Skip to main content
Version: 🚧 Canary

✅ Product validators

Product routes compose these shared validator factories. Each consumes injected route payload/context before the route pipeline runs.

Inventory​

ValidatorReadsSuccess conditionFailure / errorConsumers
isAuthenticated()context.authenticate (default getBearerTokenInfo) and request transportThe configured adapter authenticates the request.Shared invalid/missing-token contract: 401.createProductRoute, createProductBatchRoute, updateProductBatchRoute, deleteProductBatchRoute, updateProductRoute, deleteProductRoute, copyProductRoute, copyProductBatchRoute, getProductImageUploadUrlRoute, createProductImageRoute, deleteProductImageRoute, createProductVariantRoute, getProductVariantRoute, updateProductVariantRoute, deleteProductVariantRoute, createProductVariantBulkRoute, updateProductVariantBulkRoute, deleteProductVariantBulkRoute, findProductsByOrganizationIdRoute, getProductLikersRoute
checkIdentityType(['admin'])context.db.identities, configuration.identity.typeIds, token identityType equals configured admin type ID.500 missing DB/config; 401 invalid token; 403 lookup/type/authorization failure.createProductRoute, createProductBatchRoute, updateProductBatchRoute, deleteProductBatchRoute, updateProductRoute, deleteProductRoute, copyProductRoute, copyProductBatchRoute, getProductImageUploadUrlRoute, createProductImageRoute, deleteProductImageRoute, createProductVariantRoute, updateProductVariantRoute, deleteProductVariantRoute, createProductVariantBulkRoute, updateProductVariantBulkRoute, deleteProductVariantBulkRoute, getProductLikersRoute
hasOrgRolecontext.db.organizations, configuration.organization.roles, token identity, organization pathCaller is an owner, admin, or member.500 missing DB/config; 401 token; 400 ID; 403 authorization.findProductsByOrganizationIdRoute

Details​

isAuthenticated()​

Implementation

Signature: isAuthenticated(): Validator. Invoked as isAuthenticated(), this calls context.authenticate(payload) and defaults to getBearerTokenInfo when no adapter is injected. Product service injects bearer authentication for omitted authMode or 'bearer', and cookie authentication for 'cookie'; cookie mode requires host cookie parsing. Invalid or missing authentication is reported as 401.

Consumers: createProductRoute, createProductBatchRoute, updateProductBatchRoute, deleteProductBatchRoute, updateProductRoute, deleteProductRoute, copyProductRoute, copyProductBatchRoute, getProductImageUploadUrlRoute, createProductImageRoute, deleteProductImageRoute, createProductVariantRoute, getProductVariantRoute, updateProductVariantRoute, deleteProductVariantRoute, createProductVariantBulkRoute, updateProductVariantBulkRoute, deleteProductVariantBulkRoute, findProductsByOrganizationIdRoute, getProductLikersRoute.

checkIdentityType(['admin'])​

Implementation

Signature: checkIdentityType(['admin']): Validator. Every Product consumer invokes checkIdentityType(['admin']). It requires context.db.identities and configuration.identity.typeIds, authenticates the payload, loads the token identity, and compares its typeId with configuration.identity.typeIds.admin. It throws 500 for missing dependencies, 401 for an invalid user access token, and 403 for identity lookup, missing type, or authorization failure.

Consumers: createProductRoute, createProductBatchRoute, updateProductBatchRoute, deleteProductBatchRoute, updateProductRoute, deleteProductRoute, copyProductRoute, copyProductBatchRoute, getProductImageUploadUrlRoute, createProductImageRoute, deleteProductImageRoute, createProductVariantRoute, updateProductVariantRoute, deleteProductVariantRoute, createProductVariantBulkRoute, updateProductVariantBulkRoute, deleteProductVariantBulkRoute, getProductLikersRoute.

hasOrgRole​

Implementation

The Product route invokes hasOrgRole(['owner', 'admin', 'member'], ['params', 'requestParams', 'organizationId']). It authenticates the payload, loads that organization, and compares the caller membership role with configuration.organization.roles. It follows isAuthenticated() in the route, not checkIdentityType. It throws 500 for missing database/configuration, 401 for an invalid token, 400 for a missing organization ID, and 403 for lookup, membership, or role failure.

Consumers: findProductsByOrganizationIdRoute.