@voxgig/build 4.4.0 → 4.12.0

package/tm/web/backend/srv/auth/signin_user.ts.frag

@@ -1,4 +1,10 @@
+import { publicUser } from './user_util'
+
 // Sign a user in via @seneca/user login (email + password).
+//
+// The user is projected to safe fields: @seneca/user answers with the
+// full entity (password hash + salt) regardless of the `fields` option,
+// and aim:auth messages are reachable through the gateway.
 module.exports = function make_signin_user() {
   return async function signin_user(this: any, msg: any) {
     const seneca = this
@@ -6,9 +12,13 @@ module.exports = function make_signin_user() {
     const out = await seneca.post('sys:user,login:user', {
       email: msg.email,
       password: msg.password,
-      fields: ['id', 'email', 'name', 'handle'],
     })
 
-    return out
+    if (!out.ok) {
+      return { ok: false, why: out.why }
+    }
+
+    return { ok: true, user: publicUser(out.user), login: out.login }
   }
 }
+

package/tm/web/backend/srv/auth/signout_user.ts.frag

@@ -1,5 +1,15 @@
+// End a login session.
+//
+// @seneca/user's logout:user needs a USER QUERY, not just a token: given
+// only a token it answers `no-user-query` and leaves the sys/login row
+// active - i.e. the token would keep working after sign-out. Pass the
+// user id along with the token so the session is really revoked.
 module.exports = function make_signout_user() {
   return async function signout_user(this: any, msg: any) {
-    return this.post('sys:user,logout:user', { token: msg.token })
+    return this.post('sys:user,logout:user', {
+      user_id: msg.user_id,
+      token: msg.token,
+    })
   }
 }
+

package/tm/web/backend/srv/auth/update_user.ts.frag

@@ -0,0 +1,15 @@
+// aim:auth,update:user — update the current user's profile (name, etc.).
+module.exports = function make_update_user() {
+  return async function update_user(this: any, msg: any) {
+    const res = await this.post('sys:user,update:user', {
+      user_id: msg.user_id,
+      user_data: msg.data || {},
+    })
+    if (!res.ok) {
+      return { ok: false, why: res.why || 'update-failed' }
+    }
+    const u = res.user || {}
+    return { ok: true, user: { id: u.id, name: u.name, email: u.email, handle: u.handle } }
+  }
+}
+

package/tm/web/backend/srv/auth/user_util.ts.frag

@@ -0,0 +1,21 @@
+// Shared helper for the auth actions (not an action file).
+//
+// Project a user down to the fields safe to send to a client. The
+// @seneca/user entity carries the password hash (`pass`) and `salt`, and
+// the `fields` option of sys:user,* does NOT restrict the user object it
+// returns - so every action that answers with a user must project it
+// here. aim:auth messages are reachable through the gateway, so this is
+// the difference between a client seeing an email and seeing a hash.
+export function publicUser(user: any) {
+  if (null == user) {
+    return undefined
+  }
+  const d = 'function' === typeof user.data$ ? user.data$(false) : user
+  return {
+    id: d.id,
+    email: d.email,
+    name: d.name,
+    handle: d.handle,
+  }
+}
+

package/tm/web/backend/srv/auth/web_change_pass.ts.frag

@@ -0,0 +1,16 @@
+// Gateway wrapper: change the SIGNED-IN user's password (from the cookie
+// principal, never a caller-supplied id).
+module.exports = function make_web_change_pass() {
+  return async function web_change_pass(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,change:pass', {
+      user_id: user.id,
+      password: msg.password,
+      repeat: msg.repeat,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_create_apikey.ts.frag

@@ -0,0 +1,15 @@
+// Gateway wrapper: create an API key for the SIGNED-IN user (from the
+// cookie principal, never a caller-supplied id).
+module.exports = function make_web_create_apikey() {
+  return async function web_create_apikey(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,create:apikey', {
+      user_id: user.id,
+      name: msg.name,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_list_apikey.ts.frag

@@ -0,0 +1,11 @@
+// Gateway wrapper: list the SIGNED-IN user's API keys.
+module.exports = function make_web_list_apikey() {
+  return async function web_list_apikey(this: any, _msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,list:apikey', { user_id: user.id })
+  }
+}
+

package/tm/web/backend/srv/auth/web_load_auth.ts.frag

@@ -10,3 +10,4 @@ module.exports = function make_web_load_auth() {
     return out
   }
 }
+

package/tm/web/backend/srv/auth/web_remind_pass.ts.frag

@@ -0,0 +1,7 @@
+// Gateway wrapper: public password-reminder request (no auth required).
+module.exports = function make_web_remind_pass() {
+  return async function web_remind_pass(this: any, msg: any) {
+    return this.post('aim:auth,remind:pass', { email: msg.email })
+  }
+}
+

