mirror of
https://github.com/hcengineering/platform.git
synced 2026-09-26 11:34:58 +02:00
2029 lines
63 KiB
TypeScript
2029 lines
63 KiB
TypeScript
//
|
|
// Copyright © 2024 Hardcore Engineering Inc.
|
|
//
|
|
// Licensed under the Eclipse Public License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License. You may
|
|
// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
//
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//
|
|
import {
|
|
AccountRole,
|
|
type AccountUuid,
|
|
type Branding,
|
|
concatLink,
|
|
generateId,
|
|
groupByArray,
|
|
isActiveMode,
|
|
type MeasureContext,
|
|
type Person,
|
|
type PersonId,
|
|
type PersonUuid,
|
|
readOnlyGuestAccountUuid,
|
|
roleOrder,
|
|
SocialIdType,
|
|
type SocialKey,
|
|
systemAccountUuid,
|
|
type WorkspaceDataId,
|
|
type WorkspaceInfoWithStatus as WorkspaceInfoWithStatusCore,
|
|
type WorkspaceMode,
|
|
type WorkspaceUuid
|
|
} from '@hcengineering/core'
|
|
import { getMongoClient } from '@hcengineering/mongo' // TODO: get rid of this import later
|
|
import platform, { getMetadata, PlatformError, Severity, Status, translate } from '@hcengineering/platform'
|
|
import { getDBClient, setDBExtraOptions } from '@hcengineering/postgres'
|
|
import { pbkdf2Sync, randomBytes } from 'crypto'
|
|
import otpGenerator from 'otp-generator'
|
|
|
|
import { Analytics } from '@hcengineering/analytics'
|
|
import { decodeTokenVerbose, generateToken, type PermissionsGrant, TokenError } from '@hcengineering/server-token'
|
|
import { MongoAccountDB } from './collections/mongo'
|
|
import { PostgresAccountDB } from './collections/postgres/postgres'
|
|
import { accountPlugin } from './plugin'
|
|
import {
|
|
type Account,
|
|
type AccountDB,
|
|
type AccountEvent,
|
|
AccountEventType,
|
|
type AccountMethodHandler,
|
|
type Integration,
|
|
type LoginInfo,
|
|
type LoginInfoRequestData,
|
|
type Meta,
|
|
type Operations,
|
|
type OtpInfo,
|
|
type RegionInfo,
|
|
type SocialId,
|
|
type Workspace,
|
|
type WorkspaceInfoWithStatus,
|
|
type WorkspaceInvite,
|
|
type WorkspaceJoinInfo,
|
|
type WorkspaceLoginInfo,
|
|
type WorkspaceStatus
|
|
} from './types'
|
|
import { isAdminEmail } from './admin'
|
|
|
|
export const GUEST_ACCOUNT = 'b6996120-416f-49cd-841e-e4a5d2e49c9b' as PersonUuid
|
|
|
|
export async function getAccountDB (
|
|
uri: string,
|
|
dbNs?: string,
|
|
appName: string = 'account'
|
|
): Promise<[AccountDB, () => void]> {
|
|
const isMongo = uri.startsWith('mongodb://')
|
|
|
|
if (isMongo) {
|
|
const client = getMongoClient(uri)
|
|
const db = (await client.getClient()).db(dbNs ?? 'global-account')
|
|
const mongoAccount = new MongoAccountDB(db)
|
|
|
|
await mongoAccount.init()
|
|
|
|
return [
|
|
mongoAccount,
|
|
() => {
|
|
client.close()
|
|
}
|
|
]
|
|
} else {
|
|
setDBExtraOptions({
|
|
connection: {
|
|
application_name: appName
|
|
}
|
|
})
|
|
const client = getDBClient(uri)
|
|
const pgClient = await client.getClient()
|
|
const pgAccount = new PostgresAccountDB(pgClient, dbNs ?? 'global_account')
|
|
|
|
let error = false
|
|
|
|
do {
|
|
try {
|
|
await pgAccount.init()
|
|
error = false
|
|
} catch (e) {
|
|
console.error('Error while initializing postgres account db', e)
|
|
error = true
|
|
await new Promise((resolve) => setTimeout(resolve, 1000))
|
|
}
|
|
} while (error)
|
|
|
|
return [
|
|
pgAccount,
|
|
() => {
|
|
client.close()
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
export const assignableRoles = [AccountRole.Guest, AccountRole.User, AccountRole.Maintainer, AccountRole.Owner]
|
|
|
|
export function getRolePower (role: AccountRole): number {
|
|
return roleOrder[role]
|
|
}
|
|
|
|
export function isReadOnlyOrGuest (account: AccountUuid, extra: Record<string, any> | undefined): boolean {
|
|
return isGuest(account, extra) || extra?.readonly === 'true'
|
|
}
|
|
|
|
export function isGuest (account: AccountUuid, extra: Record<string, any> | undefined): boolean {
|
|
return account === GUEST_ACCOUNT && extra?.guest === 'true'
|
|
}
|
|
|
|
export function wrap (
|
|
accountMethod: (ctx: MeasureContext, db: AccountDB, branding: Branding | null, ...args: any[]) => Promise<any>
|
|
): AccountMethodHandler {
|
|
return async function (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
request: any,
|
|
token?: string,
|
|
meta?: Meta
|
|
): Promise<any> {
|
|
return await accountMethod(ctx, db, branding, token, { ...request.params }, meta)
|
|
.then((result) => ({ id: request.id, result }))
|
|
.catch((err: Error) => {
|
|
const status =
|
|
err instanceof PlatformError
|
|
? err.status
|
|
: new Status(Severity.ERROR, platform.status.InternalServerError, {})
|
|
|
|
if (err instanceof TokenError) {
|
|
// Let's send un authorized
|
|
return {
|
|
error: new Status(Severity.ERROR, platform.status.Unauthorized, {})
|
|
}
|
|
}
|
|
|
|
if (status.code === platform.status.InternalServerError) {
|
|
Analytics.handleError(err)
|
|
ctx.error('Error while processing account method', {
|
|
method: accountMethod.name,
|
|
status,
|
|
origErr: err
|
|
})
|
|
} else {
|
|
ctx.error('Error while processing account method', { method: accountMethod.name, status })
|
|
}
|
|
|
|
return {
|
|
error: status
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns a hash code for a string.
|
|
* (Compatible to Java's String.hashCode())
|
|
*
|
|
* The hash code for a string object is computed as
|
|
* s[0]*31^(n-1) + s[1]*31^(n-2) + ... + s[n-1]
|
|
* using number arithmetic, where s[i] is the i th character
|
|
* of the given string, n is the length of the string,
|
|
* and ^ indicates exponentiation.
|
|
* (The hash value of the empty string is zero.)
|
|
*
|
|
*/
|
|
function hashWorkspace (dbWorkspaceName: string): number {
|
|
return [...dbWorkspaceName].reduce((hash, c) => (Math.imul(31, hash) + c.charCodeAt(0)) | 0, 0)
|
|
}
|
|
|
|
export enum EndpointKind {
|
|
Internal,
|
|
External
|
|
}
|
|
|
|
const toTransactor = (line: string): EndpointInfo => {
|
|
const [internalUrl, externalUrl, region] = line
|
|
.split(';')
|
|
.map((it) => it.trim())
|
|
.map((it) => (it.length === 0 ? undefined : it))
|
|
return { internalUrl: internalUrl ?? '', region: region ?? '', externalUrl: externalUrl ?? internalUrl ?? '' }
|
|
}
|
|
|
|
/**
|
|
* Internal. Exported for testing only.
|
|
* @returns list of endpoints
|
|
*/
|
|
export const getEndpoints = (): string[] => {
|
|
const transactorsUrl = getMetadata(accountPlugin.metadata.Transactors)
|
|
if (transactorsUrl === undefined) {
|
|
throw new Error('Please provide transactor endpoint url')
|
|
}
|
|
const endpoints = transactorsUrl
|
|
.split(',')
|
|
.map((it) => it.trim())
|
|
.filter((it) => it.length > 0)
|
|
|
|
if (endpoints.length === 0) {
|
|
throw new Error('Please provide transactor endpoint url')
|
|
}
|
|
return endpoints
|
|
}
|
|
|
|
// Info is static, so no need to calculate it every time.
|
|
let regionInfo: RegionInfo[] = []
|
|
|
|
export const getRegions = (): RegionInfo[] => {
|
|
if (regionInfo.length === 0) {
|
|
regionInfo = _getRegions()
|
|
}
|
|
return regionInfo
|
|
}
|
|
|
|
/**
|
|
* Internal. Exported for tests only.
|
|
* @returns list of endpoints
|
|
*/
|
|
export const _getRegions = (): RegionInfo[] => {
|
|
let _regionInfo: RegionInfo[] = []
|
|
const endpoints = getEndpoints()
|
|
.map(toTransactor)
|
|
.map((it) => ({ region: it.region.trim(), name: '' }))
|
|
if (process.env.REGION_INFO !== undefined) {
|
|
_regionInfo = process.env.REGION_INFO.split(';')
|
|
.map((it) => it.split('|'))
|
|
.map((it) => ({ region: it[0].trim(), name: it[1].trim() }))
|
|
// We need to add all endpoints if they are not in info.
