@xen-orchestra/rest-api 0.17.0 → 0.19.0

package/dist/abstract-classes/base-controller.mjs

@@ -1,3 +1,4 @@
+import * as CM from 'complex-matcher';
 import { Controller } from 'tsoa';
 import { createGzip } from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
@@ -27,6 +28,25 @@ export class BaseController extends Controller {
             return mappedObjects;
         }
     }
+    async getTasksForObject(id, { filter, limit = Infinity } = {}) {
+        const tasks = {};
+        const object = await Promise.resolve(this.getObject(id));
+        const objectFilter = (task) => task.properties.objectId === object.id || task.properties.params?.id === object.id;
+        let userFilter = () => true;
+        if (filter !== undefined) {
+            userFilter = typeof filter === 'string' ? CM.parse(filter).createPredicate() : filter;
+        }
+        for await (const task of this.restApi.tasks.list({ filter: objectFilter })) {
+            if (limit === 0) {
+                break;
+            }
+            if (userFilter(task)) {
+                tasks[task.id] = task;
+                limit--;
+            }
+        }
+        return tasks;
+    }
     /**
      * statusCode must represent the status code in case of a synchronous request. Default 200
      */

package/dist/abstract-classes/xapi-xo-controller.mjs

@@ -1,4 +1,6 @@
 import { BaseController } from './base-controller.mjs';
+import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
+import { RAW_ALARM_FILTER } from '../alarms/alarm.service.mjs';
 export class XapiXoController extends BaseController {
     #type;
     constructor(type, restApi) {
@@ -14,4 +16,12 @@ export class XapiXoController extends BaseController {
     getXapiObject(maybeId) {
         return this.restApi.getXapiObject(maybeId, this.#type);
     }
+    getMessagesForObject(id, { filter, limit } = {}) {
+        const object = this.getObject(id);
+        const messages = this.restApi.getObjectsByType('message', {
+            filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} $object:${object.uuid} !${RAW_ALARM_FILTER}`,
+            limit,
+        });
+        return messages;
+    }
 }

package/dist/abstract-classes/xo-controller.mjs

@@ -16,7 +16,7 @@ let XoController = class XoController extends BaseController {
         super(restApi);
     }
     async getObjects(opts = {}) {
-        let objects = await this.getAllCollectionObjects();
+        let objects = await this.getAllCollectionObjects(opts);
         objects = limitAndFilterArray(objects, opts);
         const objectById = {};
         objects.forEach(obj => {

package/dist/alarms/alarm.controller.mjs

@@ -12,7 +12,7 @@ import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { alarm, alarmIds, partialAlarms } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
 import { AlarmService } from './alarm.service.mjs';
@@ -72,6 +72,7 @@ __decorate([
 AlarmController = __decorate([
     Route('alarms'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('alarms'),
     provide(AlarmController),

