@unchainedshop/api 4.8.4 → 5.0.0-alpha.1

package/lib/fastify/index.js

@@ -1,66 +1,59 @@
 import { getCurrentContextResolver } from "../context.js";
-import bulkImportHandler from "./bulkImportHandler.js";
-import ercMetadataHandler from "./ercMetadataHandler.js";
-import MongoStore from "../mongo-store.js";
-import { emit } from '@unchainedshop/events';
-import { API_EVENTS } from "../events.js";
-import fastifySession from '@fastify/session';
+import { createAuthContext } from "../middleware/createAuthMiddleware.js";
+import { pluginRegistry } from '@unchainedshop/core';
 import fastifyCookie from '@fastify/cookie';
-import fastifyMultipart from '@fastify/multipart';
 import { createLogger } from '@unchainedshop/logger';
 import mcpHandler from "./mcpHandler.js";
-import tempUploadHandler from "./tempUploadHandler.js";
 import { connectChat } from "./chatHandler.js";
+import { mountRoutes } from "./mountRoutes.js";
 import { readFileSync } from 'node:fs';
-const resolveUserRemoteAddress = (req) => {
-    const remoteAddress = req.headers['x-real-ip'] ||
-        req.headers['x-forwarded-for'] ||
-        req.socket?.remoteAddress;
+import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
+const resolveUserRemoteAddress = (req, trustProxy = false) => {
+    let remoteAddress;
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        const forwardedIps = forwardedFor?.split(',').map((ip) => ip.trim());
+        remoteAddress =
+            req.headers['x-real-ip'] ||
+                forwardedIps?.[forwardedIps.length - 1] ||
+                req.socket?.remoteAddress;
+    }
+    else {
+        remoteAddress = req.socket?.remoteAddress;
+    }
     const remotePort = req.socket?.remotePort;
     return { remoteAddress, remotePort };
 };
-const { MCP_API_PATH = '/mcp', GRAPHQL_API_PATH = '/graphql', BULK_IMPORT_API_PATH = '/bulk-import', TEMP_UPLOAD_API_PATH = '/temp-upload', ERC_METADATA_API_PATH = '/erc-metadata/:productId/:localeOrTokenFilename/:tokenFileName?', UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'none', UNCHAINED_COOKIE_INSECURE, } = process.env;
-const middlewareHook = async function middlewareHook(req, reply) {
+const { MCP_API_PATH = '/mcp' } = process.env;
+const createMiddlewareHook = (authConfig, trustProxy = false) => async function middlewareHook(req, reply) {
     const setHeader = (key, value) => reply.header(key, value);
     const getHeader = (key) => req.headers[key];
-    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req);
-    const context = getCurrentContextResolver();
-    const login = async function (user, options = {}) {
-        const { impersonator } = options;
-        req.session.userId = user._id;
-        req.session.impersonatorId = impersonator?._id;
-        await req.session.save();
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: user._id,
-            tokenExpires: new Date(req.session.cookie._expires),
-        };
-        await emit(API_EVENTS.API_LOGIN_TOKEN_CREATED, tokenObject);
-        user._inLoginMethodResponse = true;
-        return { user, ...tokenObject };
-    };
-    const logout = async function logout() {
-        const tokenObject = {
-            _id: req.session.sessionId,
-            userId: req.session?.userId,
-        };
-        req.session.userId = null;
-        req.session.impersonatorId = null;
-        await req.session.save();
-        await emit(API_EVENTS.API_LOGOUT, tokenObject);
-        return true;
+    const getCookie = (name) => req.cookies?.[name];
+    const setCookie = (name, value, options) => reply.setCookie(name, value, options);
+    const clearCookie = (name, options) => reply.clearCookie(name, { ...options, maxAge: 0 });
+    const { remoteAddress, remotePort } = resolveUserRemoteAddress(req, trustProxy);
+    const authContextParams = {
+        setHeader,
+        getHeader,
+        getCookie,
+        setCookie,
+        clearCookie,
+        remoteAddress,
+        remotePort,
     };
-    const [, accessToken] = req.headers.authorization?.split(' ') || [];
+    const authContext = await createAuthContext(authContextParams, authConfig);
+    const context = getCurrentContextResolver();
     req.unchainedContext = await context({
         setHeader,
         getHeader,
         remoteAddress,
         remotePort,
-        login,
-        logout,
-        accessToken,
-        userId: req.session.userId,
-        impersonatorId: req.session.impersonatorId,
+        login: authContext.login,
+        logout: authContext.logout,
+        accessToken: authContext.accessToken,