|
|
for (const endpoint of endpoints) {
|
|
if (_regionInfo.find((it) => it.region === endpoint.region) === undefined) {
|
|
_regionInfo.push(endpoint)
|
|
}
|
|
}
|
|
} else {
|
|
_regionInfo = endpoints
|
|
}
|
|
|
|
return _regionInfo
|
|
}
|
|
|
|
export interface EndpointInfo {
|
|
internalUrl: string
|
|
externalUrl: string
|
|
region: string
|
|
}
|
|
|
|
export function getEndpointInfo (): Map<string, EndpointInfo[]> {
|
|
return groupByArray(getEndpoints().map(toTransactor), (it) => it.region)
|
|
}
|
|
|
|
export const selectKind = (kind: EndpointKind, it: EndpointInfo): string => {
|
|
return kind === EndpointKind.Internal ? it.internalUrl : it.externalUrl
|
|
}
|
|
|
|
export const getEndpoint = (workspace: WorkspaceUuid, region: string | undefined, kind: EndpointKind): string => {
|
|
const hash = hashWorkspace(workspace)
|
|
const _endpointInfo = getEndpointInfo()
|
|
|
|
let transactors = _endpointInfo.get(region ?? '') ?? []
|
|
|
|
if (transactors.length === 0) {
|
|
console.warn('No transactors for the target region, will use default region', { group: region })
|
|
transactors = _endpointInfo.get('') ?? []
|
|
}
|
|
|
|
if (transactors.length === 0) {
|
|
throw new Error('Please provide transactor endpoint url')
|
|
}
|
|
|
|
return selectKind(kind, transactors[Math.abs(hash % transactors.length)])
|
|
}
|
|
|
|
export const getWorkspaceEndpoint = (
|
|
info: Map<string, EndpointInfo[]>,
|
|
workspace: WorkspaceUuid,
|
|
region: string | undefined
|
|
): EndpointInfo => {
|
|
const hash = hashWorkspace(workspace)
|
|
const byRegion = info.get(region ?? '') ?? []
|
|
return byRegion[Math.abs(hash % byRegion.length)]
|
|
}
|
|
|
|
export function getAllTransactors (kind: EndpointKind): string[] {
|
|
const transactorsUrl = getMetadata(accountPlugin.metadata.Transactors)
|
|
if (transactorsUrl === undefined) {
|
|
throw new Error('Please provide transactor endpoint url')
|
|
}
|
|
const endpoints = transactorsUrl
|
|
.split(',')
|
|
.map((it) => it.trim())
|
|
.filter((it) => it.length > 0)
|
|
|
|
if (endpoints.length === 0) {
|
|
throw new Error('Please provide transactor endpoint url')
|
|
}
|
|
|
|
const toTransactor = (line: string): { internalUrl: string, group: string, externalUrl: string } => {
|
|
const [internalUrl, externalUrl, group] = line.split(';')
|
|
return { internalUrl, group: group ?? '', externalUrl: externalUrl ?? internalUrl }
|
|
}
|
|
|
|
return endpoints.map(toTransactor).map((it) => (kind === EndpointKind.External ? it.externalUrl : it.internalUrl))
|
|
}
|
|
|
|
export function hashWithSalt (password: string, salt: Buffer): Buffer {
|
|
// remove "as any" when types in node will be fixed
|
|
return pbkdf2Sync(password, salt as any, 1000, 32, 'sha256')
|
|
}
|
|
|
|
export function verifyPassword (password: string, hash?: Buffer | null, salt?: Buffer | null): boolean {
|
|
if (hash == null || salt == null) {
|
|
return false
|
|
}
|
|
|
|
// remove "as any" when types in node will be fixed
|
|
return Buffer.compare(hash as any, hashWithSalt(password, salt) as any) === 0
|
|
}
|
|
|
|
// 0 or negative value means no limit
|
|
const maxFailedLoginAttempts =
|
|
process.env.MAX_FAILED_LOGIN_ATTEMPTS != null ? parseInt(process.env.MAX_FAILED_LOGIN_ATTEMPTS) : 5
|
|
|
|
/**
|
|
* Check if an account is locked due to too many failed login attempts.
|
|
* An account is locked if failedLoginAttempts >= maxFailedLoginAttempts.
|
|
* @param account The account to check
|
|
* @returns true if account is locked, false otherwise
|
|
*/
|
|
export function isAccountPasswordLocked (account: Account): boolean {
|
|
if (maxFailedLoginAttempts <= 0) {
|
|
return false
|
|
}
|
|
|
|
const failedAttempts = account.failedLoginAttempts ?? 0
|
|
|
|
return failedAttempts >= maxFailedLoginAttempts
|
|
}
|
|
|
|
/**
|
|
* Record a failed login attempt for an account.
|
|
* Increments the failed attempts counter.
|
|
* @param db Database instance
|
|
* @param accountUuid Account UUID
|
|
*/
|
|
export async function recordFailedLoginAttempt (db: AccountDB, accountUuid: AccountUuid): Promise<void> {
|
|
const account = await db.account.findOne({ uuid: accountUuid })
|
|
if (account == null) {
|
|
return
|
|
}
|
|
|
|
const currentAttempts = account.failedLoginAttempts ?? 0
|
|
const newAttempts = currentAttempts + 1
|
|
|
|
await db.account.update(
|
|
{ uuid: accountUuid },
|
|
{
|
|
failedLoginAttempts: newAttempts
|
|
}
|
|
)
|
|
}
|
|
|
|
/**
|
|
* Reset failed login attempts for an account.
|
|
* Called when:
|
|
* - User successfully logs in with password
|
|
* - User successfully authenticates via OTP or other alternative method
|
|
* @param db Database instance
|
|
* @param accountUuid Account UUID
|
|
*/
|
|
export async function resetFailedLoginAttempts (db: AccountDB, accountUuid: AccountUuid): Promise<void> {
|
|
await db.account.update(
|
|
{ uuid: accountUuid },
|
|
{
|
|
failedLoginAttempts: 0
|
|
}
|
|
)
|
|
}
|
|
|
|
export function cleanEmail (email: string): string {
|
|
return email.toLowerCase().trim()
|
|
}
|
|
|
|
export function normalizeValue (value: string): string {
|
|
return value.toLowerCase().trim()
|
|
}
|
|
|
|
export function isEmail (email: string): boolean {
|
|
// RFC 5322 compliant email regex
|
|
const EMAIL_REGEX =
|
|
/^[a-zA-Z0-9](?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-](?:\.?[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-])*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])$/ // eslint-disable-line no-control-regex
|
|
return EMAIL_REGEX.test(email)
|
|
}
|
|
|
|
export function isShallowEqual (obj1: Record<string, any>, obj2: Record<string, any>): boolean {
|
|
const keys1 = Object.keys(obj1)
|
|
const keys2 = Object.keys(obj2)
|
|
|
|
return keys1.length === keys2.length && keys1.every((k) => obj1[k] === obj2[k])
|
|
}
|
|
|
|
export async function setPassword (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
accountUuid: AccountUuid,
|
|
password: string
|
|
): Promise<void> {
|
|
if (password == null || password === '') {
|
|
return
|
|
}
|
|
|
|
const salt = randomBytes(32)
|
|
await db.setPassword(accountUuid, hashWithSalt(password, salt), salt)
|
|
|
|
// Record password change event
|
|
try {
|
|
await db.accountEvent.insertOne({
|
|
accountUuid,
|
|
eventType: AccountEventType.PASSWORD_CHANGED,
|
|
time: Date.now()
|
|
})
|
|
} catch (err) {
|
|
ctx.warn('Failed to record password change event', { accountUuid, err })
|
|
}
|
|
}
|
|
|
|
export async function getLastPasswordChangeEvent (
|
|
db: AccountDB,
|
|
accountUuid: AccountUuid
|
|
): Promise<AccountEvent | null> {
|
|
const result = await db.accountEvent.find(
|
|
{ accountUuid, eventType: AccountEventType.PASSWORD_CHANGED },
|
|
{ time: 'descending' },
|
|
1
|
|
)
|
|
return result[0] ?? null
|
|
}
|
|
|
|
export async function isPasswordChangedSince (db: AccountDB, accountUuid: AccountUuid, since: number): Promise<boolean> {
|
|
const lastEvent = await getLastPasswordChangeEvent(db, accountUuid)
|
|
return lastEvent != null && lastEvent.time >= since
|
|
}
|
|
|
|
export async function generateUniqueOtp (db: AccountDB): Promise<string> {
|
|
let exists = true
|
|
let code = ''
|
|
|
|
do {
|
|
code = otpGenerator.generate(6, {
|
|
upperCaseAlphabets: false,
|
|
lowerCaseAlphabets: false,
|
|
specialChars: false
|
|
})
|
|
|
|
exists = (await db.otp.findOne({ code })) != null
|
|
} while (exists)
|
|
|
|
return code
|
|
}
|
|
|
|
export async function sendOtp (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
socialId: SocialId
|
|
): Promise<OtpInfo> {
|
|
const ts = Date.now()
|
|
const otpData = (await db.otp.find({ socialId: socialId._id }, { createdOn: 'descending' }, 1))[0]
|
|
const retryDelay = getMetadata(accountPlugin.metadata.OtpRetryDelaySec) ?? 30
|
|
|
|
if (otpData !== undefined && otpData.expiresOn > ts && otpData.createdOn + retryDelay * 1000 > ts) {
|
|
return { sent: true, retryOn: otpData.createdOn + retryDelay * 1000 }
|
|
}
|
|
|
|
let sendMethod: (ctx: MeasureContext, branding: Branding | null, code: string, target: string) => Promise<void>
|
|
|
|
switch (socialId.type) {
|
|
case SocialIdType.EMAIL: {
|
|
sendMethod = sendOtpEmail
|
|
break
|
|
}
|
|
default:
|
|
throw new Error('Unsupported OTP social id type')
|
|
}
|
|
|
|
const retryDelayMs = (getMetadata(accountPlugin.metadata.OtpRetryDelaySec) ?? 30) * 1000
|
|
