Changelog
2025-08-22
✨ Added
Blocks
- Organization:
buildOrganizationsWithDescendantsQuery: Builds a MongoDB query to find organizations by their own IDs or by ancestor IDs
2025-08-21
✨ Added
Utilities
- Authentication:
decryptAndVerifyJWT: decrypt and verify encrypted JWTstokenPassesSecurityCheck: validate fingerprint/IP/user-agent against tokendefaultRefreshTokenBodyAuth: validate refresh token from request bodydefaultRefreshTokenCookieAuth: validate refresh token from cookiesretrieveTokenVerification: build verification metadata from Express requestvalidateAuthSecrets: validate auth secrets configurationgenerateMailBody: interpolate URL and variables into email templateauthSecretsValidationErrorMessage: helper to map invalid secrets to a messageisAccessToken: check for access tokens (user or app)isUserAccessToken: check for user access tokensisAppAccessToken: check for app access tokensisRefreshToken: check for refresh tokensisOnetimeToken: check for one-time tokensisValidAppAccessToken: check app access token has appId presentisValidUserAccessToken: check user access token has identityId present
2025-08-20
✨ Added
Validators
- Authentication:
isAuthenticated: authenticate requests using bearer token
- Identity:
isSelf: ensure authenticated identity matches target identity
- Organization:
hasOrgRole: validate organization membership role
- Chat:
hasSubscription: require channel subscriptionownsSubscription: validate subscription ownershipownsChannel: validate channel ownershipownsMessage: validate message ownership
- Order:
ownsOrder: validate order ownership
- User:
ownsProfile: validate profile ownership
- Common:
checkIdentityType: gate access by identity typeownsResource: generic ownership validatorsome: compose validators with OR semantics- Legacy parameter validators (documented):
requireParam,isUUID,isNumber
- Category:
2025-08-14
🔄 Changed
Routes
sendVerificationEmailRoute: path changed to/auth/:identityId/send-verification-email(was:userId)
Features
emailVerificationFeature: uses/auth/:identityId/send-verification-emailendpointlockUserFeatures: API endpoint uses/identities/:identityId/lockunlockUserFeatures: API endpoint uses/identities/:identityId/unlock
2025-08-13
✨ Added
Blocks
- User:
getUserById: Retrieve user by ID with existence validationnormalizeUser: Remove MongoDB_idfield from user objectnormalizeUsers: Remove MongoDB_idfields from array of user objects
- Avatar:
normalizeAvatarOfOwner: Generate signed download URL from objectId and remove objectIdnormalizeAvatarsOfOwners: Normalize avatar data for multiple usersdeleteAvatarIfReplaced: Delete previous avatar file when objectId changes
🔄 Changed
Handlers (Deprecated)
- Authentication:
- Marked as deprecated with replacement notes in docs:
loginWithCredentials,createAccessToken,createRefreshToken,setResponseCookie,refreshToken,logout,checkToken,loginWithOnetimeToken,generateOnetimeToken,registerCredentials,confirmEmail,loginTerminator,logoutTerminator,registerTerminator,sendVerificationEmailTerminator,sendVerificationEmail - Replacement: use Authentication Blocks
- Marked as deprecated with replacement notes in docs:
- User:
- Marked as deprecated with replacement notes in docs:
createUser,getUserById,findUsers,updateUser,deleteUser,lockUser,unlockUser,normalizeUserTerminator,normalizeUsersListTerminator,deleteUserTerminator,lockUserTerminator,unlockUserTerminator - Replacement: use User Blocks
- Marked as deprecated with replacement notes in docs:
Validators (Deprecated)
- Authentication:
verifyAuthentication— Replacement:isAuthenticated
- User:
validateUserProfileAccess— Replacement:ownsProfile
- Organization:
validateOrganizationAccess— Replacement:hasOrgRole
- Order:
validateOrderAccess— Replacement:ownsOrder
