✅ Common validators
Common validators compose cross-domain authentication and authorization rules against the standard route payload. Factories return a Validator; successful validators resolve without a value, while failures throw NodeblocksError.
Inventory
| Export | Kind | Inputs / reads | Success condition | Failure / error |
|---|---|---|---|---|
all | Validator composer | One or more validators and their route payload | Every validator succeeds in sequence. | Fails immediately with the first thrown error. |
checkIdentityType | Validator factory | Allowed type keys, auth adapter, identities collection, identity type configuration | The authenticated identity has an allowed configured type ID. | 500 setup, 401 token, or 403 identity/authorization error. |
isAuthenticated | Validator factory | context.authenticate, or Bearer fallback | The selected authentication adapter accepts the request. | Propagates the authentication adapter error. |
isSelf | Validator factory | Payload path and authenticated identity | The target ID exists and equals the token identity ID. | 401 invalid token or 403 missing/nonmatching identity ID. |
Resource | Type | N/A | Names a collection accepted by ownsResource. | N/A |
getResourceById | Query helper | MongoDB collection and public resource ID | Returns the matching document or null in ResultAsync. | Database rejection is returned as unknown. |
ownsResource | Validator factory | Resource name, owner path, resource-ID payload path, auth and database context | The fetched resource owner equals the token identity ID. | 400, 401, 403, or 500 according to the failed prerequisite. |
some | Validator composer | One or more validators and their route payload | At least one validator succeeds. | Throws the first collected NodeblocksError; unknown rejections become 500 Unknown error. |
Details
all
Implementation
Signature: all(...args: Validator[]): Validator. The returned validator awaits each supplied validator in argument order and stops on the first rejection. With no arguments it succeeds immediately. Use it when every access condition must hold.
checkIdentityType
Implementation
Signature: checkIdentityType<T extends string>(allowedTypes: [T, ...T[]]): Validator. It requires db.identities and configuration.identity.typeIds, authenticates through context.authenticate or the Bearer fallback, loads the token identity, and compares its typeId with the configured IDs for the supplied keys.
Missing database or type configuration produces 500; an invalid user token produces 401; a failed identity lookup, missing type ID, or disallowed type produces 403. It is used directly and through some across Authentication, Category, Invitation, Location, Order, Organization, Product, Profile, and User routes.
isAuthenticated
Implementation
Signature: isAuthenticated(): Validator. It calls context.authenticate(payload) when a service supplies an adapter and otherwise calls the Bearer-token adapter. It does not inspect the returned token information; success and failure are defined by the selected adapter. See Authentication validators for Authentication route consumers.
isSelf
Implementation
Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. It requires a valid user access token, reads the target identity ID from the exact Ramda path supplied by the caller, and compares it with the token identityId. Missing targets and mismatches are 403. See Identity validators for domain route consumers.
Resource
Implementation
Resource is the union 'chatChannels' | 'chatMessages' | 'orders' | 'profiles' | 'subscriptions' | 'notifications'. It describes the database collection names supported by ownsResource.
getResourceById
Implementation
Signature: getResourceById(collection: Collection, id: string): ResultAsync<WithId<Document> | null, unknown>. It queries collection.findOne({ id: String(id) }); a missing record is a successful null, and a rejected database operation is captured as the original unknown error. The SDK currently exports this helper from the validators namespace even though source marks it for future conversion to a block.
ownsResource
Implementation
Signature: ownsResource(resource, ownerIdPathInResource, resourceIdPathInPayload): Validator. It requires a valid user access token, the selected database collection, and a resource ID at the supplied payload path. It loads the record with getResourceById, reads its owner at the supplied owner path, and succeeds only when that value equals the token identityId.
Failures are 401 Invalid token, 500 Resource does not exist, 400 Invalid resource ID, or 403 for a database error, missing owner ID, or ownership mismatch. Domain wrappers use this contract for Chat channels/messages, Orders, Profiles, Subscriptions, and Notifications; see the Chat ownership validators.
some
Implementation
Signature: some(...args: Validator[]): Validator. It starts every supplied validator concurrently with Promise.allSettled and succeeds when at least one fulfills. If all reject, it throws the first collected error in argument order; a non-NodeblocksError rejection is replaced with NodeblocksError(500, 'Unknown error', 'validator'). With no validators it resolves successfully because no errors are collected.
Routes use it for alternatives such as administrator-or-self and administrator-or-owner access. Consumers include Authentication validators, Chat validators, and corresponding Order, Product, Profile, Organization, and User routes.