const ttlMs = (getMetadata(accountPlugin.metadata.OtpTimeToLiveSec) ?? 60) * 1000
|
|
const code = await generateUniqueOtp(db)
|
|
|
|
await sendMethod(ctx, branding, code, socialId.value)
|
|
await db.otp.insertOne({ socialId: socialId._id, code, expiresOn: ts + ttlMs, createdOn: ts })
|
|
|
|
return { sent: true, retryOn: ts + retryDelayMs }
|
|
}
|
|
|
|
export async function sendOtpEmail (
|
|
ctx: MeasureContext,
|
|
branding: Branding | null,
|
|
otp: string,
|
|
email: string
|
|
): Promise<void> {
|
|
const mailURL = getMetadata(accountPlugin.metadata.MAIL_URL)
|
|
if (mailURL === undefined || mailURL === '') {
|
|
ctx.error('Please provide email service url to enable email otp')
|
|
return
|
|
}
|
|
const mailAuth = getMetadata(accountPlugin.metadata.MAIL_AUTH_TOKEN)
|
|
|
|
const lang = branding?.language
|
|
const app = branding?.title ?? getMetadata(accountPlugin.metadata.ProductName)
|
|
|
|
const text = await translate(accountPlugin.string.OtpText, { code: otp, app }, lang)
|
|
const html = await translate(accountPlugin.string.OtpHTML, { code: otp, app }, lang)
|
|
const subject = await translate(accountPlugin.string.OtpSubject, { code: otp, app }, lang)
|
|
|
|
const to = email
|
|
const response = await fetch(concatLink(mailURL, '/send'), {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
...(mailAuth != null ? { Authorization: `Bearer ${mailAuth}` } : {})
|
|
},
|
|
body: JSON.stringify({
|
|
text,
|
|
html,
|
|
subject,
|
|
to
|
|
})
|
|
})
|
|
if (!response.ok) {
|
|
ctx.error(`Failed to send otp email: ${response.statusText}`, { to })
|
|
}
|
|
}
|
|
|
|
export async function isOtpValid (db: AccountDB, socialId: PersonId, code: string): Promise<boolean> {
|
|
const otpData = await db.otp.findOne({ socialId, code })
|
|
|
|
return (otpData?.expiresOn ?? 0) > Date.now()
|
|
}
|
|
|
|
/**
|
|
* Creates an account and a Huly social id for the specified person.
|
|
* Returns the _id of the newly created Huly social id.
|
|
*/
|
|
export async function createAccount (
|
|
db: AccountDB,
|
|
personUuid: PersonUuid,
|
|
confirmed = false,
|
|
automatic = false,
|
|
createdOn = Date.now()
|
|
): Promise<PersonId> {
|
|
// Create Huly social id and account
|
|
const socialId = await db.socialId.insertOne({
|
|
type: SocialIdType.HULY,
|
|
value: personUuid,
|
|
personUuid,
|
|
...(confirmed ? { verifiedOn: Date.now() } : {})
|
|
})
|
|
await db.account.insertOne({ uuid: personUuid as AccountUuid, automatic })
|
|
await db.accountEvent.insertOne({
|
|
accountUuid: personUuid as AccountUuid,
|
|
eventType: AccountEventType.ACCOUNT_CREATED,
|
|
time: createdOn
|
|
})
|
|
|
|
// Create user profile with default values (private by default)
|
|
await db.userProfile.insertOne({
|
|
personUuid,
|
|
isPublic: false
|
|
})
|
|
|
|
return socialId
|
|
}
|
|
|
|
export async function signUpByEmail (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
email: string,
|
|
password: string | null,
|
|
firstName: string,
|
|
lastName: string,
|
|
confirmed = false,
|
|
automatic = false
|
|
): Promise<{ account: AccountUuid, socialId: PersonId }> {
|
|
const normalizedEmail = cleanEmail(email)
|
|
|
|
const emailSocialId = await getEmailSocialId(db, normalizedEmail)
|
|
let account: AccountUuid
|
|
let socialId: PersonId
|
|
|
|
if (emailSocialId !== null) {
|
|
const existingAccount = await db.account.findOne({ uuid: emailSocialId.personUuid as AccountUuid })
|
|
|
|
if (existingAccount !== null) {
|
|
ctx.error('An account with the provided email already exists', { email })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountAlreadyExists, {}))
|
|
}
|
|
|
|
account = emailSocialId.personUuid as AccountUuid
|
|
socialId = emailSocialId._id
|
|
// Person exists, but may have different name, need to update with what's been provided
|
|
await db.person.update({ uuid: account }, { firstName, lastName })
|
|
} else {
|
|
// There's no person we can link to this email, so we need to create a new one
|
|
account = await db.person.insertOne({ firstName, lastName })
|
|
socialId = await db.socialId.insertOne({
|
|
type: SocialIdType.EMAIL,
|
|
value: normalizedEmail,
|
|
personUuid: account,
|
|
...(confirmed ? { verifiedOn: Date.now() } : {})
|
|
})
|
|
}
|
|
|
|
await createAccount(db, account, confirmed, automatic)
|
|
if (password != null) {
|
|
await setPassword(ctx, db, branding, account, password)
|
|
}
|
|
|
|
return { account, socialId }
|
|
}
|
|
|
|
export async function signUpByGrant (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
accountUuid: AccountUuid,
|
|
grant: PermissionsGrant,
|
|
info?: LoginInfoRequestData
|
|
): Promise<{ account: AccountUuid, socialId: PersonId }> {
|
|
const firstName = grant.firstName ?? info?.firstName
|
|
const lastName = grant.lastName ?? info?.lastName
|
|
|
|
if (firstName == null || firstName === '') {
|
|
ctx.error('First name is required for grant sign up', { grant, info })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
|
|
}
|
|
|
|
const existingAccount = await db.account.findOne({ uuid: accountUuid })
|
|
|
|
if (existingAccount != null) {
|
|
ctx.error('An account with the provided uuid already exists', { accountUuid })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountAlreadyExists, {}))
|
|
}
|
|
|
|
const existingPerson = await db.person.findOne({ uuid: accountUuid })
|
|
|
|
if (existingPerson == null) {
|
|
await db.person.insertOne({ uuid: accountUuid, firstName, lastName: lastName ?? '' })
|
|
}
|
|
|
|
// If there's no account there should be no Huly social id associated with the person if it existed
|
|
// also, there should be no confirmed social ids associated
|
|
// so we can safely proceed to account creation
|
|
|
|
const socialId = await createAccount(db, accountUuid, true, true)
|
|
|
|
return { account: accountUuid, socialId }
|
|
}
|
|
|
|
export async function selectWorkspace (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
token: string | undefined,
|
|
params: {
|
|
workspaceUrl: string
|
|
kind: 'external' | 'internal' | 'byregion'
|
|
externalRegions?: string[]
|
|
},
|
|
meta?: Meta
|
|
): Promise<WorkspaceLoginInfo> {
|
|
const { workspaceUrl, kind, externalRegions = [] } = params
|
|
|
|
let workspace: Workspace | null = null
|
|
if (workspaceUrl !== '') {
|
|
workspace = await getWorkspaceByUrl(db, workspaceUrl)
|
|
}
|
|
|
|
let accountUuid: AccountUuid
|
|
let extra: Record<string, any> | undefined
|
|
let grant: PermissionsGrant | undefined
|
|
let sub: AccountUuid | undefined
|
|
let exp: number | undefined
|
|
let nbf: number | undefined
|
|
try {
|
|
const decodedToken = decodeTokenVerbose(ctx, token ?? '')
|
|
accountUuid = decodedToken.account
|
|
if (workspace == null) {
|
|
workspace = await getWorkspaceById(db, decodedToken.workspace)
|
|
}
|
|
extra = decodedToken.extra
|
|
grant = decodedToken.grant
|
|
sub = decodedToken.sub
|
|
exp = decodedToken.exp
|
|
nbf = decodedToken.nbf
|
|
} catch (e) {
|
|
if (workspace?.allowReadOnlyGuest === true) {
|
|
accountUuid = readOnlyGuestAccountUuid
|
|
} else {
|
|
throw e
|
|
}
|
|
}
|
|
|
|
if (workspace == null) {
|
|
ctx.error('Workspace not found in selectWorkspace', { workspaceUrl, kind, accountUuid, extra })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
|
|
}
|
|
|
|
const getKind = (region: string | undefined): EndpointKind => {
|
|
switch (kind) {
|
|
case 'external':
|
|
return EndpointKind.External
|
|
case 'internal':
|
|
return EndpointKind.Internal
|
|
case 'byregion':
|
|
return externalRegions.includes(region ?? '') ? EndpointKind.External : EndpointKind.Internal
|
|
default:
|
|
return meta?.clientNetworkPosition === 'internal' ? EndpointKind.Internal : EndpointKind.External
|
|
}
|
|
}
|
|
|
|
if (isGuest(accountUuid, extra)) {
|
|
const workspace = await getWorkspaceByUrl(db, workspaceUrl)
|
|
if (workspace == null) {
|
|
ctx.error('Workspace not found in selectWorkspace', { workspaceUrl, kind, accountUuid, extra })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
|
|
}
|
|
|
|
// Guest mode select workspace
|
|
return {
|
|
account: accountUuid,
|
|
endpoint: getEndpoint(workspace.uuid, workspace.region, getKind(workspace.region)),
|
|
token,
|
|
workspace: workspace.uuid,
|
|
workspaceUrl: workspace.url,
|
|
workspaceDataId: workspace.dataId,
|
|
role: AccountRole.DocGuest
|
|
}
|
|
}
|
|
|
|
if (accountUuid === systemAccountUuid) {
|
|
return {
|
|
account: accountUuid,
|
|
