@volcanicminds/backend 2.3.1 → 3.0.0

package/lib/defaults/managers.ts

@@ -1,9 +1,8 @@
-
-import { 
-  UserManagement, 
-  TokenManagement, 
-  DataBaseManagement, 
-  MfaManagement, 
+import {
+  UserManagement,
+  TokenManagement,
+  DataBaseManagement,
+  MfaManagement,
   TransferManagement,
   TenantManagement,
   TransferCallback
@@ -12,77 +11,205 @@ import { FastifyReply, FastifyRequest } from 'fastify'
 
 // Default implementations that throw errors or return not implemented
 export const defaultTenantManager: TenantManagement = {
-  isImplemented() { return false },
-  resolveTenant(_req) { throw new Error('Not implemented') },
-  switchContext(_tenant, _db?) { throw new Error('Not implemented') },
-  createTenant(_data) { throw new Error('Not implemented') },
-  deleteTenant(_id) { throw new Error('Not implemented') }
+  isImplemented() {
+    return false
+  },
+  resolveTenant(_req) {
+    throw new Error('Not implemented')
+  },
+  switchContext(_tenant, _db?) {
+    throw new Error('Not implemented')
+  },
+  createTenant(_data) {
+    throw new Error('Not implemented')
+  },
+  deleteTenant(_id) {
+    throw new Error('Not implemented')
+  },
+  listTenants() {
+    throw new Error('Not implemented')
+  },
+  getTenant(_id) {
+    throw new Error('Not implemented')
+  },
+  updateTenant(_id, _data) {
+    throw new Error('Not implemented')
+  },
+  restoreTenant(_id) {
+    throw new Error('Not implemented')
+  }
 }
 
 export const defaultUserManager: UserManagement = {
-  isImplemented() { return false },
-  isValidUser(_data: unknown) { throw new Error('Not implemented.') },
-  createUser(_data: unknown) { throw new Error('Not implemented.') },
-  deleteUser(_data: unknown) { throw new Error('Not implemented.') },
-  resetExternalId(_data: unknown) { throw new Error('Not implemented.') },
-  updateUserById(_id: string, _user: unknown) { throw new Error('Not implemented.') },
-  retrieveUserById(_id: string) { throw new Error('Not implemented.') },
-  retrieveUserByEmail(_email: string) { throw new Error('Not implemented.') },
-  retrieveUserByConfirmationToken(_code: string) { throw new Error('Not implemented.') },
-  retrieveUserByResetPasswordToken(_code: string) { throw new Error('Not implemented.') },
-  retrieveUserByUsername(_username: string) { throw new Error('Not implemented.') },
-  retrieveUserByExternalId(_externalId: string) { throw new Error('Not implemented.') },
-  retrieveUserByPassword(_email: string, _password: string) { throw new Error('Not implemented.') },
-  changePassword(_email: string, _password: string, _oldPassword: string) { throw new Error('Not implemented.') },
-  forgotPassword(_email: string) { throw new Error('Not implemented.') },
-  userConfirmation(_user: unknown) { throw new Error('Not implemented.') },
-  resetPassword(_user: unknown, _password: string) { throw new Error('Not implemented.') },
-  blockUserById(_id: string, _reason: string) { throw new Error('Not implemented.') },
-  unblockUserById(_data: unknown) { throw new Error('Not implemented.') },
-  countQuery(_data: unknown) { throw new Error('Not implemented.') },
-  findQuery(_data: unknown) { throw new Error('Not implemented.') },
-  disableUserById(_id: string) { throw new Error('Not implemented.') },
-  saveMfaSecret(_userId: string, _secret: string) { throw new Error('Not implemented.') },
-  retrieveMfaSecret(_userId: string) { throw new Error('Not implemented.') },
-  enableMfa(_userId: string) { throw new Error('Not implemented.') },
-  disableMfa(_userId: string) { throw new Error('Not implemented.') },
-  forceDisableMfaForAdmin(_email: string) { throw new Error('Not implemented.') }
+  isImplemented() {
+    return false
+  },
+  isValidUser(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  createUser(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  deleteUser(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  resetExternalId(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  updateUserById(_id: string, _user: unknown) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserById(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByEmail(_email: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByConfirmationToken(_code: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByResetPasswordToken(_code: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByUsername(_username: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByExternalId(_externalId: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveUserByPassword(_email: string, _password: string) {
+    throw new Error('Not implemented.')
+  },
+  changePassword(_email: string, _password: string, _oldPassword: string) {
+    throw new Error('Not implemented.')
+  },
+  forgotPassword(_email: string) {
+    throw new Error('Not implemented.')
+  },
+  userConfirmation(_user: unknown) {
+    throw new Error('Not implemented.')
+  },
+  resetPassword(_user: unknown, _password: string) {
+    throw new Error('Not implemented.')
+  },
+  blockUserById(_id: string, _reason: string) {
+    throw new Error('Not implemented.')
+  },
+  unblockUserById(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  countQuery(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  findQuery(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  disableUserById(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  saveMfaSecret(_userId: string, _secret: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveMfaSecret(_userId: string) {
+    throw new Error('Not implemented.')
+  },
+  enableMfa(_userId: string) {
+    throw new Error('Not implemented.')
+  },
+  disableMfa(_userId: string) {
+    throw new Error('Not implemented.')
+  },
+  forceDisableMfaForAdmin(_email: string) {
+    throw new Error('Not implemented.')
+  }
 }
 