package/dist/backup-archives/backup-archive.controller.mjs

@@ -0,0 +1,96 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { noSuchObject } from 'xo-common/api-errors.js';
+import { provide } from 'inversify-binding-decorators';
+import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { XoController } from '../abstract-classes/xo-controller.mjs';
+import { backupArchive, backupArchiveIds, partialBackupArchives, } from '../open-api/oa-examples/backup-archive.oa-example.mjs';
+// BR uuid/xo-vm-backups/VM uuid/(ISO 8601 compact).json
+const BACKUP_ARCHIVE_ID_REGEX = /^([0-9a-fA-F-]{36})\/+xo-vm-backups\/+([0-9a-fA-F-]{36})\/+(\d{8}T\d{6}Z)\.json$/;
+let BackupArchiveController = class BackupArchiveController extends XoController {
+    async getAllCollectionObjects({ backupRepositories = [], } = {}) {
+        const backupRepositoryIds = [];
+        if (backupRepositories.includes('*')) {
+            const allBackupRepositories = await this.restApi.xoApp.getAllRemotes();
+            allBackupRepositories.forEach(br => backupRepositoryIds.push(br.id));
+        }
+        else {
+            for (const brId of backupRepositories) {
+                const br = await this.restApi.xoApp.getRemote(brId);
+                backupRepositoryIds.push(br.id);
+            }
+        }
+        const backupArchivesByRemote = await this.restApi.xoApp.listVmBackupsNg(backupRepositoryIds);
+        const vmBackupArchives = Object.values(backupArchivesByRemote)
+            .map(backupsByVm => Object.values(backupsByVm))
+            .flat(2);
+        return vmBackupArchives;
+    }
+    async getCollectionObject(id) {
+        const match = id.match(BACKUP_ARCHIVE_ID_REGEX);
+        if (match === null) {
+            throw noSuchObject(id, 'backup-archive');
+        }
+        const [, brId, vmId] = match;
+        const backupArchive = (await this.restApi.xoApp.listVmBackupsNg([brId]))[brId]?.[vmId]?.find(ba => ba.id === id);
+        if (backupArchive === undefined) {
+            throw noSuchObject(id, 'backup-archive');
+        }
+        return backupArchive;
+    }
+    /**
+     *
+     * You can use the alias "*" in "backup-repository" to select all backup repositories.
+     *
+     * @example backupRepositories ["c4284e12-37c9-7967-b9e8-83ef229c3e03", "1af95910-01b4-4e87-9c2f-d895cafe0776"]
+     * @example fields "id,backupRepository,disks"
+     * @example filter "disks:length:>0"
+     * @example limit 42
+     */
+    async getBackupArchives(req, backupRepositories, fields, ndjson, filter, limit) {
+        const backupArchives = await this.getObjects({ backupRepositories, filter, limit });
+        return this.sendObjects(Object.values(backupArchives), req);
+    }
+    /**
+     * @example id "231264c3-af43-4ec0-a3be-394c5b1fdbfc//xo-vm-backups/6ef7c09e-677b-1e6f-0546-7ab30413c61c/20250801T080832Z.json"
+     */
+    async getBackupArchive(id) {
+        const backupArchive = await this.getObject(id);
+        return backupArchive;
+    }
+};
+__decorate([
+    Example(backupArchiveIds),
+    Example(partialBackupArchives),
+    Get(''),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Query('backup-repository')),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], BackupArchiveController.prototype, "getBackupArchives", null);
+__decorate([
+    Example(backupArchive),
+    Get('{id}'),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path())
+], BackupArchiveController.prototype, "getBackupArchive", null);
+BackupArchiveController = __decorate([
+    Route('backup-archives'),
+    Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
+    Response(unauthorizedResp.status, unauthorizedResp.description),
+    Tags('backup-archives'),
+    provide(BackupArchiveController)
+], BackupArchiveController);
+export { BackupArchiveController };

package/dist/backup-jobs/backup-job.controller.mjs

@@ -15,7 +15,7 @@ import { Deprecated, Example, Get, Hidden, Middlewares, Path, Query, Request, Re
 import { provide } from 'inversify-binding-decorators';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from '../backup-logs/backup-log.service.mjs';
-import { notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray } from '../helpers/utils.helper.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -72,6 +72,7 @@ __decorate([
 BackupJobController = __decorate([
     Route('backup-jobs'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('backup-jobs'),
     provide(BackupJobController)
@@ -271,6 +272,7 @@ __decorate([
 DeprecatedBackupController = __decorate([
     Route('backup'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Middlewares((_req, _res, next) => {
         log.warn('You are calling a deprecated route. It will be removed in the futur. Please use `/rest/v0/backup-jobs` or `/rest/v0/backup-logs` instead');

package/dist/backup-logs/backup-log.controller.mjs

@@ -14,7 +14,7 @@ import { provide } from 'inversify-binding-decorators';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from './backup-log.service.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-import { unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 let BackupLogController = class BackupLogController extends XoController {
     #backupLogService;
@@ -66,6 +66,7 @@ __decorate([
 BackupLogController = __decorate([
     Route('backup-logs'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('backup-logs'),
     provide(BackupLogController),

