@unchainedshop/api 4.8.4 → 5.0.0-alpha.1

package/lib/acl.d.ts

@@ -2,11 +2,11 @@ import type { CheckPermissionArgs } from '@unchainedshop/roles';
 export declare const ensureActionExists: (action: any, userOptions: any) => void;
 export declare const ensureIsFunction: (fn: any, action: any, options: any, key: any) => void;
 declare const checkAction: (context: any, action: any, args?: CheckPermissionArgs, options?: any) => Promise<void>;
-declare const checkResolver: (action: any, userOptions?: any) => (fn: any, name?: string) => (root: any, params: any, context: any, info: any) => Promise<any>;
+declare const checkResolver: (action: any, userOptions?: any) => (fn: any, name?: string) => (root: any, params: any, context: any, ...other: any[]) => Promise<any>;
 declare const checkTypeResolver: (action: any, key: any) => (obj: any, params: any, context: any) => Promise<any>;
 declare const resolverDecorator: (action: any, userOptions?: any) => (target: any, key: any, descriptor: any) => {
     configurable: boolean;
-    get(): (root: any, params: any, context: any, info: any) => Promise<any>;
+    get(): (root: any, params: any, context: any, ...other: any[]) => Promise<any>;
 };
 export default resolverDecorator;
 export { resolverDecorator, checkResolver, checkTypeResolver, checkAction };

package/lib/acl.js

@@ -1,5 +1,16 @@
-import { Roles } from '@unchainedshop/roles';
+import { emit } from '@unchainedshop/events';
 import { NoPermissionError, PermissionSystemError } from "./errors.js";
+import { API_EVENTS } from "./events.js";
+const SENSITIVE_ACTION_PREFIXES = [
+    'manageUser',
+    'login',
+    'logout',
+    'reset',
+    'forgot',
+    'impersonate',
+    'updateUser',
+    'createUser',
+];
 const defaultOptions = {
     showKey: true,
     mapArgs: (...args) => args,
@@ -19,11 +30,27 @@ export const ensureIsFunction = (fn, action, options, key) => {
         });
     }
 };
+const isSensitiveAction = (action) => {
+    return SENSITIVE_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix));
+};
 const checkAction = async (context, action, args = emptyArray, options = emptyObject) => {
     const { key } = options || emptyObject;
-    const hasPermission = await Roles.userHasPermission(context, action, args);
-    if (hasPermission)
+    const hasPermission = await context.roles.userHasPermission(context, action, args);
+    if (hasPermission) {
+        if (isSensitiveAction(action)) {
+            await emit(API_EVENTS.ACL_GRANTED_SENSITIVE, {
+                userId: context.userId,
+                action,
+                key,
+            });
+        }
         return;
+    }
+    await emit(API_EVENTS.ACL_DENIED, {
+        userId: context.userId,
+        action,
+        key,
+    });
     const keyText = key && key !== '' ? ` in "${key}"` : '';
     throw new NoPermissionError({
         userId: context.userId,
@@ -36,11 +63,12 @@ const wrapFunction = (fn, name, action, userOptions) => {
     const key = name || fn.name;
     const options = { ...defaultOptions, ...userOptions };
     ensureIsFunction(fn, action, options, key);
-    const actionOptions = { key: options.showKey ? key : '' };
-    return async (root, params, context, info) => {
-        const args = options.mapArgs(root, params, info);
-        await checkAction(context, action, args, actionOptions);
-        return fn(root, params, context, info);
+    return async (root, params, context, ...other) => {
+        const args = options.mapArgs(root, params, ...other);
+        await checkAction(context, action, args, {
+            key: options.showKey ? key : '',
+        });
+        return fn(root, params, context, ...other);
     };
 };
 const checkResolver = (action, userOptions) => {

package/lib/api-index.d.ts

@@ -8,9 +8,11 @@ export * from './loaders/index.ts';
 export * from './errors.ts';
 export * as acl from './acl.ts';
 export * as roles from './roles/index.ts';
+export type { OIDCProviderConfig, AuthConfig } from './auth.ts';
 export { createContextResolver, getCurrentContextResolver, setCurrentContextResolver };
+import type { RolesInterface } from '@unchainedshop/roles';
 export type UnchainedServerOptions = {
-    roles?: any;
+    roles?: RolesInterface;
     adminUiConfig?: AdminUiConfig;
     unchainedAPI: UnchainedCore;
     context?: (defaultResolver: UnchainedContextResolver) => UnchainedContextResolver;

