Steedos Builder6 Modules

Builder6 Modules: Auth, Files & Plugins

Authentication | 认证系统

Builder6 uses a multi-format token system: JWT, cookie-based sessions, and API keys. Enforced by NestJS guards from @builder6/core.

Token Formats

1. JWT (Bearer)

Authorization: Bearer <jwt>

Payload: { sub: userId, name, email, space: spaceId, profile }

2. Cookie-Based Session

Cookies: X-Space-Id, X-Auth-Token, X-User-Id, X-Access-Token Validated against hashed tokens in users.services.resume.loginTokens.

3. API Key

Authorization: Bearer apikey,<api-key-string>

Looked up in api_keys collection. Must be active: true.

Guards

AuthService Methods

• signIn(username, password?, space_id?): Find user → SHA256+bcrypt verify → generate JWT + login token → return { access_token, auth_token, ...space_user }
• getUserByToken(token): JWT decode / apikey lookup / cookie hash validation
• extractTokenFromHeaderOrCookie(request): Priority: Authorization header → cookies
• setAuthCookies(res, {...}): Sets 4 cookies (httpOnly: true, sameSite: 'strict', maxAge: 2 years)

Password Hashing

Client password → SHA256 hex digest → bcrypt compare against stored hash

User Context in Controllers

const user = req['user'];
// user._id, user.space, user.name, user.email, user.profile

MongoDB Collections

File System | 文件系统

The Files module (@builder6/files) provides file upload/download with local filesystem and AWS S3 support.

Storage Types

Collection Names

API Endpoints

Upload: POST /api/v6/files/:collectionName (multipart, AuthGuard)

• Fields: file (binary), object_name, record_id, parent

Download: GET /api/v6/files/:collectionName/:fileId[/:fileName]

• ?redirect=true (S3 signed URL), ?download=true (force attachment)
• Public collections (default: avatars) allow anonymous download

Direct Download: GET /api/v6/files/download/:collectionName/:fileId/:fileName

Presigned URLs: POST /api/v6/files/:collectionName/presigned-urls

• Body: { "records": ["fileId1", "fileId2"] } → { "urls": [...] }

File Record Schema

{
  "_id": "uuid",
  "original": { "type": "application/pdf", "size": 12345, "name": "invoice.pdf" },
  "metadata": { "owner": "userId", "space": "spaceId", "object_name": "orders", "record_id": "orderId" },
  "copies": { "files": { "name": "...", "key": "orders/2026/04/uuid-invoice.pdf" } }
}

S3 Configuration

B6_CFS_STORE=S3
B6_CFS_AWS_S3_ENDPOINT=https://s3.amazonaws.com
B6_CFS_AWS_S3_ACCESS_KEY_ID=...
B6_CFS_AWS_S3_SECRET_ACCESS_KEY=...
B6_CFS_AWS_S3_REGION=us-east-1
B6_CFS_AWS_S3_BUCKET=my-bucket

Plugin System | 插件系统

Plugins are NPM packages loaded at startup via environment variables.

Plugin Types

NestJS Module Plugins (B6_PLUGIN_MODULES):

B6_PLUGIN_MODULES=@builder6/plugin-custom,@myorg/plugin-erp

Each package exports a default NestJS module from dist/plugin.module.js.

Moleculer Service Plugins (B6_PLUGIN_PACKAGES):

B6_PLUGIN_PACKAGES=@steedos/service-custom@1.0.0,@steedos/service-report

Configuration

Plugin Directory

plugins/
├── package.json        # Auto-managed
├── .npmrc              # From B6_PLUGIN_NPMRC
└── node_modules/

Installation Lifecycle

1. Update .npmrc from B6_PLUGIN_NPMRC
2. Diff dependencies against plugins/package.json
3. npm install --omit=dev --no-audit (if changed)
4. Load NestJS modules → require dist/plugin.module.js
5. Load Moleculer services via MoleculerPluginService

Creating a NestJS Plugin

// src/plugin.module.ts
import { Module } from '@nestjs/common';

@Module({
  controllers: [...],
  providers: [...],
})
export default class MyPluginModule {}

Build to dist/plugin.module.js — this is the required entry point.