โ Identity validators
Identity routes compose two shared access factories, while isSelf is the local reusable ownership validator. Validators receive the route payload, either complete normally or throw NodeblocksError; they are SDK guards, not Express middleware.
Inventoryโ
| Validator | Reads | Success condition | Failure / error | Consumers |
|---|---|---|---|---|
isSelf | context.authenticate or Bearer fallback; configured payload path | Target value equals the valid user tokenโs identityId | 401 invalid token; 403 missing or mismatched target | Authentication, Profile, Order, Organization, Notification, and Chat routes. |
isAuthenticated() | context.authenticate or Bearer fallback | Selected adapter resolves | Adapter error propagates | find, get, update, delete, lock, unlock |
checkIdentityType(['admin']) | auth adapter, db.identities, configuration.identity.typeIds | Valid user tokenโs loaded identity has configured admin type ID | 500 setup; 401 invalid token; 403 identity/type | find, get, update, delete, lock, unlock |
Detailsโ
isSelfโ
Implementation
Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. This factory selects context.authenticate or getBearerTokenInfo, calls it with the route payload, requires isValidUserAccessToken(tokenInfo), then reads path(identityIdPathInPayload, payload) with ramda. It compares that configured target valueโnot necessarily a field named identityIdโwith tokenInfo.identityId.
It throws NodeblocksError(401, 'Invalid token', 'isSelf') for a non-user token, NodeblocksError(403, 'Identity ID is required', 'isSelf') when the configured path has no value, and NodeblocksError(403, 'Identity ID does not match', 'isSelf') when the values differ.
Consumers: isSelf(...) is the self branch of some(checkIdentityType(['admin']), isSelf(...)) on Authenticationโs deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, and deactivateRoute, each with ['params', 'requestParams', 'identityId'] except deactivationโs ['params', 'requestBody', 'identityId']; Profileโs createProfileRoute with body identityId; Orderโs createOrderRoute with body identityId and findOrdersRoute with query identityId; Organizationโs findOrganizationsForMemberRoute with path identityId; and Chatโs createChatChannelRoute, findChatChannelsRoute, createChatSubscriptionRoute, and findChatSubscriptionsRoute. It runs directly on Profileโs findProfilesByIdentityIdRoute (path identityId; see Profile routes), Notificationโs findNotificationsRoute and updateNotificationToReadBatchRoute, Chatโs createChatMessageRoute, findChatMessagesRoute, and upsertChatChannelReadStateRoute. Chat uses ownerId, subscribedId, and senderId respectively; the remaining direct routes use identityId at the stated body, path, or query location.
Identity routes do not compose isSelf; they use the administrator check below.
isAuthenticated()โ
Implementation
This shared factory is documented canonically in Common validators. Signature: isAuthenticated(): Validator. Its validator selects context.authenticate or getBearerTokenInfo, invokes the selected adapter with the payload once, and does not inspect the returned value; any adapter error propagates unchanged.
Consumers: Identity calls isAuthenticated() first on findIdentitiesRoute, getIdentityRoute, updateIdentityRoute, deleteIdentityRoute, lockIdentityRoute, and unlockIdentityRoute. Other direct consumers are Address findAddressRoute, Attribute createAttributeRoute, updateAttributeRoute, deleteAttributeRoute, all Organization routes listed in its route reference, all Profile routes, all Order routes, Location createLocationRoute, updateLocationRoute, deleteLocationRoute, Authentication logoutRoute, deleteRefreshTokensRoute, generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute, activateRoute, Notification updateNotificationToReadRoute, findNotificationsRoute, updateNotificationToReadBatchRoute, Product create, batch, update, delete, copy, image, variant, organization-list, and liker routes, all Invitation routes, all Chat routes except the source-commented stream validator, and all Category routes.
checkIdentityType(['admin'])โ
Implementation
This shared factory is documented canonically in Common validators. Identityโs exact invocation is checkIdentityType(['admin']). It requires context.db.identities and context.configuration.identity.typeIds, selects context.authenticate or getBearerTokenInfo, requires a valid user access token, loads tokenInfo.identityId using getIdentityById, then compares the retrieved identityโs typeId with identityTypeIds.admin.
It throws 500 db.identities is not set or 500 configuration.identity.typeIds is not set; 401 Invalid token; 403 Failed to fetch identity, 403 Invalid identity type ID, or 403 Identity is not authorized to access this resource.
Consumers: Identity invokes checkIdentityType(['admin']) after isAuthenticated() on findIdentitiesRoute, getIdentityRoute, updateIdentityRoute, deleteIdentityRoute, lockIdentityRoute, and unlockIdentityRoute. Other direct ['admin'] consumers are Attribute createAttributeRoute, updateAttributeRoute, deleteAttributeRoute; all Organization routes in the route reference; all Profile routes except findProfilesByIdentityIdRoute; all Order routes except findOrdersByOrganizationIdRoute; Location createLocationRoute, updateLocationRoute, deleteLocationRoute; Authentication deleteRefreshTokensRoute, generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute, activateRoute; all administrator Product routes; all Invitation routes; the administrator Chat channel, message, template, and subscription routes; and all Category routes.