 export const defaultTokenManager: TokenManagement = {
-  isImplemented() { return false },
-  isValidToken(_data: unknown) { throw new Error('Not implemented.') },
-  createToken(_data: unknown) { throw new Error('Not implemented.') },
-  resetExternalId(_id: string) { throw new Error('Not implemented.') },
-  updateTokenById(_id: string, _token: unknown) { throw new Error('Not implemented.') },
-  retrieveTokenById(_id: string) { throw new Error('Not implemented.') },
-  retrieveTokenByExternalId(_id: string) { throw new Error('Not implemented.') },
-  blockTokenById(_id: string, _reason: string) { throw new Error('Not implemented.') },
-  unblockTokenById(_id: string) { throw new Error('Not implemented.') },
-  countQuery(_data: unknown) { throw new Error('Not implemented.') },
-  findQuery(_data: unknown) { throw new Error('Not implemented.') },
-  removeTokenById(_id: string) { throw new Error('Not implemented.') }
+  isImplemented() {
+    return false
+  },
+  isValidToken(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  createToken(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  resetExternalId(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  updateTokenById(_id: string, _token: unknown) {
+    throw new Error('Not implemented.')
+  },
+  retrieveTokenById(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  retrieveTokenByExternalId(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  blockTokenById(_id: string, _reason: string) {
+    throw new Error('Not implemented.')
+  },
+  unblockTokenById(_id: string) {
+    throw new Error('Not implemented.')
+  },
+  countQuery(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  findQuery(_data: unknown) {
+    throw new Error('Not implemented.')
+  },
+  removeTokenById(_id: string) {
+    throw new Error('Not implemented.')
+  }
 }
 
 export const defaultDataBaseManager: DataBaseManagement = {
-  isImplemented() { return false },
-  synchronizeSchemas() { throw new Error('Not implemented.') },
-  retrieveBy(_entityName, _entityId) { throw new Error('Not implemented.') },
-  addChange(_entityName, _entityId, _status, _userId, _contents, _changeEntity) { throw new Error('Not implemented.') }
+  isImplemented() {
+    return false
+  },
+  synchronizeSchemas() {
+    throw new Error('Not implemented.')
+  },
+  retrieveBy(_entityName, _entityId) {
+    throw new Error('Not implemented.')
+  },
+  addChange(_entityName, _entityId, _status, _userId, _contents, _changeEntity) {
+    throw new Error('Not implemented.')
+  }
 }
 
