@volcanicminds/backend 2.3.2 → 3.0.1

package/dist/types/global.d.ts

@@ -0,0 +1,318 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/* eslint-disable @typescript-eslint/no-empty-object-type */
+import { FastifyRequest, FastifyReply } from 'fastify'
+export { FastifyInstance } from 'fastify'
+import { EntityManager } from 'typeorm'
+import { MfaPolicy } from '../lib/config/constants.js'
+import { VQuery, VFindResult, VHeaders } from './orm.js'
+
+export { MfaPolicy, VQuery, VFindResult, VHeaders }
+
+export interface AuthenticatedUser {
+  getId(): any
+  username: string
+  email: string
+  roles: Role[]
+  externalId: string
+  mfaEnabled?: boolean
+}
+
+export interface AuthenticatedToken {
+  getId(): any
+  name: string
+  roles: Role[]
+}
+
+export interface Role {
+  code: string
+  name: string
+  description: string
+}
+
+export interface Roles {
+  [option: string]: Role
+}
+
+export interface Data {
+  [option: string]: any
+}
+
+export interface RouteConfig {
+  title: string
+  description: string
+  enable: boolean
+  deprecated: boolean
+  tenantContext?: boolean
+  tags?: string[]
+  version: string
+  security?: any
+  params?: any
+  query?: any
+  body?: any
+  response?: any
+  consumes?: any
+  rawBody?: boolean
+}
+
+export interface Route {
+  method: string
+  path: string
+  handler: string
+  roles: Role[]
+  middlewares: string[]
+  config?: RouteConfig
+  rateLimit?: any
+}
+
+export interface GeneralConfig {
+  name: string
+  options: {
+    allow_multiple_admin: boolean
+    admin_can_change_passwords: boolean
+    allow_admin_change_password_users: boolean
+    reset_external_id_on_login: boolean
+    scheduler: boolean
+    embedded_auth: boolean
+    // MFA Configs
+    mfa_policy?: MfaPolicy | string
+    mfa_admin_forced_reset_email?: string
+    mfa_admin_forced_reset_until?: string
+    // Multi-Tenant Configs
+    multi_tenant?: {
+      enabled: boolean
+      resolver?: 'subdomain' | 'header' | 'query'
+      header_key?: string
+      query_key?: string
+    }
+  }
+}
+
+export interface JobSchedule {
+  active: boolean // boolean (required)
+  type?: string // cron|interval, default: interval
+  async?: boolean // boolean, default: true
+  preventOverrun?: boolean // boolean, default: true
+
+  cron?: {
+    expression?: string // required if type = 'cron', use cron syntax (if not specified cron will be disabled)
+    timezone?: string // optional, like "Europe/Rome" (to test)
+  }
+
+  interval?: {
+    days?: number // number, default 0
+    hours?: number // number, default 0
+    minutes?: number // number, default 0
+    seconds?: number // number, default 0
+    milliseconds?: number // number, default 0
+    runImmediately?: boolean // boolean, default: false
+  }
+}
+
+export interface ConfiguredRoute {
+  enable: boolean
+  tenantContext: boolean
+  method: any
+  path: string
+  handler: any
+  rawBody: boolean
+  rateLimit: any
+  file: string
+  func: any
+  base: string
+  middlewares: string[]
+  roles: Role[]
+  doc: {
+    summary?: string
+    description?: string
+    deprecated?: boolean
+    tags?: string[]
+    version?: string
+    security?: any
+    params?: any
+    querystring?: any
+    body?: any
+    response?: any
+    consumes?: any
+  }
+}
+
+export interface TrackChanges {
+  enable: boolean
+  method: string
+  path: string
+  entity: string
+  changeEntity: string
+  fields?: {
+    includes?: string[] | null
+    excludes?: string[] | null
+  } | null
+  primaryKey?: string | null
+}
+
+export interface TrackChangesList {
+  [option: string]: TrackChanges
+}
+
+export interface UserManagement {
+  isImplemented(): boolean
+  isValidUser(data: any): boolean
+  createUser(data: any): any | null
+  deleteUser(data: any): any | null
+  resetExternalId(data: any): any | null
+  updateUserById(id: string, user: any): any | null
+  retrieveUserById(id: string): any | null
+  retrieveUserByEmail(email: string): any | null
+  retrieveUserByResetPasswordToken(code: string): any | null
+  retrieveUserByConfirmationToken(code: string): any | null
+  retrieveUserByUsername(username: string): any | null
+  retrieveUserByExternalId(externalId: string): any | null
+  retrieveUserByPassword(email: string, password: string): any | null
+  changePassword(email: string, password: string, oldPassword: string): any | null
+  forgotPassword(email: string): any | null
+  resetPassword(user: any, password: string): any | null
+  userConfirmation(user: any)
+  blockUserById(id: string, reason: string): any | null
+  unblockUserById(id: string): any | null
