sessionUtils.ts

Go to the documentation of this file.

/**
 * Session utilities for server-side API routes
 * Extracts and validates session/store context from requests
 */
 
import { NextRequest } from 'next/server';
import { cookies } from 'next/headers';
import { Store, getStoreById } from '@/lib/stores';
 
export interface SessionData {
  userId: string;
  username: string;
  authenticated: boolean;
  role?: 'staff' | 'employee' | 'admin';
  storeId?: string;
  storeName?: string;
  storeUrl?: string;
  storeType?: 'management' | 'store';
  timestamp: number;
  apiKey?: string;
  fieldpineData?: any;
}
 
export interface RequestContext {
  session: SessionData;
  store: Store;
  isAuthenticated: boolean;
  isManagementPortal: boolean;
  isRetailStore: boolean;
}
 
/**
 * Get session data from request cookies
 */
export async function getSessionFromRequest(request?: NextRequest): Promise<SessionData | null> {
  try {
    const cookieStore = await cookies();
    const sessionCookie = cookieStore.get('fieldpine-session');
 
    if (!sessionCookie) {
      return null;
    }
 
    const sessionData: SessionData = JSON.parse(sessionCookie.value);
 
    // Check if session has expired (8 hours)
    const sessionAge = Date.now() - sessionData.timestamp;
    const maxAge = 8 * 60 * 60 * 1000; // 8 hours in milliseconds
 
    if (sessionAge > maxAge) {
      return null;
    }
 
    return sessionData;
  } catch (error) {
    console.error('[Session] Failed to parse session:', error);
    return null;
  }
}
 
/**
 * Get full request context including session and store info
 */
export async function getRequestContext(request?: NextRequest): Promise<RequestContext | null> {
  const session = await getSessionFromRequest(request);
 
  if (!session || !session.authenticated) {
    return null;
  }
 
  // Get store information
  const store = session.storeId ? getStoreById(session.storeId) : null;
 
  if (!store) {
    console.error('[Session] Store not found:', session.storeId);
    return null;
  }
 
  return {
    session,
    store,
    isAuthenticated: true,
    isManagementPortal: store.type === 'management',
    isRetailStore: store.type === 'store',
  };
}
 
/**
 * Get store URL for API requests
 * Returns the appropriate base URL based on request type
 */
export function getStoreApiUrl(context: RequestContext, requestType: 'openapi' | 'gnap' | 'elink' = 'openapi'): string {
  switch (requestType) {
    case 'openapi':
      if (context.isManagementPortal) {
        throw new Error('OpenAPI endpoints are not available in management portal mode');
      }
      return context.store.url;
    
    case 'gnap':
      // GNAP requests always go to IIG for central operations
      return 'https://iig.cwanz.online';
    
    case 'elink':
      // ELINK goes to current store
      return context.store.url;
    
    default:
      return context.store.url;
  }
}
 
/**
 * Validate that a request is allowed for the current store context
 */
export function validateStoreAccess(
  context: RequestContext,
  requiredStoreType?: 'store' | 'management'
): { valid: boolean; error?: string } {
  if (requiredStoreType && context.store.type !== requiredStoreType) {
    return {
      valid: false,
      error: `This operation requires ${requiredStoreType === 'store' ? 'a retail store' : 'management portal'} login`
    };
  }
 
  return { valid: true };
}
 
/**
 * Validate API endpoint access based on user role and store type
 * 
 * Security Rules:
 * - Retail stores: Can ONLY access ELINK endpoints for their own store
 * - Retail stores: CANNOT access OpenAPI or GNAP endpoints
 * - Management portal: Full access to all endpoints (OpenAPI, GNAP, ELINK)
 * 
 * @param context - Request context with session and store info (can be null)
 * @param requestType - The type of API endpoint being accessed
 * @returns Validation result with error message if access denied
 */
export function validateApiAccess(
  context: RequestContext | null,
  requestType: 'openapi' | 'gnap' | 'elink'
): { valid: boolean; error?: string; errorCode?: string } {
  // Check if context is null
  if (!context) {
    return {
      valid: false,
      error: 'Authentication required',
      errorCode: 'NO_CONTEXT'
    };
  }
 
  // Management portal has full access to everything
  if (context.isManagementPortal) {
    return { valid: true };
  }
 
  // Retail stores are restricted
  if (context.isRetailStore) {
    // Retail stores can ONLY use ELINK for their own store
    if (requestType === 'elink') {
      return { valid: true };
    }
 
    // Retail stores CANNOT access OpenAPI
    if (requestType === 'openapi') {
      return {
        valid: false,
        error: 'Access Denied: Retail stores cannot access OpenAPI endpoints. Only ELINK endpoints are permitted for store operations.',
        errorCode: 'STORE_OPENAPI_FORBIDDEN'
      };
    }
 
    // Retail stores CANNOT access GNAP (central management)
    if (requestType === 'gnap') {
      return {
        valid: false,
        error: 'Access Denied: Retail stores cannot access GNAP endpoints. These are restricted to management portal only.',
        errorCode: 'STORE_GNAP_FORBIDDEN'
      };
    }
  }
 
  return {
    valid: false,
    error: 'Access Denied: Invalid store type or request type',
    errorCode: 'INVALID_ACCESS'
  };
}
 
/**
 * Refresh the API key by re-authenticating with Fieldpine
 * Updates the session cookie with the new API key
 * 
 * @returns The new API key or null if refresh failed
 */
export async function refreshApiKey(context: RequestContext): Promise<string | null> {
  try {
    console.log('[Session] Refreshing API key due to 403 error...');
    
    // Import fieldpineServerApi to avoid circular dependency
    const { fieldpineServerApi } = require('./fieldpineApi');
    
    // Re-authenticate with the same credentials
    // Note: We don't have the password, so we'll need to use the existing session
    // to get a new API key via a special endpoint or token refresh
    
    // For now, the user will need to re-login
    // In a production system, you'd implement a refresh token mechanism
    
    console.log('[Session] API key refresh requires re-authentication. User must log in again.');
    return null;
  } catch (error) {
    console.error('[Session] Failed to refresh API key:', error);
    return null;
  }
}
 
/**
 * Create a Fieldpine API client configured for the current session's store
 * 
 * @example
 * const context = await getRequestContext(request);
 * const api = createFieldpineApiForStore(context, 'openapi');
 * const products = await api.apiCall('/Products', { cookie: context.session.apiKey });
 */
export function createFieldpineApiForStore(
  context: RequestContext,
  requestType: 'openapi' | 'gnap' | 'elink' = 'openapi'
): any {
  // Dynamically import to avoid circular dependencies
  const { FieldpineServerApi } = require('./fieldpineApi');
  const baseUrl = getStoreApiUrl(context, requestType);
  return new FieldpineServerApi(baseUrl);
}