@websolutespa/bom-mixer-store 1.8.6 → 1.8.7

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @websolutespa/bom-mixer-store
 
+## 1.8.7
+
+### Patch Changes
+
+- Modified: storeHandler
+- Updated dependencies
+  - @websolutespa/bom-core@1.8.15
+
 ## 1.8.6
 
 ### Patch Changes

package/dist/index.js

@@ -855,7 +855,37 @@ async function mockApiDelete(url, options = {}) {
 }
 
 // src/store/store.handler.ts
-var import_bom_core14 = require("@websolutespa/bom-core");
+var import_bom_core15 = require("@websolutespa/bom-core");
+
+// src/session/session.service.ts
+var import_bom_core9 = require("@websolutespa/bom-core");
+var import_iron_session = require("iron-session");
+async function getSession(request, response) {
+  const COOKIE_NAME = "websolutespa-next-js";
+  const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD || "SECRET_COOKIE_PASSWORD_32_CHARS_LONG";
+  const sessionOptions = {
+    cookieName: COOKIE_NAME,
+    // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+    cookieOptions: {
+      secure: !import_bom_core9.isDevelopment
+    },
+    password: COOKIE_PASSWORD
+  };
+  const session = await (0, import_iron_session.getIronSession)(request, response, sessionOptions);
+  return session;
+}
+async function getSessionToken(request, response) {
+  const session = await getSession(request, response);
+  if (session.token && session.exp && session.exp > Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3)) {
+    return session.token;
+  } else {
+    session.token = void 0;
+    session.exp = void 0;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}
 
 // src/static/static.ts
 var staticCollections = [{
@@ -1152,7 +1182,7 @@ var KNOWN_COLLECTIONS = [
 var COLLECTIONS = [...ENV_COLLECTIONS, ...KNOWN_COLLECTIONS];
 
 // src/mock/mock.store.ts
-var import_bom_core10 = require("@websolutespa/bom-core");
+var import_bom_core11 = require("@websolutespa/bom-core");
 
 // src/fs/fs.service.ts
 var fs = __toESM(require("fs"));
@@ -1180,8 +1210,8 @@ async function fsReadJson(pathname) {
 }
 
 // src/static/static.service.ts
-var import_bom_core9 = require("@websolutespa/bom-core");
-var StaticService = class extends import_bom_core9.JsonService {
+var import_bom_core10 = require("@websolutespa/bom-core");
+var StaticService = class extends import_bom_core10.JsonService {
   constructor(config, store) {
     super([]);
     this.loaded = false;
@@ -1209,7 +1239,7 @@ var StaticService = class extends import_bom_core9.JsonService {
       const config = this.config;
       const src = config.src;
       if (typeof src === "string") {
-        const response = await (0, import_bom_core9.httpGet)(src, {});
+        const response = await (0, import_bom_core10.httpGet)(src, {});
         items = response.items;
       } else if (typeof src === "function") {
         if (src instanceof Promise) {
@@ -1325,7 +1355,7 @@ function getMockStoreFromData_(data) {
   return store;
 }
 async function getStoreData_() {
-  if (import_bom_core10.isDevelopment) {
+  if (import_bom_core11.isDevelopment) {
     const path = require("path");
     const pathname = path.join(process.cwd(), ".mixer", "store.json");
     return await fsReadJson(pathname) || {};
@@ -1341,17 +1371,17 @@ async function getMockStore_() {
 }
 async function getMockStore() {
   return fromCache(async () => {
-    if (!import_bom_core10.isDevelopment) {
+    if (!import_bom_core11.isDevelopment) {
       console.warn("getMockStore");
     }
     const store = await getMockStore_();
     return store;
-  }, import_bom_core10.isDevelopment ? void 0 : "STORE_MOCK_");
+  }, import_bom_core11.isDevelopment ? void 0 : "STORE_MOCK_");
 }
 