+        userId: authContext.userId,
+        impersonatorId: authContext.impersonatorId,
+        tokenVersion: authContext.tokenVersion,
     }, req, reply);
 };
 export const unchainedLogger = (prefix) => {
@@ -79,8 +72,12 @@ export const unchainedLogger = (prefix) => {
     };
     return new Logger();
 };
-export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, initPluginMiddlewares, } = {}) => {
+export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
     if (allowRemoteToLocalhostSecureCookies) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
+                'Configure a proper CORS policy with specific allowed origins instead.');
+        }
         fastify.addHook('preHandler', async function (request) {
             request.headers['x-forwarded-proto'] = 'https';
         });
@@ -94,96 +91,34 @@ export const connect = (fastify, { graphqlHandler, db, unchainedAPI, }, { allowR
             });
         });
     }
-    const cookieName = UNCHAINED_COOKIE_NAME;
-    const domain = UNCHAINED_COOKIE_DOMAIN;
-    const path = UNCHAINED_COOKIE_PATH;
-    const secure = UNCHAINED_COOKIE_INSECURE ? false : true;
-    const sameSite = ({
-        none: 'none',
-        lax: 'lax',
-        strict: 'strict',
-        '1': true,
-        '0': false,
-    }[UNCHAINED_COOKIE_SAMESITE?.trim()?.toLowerCase()] || false);
     if (!fastify.hasPlugin('@fastify/cookie')) {
         fastify.register(fastifyCookie);
     }
-    fastify.register(fastifySession, {
-        secret: process.env.UNCHAINED_TOKEN_SECRET,
-        cookieName,
-        rolling: false,
-        saveUninitialized: false,
-        store: MongoStore.create({
-            client: db.client,
-            dbName: db.databaseName,
-            collectionName: 'sessions',
-        }),
-        cookie: {
-            domain,
-            httpOnly: true,
-            path,
-            secure,
-            sameSite,
-            maxAge: 1000 * 60 * 60 * 24 * 7,
-        },
-    });
     fastify.decorateRequest('unchainedContext');
-    fastify.addHook('onRequest', middlewareHook);
+    fastify.addHook('onRequest', createMiddlewareHook(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
     fastify.route({
-        url: GRAPHQL_API_PATH,
+        url: graphqlHandler.graphqlEndpoint,
         method: ['GET', 'POST', 'OPTIONS'],
         handler: async (req, reply) => {
-            const response = await graphqlHandler.handleNodeRequestAndResponse(req, reply, {
+            return graphqlHandler.handleNodeRequestAndResponse(req, reply, {
                 req,
                 reply,
             });
-            response.headers.forEach((value, key) => {
-                reply.header(key, value);
-            });
-            reply.status(response.status);
-            reply.send(response.body);
-            return reply;
         },
     });
-    fastify.route({
-        url: ERC_METADATA_API_PATH,
-        method: ['GET'],
-        handler: ercMetadataHandler,
-    });
     fastify.route({
         url: MCP_API_PATH,
         method: ['GET', 'POST', 'DELETE'],
         handler: mcpHandler,
     });
-    fastify.register((s, opts, registered) => {
-        s.register(fastifyMultipart, { throwFileSizeLimit: true, limits: { fileSize: 1024 * 1024 * 35 } });
-        s.route({
-            url: TEMP_UPLOAD_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 35,
-            handler: tempUploadHandler,
-        });
-        registered();
-    });
-    fastify.register((s, opts, registered) => {
-        s.removeAllContentTypeParsers();
-        s.addContentTypeParser('*', function (req, payload, done) {
-            done(null);
-        });
-        s.route({
-            url: BULK_IMPORT_API_PATH,
-            method: ['POST'],
-            bodyLimit: 1024 * 1024 * 1024 * 5,
-            handler: bulkImportHandler,
-        });
-        registered();
-    });
     if (chat) {
         connectChat(fastify, chat);
     }
-    if (initPluginMiddlewares) {
-        initPluginMiddlewares(fastify, { unchainedAPI });
+    const routes = pluginRegistry.getRoutes();
+    if (authConfig?.oidcProviders?.length) {
+        routes.push(createBackchannelLogoutRoute(authConfig.oidcProviders));
     }
+    mountRoutes(fastify, unchainedAPI, routes);
     if (adminUI) {
         fastify.register(adminUIRouter, {
             enabled: true,
@@ -247,5 +182,4 @@ export const adminUIRouter = async (fastify, opts) => {
         }
     }
 };
-export const fastifyRouter = adminUIRouter;
 export { connectChat };