+  countQuery(data: VQuery): any | null
+  findQuery(data: VQuery): VFindResult<any> | null
+  disableUserById(id: string): any | null
+
+  // MFA Persistence Methods
+  saveMfaSecret(userId: string, secret: string): Promise<boolean>
+  retrieveMfaSecret(userId: string): Promise<string | null>
+  enableMfa(userId: string): Promise<boolean>
+  disableMfa(userId: string): Promise<boolean>
+
+  // Emergency Reset
+  forceDisableMfaForAdmin(email: string): Promise<boolean>
+}
+
+export interface TokenManagement {
+  isImplemented(): boolean
+  isValidToken(data: any): boolean
+  createToken(data: any): any | null
+  resetExternalId(id: string): any | null
+  updateTokenById(id: string, token: any): any | null
+  retrieveTokenById(id: string): any | null
+  retrieveTokenByExternalId(id: string): any | null
+  blockTokenById(id: string, reason: string): any | null
+  unblockTokenById(id: string): any | null
+  countQuery(data: VQuery): any | null
+  findQuery(data: VQuery): VFindResult<any> | null
+  removeTokenById(id: string): any | null
+}
+
+export interface DataBaseManagement {
+  isImplemented(): boolean
+  synchronizeSchemas(): any | null
+  retrieveBy(entityName, entityId): any | null
+  addChange(entityName, entityId, status, userId, contents, changeEntity): any | null
+}
+
+export interface MfaManagement {
+  generateSetup(appName: string, email: string): Promise<{ secret: string; uri: string; qrCode: string }>
+  verify(token: string, secret: string): boolean
+}
+
+// Callback type signature: (uploadOrId, req, res) => void
+export type TransferCallback = (data: any, req: any, res: any) => void
+
+export interface TransferManagement {
+  isImplemented(): boolean
+  getPath(): string
+  getServer(): any
+  onUploadCreate(callback: TransferCallback): void
+  onUploadFinish(callback: TransferCallback): void
+  onUploadTerminate(callback: TransferCallback): void
+  handle(req: any, res: any): Promise<void>
+  isValid(req: FastifyRequest): Promise<boolean>
+}
+
+export interface TenantManagement {
+  isImplemented(): boolean
+  resolveTenant(req: FastifyRequest): Promise<any | null>
+  switchContext(tenant: any, db?: EntityManager): Promise<void>
+  createTenant?(data: any): Promise<void>
+  deleteTenant?(id: string): Promise<void>
+  listTenants?(): Promise<any[]>
+  getTenant?(id: string): Promise<any | null>
+  updateTenant?(id: string, data: any): Promise<any | null>
+  restoreTenant?(id: string): Promise<any | null>
+}
+
+declare module 'fastify' {
+  export interface FastifyRequest {
+    user?: AuthenticatedUser
+    token?: AuthenticatedToken
+    startedAt?: Date
+    data(): Data & VQuery
+    parameters(): Data
+    roles(): string[]
+    hasRole(role: Role): boolean
+    payloadSize?: number
+    trackingData?: any
+    runner?: any
+    tenant?: any
+    /**
+     * The Tenant-Aware EntityManager for this request.
+     * MUST be used for all DB operations within this request scope.
+     */
+    db?: EntityManager
+    /** Raw request body, populated by `fastify-raw-body` when enabled on the route. */
+    rawBody?: string | Buffer
+    /** Multipart helpers, populated by `@fastify/multipart`. */
+    isMultipart(): boolean
+    file(options?: any): Promise<any>
+    files(options?: any): AsyncIterableIterator<any>
+  }
+  export interface FastifyReply {
+    payloadSize?: number
+  }
+}
+
+export interface FastifyRequest extends FastifyRequest {
+  user?: AuthenticatedUser
+  token?: AuthenticatedToken
+  startedAt?: Date
+  data(): Data & VQuery
+  parameters(): Data
+  roles(): string[]
+  hasRole(role: Role): boolean
+  payloadSize?: number
+  trackingData?: any
+  runner?: any
+  tenant?: any
+  /**
+   * The Tenant-Aware EntityManager for this request.
+   * MUST be used for all DB operations within this request scope.
+   */
+  db?: EntityManager
+  /** Raw request body, populated by `fastify-raw-body` when enabled on the route. */
+  rawBody?: string | Buffer
+  /** Multipart helpers, populated by `@fastify/multipart`. */
+  isMultipart(): boolean
+  file(options?: any): Promise<any>
+  files(options?: any): AsyncIterableIterator<any>
+}
+
+export interface FastifyReply extends FastifyReply {
+  payloadSize?: number
+}
+
+export interface global {}
+
+declare global {
+  var log: any
+  var server: any
+  var config: GeneralConfig
+  var transferConfig: TransferConfig
+  var transferPath: string | null
+  var roles: Roles
+  var tracking: TrackChangesList
+  var trackingConfig: Data
+  var connection: any
+  var entity: any
+  var repository: any
+}
+
+export { global }