 // src/cached/cached.service.ts
-var import_bom_core11 = require("@websolutespa/bom-core");
-var CachedService = class extends import_bom_core11.JsonService {
+var import_bom_core12 = require("@websolutespa/bom-core");
+var CachedService = class extends import_bom_core12.JsonService {
   constructor(service, options = {}) {
     super([]);
     this.cache_ = /* @__PURE__ */ new Map();
@@ -1390,7 +1420,7 @@ var CachedService = class extends import_bom_core11.JsonService {
     });
   }
   async findOne(id, params = {}) {
-    const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+    const serializedParams = (0, import_bom_core12.qsSerialize)(params);
     const key = `findOne[${id}]?${serializedParams}`;
     return await this.fromCache_(async () => {
       return await this.service_.findOne(id, params);
@@ -1399,7 +1429,7 @@ var CachedService = class extends import_bom_core11.JsonService {
   async findMany(params = {}) {
     if (storeStrategy === "decoratedApi" /* DecoratedApi */) {
       const { market, locale, ...otherParams } = params;
-      const serializedParams = (0, import_bom_core11.qsSerialize)({ market, locale });
+      const serializedParams = (0, import_bom_core12.qsSerialize)({ market, locale });
       const key = `findMany?${serializedParams}`;
       let items = await this.fromCache_(async () => {
         return await this.service_.findMany({ market, locale });
@@ -1412,7 +1442,7 @@ var CachedService = class extends import_bom_core11.JsonService {
       }
       return items;
     } else {
-      const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+      const serializedParams = (0, import_bom_core12.qsSerialize)(params);
       const key = `findMany?${serializedParams}`;
       return await this.fromCache_(async () => {
         return await this.service_.findMany(params);
@@ -1420,7 +1450,7 @@ var CachedService = class extends import_bom_core11.JsonService {
     }
   }
   async findPaged(params = {}) {
-    const serializedParams = (0, import_bom_core11.qsSerialize)(params);
+    const serializedParams = (0, import_bom_core12.qsSerialize)(params);
     const key = `findPaged?${serializedParams}`;
     return await this.fromCache_(async () => {
       return await this.service_.findPaged(params);
@@ -1451,25 +1481,25 @@ var CachedService = class extends import_bom_core11.JsonService {
 };
 
 // src/remote/remote.service.ts
-var import_bom_core13 = require("@websolutespa/bom-core");
+var import_bom_core14 = require("@websolutespa/bom-core");
 