- Chat:
validateChannelAccess— Replacement:ownsChannelvalidateMessageAccess— Replacement:ownsMessage
- Common:
validateResourceAccess— Replacement:isSelf,checkIdentityType
Authentication Docs
sendVerificationEmailRoute: path corrected to/auth/:identityId/send-verification-emailemailVerificationFeature: updated route and API Endpoint to use:identityIdAuthentication Blocks Index: summary updated to:identityId
Services
Authentication Service:- Token check response field corrected from
userIdtoidentityId
- Token check response field corrected from
2025-08-12
✨ Added
Schemas
- OAuth:
fpQueryParameter: Fingerprint query param for request correlationpurposeQueryParameter: Flow purpose (oauth-login|oauth-signup)redirectUrlQueryParameter: Client redirect destinationtypeIdQueryParameter: Optional identity type identifierstateQueryParameter: OAuth state for callback verificationgoogleOauthSchema: Initiation schema (empty JSON body)
Blocks
- OAuth:
requestGoogleOAuth: Initiate Google OAuth and generate signed stateauthenticateGoogleOAuth: Process provider callback and extract profileextractOAuthLoginState: Decode and validatestatetokenverifyGoogleOAuth: Resolve/create identity from Google profilegenerateRedirectURL: Build redirect URL with token
- Common:
redirectTo: Issue HTTP redirectsgenerateRandomPassword: Generate secure random passwords
- Organization:
generateSignedLogoUploadUrl: Create pre-signed upload URL for organization logo
Routes
- OAuth:
googleOAuthRoute: GET/auth/oauth/googlegoogleOAuthCallbackRoute: GET/auth/oauth/google/callback
- Organization:
getLogoUploadUrlRoute: GET/organizations/:organizationId/logo-upload-url
Features
- OAuth:
googleOAuthFeature: Composed initiation workflowgoogleOAuthCallbackFeature: Composed callback/redirect workflow
- Organization:
getLogoUploadUrlFeature: Composed workflow for organization logo upload URL generation
Drivers
- OAuth:
verifyGoogleCallback: Passport verify callback for GooglecreateGoogleOAuthDriver: Configure Passport strategy and helpers
🔄 Changed
Services
Authentication Service: Quickstart uses SDK drivers and correct stores/args- Import
driversfrom@nodeblocks/backend-sdk - Use
getMongoClient('mongodb://localhost:27017', 'dev') - Provide third argument as
{ mailService, googleOAuthDriver } - Datastore keys corrected to
identities,onetimetokens,invitations - Endpoint summary: added OAuth endpoints — GET
/auth/oauth/google, GET/auth/oauth/google/callback
- Import
2025-08-08
✨ Added
Blocks
getAvatarUploadUrlRoute: GET/user-profiles/:profileId/avatar-upload-urlfor secure avatar upload URL generationgetAvatarUploadUrlFeature: Composed workflow for avatar upload URL generation with schema validation
2025-08-07
✨ Added
Blocks
extractTokenFromAuthorizationHeader: Extract Bearer token from the Authorization headersoftDeleteRefreshTokens: Soft-delete all refresh tokens for an identity
Schemas
completePasswordResetSchema: Validate new password for reset completion
Routes
deactivateRoute: POST/auth/deactivateto deactivate account and invalidate tokenscompletePasswordResetRoute: POST/auth/reset-passwordto finalize password reset
Features
deactivateFeature: Composed workflow to deactivate accountcompletePasswordResetFeature: Composed workflow to finalize password reset
⚠️ Deprecated
requireParam,isUUID, andisNumbervalidators now use a legacy interface and are deprecated.- Prefer standard validators or custom validators using the normal payload signature.
- Details: see
requireParam,isUUID,isNumber.
🧩 Versioning
- Introduced SDK versioning for the backend documentation release.
- You can now select the Nodeblocks Backend SDK version from the right side of the navbar, next to the documentation version selector.
