data-primals-engine 1.4.0 → 1.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "data-primals-engine",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "data-primals-engine is a package responsible from handling large amount of data using MongoDB in a practical and performant way. It can also get workflow models working (for automation), and fully supports internationalisation. It also has integrated AI assistant.",
   "main": "src/engine.js",
   "type": "module",
@@ -31,12 +31,11 @@
     "tar-fs": "3.0.9",
     "on-headers": "1.1.0",
     "brace-expansion": "2.0.2",
-    "prismjs": "1.30.0"
+    "prismjs": "1.30.0",
+    "xml2js": ">=0.5.0"
   },
   "overrides": {
-    "refractor": {
-      "prismjs": "1.30.0"
-    }
+    "prismjs": "1.30.0"
   },
   "repository": {
     "type": "git",
@@ -49,12 +48,6 @@
     "./client": "./client/index.js",
     "./*": "./src/*.js"
   },
-  "peerDependencies": {
-    "express": "^5.1.0",
-    "react": "18.3.1",
-    "react-query": ">=3.0.0",
-    "react-i18next": "^15.6.1"
-  },
   "dependencies": {
     "@langchain/anthropic": "^0.3.26",
     "@langchain/core": "^0.3.66",
@@ -86,6 +79,8 @@
     "node-schedule": "^2.1.1",
     "nodemailer": "^7.0.5",
     "openai": "^5.10.2",
+    "passport": "^0.7.0",
+    "passport-saml-encrypted": "^0.1.13",
     "process": "^0.11.10",
     "prop-types": "^15.8.1",
     "randomcolor": "^0.6.2",
@@ -102,6 +97,14 @@
     "vitest": "^3.2.4",
     "yaml": "^2.8.0"
   },
+  "peerDependencies": {
+    "express": "^5.1.0",
+    "passport-azure-ad": "^4.3.5",
+    "passport-google-oauth20": "^2.0.0",
+    "react": "18.3.1",
+    "react-i18next": "^15.6.1",
+    "react-query": ">=3.0.0"
+  },
   "devDependencies": {
     "@eslint/js": "^9.32.0",
     "concurrently": "^9.2.0",

package/src/gameObject.js

@@ -33,7 +33,7 @@ export const GameObject = {
     }
 }
 // Behavior.js
-class Behaviour {
+export class Behaviour {
     constructor(gameObject) {
         this.gameObject = gameObject;
         Event.Trigger("GameObject."+(this.constructor.name)+".init", "system", "calls", this);

package/src/modules/auth-google/index.js

@@ -0,0 +1,51 @@
+import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
+import { Sso, SSOUserProvider } from '../../sso.js';
+import {Logger} from "../../gameObject.js";
+
+let logger;
+
+export async function onInit(engine) {
+    logger = engine.getComponent(Logger);
+
+    // Le SSOUserProvider est nécessaire pour l'initialisation et pour la stratégie.
+    // On le crée donc en premier.
+    const ssoUserProvider = new SSOUserProvider(engine);
+
+    // 1. Récupérer le composant PassportAuth central.
+    let passportAuth = engine.getComponent(Sso);
+    if (!passportAuth) {
+        passportAuth = engine.addComponent(Sso);
+        // C'EST ICI QUE L'INITIALISATION DOIT AVOIR LIEU, UNE SEULE FOIS.
+        passportAuth.initialize({ ssoUserProvider });
+        passportAuth.addLogoutRoute();
+        logger.info("[auth-google] Sso component was not found, created and initialized a new one.");
+    }
+
+    // 2. Vérifier que les variables d'environnement nécessaires sont présentes.
+    if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
+        logger.warn("[auth-google] GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET are not set. Google SSO will be disabled.");
+        return;
+    }
+
+    // 3. Créer l'instance de la stratégie Google.
+    const googleStrategy = new GoogleStrategy({
+        clientID: process.env.GOOGLE_CLIENT_ID,
+        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+        callbackURL: "/api/auth/google/callback"
+    },
+    async (accessToken, refreshToken, profile, done) => {
+        try {
+            // On utilise le SSOUserProvider pour trouver ou créer l'utilisateur.
+            const user = await ssoUserProvider.findOrCreate(profile);
+            return done(null, user);
+        } catch (err) {
+            return done(err);
+        }
+    });
+
+    // 4. Enregistrer la stratégie auprès du composant PassportAuth.
+    passportAuth.addStrategy('google', googleStrategy,
+        { authPath: '/api/auth/google', callbackPath: '/api/auth/google/callback' },
+        { scope: ['profile', 'email'] }
+    );
+}

package/src/modules/auth-microsoft/index.js

@@ -0,0 +1,82 @@
+import { Sso, SSOUserProvider } from '../../sso.js';
+import { Logger } from "../../gameObject.js";
+
+let logger;
+
+export async function onInit(engine) {
+    logger = engine.getComponent(Logger);
+
+    try {
+        // 1. Tenter d'importer dynamiquement la stratégie Azure AD.
+        // L'utilisateur devra exécuter `npm install passport-azure-ad`.
+        const { OIDCStrategy } = await import('passport-azure-ad');
+
+        const ssoUserProvider = new SSOUserProvider(engine);
+
+        // 2. Récupérer ou créer le composant SSO central.
+        let ssoComponent = engine.getComponent(Sso);
+        if (!ssoComponent) {
+            ssoComponent = engine.addComponent(Sso);
+            ssoComponent.initialize({ ssoUserProvider });
+            ssoComponent.addLogoutRoute();
+            logger.info("[auth-microsoft] Sso component was not found, created and initialized a new one.");
+        }
+
+        // 3. Vérifier les variables d'environnement critiques pour Azure AD.
+        const { MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_TENANT_ID } = process.env;
+        if (!MICROSOFT_CLIENT_ID || !MICROSOFT_CLIENT_SECRET || !MICROSOFT_TENANT_ID) {
+            logger.warn("[auth-microsoft] Microsoft environment variables are not fully set. Microsoft SSO will be disabled.");
+            return;
+        }
+
+        const callbackUrl = process.env.MICROSOFT_CALLBACK_URL || '/api/auth/microsoft/callback';
+
+        // 4. Créer l'instance de la stratégie OIDC pour Microsoft.
+        const microsoftStrategy = new OIDCStrategy({
+            identityMetadata: `https://login.microsoftonline.com/${MICROSOFT_TENANT_ID}/v2.0/.well-known/openid-configuration`,
+            clientID: MICROSOFT_CLIENT_ID,
+            responseType: 'code id_token',
+            responseMode: 'form_post',
+            redirectUrl: callbackUrl,
+            allowHttpForRedirectUrl: process.env.NODE_ENV !== 'production',
+            clientSecret: MICROSOFT_CLIENT_SECRET,
+            validateIssuer: false, // Important pour les tenants multiples
+            passReqToCallback: false,
+            scope: ['profile', 'email', 'openid']
+        },
+        async (iss, sub, profile, accessToken, refreshToken, done) => {
+            try {
+                // Le profil Azure AD est différent. On l'adapte à notre format standard.
+                const email = profile.upn || profile._json.email;
+                if (!email) {
+                    return done(new Error("Microsoft profile is missing an email (upn)."));
+                }
+
+                const adaptedProfile = {
+                    provider: 'azuread',
+                    id: profile.oid, // Object ID de l'utilisateur dans Azure
+                    displayName: profile.displayName,
+                    emails: [{ value: email }]
+                };
+
+                const user = await ssoUserProvider.findOrCreate(adaptedProfile);
+                return done(null, user);
+            } catch (err) {
+                return done(err);
+            }
+        });
+
+        // 5. Enregistrer la stratégie auprès du composant SSO.
+        ssoComponent.addStrategy('azuread-openidconnect', microsoftStrategy, {
+            authPath: '/api/auth/microsoft',
+            callbackPath: callbackUrl
+        });
+
+    } catch (e) {
+        if (e.code === 'ERR_MODULE_NOT_FOUND') {
+            logger.info("[auth-microsoft] Module désactivé. Pour l'activer, exécutez 'npm install passport-azure-ad'");
+        } else {
+            logger.error("[auth-microsoft] Une erreur inattendue a empêché le chargement du module :", e);
+        }
+    }
+}

package/src/modules/auth-saml/index.js

@@ -0,0 +1,90 @@
+import { Sso, SSOUserProvider } from '../../sso.js';
+import { Logger } from "../../gameObject.js";
+
+let logger;
+
+export async function onInit(engine) {
+    logger = engine.getComponent(Logger);
+
+    try {
+        // 1. Tenter d'importer dynamiquement la stratégie SAML.
+        // Cela ne fonctionnera que si l'utilisateur a exécuté `npm install passport-saml-encrypted`.
+        const { Strategy: SamlStrategy } = await import('passport-saml-encrypted');
+
+        const ssoUserProvider = new SSOUserProvider(engine);
+
+        // 2. Récupérer le composant SSO central.
+        let ssoComponent = engine.getComponent(Sso);
+        if (!ssoComponent) {
+            // S'il n'existe pas, on l'ajoute. C'est le premier module SSO à se charger.
+            ssoComponent = engine.addComponent(Sso);
+            ssoComponent.initialize({ ssoUserProvider });
+            ssoComponent.addLogoutRoute();
+            logger.info("[auth-saml] Sso component was not found, created and initialized a new one.");
+        }
+
+        // 3. Vérifier les variables d'environnement critiques pour SAML.
+        const { SAML_ENTRY_POINT, SAML_ISSUER, SAML_CERT, SAML_CALLBACK_URL, SAML_DECRYPTION_KEY } = process.env;
+        if (!SAML_ENTRY_POINT || !SAML_ISSUER || !SAML_CERT || !SAML_DECRYPTION_KEY) {
+            logger.warn("[auth-saml] SAML environment variables (SAML_ENTRY_POINT, SAML_ISSUER, SAML_CERT, SAML_DECRYPTION_KEY) are not fully set. SAML SSO will be disabled.");
+            return;
+        }
+
+        const callbackUrl = SAML_CALLBACK_URL || '/api/auth/saml/callback';
+
+        // 4. Créer l'instance de la stratégie SAML.
+        // La configuration SAML est plus complexe que OAuth2.
+        const samlStrategy = new SamlStrategy(
+            {
+                path: callbackUrl, // Le chemin où l'IdP (Identity Provider) enverra la réponse POST.
+                entryPoint: SAML_ENTRY_POINT, // L'URL de connexion de l'IdP.
+                issuer: SAML_ISSUER, // L'identifiant de votre application (Service Provider).
+                cert: SAML_CERT, // Le certificat public de l'IdP pour vérifier la signature.
+                decryptionPvk: SAML_DECRYPTION_KEY, // Clé privée pour déchiffrer les assertions.
+                encryptedSAML: true, // Indique que nous attendons des assertions chiffrées.
+                acceptedClockSkewMs: -1 // Optionnel mais recommandé: pour les problèmes de synchronisation d'horloge.
+            },
+            async (profile, done) => {
+                try {
+                    // Normaliser les clés du profil en minuscules pour une correspondance insensible à la casse.
+                    const normalizedProfile = Object.keys(profile).reduce((acc, key) => {
+                        acc[key.toLowerCase()] = profile[key];
+                        return acc;
+                    }, {});
+
+                    // Le profil SAML est différent du profil Google. Nous devons l'adapter.
+                    // `nameID` est souvent l'email. Les autres attributs dépendent de la configuration de l'IdP.
+                    const email = normalizedProfile.email || normalizedProfile.nameid;
+                    if (!email) {
+                        return done(new Error("SAML profile is missing an email or nameID."));
+                    }
+
+                    const adaptedProfile = {
+                        provider: 'saml',
+                        id: normalizedProfile.nameid,
+                        displayName: normalizedProfile.displayname || normalizedProfile.cn || `${normalizedProfile.firstname || ''} ${normalizedProfile.lastname || ''}`.trim() || email,
+                        emails: [{ value: email }]
+                    };
+
+                    const user = await ssoUserProvider.findOrCreate(adaptedProfile);
+                    return done(null, user);
+                } catch (err) {
+                    return done(err);
+                }
+            }
+        );
+
+        // 5. Enregistrer la stratégie auprès du composant SSO.
+        ssoComponent.addStrategy('saml', samlStrategy, {
+            authPath: '/api/auth/saml',
+            callbackPath: callbackUrl
+        });
+
+    } catch (e) {
+        if (e.code === 'ERR_MODULE_NOT_FOUND') {
+            logger.info("[auth-saml] Module désactivé. Pour l'activer, exécutez 'npm install passport-saml-encrypted'");
+        } else {
+            logger.error("[auth-saml] Une erreur inattendue a empêché le chargement du module :", e);
+        }
+    }
+}

package/src/modules/data/data.js

@@ -4364,7 +4364,7 @@ async function manageBackupRotation(user, backupFrequency, s3Config = null) { //
  * @param {string} [lang='en'] - Language code for localized data
  * @returns {Promise<{success: boolean, summary: object, errors: Array, modifiedCount: number}>}
  */
-export async function installPack(packIdentifier, user = null, lang = 'en', isTemporary= false) {
+export async function installPack(packIdentifier, user = null, lang = 'en', options = {}) {
     let pack;
     const packsCollection = getCollection('packs');
 
@@ -4377,7 +4377,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', isTe
             p = packIdentifier;
         }
         // Existing behavior - fetch from database
-        pack = await packsCollection.findOne({ $or:[{ _id: p}, { name: packIdentifier }] });
+        pack = await packsCollection.findOne({ $and: [{ _user: {$exists: false} }, {private: false}, {$or:[{ _id: p}, { name: packIdentifier }]}]} );
         if (!pack) {
             throw new Error(`Pack with ID ${packIdentifier} not found.`);
         }
@@ -4465,7 +4465,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', isTe
     const dataToInstall = { ...pack.data?.all, ...pack.data?.[lang] };
     if (!dataToInstall || Object.keys(dataToInstall).length === 0) {
         logger.warn(`Pack '${pack.name}' has no data to install.`);
-        return { success: errors.length === 0, summary, errors, modifiedCount: 0 };
+        return { success: false, summary, errors, modifiedCount: 0 };
     }
 
     // Process link references (same as original)
@@ -4618,6 +4618,14 @@ export async function installPack(packIdentifier, user = null, lang = 'en', isTe
         }
     }
 
+    if( options.installForUser && user?.username ){
+        if( pack.name )
+            await packsCollection.deleteOne({ name: pack.name, _user: user.username });
+        logger.info(`--- Creating pack '${pack.name}' for user... ---`);
+        const packToCreate = {...pack, _id: undefined, private: true, _user: user.username };
+        await packsCollection.insertOne(packToCreate);
+    }
+
     // Trigger event only if pack came from database (original behavior)
     if (typeof packIdentifier === 'string') {
         await Event.Trigger("OnPackInstalled", "event", "system", pack);
@@ -4636,7 +4644,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', isTe
 export const installAllPacks = async () => {
     const packs = await getAllPacks();
     await packsCollection.deleteMany({ _user: { $exists : false }});
-    await packsCollection.insertMany(packs);
+    await packsCollection.insertMany(packs.map(p =>({...p, private: false })));
 }
 
 export async function handleDemoInitialization(req, res) {