@websolutespa/bom-mixer-store 1.8.5 → 1.8.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @websolutespa/bom-mixer-store
 
+## 1.8.7
+
+### Patch Changes
+
+- Modified: storeHandler
+- Updated dependencies
+  - @websolutespa/bom-core@1.8.15
+
+## 1.8.6
+
+### Patch Changes
+
+- Modified: RemoteService
+
 ## 1.8.5
 
 ### Patch Changes

package/dist/index.d.ts

@@ -4,10 +4,7 @@ import { NextRequest } from 'next/server';
 
 type ApiRequestOptions = FetchRequestOptions;
 declare function getLocalApiRequestOptions(): ApiRequestOptions;
-declare const REMOTE_API_SESSION: {
-    token: string | null;
-};
-declare function getRemoteApiRequestOptions(): ApiRequestOptions;
+declare function getRemoteApiRequestOptions(token?: string): ApiRequestOptions;
 
 type ICrudMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | string;
 type IHandler<T = any> = (request: NextApiRequest, response: NextApiResponse<T>) => Promise<NextApiResponse<T> | void>;
@@ -145,16 +142,16 @@ declare class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     key: string;
     store: IStore;
     constructor(key: string, store: IStore);
-    findOne<B extends T = T>(id: IEquatable, params?: Omit<QueryParams, 'where'>): Promise<B | undefined>;
-    findMany<B extends T = T>(params?: QueryParams): Promise<B[]>;
-    findPaged<B extends T = T>(params?: QueryParams): Promise<IPagedResult<B>>;
-    create<B extends T = T>(payload: Omit<B, 'id'>, params?: QueryParams): Promise<B>;
-    updateOne<B extends T = T>(id: IEquatable, payload: Partial<B>, params?: Omit<QueryParams, 'where'>): Promise<B>;
-    updateMany<B extends T = T>(payload: Partial<B>, params?: QueryParams): Promise<B[]>;
-    deleteOne<B extends T = T>(id: IEquatable, params?: Omit<QueryParams, 'where'>): Promise<B | undefined>;
-    deleteMany<B extends T = T>(params?: QueryParams): Promise<B[]>;
-    update<B extends T = T>(payload: Partial<B>, params?: QueryParams): Promise<B>;
-    delete<B extends T = T>(id: IEquatable): Promise<B | undefined>;
+    findOne<B extends T = T>(id: IEquatable, params?: Omit<QueryParams, 'where'>, token?: string): Promise<B | undefined>;
+    findMany<B extends T = T>(params?: QueryParams, token?: string): Promise<B[]>;
+    findPaged<B extends T = T>(params?: QueryParams, token?: string): Promise<IPagedResult<B>>;
+    create<B extends T = T>(payload: Omit<B, 'id'>, params?: QueryParams, token?: string): Promise<B>;
+    updateOne<B extends T = T>(id: IEquatable, payload: Partial<B>, params?: Omit<QueryParams, 'where'>, token?: string): Promise<B>;
+    updateMany<B extends T = T>(payload: Partial<B>, params?: QueryParams, token?: string): Promise<B[]>;
+    deleteOne<B extends T = T>(id: IEquatable, params?: Omit<QueryParams, 'where'>, token?: string): Promise<B | undefined>;
+    deleteMany<B extends T = T>(params?: QueryParams, token?: string): Promise<B[]>;
+    update<B extends T = T>(payload: Partial<B>, params?: QueryParams, token?: string): Promise<B>;
+    delete<B extends T = T>(id: IEquatable, token?: string): Promise<B | undefined>;
     protected decorateOne_<B extends T = T>(item: B, params?: QueryParams): Promise<B>;
     protected decorateMany_<B extends T = T>(items: B[], params?: QueryParams): Promise<B[]>;
 }
@@ -255,4 +252,4 @@ declare function getStore<T extends IStore>(): Promise<T>;
 
 declare function varsHandler(): IHandler<any>;
 