package/lib/chat/generateImageHandler.js

@@ -1,4 +1,4 @@
-import { z } from 'zod/v4-mini';
+import { z } from 'zod';
 import mime from 'mime/lite';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
@@ -12,9 +12,9 @@ try {
 catch {
 }
 const inputSchema = z.object({
-    prompt: z.string().check(z.describe('The prompt to generate the image from')),
+    prompt: z.string().describe('The prompt to generate the image from'),
     size: z
-        .optional(z.enum([
+        .enum([
         '512x512',
         '768x768',
         '1024x1024',
@@ -26,8 +26,9 @@ const inputSchema = z.object({
         '1120x640',
         '1344x768',
         '1792x1024',
-    ]))
-        .check(z.describe('The size of the image (default is 1024x1024).')),
+    ])
+        .optional()
+        .describe('The size of the image (default is 1024x1024).'),
 });
 const generateImageHandler = (req) => ({ model, uploadUrl = `${process.env.ROOT_URL}/temp-upload`, }) => {
     return tool({

package/lib/context.d.ts

@@ -1,8 +1,10 @@
 import type { UnchainedCore } from '@unchainedshop/core';
+import type { RolesInterface } from '@unchainedshop/roles';
 import { type UnchainedLoaders } from './loaders/index.ts';
 import { type UnchainedLocaleContext } from './locale-context.ts';
 import type { UnchainedServerOptions } from './api-index.ts';
 import type { User } from '@unchainedshop/core-users';
+export declare const IN_LOGIN_RESPONSE: unique symbol;
 export type LoginFn = (user: User, options?: {
     impersonator?: User;
 }) => Promise<{
@@ -16,6 +18,7 @@ export interface UnchainedUserContext {
     userId?: string;
     impersonatorId?: string;
     accessToken?: string;
+    tokenVersion?: number;
     user?: User;
 }
 export interface CustomAdminUiProperties {
@@ -37,7 +40,7 @@ export interface UnchainedHTTPServerContext {
 }
 export type Context = UnchainedCore & {
     version?: string;
-    roles?: any;
+    roles?: RolesInterface;
     adminUiConfig?: AdminUiConfig;
     loaders: UnchainedLoaders;
 } & UnchainedUserContext & UnchainedLocaleContext & UnchainedHTTPServerContext;

package/lib/context.js

@@ -1,12 +1,13 @@
 import instantiateLoaders, {} from "./loaders/index.js";
 import { getLocaleContext } from "./locale-context.js";
+export const IN_LOGIN_RESPONSE = Symbol('inLoginMethodResponse');
 const { npm_package_version, UNCHAINED_API_VERSION } = process.env;
 let context;
 export const getCurrentContextResolver = () => context;
 export const setCurrentContextResolver = (newContext) => {
     context = newContext;
 };
-export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, login, logout, }) => {
+export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({ getHeader, setHeader, remoteAddress, remotePort, userId, impersonatorId, accessToken, tokenVersion, login, logout, }) => {
     const abstractHttpServerContext = { remoteAddress, remotePort, getHeader, setHeader };
     const loaders = instantiateLoaders(unchainedAPI);
     const localeContext = await getLocaleContext(abstractHttpServerContext, unchainedAPI);
@@ -21,8 +22,13 @@ export const createContextResolver = (unchainedAPI, unchainedConfig) => async ({
     if (userId && !userContext.userId) {
         const user = await unchainedAPI.modules.users.findUserById(userId);
         if (user) {
-            userContext.user = user;
-            userContext.userId = user._id;
+            const userTokenVersion = user.tokenVersion ?? 1;
+            if (tokenVersion !== undefined && tokenVersion !== userTokenVersion) {
+            }
+            else {
+                userContext.user = user;
+                userContext.userId = user._id;
+            }
         }
     }
     return {

package/lib/events.d.ts

@@ -1,5 +1,7 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
     readonly API_LOGOUT: "API_LOGOUT";
+    readonly ACL_DENIED: "ACL_DENIED";
+    readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";
 };
 export type API_EVENTS = (typeof API_EVENTS)[keyof typeof API_EVENTS];

