vendure-plugin-disable-anonymous-access/dist/api/middleware.js

Disable anonymous access to shop-api and only allow to defined methods like authenticate

"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __param = (this && this.__param) || function (paramIndex, decorator) {
    return function (target, key) { decorator(target, key, paramIndex); }
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.DisableAnonymousAccessMiddleware = void 0;
const common_1 = require("@nestjs/common");
const core_1 = require("@vendure/core");
const graphql_1 = require("graphql");
const constants_1 = require("../constants");
let DisableAnonymousAccessMiddleware = class DisableAnonymousAccessMiddleware {
    sessionService;
    configService;
    options;
    constructor(sessionService, configService, options) {
        this.sessionService = sessionService;
        this.configService = configService;
        this.options = options;
    }
    async use(req, res, next) {
        // Ensure the request is intended for the GraphQL API endpoint
        if (req.path === "/shop-api" || req.baseUrl === "/shop-api") {
            const body = req.body;
            if (body && body.query) {
                const operationName = this.getOperationName(body.query);
                if (!operationName) {
                    throw new core_1.InternalServerError("Operation name not found or extracted");
                }
                if (this.isPublicOperation(operationName)) {
                    return next();
                }
            }
            const isLoggedIn = await this.isLoggedIn(req);
            if (!isLoggedIn) {
                return res.status(403).json({ message: "Forbidden" });
            }
        }
        next();
    }
    getOperationName(query) {
        try {
            const document = (0, graphql_1.parse)(query);
            const operationAST = (0, graphql_1.getOperationAST)(document);
            return operationAST?.name?.value;
        }
        catch (error) {
            core_1.Logger.error(`Error parsing GraphQL query: ${error}`);
            return undefined;
        }
    }
    isPublicOperation(operationName) {
        return this.options.allowedMethods.includes(operationName);
    }
    async isLoggedIn(req) {
        const session = await this.getSession(req);
        return !!session?.user;
    }
    async getSession(req) {
        const { tokenMethod } = this.configService.authOptions;
        const sessionToken = (0, core_1.extractSessionToken)(req, tokenMethod);
        return sessionToken
            ? await this.sessionService.getSessionFromToken(sessionToken)
            : undefined;
    }
};
exports.DisableAnonymousAccessMiddleware = DisableAnonymousAccessMiddleware;
exports.DisableAnonymousAccessMiddleware = DisableAnonymousAccessMiddleware = __decorate([
    (0, common_1.Injectable)(),
    __param(2, (0, common_1.Inject)(constants_1.DISABLE_ANONYMOUS_ACCESS_PLUGIN_OPTIONS)),
    __metadata("design:paramtypes", [core_1.SessionService,
        core_1.ConfigService, Object])
], DisableAnonymousAccessMiddleware);