2025-08-06
✨ Added
Blocks
hash: Hash strings (passwords) using bcryptnormalizeIdentityWithoutPassword: Removepasswordand_idfrom identity objectssendEmail: Send emails with optional one-time tokenupdateIdentity: Update identity fields in datastorebuildUpdateIdentityActivatedPayload: Build activation payload to clear deactivation and unlock identityisEmailVerified: Ensure email is verified or return forbiddencheckOneTimeToken: Validate and decrypt one-time tokenscheckToken: Validate access/one-time tokens with security checks
Schemas
changePasswordSchema: Validate current and new passwordactivateSchema: Validate activation request
Routes
changePasswordRoute: PATCH/auth/:identityId/change-passwordto change passwordactivateRoute: POST/auth/activateto activate account
Features
changePasswordFeature: Composed workflow to change password
Combinators
applyPayloadArgs: Map payload data to block parametersorThrow: Throw mapped errors or pass value through
2025-07-29
✨ Added
- Database Drivers: Comprehensive documentation for database connection and configuration
- MongoDB driver documentation with connection examples
- Custom database driver interface requirements
- Mail Service Drivers: Complete documentation for email service configuration
- SendGrid driver documentation with API key configuration
- Mail data interface with HTML/text content requirements
- Mail service interface with status-based success handling
- File Storage Drivers: Detailed documentation for cloud storage operations
- Google Cloud Storage driver with signed URL generation
- File upload, download, and deletion URL examples
- cURL examples for testing signed URLs
- Content type validation and file size limits
- Driver Architecture: New drivers subdirectory under components
- Organized driver documentation in
docs/v2/backend/components/drivers/ - Separate documentation for database, mail service, and file storage drivers
- Consistent interface patterns across all driver types
- Organized driver documentation in
- Identity Service Documentation: Complete API documentation with live testing validation
- Full CRUD operations for identity management (GET, PATCH, DELETE)
- Real API response examples validated through cURL testing
- Admin-only access requirements with proper authorization documentation
- Schema-based request validation with actual response format documentation
- Error handling with HTTP status codes (401, 403, 404, 500)
- Integration examples using NodeBlocks database drivers
2025-07-28
✨ Added
- Organization blocks: pure business logic functions for organization management
applyPayloadArgsutility for mapping payload data to block parameters- File storage blocks: pure business logic functions for secure file management
generateSignedUploadUrlblock for creating secure upload URLsgenerateSignedDownloadUrlblock for creating secure download URLsgenerateSignedDeleteUrlblock for creating secure delete URLsgenerateSignedAvatarUploadUrlblock for avatar uploads with UUID generation- File storage schemas for image upload validation
- Authentication blocks: pure business logic functions for secure authentication
- Identity management blocks for user validation and email operations
- Token management blocks for secure token lifecycle management
- Email authentication blocks for verification and communication
- Security validation blocks for fingerprint tracking and request validation
- New authentication schemas for enhanced functionality:
changeEmailSchemafor email change validationcheckTokenSchemafor token validation with target contextconfirmNewEmailSchemafor new email confirmation validationsendResetPasswordLinkEmailSchemafor password reset email validation
- New authentication features for complete workflows:
changeEmailFeaturefor email change initiationcheckTokenFeaturefor token validation with target contextconfirmNewEmailFeaturefor new email confirmationsendResetPasswordLinkEmailFeaturefor password reset email generation
- New authentication routes using blocks:
changeEmailRoutefor email change initiationcheckTokenRoutefor token validationconfirmNewEmailRoutefor new email confirmationsendResetPasswordLinkEmailRoutefor password reset email sending
🔄 Changed
-
Migrated organization handlers to blocks:
createOrganization→createOrganizationblockgetOrganizationById→getOrganizationByIdblockfindOrganizations→findOrganizationsblockupdateOrganization→updateOrganizationblockdeleteOrganization→deleteOrganizationblockgetOrganizationUserRole→getOrganizationMemberRoleblockcheckOrganizationUserExistence→checkOrganizationMemberExistenceblockfindOrganizationUsers→findOrganizationMembersblockupsertOrganizationUsers→upsertOrganizationMembersblockdeleteOrganizationUser→deleteOrganizationMemberblockfindOrganizationsForUser→findOrganizationsForIdentityblock
-
Updated organization schema names and terminology:
organizationUsersSchema→organizationMembersSchemaupsertOrganizationUsersSchema→upsertOrganizationMembersSchemagetOrganizationUserRoleSchema→getOrganizationMemberRoleSchemacheckOrganizationUserExistenceSchema→checkOrganizationMemberExistenceSchemafindOrganizationUsersSchema→findOrganizationMembersSchemadeleteOrganizationUserSchema→deleteOrganizationMemberSchemafindOrganizationsForUserSchema→findOrganizationsForIdentitySchema- Parameter names updated:
userId→identityId - Member schema structure:
id→identityId
🐞 Breaking Changes
- Organization handlers removed - can no longer import them directly
- To use previous handler logic in custom routes, compose blocks using
applyPayloadArgs