 export const defaultMfaManager: MfaManagement = {
-  generateSetup(_appName: string, _email: string) { throw new Error('Not implemented.') },
-  verify(_token: string, _secret: string) { throw new Error('Not implemented.') }
+  generateSetup(_appName: string, _email: string) {
+    throw new Error('Not implemented.')
+  },
+  verify(_token: string, _secret: string) {
+    throw new Error('Not implemented.')
+  }
 }
 
 export const defaultTransferManager: TransferManagement = {
-  isImplemented() { return false },
-  getPath() { throw new Error('Not implemented.') },
-  getServer() { throw new Error('Not implemented.') },
-  onUploadCreate(_callback: TransferCallback) { throw new Error('Not implemented.') },
-  onUploadFinish(_callback: TransferCallback) { throw new Error('Not implemented.') },
-  onUploadTerminate(_callback: TransferCallback) { throw new Error('Not implemented.') },
-  handle(_req: FastifyRequest, _res: FastifyReply) { throw new Error('Not implemented.') },
-  isValid(_req: FastifyRequest) { throw new Error('Not implemented.') }
+  isImplemented() {
+    return false
+  },
+  getPath() {
+    throw new Error('Not implemented.')
+  },
+  getServer() {
+    throw new Error('Not implemented.')
+  },
+  onUploadCreate(_callback: TransferCallback) {
+    throw new Error('Not implemented.')
+  },
+  onUploadFinish(_callback: TransferCallback) {
+    throw new Error('Not implemented.')
+  },
+  onUploadTerminate(_callback: TransferCallback) {
+    throw new Error('Not implemented.')
+  },
+  handle(_req: FastifyRequest, _res: FastifyReply) {
+    throw new Error('Not implemented.')
+  },
+  isValid(_req: FastifyRequest) {
+    throw new Error('Not implemented.')
+  }
 }

package/lib/hooks/onRequest.ts

@@ -2,8 +2,6 @@
 import { getParams, getData } from '../util/common.js'
 import type { AuthenticatedUser, AuthenticatedToken, Role, TransferManagement } from '../../types/global.js'
 
-const { embedded_auth = true } = global.config?.options || {}
-
 const MFA_SETUP_WHITELIST = ['/auth/mfa/setup', '/auth/mfa/enable', '/auth/mfa/verify', '/auth/logout']
 
 const normalizeRoles = (rolesArray: any[] | undefined): string[] => {
@@ -23,63 +21,6 @@ const normalizeRoles = (rolesArray: any[] | undefined): string[] => {
 export default async (req, reply) => {
   if (log.i) req.startedAt = new Date()
 
-  const { multi_tenant } = global.config?.options || {}
-
-  if (multi_tenant?.enabled) {
-    let tenantSlug: string | undefined
-
-    if (multi_tenant.resolver === 'subdomain') {
-      const host = req.headers.host || ''
-      const parts = host.split('.')
-      if (parts.length >= 2) {
-        // FIXME: Improve subdomain extraction strategy. Currently assumes [slug].[domain].[tld] or [slug].localhost
-        if (parts[0] !== 'www') {
-          tenantSlug = parts[0]
-        }
-      }
-    } else if (multi_tenant.resolver === 'header') {
-      tenantSlug = req.headers[multi_tenant?.header_key || 'x-tenant-id'] as string
-    } else if (multi_tenant.resolver === 'query') {
-      tenantSlug = (req.query as any)[multi_tenant?.query_key || 'tid']
-    }
-
-    if (!tenantSlug) {
-      return reply.code(400).send({ statusCode: 400, error: 'Tenant ID missing', message: 'Tenant ID is required' })
-    }
-
-    if (!global.repository?.tenants) {
-      log.error('Multi-tenant enabled but global.repository.tenants not found')
-      return reply.code(500).send({ statusCode: 500, error: 'Internal Server Error' })
-    }
-
-    const tenant = await global.repository.tenants.findOneBy({ slug: tenantSlug })
-
-    if (!tenant) {
-      return reply
-        .code(404)
-        .send({ statusCode: 404, error: 'Tenant Not Found', message: `Tenant '${tenantSlug}' not found` })
-    }
-
-    if (tenant.status !== 'active') {
-      return reply.code(403).send({ statusCode: 403, error: 'Tenant Inactive', message: 'Tenant is not active' })
-    }
-
-    // Tenant Context Setup
-    const runner = global.connection.createQueryRunner()
-    await runner.connect()
-
-    // Validate schema name safety
-    if (!/^[a-z0-9_]+$/i.test(tenant.schema)) {
-      await runner.release()
-      return reply.code(400).send({ statusCode: 400, error: 'Invalid Schema Name' })
-    }
-
-    await runner.query(`SET search_path TO "${tenant.schema}", "public"`)
-
-    req.runner = runner
-    req.tenant = tenant
-  }
-
   req.data = () => getData(req)
   req.parameters = () => getParams(req)
 