package/dist/backup-repositories/backup-repositories.controller.mjs

@@ -9,7 +9,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
-import { notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { backupRepositoryIds, partialBackupRepositories, backupRepository, } from '../open-api/oa-examples/backup-repository.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 let BackupRepositoryController = class BackupRepositoryController extends XoController {
@@ -54,6 +54,7 @@ __decorate([
 BackupRepositoryController = __decorate([
     Route('backup-repositories'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('backup-repositories'),
     provide(BackupRepositoryController)

package/dist/groups/group.controller.mjs

@@ -12,13 +12,14 @@ import { inject } from 'inversify';
 import { json } from 'express';
 import { provide } from 'inversify-binding-decorators';
 import { forbiddenOperation } from 'xo-common/api-errors.js';
-import { createdResp, forbiddenOperationResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { badRequestResp, createdResp, forbiddenOperationResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { group, groupId, groupIds, partialGroups } from '../open-api/oa-examples/group.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 import { UserService } from '../users/user.service.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray } from '../helpers/utils.helper.mjs';
 import { partialUsers, userIds } from '../open-api/oa-examples/user.oa-example.mjs';
+import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs';
 let GroupController = class GroupController extends XoController {
     #userService;
     constructor(restApi, userService) {
@@ -106,6 +107,16 @@ let GroupController = class GroupController extends XoController {
         const users = await Promise.all(group.users.map(id => this.#userService.getUser(id)));
         return this.sendObjects(limitAndFilterArray(users, { filter, limit }), req, 'users');
     }
+    /**
+     * @example id "6c81b5e1-afc1-43ea-8f8d-939ceb5f3f90"
+     * @example fields "id,status,properties"
+     * @example filter "status:failure"
+     * @example limit 42
+     */
+    async getGroupTasks(req, id, fields, ndjson, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter, limit });
+        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    }
 };
 __decorate([
     Example(groupIds),
@@ -177,9 +188,23 @@ __decorate([
     __param(4, Query()),
     __param(5, Query())
 ], GroupController.prototype, "getGroupUsers", null);
+__decorate([
+    Example(taskIds),
+    Example(partialTasks),
+    Get('{id}/tasks'),
+    Tags('tasks'),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Path()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], GroupController.prototype, "getGroupTasks", null);
 GroupController = __decorate([
     Route('groups'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('groups'),
     provide(GroupController),

