@unchainedshop/api 4.8.4 → 5.0.0-alpha.1

package/lib/resolvers/queries/index.js

@@ -141,10 +141,10 @@ export default {
     event: acl(actions.viewEvent)(event),
     events: acl(actions.viewEvents)(events),
     eventsCount: acl(actions.viewEvents)(eventsCount),
-    registeredEventTypes: acl(actions.viewEvents)(registeredEventTypes),
     validateResetPasswordToken: acl(actions.resetPassword)(validateResetPasswordToken),
     validateVerifyEmailToken: acl(actions.verifyEmail)(validateVerifyEmailToken),
     workStatistics: acl(actions.viewStatistics)(workStatistics),
+    registeredEventTypes: acl(actions.viewEvents)(registeredEventTypes),
     eventStatistics: acl(actions.viewStatistics)(eventStatistics),
     orderStatistics: acl(actions.viewStatistics)(orderStatistics),
 };

package/lib/resolvers/type/index.d.ts

@@ -330,7 +330,6 @@ declare const types: {
     };
     OrderDeliveryPickUp: {
         activePickUpLocation(orderDelivery: import("@unchainedshop/core-orders").OrderDelivery, _: never, requestContext: import("../../context.ts").Context): Promise<import("@unchainedshop/core-delivery").DeliveryLocation | null>;
-        pickUpLocations(obj: import("@unchainedshop/core-orders").OrderDelivery, _: never, context: import("../../context.ts").Context): Promise<import("@unchainedshop/core-delivery").DeliveryLocation[]>;
         provider(obj: import("@unchainedshop/core-orders").OrderDelivery, _: never, { loaders }: import("../../context.ts").Context): Promise<import("@unchainedshop/core-delivery").DeliveryProvider>;
         status(obj: import("@unchainedshop/core-orders").OrderDelivery, _: never, { modules }: import("../../context.ts").Context): import("@unchainedshop/core-orders").OrderDeliveryStatus;
         discounts(obj: import("@unchainedshop/core-orders").OrderDelivery, _: never, { loaders }: import("../../context.ts").Context): Promise<{

package/lib/resolvers/type/login-method-response-types.js

@@ -1,6 +1,7 @@
+import { IN_LOGIN_RESPONSE } from "../../context.js";
 export const LoginMethodResponse = {
     user({ user }) {
-        user._inLoginMethodResponse = true;
+        user[IN_LOGIN_RESPONSE] = true;
         return user;
     },
 };

package/lib/resolvers/type/order/order-delivery-pickup-types.d.ts

@@ -2,7 +2,6 @@ import type { Context } from '../../../context.ts';
 import type { OrderDelivery } from '@unchainedshop/core-orders';
 export declare const OrderDeliveryPickUp: {
     activePickUpLocation(orderDelivery: OrderDelivery, _: never, requestContext: Context): Promise<import("@unchainedshop/core-delivery").DeliveryLocation | null>;
-    pickUpLocations(obj: OrderDelivery, _: never, context: Context): Promise<import("@unchainedshop/core-delivery").DeliveryLocation[]>;
     provider(obj: OrderDelivery, _: never, { loaders }: Context): Promise<import("@unchainedshop/core-delivery").DeliveryProvider>;
     status(obj: OrderDelivery, _: never, { modules }: Context): import("@unchainedshop/core-orders").OrderDeliveryStatus;
     discounts(obj: OrderDelivery, _: never, { loaders }: Context): Promise<{

package/lib/resolvers/type/order/order-delivery-pickup-types.js

@@ -8,13 +8,6 @@ export const OrderDeliveryPickUp = {
         const director = await DeliveryDirector.actions(provider, { orderDelivery: orderDelivery }, requestContext);
         return director.pickUpLocationById(orderPickUpLocationId);
     },
-    async pickUpLocations(obj, _, context) {
-        const provider = await context.loaders.deliveryProviderLoader.load({
-            deliveryProviderId: obj.deliveryProviderId,
-        });
-        const director = await DeliveryDirector.actions(provider, { orderDelivery: obj }, context);
-        return director.pickUpLocations();
-    },
     async provider(obj, _, { loaders }) {
         return loaders.deliveryProviderLoader.load({
             deliveryProviderId: obj.deliveryProviderId,

package/lib/resolvers/type/shop-types.js

@@ -12,6 +12,6 @@ export const Shop = {
     },
     userRoles: async (_root, _params, context) => {
         await checkAction(context, actions.manageUsers);
-        return getPublicRoles();
+        return getPublicRoles(context.roles);
     },
 };