-export { ApiRequestOptions, BuildStrategy, COLLECTIONS, DEFAULT_DEPTH, IApiHandler, ICrudMethod, IField, IHandler, IPageResolvedRelation, KNOWN_COLLECTIONS, MAX_INT, MOCK_COLLECTIONS, MapTo, MockMenuService, MockPageService, MockService, NextPhase, REMOTE_API_SESSION, RemoteMenuService, RemotePageService, RemoteService, RemoteServiceStrategy, STATIC_COLLECTIONS, StaticService, StaticServiceConfig, StaticServiceSrc, StoreStrategy, apiHandler, buildStrategy, collectCategory_, collectionDelete, collectionGet, collectionPatch, collectionPost, decorateCategories_, decorateCategory_, decorateHref_, decorateHrefs_, decorateLocalizable_, decorateLocalizables_, decorateMenu_, decorateMenus_, decorateNav_, decorateNavs_, decorateRelation_, decorateRelations_, decorateSchema_, decorateSchemas_, decorateStaticRelation_, decorateStaticRelations_, errorHandler, findRoute, fromCache, getLocalApiRequestOptions, getLocalApiUrl, getMockStore, getMockStoreFromData_, getRemoteApiRequestOptions, getRemoteApiUrl, getRemoteStore, getStore, isApiRequest, isNextRequest, isStaticRequest, localApiDelete, localApiFetch, localApiGet, localApiPatch, localApiPost, localApiPut, mockApiDelete, mockApiFetch, mockApiGet, mockApiPatch, mockApiPost, mockApiPut, mockHandler, nextPhase, optimizeMany_, optimizeOne_, remoteApiDelete, remoteApiFetch, remoteApiGet, remoteApiPatch, remoteApiPost, remoteApiPut, routePost, staticCollections, storeApiDelete, storeApiGet, storeApiPatch, storeApiPost, storeApiPut, storeCacheDuration, storeHandler, storeIndexHandler, storeStrategy, varsHandler };
+export { ApiRequestOptions, BuildStrategy, COLLECTIONS, DEFAULT_DEPTH, IApiHandler, ICrudMethod, IField, IHandler, IPageResolvedRelation, KNOWN_COLLECTIONS, MAX_INT, MOCK_COLLECTIONS, MapTo, MockMenuService, MockPageService, MockService, NextPhase, RemoteMenuService, RemotePageService, RemoteService, RemoteServiceStrategy, STATIC_COLLECTIONS, StaticService, StaticServiceConfig, StaticServiceSrc, StoreStrategy, apiHandler, buildStrategy, collectCategory_, collectionDelete, collectionGet, collectionPatch, collectionPost, decorateCategories_, decorateCategory_, decorateHref_, decorateHrefs_, decorateLocalizable_, decorateLocalizables_, decorateMenu_, decorateMenus_, decorateNav_, decorateNavs_, decorateRelation_, decorateRelations_, decorateSchema_, decorateSchemas_, decorateStaticRelation_, decorateStaticRelations_, errorHandler, findRoute, fromCache, getLocalApiRequestOptions, getLocalApiUrl, getMockStore, getMockStoreFromData_, getRemoteApiRequestOptions, getRemoteApiUrl, getRemoteStore, getStore, isApiRequest, isNextRequest, isStaticRequest, localApiDelete, localApiFetch, localApiGet, localApiPatch, localApiPost, localApiPut, mockApiDelete, mockApiFetch, mockApiGet, mockApiPatch, mockApiPost, mockApiPut, mockHandler, nextPhase, optimizeMany_, optimizeOne_, remoteApiDelete, remoteApiFetch, remoteApiGet, remoteApiPatch, remoteApiPost, remoteApiPut, routePost, staticCollections, storeApiDelete, storeApiGet, storeApiPatch, storeApiPost, storeApiPut, storeCacheDuration, storeHandler, storeIndexHandler, storeStrategy, varsHandler };

package/dist/index.js

@@ -40,7 +40,6 @@ __export(src_exports, {
   MockPageService: () => MockPageService,
   MockService: () => MockService,
   NextPhase: () => NextPhase,
-  REMOTE_API_SESSION: () => REMOTE_API_SESSION,
   RemoteMenuService: () => RemoteMenuService,
   RemotePageService: () => RemotePageService,
   RemoteService: () => RemoteService,
@@ -128,16 +127,13 @@ function getLocalApiRequestOptions() {
     headers: {}
   };
 }
-var REMOTE_API_SESSION = {
-  token: null
-};
-function getRemoteApiRequestOptions() {
-  if (REMOTE_API_SESSION.token) {
+function getRemoteApiRequestOptions(token) {
+  if (token) {
     return {
       // mode: 'cors',
       headers: {
-        Authorization: `Bearer ${REMOTE_API_SESSION.token}`
-        // Authorization: `JWT ${REMOTE_API_SESSION.token}`,
+        Authorization: `JWT ${token}`
+        // Authorization: `Bearer ${token}`,
       }
     };
   } else {
@@ -859,7 +855,37 @@ async function mockApiDelete(url, options = {}) {
 }
 
 // src/store/store.handler.ts
-var import_bom_core14 = require("@websolutespa/bom-core");
+var import_bom_core15 = require("@websolutespa/bom-core");
+
+// src/session/session.service.ts
+var import_bom_core9 = require("@websolutespa/bom-core");
+var import_iron_session = require("iron-session");
+async function getSession(request, response) {
+  const COOKIE_NAME = "websolutespa-next-js";
+  const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD || "SECRET_COOKIE_PASSWORD_32_CHARS_LONG";
+  const sessionOptions = {
+    cookieName: COOKIE_NAME,
+    // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+    cookieOptions: {
+      secure: !import_bom_core9.isDevelopment
+    },
+    password: COOKIE_PASSWORD
+  };
+  const session = await (0, import_iron_session.getIronSession)(request, response, sessionOptions);
+  return session;
+}
+async function getSessionToken(request, response) {
+  const session = await getSession(request, response);
+  if (session.token && session.exp && session.exp > Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3)) {
+    return session.token;
+  } else {
+    session.token = void 0;
+    session.exp = void 0;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}
 
 // src/static/static.ts
 var staticCollections = [{
@@ -1156,7 +1182,7 @@ var KNOWN_COLLECTIONS = [
 var COLLECTIONS = [...ENV_COLLECTIONS, ...KNOWN_COLLECTIONS];
 
 // src/mock/mock.store.ts
-var import_bom_core10 = require("@websolutespa/bom-core");
+var import_bom_core11 = require("@websolutespa/bom-core");
 
 // src/fs/fs.service.ts
 var fs = __toESM(require("fs"));
@@ -1184,8 +1210,8 @@ async function fsReadJson(pathname) {
 }
 
