@unchainedshop/api 4.8.4 → 4.8.9

package/lib/context.d.ts

@@ -3,6 +3,7 @@ import { type UnchainedLoaders } from './loaders/index.ts';
 import { type UnchainedLocaleContext } from './locale-context.ts';
 import type { UnchainedServerOptions } from './api-index.ts';
 import type { User } from '@unchainedshop/core-users';
+export declare const IN_LOGIN_RESPONSE: unique symbol;
 export type LoginFn = (user: User, options?: {
     impersonator?: User;
 }) => Promise<{

package/lib/context.js

@@ -1,6 +1,7 @@
 import instantiateLoaders, {} from "./loaders/index.js";
 import { getLocaleContext } from "./locale-context.js";
 const { npm_package_version, UNCHAINED_API_VERSION } = process.env;
+export const IN_LOGIN_RESPONSE = Symbol('inLoginMethodResponse');
 let context;
 export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {

package/lib/express/index.js

@@ -5,7 +5,7 @@ import MongoStore from "../mongo-store.js";
 import { Passport } from 'passport';
 import { mongodb } from '@unchainedshop/mongodb';
 import { emit } from '@unchainedshop/events';
-import { getCurrentContextResolver } from "../context.js";
+import { getCurrentContextResolver, IN_LOGIN_RESPONSE, } from "../context.js";
 import createBulkImportMiddleware from "./createBulkImportMiddleware.js";
 import createERCMetadataMiddleware from "./createERCMetadataMiddleware.js";
 import createTempUploadMiddleware from "./createTempUploadMiddleware.js";
@@ -57,7 +57,7 @@ const addContext = async function middlewareWithContext(req, res, next) {
                 tokenExpires: new Date(req.session?.cookie._expires),
             };
             await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-            user._inLoginMethodResponse = true;
+            user[IN_LOGIN_RESPONSE] = true;
             return { user, ...tokenObject };
         };
         const logout = async (sessionId) => {

package/lib/fastify/index.js

@@ -1,4 +1,4 @@
-import { getCurrentContextResolver } from "../context.js";
+import { getCurrentContextResolver, IN_LOGIN_RESPONSE, } from "../context.js";
 import bulkImportHandler from "./bulkImportHandler.js";
 import ercMetadataHandler from "./ercMetadataHandler.js";
 import MongoStore from "../mongo-store.js";
@@ -36,7 +36,7 @@ const middlewareHook = async function middlewareHook(req, reply) {
             tokenExpires: new Date(req.session.cookie._expires),
         };
         await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-        user._inLoginMethodResponse = true;
+        user[IN_LOGIN_RESPONSE] = true;
         return { user, ...tokenObject };
     };
     const logout = async function logout() {

package/lib/loaders/index.d.ts

@@ -171,6 +171,11 @@ declare const loaders: (unchainedAPI: UnchainedCore) => {
     }, import("@unchainedshop/core-quotations").Quotation | null, {
         quotationId: string;
     }>;
+    tokenExportStatusLoader: import("dataloader")<{
+        token: import("@unchainedshop/core-warehousing").TokenSurrogate;
+    }, import("@unchainedshop/core-warehousing").TokenStatus, {
+        token: import("@unchainedshop/core-warehousing").TokenSurrogate;
+    }>;
 };
 export type UnchainedLoaders = Awaited<ReturnType<typeof loaders>>;
 export default loaders;

package/lib/loaders/index.js

@@ -27,6 +27,7 @@ import paymentProviderLoader from "./paymentProviderLoader.js";
 import warehousingProviderLoader from "./warehousingProviderLoader.js";
 import orderLoader from "./orderLoader.js";
 import quotationLoader from "./quotationLoader.js";
+import tokenExportStatusLoader from "./tokenExportStatusLoader.js";
 const loaders = (unchainedAPI) => {
     return {
         assortmentLoader: assortmentLoader(unchainedAPI),
@@ -58,6 +59,7 @@ const loaders = (unchainedAPI) => {
         warehousingProviderLoader: warehousingProviderLoader(unchainedAPI),
         orderLoader: orderLoader(unchainedAPI),
         quotationLoader: quotationLoader(unchainedAPI),
+        tokenExportStatusLoader: tokenExportStatusLoader(unchainedAPI),
     };
 };
 export default loaders;