 // src/remote/remote.api.ts
-var import_bom_core12 = require("@websolutespa/bom-core");
+var import_bom_core13 = require("@websolutespa/bom-core");
 var API_URL3 = process.env.STORE_URL;
 var API_BASE4 = process.env.STORE_API || "/api";
 function getRemoteApiUrl(pathname) {
   let url = `${API_URL3}${API_BASE4}${pathname}`;
-  url = import_bom_core12.isBrowser ? url : url.replace("://localhost", "://127.0.0.1");
+  url = import_bom_core13.isBrowser ? url : url.replace("://localhost", "://127.0.0.1");
   return url;
 }
 async function remoteApiFetch(pathname, options = {}) {
-  if (import_bom_core12.isBrowser) {
+  if (import_bom_core13.isBrowser) {
     throw "Unauthorized: remote api cannot be fetched client side";
   }
   const url = getRemoteApiUrl(pathname);
-  const apiOptions = (0, import_bom_core12.merge)({ ...getRemoteApiRequestOptions() }, options);
+  const apiOptions = (0, import_bom_core13.merge)({ ...getRemoteApiRequestOptions() }, options);
   console.log("remoteApiFetch", apiOptions.method, url);
-  const apiResponse = await (0, import_bom_core12.httpFetch)(url, apiOptions);
+  const apiResponse = await (0, import_bom_core13.httpFetch)(url, apiOptions);
   return apiResponse;
 }
 async function remoteApiGet(url, options = {}) {
@@ -1506,7 +1536,7 @@ var RemoteService = class {
   async findOne(id, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     try {
@@ -1523,7 +1553,7 @@ var RemoteService = class {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
@@ -1534,7 +1564,7 @@ var RemoteService = class {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = true;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const response = await remoteApiGet(url, getRemoteApiRequestOptions(token));
@@ -1545,7 +1575,7 @@ var RemoteService = class {
   async create(payload, params = {}, token) {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const result = await remoteApiPost(url, payload, getRemoteApiRequestOptions(token));
@@ -1553,7 +1583,7 @@ var RemoteService = class {
     return await this.decorateOne_(item, {});
   }
   async updateOne(id, payload, params = {}, token) {
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     const result = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
@@ -1564,7 +1594,7 @@ var RemoteService = class {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const response = await remoteApiPatch(url, payload, getRemoteApiRequestOptions(token));
@@ -1572,7 +1602,7 @@ var RemoteService = class {
     return await this.decorateMany_(items, params);
   }
   async deleteOne(id, params = {}, token) {
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}/${encodeURIComponent(id)}${search}`;
     const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
@@ -1582,7 +1612,7 @@ var RemoteService = class {
     params.richText = String(params.richText) === "true" ? true : false;
     params.draft = RemoteServiceStrategy.draft;
     params.pagination = false;
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const response = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
@@ -1604,7 +1634,7 @@ var RemoteService = class {
         }
       }
     };
-    const query = (0, import_bom_core13.qsSerialize)(params);
+    const query = (0, import_bom_core14.qsSerialize)(params);
     const search = query ? `?${query}` : "";
     const url = `/${this.key}${search}`;
     const item = await remoteApiDelete(url, getRemoteApiRequestOptions(token));
@@ -1780,7 +1810,7 @@ function collectionGet(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1791,18 +1821,19 @@ function collectionGet(storePromise) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.findOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.findOne((0, import_bom_core15.asEquatable)(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else if (String(params.pagination) === "true") {
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1820,6 +1851,13 @@ function collectionPost(storePromise) {
         return response.status(405).send("method not allowed");
       }
       const collection = collections[0];
+      const id = collections[1];
+      if (id) {
+        console.error("method not allowed", collection);
+        return response.status(405).send("method not allowed");
+      }
+      const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -1829,6 +1867,10 @@ function collectionPost(storePromise) {
       if (collection === "route") {
         return routePost(store, request, response);
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error) {
       console.error("storeHandler.error.500", error);
       throw error;
@@ -1850,7 +1892,7 @@ function collectionPatch(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1861,15 +1903,17 @@ function collectionPatch(storePromise) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
       if (id) {
-        const item = await service.updateOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.updateOne((0, import_bom_core15.asEquatable)(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1893,7 +1937,7 @@ function collectionDelete(storePromise) {
       const collection = collections[0];
       const id = collections[1];
       const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
-      const params = (0, import_bom_core14.qsDeserialize)(qs);
+      const params = (0, import_bom_core15.qsDeserialize)(qs);
       if (!COLLECTIONS.includes(collection)) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
@@ -1904,15 +1948,16 @@ function collectionDelete(storePromise) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.deleteOne((0, import_bom_core14.asEquatable)(id), params);
+        const item = await service.deleteOne((0, import_bom_core15.asEquatable)(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1953,8 +1998,8 @@ function storeIndexHandler() {
   return apiHandler({
     get: async (request, response) => {
       try {
-        const market = import_bom_core14.defaultMarket;
-        const locale = import_bom_core14.defaultLocale;
+        const market = import_bom_core15.defaultMarket;
+        const locale = import_bom_core15.defaultLocale;
         if (!Array.isArray(COLLECTIONS) || COLLECTIONS?.length === 0) {
           console.error("apiHome.collectionGet", "collections not found", COLLECTIONS);
           return response.status(405).send("method not allowed");
@@ -2221,7 +2266,7 @@ async function storeApiDelete(url, options = {}) {
 }
 
 // src/vars/vars.handler.ts
-var import_bom_core16 = require("@websolutespa/bom-core");
+var import_bom_core17 = require("@websolutespa/bom-core");
 
 // ../models/src/label/label.service.ts
 async function getLabels(params = {}) {
@@ -2252,7 +2297,7 @@ async function getMenus(params = {}) {
 }
 