package/lib/fastify/mcpHandler.js

@@ -1,3 +1,4 @@
+import initMCPServer from "../mcp/index.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
 let StreamableHTTPServerTransport;
@@ -44,7 +45,6 @@ const mcpHandler = async (req, res) => {
                     }
                 };
                 const roles = req.unchainedContext.user.roles || [];
-                const { default: initMCPServer } = await import("../mcp/index.js");
                 const server = initMCPServer(new McpServer({
                     name: 'Unchained MCP Server',
                     version: '1.0.0',

package/lib/loaders/buildTextMap.js

@@ -1,13 +1,16 @@
 export default function buildTextMap(localeMap, texts, buildId) {
     const textsMap = {};
     const localeMapKeys = Object.keys(localeMap);
-    for (const originLocale of localeMapKeys) {
+    for (let i = 0; i < localeMapKeys.length; i++) {
+        const originLocale = localeMapKeys[i];
         const localesForText = localeMap[originLocale];
-        for (const text of texts) {
+        for (let j = 0; j < texts.length; j++) {
+            const text = texts[j];
             if (originLocale !== text.locale)
                 continue;
             const idPart = buildId(text);
-            for (const locale of localesForText) {
+            for (let k = 0; k < localesForText.length; k++) {
+                const locale = localesForText[k];
                 const key = locale + idPart;
                 if (textsMap[key] && locale !== text.locale) {
                     continue;

package/lib/locale-context.d.ts

@@ -6,10 +6,12 @@ export interface UnchainedLocaleContext {
     currencyCode: string;
 }
 export type GetHeaderFn = (key: string) => string | string[];
-export declare const resolveDefaultContext: ({ acceptLang, acceptCountry }: {
+export declare const resolveDefaultContext: (({ acceptLang, acceptCountry }: {
     acceptLang: any;
     acceptCountry: any;
-}, unchainedAPI: UnchainedCore) => Promise<UnchainedLocaleContext>;
+}, unchainedAPI: UnchainedCore) => Promise<UnchainedLocaleContext>) & {
+    clear: () => void;
+};
 export declare const getLocaleContext: ({ getHeader, }: {
     getHeader: UnchainedHTTPServerContext["getHeader"];
 }, unchainedAPI: UnchainedCore) => Promise<UnchainedLocaleContext>;

package/lib/locale-context.js

@@ -1,9 +1,6 @@
-import { resolveBestSupported, resolveBestCurrency } from '@unchainedshop/utils';
-import pMemoize from 'p-memoize';
-import ExpiryMap from 'expiry-map';
+import { resolveBestSupported, resolveBestCurrency, memoizeWithTTL } from '@unchainedshop/utils';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api');
-const memoizeCache = new ExpiryMap(process.env.NODE_ENV === 'production' ? 1000 * 60 : 1);
 const uncachedResolveDefaultContext = async ({ acceptLang, acceptCountry }, unchainedAPI) => {
     const languages = await unchainedAPI.modules.languages.findLanguages({ includeInactive: false }, { projection: { isoCode: 1, isActive: 1 } });
     const countries = await unchainedAPI.modules.countries.findCountries({ includeInactive: false }, { projection: { isoCode: 1, isActive: 1 } });
@@ -19,8 +16,7 @@ const uncachedResolveDefaultContext = async ({ acceptLang, acceptCountry }, unch
     };
     return newContext;
 };
-export const resolveDefaultContext = pMemoize(uncachedResolveDefaultContext, {
-    cache: memoizeCache,
+export const resolveDefaultContext = memoizeWithTTL(uncachedResolveDefaultContext, process.env.NODE_ENV === 'production' ? 1000 * 60 : 1, {
     cacheKey: (args) => {
         const [{ acceptLang, acceptCountry }] = args;
         return `${acceptLang}-${acceptCountry}`;

package/lib/mcp/tools/assortment/assortmentManagement.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '../../../context.ts';
-import { AssortmentManagementSchema, type AssortmentManagementParams } from './schemas.ts';
-export { AssortmentManagementSchema };
+import { AssortmentManagementSchema, AssortmentManagementZodSchema, type AssortmentManagementParams } from './schemas.ts';
+export { AssortmentManagementSchema, AssortmentManagementZodSchema };
 export type { AssortmentManagementParams };
 export declare function assortmentManagement(context: Context, params: AssortmentManagementParams): Promise<{
     content: {

package/lib/mcp/tools/assortment/assortmentManagement.js

@@ -1,8 +1,8 @@
 import { log } from '@unchainedshop/logger';
-import { actionValidators, AssortmentManagementSchema, } from "./schemas.js";
+import { actionValidators, AssortmentManagementSchema, AssortmentManagementZodSchema, } from "./schemas.js";
 import actionHandlers from "./handlers/index.js";
 import { createMcpResponse, createMcpErrorResponse } from "../../utils/sharedSchemas.js";
-export { AssortmentManagementSchema };
+export { AssortmentManagementSchema, AssortmentManagementZodSchema };
 export async function assortmentManagement(context, params) {
     const { action, ...actionParams } = params;
     log('MCP assortmentManagement', { userId: context.userId, params });

package/lib/mcp/tools/assortment/handlers/getAssortment.js

@@ -3,7 +3,7 @@ import { getNormalizedAssortmentDetails } from "../../../utils/getNormalizedAsso
 export default async function getAssortment(context, params) {
     const { modules } = context;
     const { assortmentId, slug } = params;
-    let query;
+    let query = {};
     if (assortmentId)
         query = { assortmentId };
     else if (slug)