token: generateToken(accountUuid, workspace.uuid, extra, undefined, {
|
|
grant,
|
|
sub,
|
|
exp,
|
|
nbf
|
|
}),
|
|
endpoint: getEndpoint(workspace.uuid, workspace.region, getKind(workspace.region)),
|
|
workspace: workspace.uuid,
|
|
workspaceUrl: workspace.url,
|
|
role: AccountRole.Admin
|
|
}
|
|
}
|
|
|
|
let role = await db.getWorkspaceRole(accountUuid, workspace.uuid)
|
|
if (role == null && extra?.admin === 'true') {
|
|
role = AccountRole.Admin
|
|
}
|
|
let account = await db.account.findOne({ uuid: accountUuid })
|
|
|
|
if ((role == null || account == null) && workspace.allowReadOnlyGuest) {
|
|
accountUuid = readOnlyGuestAccountUuid
|
|
role = await db.getWorkspaceRole(accountUuid, workspace.uuid)
|
|
account = await db.account.findOne({ uuid: accountUuid })
|
|
}
|
|
|
|
if (role == null) {
|
|
ctx.error('Not a member of the workspace being selected', { workspaceUrl, accountUuid })
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
if (accountUuid !== systemAccountUuid && account == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, {}))
|
|
}
|
|
|
|
if (accountUuid !== systemAccountUuid && meta !== undefined) {
|
|
void setTimezone(ctx, db, accountUuid, account, meta)
|
|
}
|
|
|
|
if (role === AccountRole.ReadOnlyGuest) {
|
|
if (extra == null) {
|
|
extra = {}
|
|
}
|
|
extra.readonly = 'true'
|
|
}
|
|
|
|
const wsStatus = await db.workspaceStatus.findOne({ workspaceUuid: workspace.uuid })
|
|
|
|
if (wsStatus != null) {
|
|
if (wsStatus.isDisabled && isActiveMode(wsStatus.mode)) {
|
|
ctx.error('Selecting a disabled workspace', { workspaceUrl, accountUuid })
|
|
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
|
|
}
|
|
}
|
|
|
|
const person = await db.person.findOne({ uuid: accountUuid })
|
|
if (person == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
return {
|
|
account: accountUuid,
|
|
token: generateToken(accountUuid, workspace.uuid, extra, undefined, {
|
|
grant,
|
|
sub,
|
|
exp,
|
|
nbf
|
|
}),
|
|
endpoint: getEndpoint(workspace.uuid, workspace.region, getKind(workspace.region)),
|
|
workspace: workspace.uuid,
|
|
workspaceUrl: workspace.url,
|
|
workspaceDataId: workspace.dataId,
|
|
allowGuestSignUp: workspace.allowReadOnlyGuest && workspace.allowGuestSignUp,
|
|
role
|
|
}
|
|
}
|
|
|
|
export async function updateAllowReadOnlyGuests (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
token: string,
|
|
params: {
|
|
readOnlyGuestsAllowed: boolean
|
|
}
|
|
): Promise<{ guestPerson: Person, guestSocialIds: SocialId[] } | undefined> {
|
|
const { readOnlyGuestsAllowed } = params
|
|
const { account, workspace } = decodeTokenVerbose(ctx, token)
|
|
|
|
if (workspace === null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid: workspace }))
|
|
}
|
|
|
|
const accRole = account === systemAccountUuid ? AccountRole.Owner : await db.getWorkspaceRole(account, workspace)
|
|
if (accRole == null || getRolePower(accRole) < getRolePower(AccountRole.Owner)) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
await db.updateAllowReadOnlyGuests(workspace, readOnlyGuestsAllowed)
|
|
if (!readOnlyGuestsAllowed) {
|
|
await db.unassignWorkspace(readOnlyGuestAccountUuid, workspace)
|
|
return undefined
|
|
}
|
|
|
|
let guestPerson = await db.person.findOne({ uuid: readOnlyGuestAccountUuid as PersonUuid })
|
|
if (guestPerson == null) {
|
|
await db.person.insertOne({
|
|
uuid: readOnlyGuestAccountUuid as PersonUuid,
|
|
firstName: 'Anonymous',
|
|
lastName: 'Guest'
|
|
})
|
|
await createAccount(db, readOnlyGuestAccountUuid as PersonUuid, true)
|
|
guestPerson = await db.person.findOne({ uuid: readOnlyGuestAccountUuid as PersonUuid })
|
|
}
|
|
const roleInWorkspace = await db.getWorkspaceRole(readOnlyGuestAccountUuid, workspace)
|
|
if (roleInWorkspace == null) {
|
|
await db.assignWorkspace(readOnlyGuestAccountUuid, workspace, AccountRole.ReadOnlyGuest)
|
|
}
|
|
|
|
const guestAccount = await db.account.findOne({ uuid: readOnlyGuestAccountUuid })
|
|
if (guestPerson === null || guestAccount == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
const guestSocialIds = await db.socialId.find({
|
|
personUuid: readOnlyGuestAccountUuid as PersonUuid,
|
|
verifiedOn: { $gt: 0 }
|
|
})
|
|
|
|
return { guestPerson, guestSocialIds: guestSocialIds.filter((si) => si.isDeleted !== true) }
|
|
}
|
|
|
|
export async function updateAllowGuestSignUp (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
token: string,
|
|
params: {
|
|
guestSignUpAllowed: boolean
|
|
}
|
|
): Promise<void> {
|
|
const { guestSignUpAllowed } = params
|
|
const { account, workspace } = decodeTokenVerbose(ctx, token)
|
|
|
|
if (workspace === null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid: workspace }))
|
|
}
|
|
|
|
const accRole = account === systemAccountUuid ? AccountRole.Owner : await db.getWorkspaceRole(account, workspace)
|
|
if (accRole == null || getRolePower(accRole) < getRolePower(AccountRole.Owner)) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
await db.updateAllowGuestSignUp(workspace, guestSignUpAllowed)
|
|
}
|
|
|
|
export async function updateWorkspaceRole (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
token: string,
|
|
params: {
|
|
targetAccount: AccountUuid
|
|
targetRole: AccountRole
|
|
}
|
|
): Promise<void> {
|
|
const { targetAccount, targetRole } = params
|
|
|
|
if (targetAccount === readOnlyGuestAccountUuid) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
const { account, workspace } = decodeTokenVerbose(ctx, token)
|
|
|
|
if (workspace === null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid: workspace }))
|
|
}
|
|
|
|
const accRole = account === systemAccountUuid ? AccountRole.Owner : await db.getWorkspaceRole(account, workspace)
|
|
|
|
if (
|
|
accRole == null ||
|
|
getRolePower(accRole) < getRolePower(AccountRole.Maintainer) ||
|
|
getRolePower(accRole) < getRolePower(targetRole)
|
|
) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
const currentRole = await db.getWorkspaceRole(targetAccount, workspace)
|
|
|
|
if (currentRole == null || getRolePower(accRole) < getRolePower(currentRole)) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
if (currentRole === targetRole) return
|
|
|
|
if (currentRole === AccountRole.Owner) {
|
|
// Check if there are other owners
|
|
const owners = (await db.getWorkspaceMembers(workspace)).filter((m) => m.role === AccountRole.Owner)
|
|
if (owners.length === 1) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
}
|
|
|
|
await db.updateWorkspaceRole(targetAccount, workspace, targetRole)
|
|
}
|
|
|
|
/**
|
|
* Convert workspace name to a URL-friendly string following these rules:
|
|
*
|
|
* 1. Converts all characters to lowercase
|
|
* 2. Only keeps alphanumeric characters (a-z, 0-9) and hyphens (-)
|
|
* 3. Cannot start with a number or hyphen
|
|
* 4. Cannot end with a hyphen
|
|
* 5. Removes all other special characters
|
|
*/
|
|
export function generateWorkspaceUrl (name: string): string {
|
|
const lowercaseName = name.toLowerCase()
|
|
let result = ''
|
|
let isFirst = true
|
|
|
|
for (const char of lowercaseName) {
|
|
const isValidChar = /[a-z0-9-]/.test(char)
|
|
const isNumber = /[0-9]/.test(char)
|
|
const isHyphen = char === '-'
|
|
|
|
if (isValidChar && (!isFirst || (!isNumber && !isHyphen))) {
|
|
result += char
|
|
isFirst = false
|
|
}
|
|
}
|
|
|
|
// Trim hyphens from the end
|
|
return result.replace(/-+$/, '')
|
|
}
|
|
|
|
// TODO: rework later to map exact codes for specific DBs
|
|
const DB_ERROR_CODES = {
|
|
UNIQUE_VIOLATION: [
|
|
'23505', // Postgres, CockroachDB
|
|
11000 // Mongo
|
|
]
|
|
}
|
|
|
|
interface CreateWorkspaceRecordResult {
|
|
workspaceUuid: WorkspaceUuid
|
|
workspaceUrl: string
|
|
}
|
|
|
|
export async function createWorkspaceRecord (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
workspaceName: string,
|
|
account: PersonUuid,
|
|
region: string = '',
|
|
initMode: WorkspaceMode = 'pending-creation',
|
|
dataId?: WorkspaceDataId
|
|
): Promise<CreateWorkspaceRecordResult> {
|
|
const brandingKey = branding?.key ?? 'huly'
|
|
const regionInfo = getRegions().find((it) => it.region === region)
|
|
|
|
if (regionInfo === undefined) {
|
|
ctx.error('Region not found', { region, regions: getRegions() })
|
|
|
|
throw new PlatformError(
|
|
new Status(Severity.ERROR, platform.status.InternalServerError, {
|
|
region
|
|
})
|
|
)
|
|
}
|
|
|
|
// The workspace url must be unique.