package/dist/types/orm.d.ts

@@ -0,0 +1,22 @@
+export interface VQuery {
+  page?: number
+  pageSize?: number
+  take?: number
+  skip?: number
+  sort?: string[] | string
+  _logic?: string
+  [key: string]: unknown
+}
+
+export interface VHeaders {
+  'v-count': number
+  'v-total': number
+  'v-page': number
+  'v-pageSize': number
+  'v-pageCount': number
+}
+
+export interface VFindResult<T> {
+  records: T[]
+  headers: VHeaders
+}

package/lib/api/auth/controller/auth.ts

@@ -3,6 +3,10 @@ import { FastifyReply, FastifyRequest } from 'fastify'
 import * as regExp from '../../../util/regexp.js'
 import { MfaPolicy } from '../../../config/constants.js'
 
+// Upper bound for the password accepted at login: a cheap guard against oversized
+// payloads. Complexity is enforced only when a password is set, not at login.
+const MAX_PASSWORD_LENGTH = 256
+
 export async function register(req: FastifyRequest, reply: FastifyReply) {
   const { password1: password, password2, ...data } = req.data()
 
@@ -13,7 +17,7 @@ export async function register(req: FastifyRequest, reply: FastifyReply) {
   if (!data.username) {
     return reply.status(400).send(new Error('Username not valid'))
   }
-  if (!data.email || !regExp.email.test(data.email)) {
+  if (!regExp.isEmail(data.email)) {
     return reply.status(400).send(new Error('Email not valid'))
   }
   if (!password || !regExp.password.test(password)) {
@@ -136,7 +140,7 @@ export async function forgotPassword(req: FastifyRequest, reply: FastifyReply) {
     throw new Error('Not implemented')
   }
 
-  if (!username && (!email || (email && !regExp.email.test(email)))) {
+  if (!username && !regExp.isEmail(email)) {
     return reply.status(400).send(new Error('Missing a valid user identifier'))
   }
 
@@ -226,10 +230,15 @@ export async function login(req: FastifyRequest, reply: FastifyReply) {
     throw new Error('Not implemented')
   }
 
-  if (!email || !regExp.email.test(email)) {
+  if (!regExp.isEmail(email)) {
     return reply.status(400).send(new Error('Email not valid'))
   }
-  if (!password || !regExp.password.test(password)) {
+  // At login we do NOT re-validate the password complexity policy: the password
+  // was already validated when it was set (register/change/reset), and bcrypt is
+  // the actual security gate. Re-checking the policy here adds no security and
+  // would lock out existing users whenever the policy changes. We only bound the
+  // input length as a cheap guard against oversized payloads.
+  if (!password || password.length > MAX_PASSWORD_LENGTH) {
     return reply.status(400).send(new Error('Password not valid'))
   }
 
@@ -241,7 +250,7 @@ export async function login(req: FastifyRequest, reply: FastifyReply) {
   const isValid = await req.server['userManager'].isValidUser(user)
 
   if (!isValid) {
-    return reply.status(403).send(new Error('Wrong credentials'))
+    return reply.status(403).send(new Error('Invalid user'))
   }
 
   if (!(user.confirmed === true)) {
@@ -333,10 +342,21 @@ export async function refreshToken(req: FastifyRequest, reply: FastifyReply) {
     throw new Error('Not implemented')
   }
 
-  const tokenData = (await reply.server.jwt.decode(token)) as { sub: number }
-  const minAccettable = Math.floor(Date.now() / 1000) - 2592000 // 30 days
+  // Verify the signature of the (possibly expired) access token: `ignoreExpiration`
+  // lets a stale token through — which is the whole point of refresh — but a forged
+  // or tampered token is now rejected (previously `decode` skipped signature checks).
+  let tokenData: { sub: number; iat?: number }
+  try {
+    tokenData = (await reply.server.jwt.verify(token, { ignoreExpiration: true })) as { sub: number; iat?: number }
+  } catch {
+    return reply.status(403).send(new Error('Invalid token'))
+  }
 