 // src/static/static.service.ts
-var import_bom_core9 = require("@websolutespa/bom-core");
-var StaticService = class extends import_bom_core9.JsonService {
+var import_bom_core10 = require("@websolutespa/bom-core");
+var StaticService = class extends import_bom_core10.JsonService {
   constructor(config, store) {
     super([]);
     this.loaded = false;
@@ -1213,7 +1239,7 @@ var StaticService = class extends import_bom_core9.JsonService {
       const config = this.config;
       const src = config.src;
       if (typeof src === "string") {
-        const response = await (0, import_bom_core9.httpGet)(src, {});
+        const response = await (0, import_bom_core10.httpGet)(src, {});
         items = response.items;
       } else if (typeof src === "function") {
         if (src instanceof Promise) {
@@ -1329,7 +1355,7 @@ function getMockStoreFromData_(data) {
   return store;
 }
 async function getStoreData_() {
-  if (import_bom_core10.isDevelopment) {
+  if (import_bom_core11.isDevelopment) {
     const path = require("path");
     const pathname = path.join(process.cwd(), ".mixer", "store.json");
     return await fsReadJson(pathname) || {};
@@ -1345,17 +1371,17 @@ async function getMockStore_() {
 }
 async function getMockStore() {
   return fromCache(async () => {
-    if (!import_bom_core10.isDevelopment) {
+    if (!import_bom_core11.isDevelopment) {
       console.warn("getMockStore");
     }
     const store = await getMockStore_();
     return store;
-  }, import_bom_core10.isDevelopment ? void 0 : "STORE_MOCK_");
+  }, import_bom_core11.isDevelopment ? void 0 : "STORE_MOCK_");
 }
 
 // src/cached/cached.service.ts
-var import_bom_core11 = require("@websolutespa/bom-core");
-var CachedService = class extends import_bom_core11.JsonService {
+var import_bom_core12 = require("@websolutespa/bom-core");
+var CachedService = class extends import_bom_core12.JsonService {
   constructor(service, options = {}) {
     super([]);
     this.cache_ = /* @__PURE__ */ new Map();
@@ -1394,7 +1420,7 @@ var CachedService = class extends import_bom_core11.JsonService {
     });
   }
   async findOne(id, params = {}) {
-    const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+    const serializedParams = (0, import_bom_core12.qsSerialize)(params);
     const key = `findOne[${id}]?${serializedParams}`;
     return await this.fromCache_(async () => {
       return await this.service_.findOne(id, params);
@@ -1403,7 +1429,7 @@ var CachedService = class extends import_bom_core11.JsonService {
   async findMany(params = {}) {
     if (storeStrategy === "decoratedApi" /* DecoratedApi */) {
       const { market, locale, ...otherParams } = params;
-      const serializedParams = (0, import_bom_core11.qsSerialize)({ market, locale });
+      const serializedParams = (0, import_bom_core12.qsSerialize)({ market, locale });
       const key = `findMany?${serializedParams}`;
       let items = await this.fromCache_(async () => {
         return await this.service_.findMany({ market, locale });
@@ -1416,7 +1442,7 @@ var CachedService = class extends import_bom_core11.JsonService {
       }
       return items;
     } else {
-      const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+      const serializedParams = (0, import_bom_core12.qsSerialize)(params);
       const key = `findMany?${serializedParams}`;
       return await this.fromCache_(async () => {
         return await this.service_.findMany(params);
@@ -1424,7 +1450,7 @@ var CachedService = class extends import_bom_core11.JsonService {
     }
   }
   async findPaged(params = {}) {
-    const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+    const serializedParams = (0, import_bom_core12.qsSerialize)(params);
     const key = `findPaged?${serializedParams}`;
     return await this.fromCache_(async () => {
       return await this.service_.findPaged(params);
@@ -1455,25 +1481,25 @@ var CachedService = class extends import_bom_core11.JsonService {
 };
 
 // src/remote/remote.service.ts
-var import_bom_core13 = require("@websolutespa/bom-core");
+var import_bom_core14 = require("@websolutespa/bom-core");
 