@@ -102,6 +43,8 @@ export default async (req, reply) => {
     }
   }
 
+  const { embedded_auth = true } = global.config?.options || {}
+
   if (embedded_auth) {
     req.roles = () => [roles.public.code]
     req.hasRole = (r: Role) => req.roles().includes(r?.code)
@@ -133,7 +76,14 @@ export default async (req, reply) => {
 
         // Validate Tenant Access
         const { multi_tenant } = global.config?.options || {}
-        if (multi_tenant?.enabled && req.tenant && tokenData.tid) {
+        if (multi_tenant?.enabled && cfg.tenantContext !== false) {
+          if (!req.tenant || !tokenData.tid) {
+            return reply.status(403).send({
+              statusCode: 403,
+              code: 'TENANT_NOT_FOUND',
+              message: 'Token does not belong to this tenant'
+            })
+          }
           if (tokenData.tid !== req.tenant.id) {
             return reply.status(403).send({
               statusCode: 403,
@@ -168,7 +118,7 @@ export default async (req, reply) => {
         let token: null | AuthenticatedToken = null
 
         if (req.server['userManager']?.isImplemented()) {
-          user = await req.server['userManager'].retrieveUserByExternalId(subjectId)
+          user = await req.server['userManager'].retrieveUserByExternalId(subjectId, req.db)
           if (user) {
             const isValid = await req.server['userManager'].isValidUser(user)
             if (!isValid) {
@@ -181,7 +131,7 @@ export default async (req, reply) => {
         }
 
         if (!user && req.server['tokenManager']?.isImplemented()) {
-          token = await req.server['tokenManager'].retrieveTokenByExternalId(subjectId)
+          token = await req.server['tokenManager'].retrieveTokenByExternalId(subjectId, req.db)
           if (token) {
             const isValid = await req.server['tokenManager'].isValidToken(token)
             if (!isValid) {
@@ -223,5 +173,3 @@ export default async (req, reply) => {
     }
   }
 }
-
-

package/lib/loader/router.ts

@@ -61,6 +61,132 @@ async function loadMiddlewares(base: string, middlewares: string[] = []) {
   return midds
 }
 
