Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@furystack/repository
Advanced tools
Repository implementation for FuryStack. With a repository, you can implement entity-level business logic in an easy and structured way. You can authorize, manipulate and observe CRUD operations.
You can set up a repository in the following way
class MyModel {
declare id: number
declare value: string
}
const myInjector = new Injector()
myInjector
.setupStores((stores) => stores.addStore(new InMemoryStore({ model: MyModel, primaryKey: 'id' })))
.setupRepository((repo) =>
repo.createDataSet(MyModel, {
onEntityAdded: ({ injector, entity }) => {
injector.logger.verbose({ message: `An entity added with value '${entity.value}'` })
},
authorizeUpdate: async () => ({
isAllowed: false,
message: 'This is a read only dataset. No update is allowed. :(',
}),
/** custom repository options */
}),
)
In the following example we've created a physical InMemory store for the model MyModel, and we've configured a Repository with a DataSet. It will log to a logger when an entity has been added and it won't allow us to update entities.
A DataSet is similar to a physical store, but it can have custom event callbacks and authorization logic. You can retrieve the dataset in a following way:
const dataSet = myInjector.getDataSetFor(MyModel)
dataSet.add(myInjector, { id: 1, value: 'foo' }) // <-- this will log to a logger
dataSet.update(myInjector, 1, { id: 1, value: 'bar' }) // <--- this one will be rejected
Events are great for logging / monitoring DataSet changes or distribute changes to clients. They are simple optional callbacks - if they are defined, they will be called on a specific event. These events are onEntityAdded
, onEntityUpdated
and onEntityRemoved
Authorizers are similar callbacks but they have to return a promise with an AuthorizationResult
object - you can allow or deny CRUD operations or add additional filters to collections with these Authorize callbacks. These areauthorizeAdd
, authorizeUpdate
, authorizeUpdateEntity
(this needs an additional reload of entity but can compare with the original one), authorizeRemove
, authroizeRemoveEntity
(also needs reloading), authorizeGet
,authorizeGetEntity
(also needs reloading),
There are some callbacks that modifies an entity before persisting (like modifyOnAdd
or modifyOnUpdate
). For example, you can fill createdByUser or lastModifiedByUser fields with these.
There is an additional property called addFilter
, you can use that to add a pre-filter condition before a filter expression will be evaluated in the data store - ensuring e.g. that the user can retrieve only suff from the physical store that she has enough permission.
All methods above has an injector instance on the call parameter - you can use that injector to get service instances from the right caller context. It means that you can use e.g.: HttpUserContext to getting the current user.
FAQs
Repository implementation for FuryStack
The npm package @furystack/repository receives a total of 139 weekly downloads. As such, @furystack/repository popularity was classified as not popular.
We found that @furystack/repository demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.