package/lib/resolvers/type/user-types.js

@@ -1,4 +1,4 @@
-import { Roles, permissions } from '@unchainedshop/roles';
+import { permissions } from '@unchainedshop/roles';
 import { checkAction, checkTypeResolver } from "../../acl.js";
 import { actions } from "../../roles/index.js";
 const { viewUserPrivateInfos, viewUserPublicInfos, viewUserOrders, viewUserEnrollments, viewUserQuotations, viewUserProductReviews, } = actions;
@@ -90,8 +90,8 @@ export const User = {
     },
     allowedActions: async (user, params, context) => {
         await checkAction(context, viewUserPrivateInfos, [user, params]);
-        const userRoles = Roles.getUserRoles(user?._id, user.roles, true);
-        return permissions(userRoles, context.roles);
+        const userRoles = context.roles.getUserRoles(user?._id, user.roles, true);
+        return permissions(userRoles, context.roles.roles);
     },
     orders: async (user, params, context) => {
         await checkAction(context, viewUserOrders, [user, params]);

package/lib/roles/all.js

@@ -1,6 +1,8 @@
+import { timingSafeStringEqual } from '@unchainedshop/utils';
+import { IN_LOGIN_RESPONSE } from "../context.js";
 export const all = (role, actions) => {
     const isInLoginMutationResponse = (root) => {
-        if (root && root._inLoginMethodResponse) {
+        if (root && root[IN_LOGIN_RESPONSE]) {
             return true;
         }
         return false;
@@ -19,7 +21,7 @@ export const all = (role, actions) => {
             return true;
         const accessKeyHeader = context.getHeader('x-token-accesskey');
         const accessKey = await context.modules.warehousing.buildAccessKeyForToken(tokenId);
-        if (accessKeyHeader && accessKeyHeader === accessKey)
+        if (accessKeyHeader && accessKey && (await timingSafeStringEqual(accessKeyHeader, accessKey)))
             return true;
         return false;
     };
@@ -145,6 +147,6 @@ export const all = (role, actions) => {
     role.allow(actions.createUser, () => true);
     role.allow(actions.forgotPassword, () => true);
     role.allow(actions.resetPassword, () => true);
-    role.allow(actions.changePassword, () => true);
+    role.allow(actions.changePassword, () => false);
     role.allow(actions.heartbeat, () => true);
 };

package/lib/roles/index.d.ts

@@ -1,16 +1,9 @@
-declare const allRoles: {
-    ADMIN: import("@unchainedshop/roles").RoleInterface | undefined;
-    LOGGEDIN: import("@unchainedshop/roles").RoleInterface | undefined;
-    ALL: import("@unchainedshop/roles").RoleInterface | undefined;
-};
+import { type RolesInterface } from '@unchainedshop/roles';
 declare const actions: Record<string, string>;
+declare let allRoles: Record<string, any>;
 declare const configureRoles: ({ additionalRoles, additionalActions, }: {
     additionalRoles?: Record<string, any>;
     additionalActions?: string[];
-}) => {
-    ADMIN: import("@unchainedshop/roles").RoleInterface | undefined;
-    LOGGEDIN: import("@unchainedshop/roles").RoleInterface | undefined;
-    ALL: import("@unchainedshop/roles").RoleInterface | undefined;
-};
-declare const getPublicRoles: () => string[];
+}) => RolesInterface;
+declare const getPublicRoles: (roles: RolesInterface) => string[];
 export { allRoles, actions, configureRoles, getPublicRoles };