|
|
// This function is not concurrency safe, moreover multiple account services may be
|
|
// creating a workspace with the same base url at the same time so it's not possible
|
|
// to make it safe in the first place.
|
|
// But the uniqueness is guaranteed by the database rules and it will reject duplicate workspace urls.
|
|
// So we just need to handle the expected error and retry until we get a unique url.
|
|
let iteration = 0
|
|
let baseWorkspaceUrl = generateWorkspaceUrl(workspaceName)
|
|
let workspaceUrl = baseWorkspaceUrl
|
|
|
|
if (baseWorkspaceUrl === '') {
|
|
baseWorkspaceUrl = 'ws'
|
|
workspaceUrl = `ws-${generateId('-')}`
|
|
}
|
|
|
|
while (true) {
|
|
try {
|
|
const workspaceUuid = await db.createWorkspace(
|
|
{
|
|
name: workspaceName,
|
|
url: workspaceUrl,
|
|
dataId,
|
|
branding: brandingKey,
|
|
createdBy: account,
|
|
billingAccount: account,
|
|
allowReadOnlyGuest: false,
|
|
allowGuestSignUp: false,
|
|
region
|
|
},
|
|
{
|
|
mode: initMode,
|
|
versionMajor: 0,
|
|
versionMinor: 0,
|
|
versionPatch: 0,
|
|
isDisabled: true
|
|
}
|
|
)
|
|
|
|
return {
|
|
workspaceUuid,
|
|
workspaceUrl
|
|
}
|
|
} catch (err: any) {
|
|
if (!DB_ERROR_CODES.UNIQUE_VIOLATION.includes(err.code)) {
|
|
throw err
|
|
}
|
|
}
|
|
|
|
workspaceUrl = `${baseWorkspaceUrl}-${generateId('-')}`
|
|
iteration++
|
|
// Safety check to prevent infinite loop. Should never happen if the code is alright.
|
|
if (iteration > 1000) {
|
|
ctx.error('Workspace record generation failed. Could not create a workspace record in 1000 attempts.', {
|
|
workspaceName
|
|
})
|
|
throw new PlatformError(
|
|
new Status(Severity.ERROR, platform.status.InternalServerError, { region, workspaceName, baseWorkspaceUrl })
|
|
)
|
|
}
|
|
}
|
|
}
|
|
|
|
export async function checkInvite (ctx: MeasureContext, invite: WorkspaceInvite, email: string): Promise<WorkspaceUuid> {
|
|
if (invite.remainingUses === 0) {
|
|
ctx.error('Invite limit exceeded', { email, ...invite })
|
|
Analytics.handleError(new Error(`Invite limit exceeded ${email}`))
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
if (invite.expiresOn > 0 && invite.expiresOn < Date.now()) {
|
|
ctx.error('Invite link expired', { email, ...invite })
|
|
Analytics.handleError(new Error(`Invite link expired ${invite.id} ${email}`))
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.ExpiredLink, {}))
|
|
}
|
|
|
|
// TODO: consider not using RegExp with user input as some regexes might
|
|
// be slow or even cause catastrophic backtracking
|
|
// if (
|
|
// invite.emailPattern != null &&
|
|
// invite.emailPattern.trim().length > 0 &&
|
|
// !new RegExp(invite.emailPattern).test(email)
|
|
// ) {
|
|
// ctx.error("Invite doesn't allow this email address", { email, ...invite })
|
|
// Analytics.handleError(new Error(`Invite link email mask check failed ${invite.id} ${email} ${invite.emailPattern}`))
|
|
// throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
// }
|
|
|
|
if (invite.email != null && invite.email.trim().length > 0 && invite.email !== email) {
|
|
ctx.error("Invite doesn't allow this email address", { email, ...invite })
|
|
Analytics.handleError(new Error(`Invite link email check failed ${invite.id} ${email} ${invite.email}`))
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
return invite.workspaceUuid
|
|
}
|
|
|
|
export async function sendEmailConfirmation (
|
|
ctx: MeasureContext,
|
|
branding: Branding | null,
|
|
account: PersonUuid,
|
|
email: string
|
|
): Promise<void> {
|
|
const mailURL = getMetadata(accountPlugin.metadata.MAIL_URL)
|
|
if (mailURL === undefined || mailURL === '') {
|
|
ctx.error('Please provide MAIL_URL to enable email confirmations.')
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
const mailAuth = getMetadata(accountPlugin.metadata.MAIL_AUTH_TOKEN)
|
|
|
|
const front = branding?.front ?? getMetadata(accountPlugin.metadata.FrontURL)
|
|
if (front === undefined || front === '') {
|
|
ctx.error('Please provide front url via branding configuration or FRONT_URL variable')
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
const token = generateToken(account, undefined, {
|
|
confirmEmail: email
|
|
})
|
|
|
|
const link = concatLink(front, `/login/confirm?id=${token}`)
|
|
|
|
const name = branding?.title ?? getMetadata(accountPlugin.metadata.ProductName)
|
|
const lang = branding?.language
|
|
const text = await translate(accountPlugin.string.ConfirmationText, { name, link }, lang)
|
|
const html = await translate(accountPlugin.string.ConfirmationHTML, { name, link }, lang)
|
|
const subject = await translate(accountPlugin.string.ConfirmationSubject, { name }, lang)
|
|
|
|
const response = await fetch(concatLink(mailURL, '/send'), {
|
|
method: 'post',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
...(mailAuth != null ? { Authorization: `Bearer ${mailAuth}` } : {})
|
|
},
|
|
body: JSON.stringify({
|
|
text,
|
|
html,
|
|
subject,
|
|
to: email
|
|
})
|
|
})
|
|
if (!response.ok) {
|
|
ctx.error(`Failed to send email confirmation: ${response.statusText}`, { email })
|
|
}
|
|
}
|
|
|
|
export async function confirmEmail (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
account: string,
|
|
email: string
|
|
): Promise<PersonId> {
|
|
const normalizedEmail = cleanEmail(email)
|
|
ctx.info('Confirming email', { account, email, normalizedEmail })
|
|
|
|
const emailSocialId = await getEmailSocialId(db, normalizedEmail)
|
|
|
|
if (emailSocialId == null) {
|
|
ctx.error('Email social id not found', { account, normalizedEmail })
|
|
throw new PlatformError(
|
|
new Status(Severity.ERROR, platform.status.SocialIdNotFound, {
|
|
value: normalizedEmail,
|
|
type: SocialIdType.EMAIL
|
|
})
|
|
)
|
|
}
|
|
|
|
if (emailSocialId.verifiedOn != null) {
|
|
throw new PlatformError(
|
|
new Status(Severity.ERROR, platform.status.SocialIdAlreadyConfirmed, {
|
|
socialId: normalizedEmail,
|
|
type: SocialIdType.EMAIL
|
|
})
|
|
)
|
|
}
|
|
|
|
await db.socialId.update({ _id: emailSocialId._id }, { verifiedOn: Date.now() })
|
|
return emailSocialId._id
|
|
}
|
|
|
|
export async function confirmHulyIds (ctx: MeasureContext, db: AccountDB, account: AccountUuid): Promise<void> {
|
|
const hulySocialIds = await db.socialId.find({ personUuid: account, type: SocialIdType.HULY, verifiedOn: null })
|
|
for (const hulySocialId of hulySocialIds) {
|
|
await db.socialId.update({ _id: hulySocialId._id }, { verifiedOn: Date.now() })
|
|
}
|
|
}
|
|
|
|
export async function useInvite (db: AccountDB, inviteId: string): Promise<void> {
|
|
await db.invite.update({ id: inviteId }, { $inc: { remainingUses: -1 } })
|
|
}
|
|
|
|
export async function getAccount (db: AccountDB, uuid: AccountUuid): Promise<Account | null> {
|
|
return await db.account.findOne({ uuid })
|
|
}
|
|
|
|
export async function getWorkspaceById (db: AccountDB, uuid: WorkspaceUuid): Promise<Workspace | null> {
|
|
return await db.workspace.findOne({ uuid })
|
|
}
|
|
|
|
export async function getWorkspaceInfoWithStatusById (
|
|
db: AccountDB,
|
|
uuid: WorkspaceUuid
|
|
): Promise<WorkspaceInfoWithStatus | null> {
|
|
const ws = await db.workspace.findOne({ uuid })
|
|
const status = await db.workspaceStatus.findOne({ workspaceUuid: uuid })
|
|
|
|
if (ws == null || status == null) {
|
|
return null
|
|
}
|
|
|
|
return {
|
|
...ws,
|
|
status
|
|
}
|
|
}
|
|
|
|
export async function getWorkspacesInfoWithStatusByIds (
|
|
db: AccountDB,
|
|
uuids: WorkspaceUuid[]
|
|
): Promise<WorkspaceInfoWithStatus[]> {
|
|
