@voxgig/build 4.4.0 → 4.11.0

package/tm/web/backend/srv/api/on_ent.ts.frag

@@ -0,0 +1,124 @@
+import { exposedCanon } from './expose'
+
+// aim:api,on:ent  { op, ent:'zone/name', id?, data?, q? }
+// One REST operation on one entity. Validates the entity is exposed by
+// the API (model main.api) and the data against the GENERATED entity
+// shapes (valid_gen.ts - strict: unknown fields are rejected), then
+// delegates to the generic entity service (aim:ent,cmd:*), which
+// enforces membership access. The caller's principal (resolved from the
+// API key by the router) propagates via meta.custom.
+module.exports = function make_on_ent() {
+  const makeShapes = require('./valid_gen')
+  let shapes: any = null
+
+  return async function on_ent(this: any, msg: any) {
+    const seneca = this
+    const model = seneca.context.model
+
+    shapes = shapes || makeShapes(seneca.util.Gubu)
+
+    const op = String(msg.op || '')
+    const canon = String(msg.ent || '')
+
+    if (!exposedCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+
+    if ('list' === op) {
+      return relay(await seneca.post('aim:ent,cmd:list',
+        { ent: canon, q: coerceQ(model, canon, msg.q || {}) }))
+    }
+
+    if ('load' === op) {
+      const res = await seneca.post('aim:ent,cmd:load', { ent: canon, id: msg.id })
+      if (res.ok && null == res.item) {
+        return { ok: false, why: 'not-found' }
+      }
+      return relay(res)
+    }
+
+    if ('create' === op || 'update' === op) {
+      const shape = shapes[canon] && shapes[canon][op]
+      if (null == shape) {
+        return { ok: false, why: 'unknown-entity' }
+      }
+      let data = null == msg.data ? {} : msg.data
+      try {
+        data = shape(data)
+      }
+      catch (e: any) {
+        if ('shape' !== e.code) {
+          throw e
+        }
+        return {
+          ok: false, why: 'invalid-data', message: e.message,
+          details: (e.props || []).map((p: any) =>
+            ({ path: p.path, what: p.what, type: p.type })),
+        }
+      }
+      if ('update' === op) {
+        const existing = await seneca.post('aim:ent,cmd:load', { ent: canon, id: msg.id })
+        if (!existing.ok || null == existing.item) {
+          return { ok: false, why: existing.ok ? 'not-found' : existing.why }
+        }
+        data = Object.assign({}, existing.item.data$ ?
+          existing.item.data$(false) : existing.item, data, { id: msg.id })
+      }
+      return relay(await seneca.post('aim:ent,cmd:save', { ent: canon, item: data }))
+    }
+
+    if ('remove' === op) {
+      const existing = await seneca.post('aim:ent,cmd:load', { ent: canon, id: msg.id })
+      if (!existing.ok || null == existing.item) {
+        return { ok: false, why: existing.ok ? 'not-found' : existing.why }
+      }
+      return relay(await seneca.post('aim:ent,cmd:remove', { ent: canon, id: msg.id }))
+    }
+
+    return { ok: false, why: 'unknown-op' }
+  }
+}
+
+// Pass the ent service result through, stripping entity instances down
+// to plain data (strict JSON out).
+function relay(res: any) {
+  if (null == res || !res.ok) {
+    return res || { ok: false, why: 'failed' }
+  }
+  const out: any = { ok: true }
+  if (null != res.item) {
+    out.item = plain(res.item)
+  }
+  if (null != res.list) {
+    out.items = res.list.map(plain)
+  }
+  if (null != res.id) {
+    out.id = res.id
+  }
+  return out
+}
+
+function plain(item: any) {
+  return item && 'function' === typeof item.data$ ? item.data$(false) : item
+}
+
+// HTTP query values arrive as strings; coerce them to the field's kind
+// so exact-match filtering works (done=true, t_c=123, ...).
+function coerceQ(model: any, canon: string, q: any) {
+  const [zone, name] = canon.split('/')
+  const fields = (model.main.ent[zone][name] || {}).field || {}
+  const out: any = {}
+  for (const k of Object.keys(q)) {
+    const kind = fields[k] && fields[k].kind
+    let v: any = q[k]
+    if ('Number' === kind) {
+      v = Number(v)
+    }
+    else if ('Boolean' === kind) {
+      v = 'false' !== v && false !== v
+    }
+    out[k] = v
+  }
+  return out
+}
+

package/tm/web/backend/srv/auth/apikey_util.ts.frag

@@ -0,0 +1,10 @@
+// Shared helper for the apikey actions (not an action file).
+// Never expose the stored hash.
+export function publicKey(item: any) {
+  if (null == item) {
+    return null
+  }
+  const d = 'function' === typeof item.data$ ? item.data$(false) : item
+  return { id: d.id, name: d.name, prefix: d.prefix, revoked: !!d.revoked, t_c: d.t_c }
+}
+

package/tm/web/backend/srv/auth/auth-srv.ts.frag

@@ -2,3 +2,4 @@
 import { MakeSrv } from '@voxgig/system'
 
 module.exports = MakeSrv('auth', require)
+

package/tm/web/backend/srv/auth/change_pass.ts.frag

@@ -0,0 +1,12 @@
+// aim:auth,change:pass — change the current user's password via @seneca/user.
+module.exports = function make_change_pass() {
+  return async function change_pass(this: any, msg: any) {
+    const res = await this.post('sys:user,change:pass', {
+      user_id: msg.user_id,
+      password: msg.password,
+      repeat: msg.repeat,
+    })
+    return res.ok ? { ok: true } : { ok: false, why: res.why || 'change-failed' }
+  }
+}
+

package/tm/web/backend/srv/auth/create_apikey.ts.frag

@@ -0,0 +1,33 @@
+import Crypto from 'node:crypto'
+
+import { publicKey } from './apikey_util'
+
+// aim:auth,create:apikey  { user_id, name }
+// Create an API access key for the user. The raw key is returned ONCE
+// (never stored): only its sha-256 hash is kept, plus a short prefix for
+// display. Keys authenticate REST API calls (Authorization: Bearer).
+module.exports = function make_create_apikey() {
+  return async function create_apikey(this: any, msg: any) {
+    const seneca = this
+    const user_id = String(msg.user_id || '')
+    const name = String(msg.name || '').trim()
+    if ('' === user_id || '' === name) {
+      return { ok: false, why: 'invalid-args' }
+    }
+
+    const key = 'vk_' + Crypto.randomBytes(24).toString('hex')
+    const hash = Crypto.createHash('sha256').update(key).digest('hex')
+
+    const item = await seneca.entity('sys/apikey').data$({
+      user_id,
+      name,
+      hash,
+      prefix: key.slice(0, 8),
+      revoked: false,
+      t_c: Date.now(),
+    }).save$()
+
+    return { ok: !!item, key, item: publicKey(item) }
+  }
+}
+

package/tm/web/backend/srv/auth/get_info.ts.frag

@@ -3,3 +3,4 @@ module.exports = function make_get_info() {
     return { ok: true, srv: 'auth' }
   }
 }
+

package/tm/web/backend/srv/auth/list_apikey.ts.frag

@@ -0,0 +1,15 @@
+import { publicKey } from './apikey_util'
+
+// aim:auth,list:apikey  { user_id }
+// List the user's API keys (hashes never leave the service).
+module.exports = function make_list_apikey() {
+  return async function list_apikey(this: any, msg: any) {
+    const user_id = String(msg.user_id || '')
+    if ('' === user_id) {
+      return { ok: false, why: 'invalid-args' }
+    }
+    const list = await this.entity('sys/apikey').list$({ user_id })
+    return { ok: true, items: list.map(publicKey) }
+  }
+}
+

package/tm/web/backend/srv/auth/load_auth.ts.frag

@@ -1,6 +1,15 @@
+import { publicUser } from './user_util'
+
+// Load the auth state for a user id. The user is projected to safe
+// fields (never the password hash or salt) - see user_util.
 module.exports = function make_load_auth() {
   return async function load_auth(this: any, msg: any) {
     const user = await this.entity('sys/user').load$(msg.user_id)
-    return { ok: !!user, state: user ? 'signedin' : 'signedout', user }
+    return {
+      ok: !!user,
+      state: user ? 'signedin' : 'signedout',
+      user: publicUser(user),
+    }
   }
 }
+

package/tm/web/backend/srv/auth/remind_pass.ts.frag

@@ -0,0 +1,35 @@
+// aim:auth,remind:pass — password reminder. Creates a reset code but does
+// NOT actually send an email (this is a demo); it logs what WOULD be sent.
+// Always returns ok, regardless of whether the email exists, to avoid
+// leaking which addresses are registered.
+module.exports = function make_remind_pass() {
+  return async function remind_pass(this: any, msg: any) {
+    const email = String(msg.email || '').trim()
+    if ('' === email) {
+      return { ok: true }
+    }
+
+    const found = await this.post('sys:user,get:user', { email })
+    if (found.ok && found.user) {
+      let code = '(reset-code)'
+      try {
+        const v = await this.post('sys:user,make:verify', {
+          user_id: found.user.id,
+          kind: 'pass',
+        })
+        code = (v && ((v.verify && (v.verify.id || v.verify.code)) || v.id)) || code
+      }
+      catch (e) {
+        // best-effort; the reminder is a stub
+      }
+
+      // IMPORTANT: no email is actually sent — just record what would be.
+      this.log.info('password-reminder', { to: email, code, sent: false })
+      // eslint-disable-next-line no-console
+      console.log('[PASSWORD-REMINDER] (not sent) to=' + email + ' reset-code=' + code)
+    }
+
+    return { ok: true }
+  }
+}
+

package/tm/web/backend/srv/auth/revoke_apikey.ts.frag

@@ -0,0 +1,23 @@
+import { publicKey } from './apikey_util'
+
+// aim:auth,revoke:apikey  { user_id, id }
+// Revoke one of the user's API keys. The record is kept (audit trail);
+// revoked keys fail REST authentication immediately.
+module.exports = function make_revoke_apikey() {
+  return async function revoke_apikey(this: any, msg: any) {
+    const seneca = this
+    const user_id = String(msg.user_id || '')
+    const id = String(msg.id || '')
+    if ('' === user_id || '' === id) {
+      return { ok: false, why: 'invalid-args' }
+    }
+    const item = await seneca.entity('sys/apikey').load$(id)
+    if (null == item || item.user_id !== user_id) {
+      return { ok: false, why: 'not-found' }
+    }
+    item.revoked = true
+    const saved = await item.save$()
+    return { ok: !!saved, item: publicKey(saved) }
+  }
+}
+

package/tm/web/backend/srv/auth/signin_user.ts.frag

@@ -1,4 +1,10 @@
+import { publicUser } from './user_util'
+
 // Sign a user in via @seneca/user login (email + password).
+//
+// The user is projected to safe fields: @seneca/user answers with the
+// full entity (password hash + salt) regardless of the `fields` option,
+// and aim:auth messages are reachable through the gateway.
 module.exports = function make_signin_user() {
   return async function signin_user(this: any, msg: any) {
     const seneca = this
@@ -6,9 +12,13 @@ module.exports = function make_signin_user() {
     const out = await seneca.post('sys:user,login:user', {
       email: msg.email,
       password: msg.password,
-      fields: ['id', 'email', 'name', 'handle'],
     })
 
-    return out
+    if (!out.ok) {
+      return { ok: false, why: out.why }
+    }
+
+    return { ok: true, user: publicUser(out.user), login: out.login }
   }
 }
+

package/tm/web/backend/srv/auth/signout_user.ts.frag

@@ -1,5 +1,15 @@
+// End a login session.
+//
+// @seneca/user's logout:user needs a USER QUERY, not just a token: given
+// only a token it answers `no-user-query` and leaves the sys/login row
+// active - i.e. the token would keep working after sign-out. Pass the
+// user id along with the token so the session is really revoked.
 module.exports = function make_signout_user() {
   return async function signout_user(this: any, msg: any) {
-    return this.post('sys:user,logout:user', { token: msg.token })
+    return this.post('sys:user,logout:user', {
+      user_id: msg.user_id,
+      token: msg.token,
+    })
   }
 }
+

package/tm/web/backend/srv/auth/update_user.ts.frag

@@ -0,0 +1,15 @@
+// aim:auth,update:user — update the current user's profile (name, etc.).
+module.exports = function make_update_user() {
+  return async function update_user(this: any, msg: any) {
+    const res = await this.post('sys:user,update:user', {
+      user_id: msg.user_id,
+      user_data: msg.data || {},
+    })
+    if (!res.ok) {
+      return { ok: false, why: res.why || 'update-failed' }
+    }
+    const u = res.user || {}
+    return { ok: true, user: { id: u.id, name: u.name, email: u.email, handle: u.handle } }
+  }
+}
+

package/tm/web/backend/srv/auth/user_util.ts.frag

@@ -0,0 +1,21 @@
+// Shared helper for the auth actions (not an action file).
+//
+// Project a user down to the fields safe to send to a client. The
+// @seneca/user entity carries the password hash (`pass`) and `salt`, and
+// the `fields` option of sys:user,* does NOT restrict the user object it
+// returns - so every action that answers with a user must project it
+// here. aim:auth messages are reachable through the gateway, so this is
+// the difference between a client seeing an email and seeing a hash.
+export function publicUser(user: any) {
+  if (null == user) {
+    return undefined
+  }
+  const d = 'function' === typeof user.data$ ? user.data$(false) : user
+  return {
+    id: d.id,
+    email: d.email,
+    name: d.name,
+    handle: d.handle,
+  }
+}
+

package/tm/web/backend/srv/auth/web_change_pass.ts.frag

@@ -0,0 +1,16 @@
+// Gateway wrapper: change the SIGNED-IN user's password (from the cookie
+// principal, never a caller-supplied id).
+module.exports = function make_web_change_pass() {
+  return async function web_change_pass(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,change:pass', {
+      user_id: user.id,
+      password: msg.password,
+      repeat: msg.repeat,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_create_apikey.ts.frag

@@ -0,0 +1,15 @@
+// Gateway wrapper: create an API key for the SIGNED-IN user (from the
+// cookie principal, never a caller-supplied id).
+module.exports = function make_web_create_apikey() {
+  return async function web_create_apikey(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,create:apikey', {
+      user_id: user.id,
+      name: msg.name,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_list_apikey.ts.frag

@@ -0,0 +1,11 @@
+// Gateway wrapper: list the SIGNED-IN user's API keys.
+module.exports = function make_web_list_apikey() {
+  return async function web_list_apikey(this: any, _msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,list:apikey', { user_id: user.id })
+  }
+}
+

package/tm/web/backend/srv/auth/web_load_auth.ts.frag

@@ -10,3 +10,4 @@ module.exports = function make_web_load_auth() {
     return out
   }
 }
+

package/tm/web/backend/srv/auth/web_remind_pass.ts.frag

@@ -0,0 +1,7 @@
+// Gateway wrapper: public password-reminder request (no auth required).
+module.exports = function make_web_remind_pass() {
+  return async function web_remind_pass(this: any, msg: any) {
+    return this.post('aim:auth,remind:pass', { email: msg.email })
+  }
+}
+

package/tm/web/backend/srv/auth/web_revoke_apikey.ts.frag

@@ -0,0 +1,14 @@
+// Gateway wrapper: revoke one of the SIGNED-IN user's API keys.
+module.exports = function make_web_revoke_apikey() {
+  return async function web_revoke_apikey(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,revoke:apikey', {
+      user_id: user.id,
+      id: msg.id,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_signin_user.ts.frag