 // ../models/src/route/route.service.ts
-var import_bom_core15 = require("@websolutespa/bom-core");
+var import_bom_core16 = require("@websolutespa/bom-core");
 async function getRouteLinkTree(market, locale) {
   const store = await getStore();
   const routes = await store.route.findMany({
@@ -2266,7 +2311,7 @@ async function getRouteLinkTree(market, locale) {
     }
   });
   const categories = await store.category.findMany({ market, locale });
-  const rootCategory = (0, import_bom_core15.getRootCategory)(categories);
+  const rootCategory = (0, import_bom_core16.getRootCategory)(categories);
   if (rootCategory) {
     const root = categoryToRouteLink(routes, categories, rootCategory, locale);
     return root;
@@ -2274,13 +2319,13 @@ async function getRouteLinkTree(market, locale) {
   return void 0;
 }
 function categoryToRouteLink(routes, categories, category, locale) {
-  const route = (0, import_bom_core15.findRouteOfCategory)(routes, category.id);
+  const route = (0, import_bom_core16.findRouteOfCategory)(routes, category.id);
   if (!route) {
     return void 0;
   }
-  const rootCategory = (0, import_bom_core15.getRootCategory)(categories);
+  const rootCategory = (0, import_bom_core16.getRootCategory)(categories);
   const childCategories = categories.filter((x) => {
-    const parentId = (0, import_bom_core15.asCategoryId)(x.category);
+    const parentId = (0, import_bom_core16.asCategoryId)(x.category);
     return rootCategory && rootCategory.id === category.id ? x.id !== rootCategory.id && (parentId === category.id || !parentId) : parentId === category.id;
   });
   const routeLink = newRouteLink(category, route, locale);
@@ -2292,7 +2337,7 @@ function newRouteLink(category, route, locale) {
   const id = route?.page || category.id;
   const media = category.media || route?.media;
   const schema = route?.template || route?.schema || category?.schema || "unknown";
-  const title = (0, import_bom_core15.localize)(category.title || route?.title || "untitled", locale);
+  const title = (0, import_bom_core16.localize)(category.title || route?.title || "untitled", locale);
   const routeLink = {
     category: category.id,
     href,
@@ -2369,10 +2414,10 @@ function varsHandler() {
         const { locale = defaultLocale3, market = defaultMaket } = request.query || {};
         const layout = typeof locale === "string" && typeof market === "string" ? await getLayout(market, locale) : void 0;
         const info = {
-          production: import_bom_core16.isProduction,
-          development: import_bom_core16.isDevelopment,
-          origin: (0, import_bom_core16.getOrigin)(request.headers),
-          host: (0, import_bom_core16.getHost)(request.headers),
+          production: import_bom_core17.isProduction,
+          development: import_bom_core17.isDevelopment,
+          origin: (0, import_bom_core17.getOrigin)(request.headers),
+          host: (0, import_bom_core17.getHost)(request.headers),
           headers: { ...sortKeys(request.headers) },
           env: { ...getFilteredEnv(process.env) },
           layout: { ...sortKeys(layout) }

package/dist/index.mjs

@@ -752,6 +752,36 @@ async function mockApiDelete(url, options = {}) {
 // src/store/store.handler.ts
 import { asEquatable, defaultLocale, defaultMarket, qsDeserialize } from "@websolutespa/bom-core";
 
+// src/session/session.service.ts
+import { isDevelopment } from "@websolutespa/bom-core";
+import { getIronSession } from "iron-session";
+async function getSession(request, response) {
+  const COOKIE_NAME = "websolutespa-next-js";
+  const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD || "SECRET_COOKIE_PASSWORD_32_CHARS_LONG";
+  const sessionOptions = {
+    cookieName: COOKIE_NAME,
+    // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+    cookieOptions: {
+      secure: !isDevelopment
+    },
+    password: COOKIE_PASSWORD
+  };
+  const session = await getIronSession(request, response, sessionOptions);
+  return session;
+}
+async function getSessionToken(request, response) {
+  const session = await getSession(request, response);
+  if (session.token && session.exp && session.exp > Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3)) {
+    return session.token;
+  } else {
+    session.token = void 0;
+    session.exp = void 0;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}
+
 // src/static/static.ts
 var staticCollections = [{
   src: "https://actarian.github.io/cms-i18n-react/api/continent.json",
@@ -1047,7 +1077,7 @@ var KNOWN_COLLECTIONS = [
 var COLLECTIONS = [...ENV_COLLECTIONS, ...KNOWN_COLLECTIONS];
 
 // src/mock/mock.store.ts
-import { isDevelopment } from "@websolutespa/bom-core";
+import { isDevelopment as isDevelopment2 } from "@websolutespa/bom-core";
 
 // src/fs/fs.service.ts
 import * as fs from "fs";
@@ -1220,7 +1250,7 @@ function getMockStoreFromData_(data) {
   return store;
 }
 async function getStoreData_() {
-  if (isDevelopment) {
+  if (isDevelopment2) {
     const path = __require("path");
     const pathname = path.join(process.cwd(), ".mixer", "store.json");
     return await fsReadJson(pathname) || {};
@@ -1236,12 +1266,12 @@ async function getMockStore_() {
 }
 async function getMockStore() {
   return fromCache(async () => {
-    if (!isDevelopment) {
+    if (!isDevelopment2) {
       console.warn("getMockStore");
     }
     const store = await getMockStore_();
     return store;
-  }, isDevelopment ? void 0 : "STORE_MOCK_");
+  }, isDevelopment2 ? void 0 : "STORE_MOCK_");
 }
 