const statuses = await db.workspaceStatus.find({ workspaceUuid: { $in: uuids } })
|
|
const statusesMap = statuses.reduce<Record<string, WorkspaceStatus>>((sm, s) => {
|
|
sm[s.workspaceUuid] = s
|
|
return sm
|
|
}, {})
|
|
const workspaces = await db.workspace.find({ uuid: { $in: uuids } })
|
|
|
|
return workspaces.map((it) => ({
|
|
...it,
|
|
status: statusesMap[it.uuid]
|
|
}))
|
|
}
|
|
|
|
export async function getWorkspaceByUrl (db: AccountDB, url: string): Promise<Workspace | null> {
|
|
return await db.workspace.findOne({ url })
|
|
}
|
|
|
|
export async function getWorkspaceByDataId (
|
|
db: AccountDB,
|
|
dataId: string | null | undefined
|
|
): Promise<Workspace | null> {
|
|
if (dataId == null || dataId === '') {
|
|
return null
|
|
}
|
|
|
|
return await db.workspace.findOne({ dataId: dataId as WorkspaceDataId })
|
|
}
|
|
|
|
export async function getWorkspaceInvite (db: AccountDB, id: string): Promise<WorkspaceInvite | null> {
|
|
const invite = await db.invite.findOne({ id })
|
|
|
|
if (invite != null) {
|
|
return invite
|
|
}
|
|
|
|
return await db.invite.findOne({ migratedFrom: id })
|
|
}
|
|
|
|
export async function getSocialIdByKey (db: AccountDB, socialKey: string): Promise<SocialId | null> {
|
|
return await db.socialId.findOne({ key: socialKey })
|
|
}
|
|
|
|
export async function getEmailSocialId (db: AccountDB, email: string): Promise<SocialId | null> {
|
|
return await db.socialId.findOne({ type: SocialIdType.EMAIL, value: email })
|
|
}
|
|
|
|
export function getMailUrl (): { mailURL: string, mailAuth: string | undefined } {
|
|
const mailURL = getMetadata(accountPlugin.metadata.MAIL_URL)
|
|
|
|
if (mailURL === undefined || mailURL === '') {
|
|
throw new Error('Please provide email service url')
|
|
}
|
|
const mailAuth = getMetadata(accountPlugin.metadata.MAIL_AUTH_TOKEN)
|
|
|
|
return { mailURL, mailAuth }
|
|
}
|
|
|
|
export function getFrontUrl (branding: Branding | null): string {
|
|
const front = branding?.front ?? getMetadata(accountPlugin.metadata.FrontURL)
|
|
|
|
if (front === undefined || front === '') {
|
|
throw new Error('Please provide front url')
|
|
}
|
|
|
|
return front
|
|
}
|
|
|
|
export async function updateArchiveInfo (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
workspace: WorkspaceUuid,
|
|
value: boolean
|
|
): Promise<void> {
|
|
const workspaceInfo = await getWorkspaceById(db, workspace)
|
|
if (workspaceInfo === null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid: workspace }))
|
|
}
|
|
|
|
await db.workspaceStatus.update(
|
|
{ workspaceUuid: workspace },
|
|
{
|
|
mode: 'archived'
|
|
}
|
|
)
|
|
}
|
|
|
|
export async function getWorkspaceJoinInfo (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
email: string,
|
|
inviteId: string,
|
|
workspaceUrl: string
|
|
): Promise<WorkspaceJoinInfo> {
|
|
if (email === undefined || email === '' || email === null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
|
|
}
|
|
const normalizedEmail = cleanEmail(email)
|
|
if (inviteId !== undefined && inviteId !== '' && inviteId !== null) {
|
|
const invite = await getWorkspaceInvite(db, inviteId)
|
|
if (invite == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
const workspaceUuid = await checkInvite(ctx, invite, normalizedEmail)
|
|
const workspace = await getWorkspaceById(db, workspaceUuid)
|
|
if (workspace == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid }))
|
|
}
|
|
return {
|
|
email,
|
|
invite,
|
|
workspace
|
|
}
|
|
}
|
|
if (workspaceUrl !== undefined && workspaceUrl !== '' && workspaceUrl !== null) {
|
|
const workspace = await getWorkspaceByUrl(db, workspaceUrl)
|
|
if (workspace == null || !workspace.allowReadOnlyGuest || !workspace.allowGuestSignUp) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
return {
|
|
email,
|
|
workspace
|
|
}
|
|
}
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
|
|
}
|
|
|
|
export async function doJoinByInvite (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
token: string,
|
|
account: AccountUuid,
|
|
workspace: Workspace,
|
|
invite: WorkspaceInvite | null | undefined
|
|
): Promise<WorkspaceLoginInfo> {
|
|
const role = await db.getWorkspaceRole(account, workspace.uuid)
|
|
|
|
if (invite !== undefined && invite != null) {
|
|
// TODO: should we re-join kicked users? How are they marked as inactive?
|
|
if (role == null) {
|
|
await db.assignWorkspace(account, workspace.uuid, invite.role)
|
|
} else if (getRolePower(role) < getRolePower(invite.role)) {
|
|
await db.updateWorkspaceRole(account, workspace.uuid, invite.role)
|
|
}
|
|
await useInvite(db, invite.id)
|
|
} else if (workspace.allowReadOnlyGuest && workspace.allowGuestSignUp) {
|
|
if (role == null) {
|
|
await db.assignWorkspace(account, workspace.uuid, AccountRole.Guest)
|
|
}
|
|
} else {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
const result = await selectWorkspace(ctx, db, branding, token, { workspaceUrl: workspace.url, kind: 'external' })
|
|
|
|
ctx.info('Successfully joined a workspace using invite', {
|
|
account,
|
|
workspaceUuid: workspace.uuid,
|
|
workspaceUrl: workspace.url,
|
|
workspaceName: workspace.name
|
|
})
|
|
|
|
return result
|
|
}
|
|
|
|
export async function loginOrSignUpWithProvider (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
email: string | undefined,
|
|
first: string,
|
|
last: string,
|
|
socialId: SocialKey,
|
|
signUpDisabled = false
|
|
): Promise<LoginInfo | null> {
|
|
try {
|
|
const normalizedEmail = email != null ? cleanEmail(email) : ''
|
|
const normalizedSocialId: SocialKey = {
|
|
type: socialId.type,
|
|
value: normalizeValue(socialId.value)
|
|
}
|
|
|
|
// Find if any of the target/email social ids exist
|
|
const targetSocialId = await db.socialId.findOne(normalizedSocialId)
|
|
const emailSocialId =
|
|
normalizedEmail !== ''
|
|
? await db.socialId.findOne({ type: SocialIdType.EMAIL, value: normalizedEmail })
|
|
: undefined
|
|
let personUuid = targetSocialId?.personUuid ?? emailSocialId?.personUuid
|
|
|
|
if (personUuid == null) {
|
|
if (signUpDisabled) {
|
|
return null
|
|
}
|
|
|
|
personUuid = await db.person.insertOne({ firstName: first, lastName: last })
|
|
}
|
|
|
|
if (personUuid == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
const person = await db.person.findOne({ uuid: personUuid })
|
|
|
|
if (person == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
const account = await db.account.findOne({ uuid: personUuid as AccountUuid })
|
|
|
|
if (account == null) {
|
|
if (signUpDisabled) {
|
|
return null
|
|
}
|
|
|
|
await createAccount(db, personUuid, true)
|
|
await db.person.update({ uuid: personUuid }, { firstName: first, lastName: last })
|
|
}
|
|
|
|
// We should check and reset password if there's an account with password but no social ids have been
|
|
// confirmed yet
|
|
const confirmedSocialId = await db.socialId.findOne({ personUuid, verifiedOn: { $gt: 0 } })
|
|
|
|
if (confirmedSocialId == null) {
|
|
await db.resetPassword(personUuid as AccountUuid)
|
|
}
|
|
|
|
let socialIdId: PersonId | undefined
|
|
// Create and/or confirm missing social ids
|
|
if (targetSocialId == null) {
|
|
socialIdId = await db.socialId.insertOne({ ...normalizedSocialId, personUuid, verifiedOn: Date.now() })
|
|
} else if (targetSocialId.verifiedOn == null) {
|
|
await db.socialId.update({ key: targetSocialId.key }, { verifiedOn: Date.now() })
|
|
socialIdId = targetSocialId._id
|
|
}
|
|
|
|
if (emailSocialId == null) {
|
|
if (normalizedEmail !== '') {
|
|
await db.socialId.insertOne({
