cyberia 3.0.2 → 3.1.3

package/src/api/file/file.service.js

@@ -387,12 +387,35 @@ const FileService = {
         if (doc.isPublic) return true;
 
         // Otherwise, user must be authenticated and own the document
+        // Try bearer token first
         const token = getBearerToken(req);
-        if (!token) false;
-        const payload = jwtVerify(token, options);
-        const user = await User.findOne({ _id: payload._id }).lean();
-        if (!user) return false;
-        return String(doc.userId) === String(user._id);
+        if (token) {
+          try {
+            const payload = jwtVerify(token, options);
+            const user = await User.findOne({ _id: payload._id }).lean();
+            if (user && String(doc.userId) === String(user._id)) return true;
+          } catch (bearerErr) {
+            logger.warn('Bearer token verification failed, trying cookie session fallback:', bearerErr.message);
+          }
+        }
+
+        // Fallback: check cookie-based session (refreshToken cookie)
+        const refreshToken = req.cookies?.refreshToken;
+        if (refreshToken) {
+          try {
+            const user = await User.findOne({ 'activeSessions.tokenHash': refreshToken }).lean();
+            if (user) {
+              const session = user.activeSessions.find((s) => s.tokenHash === refreshToken);
+              if (session && (!session.expiresAt || session.expiresAt >= new Date())) {
+                return String(doc.userId) === String(user._id);
+              }
+            }
+          } catch (cookieErr) {
+            logger.warn('Cookie session verification failed:', cookieErr.message);
+          }
+        }
+
+        return false;
       } catch (err) {
         console.log(err);
         logger.error('Authorization check failed:', err);

package/src/api/ipfs/ipfs.service.js

@@ -24,7 +24,7 @@ const createPinRecord = async ({ cid, userId, options }) => {
   const record = await Ipfs.findOneAndUpdate(
     { cid, userId },
     { cid, userId },
-    { upsert: true, new: true, setDefaultsOnInsert: true },
+    { upsert: true, returnDocument: 'after', setDefaultsOnInsert: true },
   );
 
   logger.info(`IPFS pin record upserted – CID: ${cid}, userId: ${userId}`);
@@ -107,7 +107,7 @@ const IpfsService = {
   put: async (req, res, options) => {
     /** @type {import('./ipfs.model.js').IpfsModel} */
     const Ipfs = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Ipfs;
-    return await Ipfs.findByIdAndUpdate(req.params.id, req.body, { new: true });
+    return await Ipfs.findByIdAndUpdate(req.params.id, req.body, { returnDocument: 'after' });
   },
 
   delete: async (req, res, options) => {

package/src/api/object-layer/object-layer.controller.js

@@ -21,7 +21,9 @@ const ObjectLayerController = {
   },
   get: async (req, res, options) => {
     try {
-      res.setHeader('Access-Control-Allow-Origin', '*');
+      if (req && req.headers && req.headers.origin) {
+        res.set('Access-Control-Allow-Origin', req.headers.origin);
+      } else res.setHeader('Access-Control-Allow-Origin', '*');
       res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
       const result = await ObjectLayerService.get(req, res, options);
       return res.status(200).json({
@@ -39,7 +41,9 @@ const ObjectLayerController = {
   generateWebp: async (req, res, options) => {
     try {
       const result = await ObjectLayerService.generateWebp(req, res, options);
-      res.setHeader('Access-Control-Allow-Origin', '*');
+      if (req && req.headers && req.headers.origin) {
+        res.set('Access-Control-Allow-Origin', req.headers.origin);
+      } else res.setHeader('Access-Control-Allow-Origin', '*');
       res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
       res.setHeader('Content-Type', 'image/webp');
       res.setHeader(

package/src/api/object-layer/object-layer.model.js

@@ -46,14 +46,67 @@ const ItemSchema = new Schema(
   { _id: false },
 );
 