+
+function processRoute(
+  route: Route,
+  index: number,
+  file: string,
+  dir: string,
+  base: string,
+  defaultConfig: any,
+  authMiddlewares: string[],
+  validRoutes: ConfiguredRoute[]
+): ConfiguredRoute | null {
+  const errors: string[] = []
+  const {
+    method: methodCase,
+    path: pathName = '/',
+    handler,
+    roles: rs = [],
+    config = {} as RouteConfig,
+    middlewares = [],
+    rateLimit
+  } = route
+
+  const rsp = !rs.length ? [roles.public] : rs
+  let requiredRoles: Role[] = []
+
+  try {
+    requiredRoles = rsp.some((r) => r.code === roles.admin.code) ? rsp : [...rsp, roles.admin]
+  } catch (err) {
+    if (log.e) log.error(`Error in loading roles for ${methodCase} ${pathName} (${handler})`)
+    if (log.t) log.trace(err)
+    config.enable = false
+  }
+
+  const reqAuth: boolean =
+    middlewares.some((m) => authMiddlewares.includes(m)) ||
+    requiredRoles.every((r) => r.code !== roles.public.code)
+
+  if (!config?.security && reqAuth) {
+    config.security = 'bearer'
+  }
+
+  const {
+    title = '',
+    description = '',
+    enable = yn(defaultConfig.enable, true),
+    deprecated = yn(defaultConfig.deprecated, false),
+    tenantContext = yn(defaultConfig.tenantContext, true),
+    tags = defaultConfig.tags,
+    version = defaultConfig.version || '',
+    security = defaultConfig.security,
+    query,
+    params,
+    body,
+    response,
+    consumes,
+    rawBody = false
+  } = config || {}
+
+  const endpoint = `${dir}${pathName.replace(/\/+$/, '')}`
+  const method = methodCase.toUpperCase()
+  const num = index + 1
+  const handlerParts = handler.split('.')
+
+  if (enable) {
+    if (!pathName.startsWith('/')) errors.push(`Error in [${file}] bad path [${pathName}] at route n. ${num}`)
+    if (!methods.includes(method)) errors.push(`Error in [${file}] bad method [${method}] at route n. ${num}`)
+    if (handlerParts.length !== 2) errors.push(`Error in [${file}] bad handler [${handler}] at route n. ${num}`)
+
+    const key = method + endpoint + version
+    if (validRoutes.some((r) => `${r.method}${r.path}${r.doc?.version}` === key)) {
+      errors.push(`Error in [${file}] duplicated path [${pathName}] at route n. ${num}`)
+    }
+
+    if (errors.length > 0) {
+      if (log.e) errors.forEach((error) => log.error(error))
+    }
+  }
+
+  const toAdd = enable && errors.length === 0
+  if (toAdd) {
+    if (log.t)
+      log.trace(
+        `* Method [${method}] path ${endpoint} handler ${handler} enabled with ${
+          middlewares?.length || 0
+        } middlewares`
+      )
+  } else {
+    if (log.w) log.warn(`* Method [${method}] path ${endpoint} handler ${handler} disabled. Skip.`)
+  }
+
+  if (toAdd) {
+    const doc = {
+      summary: title,
+      description,
+      deprecated,
+      tags,
+      version,
+      security: security === 'bearer' ? [{ Bearer: [] }] : security,
+      response
+    } as any
+
+    if (query) doc.querystring = query
+    if (params) doc.params = params
+    if (body) doc.body = body
+    if (consumes) doc.consumes = consumes
+
+    return {
+      handler,
+      method,
+      path: '/' + endpoint,
+      middlewares,
+      roles: requiredRoles,
+      enable,
+      tenantContext,
+      rawBody,
+      rateLimit,
+      base,
+      file: path.join(base, defaultConfig.controller || 'controller', handlerParts[0]),
+      func: handlerParts[1],
+      doc: doc
+    }
+  }
+
+  return null
+}
+
 async function load(): Promise<ConfiguredRoute[]> {
   const validRoutes: ConfiguredRoute[] = []
   const patterns = normalizePatterns(['..', 'api', '**', 'routes.{ts,js}'], ['src', 'api', '**', 'routes.{ts,js}'])
@@ -84,114 +210,9 @@ async function load(): Promise<ConfiguredRoute[]> {
       if (log.t) log.trace(`* Add ${routes.length} routes from ${file}`)
 