|
|
type: SocialIdType.EMAIL,
|
|
value: normalizedEmail,
|
|
personUuid,
|
|
verifiedOn: Date.now()
|
|
})
|
|
}
|
|
} else if (emailSocialId.verifiedOn == null) {
|
|
await db.socialId.update({ key: emailSocialId.key }, { verifiedOn: Date.now() })
|
|
}
|
|
|
|
await confirmHulyIds(ctx, db, personUuid as AccountUuid)
|
|
const extraToken: Record<string, string> = isAdminEmail(normalizedEmail) ? { admin: 'true' } : {}
|
|
ctx.info('Provider login succeeded', { email, normalizedEmail, emailSocialId, socialId, ...extraToken })
|
|
|
|
return {
|
|
account: personUuid as AccountUuid,
|
|
socialId: socialIdId,
|
|
name: getPersonName(person),
|
|
token: generateToken(personUuid, undefined, extraToken)
|
|
}
|
|
} catch (err: any) {
|
|
Analytics.handleError(err)
|
|
ctx.error('Provider login failed', { email, err })
|
|
throw err
|
|
}
|
|
}
|
|
|
|
export async function joinWithProvider (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
branding: Branding | null,
|
|
email: string | undefined,
|
|
first: string,
|
|
last: string,
|
|
inviteId: string,
|
|
socialId: SocialKey,
|
|
signUpDisabled = false
|
|
): Promise<WorkspaceLoginInfo | LoginInfo | null> {
|
|
const normalizedEmail = email != null ? cleanEmail(email) : ''
|
|
const invite = await getWorkspaceInvite(db, inviteId)
|
|
if (invite == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
const workspaceUuid = await checkInvite(ctx, invite, normalizedEmail)
|
|
const workspace = await getWorkspaceById(db, workspaceUuid)
|
|
|
|
if (workspace == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid }))
|
|
}
|
|
|
|
const loginInfo = await loginOrSignUpWithProvider(
|
|
ctx,
|
|
db,
|
|
branding,
|
|
normalizedEmail,
|
|
first,
|
|
last,
|
|
socialId,
|
|
signUpDisabled
|
|
)
|
|
|
|
if (loginInfo == null) {
|
|
return null
|
|
}
|
|
|
|
return await doJoinByInvite(
|
|
ctx,
|
|
db,
|
|
branding,
|
|
generateToken(loginInfo.account, workspaceUuid),
|
|
loginInfo.account,
|
|
workspace,
|
|
invite
|
|
)
|
|
}
|
|
|
|
export function flattenStatus (ws: WorkspaceInfoWithStatus): WorkspaceInfoWithStatusCore {
|
|
if (ws === undefined) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, {}))
|
|
}
|
|
|
|
const status = ws.status
|
|
const result: WorkspaceInfoWithStatusCore = {
|
|
...ws,
|
|
...status,
|
|
createdOn: ws.createdOn as number,
|
|
processingAttemps: status.processingAttempts ?? 0
|
|
}
|
|
delete (result as any).status
|
|
|
|
return result
|
|
}
|
|
|
|
export async function cleanExpiredOtp (db: AccountDB): Promise<void> {
|
|
await db.otp.deleteMany({ expiresOn: { $lte: Date.now() } })
|
|
}
|
|
|
|
export async function getWorkspaces (
|
|
db: AccountDB,
|
|
isDisabled?: boolean | null,
|
|
region?: string | null,
|
|
mode?: WorkspaceMode | null
|
|
): Promise<WorkspaceInfoWithStatus[]> {
|
|
const statuses = await db.workspaceStatus.find({})
|
|
const statusesMap = statuses.reduce<Record<string, WorkspaceStatus>>((sm, s) => {
|
|
sm[s.workspaceUuid] = s
|
|
return sm
|
|
}, {})
|
|
|
|
const workspaces = (await db.workspace.find(region != null ? { region } : {})).filter((it) => {
|
|
const status = statusesMap[it.uuid]
|
|
if (isDisabled === true) {
|
|
return status.isDisabled
|
|
} else if (isDisabled === false) {
|
|
return !status.isDisabled
|
|
}
|
|
|
|
if (mode != null) {
|
|
return status.mode === mode
|
|
}
|
|
|
|
return true
|
|
})
|
|
|
|
return workspaces.map((it) => ({
|
|
...it,
|
|
status: statusesMap[it.uuid]
|
|
}))
|
|
}
|
|
|
|
export function verifyAllowedServices (services: string[], extra: any, shouldThrow = true): boolean {
|
|
const ok = services.includes(extra?.service)
|
|
|
|
if (!ok && shouldThrow) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
return ok
|
|
}
|
|
|
|
export function verifyAllowedRole (
|
|
callerRole: AccountRole | null,
|
|
minRole: AccountRole,
|
|
extra: any,
|
|
shouldThrow = true
|
|
): boolean {
|
|
const ok = extra?.admin === 'true' || (callerRole != null && getRolePower(callerRole) >= getRolePower(minRole))
|
|
|
|
if (!ok && shouldThrow) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
|
|
return ok
|
|
}
|
|
|
|
export function getPersonName (person: Person): string {
|
|
// Should we control the order by config?
|
|
return `${person.firstName} ${person.lastName}`
|
|
}
|
|
|
|
interface EmailInfo {
|
|
text: string
|
|
html: string
|
|
subject: string
|
|
to: string
|
|
}
|
|
|
|
export async function sendEmail (info: EmailInfo, ctx: MeasureContext): Promise<void> {
|
|
const { text, html, subject, to } = info
|
|
const { mailURL, mailAuth } = getMailUrl()
|
|
const response = await fetch(concatLink(mailURL, '/send'), {
|
|
method: 'post',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
...(mailAuth != null ? { Authorization: `Bearer ${mailAuth}` } : {})
|
|
},
|
|
body: JSON.stringify({
|
|
text,
|
|
html,
|
|
subject,
|
|
to
|
|
})
|
|
})
|
|
if (!response.ok) {
|
|
ctx.error(`Failed to send mail: ${response.statusText}`, { to })
|
|
}
|
|
}
|
|
|
|
export function sanitizeEmail (email: string): string {
|
|
if (email == null || typeof email !== 'string') return ''
|
|
const sanitizedEmail = email
|
|
.trim()
|
|
.replace(/[<>/\\@{}()[\]'"`]/g, '') // Remove special chars and quotes
|
|
.replace(/^(http|ssh|ftp|https|mailto|javascript|data|file):?\/?\/?\s*/i, '') // Remove potentially dangerous protocols
|
|
.slice(0, 40)
|
|
return sanitizedEmail
|
|
}
|
|
|
|
export async function getInviteEmail (
|
|
branding: Branding | null,
|
|
email: string,
|
|
link: string,
|
|
workspace: Workspace,
|
|
expHours: number,
|
|
resend = false
|
|
): Promise<EmailInfo> {
|
|
const ws = sanitizeEmail(workspace.name !== '' ? workspace.name : workspace.url)
|
|
const lang = branding?.language
|
|
|
|
return {
|
|
text: await translate(
|
|
resend ? accountPlugin.string.ResendInviteText : accountPlugin.string.InviteText,
|
|
{ link, ws, expHours },
|
|
lang
|
|
),
|
|
html: await translate(
|
|
resend ? accountPlugin.string.ResendInviteHTML : accountPlugin.string.InviteHTML,
|
|
{ link, ws, expHours },
|
|
lang
|
|
),
|
|
subject: await translate(
|
|
resend ? accountPlugin.string.ResendInviteSubject : accountPlugin.string.InviteSubject,
|
|
{ ws },
|
|
lang
|
|
),
|
|
to: email
|
|
}
|
|
}
|
|
|
|
export async function addSocialIdBase (
|
|
db: AccountDB,
|
|
personUuid: PersonUuid,
|
|
type: SocialIdType,
|
|
value: string,
|
|
confirmed: boolean,
|
|
displayValue?: string
|
|
): Promise<PersonId> {
|
|
const normalizedValue = normalizeValue(value ?? '')
|
|
|
|
if (!Object.values(SocialIdType).includes(type) || normalizedValue.length === 0) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
|
|
}
|
|
|
|
const person = await db.person.findOne({ uuid: personUuid })
|
|
if (person == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.PersonNotFound, { person: personUuid }))
|
|
}
|
|
|
|
const socialId = await db.socialId.findOne({ type, value: normalizedValue })
|
|
if (socialId != null) {
|
|
const update: Operations<SocialId> = {}
|
|
let needUpdate = false
|
|
|
|
if (socialId.personUuid !== personUuid) {
|
|
if (socialId.verifiedOn != null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.SocialIdAlreadyExists, {}))
|
|
} else {
|
|
// Was not verified.
|
|
const accountFromSocialId = await db.account.findOne({ uuid: socialId.personUuid as AccountUuid })
|
|
|
|
if (accountFromSocialId == null && confirmed) {
|
|
// If attached to a person w/o account and adding verifiedOn - merge this person into the current account.