 // src/remote/remote.api.ts
-var import_bom_core12 = require("@websolutespa/bom-core");
+var import_bom_core13 = require("@websolutespa/bom-core");
 var API_URL3 = process.env.STORE_URL;
 var API_BASE4 = process.env.STORE_API || "/api";
 function getRemoteApiUrl(pathname) {
   let url = `${API_URL3}${API_BASE4}${pathname}`;
-  url = import_bom_core12.isBrowser ? url : url.replace("://localhost", "://127.0.0.1");
+  url = import_bom_core13.isBrowser ? url : url.replace("://localhost", "://127.0.0.1");
   return url;
 }
 async function remoteApiFetch(pathname, options = {}) {
-  if (import_bom_core12.isBrowser) {
+  if (import_bom_core13.isBrowser) {
     throw "Unauthorized: remote api cannot be fetched client side";
   }
   const url = getRemoteApiUrl(pathname);
-  const apiOptions = (0, import_bom_core12.merge)({ ...getRemoteApiRequestOptions() }, options);
+  const apiOptions = (0, import_bom_core13.merge)({ ...getRemoteApiRequestOptions() }, options);
   console.log("remoteApiFetch", apiOptions.method, url);
-  const apiResponse = await (0, import_bom_core12.httpFetch)(url, apiOptions);
+  const apiResponse = await (0, import_bom_core13.httpFetch)(url, apiOptions);
   return apiResponse;
 }
 async function remoteApiGet(url, options = {}) {
@@ -1507,14 +1533,14 @@ var RemoteService = class {
     this.key = key;
     this.store = store;
   }
-  async findOne(id, params = {}) {
+  async findOne(id, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     try {
-      const item = await remoteApiGet(url);
+      const item = await remoteApiGet(url, getRemoteApiRequestOptions(token));
       if (item) {
         return await this.decorateOne_(item, params);
       }
@@ -1523,84 +1549,84 @@ var RemoteService = class {
     }
     return;
   }
-  async findMany(params = {}) {
+  async findMany(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiGet(url);
+    const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
-  async findPaged(params = {}) {
+  async findPaged(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = true;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiGet(url);
+    const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
     let items = response.docs;
     items = await this.decorateMany_(items, params);
     return { ...response, docs: items };
   }
-  async create(payload, params = {}) {
+  async create(payload, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const result = await remoteApiPost(url, payload);
+    const result = await remoteApiPost(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async updateOne(id, payload, params = {}) {
-    const query = (0, import_bom_core13.qsSerialize)(params);
+  async updateOne(id, payload, params = {}, token) {
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
-    const result = await remoteApiPatch(url, payload);
+    const result = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async updateMany(payload, params = {}) {
+  async updateMany(payload, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiPatch(url, payload);
+    const response = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
-  async deleteOne(id, params = {}) {
-    const query = (0, import_bom_core13.qsSerialize)(params);
+  async deleteOne(id, params = {}, token) {
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
-    const item = await remoteApiDelete(url);
+    const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
-  async deleteMany(params = {}) {
+  async deleteMany(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiDelete(url);
+    const response = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
   // !!! old
-  async update(payload, params = {}) {
+  async update(payload, params = {}, token) {
     const url = `/${this.key}`;
-    const result = await remoteApiPatch(url, payload);
+    const result = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async delete(id) {
+  async delete(id, token) {
     const params = {
       where: {
         id: {
@@ -1608,10 +1634,10 @@ var RemoteService = class {
         }
       }
     };
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const item = await remoteApiDelete(url);
+    const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
   async decorateOne_(item, params = {}) {
@@ -1784,7 +1810,7 @@ function collectionGet(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1795,18 +1821,19 @@ function collectionGet(storePromise) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.findOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.findOne((0, import_bom_core15.asEquatable)(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else if (String(params.pagination) === "true") {
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1824,6 +1851,13 @@ function collectionPost(storePromise) {
         return response.status(405).send("method not allowed");
       }
       const collection = collections[0];
+      const id = collections[1];
+      if (id) {
+        console.error("method not allowed", collection);
+        return response.status(405).send("method not allowed");
+      }
+      const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -1833,6 +1867,10 @@ function collectionPost(storePromise) {
       if (collection === "route") {
         return routePost(store, request, response);
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error) {
       console.error("storeHandler.error.500", error);
       throw error;
@@ -1854,7 +1892,7 @@ function collectionPatch(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1865,15 +1903,17 @@ function collectionPatch(storePromise) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
       if (id) {
-        const item = await service.updateOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.updateOne((0, import_bom_core15.asEquatable)(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1897,7 +1937,7 @@ function collectionDelete(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1908,15 +1948,16 @@ function collectionDelete(storePromise) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.deleteOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.deleteOne((0, import_bom_core15.asEquatable)(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1957,8 +1998,8 @@ function storeIndexHandler() {
   return apiHandler({
     get: async (request, response) => {
       try {
-        const market = import_bom_core14.defaultMarket;
-        const locale = import_bom_core14.defaultLocale;
+        const market = import_bom_core15.defaultMarket;
+        const locale = import_bom_core15.defaultLocale;
         if (!Array.isArray(COLLECTIONS) || COLLECTIONS?.length === 0) {
           console.error("apiHome.collectionGet", "collections not found", COLLECTIONS);
           return response.status(405).send("method not allowed");
@@ -2225,7 +2266,7 @@ async function storeApiDelete(url, options = {}) {
 }
 
 // src/vars/vars.handler.ts
-var import_bom_core16 = require("@websolutespa/bom-core");
+var import_bom_core17 = require("@websolutespa/bom-core");
 
 // ../models/src/label/label.service.ts
 async function getLabels(params = {}) {
@@ -2256,7 +2297,7 @@ async function getMenus(params = {}) {
 }
 
 // ../models/src/route/route.service.ts
-var import_bom_core15 = require("@websolutespa/bom-core");
+var import_bom_core16 = require("@websolutespa/bom-core");
 async function getRouteLinkTree(market, locale) {
   const store = await getStore();
   const routes = await store.route.findMany({
@@ -2270,7 +2311,7 @@ async function getRouteLinkTree(market, locale) {
     }
   });
   const categories = await store.category.findMany({ market, locale });
-  const rootCategory = (0, import_bom_core15.getRootCategory)(categories);
+  const rootCategory = (0, import_bom_core16.getRootCategory)(categories);
   if (rootCategory) {
     const root = categoryToRouteLink(routes, categories, rootCategory, locale);
     return root;
@@ -2278,13 +2319,13 @@ async function getRouteLinkTree(market, locale) {
   return void 0;
 }
 function categoryToRouteLink(routes, categories, category, locale) {
-  const route = (0, import_bom_core15.findRouteOfCategory)(routes, category.id);
+  const route = (0, import_bom_core16.findRouteOfCategory)(routes, category.id);
   if (!route) {
     return void 0;
   }
-  const rootCategory = (0, import_bom_core15.getRootCategory)(categories);
+  const rootCategory = (0, import_bom_core16.getRootCategory)(categories);
   const childCategories = categories.filter((x) => {
-    const parentId = (0, import_bom_core15.asCategoryId)(x.category);
+    const parentId = (0, import_bom_core16.asCategoryId)(x.category);
     return rootCategory && rootCategory.id === category.id ? x.id !== rootCategory.id && (parentId === category.id || !parentId) : parentId === category.id;
   });
   const routeLink = newRouteLink(category, route, locale);
@@ -2296,7 +2337,7 @@ function newRouteLink(category, route, locale) {
   const id = route?.page || category.id;
   const media = category.media || route?.media;
   const schema = route?.template || route?.schema || category?.schema || "unknown";
-  const title = (0, import_bom_core15.localize)(category.title || route?.title || "untitled", locale);
+  const title = (0, import_bom_core16.localize)(category.title || route?.title || "untitled", locale);
   const routeLink = {
     category: category.id,
     href,
@@ -2373,10 +2414,10 @@ function varsHandler() {
         const { locale = defaultLocale3, market = defaultMaket } = request.query || {};
         const layout = typeof locale === "string" && typeof market === "string" ? await getLayout(market, locale) : void 0;
         const info = {
-          production: import_bom_core16.isProduction,
-          development: import_bom_core16.isDevelopment,
-          origin: (0, import_bom_core16.getOrigin)(request.headers),
-          host: (0, import_bom_core16.getHost)(request.headers),
+          production: import_bom_core17.isProduction,
+          development: import_bom_core17.isDevelopment,
+          origin: (0, import_bom_core17.getOrigin)(request.headers),
+          host: (0, import_bom_core17.getHost)(request.headers),
           headers: { ...sortKeys(request.headers) },
           env: { ...getFilteredEnv(process.env) },
           layout: { ...sortKeys(layout) }
@@ -2500,7 +2541,6 @@ function varsHandler() {
   MockPageService,
   MockService,
   NextPhase,
-  REMOTE_API_SESSION,
   RemoteMenuService,
   RemotePageService,
   RemoteService,