package/lib/events.js

@@ -1,4 +1,6 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
     API_LOGOUT: 'API_LOGOUT',
+    ACL_DENIED: 'ACL_DENIED',
+    ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',
 };

package/lib/express/createMCPMiddleware.js

@@ -1,3 +1,4 @@
+import initMCPServer from "../mcp/index.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
 let StreamableHTTPServerTransport;
@@ -34,7 +35,6 @@ const handlePostRequest = async (req, res) => {
             }
         };
         const roles = req.unchainedContext.user?.roles || [];
-        const { default: initMCPServer } = await import("../mcp/index.js");
         const server = initMCPServer(new McpServer({
             name: 'Unchained MCP Server',
             version: '1.0.0',

package/lib/express/index.d.ts

@@ -1,7 +1,7 @@
 import e from 'express';
 import type { YogaServerInstance } from 'graphql-yoga';
-import { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
+import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
 export interface AdminUIRouterOptions {
@@ -9,17 +9,14 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const adminUIRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
-export declare const connect: (expressApp: e.Express, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (expressApp: e.Express, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: e.Express, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
-export declare const expressRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export { connectChat };

package/lib/express/index.js

@@ -1,17 +1,12 @@
 import e from 'express';
-import session from 'express-session';
-import multer from 'multer';
-import MongoStore from "../mongo-store.js";
-import { Passport } from 'passport';
-import { mongodb } from '@unchainedshop/mongodb';
-import { emit } from '@unchainedshop/events';
+import cookieParser from 'cookie-parser';
+import { pluginRegistry } from '@unchainedshop/core';
 import { getCurrentContextResolver } from "../context.js";
-import createBulkImportMiddleware from "./createBulkImportMiddleware.js";
-import createERCMetadataMiddleware from "./createERCMetadataMiddleware.js";
-import createTempUploadMiddleware from "./createTempUploadMiddleware.js";
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
-import { API_EVENTS } from "../events.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
 export const adminUIRouter = (enabled = true) => {
     const router = e.Router();
     const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -24,87 +19,53 @@ export const adminUIRouter = (enabled = true) => {
     }
     return router;
 };
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const storage = multer.memoryStorage();
-const upload = multer({ storage: storage });
-const { BULK_IMPORT_API_PATH = '/bulk-import', ERC_METADATA_API_PATH = '/erc-metadata', TEMP_UPLOAD_API_PATH = '/temp-upload', MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const addContext = async function middlewareWithContext(req, res, next) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createAddContextMiddleware = (authConfig, trustProxy = false) => async function middlewareWithContext(req, res, next) {
     try {
         const setHeader = (key, value) => res.setHeader(key, value);
         const getHeader = (key) => req.headers[key];
-        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-        const context = getCurrentContextResolver();
-        const login = async (user, options = {}) => {
-            const { impersonator } = options;
-            await new Promise((resolve, reject) => {
-                req.login(user, (error, result) => {
-                    if (error) {
-                        return reject(error);
-                    }
-                    req.session.impersonatorId = impersonator?._id;
-                    return resolve(result);
-                });
-            });
-            const tokenObject = {
-                _id: req.sessionID,
-                userId: user._id,
-                tokenExpires: new Date(req.session?.cookie._expires),
-            };
-            await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-            user._inLoginMethodResponse = true;
-            return { user, ...tokenObject };
-        };
-        const logout = async (sessionId) => {
-            const { user } = req;
-            if (!user)
-                return false;
-            const currentSessionId = req.sessionID;
-            const targetSessionId = sessionId || currentSessionId;
-            const tokenObject = {
-                _id: targetSessionId,
-                userId: user._id,
-            };
-            if (sessionId && sessionId !== currentSessionId) {
-                await new Promise((resolve, reject) => {
-                    req.sessionStore.destroy(sessionId, (error) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        return resolve();
-                    });
-                });
-            }
-            else {
-                await new Promise((resolve, reject) => {
-                    req.logout((error, result) => {
-                        if (error) {
-                            return reject(error);
-                        }
-                        req.session.impersonatorId = null;
-                        return resolve(result);
-                    });
-                });
-            }
-            await emit(API_EVENTS.API_LOGOUT, tokenObject);
-            return true;
+        const getCookie = (name) => req.cookies?.[name];
+        const setCookie = (name, value, options) => res.cookie(name, value, options);
+        const clearCookie = (name, options) => res.clearCookie(name, { ...options, maxAge: 0 });
+        const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+        const authContextParams = {
+            setHeader,
+            getHeader,
+            getCookie,
+            setCookie,
+            clearCookie,
+            remoteAddress,
+            remotePort,
         };
-        const [, accessToken] = req.headers.authorization?.split(' ') || [];
+        const authContext = await createAuthContext(authContextParams, authConfig);
+        const context = getCurrentContextResolver();
         req.unchainedContext = await context({
             setHeader,
             getHeader,
             remoteAddress,
             remotePort,
-            login,
-            logout,
-            accessToken,
-            userId: req.user?._id,
-            impersonatorId: req.session.impersonatorId,
+            login: authContext.login,
+            logout: authContext.logout,
+            accessToken: authContext.accessToken,
+            userId: authContext.userId,
+            impersonatorId: authContext.impersonatorId,
+            tokenVersion: authContext.tokenVersion,
         }, req, res);
         next();
     }
@@ -112,8 +73,12 @@ const addContext = async function middlewareWithContext(req, res, next) {
         next(error);
     }
 };
-export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         expressApp.set('trust proxy', 1);
         expressApp.use((req, res, next) => {
             req.headers['x-forwarded-proto'] = 'https';
@@ -125,59 +90,21 @@ export const connect = (expressApp, { graphqlHandler, db, unchainedAPI, }, { all
             next();
         });
     }
-    const passport = new Passport();
-    passport.serializeUser(function serialize(user, done) {
-        done(null, user._id);
-    });
-    passport.deserializeUser(function deserialize(_id, done) {
-        done(null, { _id });
-    });
-    const name = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
-    expressApp.use(session({
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-            touchAfter: 24 * 3600,
-        }),
-        name,
-        saveUninitialized: false,
-        resave: false,
-        cookie: {
-            domain,
-            path,
-            sameSite,
-            secure,
-            httpOnly: true,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    }), passport.initialize(), passport.session(), addContext);
-    expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
-    expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
-    expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
-    expressApp.use(TEMP_UPLOAD_API_PATH, upload.any(), createTempUploadMiddleware);
+    expressApp.use(cookieParser());
+    expressApp.use(createAddContextMiddleware(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
+    expressApp.use(graphqlHandler.graphqlEndpoint, graphqlHandler.handle);
     expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
     expressApp.use(MCP_API_PATH, createMCPMiddleware);
     if (chat) {
         connectChat(expressApp, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(expressApp, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(expressApp, unchainedAPI, routes);
     if (adminUI) {
         expressApp.use(typeof adminUI === 'object' ? adminUI.prefix : '/', adminUIRouter(true));
     }
 };
-export const expressRouter = adminUIRouter;
 export { connectChat };