@@ -23,3 +23,4 @@ module.exports = function make_web_signin_user() {
     return out
   }
 }
+

package/tm/web/backend/srv/auth/web_signout_user.ts.frag

@@ -1,9 +1,17 @@
+// Gateway signout: revoke the session server-side, then tell
+// gateway-auth (express_cookie) to clear the auth cookie.
 module.exports = function make_web_signout_user() {
   return async function web_signout_user(this: any, _msg: any, meta: any) {
-    const token = meta.custom?.principal?.token
-    if (token) {
-      await this.post('aim:auth,signout:user', { token })
+    const principal = meta.custom?.principal
+    const token = principal?.token
+    const user_id = principal?.user?.id
+
+    if (token || user_id) {
+      // Both are needed: a token alone does not revoke the login row.
+      await this.post('aim:auth,signout:user', { user_id, token })
     }
+
     return { ok: true, gateway$: { auth: { remove: true } } }
   }
 }
+

package/tm/web/backend/srv/auth/web_update_user.ts.frag

@@ -0,0 +1,11 @@
+// Gateway wrapper: update the SIGNED-IN user's profile.
+module.exports = function make_web_update_user() {
+  return async function web_update_user(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,update:user', { user_id: user.id, data: msg.data })
+  }
+}
+

package/tm/web/backend/srv/ent/access.ts.frag

@@ -0,0 +1,179 @@
+// Access control support for the generic entity service.
+//
+// Enforcement itself lives in @seneca/owner (configured in
+// src/env/shared/basic.ts), which scopes every entity message by the two
+// ownership axes it finds on `custom.sysowner`:
+//
+//   owner_id   the acting user
+//   project_id the project in play (the tenant axis)
+//
+// This module's job is only to RESOLVE those axes from the gateway
+// principal and the message, and to say which canons the service will
+// answer for at all. It does not filter rows - the entity layer does.
+//
+// Relationships in the model are reference fields: `kind: String` plus a
+// `ref: 'zone/name'` attribute (never `kind: 'Ref'`).
+
+import { base } from '../../env/shared/basic'
+
+// The ownership axes @seneca/owner manages. They are SERVER-managed: a
+// client may neither set them nor round-trip them back on update (a loaded
+// row carries them, and owner rejects a create/update whose payload
+// disagrees with the acting owner - see stripOwned).
+export const OWNER_FIELDS: string[] = base.options.owner.fields
+
+// @seneca/owner fails writes loudly rather than returning an empty result,
+// so a denial arrives as an error, not a null.
+const DENIED = [
+  'create-not-allowed',
+  'update-not-allowed',
+  'save-not-found',
+  'role-entity-not-allowed',
+]
+
+export function isDenied(err: any): boolean {
+  return !!err && DENIED.indexOf(err.code) >= 0
+}
+
+// Drop the server-managed ownership fields from client data, so owner
+// injects them from custom.sysowner instead of comparing them to a claim.
+export function stripOwned(data: any): any {
+  for (const f of OWNER_FIELDS) {
+    delete data[f]
+  }
+  return data
+}
+
+export type Scope =
+  | { kind: 'project' }
+  | { kind: 'scoped'; via: string }
+  | { kind: 'user' }
+  | { kind: 'open' }
+
+export function principalOf(meta: any): any {
+  return (meta && meta.custom && meta.custom.principal && meta.custom.principal.user) || null
+}
+
+export function entDef(model: any, canon: string): any {
+  const [zone, name] = String(canon).split('/')
+  return model && model.main && model.main.ent &&
+    model.main.ent[zone] && model.main.ent[zone][name] || null
+}
+
+export function validCanon(model: any, canon: string): boolean {
+  if (!entDef(model, canon)) {
+    return false
+  }
+  const zone = String(canon).split('/')[0]
+  // Only sys/user is reachable from the sys zone (for pickers); sys/login etc. are not.
+  return 'sys' !== zone || 'sys/user' === canon
+}
+
+// Find the reference field that targets proj/project, if any.
+function projectRefField(model: any, canon: string): string | null {
+  const def = entDef(model, canon)
+  const fields = (def && def.field) || {}
+  for (const fname of Object.keys(fields)) {
+    const f = fields[fname]
+    if (f && 'proj/project' === f.ref) {
+      return fname
+    }
+  }
+  return null
+}
+
+export function scopeOf(model: any, canon: string): Scope {
+  if ('proj/project' === canon) {
+    return { kind: 'project' }
+  }
+  if ('sys/user' === canon) {
+    return { kind: 'open' }
+  }
+  const via = projectRefField(model, canon)
+  if (via) {
+    return { kind: 'scoped', via }
+  }
+  return { kind: 'user' }
+}
+
+// Project ids the given user is a member of.
+export async function myProjectIds(seneca: any, userId: string): Promise<string[]> {
+  if (!userId) {
+    return []
+  }
+  const members = await seneca.entity('proj/member').list$({ user_id: userId })
+  const ids: string[] = []
+  for (const m of members) {
+    if (null != m.project_id && ids.indexOf(m.project_id) < 0) {
+      ids.push(m.project_id)
+    }
+  }
+  return ids
+}
+
+export async function isMember(seneca: any, userId: string, projectId: string): Promise<boolean> {
+  if (!userId || null == projectId) {
+    return false
+  }
+  const m = await seneca.entity('proj/member').load$({ user_id: userId, project_id: projectId })
+  return !!m
+}
+
+// The project this message acts in, taken from the message itself: the
+// query filter for a list, the item's project ref for a save, else null
+// (load/remove address a row by id and are resolved by the caller).
+export function projectOf(model: any, canon: string, msg: any): string | null {
+  const scope = scopeOf(model, canon)
+  if ('scoped' !== scope.kind) {
+    return null
+  }
+  const via = (scope as any).via
+  const q = msg.q || {}
+  const item = msg.item || {}
+  return null != q[via] ? q[via] : (null != item[via] ? item[via] : null)
+}
+
+// The @seneca/owner axes for a user acting in a project. Pure: use it
+// only where membership is ALREADY established (project ids that came
+// out of the member table). Everywhere else use ownerOf.
+export function ownerFor(user: any, projectId: string | null): any {
+  // No project in play -> owner-only scoping (the `user` role).
+  return null == projectId
+    ? { owner_id: user.id, role: 'user' }
+    : { owner_id: user.id, project_id: projectId, role: 'member' }
+}
+
+// Same, but confirms membership first. Returns null when the caller is
+// not a member of the requested project, which the caller turns into
+// 'forbidden' - owner would deny the row anyway, this just gives a
+// precise reason instead of an empty result.
+export async function ownerOf(
+  seneca: any, user: any, projectId: string | null
+): Promise<any> {
+  if (null == projectId) {
+    return ownerFor(user, null)
+  }
+  if (!(await isMember(seneca, user.id, projectId))) {
+    return null
+  }
+  return ownerFor(user, projectId)
+}
+
+// Run entity operations as the given owner: a delegate carrying
+// custom.sysowner, which is where @seneca/owner reads the axes from.
+export function asOwner(seneca: any, owner: any): any {
+  return seneca.delegate(null, { custom: { sysowner: owner } })
+}
+
+// Internal, unscoped access for bookkeeping the caller is not the owner of
+// (membership rows, discovering which project a row belongs to). Never
+// derived from request input - see the `system` role in basic.ts.
+export function asSystem(seneca: any): any {
+  return asOwner(seneca, { owner_id: 'system', role: 'system' })
+}
+
+// Public projection of a user (never expose password/hashes).
+export function publicUser(u: any): any {
+  return u ? { id: u.id, name: u.name, email: u.email, handle: u.handle } : u
+}
+