-  if (tokenData?.sub > 0 && tokenData?.sub > minAccettable) {
+  // Reject refresh of access tokens issued too long ago. Use the real temporal
+  // claim (`iat`), not `sub` (the externalId): the old check compared a user id
+  // against a unix timestamp and was effectively dead code.
+  const minAccettable = Math.floor(Date.now() / 1000) - 2592000 // 30 days
+  if (!tokenData?.iat || tokenData.iat < minAccettable) {
     return reply.status(403).send(new Error('Token too old'))
   }
 
@@ -369,8 +389,6 @@ export async function invalidateTokens(req: FastifyRequest, reply: FastifyReply)
   return { ok: isValid }
 }
 
-
-
 export async function mfaSetup(req: FastifyRequest, reply: FastifyReply) {
   const user = req.user
   if (!user) return reply.status(401).send(new Error('Unauthorized'))
@@ -499,5 +517,3 @@ export async function mfaDisable(req: FastifyRequest, reply: FastifyReply) {
     return reply.status(500).send(new Error('Failed to disable MFA'))
   }
 }
-
-

package/lib/api/health/controller/health.ts

@@ -1,5 +1,5 @@
 import { FastifyReply, FastifyRequest } from 'fastify'
 
-export function check(req: FastifyRequest, reply: FastifyReply) {
+export function check(_req: FastifyRequest, reply: FastifyReply) {
   reply.send({ ok: true })
 }

package/lib/api/health/routes.ts

@@ -15,6 +15,7 @@ export default {
       config: {
         title: 'Health check service',
         description: 'Health check service',
+        tenantContext: false,
         response: {
           200: { $ref: 'defaultResponse#' }
         }