package/dist/hosts/host.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { Delete, Example, Get, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { pipeline } from 'node:stream/promises';
 import { provide } from 'inversify-binding-decorators';
@@ -17,8 +17,10 @@ import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.m
 import { host, hostIds, hostSmt, hostMissingPatches, hostStats, partialHosts, } from '../open-api/oa-examples/host.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
-import { featureUnauthorized, internalServerErrorResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { badRequestResp, featureUnauthorized, internalServerErrorResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { HostService } from './host.service.mjs';
+import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
+import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs';
 let HostController = class HostController extends XapiXoController {
     #alarmService;
     #hostService;
@@ -117,6 +119,42 @@ let HostController = class HostController extends XapiXoController {
         const { missingPatches } = await this.#hostService.getMissingPatchesInfo({ filter: host => host.id === id });
         return missingPatches;
     }
+    /**
+     * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
+     * @example fields "name,id,$object"
+     * @example filter "name:PBD_PLUG_FAILED_ON_SERVER_START"
+     * @example limit 42
+     */
+    getHostMessages(req, id, fields, ndjson, filter, limit) {
+        const messages = this.getMessagesForObject(id, { filter, limit });
+        return this.sendObjects(Object.values(messages), req, 'messages');
+    }
+    /**
+     * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
+     * @example fields "id,status,properties"
+     * @example filter "status:failure"
+     * @example limit 42
+     */
+    async getHostTasks(req, id, fields, ndjson, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter, limit });
+        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    }
+    /**
+     * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
+     * @example tag "from-rest-api"
+     */
+    async putHostTag(id, tag) {
+        const host = this.getXapiObject(id);
+        await host.$call('add_tags', tag);
+    }
+    /**
+     * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
+     * @example tag "from-rest-api"
+     */
+    async deleteHostTag(id, tag) {
+        const host = this.getXapiObject(id);
+        await host.$call('remove_tags', tag);
+    }
 };
 __decorate([
     Example(hostIds),
@@ -185,9 +223,50 @@ __decorate([
     Response(featureUnauthorized.status, featureUnauthorized.description),
     __param(0, Path())
 ], HostController.prototype, "getMissingPatches", null);
+__decorate([
+    Example(messageIds),
+    Example(partialMessages),
+    Get('{id}/messages'),
+    Tags('messages'),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Path()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], HostController.prototype, "getHostMessages", null);
+__decorate([
+    Example(taskIds),
+    Example(partialTasks),
+    Get('{id}/tasks'),
+    Tags('tasks'),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Path()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], HostController.prototype, "getHostTasks", null);
+__decorate([
+    Put('{id}/tags/{tag}'),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path()),
+    __param(1, Path())
+], HostController.prototype, "putHostTag", null);
+__decorate([
+    Delete('{id}/tags/{tag}'),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path()),
+    __param(1, Path())
+], HostController.prototype, "deleteHostTag", null);
 HostController = __decorate([
     Route('hosts'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('hosts'),
     provide(HostController),

package/dist/index.mjs

@@ -4,6 +4,7 @@ import genericErrorHandler from './middlewares/generic-error-handler.middleware.
 import tsoaToXoErrorHandler from './middlewares/tsoa-to-xo-error.middleware.mjs';
 import { RegisterRoutes } from './open-api/routes/routes.js';
 import { setupContainer } from './ioc/ioc.mjs';
+import { setupApiContext } from './middlewares/authentication.middleware.mjs';
 // Avoid using "import from" to import a json file as this requires assert/with and will break compatibility with recent node versions
 // https://github.com/nodejs/node/issues/51622
 const require = createRequire(import.meta.url);
@@ -31,14 +32,14 @@ const SWAGGER_UI_OPTIONS = {
 };
 export default function setupRestApi(express, xoApp) {
     setupContainer(xoApp);
+    express.use(BASE_URL, setupApiContext(xoApp));
     RegisterRoutes(express);
     express.get(`${BASE_URL}/docs/swagger.json`, (_req, res) => {
         res.setHeader('Content-Type', 'application/json');
         res.json(swaggerOpenApiSpec);
     });
     // do not register the doc at the root level, or it may lead to unwanted behaviour
-    // uncomment when all endpoints are migrated to this API
-    // express.get('/rest/v0', (_req, res) => res.redirect('/rest/v0/docs'))
+    express.get('/rest/v0', (_req, res) => res.redirect('/rest/v0/docs'));
     express.use(`${BASE_URL}/docs`, swaggerUi.serve, swaggerUi.setup(swaggerOpenApiSpec, SWAGGER_UI_OPTIONS));
     express.use(BASE_URL, tsoaToXoErrorHandler);
     express.use(BASE_URL, genericErrorHandler);

package/dist/ioc/ioc.mjs

@@ -8,7 +8,6 @@ import { HostService } from '../hosts/host.service.mjs';
 import { PoolService } from '../pools/pool.service.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { VdiService } from '../vdis/vdi.service.mjs';
-import { TaskService } from '../tasks/task.service.mjs';
 import { UserService } from '../users/user.service.mjs';
 import { BackupJobService } from '../backup-jobs/backup-job.service.mjs';
 import { BackupLogService } from '../backup-logs/backup-log.service.mjs';
@@ -58,10 +57,6 @@ export function setupContainer(xoApp) {
         return new AlarmService(restApi);
     })
         .inSingletonScope();
-    iocContainer.bind(TaskService).toDynamicValue(ctx => {
-        const restApi = ctx.container.get(RestApi);
-        return new TaskService(restApi);
-    });
     iocContainer
         .bind(VdiService)
         .toDynamicValue(ctx => {