package/lib/fastify/index.d.ts

@@ -1,5 +1,5 @@
+import type { AuthConfig } from '../auth.ts';
 import type { YogaServerInstance } from 'graphql-yoga';
-import type { mongodb } from '@unchainedshop/mongodb';
 import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
@@ -9,18 +9,15 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
-export declare const connect: (fastify: FastifyInstance, { graphqlHandler, db, unchainedAPI, }: {
+export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
-    db: mongodb.Db;
     unchainedAPI: UnchainedCore;
-}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, initPluginMiddlewares, }?: {
+}, { allowRemoteToLocalhostSecureCookies, adminUI, chat, authConfig, trustProxy, }?: {
     allowRemoteToLocalhostSecureCookies?: boolean;
     adminUI?: boolean | Omit<AdminUIRouterOptions, "enabled">;
     chat?: ChatConfiguration;
-    initPluginMiddlewares?: (app: FastifyInstance, { unchainedAPI }: {
-        unchainedAPI: UnchainedCore;
-    }) => void;
-}) => void;
+    authConfig?: AuthConfig;
+    trustProxy?: boolean;
+}) => Promise<void>;
 export declare const adminUIRouter: FastifyPluginAsync<AdminUIRouterOptions>;
-export declare const fastifyRouter: FastifyPluginAsync<AdminUIRouterOptions>;
 export { connectChat };