|
|
await doMergePersons(db, personUuid, socialId.personUuid)
|
|
} else {
|
|
// Re-wire this social id into the current account
|
|
update.personUuid = personUuid
|
|
needUpdate = true
|
|
}
|
|
}
|
|
}
|
|
|
|
if (confirmed && socialId.verifiedOn == null) {
|
|
update.verifiedOn = Date.now()
|
|
needUpdate = true
|
|
}
|
|
|
|
if (displayValue !== socialId.displayValue) {
|
|
update.displayValue = displayValue
|
|
needUpdate = true
|
|
}
|
|
|
|
if (needUpdate) {
|
|
await db.socialId.update({ _id: socialId._id }, update)
|
|
}
|
|
|
|
return socialId._id
|
|
}
|
|
|
|
const newSocialId: Omit<SocialId, '_id' | 'key'> = {
|
|
type,
|
|
value: normalizedValue,
|
|
personUuid,
|
|
displayValue
|
|
}
|
|
|
|
if (confirmed) {
|
|
newSocialId.verifiedOn = Date.now()
|
|
}
|
|
|
|
return await db.socialId.insertOne(newSocialId)
|
|
}
|
|
|
|
export async function doReleaseSocialId (
|
|
db: AccountDB,
|
|
personUuid: PersonUuid,
|
|
type: SocialIdType,
|
|
value: string,
|
|
releasedBy: string,
|
|
deleteIntegrations = false
|
|
): Promise<SocialId> {
|
|
const socialId = await db.socialId.findOne({ personUuid, type, value, isDeleted: { $ne: true } })
|
|
|
|
if (socialId == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.SocialIdNotFound, {}))
|
|
}
|
|
|
|
const account = await db.account.findOne({ uuid: personUuid as AccountUuid })
|
|
|
|
const integrations = await db.integration.find({ socialId: socialId._id })
|
|
if (!deleteIntegrations && integrations.length > 0) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.IntegrationExists, {}))
|
|
}
|
|
|
|
// Delete all integrations for this socialId
|
|
// TODO: Send to pipe? to notify integration services somehow so they can clean up if needed
|
|
await db.integrationSecret.deleteMany({ socialId: socialId._id })
|
|
await db.integration.deleteMany({ socialId: socialId._id })
|
|
|
|
// Release socialId
|
|
await db.socialId.update({ _id: socialId._id }, { value: `${socialId.value}#${socialId._id}`, isDeleted: true })
|
|
if (account != null) {
|
|
await db.accountEvent.insertOne({
|
|
accountUuid: account.uuid,
|
|
eventType: AccountEventType.SOCIAL_ID_RELEASED,
|
|
time: Date.now(),
|
|
data: {
|
|
socialId: socialId._id,
|
|
releasedBy: releasedBy ?? ''
|
|
}
|
|
})
|
|
}
|
|
|
|
// read updated id (to avoid generating updated key manually)
|
|
const deletedSocialId = await db.socialId.findOne({ _id: socialId._id })
|
|
|
|
if (deletedSocialId == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
|
|
}
|
|
|
|
return deletedSocialId
|
|
}
|
|
|
|
export async function getWorkspaceRole (
|
|
db: AccountDB,
|
|
account: AccountUuid,
|
|
workspace: WorkspaceUuid
|
|
): Promise<AccountRole | null> {
|
|
if (account === systemAccountUuid) {
|
|
return AccountRole.Owner
|
|
}
|
|
|
|
return await db.getWorkspaceRole(account, workspace)
|
|
}
|
|
|
|
export async function getWorkspaceRoles (
|
|
db: AccountDB,
|
|
account: AccountUuid
|
|
): Promise<Map<WorkspaceUuid, AccountRole | null>> {
|
|
return await db.getWorkspaceRoles(account)
|
|
}
|
|
|
|
export function generatePassword (len: number = 24): string {
|
|
return randomBytes(len).toString('base64').slice(0, len)
|
|
}
|
|
|
|
export async function setTimezone (
|
|
ctx: MeasureContext,
|
|
db: AccountDB,
|
|
accountId: AccountUuid,
|
|
account: Account | null | undefined,
|
|
meta?: Meta
|
|
): Promise<void> {
|
|
try {
|
|
if (meta?.timezone === undefined) return
|
|
const existingAccount = account ?? (await db.account.findOne({ uuid: accountId }))
|
|
if (existingAccount === undefined || existingAccount === null) {
|
|
ctx.warn('Failed to find account')
|
|
return
|
|
}
|
|
if (existingAccount.timezone === meta?.timezone) return
|
|
await db.account.update({ uuid: accountId }, { timezone: meta.timezone })
|
|
} catch (err: any) {
|
|
ctx.error('Failed to set account timezone', err)
|
|
}
|
|
}
|
|
|
|
// Move to config?
|
|
export const integrationServices = [
|
|
'github',
|
|
'telegram-bot',
|
|
'hulygram',
|
|
'mailbox',
|
|
'caldav',
|
|
'gmail',
|
|
'google-calendar',
|
|
'huly-mail',
|
|
'ai-assistant',
|
|
'tool'
|
|
]
|
|
|
|
export async function findExistingIntegration (
|
|
account: AccountUuid,
|
|
db: AccountDB,
|
|
params: Integration,
|
|
extra: any
|
|
): Promise<Integration | null> {
|
|
const { socialId, kind, workspaceUuid } = params
|
|
// Note: workspaceUuid === null is a decent use case for account-wise integration not related to a particular workspace
|
|
if (kind == null || kind === '' || socialId == null || socialId === '' || workspaceUuid === undefined) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
|
|
}
|
|
|
|
if (verifyAllowedServices(integrationServices, extra, false)) {
|
|
const existingSocialId = await db.socialId.findOne({ _id: socialId, verifiedOn: { $gt: 0 } })
|
|
if (existingSocialId == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.SocialIdNotFound, { _id: socialId }))
|
|
}
|
|
} else {
|
|
if (account == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
// Allow accounts to operate on their own integrations
|
|
const existingSocialId = await db.socialId.findOne({ _id: socialId, personUuid: account, verifiedOn: { $gt: 0 } })
|
|
if (existingSocialId == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
|
|
}
|
|
}
|
|
|
|
if (workspaceUuid != null) {
|
|
const workspace = await getWorkspaceById(db, workspaceUuid)
|
|
if (workspace == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid }))
|
|
}
|
|
}
|
|
|
|
return await db.integration.findOne({ socialId, kind, workspaceUuid })
|
|
}
|
|
|
|
export async function doMergePersons (
|
|
db: AccountDB,
|
|
primaryPerson: PersonUuid,
|
|
secondaryPerson: PersonUuid,
|
|
mergeVerified = false
|
|
): Promise<void> {
|
|
if (primaryPerson === secondaryPerson) {
|
|
// Nothing to do
|
|
return
|
|
}
|
|
|
|
const primaryPersonObj = await db.person.findOne({ uuid: primaryPerson })
|
|
if (primaryPersonObj == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.PersonNotFound, { person: primaryPerson }))
|
|
}
|
|
|
|
const secondaryPersonObj = await db.person.findOne({ uuid: secondaryPerson })
|
|
if (secondaryPersonObj == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.PersonNotFound, { person: secondaryPerson }))
|
|
}
|
|
|
|
// Merge social ids. Re-wire the secondary person social ids to the primary person.
|
|
// Keep their ids. This way all PersonIds inside the workspaces will remain the same.
|
|
const secondarySocialIds = await db.socialId.find({ personUuid: secondaryPerson })
|
|
|
|
if (!mergeVerified && secondarySocialIds.some((si) => si.verifiedOn != null)) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.Conflict, {}))
|
|
}
|
|
|
|
for (const secondarySocialId of secondarySocialIds) {
|
|
await db.socialId.update({ _id: secondarySocialId._id, personUuid: secondaryPerson }, { personUuid: primaryPerson })
|
|
}
|
|
|
|
await db.person.update({ uuid: secondaryPerson }, { migratedTo: primaryPerson })
|
|
}
|
|
|
|
export async function doMergeAccounts (
|
|
db: AccountDB,
|
|
primaryAccount: AccountUuid,
|
|
secondaryAccount: AccountUuid
|
|
): Promise<void> {
|
|
if (primaryAccount === secondaryAccount) {
|
|
// Nothing to do
|
|
return
|
|
}
|
|
|
|
const primaryAccountObj = await db.account.findOne({ uuid: primaryAccount })
|
|
if (primaryAccountObj == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, { account: primaryAccount }))
|
|
}
|
|
|
|
const secondaryAccountObj = await db.account.findOne({ uuid: secondaryAccount })
|
|
if (secondaryAccountObj == null) {
|
|
throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, { account: secondaryAccount }))
|
|
}
|
|
|
|
await doMergePersons(db, primaryAccount, secondaryAccount, true)
|
|
|
|
// Workspace assignments. Assign primary account to all workspaces of the secondary account.
|
|
const secondaryWorkspacesRoles = await db.getWorkspaceRoles(secondaryAccount)
|
|
for (const [workspaceUuid, role] of secondaryWorkspacesRoles) {
|
|
await db.unassignWorkspace(secondaryAccount, workspaceUuid)
|
|
|
|
const primaryRole = await db.getWorkspaceRole(primaryAccount, workspaceUuid)
|
|
if (primaryRole != null) {
|
|
if (getRolePower(primaryRole) < getRolePower(role)) {
|
|
await db.updateWorkspaceRole(primaryAccount, workspaceUuid, role)
|
|
}
|
|
} else {
|
|
await db.assignWorkspace(primaryAccount, workspaceUuid, role)
|
|
}
|
|
}
|
|
|
|
// Merge passwords. Keep the primary account password if exists, otherwise take the secondary account password.
|
|
if (primaryAccountObj.hash == null && secondaryAccountObj.hash != null && secondaryAccountObj.salt != null) {
|
|
await db.setPassword(primaryAccount, secondaryAccountObj.hash, secondaryAccountObj.salt)
|
|
}
|
|
}
|