package/lib/roles/index.js

@@ -1,13 +1,7 @@
-import { Roles, Role } from '@unchainedshop/roles';
+import { createRoles, Role } from '@unchainedshop/roles';
 import { all } from "./all.js";
 import { loggedIn } from "./loggedIn.js";
 import { admin } from "./admin.js";
-const roles = {
-    ADMIN: Roles.adminRole,
-    LOGGEDIN: Roles.loggedInRole,
-    ALL: Roles.allRole,
-};
-const allRoles = roles;
 const actions = [
     'impersonate',
     'stopImpersonation',
@@ -101,6 +95,7 @@ const actions = [
     'managePaymentCredentials',
     'bulkImport',
     'logout',
+    'logoutAllSessions',
     'loginAsGuest',
     'loginWithPassword',
     'loginWithWebAuthn',
@@ -124,21 +119,31 @@ const actions = [
     newValue[actionValue] = actionValue;
     return newValue;
 }, {});
+let allRoles = {};
 const configureRoles = ({ additionalRoles, additionalActions, }) => {
+    const roles = createRoles();
+    roles.adminRole = roles.addRole(new Role('admin'));
+    roles.loggedInRole = roles.addRole(new Role('__loggedIn__'));
+    roles.allRole = roles.addRole(new Role('__all__'));
     additionalActions?.forEach((action) => {
         actions[action] = action;
     });
+    allRoles = {
+        ADMIN: roles.adminRole,
+        LOGGEDIN: roles.loggedInRole,
+        ALL: roles.allRole,
+    };
     Object.entries(additionalRoles || {}).forEach(([key, val]) => {
-        allRoles[key] = new Role(key);
+        allRoles[key] = roles.addRole(new Role(key));
         val(allRoles[key], actions);
     });
     all(allRoles.ALL, actions);
     loggedIn(allRoles.LOGGEDIN, actions);
     admin(allRoles.ADMIN, actions);
-    return allRoles;
+    return roles;
 };
-const getPublicRoles = () => {
-    return Object.values(allRoles)
+const getPublicRoles = (roles) => {
+    return Object.values(roles.roles)
         .map((role) => role?.name)
         .filter(Boolean)
         .filter((name) => !name.startsWith('__'));

package/lib/roles/loggedIn.js

@@ -172,4 +172,6 @@ export const loggedIn = (role, actions) => {
     role.allow(actions.downloadFile, isFileAccessible);
     role.allow(actions.uploadUserAvatar, canUpdateAvatar);
     role.allow(actions.uploadTempFile, canUpdateAvatar);
+    role.allow(actions.changePassword, () => true);
+    role.allow(actions.logoutAllSessions, () => true);
 };

package/lib/schema/mutation.js

@@ -57,6 +57,12 @@ export default [
       """
       logout: SuccessResponse
 
+      """
+      Log the user out of all sessions by invalidating all JWT tokens.
+      This increments the token version, making all existing tokens invalid.
+      """
+      logoutAllSessions: SuccessResponse
+
       """
       Impersonate a user
       """
@@ -221,20 +227,6 @@ export default [
       """
       terminateEnrollment(enrollmentId: ID!): Enrollment!
 
-      """
-      Change the delivery method/provider to an order. If the delivery provider
-      doesn’t exists new delivery provider will be created with the provided ID.
-      """
-      setOrderDeliveryProvider(orderId: ID!, deliveryProviderId: ID!): Order!
-        @deprecated(reason: "Use updateCart or updateCartDelivery* mutations instead")
-
-      """
-      Change the payment method/provider to an order. If the payment provider
-      doesn’t exists new payment provider will be created with the provided ID.
-      """
-      setOrderPaymentProvider(orderId: ID!, paymentProviderId: ID!): Order!
-        @deprecated(reason: "Use updateCart or updateCartPayment* mutations instead")
-
       """
       Update the cart by changing the delivery provider and using a shipping specific configuration
       """
@@ -265,36 +257,6 @@ export default [
       """
       updateCartPaymentGeneric(orderId: ID, paymentProviderId: ID!, meta: JSON): Order!
 
-      """
-      Update a Shipping Delivery Provider's specific configuration
-      """
-      updateOrderDeliveryShipping(
-        orderDeliveryId: ID!
-        address: AddressInput
-        meta: JSON
-      ): OrderDeliveryShipping! @deprecated(reason: "Use updateCartDeliveryShipping instead")
-
-      """
-      Update a Pick Up Delivery Provider's specific configuration
-      """
-      updateOrderDeliveryPickUp(
-        orderDeliveryId: ID!
-        orderPickUpLocationId: ID!
-        meta: JSON
-      ): OrderDeliveryPickUp! @deprecated(reason: "Use updateCartDeliveryPickUp instead")
-
-      """
-      Update an Invoice Payment Provider's specific configuration
-      """
-      updateOrderPaymentInvoice(orderPaymentId: ID!, meta: JSON): OrderPaymentInvoice!
-        @deprecated(reason: "Use updateCartPaymentInvoice instead")
-
-      """
-      Update a Generic Payment Provider's specific configuration
-      """
-      updateOrderPaymentGeneric(orderPaymentId: ID!, meta: JSON): OrderPaymentGeneric!
-        @deprecated(reason: "Use updateCartPaymentGeneric instead")
-
       """
       Remove an order while it's still open
       """

package/lib/schema/query.js

@@ -491,11 +491,6 @@ export default [
       """
       eventsCount(types: [String!], queryString: String, created: DateFilterInput): Int!
 