       routes.forEach((route: Route, index: number) => {
-        const errors: string[] = []
-        const {
-          method: methodCase,
-          path: pathName = '/',
-          handler,
-          roles: rs = [],
-          config = {} as RouteConfig,
-          middlewares = [],
-          rateLimit
-        } = route
-
-        const rsp = !rs.length ? [roles.public] : rs
-        let requiredRoles: Role[] = []
-
-        try {
-          requiredRoles = rsp.some((r) => r.code === roles.admin.code) ? rsp : [...rsp, roles.admin]
-        } catch (err) {
-          if (log.e) log.error(`Error in loading roles for ${methodCase} ${pathName} (${handler})`)
-          if (log.t) log.trace(err)
-          config.enable = false
-        }
-
-        const reqAuth: boolean =
-          middlewares.some((m) => authMiddlewares.includes(m)) ||
-          requiredRoles.every((r) => r.code !== roles.public.code)
-
-        if (!config?.security && reqAuth) {
-          config.security = 'bearer'
-        }
-
-        const {
-          title = '',
-          description = '',
-          enable = yn(defaultConfig.enable, true),
-          deprecated = yn(defaultConfig.deprecated, false),
-          tags = defaultConfig.tags,
-          version = defaultConfig.version || '',
-          security = defaultConfig.security,
-          query,
-          params,
-          body,
-          response,
-          consumes,
-          rawBody = false
-        } = config || {}
-
-        const endpoint = `${dir}${pathName.replace(/\/+$/, '')}`
-        const method = methodCase.toUpperCase()
-        const num = index + 1
-        const handlerParts = handler.split('.')
-
-        if (enable) {
-          if (!pathName.startsWith('/')) errors.push(`Error in [${file}] bad path [${pathName}] at route n. ${num}`)
-          if (!methods.includes(method)) errors.push(`Error in [${file}] bad method [${method}] at route n. ${num}`)
-          if (handlerParts.length !== 2) errors.push(`Error in [${file}] bad handler [${handler}] at route n. ${num}`)
-
-          const key = method + endpoint + version
-          if (validRoutes.some((r) => `${r.method}${r.path}${r.doc?.version}` === key)) {
-            errors.push(`Error in [${file}] duplicated path [${pathName}] at route n. ${num}`)
-          }
-
-          if (errors.length > 0) {
-            if (log.e) errors.forEach((error) => log.error(error))
-          }
-        }
-
-        const toAdd = enable && errors.length === 0
-        if (toAdd) {
-          if (log.t)
-            log.trace(
-              `* Method [${method}] path ${endpoint} handler ${handler} enabled with ${
-                middlewares?.length || 0
-              } middlewares`
-            )
-        } else {
-          if (log.w) log.warn(`* Method [${method}] path ${endpoint} handler ${handler} disabled. Skip.`)
-        }
-
-        if (toAdd) {
-          const doc = {
-            summary: title,
-            description,
-            deprecated,
-            tags,
-            version,
-            security: security === 'bearer' ? [{ Bearer: [] }] : security,
-            response
-          } as any
-
-          if (query) doc.querystring = query
-          if (params) doc.params = params
-          if (body) doc.body = body
-          if (consumes) doc.consumes = consumes
-
-          validRoutes.push({
-            handler,
-            method,
-            path: '/' + endpoint,
-            middlewares,
-            roles: requiredRoles,
-            enable,
-            rawBody,
-            rateLimit,
-            base,
-            file: path.join(base, defaultConfig.controller || 'controller', handlerParts[0]),
-            func: handlerParts[1],
-            doc: doc
-          })
+        const configuredRoute = processRoute(route, index, file, dir, base, defaultConfig, authMiddlewares, validRoutes)
+        if (configuredRoute) {
+          validRoutes.push(configuredRoute)
         }
       })
     }
@@ -211,7 +232,8 @@ async function applyRoutes(server: any, routes: ConfiguredRoute[]): Promise<void
   let countRoutes = 0
   for (const route of routes) {
     if (route?.enable) {
-      const { handler, method, path, middlewares, roles, rawBody, rateLimit, base, file, func, doc } = route
+      const { handler, method, path, middlewares, roles, rawBody, rateLimit, base, file, func, doc, tenantContext } =
+        route
 
       if (log.d) log.debug(`* Add path ${method} ${path} on handle ${handler}`)
       const midds = await loadMiddlewares(base, middlewares)
@@ -224,7 +246,8 @@ async function applyRoutes(server: any, routes: ConfiguredRoute[]): Promise<void
         config: {
           requiredRoles: roles || [],
           rawBody: rawBody || false,
-          rateLimit: rateLimit || undefined
+          rateLimit: rateLimit || undefined,
+          tenantContext: tenantContext
         },
         handler: async function (req: FastifyRequest, reply: FastifyReply) {
           let module