package/lib/api/tenants/controller/tenants.ts

@@ -0,0 +1,211 @@
+import { FastifyReply, FastifyRequest } from 'fastify'
+
+/*
+ * S12 — schema name hardening for `SET search_path`.
+ * Postgres identifiers cannot be parameterized, so the schema name is always
+ * string-interpolated. Mirror the canonical sanitization used by
+ * `@volcanicminds/typeorm`'s `tenantManager.switchContext`
+ * (`schema.replace(/[^a-z0-9_]/gi, '')`): strip anything outside the safe
+ * identifier alphabet. A legit schema name is unaffected; a tampered/malformed
+ * value collapses to empty and is rejected fail-fast instead of being injected.
+ */
+export function sanitizeSchemaName(schema: string): string {
+  return (schema || '').replace(/[^a-z0-9_]/gi, '')
+}
+
+export async function list(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const tenants = await tm.listTenants()
+  return reply.send(tenants)
+}
+
+export async function create(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const data = req.data()
+  // Provisioning is handled by the manager implementation
+  const tenant = await tm.createTenant(data)
+
+  // Return created
+  return reply.code(201).send(tenant)
+}
+
+export async function findOne(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const { id } = req.parameters()
+  const tenant = await tm.getTenant(id)
+  if (!tenant) return reply.status(404).send()
+  return reply.send(tenant)
+}
+
+export async function update(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const { id } = req.parameters()
+  const data = req.data()
+  const tenant = await tm.updateTenant(id, data)
+  if (!tenant) return reply.status(404).send()
+  return reply.send(tenant)
+}
+
+export async function remove(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const { id } = req.parameters()
+  await tm.deleteTenant(id)
+  return reply.send({ message: 'Tenant archived/deleted', id })
+}
+
+export async function restore(req: FastifyRequest, reply: FastifyReply) {
+  const tm = req.server['tenantManager']
+  if (!tm.isImplemented()) return reply.status(501).send()
+
+  const { id } = req.parameters()
+  const tenant = await tm.restoreTenant(id)
+  return reply.send({ message: 'Tenant restored', tenant })
+}
+
+// Helper: Resolve Target Tenant
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+async function resolveTargetTenant(targetTenantSlug: string, targetTenantId: string, reqTenant: any) {
+  let resolvedSlug = targetTenantSlug
+  if (!resolvedSlug && !targetTenantId && reqTenant) {
+    resolvedSlug = reqTenant.slug
+  }
+
+  const Tenant = global.entity?.Tenant || global.connection.getRepository('Tenant').target
+  const tenantRepo = global.connection.getRepository(Tenant)
+
+  return tenantRepo.findOne({
+    where: [
+      { slug: resolvedSlug, status: 'active' },
+      { id: targetTenantId, status: 'active' }
+    ]
+  })
+}
+
+// Helper: Security Check
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function checkImpersonationSecurity(req: FastifyRequest, targetTenant: any): boolean {
+  let isSystemAdmin = false
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  if (req.user?.tenantId === 'system' || req.tenant?.slug === 'system') {
+    isSystemAdmin = true
+  }
+
+  let isTenantAdminForTarget = false
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  if (req.tenant?.id === targetTenant.id || req.tenant?.slug === targetTenant.slug) {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    const userRoles = typeof req.roles === 'function' ? req.roles() : req.user?.roles || []
+    const roleCodes = userRoles.map((r: { code?: string } | string) => (typeof r === 'string' ? r : r?.code))
+
+    if (roleCodes.includes('admin')) {
+      isTenantAdminForTarget = true
+    }
+  }
+
+  return isSystemAdmin || isTenantAdminForTarget
+}
+
+// Helper: Resolve Target User
+async function resolveTargetUser(dbSchema: string, targetUserId: string, targetUserEmail: string, targetRole: string) {
+  const safeSchema = sanitizeSchemaName(dbSchema)
+  if (!safeSchema) {
+    throw new Error('Invalid target tenant schema')
+  }
+
+  const qr = global.connection.createQueryRunner()
+  await qr.connect()
+
+  try {
+    await qr.query(`SET search_path TO "${safeSchema}", "public"`)
+
+    const UserEntity = global.entity?.User || 'User'
+    const targetUserRepo = qr.manager.getRepository(UserEntity)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let targetUser: any = null
+
+    const baseWhere = { blocked: false }
+
+    if (targetUserId) {
+      targetUser = await targetUserRepo.findOne({ where: { ...baseWhere, id: targetUserId } })
+    } else if (targetUserEmail) {
+      targetUser = await targetUserRepo.findOne({ where: { ...baseWhere, email: targetUserEmail } })
+    } else if (targetRole) {
+      targetUser = await targetUserRepo
+        .createQueryBuilder('user')
+        .where('user.blocked = :blocked', { blocked: false })
+        .andWhere(':role = ANY(user.roles)', { role: targetRole })
+        .getOne()
+    }
+
+    return targetUser
+  } finally {
+    await qr.release()
+  }
+}
+
+export async function impersonate(req: FastifyRequest, reply: FastifyReply) {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any, prefer-const
+  let { targetTenantSlug, targetTenantId, targetRole, targetUserEmail, targetUserId } = req.body as any
+
+  // 1. Risoluzione Tenant
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const targetTenant = await resolveTargetTenant(targetTenantSlug, targetTenantId, req.tenant)
+  if (!targetTenant) {
+    return reply.code(404).send({ error: 'Target tenant not found or inactive' })
+  }
+
+  // 2. Security Check (Hardened)
+  const isAuthorized = checkImpersonationSecurity(req, targetTenant)
+  if (!isAuthorized) {
+    return reply
+      .code(403)
+      .send({ error: 'Unauthorized: Only System Admins or Tenant Admins can impersonate (Invalid Context)' })
+  }
+
+  // 3. Risoluzione Utente (su schema target)
+  const dbSchema = targetTenant.dbSchema
+  if (!dbSchema) {
+    throw new Error('Target tenant has no schema defined')
+  }
+
+  const targetUser = await resolveTargetUser(dbSchema, targetUserId, targetUserEmail, targetRole)
+
+  if (!targetUser) {
+    return reply.code(404).send({ error: 'Target user not found (or blocked) matching criteria' })
+  }
+
+  // 4. Generazione Token Impersonato
+  // We rely on fastify-jwt which is decorated on 'reply' (standard in volcanic-backend)
+  const token = await reply.jwtSign(
+    {
+      sub: targetUser.externalId, // Identity: The Local Admin
+      tid: targetTenant.id, // Context: The Target Tenant
+      roles: targetUser.roles, // Privileges: Inherited from Target
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-ignore
+      impersonator: req.user.email, // Audit: Who is holding the puppet strings
+      iat: Math.floor(Date.now() / 1000)
+    },
+    { expiresIn: '24h' }
+  )
+
+  return {
+    token,
+    expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+    impersonatedUser: { email: targetUser.email, id: targetUser.id }
+  }
+}