package/tm/web/backend/srv/auth/web_revoke_apikey.ts.frag

@@ -0,0 +1,14 @@
+// Gateway wrapper: revoke one of the SIGNED-IN user's API keys.
+module.exports = function make_web_revoke_apikey() {
+  return async function web_revoke_apikey(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,revoke:apikey', {
+      user_id: user.id,
+      id: msg.id,
+    })
+  }
+}
+

package/tm/web/backend/srv/auth/web_signin_user.ts.frag

@@ -23,3 +23,4 @@ module.exports = function make_web_signin_user() {
     return out
   }
 }
+

package/tm/web/backend/srv/auth/web_signout_user.ts.frag

@@ -1,9 +1,17 @@
+// Gateway signout: revoke the session server-side, then tell
+// gateway-auth (express_cookie) to clear the auth cookie.
 module.exports = function make_web_signout_user() {
   return async function web_signout_user(this: any, _msg: any, meta: any) {
-    const token = meta.custom?.principal?.token
-    if (token) {
-      await this.post('aim:auth,signout:user', { token })
+    const principal = meta.custom?.principal
+    const token = principal?.token
+    const user_id = principal?.user?.id
+
+    if (token || user_id) {
+      // Both are needed: a token alone does not revoke the login row.
+      await this.post('aim:auth,signout:user', { user_id, token })
     }
+
     return { ok: true, gateway$: { auth: { remove: true } } }
   }
 }
+

package/tm/web/backend/srv/auth/web_update_user.ts.frag

@@ -0,0 +1,11 @@
+// Gateway wrapper: update the SIGNED-IN user's profile.
+module.exports = function make_web_update_user() {
+  return async function web_update_user(this: any, msg: any, meta: any) {
+    const user = meta?.custom?.principal?.user
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+    return this.post('aim:auth,update:user', { user_id: user.id, data: msg.data })
+  }
+}
+