 // src/cached/cached.service.ts
@@ -1686,18 +1716,19 @@ function collectionGet(storePromise) {
         console.error("storeHandler.collectionGet", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.findOne(asEquatable(id), params);
+        const item = await service.findOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else if (String(params.pagination) === "true") {
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1715,6 +1746,13 @@ function collectionPost(storePromise) {
         return response.status(405).send("method not allowed");
       }
       const collection = collections[0];
+      const id = collections[1];
+      if (id) {
+        console.error("method not allowed", collection);
+        return response.status(405).send("method not allowed");
+      }
+      const qs = Object.entries(query).map((kv) => kv.join("=")).join("&");
+      const params = qsDeserialize(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -1724,6 +1762,10 @@ function collectionPost(storePromise) {
       if (collection === "route") {
         return routePost(store, request, response);
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error) {
       console.error("storeHandler.error.500", error);
       throw error;
@@ -1756,15 +1798,17 @@ function collectionPatch(storePromise) {
         console.error("storeHandler.collectionUpdate", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
+      const payload = request.body;
       if (id) {
-        const item = await service.updateOne(asEquatable(id), params);
+        const item = await service.updateOne(asEquatable(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -1799,15 +1843,16 @@ function collectionDelete(storePromise) {
         console.error("storeHandler.collectionDelete", "method not allowed", collection);
         return response.status(405).send("method not allowed");
       }
+      const token = await getSessionToken(request, response);
       if (id) {
-        const item = await service.deleteOne(asEquatable(id), params);
+        const item = await service.deleteOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
           return response.status(404).send("not found");
         }
       } else {
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error) {
@@ -2116,7 +2161,7 @@ async function storeApiDelete(url, options = {}) {
 }
 
 // src/vars/vars.handler.ts
-import { getHost, getOrigin, isDevelopment as isDevelopment2, isProduction } from "@websolutespa/bom-core";
+import { getHost, getOrigin, isDevelopment as isDevelopment3, isProduction } from "@websolutespa/bom-core";
 
 // ../models/src/label/label.service.ts
 async function getLabels(params = {}) {
@@ -2265,7 +2310,7 @@ function varsHandler() {
         const layout = typeof locale === "string" && typeof market === "string" ? await getLayout(market, locale) : void 0;
         const info = {
           production: isProduction,
-          development: isDevelopment2,
+          development: isDevelopment3,
           origin: getOrigin(request.headers),
           host: getHost(request.headers),
           headers: { ...sortKeys(request.headers) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@websolutespa/bom-mixer-store",
-  "version": "1.8.6",
+  "version": "1.8.7",
   "description": "Mixer Store module of the BOM Repository",
   "keywords": [
     "bom",

package/src/session/session.service.ts

@@ -1,11 +1,11 @@
-
 import { isDevelopment } from '@websolutespa/bom-core';
-import * as http from 'http';
 import { getIronSession, IronSession, SessionOptions } from 'iron-session';
+import { NextApiRequest, NextApiResponse } from 'next';
+import { NextRequest, NextResponse } from 'next/server';
 
 export async function getSession<T extends object = Record<string, any>>(
-  request: (http.IncomingMessage | Request & { cookies: any }),
-  response?: Response | http.ServerResponse
+  request: NextRequest | NextApiRequest,
+  response: NextResponse | NextApiResponse
 ): Promise<IronSession<T>> {
   const COOKIE_NAME = 'websolutespa-next-js';
   const COOKIE_PASSWORD = process.env.SECRET_COOKIE_PASSWORD as string || 'SECRET_COOKIE_PASSWORD_32_CHARS_LONG';
@@ -17,9 +17,27 @@ export async function getSession<T extends object = Record<string, any>>(
     },
     password: COOKIE_PASSWORD,
   };
-  const session =
-    'cookies' in request ?
-      await getIronSession<T>(request.cookies, sessionOptions) :
-      await getIronSession<T>(request, response, sessionOptions);
+  const session = await getIronSession<T>(request, response, sessionOptions);
   return session;
 }
+
+export type SessionWithToken<T extends object = Record<string, any>> = T & Partial<{
+  token: string;
+  exp: number;
+}>;
+
+export async function getSessionToken<T extends SessionWithToken>(
+  request: NextRequest | NextApiRequest,
+  response: NextResponse | NextApiResponse
+): Promise<string | undefined> {
+  const session = await getSession<T>(request, response);
+  if (session.token && session.exp && session.exp > Math.floor(new Date().getTime() / 1000)) {
+    return session.token;
+  } else {
+    session.token = undefined;
+    session.exp = undefined;
+    await session.save();
+    session.destroy();
+    return;
+  }
+}