package/dist/messages/message.controller.mjs

@@ -15,7 +15,7 @@ import { provide } from 'inversify-binding-decorators';
 import { alarmPredicate } from '../alarms/alarm.service.mjs';
 import { message, messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-import { notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
 let MessageController = class MessageController extends XapiXoController {
     constructor(restapi) {
@@ -76,8 +76,9 @@ __decorate([
 MessageController = __decorate([
     Route('messages'),
     Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
-    Tags('message'),
+    Tags('messages'),
     provide(MessageController),
     __param(0, inject(RestApi))
 ], MessageController);

package/dist/middlewares/authentication.middleware.mjs

@@ -1,34 +1,58 @@
 import { createLogger } from '@xen-orchestra/log';
-import { invalidCredentials, notImplemented, unauthorized } from 'xo-common/api-errors.js';
+import { unauthorized } from 'xo-common/api-errors.js';
 import { iocContainer } from '../ioc/ioc.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-const noop = () => { };
+import { ApiError } from '../helpers/error.helper.mjs';
 const log = createLogger('xo:rest-api:authentication');
-function getCredentials(securityName, req) {
-    const token = req.cookies.token ?? req.cookies.authenticationToken;
-    if (securityName === '*' || securityName === 'token') {
-        if (token !== undefined) {
-            return { token };
-        }
-        return;
-    }
-    log.error(`${securityName} not implemented.`);
-    throw notImplemented();
-}
 // TODO: correctly handle ACL/Resource set users
 // for now only support "xoa-admin"
+// TSOA spec require this function to be async
 export async function expressAuthentication(req, securityName) {
     const restApi = iocContainer.get(RestApi);
-    const ip = req.ip;
-    const credentials = getCredentials(securityName, req);
-    if (credentials === undefined) {
-        throw invalidCredentials();
+    const user = restApi.getCurrentUser();
+    const authType = req.res.locals.authType;
+    if (securityName !== '*' && authType !== securityName) {
+        throw new ApiError(`invalid authentification. please use ${securityName} authentication`, 401);
     }
-    const { user } = await restApi.authenticateUser(credentials, { ip });
     if (user.permission !== 'admin') {
         log.error(`The REST API can only be used by 'xoa-admin' users for now. Your permission: ${user.permission}`);
         throw unauthorized();
     }
-    await restApi.runWithApiContext(user, noop);
-    Promise.resolve(user);
+    return user;
+}
+export function setupApiContext(xoApp) {
+    return async (req, res, next) => {
+        const { cookies, headers, ip, query } = req;
+        const { authorization } = headers;
+        const token = cookies.authenticationToken ?? cookies.token;
+        const hasToken = Boolean(token);
+        const hasBasic = Boolean(authorization);
+        if (hasToken && hasBasic) {
+            return next(new ApiError('Having multiple authentication methods is not supported, please choose one', 400));
+        }
+        if (!hasToken && !hasBasic) {
+            return xoApp.runWithApiContext(undefined, next);
+        }
+        const credentials = {};
+        if (hasToken) {
+            Object.assign(credentials, { token });
+            res.locals.authType = 'token';
+        }
+        else {
+            const [, encoded] = authorization.split(' ');
+            if (encoded === undefined) {
+                return next(new ApiError('Malformed Authorization header', 400));
+            }
+            const [username, password] = Buffer.from(encoded, 'base64').toString().split(':');
+            Object.assign(credentials, { username, password, otp: query.otp });
+            res.locals.authType = 'basic';
+        }
+        try {
+            const { user } = await xoApp.authenticateUser(credentials, { ip });
+            return xoApp.runWithApiContext(user, next);
+        }
+        catch (error) {
+            return next(error);
+        }
+    };
 }