package/tm/web/backend/srv/ent/access.ts.frag

@@ -0,0 +1,179 @@
+// Access control support for the generic entity service.
+//
+// Enforcement itself lives in @seneca/owner (configured in
+// src/env/shared/basic.ts), which scopes every entity message by the two
+// ownership axes it finds on `custom.sysowner`:
+//
+//   owner_id   the acting user
+//   project_id the project in play (the tenant axis)
+//
+// This module's job is only to RESOLVE those axes from the gateway
+// principal and the message, and to say which canons the service will
+// answer for at all. It does not filter rows - the entity layer does.
+//
+// Relationships in the model are reference fields: `kind: String` plus a
+// `ref: 'zone/name'` attribute (never `kind: 'Ref'`).
+
+import { base } from '../../env/shared/basic'
+
+// The ownership axes @seneca/owner manages. They are SERVER-managed: a
+// client may neither set them nor round-trip them back on update (a loaded
+// row carries them, and owner rejects a create/update whose payload
+// disagrees with the acting owner - see stripOwned).
+export const OWNER_FIELDS: string[] = base.options.owner.fields
+
+// @seneca/owner fails writes loudly rather than returning an empty result,
+// so a denial arrives as an error, not a null.
+const DENIED = [
+  'create-not-allowed',
+  'update-not-allowed',
+  'save-not-found',
+  'role-entity-not-allowed',
+]
+
+export function isDenied(err: any): boolean {
+  return !!err && DENIED.indexOf(err.code) >= 0
+}
+
+// Drop the server-managed ownership fields from client data, so owner
+// injects them from custom.sysowner instead of comparing them to a claim.
+export function stripOwned(data: any): any {
+  for (const f of OWNER_FIELDS) {
+    delete data[f]
+  }
+  return data
+}
+
+export type Scope =
+  | { kind: 'project' }
+  | { kind: 'scoped'; via: string }
+  | { kind: 'user' }
+  | { kind: 'open' }
+
+export function principalOf(meta: any): any {
+  return (meta && meta.custom && meta.custom.principal && meta.custom.principal.user) || null
+}
+
+export function entDef(model: any, canon: string): any {
+  const [zone, name] = String(canon).split('/')
+  return model && model.main && model.main.ent &&
+    model.main.ent[zone] && model.main.ent[zone][name] || null
+}
+
+export function validCanon(model: any, canon: string): boolean {
+  if (!entDef(model, canon)) {
+    return false
+  }
+  const zone = String(canon).split('/')[0]
+  // Only sys/user is reachable from the sys zone (for pickers); sys/login etc. are not.
+  return 'sys' !== zone || 'sys/user' === canon
+}
+
+// Find the reference field that targets proj/project, if any.
+function projectRefField(model: any, canon: string): string | null {
+  const def = entDef(model, canon)
+  const fields = (def && def.field) || {}
+  for (const fname of Object.keys(fields)) {
+    const f = fields[fname]
+    if (f && 'proj/project' === f.ref) {
+      return fname
+    }
+  }
+  return null
+}
+
+export function scopeOf(model: any, canon: string): Scope {
+  if ('proj/project' === canon) {
+    return { kind: 'project' }
+  }
+  if ('sys/user' === canon) {
+    return { kind: 'open' }
+  }
+  const via = projectRefField(model, canon)
+  if (via) {
+    return { kind: 'scoped', via }
+  }
+  return { kind: 'user' }
+}
+
+// Project ids the given user is a member of.
+export async function myProjectIds(seneca: any, userId: string): Promise<string[]> {
+  if (!userId) {
+    return []
+  }
+  const members = await seneca.entity('proj/member').list$({ user_id: userId })
+  const ids: string[] = []
+  for (const m of members) {
+    if (null != m.project_id && ids.indexOf(m.project_id) < 0) {
+      ids.push(m.project_id)
+    }
+  }
+  return ids
+}
+
+export async function isMember(seneca: any, userId: string, projectId: string): Promise<boolean> {
+  if (!userId || null == projectId) {
+    return false
+  }
+  const m = await seneca.entity('proj/member').load$({ user_id: userId, project_id: projectId })
+  return !!m
+}
+
+// The project this message acts in, taken from the message itself: the
+// query filter for a list, the item's project ref for a save, else null
+// (load/remove address a row by id and are resolved by the caller).
+export function projectOf(model: any, canon: string, msg: any): string | null {
+  const scope = scopeOf(model, canon)
+  if ('scoped' !== scope.kind) {
+    return null
+  }
+  const via = (scope as any).via
+  const q = msg.q || {}
+  const item = msg.item || {}
+  return null != q[via] ? q[via] : (null != item[via] ? item[via] : null)
+}
+
+// The @seneca/owner axes for a user acting in a project. Pure: use it
+// only where membership is ALREADY established (project ids that came
+// out of the member table). Everywhere else use ownerOf.
+export function ownerFor(user: any, projectId: string | null): any {
+  // No project in play -> owner-only scoping (the `user` role).
+  return null == projectId
+    ? { owner_id: user.id, role: 'user' }
+    : { owner_id: user.id, project_id: projectId, role: 'member' }
+}
+
+// Same, but confirms membership first. Returns null when the caller is
+// not a member of the requested project, which the caller turns into
+// 'forbidden' - owner would deny the row anyway, this just gives a
+// precise reason instead of an empty result.
+export async function ownerOf(
+  seneca: any, user: any, projectId: string | null
+): Promise<any> {
+  if (null == projectId) {
+    return ownerFor(user, null)
+  }
+  if (!(await isMember(seneca, user.id, projectId))) {
+    return null
+  }
+  return ownerFor(user, projectId)
+}
+
+// Run entity operations as the given owner: a delegate carrying
+// custom.sysowner, which is where @seneca/owner reads the axes from.
+export function asOwner(seneca: any, owner: any): any {
+  return seneca.delegate(null, { custom: { sysowner: owner } })
+}
+
+// Internal, unscoped access for bookkeeping the caller is not the owner of
+// (membership rows, discovering which project a row belongs to). Never
+// derived from request input - see the `system` role in basic.ts.
+export function asSystem(seneca: any): any {
+  return asOwner(seneca, { owner_id: 'system', role: 'system' })
+}
+
+// Public projection of a user (never expose password/hashes).
+export function publicUser(u: any): any {
+  return u ? { id: u.id, name: u.name, email: u.email, handle: u.handle } : u
+}
+

