 });
+            }
+            catch (error) {
+                logger.error('Back-channel logout error:', { error });
+                return new Response(JSON.stringify({ error: 'internal_error' }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        },
+    };
+}
+export default createBackchannelLogoutRoute;

package/lib/middleware/createAuthMiddleware.d.ts

@@ -0,0 +1,29 @@
+import { type AuthConfig } from '../auth.ts';
+import type { LoginFn, LogoutFn } from '../context.ts';
+export interface AuthContextParams {
+    getHeader: (key: string) => string | undefined;
+    setHeader: (key: string, value: string) => void;
+    getCookie: (name: string) => string | undefined;
+    setCookie: (name: string, value: string, options: CookieOptions) => void;
+    clearCookie: (name: string, options: CookieOptions) => void;
+    remoteAddress?: string;
+    remotePort?: number;
+}
+export interface CookieOptions {
+    domain?: string;
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none' | boolean;
+    maxAge?: number;
+    expires?: Date;
+}
+export interface AuthContext {
+    userId?: string;
+    tokenVersion?: number;
+    impersonatorId?: string;
+    accessToken?: string;
+    login: LoginFn;
+    logout: LogoutFn;
+}
+export declare function createAuthContext(params: AuthContextParams, authConfig?: AuthConfig): Promise<AuthContext>;

package/lib/middleware/createAuthMiddleware.js

@@ -0,0 +1,91 @@
+import { emit } from '@unchainedshop/events';
+import { signAccessToken, createAuthHandler } from "../auth.js";
+import { API_EVENTS } from "../events.js";
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:api:auth-middleware');
+const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
+function getTokenCookieOptions(expires) {
+    const secure = !UNCHAINED_COOKIE_INSECURE;
+    const sameSite = {
+        none: 'none',
+        lax: 'lax',
+        strict: 'strict',
+        '1': true,
+        '0': false,
+    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || 'lax';
+    if (!secure && process.env.NODE_ENV === 'production') {
+        logger.warn('SECURITY WARNING: Running with UNCHAINED_COOKIE_INSECURE in production is not recommended');
+    }
+    if (sameSite === 'none' && !secure) {
+        logger.warn('SECURITY WARNING: SameSite=None requires Secure flag to be effective');
+    }
+    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
+    return {
+        domain: UNCHAINED_COOKIE_DOMAIN,
+        path: UNCHAINED_COOKIE_PATH,
+        secure,
+        httpOnly: true,
+        sameSite: sameSite,
+        maxAge: expires ? undefined : expirySeconds * 1000,
+        expires,
+    };
+}
+function extractBearerToken(authHeader) {
+    if (!authHeader)
+        return undefined;
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2)
+        return undefined;
+    const [scheme, token] = parts;
+    if (scheme.toLowerCase() !== 'bearer') {
+        logger.debug('Authorization header present but not Bearer scheme');
+        return undefined;
+    }
+    return token;
+}
+export async function createAuthContext(params, authConfig) {
+    const { getHeader, getCookie, setCookie, clearCookie } = params;
+    const authHeader = getHeader('authorization');
+    const headerToken = extractBearerToken(authHeader);
+    const cookieToken = getCookie(UNCHAINED_COOKIE_NAME);
+    const token = headerToken || cookieToken;
+    const verifyToken = createAuthHandler(authConfig);
+    const authResult = token ? await verifyToken(token) : {};
+    const login = async (user, options = {}) => {
+        const { impersonator } = options;
+        const tokenVersion = user.tokenVersion ?? 1;
+        const { token: newToken, expires } = await signAccessToken(user._id, tokenVersion, {
+            impersonatorId: impersonator?._id,
+        });
+        setCookie(UNCHAINED_COOKIE_NAME, newToken, getTokenCookieOptions(expires));
+        const tokenObject = {
+            _id: crypto.randomUUID(),
+            userId: user._id,
+            userName: user.username || user.emails?.[0]?.address,
+            tokenExpires: expires,
+            remoteAddress: params.remoteAddress,
+        };
+        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
+        user._inLoginMethodResponse = true;
+        return { user, ...tokenObject };
+    };
+    const logout = async () => {
+        clearCookie(UNCHAINED_COOKIE_NAME, getTokenCookieOptions());
+        if (authResult.userId) {
+            const tokenObject = {
+                _id: crypto.randomUUID(),
+                userId: authResult.userId,
+            };
+            await emit(API_EVENTS.API_LOGOUT, tokenObject);
+        }
+        return true;
+    };
+    return {
+        userId: authResult.userId,
+        tokenVersion: authResult.tokenVersion,
+        impersonatorId: authResult.impersonatorId,
+        accessToken: authResult.isApiKey ? authResult.accessToken : undefined,
+        login,
+        logout,
+    };
+}