package/src/store/store.handler.ts

@@ -1,6 +1,7 @@
-import { IRedirect, IRoute, IStore, asEquatable, defaultLocale, defaultMarket, qsDeserialize } from '@websolutespa/bom-core';
+import { IEntity, IRedirect, IRoute, IStore, asEquatable, defaultLocale, defaultMarket, qsDeserialize } from '@websolutespa/bom-core';
 import { NextApiRequest, NextApiResponse } from 'next';
 import { apiHandler } from '../api/api.handler';
+import { getSessionToken } from '../session/session.service';
 import { COLLECTIONS } from './store';
 import { getStore } from './store.service';
 
@@ -44,10 +45,11 @@ export function collectionGet<T extends IStore>(storePromise: () => Promise<T>)
         console.error('storeHandler.collectionGet', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
       // find a specific document by id
       if (id) {
         // console.log('storeHandler.collectionGet', collection, id, params);
-        const item = await service.findOne(asEquatable(id), params);
+        const item = await service.findOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -56,11 +58,11 @@ export function collectionGet<T extends IStore>(storePromise: () => Promise<T>)
         // find paginated documents
       } else if (String(params.pagination) === 'true') {
         // console.log('storeHandler.collectionGet', collection, params);
-        const pagination = await service.findPaged(params);
+        const pagination = await service.findPaged(params, token);
         return response.status(200).json(pagination);
       } else {
         // console.log('storeHandler.collectionGet', collection, params);
-        const items = await service.findMany(params);
+        const items = await service.findMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {
@@ -80,6 +82,13 @@ export function collectionPost<T extends IStore>(storePromise: () => Promise<T>)
         return response.status(405).send('method not allowed');
       }
       const collection: string = collections[0];
+      const id: string = collections[1];
+      if (id) {
+        console.error('method not allowed', collection);
+        return response.status(405).send('method not allowed');
+      }
+      const qs = Object.entries(query).map(kv => kv.join('=')).join('&');
+      const params = qsDeserialize(qs);
       const store = await storePromise();
       const service = store[collection];
       if (!service) {
@@ -90,7 +99,10 @@ export function collectionPost<T extends IStore>(storePromise: () => Promise<T>)
       if (collection === 'route') {
         return routePost(store, request, response);
       }
-      // !!! todo post create
+      const token = await getSessionToken(request, response);
+      const payload: Omit<IEntity, 'id'> = request.body;
+      const item = await service.create(payload, params, token);
+      return response.status(200).json(item);
     } catch (error: any) {
       console.error('storeHandler.error.500', error);
       throw error;
@@ -127,10 +139,12 @@ export function collectionPatch<T extends IStore>(storePromise: () => Promise<T>
         console.error('storeHandler.collectionUpdate', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
+      const payload: Partial<IEntity> = request.body;
       // update a specific document by id
       if (id) {
         // console.log('storeHandler.collectionUpdate', collection, id, params);
-        const item = await service.updateOne(asEquatable(id), params);
+        const item = await service.updateOne(asEquatable(id), payload, params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -138,7 +152,7 @@ export function collectionPatch<T extends IStore>(storePromise: () => Promise<T>
         }
       } else {
         // console.log('storeHandler.collectionUpdate', collection, params);
-        const items = await service.updateMany(params);
+        const items = await service.updateMany(payload, params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {
@@ -177,10 +191,11 @@ export function collectionDelete<T extends IStore>(storePromise: () => Promise<T
         console.error('storeHandler.collectionDelete', 'method not allowed', collection);
         return response.status(405).send('method not allowed');
       }
+      const token = await getSessionToken(request, response);
       // delete a specific document by id
       if (id) {
         // console.log('storeHandler.collectionDelete', collection, id, params);
-        const item = await service.deleteOne(asEquatable(id), params);
+        const item = await service.deleteOne(asEquatable(id), params, token);
         if (item) {
           return response.status(200).json(item);
         } else {
@@ -188,7 +203,7 @@ export function collectionDelete<T extends IStore>(storePromise: () => Promise<T
         }
       } else {
         // console.log('storeHandler.collectionDelete', collection, params);
-        const items = await service.deleteMany(params);
+        const items = await service.deleteMany(params, token);
         return response.status(200).json(items);
       }
     } catch (error: any) {