package/dist/index.mjs

@@ -12,16 +12,13 @@ function getLocalApiRequestOptions() {
     headers: {}
   };
 }
-var REMOTE_API_SESSION = {
-  token: null
-};
-function getRemoteApiRequestOptions() {
-  if (REMOTE_API_SESSION.token) {
+function getRemoteApiRequestOptions(token) {
+  if (token) {
     return {
       // mode: 'cors',
       headers: {
-        Authorization: `Bearer ${REMOTE_API_SESSION.token}`
-        // Authorization: `JWT ${REMOTE_API_SESSION.token}`,
+        Authorization: `JWT ${token}`
+        // Authorization: `Bearer ${token}`,
       }
     };
   } else {
@@ -755,6 +752,36 @@ async function mockApiDelete(url, options = {}) {
 // src/store/store.handler.ts
 import { asEquatable, defaultLocale, defaultMarket, qsDeserialize } from "@websolutespa/bom-core";
 
+// src/session/session.service.ts
+import { isDevelopment } from "@websolutespa/bom-core";
+import { getIronSession } from "iron-session";
+async function getSession(request, response) {
+  const COOKIE_NAME = "websolutespa-next-js";
+  const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD || "SECRET_COOKIE_PASSWORD_32_CHARS_LONG";
+  const sessionOptions = {
+    cookieName: COOKIE_NAME,
+    // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+    cookieOptions: {
+      secure: !isDevelopment
+    },
+    password: COOKIE_PASSWORD
+  };
+  const session = await getIronSession(request, response, sessionOptions);
+  return session;
+}
+async function getSessionToken(request, response) {
+  const session = await getSession(request, response);
+  if (session.token && session.exp && session.exp > Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3)) {
+    return session.token;
+  } else {
+    session.token = void 0;
+    session.exp = void 0;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}
+
 // src/static/static.ts
 var staticCollections = [{
   src: "https://actarian.github.io/cms-i18n-react/api/continent.json",
@@ -1050,7 +1077,7 @@ var KNOWN_COLLECTIONS = [
 var COLLECTIONS = [...ENV_COLLECTIONS, ...KNOWN_COLLECTIONS];
 
 // src/mock/mock.store.ts
-import { isDevelopment } from "@websolutespa/bom-core";
+import { isDevelopment as isDevelopment2 } from "@websolutespa/bom-core";
 
 // src/fs/fs.service.ts
 import * as fs from "fs";
@@ -1223,7 +1250,7 @@ function getMockStoreFromData_(data) {
   return store;
 }
 async function getStoreData_() {
-  if (isDevelopment) {
+  if (isDevelopment2) {
     const path = __require("path");
     const pathname = path.join(process.cwd(), ".mixer", "store.json");
     return await fsReadJson(pathname) || {};
@@ -1239,12 +1266,12 @@ async function getMockStore_() {
 }
 async function getMockStore() {
   return fromCache(async () => {
-    if (!isDevelopment) {
+    if (!isDevelopment2) {
       console.warn("getMockStore");
     }
     const store = await getMockStore_();
     return store;
-  }, isDevelopment ? void 0 : "STORE_MOCK_");
+  }, isDevelopment2 ? void 0 : "STORE_MOCK_");
 }
 