package/lib/resolvers/mutations/accounts/logoutAllSessions.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '../../../context.ts';
+export default function logoutAllSessions(root: never, params: {
+    userId?: string;
+}, context: Context): Promise<{
+    success: boolean;
+}>;

package/lib/resolvers/mutations/accounts/logoutAllSessions.js

@@ -0,0 +1,17 @@
+import { log } from '@unchainedshop/logger';
+import { UserNotFoundError } from "../../../errors.js";
+export default async function logoutAllSessions(root, params, context) {
+    const { userId, modules } = context;
+    const normalizedUserId = params.userId || userId;
+    log(`mutation logoutAllSessions ${normalizedUserId}`, { userId });
+    if (!(await modules.users.userExists({ userId: normalizedUserId })))
+        throw new UserNotFoundError({ userId: normalizedUserId });
+    const result = await modules.users.incrementTokenVersion(normalizedUserId);
+    if (!result) {
+        throw new Error('Failed to logout all sessions', { cause: 'LOGOUT_FAILED' });
+    }
+    if (normalizedUserId === userId) {
+        await context.logout();
+    }
+    return { success: true };
+}

package/lib/resolvers/mutations/bulk/bulkAssignProductsToAssortment.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '../../../context.ts';
+export default function bulkAssignProductsToAssortment(root: never, { productIds, assortmentId }: {
+    productIds: string[];
+    assortmentId: string;
+}, { modules, services, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkAssignProductsToAssortment.js

@@ -0,0 +1,18 @@
+import { log } from '@unchainedshop/logger';
+import { InvalidIdError, AssortmentNotFoundError } from "../../../errors.js";
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkAssignProductsToAssortment(root, { productIds, assortmentId }, { modules, services, userId }) {
+    log(`mutation bulkAssignProductsToAssortment ${assortmentId} for ${productIds.length} products`, {
+        userId,
+    });
+    const normalizedProductIds = normalizeBulkIds(productIds);
+    if (!assortmentId)
+        throw new InvalidIdError({ assortmentId });
+    if (!(await modules.assortments.assortmentExists({ assortmentId })))
+        throw new AssortmentNotFoundError({ assortmentId });
+    const result = await services.assortments.bulkAssignProductsToAssortment({
+        assortmentId,
+        productIds: normalizedProductIds,
+    });
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkOperation.d.ts

@@ -0,0 +1,12 @@
+export declare const MAX_BULK_OPERATION_SIZE = 1000;
+export interface BulkOperationIds {
+    successIds: string[];
+    failedIds: string[];
+}
+export declare const normalizeBulkIds: (ids: readonly string[]) => string[];
+export declare const createBulkOperationResult: ({ successIds, failedIds }: BulkOperationIds) => {
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+};

package/lib/resolvers/mutations/bulk/bulkOperation.js

@@ -0,0 +1,14 @@
+import { BulkOperationTooLargeError } from "../../../errors.js";
+export const MAX_BULK_OPERATION_SIZE = 1000;
+export const normalizeBulkIds = (ids) => {
+    if (ids.length > MAX_BULK_OPERATION_SIZE) {
+        throw new BulkOperationTooLargeError({ limit: MAX_BULK_OPERATION_SIZE });
+    }
+    return [...new Set(ids)];
+};
+export const createBulkOperationResult = ({ successIds, failedIds }) => ({
+    successIds,
+    successCount: successIds.length,
+    failedIds,
+    failedCount: failedIds.length,
+});

package/lib/resolvers/mutations/bulk/bulkRemoveAssortments.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from '../../../context.ts';
+export default function bulkRemoveAssortments(root: never, { assortmentIds }: {
+    assortmentIds: string[];
+}, { modules, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkRemoveAssortments.js

@@ -0,0 +1,7 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkRemoveAssortments(root, { assortmentIds }, { modules, userId }) {
+    log(`mutation bulkRemoveAssortments for ${assortmentIds.length} assortments`, { userId });
+    const result = await modules.assortments.bulkDelete(normalizeBulkIds(assortmentIds));
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkRemoveFilters.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from '../../../context.ts';
+export default function bulkRemoveFilters(root: never, { filterIds }: {
+    filterIds: string[];
+}, { services, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkRemoveFilters.js

@@ -0,0 +1,9 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkRemoveFilters(root, { filterIds }, { services, userId }) {
+    log(`mutation bulkRemoveFilters for ${filterIds.length} filters`, { userId });
+    const result = await services.filters.bulkRemoveFilters({
+        filterIds: normalizeBulkIds(filterIds),
+    });
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkRemoveProducts.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from '../../../context.ts';
+export default function bulkRemoveProducts(root: never, { productIds }: {
+    productIds: string[];
+}, { services, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkRemoveProducts.js

@@ -0,0 +1,9 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkRemoveProducts(root, { productIds }, { services, userId }) {
+    log(`mutation bulkRemoveProducts for ${productIds.length} products`, { userId });
+    const result = await services.products.bulkRemoveProducts({
+        productIds: normalizeBulkIds(productIds),
+    });
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkRemoveUsers.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from '../../../context.ts';
+export default function bulkRemoveUsers(root: never, { userIds }: {
+    userIds: string[];
+}, { services, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkRemoveUsers.js

@@ -0,0 +1,7 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkRemoveUsers(root, { userIds }, { services, userId }) {
+    log(`mutation bulkRemoveUsers for ${userIds.length} users`, { userId });
+    const result = await services.users.bulkDeleteUsers({ userIds: normalizeBulkIds(userIds) });
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkSetAssortmentActive.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '../../../context.ts';
+export default function bulkSetAssortmentActive(root: never, { assortmentIds, isActive }: {
+    assortmentIds: string[];
+    isActive: boolean;
+}, { modules, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkSetAssortmentActive.js

@@ -0,0 +1,9 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkSetAssortmentActive(root, { assortmentIds, isActive }, { modules, userId }) {
+    log(`mutation bulkSetAssortmentActive ${isActive} for ${assortmentIds.length} assortments`, {
+        userId,
+    });
+    const result = await modules.assortments.bulkSetActive(normalizeBulkIds(assortmentIds), isActive);
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkSetFilterActive.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '../../../context.ts';
+export default function bulkSetFilterActive(root: never, { filterIds, isActive }: {
+    filterIds: string[];
+    isActive: boolean;
+}, { services, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkSetFilterActive.js

@@ -0,0 +1,10 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkSetFilterActive(root, { filterIds, isActive }, { services, userId }) {
+    log(`mutation bulkSetFilterActive ${isActive} for ${filterIds.length} filters`, { userId });
+    const result = await services.filters.bulkSetFilterActive({
+        filterIds: normalizeBulkIds(filterIds),
+        isActive,
+    });
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkSetProductStatus.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '../../../context.ts';
+export default function bulkSetProductStatus(root: never, { productIds, status }: {
+    productIds: string[];
+    status: string;
+}, { modules, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkSetProductStatus.js

@@ -0,0 +1,17 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkSetProductStatus(root, { productIds, status }, { modules, userId }) {
+    log(`mutation bulkSetProductStatus ${status} for ${productIds.length} products`, { userId });
+    const normalizedProductIds = normalizeBulkIds(productIds);
+    let result;
+    if (status === 'ACTIVE') {
+        result = await modules.products.bulkPublish(normalizedProductIds);
+    }
+    else if (status === 'DRAFT') {
+        result = await modules.products.bulkUnpublish(normalizedProductIds);
+    }
+    else {
+        result = { successIds: [], failedIds: normalizedProductIds };
+    }
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkSetUserRoles.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from '../../../context.ts';
+export default function bulkSetUserRoles(root: never, { userIds, roles }: {
+    userIds: string[];
+    roles: string[];
+}, context: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkSetUserRoles.js

@@ -0,0 +1,14 @@
+import { log } from '@unchainedshop/logger';
+import { getPublicRoles } from "../../../roles/index.js";
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkSetUserRoles(root, { userIds, roles }, context) {
+    const { modules, userId } = context;
+    log(`mutation bulkSetUserRoles for ${userIds.length} users`, { userId });
+    const publicRoles = getPublicRoles(context.roles);
+    const invalidRoles = roles.filter((r) => !publicRoles.includes(r));
+    if (invalidRoles.length) {
+        throw new Error(`Invalid role names: ${invalidRoles.join(', ')}`);
+    }
+    const result = await modules.users.bulkUpdateRoles(normalizeBulkIds(userIds), roles);
+    return createBulkOperationResult(result);
+}

package/lib/resolvers/mutations/bulk/bulkUpdateAssortmentTags.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from '../../../context.ts';
+export default function bulkUpdateAssortmentTags(root: never, { assortmentIds, add, remove }: {
+    assortmentIds: string[];
+    add?: string[];
+    remove?: string[];
+}, { modules, userId }: Context): Promise<{
+    successIds: string[];
+    successCount: number;
+    failedIds: string[];
+    failedCount: number;
+}>;

package/lib/resolvers/mutations/bulk/bulkUpdateAssortmentTags.js

@@ -0,0 +1,10 @@
+import { log } from '@unchainedshop/logger';
+import { createBulkOperationResult, normalizeBulkIds } from "./bulkOperation.js";
+export default async function bulkUpdateAssortmentTags(root, { assortmentIds, add, remove }, { modules, userId }) {
+    log(`mutation bulkUpdateAssortmentTags for ${assortmentIds.length} assortments`, { userId });
+    const result = await modules.assortments.bulkUpdateTags(normalizeBulkIds(assortmentIds), {
+        add,
+        remove,
+    });
+    return createBulkOperationResult(result);
+}