@3sixty/api-auth-entity-storage-service 0.0.0-stage → 0.20.0-next.0

package/docs/reference/functions/authenticationRefreshToken.md

@@ -0,0 +1,31 @@
+# Function: authenticationRefreshToken()
+
+> **authenticationRefreshToken**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IRefreshTokenResponse` & `IRestRouteResponseOptions`\>
+
+Refresh the login token.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IRefreshTokenRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IRefreshTokenResponse` & `IRestRouteResponseOptions`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationUpdatePassword.md

@@ -0,0 +1,31 @@
+# Function: authenticationUpdatePassword()
+
+> **authenticationUpdatePassword**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse`\>
+
+Update the user's password.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IUpdatePasswordRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/generateRestRoutesAuthentication.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthentication()
+
+> **generateRestRoutesAuthentication**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/generateRestRoutesAuthenticationAdmin.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthenticationAdmin()
+
+> **generateRestRoutesAuthenticationAdmin**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication admin.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/generateRestRoutesAuthenticationAudit.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthenticationAudit()
+
+> **generateRestRoutesAuthenticationAudit**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication audit.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/initSchema.md

@@ -0,0 +1,9 @@
+# Function: initSchema()
+
+> **initSchema**(): `void`
+
+Initialize the schema for the authentication service.
+
+## Returns
+
+`void`

package/docs/reference/index.md

@@ -0,0 +1,57 @@
+# @3sixty/api-auth-entity-storage-service
+
+## Classes
+
+- [AuthenticationAuditEntry](classes/AuthenticationAuditEntry.md)
+- [AuthenticationRateEntry](classes/AuthenticationRateEntry.md)
+- [AuthenticationUser](classes/AuthenticationUser.md)
+- [AuthHeaderProcessor](classes/AuthHeaderProcessor.md)
+- [EntityStorageAuthenticationAdminService](classes/EntityStorageAuthenticationAdminService.md)
+- [EntityStorageAuthenticationAuditService](classes/EntityStorageAuthenticationAuditService.md)
+- [EntityStorageAuthenticationRateService](classes/EntityStorageAuthenticationRateService.md)
+- [EntityStorageAuthenticationService](classes/EntityStorageAuthenticationService.md)
+- [PasswordHelper](classes/PasswordHelper.md)
+- [TokenHelper](classes/TokenHelper.md)
+
+## Interfaces
+
+- [IAuthHeaderProcessorConfig](interfaces/IAuthHeaderProcessorConfig.md)
+- [IAuthHeaderProcessorConstructorOptions](interfaces/IAuthHeaderProcessorConstructorOptions.md)
+- [IAuthTokenContext](interfaces/IAuthTokenContext.md)
+- [IEntityStorageAuthenticationAdminServiceConfig](interfaces/IEntityStorageAuthenticationAdminServiceConfig.md)
+- [IEntityStorageAuthenticationAdminServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationAuditServiceConfig](interfaces/IEntityStorageAuthenticationAuditServiceConfig.md)
+- [IEntityStorageAuthenticationAuditServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationRateServiceConfig](interfaces/IEntityStorageAuthenticationRateServiceConfig.md)
+- [IEntityStorageAuthenticationRateServiceConstructorOptions](interfaces/IEntityStorageAuthenticationRateServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationServiceConfig](interfaces/IEntityStorageAuthenticationServiceConfig.md)
+- [IEntityStorageAuthenticationServiceConstructorOptions](interfaces/IEntityStorageAuthenticationServiceConstructorOptions.md)
+
+## Variables
+
+- [restEntryPoints](variables/restEntryPoints.md)
+- [tagsAuthenticationAdmin](variables/tagsAuthenticationAdmin.md)
+- [tagsAuthenticationAudit](variables/tagsAuthenticationAudit.md)
+- [tagsAuthentication](variables/tagsAuthentication.md)
+
+## Functions
+
+- [generateRestRoutesAuthenticationAdmin](functions/generateRestRoutesAuthenticationAdmin.md)
+- [authenticationAdminCreateUser](functions/authenticationAdminCreateUser.md)
+- [authenticationAdminUpdateUser](functions/authenticationAdminUpdateUser.md)
+- [authenticationAdminUpdateUserPassword](functions/authenticationAdminUpdateUserPassword.md)
+- [authenticationAdminGetUser](functions/authenticationAdminGetUser.md)
+- [authenticationAdminGetUserByIdentity](functions/authenticationAdminGetUserByIdentity.md)
+- [authenticationAdminRemoveUser](functions/authenticationAdminRemoveUser.md)
+- [generateRestRoutesAuthenticationAudit](functions/generateRestRoutesAuthenticationAudit.md)
+- [authenticationAuditCreate](functions/authenticationAuditCreate.md)
+- [authenticationAuditGet](functions/authenticationAuditGet.md)
+- [authenticationAuditUpdate](functions/authenticationAuditUpdate.md)
+- [authenticationAuditRemove](functions/authenticationAuditRemove.md)
+- [authenticationAuditQuery](functions/authenticationAuditQuery.md)
+- [generateRestRoutesAuthentication](functions/generateRestRoutesAuthentication.md)
+- [authenticationLogin](functions/authenticationLogin.md)
+- [authenticationLogout](functions/authenticationLogout.md)
+- [authenticationRefreshToken](functions/authenticationRefreshToken.md)
+- [authenticationUpdatePassword](functions/authenticationUpdatePassword.md)
+- [initSchema](functions/initSchema.md)