 // src/cached/cached.service.ts
@@ -1401,14 +1428,14 @@ var RemoteService = class {
     this.key = key;
     this.store = store;
   }
-  async findOne(id, params = {}) {
+  async findOne(id, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     try {
-      const item = await remoteApiGet(url);
+      const item = await remoteApiGet(url, getRemoteApiRequestOptions(token));
       if (item) {
         return await this.decorateOne_(item, params);
       }
@@ -1417,84 +1444,84 @@ var RemoteService = class {
     }
     return;
   }
-  async findMany(params = {}) {
+  async findMany(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiGet(url);
+    const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
-  async findPaged(params = {}) {
+  async findPaged(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = true;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiGet(url);
+    const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
     let items = response.docs;
     items = await this.decorateMany_(items, params);
     return { ...response, docs: items };
   }
-  async create(payload, params = {}) {
+  async create(payload, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const result = await remoteApiPost(url, payload);
+    const result = await remoteApiPost(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async updateOne(id, payload, params = {}) {
+  async updateOne(id, payload, params = {}, token) {
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
-    const result = await remoteApiPatch(url, payload);
+    const result = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async updateMany(payload, params = {}) {
+  async updateMany(payload, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiPatch(url, payload);
+    const response = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
-  async deleteOne(id, params = {}) {
+  async deleteOne(id, params = {}, token) {
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
-    const item = await remoteApiDelete(url);
+    const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
-  async deleteMany(params = {}) {
+  async deleteMany(params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const response = await remoteApiDelete(url);
+    const response = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     const items = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
   // !!! old
-  async update(payload, params = {}) {
+  async update(payload, params = {}, token) {
     const url = `/${this.key}`;
-    const result = await remoteApiPatch(url, payload);
+    const result = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
     const item = result.doc ? result.doc : result;
     return await this.decorateOne_(item, {});
   }
-  async delete(id) {
+  async delete(id, token) {
     const params = {
       where: {
         id: {
@@ -1505,7 +1532,7 @@ var RemoteService = class {
     const query = qsSerialize2(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
-    const item = await remoteApiDelete(url);
+    const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
   async decorateOne_(item, params = {}) {
@@ -1689,18 +1716,19 @@ function collectionGet(storePromise) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.findOne(asEquatable(id), params);
+        const item = await service.findOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else if (String(params.pagination) === "true") {
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1718,6 +1746,13 @@ function collectionPost(storePromise) {
         return response.status(405).send("method not allowed");
       }
       const collection = collections[0];
+      const id = collections[1];
+      if (id) {
+        console.error("method not allowed", collection);
+        return response.status(405).send("method not allowed");
+      }
+      const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
+      const params = qsDeserialize(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -1727,6 +1762,10 @@ function collectionPost(storePromise) {
       if (collection === "route") {
         return routePost(store, request, response);
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error) {
       console.error("storeHandler.error.500", error);
       throw error;
@@ -1759,15 +1798,17 @@ function collectionPatch(storePromise) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
       if (id) {
-        const item = await service.updateOne(asEquatable(id), params);
+        const item = await service.updateOne(asEquatable(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1802,15 +1843,16 @@ function collectionDelete(storePromise) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.deleteOne(asEquatable(id), params);
+        const item = await service.deleteOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -2119,7 +2161,7 @@ async function storeApiDelete(url, options = {}) {
 }
 
 // src/vars/vars.handler.ts
-import { getHost, getOrigin, isDevelopment as isDevelopment2, isProduction } from "@websolutespa/bom-core";
+import { getHost, getOrigin, isDevelopment as isDevelopment3, isProduction } from "@websolutespa/bom-core";
 
 // ../models/src/label/label.service.ts
 async function getLabels(params = {}) {
@@ -2268,7 +2310,7 @@ function varsHandler() {
         const layout = typeof locale === "string" && typeof market === "string" ? await getLayout(market, locale) : void 0;
         const info = {
           production: isProduction,
-          development: isDevelopment2,
+          development: isDevelopment3,
           origin: getOrigin(request.headers),
           host: getHost(request.headers),
           headers: { ...sortKeys(request.headers) },
@@ -2393,7 +2435,6 @@ export {
   MockPageService,
   MockService,
   NextPhase,
-  REMOTE_API_SESSION,
   RemoteMenuService,
   RemotePageService,
   RemoteService,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@websolutespa/bom-mixer-store",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "description": "Mixer Store module of the BOM Repository",
   "keywords": [
     "bom",

package/src/api/api.ts

@@ -9,40 +9,14 @@ export function getLocalApiRequestOptions(): ApiRequestOptions {
   };
 }
 
-export const REMOTE_API_SESSION: { token: string | null } = {
-  token: null,
-};
-
-export function getRemoteApiRequestOptions(): ApiRequestOptions {
-  if (REMOTE_API_SESSION.token) {
-    // authenticated end user JWT token bearer (end_users)
-    return {
-      // mode: 'cors',
-      headers: {
-        Authorization: `Bearer ${REMOTE_API_SESSION.token}`,
-        // Authorization: `JWT ${REMOTE_API_SESSION.token}`,
-      },
-    };
-  } else {
-    // guest user api key (users)
-    return {
-      // mode: 'cors',
-      headers: {
-        Authorization: `users API-Key ${process.env.STORE_API_KEY}`,
-      },
-    };
-  }
-}
-
-/*
-export async function getRemoteApiRequestOptions(): Promise<ApiRequestOptions> {
-  if (REMOTE_API_SESSION.token) {
+export function getRemoteApiRequestOptions(token?: string): ApiRequestOptions {
+  if (token) {
     // authenticated end user JWT token bearer (end_users)
     return {
       // mode: 'cors',
       headers: {
-        Authorization: `Bearer ${REMOTE_API_SESSION.token}`,
-        // Authorization: `JWT ${REMOTE_API_SESSION.token}`,
+        Authorization: `JWT ${token}`,
+        // Authorization: `Bearer ${token}`,
       },
     };
   } else {
@@ -55,21 +29,3 @@ export async function getRemoteApiRequestOptions(): Promise<ApiRequestOptions> {
     };
   }
 }
-*/
-
-/*
-const session = await getSession<T>(request, response);
-// console.log('getAuth.session', session);
-if (session.token && session.exp && session.exp > Math.floor(new Date().getTime() / 1000)) {
-  REMOTE_API_SESSION.token = session.token;
-} else {
-  session.token = undefined;
-  session.exp = undefined;
-  await session.save();
-  session.destroy();
-  REMOTE_API_SESSION.token = null;
-}
-return session;
-*/
-
-

package/src/remote/remote.service.ts

@@ -1,4 +1,5 @@
 import { IEntity, IEquatable, IPagedResult, IQuerable, IStore, qsSerialize, QueryParams } from '@websolutespa/bom-core';
+import { getRemoteApiRequestOptions } from '../api/api';
 import { decorateSchema_, decorateSchemas_ } from '../decorators';
 import { remoteApiDelete, remoteApiGet, remoteApiPatch, remoteApiPost } from './remote.api';
 
@@ -25,7 +26,7 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     this.store = store;
   }
 