-      """
-      Get all registered event types
-      """
-      registeredEventTypes: [String!]!
-
       """
       Determines if a token is valid/active for reset password
       """
@@ -506,6 +501,11 @@ export default [
       """
       validateVerifyEmailToken(token: String!): Boolean!
 
+      """
+      Get all registered event types
+      """
+      registeredEventTypes: [String!]!
+
       """
       Returns aggregated report of all the events that occurred in the system
       """

package/lib/schema/types/index.js

@@ -15,7 +15,7 @@ import price from "./price.js";
 import payment from "./payment.js";
 import shop from "./shop.js";
 import stock from "./stock.js";
-import types from "./types.js";
+import common from "./common.js";
 import user from "./user.js";
 import warehousing from "./warehousing.js";
 import order from "./order/index.js";
@@ -46,7 +46,7 @@ export default [
     ...payment,
     ...shop,
     ...stock,
-    ...types,
+    ...common,
     ...user,
     ...warehousing,
     ...product,

package/lib/schema/types/order/delivery.js

@@ -33,8 +33,6 @@ export default [
       delivered: DateTime
       fee: Price
       discounts: [OrderDeliveryDiscount!]
-      pickUpLocations: [PickUpLocation!]!
-        @deprecated(reason: "Use DeliveryProvider.pickupLocations instead")
       activePickUpLocation: PickUpLocation
     }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "4.8.4",
+  "version": "5.0.0-alpha.1",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -63,22 +63,20 @@
     "@ai-sdk/mcp": "^1",
     "@fastify/cookie": ">= 11 < 12",
     "@fastify/multipart": ">= 9 < 10",
-    "@fastify/session": ">= 11 < 12",
     "@fastify/static": ">= 9 < 10",
     "@modelcontextprotocol/sdk": ">= 1 < 2",
     "ai": ">= 6 < 7",
+    "cookie-parser": ">= 1.4 < 2",
     "express": ">= 5 < 6",
-    "express-session": ">= 1.18 < 2",
     "fastify": ">= 5.2 < 6",
     "graphql-yoga": ">= 5.9 < 6",
-    "multer": ">= 2 < 3",
-    "passport": ">= 0.7 < 1"
+    "multer": ">= 2 < 3"
   },
   "peerDependenciesMeta": {
     "graphql-yoga": {
       "optional": false
     },
-    "express-session": {
+    "cookie-parser": {
       "optional": false
     },
     "@modelcontextprotocol/sdk": {
@@ -99,9 +97,6 @@
     "@fastify/multipart": {
       "optional": true
     },
-    "@fastify/session": {
-      "optional": true
-    },
     "@fastify/static": {
       "optional": true
     },
@@ -110,40 +105,35 @@
     },
     "multer": {
       "optional": true
-    },
-    "passport": {
-      "optional": true
     }
   },
   "dependencies": {
-    "@unchainedshop/core": "^4.6.0",
-    "@unchainedshop/events": "^4.6.0",
-    "@unchainedshop/logger": "^4.6.0",
-    "@unchainedshop/roles": "^4.6.0",
-    "@unchainedshop/utils": "^4.6.0",
+    "@unchainedshop/core": "^5.0.0-alpha.1",
+    "@unchainedshop/events": "^5.0.0-alpha.1",
+    "@unchainedshop/logger": "^5.0.0-alpha.1",
+    "@unchainedshop/roles": "^5.0.0-alpha.1",
+    "@unchainedshop/utils": "^5.0.0-alpha.1",
+    "@whatwg-node/server": "^0.10.18",
     "dataloader": "^2.2.3",
-    "expiry-map": "^2.0.0",
     "graphql-scalars": "^1.24.2",
+    "jose": "^6.0.10",
     "mime": ">= 4 < 5",
-    "p-memoize": "^8.0.0",
     "zod": "^3.25.76 || ^4"
   },
   "devDependencies": {
     "@ai-sdk/mcp": "^1.0.5",
     "@fastify/cookie": "^11.0.2",
     "@fastify/multipart": "^9.0.3",
-    "@fastify/session": "^11.1.0",
     "@fastify/static": "^9.0.0",
     "@modelcontextprotocol/sdk": "^1.15.1",
+    "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.3",
-    "@types/express-session": "^1.18.2",
     "@types/node": "^25.0.0",
     "ai": "^6.0.14",
+    "cookie-parser": "^1.4.7",
     "express": "^5.1.0",
-    "express-session": "^1.18.1",
     "fastify": "^5.4.0",
     "multer": "^2.0.1",
-    "passport": "^0.7.0",
     "typescript": "^5.8.3"
   }
 }