package/tm/web/backend/srv/ent/cmd_list.ts.frag

@@ -0,0 +1,86 @@
+import {
+  principalOf, validCanon, scopeOf, myProjectIds, ownerFor, asOwner, asSystem,
+  publicUser,
+} from './access'
+
+// aim:ent,cmd:list  { ent:'zone/name', q?:{...} }
+//
+// Rows are filtered by @seneca/owner, not here: each list runs on a
+// delegate whose custom.sysowner names the project, and owner refines the
+// query by the tenant axis. The membership JOIN is the one thing owner
+// cannot express (it scopes to ONE tenant, not "every project I belong
+// to"), so listing across projects fans out over the member rows.
+module.exports = function make_cmd_list() {
+  return async function cmd_list(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+    const q = Object.assign({}, msg.q)
+
+    // sys/user: public projection, for reference pickers.
+    if ('open' === scope.kind) {
+      const list = await asSystem(seneca).entity(canon).list$(q)
+      return { ok: true, list: list.map(publicUser) }
+    }
+
+    // Not project data: owner scopes it to the acting user alone.
+    if ('user' === scope.kind) {
+      const owner = ownerFor(user, null)
+      return { ok: true, list: await asOwner(seneca, owner).entity(canon).list$(q) }
+    }
+
+    // Every id below came OUT of the member table, so membership is
+    // already established - ownerFor, not ownerOf, or each one costs a
+    // redundant round trip re-proving what this list just read.
+    const myIds = await myProjectIds(seneca, user.id)
+
+    // The projects themselves: one load per membership row.
+    if ('project' === scope.kind) {
+      const projects: any[] = []
+      for (const id of myIds) {
+        const p = await asOwner(seneca, ownerFor(user, id)).entity(canon).load$(id)
+        if (p && matches(p, q)) {
+          projects.push(p)
+        }
+      }
+      return { ok: true, list: projects }
+    }
+
+    // 'scoped': one project asked for, or a union across all of mine.
+    const via = (scope as any).via
+    const ids = null != q[via] ? [q[via]] : myIds
+    if (null != q[via] && myIds.indexOf(q[via]) < 0) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    let all: any[] = []
+    for (const pid of ids) {
+      const sub = Object.assign({}, q)
+      sub[via] = pid
+      all = all.concat(
+        await asOwner(seneca, ownerFor(user, pid)).entity(canon).list$(sub))
+    }
+    return { ok: true, list: all }
+  }
+}
+
+// Simple exact-match filter (the membership-scoped project list is loaded
+// by id, so the query can't go through list$).
+function matches(item: any, q: any) {
+  for (const k of Object.keys(q || {})) {
+    if (item[k] !== q[k]) {
+      return false
+    }
+  }
+  return true
+}
+

package/tm/web/backend/srv/ent/cmd_load.ts.frag

@@ -0,0 +1,56 @@
+import {
+  principalOf, validCanon, scopeOf, ownerOf, asOwner, asSystem, publicUser,
+} from './access'
+
+// aim:ent,cmd:load  { ent:'zone/name', id }
+//
+// A load addresses a row by id, so which project it belongs to is not
+// known from the message. Resolve that first (system read), then re-load
+// as the caller so @seneca/owner is the thing that actually decides - a
+// row outside the caller's project comes back null.
+module.exports = function make_cmd_load() {
+  return async function cmd_load(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+
+    // sys/user: public projection, not project data.
+    if ('open' === scope.kind) {
+      const item = await asSystem(seneca).entity(canon).load$(msg.id)
+      return { ok: true, item: publicUser(item) }
+    }
+
+    const found = await asSystem(seneca).entity(canon).load$(msg.id)
+    if (!found) {
+      return { ok: true, item: null }
+    }
+
+    const projectId = 'project' === scope.kind
+      ? found.id
+      : found[(scope as any).via]
+
+    // A scoped row with no stored tenant is an anomaly, not user-scoped
+    // data - refuse it rather than let ownerOf downgrade to owner-only.
+    if ('scoped' === scope.kind && null == projectId) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const owner = await ownerOf(seneca, user, projectId)
+    if (null == owner) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const item = await asOwner(seneca, owner).entity(canon).load$(msg.id)
+    return null == item ? { ok: false, why: 'forbidden' } : { ok: true, item }
+  }
+}
+

package/tm/web/backend/srv/ent/cmd_remove.ts.frag

@@ -0,0 +1,60 @@
+import {
+  principalOf, validCanon, scopeOf, ownerOf, asOwner, asSystem,
+} from './access'
+
+// aim:ent,cmd:remove  { ent:'zone/name', id }
+//
+// Same shape as cmd_load: discover the row's project, then delete as the
+// caller so @seneca/owner refines the query - a row outside the caller's
+// project is simply not matched.
+module.exports = function make_cmd_remove() {
+  return async function cmd_remove(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+    if ('open' === scope.kind) {
+      return { ok: false, why: 'read-only' }
+    }
+
+    const found = await asSystem(seneca).entity(canon).load$(msg.id)
+    if (!found) {
+      return { ok: true }
+    }
+
+    const projectId = 'project' === scope.kind
+      ? found.id
+      : found[(scope as any).via]
+
+    // A scoped row with no stored tenant is an anomaly, not user-scoped
+    // data - refuse it rather than let ownerOf downgrade to owner-only.
+    if ('scoped' === scope.kind && null == projectId) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const owner = await ownerOf(seneca, user, projectId)
+    if (null == owner) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    // Owner treats a denied remove as a silent no-op, which would report
+    // success for a row the caller cannot see. Read it back as the caller
+    // first, so remove answers like load does.
+    const mine = asOwner(seneca, owner).entity(canon)
+    if (null == await mine.load$(msg.id)) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    await mine.remove$(msg.id)
+    return { ok: true }
+  }
+}
+