package/docs/reference/interfaces/IAuthHeaderProcessorConfig.md

@@ -0,0 +1,86 @@
+# Interface: IAuthHeaderProcessorConfig
+
+Configuration for the authentication header processor
+
+## Properties
+
+### signingKeyName? {#signingkeyname}
+
+> `optional` **signingKeyName?**: `string`
+
+The name of the key to retrieve from the vault for signing JWT.
+
+#### Default
+
+```ts
+auth-signing
+```
+
+***
+
+### cookieName? {#cookiename}
+
+> `optional` **cookieName?**: `string`
+
+The name of the cookie to use for the token.
+
+#### Default
+
+```ts
+access_token
+```
+
+***
+
+### includeErrorStack? {#includeerrorstack}
+
+> `optional` **includeErrorStack?**: `boolean`
+
+Include the stack with errors.
+
+***
+
+### tokenCacheTtlMs? {#tokencachettlms}
+
+> `optional` **tokenCacheTtlMs?**: `number`
+
+The time in milliseconds a verified token is kept in the in-memory cache, counted from when it
+was verified and not extended by use, set to 0 to disable caching. A hit skips the vault
+signature check, the tenant lookup and the user lookup, so this is also the longest a password
+change, a user removal or a signing key rotation can go unnoticed. An entry never outlives the
+expiry claim of its own token either. The scopes a route requires are still checked for every
+request.
+
+#### Default
+
+```ts
+30000
+```
+
+***
+
+### tokenCacheCapacity? {#tokencachecapacity}
+
+> `optional` **tokenCacheCapacity?**: `number`
+
+The maximum number of verified tokens to hold in the in-memory cache.
+
+#### Default
+
+```ts
+undefined (LfuCache default)
+```
+
+***
+
+### tokenCacheMutexTimeoutMs? {#tokencachemutextimeoutms}
+
+> `optional` **tokenCacheMutexTimeoutMs?**: `number`
+
+Maximum time in milliseconds to wait for the token cache mutex during a cache population.
+
+#### Default
+
+```ts
+undefined (LfuCache default)
+```

package/docs/reference/interfaces/IAuthHeaderProcessorConstructorOptions.md

@@ -0,0 +1,53 @@
+# Interface: IAuthHeaderProcessorConstructorOptions
+
+Options for the AuthHeaderProcessor constructor.
+
+## Properties
+
+### userEntityStorageType? {#userentitystoragetype}
+
+> `optional` **userEntityStorageType?**: `string`
+
+The entity storage for users.
+
+#### Default
+
+```ts
+authentication-user
+```
+
+***
+
+### vaultConnectorType? {#vaultconnectortype}
+
+> `optional` **vaultConnectorType?**: `string`
+
+The vault for the private keys.
+
+#### Default
+
+```ts
+vault
+```
+
+***
+
+### tenantAdminComponentType? {#tenantadmincomponenttype}
+
+> `optional` **tenantAdminComponentType?**: `string`
+
+The component to retrieve tenant information.
+
+#### Default
+
+```ts
+tenant-admin
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IAuthHeaderProcessorConfig`](IAuthHeaderProcessorConfig.md)
+
+The configuration for the processor.

package/docs/reference/interfaces/IAuthTokenContext.md

@@ -0,0 +1,60 @@
+# Interface: IAuthTokenContext
+
+The context resolved from an access token, everything a request needs that does not depend on
+the route being called.
+
+## Properties
+
+### tenantId? {#tenantid}
+
+> `optional` **tenantId?**: `string`
+
+The tenant id from the token, if it carried one.
+
+***
+
+### tenantOrganizationId? {#tenantorganizationid}
+
+> `optional` **tenantOrganizationId?**: `string`
+
+The organization id of the tenant the token belongs to.
+
+***
+
+### tenantPublicOrigin? {#tenantpublicorigin}
+
+> `optional` **tenantPublicOrigin?**: `string`
+
+The public origin of the tenant the token belongs to.
+
+***
+
+### userIdentity? {#useridentity}
+
+> `optional` **userIdentity?**: `string`
+
+The identity of the verified user.
+
+***
+
+### userOrganization? {#userorganization}
+
+> `optional` **userOrganization?**: `string`
+
+The organization of the verified user.
+
+***
+
+### scope? {#scope}
+
+> `optional` **scope?**: `string`
+
+The comma separated scopes carried by the token.
+
+***
+
+### expires? {#expires}
+
+> `optional` **expires?**: `number`
+
+The expiry of the token in milliseconds since the epoch, if it carried one.

