sitero 0.1.6 → 0.2.0

package/dist/src/core/infrastructure/authentication/helpers/authentication-token-codec.js

@@ -0,0 +1,46 @@
+import jwt from 'jsonwebtoken';
+import { deriveAuthenticationTokenKey } from './authentication-token-key.js';
+
+function createAuthenticationTokenCodec({
+  appName,
+  secret
+}) {
+  const keyFor = (purpose) => deriveAuthenticationTokenKey({ appName, secret }, purpose);
+  const audienceFor = (purpose) => `${appName}:authentication:${purpose}`;
+  return {
+    sign: (purpose, payload, expiresIn) => {
+      const now = Math.floor(Date.now() / 1e3);
+      return jwt.sign(
+        {
+          ...payload,
+          typ: purpose,
+          iat: now,
+          exp: now + expiresIn,
+          iss: appName,
+          aud: audienceFor(purpose)
+        },
+        keyFor(purpose),
+        { algorithm: "HS256" }
+      );
+    },
+    verify: (purpose, token) => {
+      try {
+        const decoded = jwt.verify(token, keyFor(purpose), {
+          algorithms: ["HS256"],
+          issuer: appName,
+          audience: audienceFor(purpose),
+          complete: true
+        });
+        const payload = decoded.payload;
+        if (decoded.header.typ !== "JWT" || typeof payload !== "object" || payload === null || Array.isArray(payload) || payload["typ"] !== purpose || payload.iss !== appName || payload.aud !== audienceFor(purpose) || typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+          throw new TypeError("Invalid authentication token claims");
+        }
+        return payload;
+      } catch (cause) {
+        throw new TypeError("Invalid authentication token", { cause });
+      }
+    }
+  };
+}
+
+export { createAuthenticationTokenCodec };

package/dist/src/core/infrastructure/authentication/helpers/authentication-token-key.js

@@ -0,0 +1,7 @@
+import { createHmac } from 'node:crypto';
+
+function deriveAuthenticationTokenKey({ appName, secret }, purpose) {
+  return createHmac("sha256", secret).update(`sitero:${appName}:authentication:${purpose}`).digest();
+}
+
+export { deriveAuthenticationTokenKey };

package/dist/src/core/infrastructure/authentication/helpers/resolvers.js

@@ -0,0 +1,23 @@
+function resolveSecurityConfig(config) {
+  const appName = config.appName.trim();
+  if (!appName) {
+    throw new Error(
+      "Authentication security config requires a non-empty appName"
+    );
+  }
+  if (Buffer.byteLength(config.secret, "utf8") < 32) {
+    throw new Error(
+      "Authentication security config requires a secret of at least 32 UTF-8 bytes"
+    );
+  }
+  return { appName, secret: config.secret };
+}
+function resolveTtlSeconds(value, fallback, name) {
+  const ttlSeconds = value ?? fallback;
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+    throw new Error(`${name} must be a positive whole number of seconds`);
+  }
+  return ttlSeconds;
+}
+
+export { resolveSecurityConfig, resolveTtlSeconds };

package/dist/src/core/infrastructure/cache/create-redis-cache-port.js

@@ -0,0 +1,72 @@
+const SET_SCRIPT = `
+for i = 2, #KEYS do
+  local kind = redis.call('TYPE', KEYS[i]).ok
+  if kind ~= 'none' and kind ~= 'zset' then
+    return redis.error_reply('Invalid cache tag index type')
+  end
+end
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+local ttl = tonumber(ARGV[2]) * 1000
+local expires = now + ttl
+redis.call('SET', KEYS[1], ARGV[1], 'PX', ttl)
+for i = 2, #KEYS do
+  redis.call('ZREMRANGEBYSCORE', KEYS[i], '-inf', now)
+  redis.call('ZADD', KEYS[i], expires, KEYS[1])
+  local last = redis.call('ZRANGE', KEYS[i], -1, -1, 'WITHSCORES')
+  redis.call('PEXPIREAT', KEYS[i], tonumber(last[2]))
+end
+return 1
+`;
+const INVALIDATE_SCRIPT = `
+for i = 1, #KEYS do
+  local kind = redis.call('TYPE', KEYS[i]).ok
+  if kind ~= 'none' and kind ~= 'zset' then
+    return redis.error_reply('Invalid cache tag index type')
+  end
+end
+for i = 1, #KEYS do
+  local entries = redis.call('ZRANGE', KEYS[i], 0, -1)
+  for _, key in ipairs(entries) do
+    redis.call('DEL', key)
+  end
+  redis.call('DEL', KEYS[i])
+end
+return 1
+`;
+function createRedisCachePort(input) {
+  const { getClient, namespace, ttlSeconds } = input;
+  if (!namespace.trim()) throw new Error("Redis cache namespace is required");
+  if (!Number.isSafeInteger(ttlSeconds * 1e3) || ttlSeconds <= 0 || !Number.isInteger(ttlSeconds)) {
+    throw new Error("Redis cache ttlSeconds must be a positive integer");
+  }
+  const entryKey = (key) => `${namespace}:cache:${key}`;
+  const tagKey = (tag) => `${namespace}:cache-tag:${tag}`;
+  return {
+    async get(key) {
+      const client = await getClient();
+      const value = await client.get(entryKey(key));
+      return value === null ? void 0 : JSON.parse(value);
+    },
+    async set({ key, value, tags = [] }) {
+      const serialized = JSON.stringify(value);
+      if (serialized === void 0)
+        throw new Error("Cache value must be JSON serializable");
+      const client = await getClient();
+      await client.eval(SET_SCRIPT, {
+        keys: [entryKey(key), ...[...new Set(tags)].map(tagKey)],
+        arguments: [serialized, String(ttlSeconds)]
+      });
+    },
+    async invalidateTags(tags) {
+      if (!tags.length) return;
+      const client = await getClient();
+      await client.eval(INVALIDATE_SCRIPT, {
+        keys: [...new Set(tags)].map(tagKey),
+        arguments: []
+      });
+    }
+  };
+}
+
+export { createRedisCachePort };

package/dist/src/core/infrastructure/email/catalog.js

@@ -0,0 +1,59 @@
+import 'sitero-domain';
+import { EMAIL_DEFINITION_KEYS } from '../../../config/emails.js';
+
+function assertRelativeEmailAssetPath(value, label) {
+  const normalized = value;
+  const segments = normalized.split("/");
+  if (!normalized || normalized !== normalized.trim() || normalized.includes("\\") || normalized.includes(":") || normalized.startsWith("/") || segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new Error(`${label} must be a safe relative email asset path`);
+  }
+}
+function validateEmailCatalog(catalog) {
+  for (const key of Object.values(EMAIL_DEFINITION_KEYS)) {
+    if (!Object.hasOwn(catalog, key)) {
+      throw new Error(`Email definition not found: ${key}`);
+    }
+  }
+  for (const [key, definition] of Object.entries(catalog)) {
+    assertRelativeEmailAssetPath(
+      definition.presentation,
+      `Email definition ${key} presentation`
+    );
+    const fallback = definition.locales[definition.fallbackLocale];
+    if (!Object.hasOwn(definition.locales, definition.fallbackLocale) || !fallback) {
+      throw new Error(
+        `Email definition ${key} has no fallback locale variant: ${definition.fallbackLocale}`
+      );
+    }
+    for (const [locale, localized] of Object.entries(definition.locales)) {
+      if (!locale.trim()) {
+        throw new Error(`Email definition ${key} contains an empty locale`);
+      }
+      if (!localized.subject.trim()) {
+        throw new Error(
+          `Email definition ${key} has an empty subject for locale: ${locale}`
+        );
+      }
+      assertRelativeEmailAssetPath(
+        localized.contentPath,
+        `Email definition ${key} contentPath for locale ${locale}`
+      );
+    }
+  }
+}
+function resolveEmailLocaleDefinition(catalog, key, locale) {
+  const definition = catalog[key];
+  if (!Object.hasOwn(catalog, key) || !definition) {
+    throw new Error(`Email definition not found: ${key}`);
+  }
+  const resolvedLocale = locale && Object.hasOwn(definition.locales, locale) ? locale : definition.fallbackLocale;
+  const localized = definition.locales[resolvedLocale];
+  if (!Object.hasOwn(definition.locales, resolvedLocale) || !localized) {
+    throw new Error(
+      `Email definition ${key} has no fallback locale variant: ${definition.fallbackLocale}`
+    );
+  }
+  return { definition, localized, locale: resolvedLocale };
+}
+
+export { resolveEmailLocaleDefinition, validateEmailCatalog };

package/dist/src/core/infrastructure/email/delivery.js

@@ -0,0 +1,46 @@
+import nodemailer from 'nodemailer';
+
+function createTransporter({
+  host,
+  port,
+  auth,
+  from,
+  replyTo
+}) {
+  return nodemailer.createTransport(
+    { host, port, auth },
+    { from, replyTo: replyTo ?? from }
+  );
+}
+function createNodemailerEmailDeliveryPort({
+  transporter,
+  logger
+}) {
+  return {
+    async send(message) {
+      const normalizedOptions = {
+        ...message,
+        to: message.to.trim()
+      };
+      try {
+        const info = await transporter.sendMail(normalizedOptions);
+        logger.info("Email sent", {
+          to: normalizedOptions.to,
+          subject: normalizedOptions.subject,
+          messageId: info.messageId,
+          accepted: info.accepted,
+          rejected: info.rejected
+        });
+      } catch (error) {
+        logger.error("Email failed", {
+          to: normalizedOptions.to,
+          subject: normalizedOptions.subject,
+          error
+        });
+        throw error;
+      }
+    }
+  };
+}
+
+export { createNodemailerEmailDeliveryPort, createTransporter };

package/dist/src/core/infrastructure/email/filesystem-email-composer.js

@@ -0,0 +1,60 @@
+import path__default from 'node:path';
+import { validateEmailCatalog, resolveEmailLocaleDefinition } from './catalog.js';
+import { applyReplacements } from './helpers/apply-replacements.js';
+import { normalizeEmailTemplateReplacements } from './helpers/normalize-replacements.js';
+import { readTemplate } from './helpers/read-template.js';
+
+function createFilesystemEmailComposer({
+  catalog,
+  url,
+  logoUrl,
+  siteName,
+  logger
+}) {
+  const templateDir = path__default.resolve(process.cwd(), "emails");
+  validateEmailCatalog(catalog);
+  return {
+    async compose({
+      locale,
+      key,
+      replacements = {}
+    }) {
+      try {
+        const resolved = resolveEmailLocaleDefinition(catalog, key, locale);
+        const contentPath = path__default.join(
+          templateDir,
+          `${resolved.localized.contentPath}.html`
+        );
+        const layoutHtml = await readTemplate(
+          path__default.join(
+            templateDir,
+            `presentations/${resolved.definition.presentation}.html`
+          )
+        );
+        const contentHtml = await readTemplate(contentPath);
+        const merged = layoutHtml.replaceAll("{{{content}}}", contentHtml);
+        const allReplacements = {
+          WEB_URL: url,
+          LOGO_URL: logoUrl,
+          SITE_NAME: siteName[resolved.locale] ?? "",
+          ...normalizeEmailTemplateReplacements(replacements)
+        };
+        return {
+          subject: resolved.localized.subject,
+          html: applyReplacements(merged, allReplacements, logger),
+          locale: resolved.locale
+        };
+      } catch (error) {
+        logger.error({
+          msg: "Email template render failed",
+          fileKey: key,
+          templateDir,
+          error
+        });
+        throw new Error(`Email template error: ${key}`, { cause: error });
+      }
+    }
+  };
+}
+
+export { createFilesystemEmailComposer };

package/dist/src/core/infrastructure/email/helpers/normalize-replacements.js

@@ -0,0 +1,10 @@
+function normalizeEmailTemplateReplacements(replacements) {
+  return Object.fromEntries(
+    Object.entries(replacements).map(([key, value]) => [
+      key,
+      value == null ? "" : String(value)
+    ])
+  );
+}
+
+export { normalizeEmailTemplateReplacements };

package/dist/src/core/infrastructure/email/link.js

@@ -0,0 +1,15 @@
+function createUrlEmailLinkBuilderPort(input) {
+  const { url: baseUrl } = input;
+  return {
+    build({ pathname, query }) {
+      const url = new URL(pathname, baseUrl);
+      for (const [key, value] of Object.entries(query ?? {})) {
+        if (value == null) continue;
+        url.searchParams.set(key, String(value));
+      }
+      return url.toString();
+    }
+  };
+}
+
+export { createUrlEmailLinkBuilderPort };

package/dist/src/core/infrastructure/prisma/admin/admin-prisma-ports.js

@@ -0,0 +1,144 @@
+import { ADMIN_ROLES } from 'sitero-domain';
+import { connectOrDisconnectOne, connectOne } from '../helpers/relation-writes.js';
+import { createSearchWhere } from '../helpers/search-where.js';
+import { adminToSafe } from './base-mappers.js';
+import { ADMIN_LIST_CARD_INCLUDE, ADMIN_DETAIL_INCLUDE } from './include.js';
+import { adminListCardToDomain, adminDetailToDomain } from './mappers.js';
+
+const SEARCH_ROOT_FIELDS = [
+  "email"
+];
+const SEARCH_TRANSLATION_FIELDS = [
+  "name",
+  "authorName",
+  "description",
+  "jobTitle",
+  "url",
+  "worksFor",
+  "homeLocation",
+  "nationality"
+];
+const ADMIN_ORDER_BY = [
+  { updatedAt: "desc" },
+  { createdAt: "desc" },
+  { id: "asc" }
+];
+function createAdminPrismaPorts(prisma) {
+  return {
+    // ------------------------------------------------------------
+    // Command
+    // ------------------------------------------------------------
+    adminCommandPort: {
+      async create(input) {
+        const { avatarImage, translations, ...data } = input;
+        const avatarImageWrite = connectOne(avatarImage);
+        return adminToSafe(
+          await prisma.admin.create({
+            data: {
+              ...data,
+              ...avatarImageWrite ? { avatarImage: avatarImageWrite } : {},
+              translations: { create: translations }
+            }
+          })
+        );
+      },
+      async update(input) {
+        const { id, avatarImage, translations, ...data } = input;
+        return adminToSafe(
+          await prisma.admin.update({
+            where: { id },
+            data: {
+              ...data,
+              avatarImage: connectOrDisconnectOne(avatarImage),
+              translations: {
+                upsert: translations.map((translation) => ({
+                  where: {
+                    adminId_locale: { adminId: id, locale: translation.locale }
+                  },
+                  update: translation,
+                  create: translation
+                }))
+              }
+            }
+          })
+        );
+      },
+      async delete({ id }) {
+        return adminToSafe(await prisma.admin.delete({ where: { id } }));
+      }
+    },
+    // ------------------------------------------------------------
+    // Query
+    // ------------------------------------------------------------
+    adminQueryPort: {
+      async find(input) {
+        const admin = await prisma.admin.findUnique({
+          where: "id" in input ? { id: input.id } : { email: input.email }
+        });
+        return admin ? adminToSafe(admin) : null;
+      },
+      async findWithPasswordHash(input) {
+        const admin = await prisma.admin.findUnique({
+          where: "id" in input ? { id: input.id } : { email: input.email }
+        });
+        return admin ?? null;
+      },
+      async findDetail({ id }) {
+        const admin = await prisma.admin.findUnique({
+          where: { id },
+          include: ADMIN_DETAIL_INCLUDE
+        });
+        return admin ? adminDetailToDomain(admin) : null;
+      },
+      async findListCards(input) {
+        const where = {
+          ...createSearchWhere({
+            searchString: input.searchString,
+            rootFields: SEARCH_ROOT_FIELDS,
+            translation: {
+              locale: input.locale,
+              fields: SEARCH_TRANSLATION_FIELDS
+            }
+          }),
+          ...input.currentRole === ADMIN_ROLES.SUPER_ADMIN ? {} : { role: { not: ADMIN_ROLES.SUPER_ADMIN } },
+          ...input.adminIds ? { id: { in: input.adminIds } } : {}
+        };
+        const pagination = input.page && input.pageSize ? { skip: (input.page - 1) * input.pageSize, take: input.pageSize } : {};
+        const { items, total } = await prisma.$transaction(
+          async (transaction) => {
+            const [items2, total2] = await Promise.all([
+              transaction.admin.findMany({
+                where,
+                include: ADMIN_LIST_CARD_INCLUDE,
+                orderBy: ADMIN_ORDER_BY,
+                ...pagination
+              }),
+              transaction.admin.count({ where })
+            ]);
+            return { items: items2, total: total2 };
+          }
+        );
+        return { items: items.map(adminListCardToDomain), total };
+      }
+    },
+    // ------------------------------------------------------------
+    // Extra
+    // ------------------------------------------------------------
+    adminInquiryNotificationRecipientQueryPort: {
+      async findInquiryNotificationRecipients() {
+        return prisma.admin.findMany({
+          where: {
+            emailVerifiedAt: { not: null },
+            receivesInquiryNotifications: true
+          },
+          select: {
+            email: true,
+            preferredLocale: true
+          }
+        });
+      }
+    }
+  };
+}
+
+export { createAdminPrismaPorts };

package/dist/src/core/infrastructure/prisma/admin/base-mappers.js

@@ -0,0 +1,6 @@
+function adminToSafe(admin) {
+  const { passwordHash: _, ...safeAdmin } = admin;
+  return safeAdmin;
+}
+
+export { adminToSafe };

package/dist/src/core/infrastructure/prisma/admin/include.js

@@ -0,0 +1,9 @@
+const ADMIN_DETAIL_INCLUDE = {
+  translations: true,
+  avatarImage: { include: { translations: true } }
+};
+const ADMIN_LIST_CARD_INCLUDE = {
+  ...ADMIN_DETAIL_INCLUDE
+};
+
+export { ADMIN_DETAIL_INCLUDE, ADMIN_LIST_CARD_INCLUDE };

package/dist/src/core/infrastructure/prisma/admin/mappers.js

@@ -0,0 +1,15 @@
+import { fileToCard } from '../file/base-mappers.js';
+import { adminToSafe } from './base-mappers.js';
+
+function adminDetailToDomain(admin) {
+  return {
+    ...adminToSafe(admin),
+    translations: admin.translations,
+    avatarImage: admin.avatarImage ? fileToCard(admin.avatarImage) : null
+  };
+}
+function adminListCardToDomain(admin) {
+  return adminDetailToDomain(admin);
+}
+
+export { adminDetailToDomain, adminListCardToDomain };

package/dist/src/core/infrastructure/prisma/admin-refresh-token/admin-refresh-token-prisma-ports.js

@@ -0,0 +1,61 @@
+import '../../../../../prisma/generated/client.js';
+import { adminRefreshTokenToDomain } from './mappers.js';
+import { JsonNull } from '../../../../../prisma/generated/internal/prismaNamespace.js';
+
+function createAdminRefreshTokenPrismaPorts(prisma) {
+  return {
+    // ------------------------------------------------------------
+    // Command
+    // ------------------------------------------------------------
+    adminRefreshTokenCommandPort: {
+      async create(input) {
+        return adminRefreshTokenToDomain(
+          await prisma.adminRefreshToken.create({
+            data: {
+              ...input,
+              deviceInfo: input.deviceInfo === null ? JsonNull : input.deviceInfo
+            }
+          })
+        );
+      },
+      async delete({ id }) {
+        await prisma.adminRefreshToken.delete({ where: { id } });
+      },
+      async deleteMany({ adminId, excludeTokenHash }) {
+        const { count } = await prisma.adminRefreshToken.deleteMany({
+          where: {
+            adminId,
+            ...excludeTokenHash ? { tokenHash: { not: excludeTokenHash } } : {}
+          }
+        });
+        return count;
+      },
+      async deleteManyExpired() {
+        const { count } = await prisma.adminRefreshToken.deleteMany({
+          where: { expiresAt: { lt: /* @__PURE__ */ new Date() } }
+        });
+        return count;
+      }
+    },
+    // ------------------------------------------------------------
+    // Query
+    // ------------------------------------------------------------
+    adminRefreshTokenQueryPort: {
+      async find(input) {
+        const refreshToken = await prisma.adminRefreshToken.findUnique({
+          where: "id" in input ? { id: input.id } : { tokenHash: input.tokenHash }
+        });
+        return refreshToken ? adminRefreshTokenToDomain(refreshToken) : null;
+      },
+      async findMany({ adminId }) {
+        const refreshTokens = await prisma.adminRefreshToken.findMany({
+          where: { adminId },
+          orderBy: [{ createdAt: "desc" }, { id: "asc" }]
+        });
+        return refreshTokens.map(adminRefreshTokenToDomain);
+      }
+    }
+  };
+}
+
+export { createAdminRefreshTokenPrismaPorts };

package/dist/src/core/infrastructure/prisma/admin-refresh-token/mappers.js

@@ -0,0 +1,8 @@
+function adminRefreshTokenToDomain(refreshToken) {
+  return {
+    ...refreshToken,
+    deviceInfo: refreshToken.deviceInfo
+  };
+}
+
+export { adminRefreshTokenToDomain };

package/dist/src/core/infrastructure/prisma/authentication/admin/admin-authentication-prisma-port.js

@@ -0,0 +1,22 @@
+import { adminToSafe } from '../../admin/base-mappers.js';
+
+function createAdminAuthenticationPrismaPort(prisma) {
+  return {
+    async markEmailVerified({ adminId }) {
+      return adminToSafe(
+        await prisma.admin.update({
+          where: { id: adminId },
+          data: { emailVerifiedAt: /* @__PURE__ */ new Date() }
+        })
+      );
+    },
+    async updatePasswordHash({ adminId, passwordHash }) {
+      await prisma.admin.update({
+        where: { id: adminId },
+        data: { passwordHash }
+      });
+    }
+  };
+}
+
+export { createAdminAuthenticationPrismaPort };