package/lib/loaders/tokenExportStatusLoader.d.ts

@@ -0,0 +1,9 @@
+import type { UnchainedCore } from '@unchainedshop/core';
+import type { TokenSurrogate, TokenStatus as TokenStatusType } from '@unchainedshop/core-warehousing';
+import DataLoader from 'dataloader';
+declare const _default: (unchainedAPI: UnchainedCore) => DataLoader<{
+    token: TokenSurrogate;
+}, TokenStatusType, {
+    token: TokenSurrogate;
+}>;
+export default _default;

package/lib/loaders/tokenExportStatusLoader.js

@@ -0,0 +1,31 @@
+import { TokenStatus } from '@unchainedshop/core-warehousing';
+import { WorkStatus } from '@unchainedshop/core-worker';
+import DataLoader from 'dataloader';
+export default (unchainedAPI) => new DataLoader(async (queries) => {
+    const tokensNeedingWorkCheck = [];
+    for (const { token } of queries) {
+        if (!(token.walletAddress && !token.userId)) {
+            tokensNeedingWorkCheck.push(token);
+        }
+    }
+    let exportingTokenIds;
+    if (tokensNeedingWorkCheck.length > 0) {
+        const workItems = await unchainedAPI.modules.worker.findWorkQueue({
+            types: ['EXPORT_TOKEN'],
+            status: [WorkStatus.NEW, WorkStatus.ALLOCATED],
+        });
+        exportingTokenIds = new Set(workItems.map((item) => item.input?.token?._id).filter(Boolean));
+    }
+    else {
+        exportingTokenIds = new Set();
+    }
+    return queries.map(({ token }) => {
+        if (token.walletAddress && !token.userId) {
+            return TokenStatus.DECENTRALIZED;
+        }
+        if (exportingTokenIds.has(token._id)) {
+            return TokenStatus.EXPORTING;
+        }
+        return TokenStatus.CENTRALIZED;
+    });
+});

package/lib/resolvers/mutations/users/setRoles.js

@@ -1,4 +1,5 @@
 import { log } from '@unchainedshop/logger';
+import { Roles } from '@unchainedshop/roles';
 import { InvalidIdError, UserNotFoundError } from "../../../errors.js";
 export default async function setRoles(root, params, { modules, userId }) {
     const foreignUserId = params.userId;
@@ -7,5 +8,9 @@ export default async function setRoles(root, params, { modules, userId }) {
         throw new InvalidIdError({ foreignUserId });
     if (!(await modules.users.userExists({ userId: foreignUserId })))
         throw new UserNotFoundError({ userId: foreignUserId });
+    const invalidRoles = params.roles.filter((role) => !Roles.roles[role]);
+    if (invalidRoles.length > 0) {
+        throw new Error(`Invalid role names: ${invalidRoles.join(', ')}`);
+    }
     return modules.users.updateRoles(foreignUserId, params.roles);
 }

package/lib/resolvers/type/index.d.ts

@@ -776,12 +776,12 @@ declare const types: {
     Token: {
         product: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, { loaders }: import("../../context.ts").Context) => Promise<import("@unchainedshop/core-products").Product>;
         user: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, { loaders }: import("../../context.ts").Context) => Promise<import("@unchainedshop/core-users").User | null>;
-        status: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, { services }: import("../../context.ts").Context) => Promise<import("@unchainedshop/core-warehousing").TokenStatus>;
+        status: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, { loaders }: import("../../context.ts").Context) => Promise<import("@unchainedshop/core-warehousing").TokenStatus>;
         ercMetadata: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, { forceLocale }: {
             forceLocale: string;
         }, context: import("../../context.ts").Context) => Promise<any>;
-        isInvalidateable: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, _params: never, { services }: import("../../context.ts").Context) => Promise<boolean>;
-        accessKey: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, requestContext: import("../../context.ts").Context) => Promise<string | null>;
+        isInvalidateable: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, _params: never, { loaders, services }: import("../../context.ts").Context) => Promise<boolean>;
+        accessKey: (token: import("@unchainedshop/core-warehousing").TokenSurrogate, params: never, requestContext: import("../../context.ts").Context) => Promise<string>;
     };
     User: import("./user-types.ts").UserHelperTypes;
     WebAuthnCredentials: {

package/lib/resolvers/type/login-method-response-types.js

@@ -1,6 +1,7 @@
+import { IN_LOGIN_RESPONSE } from "../../context.js";
 export const LoginMethodResponse = {
     user({ user }) {
-        user._inLoginMethodResponse = true;
+        user[IN_LOGIN_RESPONSE] = true;
         return user;
     },
 };