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConfig.md

@@ -0,0 +1,25 @@
+# Interface: IEntityStorageAuthenticationAdminServiceConfig
+
+Configuration for the entity storage authentication admin service.
+
+## Properties
+
+### minPasswordLength? {#minpasswordlength}
+
+> `optional` **minPasswordLength?**: `number`
+
+The minimum password length.
+
+#### Default
+
+```ts
+8
+```
+
+***
+
+### escalatedPrivilegeScope? {#escalatedprivilegescope}
+
+> `optional` **escalatedPrivilegeScope?**: `string`
+
+The scope value that grants escalated privilege to assign privileged roles. Defaults to "global-admin".

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md

@@ -0,0 +1,39 @@
+# Interface: IEntityStorageAuthenticationAdminServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationAdminService constructor.
+
+## Properties
+
+### userEntityStorageType? {#userentitystoragetype}
+
+> `optional` **userEntityStorageType?**: `string`
+
+The entity storage for the users.
+
+#### Default
+
+```ts
+authentication-user
+```
+
+***
+
+### authenticationAuditServiceType? {#authenticationauditservicetype}
+
+> `optional` **authenticationAuditServiceType?**: `string`
+
+The audit service.
+
+#### Default
+
+```ts
+authentication-audit
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)
+
+The configuration for the authentication.

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConfig.md

@@ -0,0 +1,11 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConfig
+
+Config for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### ipHashSalt? {#iphashsalt}
+
+> `optional` **ipHashSalt?**: `string`
+
+The server-side salt for hashing IP addresses in audit logs, if configured.

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md

@@ -0,0 +1,25 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### authenticationAuditEntryStorageType? {#authenticationauditentrystoragetype}
+
+> `optional` **authenticationAuditEntryStorageType?**: `string`
+
+The entity storage for the audit entries.
+
+#### Default
+
+```ts
+authentication-audit-entry
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAuditServiceConfig`](IEntityStorageAuthenticationAuditServiceConfig.md)
+
+The configuration for the authentication audit service.

package/docs/reference/interfaces/IEntityStorageAuthenticationRateServiceConfig.md

@@ -0,0 +1,17 @@
+# Interface: IEntityStorageAuthenticationRateServiceConfig
+
+Configuration for the entity storage authentication rate service.
+
+## Properties
+
+### cleanupIntervalMinutes? {#cleanupintervalminutes}
+
+> `optional` **cleanupIntervalMinutes?**: `number`
+
+Interval between cleanup runs in minutes.
+
+#### Default
+
+```ts
+5
+```

package/docs/reference/interfaces/IEntityStorageAuthenticationRateServiceConstructorOptions.md

@@ -0,0 +1,53 @@
+# Interface: IEntityStorageAuthenticationRateServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationRateService constructor.
+
+## Properties
+
+### authenticationRateEntryStorageType? {#authenticationrateentrystoragetype}
+
+> `optional` **authenticationRateEntryStorageType?**: `string`
+
+The entity storage for authentication rate entries.
+
+#### Default
+
+```ts
+authentication-rate-entry
+```
+
+***
+
+### taskSchedulerComponentType? {#taskschedulercomponenttype}
+
+> `optional` **taskSchedulerComponentType?**: `string`
+
+The task scheduler component type.
+
+#### Default
+
+```ts
+task-scheduler
+```
+
+***
+
+### platformComponentType? {#platformcomponenttype}
+
+> `optional` **platformComponentType?**: `string`
+
+The platform component type, used to run the periodic cleanup per tenant.
+
+#### Default
+
+```ts
+platform
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationRateServiceConfig`](IEntityStorageAuthenticationRateServiceConfig.md)
+
+The configuration for the authentication rate service.

package/docs/reference/interfaces/IEntityStorageAuthenticationServiceConfig.md

@@ -0,0 +1,87 @@
+# Interface: IEntityStorageAuthenticationServiceConfig
+
+Configuration for the entity storage authentication service.
+
+## Properties
+
+### signingKeyName? {#signingkeyname}
+
+> `optional` **signingKeyName?**: `string`
+
+The name of the key to retrieve from the vault for signing JWT.
+
+#### Default
+
+```ts
+auth-signing
+```
+
+***
+
+### defaultTtlMinutes? {#defaultttlminutes}
+
+> `optional` **defaultTtlMinutes?**: `number`
+
+The default time to live for the JWT.
+
+#### Default
+
+```ts
+60
+```
+
+***
+
+### minPasswordLength? {#minpasswordlength}
+
+> `optional` **minPasswordLength?**: `number`
+
+The minimum password length for new password validation.
+
+#### Default
+
+```ts
+8
+```
+
+***
+
+### loginRateLimit? {#loginratelimit}
+
+> `optional` **loginRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for login failure rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### passwordChangeRateLimit? {#passwordchangeratelimit}
+
+> `optional` **passwordChangeRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for password change rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### tokenRefreshRateLimit? {#tokenrefreshratelimit}
+
+> `optional` **tokenRefreshRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for token refresh rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 30, windowMinutes: 60 }
+```