-  async findOne<B extends T = T>(id: IEquatable, params: Omit<QueryParams, 'where'> = {}): Promise<B | undefined> {
+  async findOne<B extends T = T>(id: IEquatable, params: Omit<QueryParams, 'where'> = {}, token?: string): Promise<B | undefined> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     const query = qsSerialize(params);
@@ -33,7 +34,7 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     // console.log('RemoteService', this.key, 'findOne', url);
     try {
-      const item = await remoteApiGet<B>(url);
+      const item = await remoteApiGet<B>(url, getRemoteApiRequestOptions(token));
       if (item) {
         return await this.decorateOne_(item, params);
       }
@@ -43,7 +44,7 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     return;
   }
 
-  async findMany<B extends T = T>(params: QueryParams = {}): Promise<B[]> {
+  async findMany<B extends T = T>(params: QueryParams = {}, token?: string): Promise<B[]> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
@@ -51,12 +52,12 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'findMany', url);
-    const response = await remoteApiGet<B[] | { docs: B[] }>(url);
+    const response = await remoteApiGet<B[] | { docs: B[] }>(url, getRemoteApiRequestOptions(token));
     const items: B[] = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
 
-  async findPaged<B extends T = T>(params: QueryParams = {}): Promise<IPagedResult<B>> {
+  async findPaged<B extends T = T>(params: QueryParams = {}, token?: string): Promise<IPagedResult<B>> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = true;
@@ -64,35 +65,35 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'findPaged', url);
-    const response = await remoteApiGet<IPagedResult<B>>(url);
+    const response = await remoteApiGet<IPagedResult<B>>(url, getRemoteApiRequestOptions(token));
     let items: B[] = response.docs;
     items = await this.decorateMany_(items, params);
     return { ...response, docs: items };
   }
 
-  async create<B extends T = T>(payload: Omit<B, 'id'>, params: QueryParams = {}): Promise<B> {
+  async create<B extends T = T>(payload: Omit<B, 'id'>, params: QueryParams = {}, token?: string): Promise<B> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     const query = qsSerialize(params);
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'create', url);
-    const result = await remoteApiPost<B | { doc: B }>(url, payload);
+    const result = await remoteApiPost<B | { doc: B }>(url, payload, getRemoteApiRequestOptions(token));
     const item = (result.doc ? result.doc : result) as B;
     return await this.decorateOne_(item, {});
   }
 
-  async updateOne<B extends T = T>(id: IEquatable, payload: Partial<B>, params: Omit<QueryParams, 'where'> = {}): Promise<B> {
+  async updateOne<B extends T = T>(id: IEquatable, payload: Partial<B>, params: Omit<QueryParams, 'where'> = {}, token?: string): Promise<B> {
     const query = qsSerialize(params);
     const search = query ? `?${query}` : '';
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     // console.log('RemoteService', this.key, 'updateOne', url);
-    const result = await remoteApiPatch<B | { doc: B }>(url, payload);
+    const result = await remoteApiPatch<B | { doc: B }>(url, payload, getRemoteApiRequestOptions(token));
     const item = (result.doc ? result.doc : result) as B;
     return await this.decorateOne_(item, {});
   }
 
-  async updateMany<B extends T = T>(payload: Partial<B>, params: QueryParams = {}): Promise<B[]> {
+  async updateMany<B extends T = T>(payload: Partial<B>, params: QueryParams = {}, token?: string): Promise<B[]> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
@@ -100,21 +101,21 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'updateMany', url);
-    const response = await remoteApiPatch<B[] | { docs: B[] }>(url, payload);
+    const response = await remoteApiPatch<B[] | { docs: B[] }>(url, payload, getRemoteApiRequestOptions(token));
     const items: B[] = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
 
-  async deleteOne<B extends T = T>(id: IEquatable, params: Omit<QueryParams, 'where'> = {}): Promise<B | undefined> {
+  async deleteOne<B extends T = T>(id: IEquatable, params: Omit<QueryParams, 'where'> = {}, token?: string): Promise<B | undefined> {
     const query = qsSerialize(params);
     const search = query ? `?${query}` : '';
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     // console.log('RemoteService', this.key, 'deleteOne', url);
-    const item = await remoteApiDelete<B>(url);
+    const item = await remoteApiDelete<B>(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
 
-  async deleteMany<B extends T = T>(params: QueryParams = {}): Promise<B[]> {
+  async deleteMany<B extends T = T>(params: QueryParams = {}, token?: string): Promise<B[]> {
     params.richText = String(params.richText) === 'true' ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
@@ -122,22 +123,22 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'deleteMany', url);
-    const response = await remoteApiDelete<B[] | { docs: B[] }>(url);
+    const response = await remoteApiDelete<B[] | { docs: B[] }>(url, getRemoteApiRequestOptions(token));
     const items: B[] = Array.isArray(response) ? response : response.docs;
     return await this.decorateMany_(items, params);
   }
 
   // !!! old
 
-  async update<B extends T = T>(payload: Partial<B>, params: QueryParams = {}): Promise<B> {
+  async update<B extends T = T>(payload: Partial<B>, params: QueryParams = {}, token?: string): Promise<B> {
     const url = `/${this.key}`;
     // console.log('RemoteService', this.key, 'update', url);
-    const result = await remoteApiPatch<B | { doc: B }>(url, payload);
+    const result = await remoteApiPatch<B | { doc: B }>(url, payload, getRemoteApiRequestOptions(token));
     const item = (result.doc ? result.doc : result) as B;
     return await this.decorateOne_(item, {});
   }
 