package/lib/resolvers/type/token-types.d.ts

@@ -3,10 +3,10 @@ import type { TokenSurrogate } from '@unchainedshop/core-warehousing';
 export declare const Token: {
     product: (token: TokenSurrogate, params: never, { loaders }: Context) => Promise<import("@unchainedshop/core-products").Product>;
     user: (token: TokenSurrogate, params: never, { loaders }: Context) => Promise<import("@unchainedshop/core-users").User | null>;
-    status: (token: TokenSurrogate, params: never, { services }: Context) => Promise<import("@unchainedshop/core-warehousing").TokenStatus>;
+    status: (token: TokenSurrogate, params: never, { loaders }: Context) => Promise<import("@unchainedshop/core-warehousing").TokenStatus>;
     ercMetadata: (token: TokenSurrogate, { forceLocale }: {
         forceLocale: string;
     }, context: Context) => Promise<any>;
-    isInvalidateable: (token: TokenSurrogate, _params: never, { services }: Context) => Promise<boolean>;
-    accessKey: (token: TokenSurrogate, params: never, requestContext: Context) => Promise<string | null>;
+    isInvalidateable: (token: TokenSurrogate, _params: never, { loaders, services }: Context) => Promise<boolean>;
+    accessKey: (token: TokenSurrogate, params: never, requestContext: Context) => Promise<string>;
 };

package/lib/resolvers/type/token-types.js

@@ -9,8 +9,8 @@ export const Token = {
             return null;
         return loaders.userLoader.load({ userId: token.userId });
     },
-    status: async (token, params, { services }) => {
-        return services.warehousing.resolveTokenStatus({ token });
+    status: async (token, params, { loaders }) => {
+        return loaders.tokenExportStatusLoader.load({ token });
     },
     ercMetadata: async (token, { forceLocale }, context) => {
         const { loaders, services } = context;
@@ -21,12 +21,13 @@ export const Token = {
             locale: forceLocale ? new Intl.Locale(forceLocale) : context.locale,
         });
     },
-    isInvalidateable: async (token, _params, { services }) => {
-        return services.warehousing.isTokenInvalidateable({ token });
+    isInvalidateable: async (token, _params, { loaders, services }) => {
+        const product = await loaders.productLoader.load({ productId: token.productId });
+        return services.warehousing.isTokenInvalidateable({ token, product });
     },
     accessKey: async (token, params, requestContext) => {
         const { modules } = requestContext;
         await checkAction(requestContext, actions.updateToken, [undefined, { tokenId: token._id }]);
-        return modules.warehousing.buildAccessKeyForToken(token._id);
+        return modules.warehousing.buildAccessKeyFromToken(token);
     },
 };

package/lib/roles/all.js

@@ -1,6 +1,8 @@
+import { timingSafeStringEqual } from '@unchainedshop/utils';
+import { IN_LOGIN_RESPONSE } from "../context.js";
 export const all = (role, actions) => {
     const isInLoginMutationResponse = (root) => {
-        if (root && root._inLoginMethodResponse) {
+        if (root && root[IN_LOGIN_RESPONSE]) {
             return true;
         }
         return false;
@@ -18,8 +20,8 @@ export const all = (role, actions) => {
         if (isOwnedByUser)
             return true;
         const accessKeyHeader = context.getHeader('x-token-accesskey');
-        const accessKey = await context.modules.warehousing.buildAccessKeyForToken(tokenId);
-        if (accessKeyHeader && accessKeyHeader === accessKey)
+        const accessKey = await context.modules.warehousing.buildAccessKeyFromToken(token);
+        if (accessKeyHeader && accessKey && (await timingSafeStringEqual(accessKeyHeader, accessKey)))
             return true;
         return false;
     };
@@ -145,6 +147,6 @@ export const all = (role, actions) => {
     role.allow(actions.createUser, () => true);
     role.allow(actions.forgotPassword, () => true);
     role.allow(actions.resetPassword, () => true);
-    role.allow(actions.changePassword, () => true);
+    role.allow(actions.changePassword, () => false);
     role.allow(actions.heartbeat, () => true);
 };

package/lib/roles/loggedIn.js

@@ -166,6 +166,7 @@ export const loggedIn = (role, actions) => {
     role.allow(actions.manageBookmarks, isOwnedBookmark);
     role.allow(actions.bookmarkProduct, () => true);
     role.allow(actions.voteProductReview, () => true);
+    role.allow(actions.changePassword, () => true);
     role.allow(actions.registerPaymentCredentials, () => true);
     role.allow(actions.managePaymentCredentials, isOwnedPaymentCredential);
     role.allow(actions.confirmMediaUpload, () => true);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "4.8.4",
+  "version": "4.8.9",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",