+/**
+ * @typedef {Object} Ledger
+ * Blockchain protocol metadata linking the visual object-layer prefab to its economic reality.
+ * Uses ERC-1155 as the single multi-token standard for both fungible (CryptoKoyn) and
+ * non-fungible / semi-fungible Object Layer items within one contract.
+ * @property {string} type - The token standard or off-chain designation (ERC1155, OFF_CHAIN).
+ * @property {string} address - The Solidity smart contract address (ObjectLayerToken).
+ * @property {string} tokenId - The uint256 ERC-1155 token ID (derived from keccak256 of the item identifier).
+ * @memberof CyberiaObjectLayerModel
+ */
+const LedgerSchema = new Schema(
+  {
+    type: {
+      type: String,
+      enum: ['ERC1155', 'OFF_CHAIN'],
+      required: true,
+    },
+    address: { type: String }, // ObjectLayerToken ERC-1155 contract address
+    tokenId: { type: String, default: '' }, // uint256 ERC-1155 token ID (hex or decimal string)
+  },
+  { _id: false },
+);
+
+/**
+ * @typedef {Object} Render
+ * IPFS content identifiers for the consolidated atlas sprite sheet.
+ * @property {string} cid - IPFS Content Identifier for the consolidated atlas sprite sheet PNG
+ * @property {string} metadataCid - IPFS Content Identifier for the atlas sprite sheet metadata JSON (fast-json-stable-stringify)
+ * @memberof CyberiaObjectLayerModel
+ */
+const RenderSchema = new Schema(
+  {
+    cid: { type: String, default: '', trim: true },
+    metadataCid: { type: String, default: '', trim: true },
+  },
+  { _id: false },
+);
+
 /**
  * @typedef {Object} ObjectLayer
  * @property {Object} data - Object layer data
- * @property {Data.Stats} data.stats - Statistical attributes of the object layer
- * @property {Data.Item} data.item - Item information this layer represents
- * @property {string} data.seed - Random UUID for unique state generation
- * @property {string} [data.atlasSpriteSheetCid] - IPFS Content Identifier for the consolidated atlas sprite sheet PNG
- * @property {string} [cid] - IPFS Content Identifier for the object layer data JSON (fast-json-stable-stringify)
+ * @property {Object} data.stats - Statistical or mechanical attributes for the object layer
+ * @property {number} data.stats.effect - The effect attribute value
+ * @property {number} data.stats.resistance - The resistance attribute value
+ * @property {number} data.stats.agility - The agility attribute value
+ * @property {number} data.stats.range - The range attribute value
+ * @property {number} data.stats.intelligence - The intelligence attribute value
+ * @property {number} data.stats.utility - The utility attribute value
+ * @property {Object} data.item - Human-readable item information for the object layer
+ * @property {string} data.item.id - Unique identifier for the item
+ * @property {string} data.item.type - Type of the item
+ * @property {string} data.item.description - Description of the item
+ * @property {boolean} data.item.activable - Whether the item can be activated
+ * @property {Object} data.ledger - Blockchain protocol metadata linking the visual object-layer prefab to its economic reality
+ * @property {string} data.ledger.type - The token standard or off-chain designation (ERC1155, OFF_CHAIN).
+ * @property {string} data.ledger.address - The ObjectLayerToken ERC-1155 smart contract address.
+ * @property {string} data.ledger.tokenId - The uint256 ERC-1155 token ID (hex or decimal string).
+ * @property {Object} data.render - IPFS content identifiers for the consolidated atlas sprite sheet
+ * @property {string} data.render.cid - IPFS Content Identifier for the consolidated atlas sprite sheet PNG
+ * @property {string} data.render.metadataCid - IPFS Content Identifier for the atlas sprite sheet metadata JSON (fast-json-stable-stringify)
+ * @property {string} cid - IPFS Content Identifier for the object layer data JSON (fast-json-stable-stringify)
  * @property {Types.ObjectId} objectLayerRenderFramesId - Reference to ObjectLayerRenderFrames document
  * @property {Types.ObjectId} atlasSpriteSheetId - Reference to AtlasSpriteSheet document
  * @property {string} sha256 - SHA-256 hash of the object layer data
@@ -66,15 +119,8 @@ const ObjectLayerSchema = new Schema(
     data: {
       stats: { type: StatsSchema, required: true },
       item: { type: ItemSchema, required: true },
-      seed: {
-        type: String,
-        required: true,
-        match: [
-          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
-          'Please provide a valid UUID v4',
-        ],
-      },
-      atlasSpriteSheetCid: { type: String, default: '', trim: true },
+      ledger: { type: LedgerSchema, required: true },
+      render: { type: RenderSchema, default: () => ({}) },
     },
     cid: { type: String, default: '', trim: true },
     objectLayerRenderFramesId: { type: Schema.Types.ObjectId, ref: 'ObjectLayerRenderFrames' },
@@ -114,13 +160,12 @@ ObjectLayerSchema.index(
 );
 
 // Pre-save hook to ensure data consistency
-ObjectLayerSchema.pre('save', function (next) {
+ObjectLayerSchema.pre('save', function () {
   // Ensure all required fields are present
-  if (!this.data.stats || !this.data.item || !this.data.seed || !this.sha256) {
+  if (!this.data.stats || !this.data.item || !this.sha256) {
     throw new Error('Missing required fields');
   }
-  // cid (object layer data JSON) and data.atlasSpriteSheetCid (atlas PNG) are optional – default to ''
-  next();
+  // cid (object layer data JSON) and data.render.cid (atlas PNG) are optional – default to ''
 });
 
 // Create and export the model
@@ -134,7 +179,8 @@ const ObjectLayerDto = {
       return {
         _id: 1,
         'data.item': 1,
-        'data.atlasSpriteSheetCid': 1,
+        'data.ledger': 1,
+        'data.render': 1,
         cid: 1,
         objectLayerRenderFramesId: 1,
         atlasSpriteSheetId: 1,
@@ -145,8 +191,8 @@ const ObjectLayerDto = {
         _id: 1,
         'data.item': 1,
         'data.stats': 1,
-        'data.seed': 1,
-        'data.atlasSpriteSheetCid': 1,
+        'data.ledger': 1,
+        'data.render': 1,
         cid: 1,
         objectLayerRenderFramesId: 1,
         atlasSpriteSheetId: 1,