-  async delete<B extends T = T>(id: IEquatable): Promise<B | undefined> {
+  async delete<B extends T = T>(id: IEquatable, token?: string): Promise<B | undefined> {
     const params = {
       where: {
         id: {
@@ -149,7 +150,7 @@ export class RemoteService<T extends IEntity = IEntity> implements IQuerable<T>
     const search = query ? `?${query}` : '';
     const url = `/${this.key}${search}`;
     // console.log('RemoteService', this.key, 'delete', url);
-    const item = await remoteApiDelete<B>(url);
+    const item = await remoteApiDelete<B>(url, getRemoteApiRequestOptions(token));
     return await this.decorateOne_(item, {});
   }
 

package/src/session/session.service.ts

@@ -1,11 +1,11 @@
-
 import { isDevelopment } from '@websolutespa/bom-core';
-import * as http from 'http';
 import { getIronSession, IronSession, SessionOptions } from 'iron-session';
+import { NextApiRequest, NextApiResponse } from 'next';
+import { NextRequest, NextResponse } from 'next/server';
 
 export async function getSession<T extends object = Record<string, any>>(
-  request: (http.IncomingMessage | Request & { cookies: any }),
-  response?: Response | http.ServerResponse
+  request: NextRequest | NextApiRequest,
+  response: NextResponse | NextApiResponse
 ): Promise<IronSession<T>> {
   const COOKIE_NAME = 'websolutespa-next-js';
   const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD as string || 'SECRET_COOKIE_PASSWORD_32_CHARS_LONG';
@@ -17,9 +17,27 @@ export async function getSession<T extends object = Record<string, any>>(
     },
     password: COOKIE_PASSWORD,
   };
-  const session =
-    'cookies' in request ?
-      await getIronSession<T>(request.cookies, sessionOptions) :
-      await getIronSession<T>(request, response, sessionOptions);
+  const session = await getIronSession<T>(request, response, sessionOptions);
   return session;
 }
+
+export type SessionWithToken<T extends object = Record<string, any>> = T & Partial<{
+  token: string;
+  exp: number;
+}>;
+
+export async function getSessionToken<T extends SessionWithToken>(
+  request: NextRequest | NextApiRequest,
+  response: NextResponse | NextApiResponse
+): Promise<string | undefined> {
+  const session = await getSession<T>(request, response);
+  if (session.token && session.exp && session.exp > Math.floor(new Date().getTime() / 1000)) {
+    return session.token;
+  } else {
+    session.token = undefined;
+    session.exp = undefined;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}

package/src/store/store.handler.ts

@@ -1,6 +1,7 @@
-import { IRedirect, IRoute, IStore, asEquatable, defaultLocale, defaultMarket, qsDeserialize } from '@websolutespa/bom-core';
+import { IEntity, IRedirect, IRoute, IStore, asEquatable, defaultLocale, defaultMarket, qsDeserialize } from '@websolutespa/bom-core';
 import { NextApiRequest, NextApiResponse } from 'next';
 import { apiHandler } from '../api/api.handler';
+import { getSessionToken } from '../session/session.service';
 import { COLLECTIONS } from './store';
 import { getStore } from './store.service';
 
@@ -44,10 +45,11 @@ export function collectionGet<T extends IStore>(storePromise: () => Promise<T>)
         console.error('storeHandler.collectionGet', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
       // find a specific document by id
       if (id) {
         // console.log('storeHandler.collectionGet', collection, id, params);
-        const item = await service.findOne(asEquatable(id), params);
+        const item = await service.findOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -56,11 +58,11 @@ export function collectionGet<T extends IStore>(storePromise: () => Promise<T>)
         // find paginated documents
       } else if (String(params.pagination) === 'true') {
         // console.log('storeHandler.collectionGet', collection, params);
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
         // console.log('storeHandler.collectionGet', collection, params);
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {
@@ -80,6 +82,13 @@ export function collectionPost<T extends IStore>(storePromise: () => Promise<T>)
         return response.status(405).send('method not allowed');
       }
       const collection: string = collections[0];
+      const id: string = collections[1];
+      if (id) {
+        console.error('method not allowed', collection);
+        return response.status(405).send('method not allowed');
+      }
+      const qs = Object.entries(query).map(kv => kv.join('=')).join('&');
+      const params = qsDeserialize(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -90,7 +99,10 @@ export function collectionPost<T extends IStore>(storePromise: () => Promise<T>)
       if (collection === 'route') {
         return routePost(store, request, response);
       }
-      // !!! todo post create
+      const token = await getSessionToken(request, response);
+      const payload: Omit<IEntity, 'id'> = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error: any) {
       console.error('storeHandler.error.500', error);
       throw error;
@@ -127,10 +139,12 @@ export function collectionPatch<T extends IStore>(storePromise: () => Promise<T>
         console.error('storeHandler.collectionUpdate', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
+      const payload: Partial<IEntity> = request.body;
       // update a specific document by id
       if (id) {
         // console.log('storeHandler.collectionUpdate', collection, id, params);
-        const item = await service.updateOne(asEquatable(id), params);
+        const item = await service.updateOne(asEquatable(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -138,7 +152,7 @@ export function collectionPatch<T extends IStore>(storePromise: () => Promise<T>
         }
       } else {
         // console.log('storeHandler.collectionUpdate', collection, params);
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {
@@ -177,10 +191,11 @@ export function collectionDelete<T extends IStore>(storePromise: () => Promise<T
         console.error('storeHandler.collectionDelete', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
       // delete a specific document by id
       if (id) {
         // console.log('storeHandler.collectionDelete', collection, id, params);
-        const item = await service.deleteOne(asEquatable(id), params);
+        const item = await service.deleteOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -188,7 +203,7 @@ export function collectionDelete<T extends IStore>(storePromise: () => Promise<T
         }
       } else {
         // console.log('storeHandler.collectionDelete', collection, params);
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {