@unchainedshop/api 5.0.0-alpha.3 → 5.0.0-alpha.4

package/README.md

@@ -168,8 +168,8 @@ The API layer implements comprehensive security controls.
 |----------|---------|---------|
 | `UNCHAINED_TOKEN_SECRET` | Session encryption (min 32 chars) | Required |
 | `UNCHAINED_COOKIE_NAME` | Cookie name | `unchained_token` |
-| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `none` |
-| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag | `false` |
+| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `lax` |
+| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag (development only) | `false` |
 
 Cookies are `httpOnly` and `secure` by default.
 

package/lib/adminUiPlugins.d.ts

@@ -1,3 +1,27 @@
+export interface AdminUIThemeTokens {
+    surface?: string;
+    'surface-subtle'?: string;
+    'surface-raised'?: string;
+    'surface-input'?: string;
+    border?: string;
+    'border-subtle'?: string;
+    'text-primary'?: string;
+    'text-secondary'?: string;
+    'text-muted'?: string;
+    'text-on-dark'?: string;
+    accent?: string;
+    'accent-hover'?: string;
+    danger?: string;
+    'danger-surface'?: string;
+    success?: string;
+    warning?: string;
+    'focus-ring'?: string;
+    'text-on-accent'?: string;
+}
+export interface AdminUIThemeConfig {
+    light?: AdminUIThemeTokens;
+    dark?: AdminUIThemeTokens;
+}
 export interface AdminUIPluginEntityConfig {
     path: string;
     label: string;

package/lib/auth.d.ts

@@ -2,7 +2,6 @@ export interface AccessTokenPayload {
     iss: string;
     sub: string;
     ver: number;
-    fgp?: string;
     imp?: string;
     jti?: string;
     iat?: number;
@@ -16,14 +15,8 @@ export interface OIDCProviderConfig {
 export interface AuthConfig {
     oidcProviders?: OIDCProviderConfig[];
 }
-export declare function generateFingerprint(): {
-    raw: string;
-    hash: string;
-};
-export declare function verifyFingerprint(raw: string, hash: string): boolean;
 export declare function signAccessToken(userId: string, tokenVersion: number, options?: {
     impersonatorId?: string;
-    fingerprintHash?: string;
 }): Promise<{
     token: string;
     expires: Date;
@@ -37,7 +30,6 @@ export interface AuthHandlerResult {
     userId?: string;
     tokenVersion?: number;
     impersonatorId?: string;
-    fingerprintHash?: string;
     accessToken?: string;
     isApiKey?: boolean;
 }

package/lib/auth.js

@@ -1,6 +1,5 @@
 import { createLogger } from '@unchainedshop/logger';
 import * as jose from 'jose';
-import { createHash } from 'crypto';
 const logger = createLogger('unchained:api:auth');
 const { UNCHAINED_TOKEN_SECRET, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', UNCHAINED_TOKEN_ISSUER = 'unchained-engine', } = process.env;
 const MIN_SECRET_LENGTH = 32;
@@ -11,21 +10,6 @@ function validateSecretStrength(secret) {
             `Current length: ${secret.length}. Generate a secure secret with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
     }
 }
-export function generateFingerprint() {
-    const raw = crypto.randomUUID() + crypto.randomUUID();
-    const hash = createHash('sha256').update(raw).digest('hex');
-    return { raw, hash };
-}
-export function verifyFingerprint(raw, hash) {
-    const computedHash = createHash('sha256').update(raw).digest('hex');
-    if (computedHash.length !== hash.length)
-        return false;
-    let result = 0;
-    for (let i = 0; i < computedHash.length; i++) {
-        result |= computedHash.charCodeAt(i) ^ hash.charCodeAt(i);
-    }
-    return result === 0;
-}
 export async function signAccessToken(userId, tokenVersion, options) {
     if (!UNCHAINED_TOKEN_SECRET) {
         throw new Error('UNCHAINED_TOKEN_SECRET environment variable is required');
@@ -38,9 +22,6 @@ export async function signAccessToken(userId, tokenVersion, options) {
         ver: tokenVersion,
         jti: crypto.randomUUID(),
     };
-    if (options?.fingerprintHash) {
-        payload.fgp = options.fingerprintHash;
-    }
     if (options?.impersonatorId) {
         payload.imp = options.impersonatorId;
     }
@@ -168,7 +149,6 @@ export function createAuthHandler(config) {
                 userId: localPayload.sub,
                 tokenVersion: localPayload.ver,
                 impersonatorId: localPayload.imp,
-                fingerprintHash: localPayload.fgp,
             };
         }
         if (config?.oidcProviders?.length) {

package/lib/express/chatHandler.js

@@ -43,6 +43,16 @@ const setupMCPChatHandler = (chatConfiguration) => {
             res.status(405).json({ error: 'Method Not Allowed. Use POST.' });
             return;
         }
+        const unchainedContext = req.unchainedContext;
+        const user = unchainedContext?.user;
+        if (!user) {
+            res.status(401).json({ error: 'unauthorized' });
+            return;
+        }
+        if (!(user.roles || []).includes('admin')) {
+            res.status(403).json({ error: 'forbidden', message: 'Chat requires admin privileges' });
+            return;
+        }
         let client;
         const lifecycle = createChatRequestLifecycle(res, configuredAbortSignal);
         try {
@@ -52,13 +62,14 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     url: unchainedMCPUrl,
                     headers: {
                         Cookie: req.headers.cookie || '',
+                        ...(req.headers.authorization ? { Authorization: req.headers.authorization } : {}),
                     },
                 },
                 initializationOptions: { signal: lifecycle.signal },
             });
             lifecycle.setClientClose(() => client.close());
             const defaultUnchainedTools = await client.tools();
-            const resourceContext = await buildChatResourceContext(req.unchainedContext);
+            const resourceContext = await buildChatResourceContext(unchainedContext);
             const tools = {
                 ...defaultUnchainedTools,
                 ...additionalTools,

package/lib/express/index.d.ts

@@ -4,10 +4,8 @@ import type { UnchainedCore } from '@unchainedshop/core';
 import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
-import { type AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
-import { type AdminUIPluginConfig } from '../adminUiPlugins.ts';
-export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, } from '../adminUiPlugins.ts';
-export type { AdminUIThemeTokens, AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
+import { type AdminUIPluginConfig, type AdminUIThemeConfig } from '../adminUiPlugins.ts';
+export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, AdminUIThemeTokens, AdminUIThemeConfig, } from '../adminUiPlugins.ts';
 export interface AdminUIRouterOptions {
     prefix?: string;
     enabled?: boolean;

package/lib/express/index.js

@@ -10,26 +10,38 @@ import createMCPMiddleware from "./createMCPMiddleware.js";
 import { connectChat } from "./chatHandler.js";
 import { mountRoutes } from "./mountRoutes.js";
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-import { generateThemeCSS } from '@unchainedshop/admin-ui/theme';
-import { preparePluginAssets, resolveAdminUIPath } from "../adminUiPlugins.js";
+import { preparePluginAssets, resolveAdminUIPath, } from "../adminUiPlugins.js";
 export const adminUIRouter = (enabled = true, theme, plugins = []) => {
     const router = e.Router();
     const adminUIPath = resolveAdminUIPath();
     if (!adminUIPath)
         return router;
     if (enabled) {
-        const themeCSS = generateThemeCSS(theme);
-        const themeHash = createHash('sha256').update(themeCSS).digest('hex').slice(0, 8);
-        const themeEtag = `"${themeHash}"`;
-        router.get('/admin-ui-theme.css', (req, res) => {
-            if (req.headers['if-none-match'] === themeEtag) {
+        let themePromise;
+        const resolveThemeCSS = async () => {
+            let css = '/* default theme */';
+            if (theme) {
+                try {
+                    const { generateThemeCSS } = await import('@unchainedshop/admin-ui/theme');
+                    css = generateThemeCSS(theme);
+                }
+                catch {
+                    console.warn("npm dependency @unchainedshop/admin-ui is not installed, can't apply admin-ui theme");
+                }
+            }
+            const etag = `"${createHash('sha256').update(css).digest('hex').slice(0, 8)}"`;
+            return { css, etag };
+        };
+        router.get('/admin-ui-theme.css', async (req, res) => {
+            const { css, etag } = await (themePromise ||= resolveThemeCSS());
+            if (req.headers['if-none-match'] === etag) {
                 return res.status(304).end();
             }
             res
                 .set('Cache-Control', 'public, max-age=0, must-revalidate')
-                .set('ETag', themeEtag)
+                .set('ETag', etag)
                 .type('text/css')
-                .send(themeCSS);
+                .send(css);
         });
         const log = { info: console.info, warn: console.warn };
         const devMode = process.env.NODE_ENV !== 'production';

package/lib/fastify/chatHandler.js

@@ -39,6 +39,14 @@ const setupMCPChatHandler = (chatConfiguration) => {
             });
             return res.status(200).send();
         }
+        const unchainedContext = req.unchainedContext;
+        const user = unchainedContext?.user;
+        if (!user) {
+            return res.status(401).send({ error: 'unauthorized' });
+        }
+        if (!(user.roles || []).includes('admin')) {
+            return res.status(403).send({ error: 'forbidden', message: 'Chat requires admin privileges' });
+        }
         let client;
         const lifecycle = createChatRequestLifecycle(res.raw, configuredAbortSignal);
         try {
@@ -48,13 +56,14 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     url: unchainedMCPUrl,
                     headers: {
                         Cookie: req.headers.cookie || '',
+                        ...(req.headers.authorization ? { Authorization: req.headers.authorization } : {}),
                     },
                 },
                 initializationOptions: { signal: lifecycle.signal },
             });
             lifecycle.setClientClose(() => client.close());
             const defaultUnchainedTools = await client.tools();
-            const resourceContext = await buildChatResourceContext(req.unchainedContext);
+            const resourceContext = await buildChatResourceContext(unchainedContext);
             const tools = {
                 ...defaultUnchainedTools,
                 ...additionalTools,

package/lib/fastify/index.d.ts

@@ -4,10 +4,8 @@ import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
-import { type AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
-import { type AdminUIPluginConfig } from '../adminUiPlugins.ts';
-export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, } from '../adminUiPlugins.ts';
-export type { AdminUIThemeTokens, AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
+import { type AdminUIPluginConfig, type AdminUIThemeConfig } from '../adminUiPlugins.ts';
+export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, AdminUIThemeTokens, AdminUIThemeConfig, } from '../adminUiPlugins.ts';
 export interface AdminUIRouterOptions {
     prefix?: string;
     enabled?: boolean;

package/lib/fastify/index.js

@@ -10,8 +10,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-import { generateThemeCSS } from '@unchainedshop/admin-ui/theme';
-import { preparePluginAssets, resolveAdminUIPath } from "../adminUiPlugins.js";
+import { preparePluginAssets, resolveAdminUIPath, } from "../adminUiPlugins.js";
 const resolveUserRemoteAddress = (req, trustProxy = false) => {
     let remoteAddress;
     if (trustProxy) {
@@ -126,18 +125,31 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
     if (adminUI) {
         const adminUIOptions = typeof adminUI === 'object' ? adminUI : undefined;
         const adminUIPlugins = adminUIOptions?.plugins || [];
-        const themeCSS = generateThemeCSS(adminUIOptions?.theme);
-        const themeHash = createHash('sha256').update(themeCSS).digest('hex').slice(0, 8);
-        const themeEtag = `"${themeHash}"`;
+        let themePromise;
+        const resolveThemeCSS = async () => {
+            let css = '/* default theme */';
+            if (adminUIOptions?.theme) {
+                try {
+                    const { generateThemeCSS } = await import('@unchainedshop/admin-ui/theme');
+                    css = generateThemeCSS(adminUIOptions.theme);
+                }
+                catch {
+                    fastify.log.warn("npm dependency @unchainedshop/admin-ui is not installed, can't apply admin-ui theme");
+                }
+            }
+            const etag = `"${createHash('sha256').update(css).digest('hex').slice(0, 8)}"`;
+            return { css, etag };
+        };
         fastify.get('/admin-ui-theme.css', async (request, reply) => {
-            if (request.headers['if-none-match'] === themeEtag) {
+            const { css, etag } = await (themePromise ||= resolveThemeCSS());
+            if (request.headers['if-none-match'] === etag) {
                 return reply.code(304).send();
             }
             return reply
                 .header('Cache-Control', 'public, max-age=0, must-revalidate')
-                .header('ETag', themeEtag)
+                .header('ETag', etag)
                 .type('text/css')
-                .send(themeCSS);
+                .send(css);
         });
         const devMode = process.env.NODE_ENV !== 'production';
         const { routes: pluginRoutes } = preparePluginAssets(adminUIPlugins, fastify.log, {

package/lib/loaders/assortmentLinksLoader.js

@@ -1,38 +1,40 @@
 import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
-    const parentAssortmentIds = queries.flatMap((q) => q.parentAssortmentId).filter(Boolean);
-    const childAssortmentIds = queries.flatMap((q) => q.childAssortmentId).filter(Boolean);
-    const assortmentIds = queries.flatMap((q) => q.assortmentId).filter(Boolean);
+    const parentAssortmentIds = [
+        ...new Set(queries.flatMap((q) => q.parentAssortmentId).filter(Boolean)),
+    ];
+    const childAssortmentIds = [
+        ...new Set(queries.flatMap((q) => q.childAssortmentId).filter(Boolean)),
+    ];
+    const assortmentIds = [
+        ...new Set(queries.flatMap((q) => q.assortmentId).filter(Boolean)),
+    ];
     const allLinks = await unchainedAPI.modules.assortments.links.findLinks({
-        assortmentIds: [...new Set([...parentAssortmentIds, ...childAssortmentIds, ...assortmentIds])],
+        ...(parentAssortmentIds.length ? { parentAssortmentIds } : {}),
+        ...(childAssortmentIds.length ? { childAssortmentIds } : {}),
+        ...(assortmentIds.length ? { assortmentIds } : {}),
     });
-    const parentAssortmentLinkMap = {};
-    const childAssortmentLinkMap = {};
+    const parentAssortmentLinkMap = new Map();
+    const childAssortmentLinkMap = new Map();
     for (const link of allLinks) {
-        if (!parentAssortmentLinkMap[link.parentAssortmentId]) {
-            parentAssortmentLinkMap[link.parentAssortmentId] = [link];
-        }
-        else {
-            parentAssortmentLinkMap[link.parentAssortmentId].push(link);
-        }
-        if (!childAssortmentLinkMap[link.childAssortmentId]) {
-            childAssortmentLinkMap[link.childAssortmentId] = [link];
-        }
-        else {
-            childAssortmentLinkMap[link.childAssortmentId].push(link);
-        }
+        const parentLinks = parentAssortmentLinkMap.get(link.parentAssortmentId) || [];
+        parentLinks.push(link);
+        parentAssortmentLinkMap.set(link.parentAssortmentId, parentLinks);
+        const childLinks = childAssortmentLinkMap.get(link.childAssortmentId) || [];
+        childLinks.push(link);
+        childAssortmentLinkMap.set(link.childAssortmentId, childLinks);
     }
     return queries.map((q) => {
         if (q.parentAssortmentId) {
-            return parentAssortmentLinkMap[q.parentAssortmentId] || [];
+            return parentAssortmentLinkMap.get(q.parentAssortmentId) || [];
         }
         else if (q.childAssortmentId) {
-            return childAssortmentLinkMap[q.childAssortmentId] || [];
+            return childAssortmentLinkMap.get(q.childAssortmentId) || [];
         }
         if (q.assortmentId) {
             return [
-                ...(parentAssortmentLinkMap[q.assortmentId] || []),
-                ...(childAssortmentLinkMap[q.assortmentId] || []),
+                ...(parentAssortmentLinkMap.get(q.assortmentId) || []),
+                ...(childAssortmentLinkMap.get(q.assortmentId) || []),
             ];
         }
         return [];

package/lib/loaders/assortmentMediaTextLoader.js

@@ -6,6 +6,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const texts = await unchainedAPI.modules.assortments.media.texts.findMediaTexts({ assortmentMediaIds }, {
         sort: {
             assortmentMediaId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/loaders/assortmentProductLoader.js

@@ -1,13 +1,16 @@
 import DataLoader from 'dataloader';
 export default (unchainedAPI) => new DataLoader(async (queries) => {
     const assortmentIds = [...new Set(queries.map((q) => q.assortmentId).filter(Boolean))];
+    const productIds = [...new Set(queries.map((q) => q.productId).filter(Boolean))];
     const assortmentProducts = await unchainedAPI.modules.assortments.products.findAssortmentProducts({
         assortmentIds,
+        productIds,
     });
-    const assortmentProductMap = {};
+    const assortmentProductMap = new Map();
     for (const assortmentProduct of assortmentProducts) {
-        assortmentProductMap[assortmentProduct.assortmentId + assortmentProduct.productId] =
-            assortmentProduct;
+        const productsById = assortmentProductMap.get(assortmentProduct.assortmentId) || new Map();
+        productsById.set(assortmentProduct.productId, assortmentProduct);
+        assortmentProductMap.set(assortmentProduct.assortmentId, productsById);
     }
-    return queries.map((q) => assortmentProductMap[q.assortmentId + q.productId]);
+    return queries.map((q) => assortmentProductMap.get(q.assortmentId)?.get(q.productId));
 });

package/lib/loaders/assortmentTextLoader.js

@@ -6,6 +6,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const texts = await unchainedAPI.modules.assortments.texts.findTexts({ assortmentIds }, {
         sort: {
             assortmentId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/loaders/filterTextLoader.js

@@ -6,6 +6,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const texts = await unchainedAPI.modules.filters.texts.findTexts({ filterIds }, {
         sort: {
             filterId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/loaders/productMediaTextLoader.js

@@ -6,6 +6,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const texts = await unchainedAPI.modules.products.media.texts.findMediaTexts({ productMediaIds }, {
         sort: {
             productMediaId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/loaders/productTextLoader.js

@@ -6,6 +6,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     const texts = await unchainedAPI.modules.products.texts.findTexts({ productIds }, {
         sort: {
             productId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/loaders/productVariationTextLoader.js

@@ -8,6 +8,7 @@ export default (unchainedAPI) => new DataLoader(async (queries) => {
     }, {
         sort: {
             productVariationId: 1,
+            _id: 1,
         },
     });
     const localeMap = buildLocaleMap(queries, texts);

package/lib/mcp/tools/assortment/handlers/getAssortmentFilters.js

@@ -7,7 +7,7 @@ export default async function getAssortmentFilters(context, params) {
     const assortment = await getNormalizedAssortmentDetails({ assortmentId }, context);
     if (!assortment)
         throw new AssortmentNotFoundError({ assortmentId });
-    const filters = await modules.assortments.filters.findFilters({ assortmentId }, { sort: { sortKey: 1 } });
+    const filters = await modules.assortments.filters.findFilters({ assortmentId }, { sort: { sortKey: 1, _id: 1 } });
     const filters_normalized = await Promise.all(filters?.map(async ({ filterId, ...rest }) => ({
         ...(await getNormalizedFilterDetails(filterId, context)),
         ...rest,

package/lib/mcp/tools/assortment/handlers/getAssortmentProducts.js

@@ -7,7 +7,7 @@ export default async function getAssortmentProducts(context, params) {
     const assortment = await getNormalizedAssortmentDetails({ assortmentId }, context);
     if (!assortment)
         throw new AssortmentNotFoundError({ assortmentId });
-    const assortmentProducts = await modules.assortments.products.findAssortmentProducts({ assortmentId }, { sort: { sortKey: 1 } });
+    const assortmentProducts = await modules.assortments.products.findAssortmentProducts({ assortmentId }, { sort: { sortKey: 1, _id: 1 } });
     const products = await Promise.all(assortmentProducts?.map(async ({ productId, ...rest }) => ({
         ...(await getNormalizedProductDetails(productId, context)),
         ...rest,

package/lib/mcp/tools/users/handlers/getUserPaymentCredentials.js

@@ -4,6 +4,7 @@ export default async function getUserPaymentCredentials(context, params) {
     const credentials = await modules.payment.paymentCredentials.findPaymentCredentials({ userId }, {
         sort: {
             created: -1,
+            _id: -1,
         },
     });
     return { credentials };

package/lib/mcp/utils/getNormalizedAssortmentDetails.js

@@ -9,7 +9,7 @@ export async function getNormalizedAssortmentDetails({ assortmentId, slug }, con
         assortmentId: normalizedAssortmentId,
         locale,
     });
-    const filters = await modules.assortments.filters.findFilters({ assortmentId: assortment._id }, { sort: { sortKey: 1 } });
+    const filters = await modules.assortments.filters.findFilters({ assortmentId: assortment._id }, { sort: { sortKey: 1, _id: 1 } });
     const assortmentMedias = await modules.assortments.media.findAssortmentMedias({
         assortmentId: normalizedAssortmentId,
     });
@@ -19,7 +19,7 @@ export async function getNormalizedAssortmentDetails({ assortmentId, slug }, con
     const links = (await loaders.assortmentLinksLoader.load({
         assortmentId: assortment._id,
     })) || [];
-    const products = await modules.assortments.products.findAssortmentProducts({ assortmentId: assortment._id }, { sort: { sortKey: 1 } });
+    const products = await modules.assortments.products.findAssortmentProducts({ assortmentId: assortment._id }, { sort: { sortKey: 1, _id: 1 } });
     const assortmentIds = assortmentChildLinks.map(({ childAssortmentId }) => childAssortmentId);
     const childrenCount = await modules.assortments.count({
         assortmentIds,

package/lib/mcp/utils/getNormalizedUserDetails.js

@@ -38,6 +38,7 @@ export async function getNormalizedUserDetails(userId, context) {
     const paymentCredentials = await modules.payment.paymentCredentials.findPaymentCredentials({ userId: user._id }, {
         sort: {
             created: -1,
+            _id: -1,
         },
     });
     const quotations = await modules.quotations.findQuotations({

package/lib/middleware/createAuthMiddleware.js

@@ -1,9 +1,9 @@
 import { emit } from '@unchainedshop/events';
-import { signAccessToken, createAuthHandler, generateFingerprint, verifyFingerprint, } from "../auth.js";
+import { signAccessToken, createAuthHandler } from "../auth.js";
 import { API_EVENTS } from "../events.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:auth-middleware');
-const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_FINGERPRINT_COOKIE_NAME = '__Secure-fgp', UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
+const { UNCHAINED_COOKIE_NAME = 'unchained_token', UNCHAINED_COOKIE_PATH = '/', UNCHAINED_COOKIE_DOMAIN, UNCHAINED_COOKIE_SAMESITE = 'lax', UNCHAINED_COOKIE_INSECURE, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', } = process.env;
 function getTokenCookieOptions(expires) {
     const secure = !UNCHAINED_COOKIE_INSECURE;
     const sameSite = {
@@ -30,19 +30,6 @@ function getTokenCookieOptions(expires) {
         expires,
     };
 }
-function getFingerprintCookieOptions(expires) {
-    const secure = !UNCHAINED_COOKIE_INSECURE;
-    const expirySeconds = parseInt(UNCHAINED_TOKEN_EXPIRY_SECONDS, 10);
-    return {
-        domain: UNCHAINED_COOKIE_DOMAIN,
-        path: UNCHAINED_COOKIE_PATH,
-        secure,
-        httpOnly: true,
-        sameSite: 'strict',
-        maxAge: expires ? undefined : expirySeconds * 1000,
-        expires,
-    };
-}
 function extractBearerToken(authHeader) {
     if (!authHeader)
         return undefined;
@@ -62,38 +49,15 @@ export async function createAuthContext(params, authConfig) {
     const headerToken = extractBearerToken(authHeader);
     const cookieToken = getCookie(UNCHAINED_COOKIE_NAME);
     const token = headerToken || cookieToken;
-    const fingerprintCookie = getCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME);
     const verifyToken = createAuthHandler(authConfig);
     const authResult = token ? await verifyToken(token) : {};
-    if (authResult.fingerprintHash && fingerprintCookie) {
-        const fingerprintValid = verifyFingerprint(fingerprintCookie, authResult.fingerprintHash);
-        if (!fingerprintValid) {
-            logger.warn('Token sidejacking detected: fingerprint mismatch', {
-                userId: authResult.userId,
-            });
-            authResult.userId = undefined;
-            authResult.tokenVersion = undefined;
-            authResult.impersonatorId = undefined;
-        }
-    }
-    else if (authResult.fingerprintHash && !fingerprintCookie) {
-        logger.warn('Token sidejacking detected: fingerprint cookie missing', {
-            userId: authResult.userId,
-        });
-        authResult.userId = undefined;
-        authResult.tokenVersion = undefined;
-        authResult.impersonatorId = undefined;
-    }
     const login = async (user, options = {}) => {
         const { impersonator } = options;
         const tokenVersion = user.tokenVersion ?? 1;
-        const { raw: fingerprintRaw, hash: fingerprintHash } = generateFingerprint();
         const { token: newToken, expires } = await signAccessToken(user._id, tokenVersion, {
             impersonatorId: impersonator?._id,
-            fingerprintHash,
         });
         setCookie(UNCHAINED_COOKIE_NAME, newToken, getTokenCookieOptions(expires));
-        setCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, fingerprintRaw, getFingerprintCookieOptions(expires));
         const tokenObject = {
             _id: crypto.randomUUID(),
             userId: user._id,
@@ -105,7 +69,6 @@ export async function createAuthContext(params, authConfig) {
     };
     const logout = async () => {
         clearCookie(UNCHAINED_COOKIE_NAME, getTokenCookieOptions());
-        clearCookie(UNCHAINED_FINGERPRINT_COOKIE_NAME, getFingerprintCookieOptions());
         if (authResult.userId) {
             const tokenObject = {
                 _id: crypto.randomUUID(),

package/lib/resolvers/mutations/orders/checkoutCart.js

@@ -22,7 +22,7 @@ export default async function checkoutCart(root, params, context) {
             userId,
             orderId: order._id,
             ...transactionContext,
-            detailCode: error.name || error.code,
+            detailCode: error.extensions?.code || error.name || error.code,
             detailMessage: error.message,
         });
     }

package/lib/resolvers/type/assortment/assortment-types.js

@@ -32,7 +32,7 @@ export const AssortmentTypes = {
         return modules.assortments.filters.findFilters({
             assortmentId: obj._id,
         }, {
-            sort: { sortKey: 1 },
+            sort: { sortKey: 1, _id: 1 },
         });
     },
     async linkedAssortments(assortment, _, { loaders }) {
@@ -53,7 +53,7 @@ export const AssortmentTypes = {
         return modules.assortments.products.findAssortmentProducts({
             assortmentId: obj._id,
         }, {
-            sort: { sortKey: 1 },
+            sort: { sortKey: 1, _id: 1 },
         });
     },
     async texts(obj, { forceLocale }, requestContext) {

package/lib/resolvers/type/user-types.js

@@ -105,6 +105,7 @@ export const User = {
         return context.modules.payment.paymentCredentials.findPaymentCredentials({ ...params.selector, userId: user._id }, {
             sort: {
                 created: -1,
+                _id: -1,
             },
         });
     },

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@unchainedshop/api",
   "description": "GraphQL API layer for the Unchained Engine with Express/Fastify adapters and MCP server",
-  "version": "5.0.0-alpha.3",
+  "mcpName": "io.github.unchainedshop/unchained",
+  "version": "5.0.0-alpha.4",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -65,6 +66,7 @@
     "@fastify/multipart": ">= 10 < 11",
     "@fastify/static": ">= 10.1.3 < 11",
     "@modelcontextprotocol/server": ">= 2 < 3",
+    "@unchainedshop/admin-ui": "^5.0.0-alpha.1",
     "ai": ">= 7 < 8",
     "cookie-parser": ">= 1.4 < 2",
     "express": ">= 5 < 6",
@@ -86,6 +88,9 @@
     "@modelcontextprotocol/server": {
       "optional": true
     },
+    "@unchainedshop/admin-ui": {
+      "optional": true
+    },
     "ai": {
       "optional": true
     },
@@ -136,7 +141,7 @@
     "@unchainedshop/mongodb": "^5.0.0-alpha.1",
     "@unchainedshop/roles": "^5.0.0-alpha.1",
     "@unchainedshop/utils": "^5.0.0-alpha.1",
-    "@whatwg-node/server": "^0.10.18",
+    "@whatwg-node/server": "^0.11.0",
     "dataloader": "^2.2.3",
     "graphql-scalars": "^2.0.0",
     "jose": "^6.0.10",
@@ -158,6 +163,6 @@
     "fastify": "^5.4.0",
     "graphql": "^17.0.2",
     "multer": "^2.0.1",
-    "typescript": "^5.8.3"
+    "typescript": "^6.0.3"
   }
 }

package/lib/adminUiTheme.d.ts

@@ -1,25 +0,0 @@
-export interface AdminUIThemeTokens {
-    surface?: string;
-    'surface-subtle'?: string;
-    'surface-raised'?: string;
-    'surface-input'?: string;
-    border?: string;
-    'border-subtle'?: string;
-    'text-primary'?: string;
-    'text-secondary'?: string;
-    'text-muted'?: string;
-    'text-on-dark'?: string;
-    accent?: string;
-    'accent-hover'?: string;
-    danger?: string;
-    'danger-surface'?: string;
-    success?: string;
-    warning?: string;
-    'focus-ring'?: string;
-    'text-on-accent'?: string;
-}
-export interface AdminUIThemeConfig {
-    light?: AdminUIThemeTokens;
-    dark?: AdminUIThemeTokens;
-}
-export declare const generateThemeCSS: (theme?: AdminUIThemeConfig) => string;

package/lib/adminUiTheme.js

@@ -1,34 +0,0 @@
-const CSS_VALUE_RE = /^[a-zA-Z0-9#().,/%\s\-_]+$/;
-const sanitizeCSSValue = (value) => {
-    const trimmed = value.trim();
-    if (!trimmed || !CSS_VALUE_RE.test(trimmed))
-        return null;
-    return trimmed;
-};
-const buildTokenBlock = (selector, tokens) => {
-    const vars = Object.entries(tokens)
-        .map(([key, value]) => {
-        const safe = sanitizeCSSValue(value);
-        return safe ? `  --token-${key}: ${safe};` : null;
-    })
-        .filter(Boolean);
-    if (vars.length === 0)
-        return null;
-    return `${selector} {\n${vars.join('\n')}\n}`;
-};
-export const generateThemeCSS = (theme) => {
-    if (!theme)
-        return '/* default theme */';
-    const blocks = [];
-    if (theme.light) {
-        const block = buildTokenBlock(':root:root', theme.light);
-        if (block)
-            blocks.push(block);
-    }
-    if (theme.dark) {
-        const block = buildTokenBlock('.dark.dark', theme.dark);
-        if (block)
-            blocks.push(block);
-    }
-    return blocks.length > 0 ? blocks.join('\n\n') : '/* default theme */';
-};