@3sixty/api-auth-entity-storage-service 0.0.0-stage → 0.20.0-next.0

package/dist/es/processors/authHeaderProcessor.js

@@ -0,0 +1,277 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { HttpContextIdKeys, HttpErrorHelper } from "@3sixty/api-models";
+import { ContextIdHelper, ContextIdKeys, ContextIdStore } from "@3sixty/context";
+import { BaseError, Coerce, ComponentFactory, Converter, GeneralError, Is, LfuCache } from "@3sixty/core";
+import { Blake2b } from "@3sixty/crypto";
+import { EntityStorageConnectorFactory } from "@3sixty/entity-storage-models";
+import { VaultConnectorFactory } from "@3sixty/vault-models";
+import { CookieHelper, HeaderTypes, HttpStatusCode } from "@3sixty/web";
+import { TokenHelper } from "../utils/tokenHelper.js";
+/**
+ * Handle a JWT token in the authorization header or cookies and validate it to populate request context identity.
+ */
+export class AuthHeaderProcessor {
+    /**
+     * The default name for the access token as a cookie.
+     * @internal
+     */
+    static DEFAULT_COOKIE_NAME = "access_token";
+    /**
+     * Runtime name for the class.
+     */
+    static CLASS_NAME = "AuthHeaderProcessor";
+    /**
+     * The default time to keep a verified token in the cache.
+     * @internal
+     */
+    static _DEFAULT_TOKEN_CACHE_TTL_MS = 30000;
+    /**
+     * The vault for the keys.
+     * @internal
+     */
+    _vaultConnector;
+    /**
+     * The component to retrieve tenant information.
+     * @internal
+     */
+    _tenantAdminComponent;
+    /**
+     * The entity storage for users.
+     * @internal
+     */
+    _userEntityStorage;
+    /**
+     * The name of the key to retrieve from the vault for signing JWT.
+     * @internal
+     */
+    _signingKeyName;
+    /**
+     * The name of the cookie to use for the token.
+     * @internal
+     */
+    _cookieName;
+    /**
+     * Include the stack with errors.
+     * @internal
+     */
+    _includeErrorStack;
+    /**
+     * The cache of contexts resolved from verified tokens, undefined when caching is disabled.
+     * @internal
+     */
+    _tokenCache;
+    /**
+     * How long a cached token context may live, counted from when it was resolved.
+     * @internal
+     */
+    _tokenCacheTtlMs;
+    /**
+     * The node identity.
+     * @internal
+     */
+    _nodeId;
+    /**
+     * The organization ID for the single-tenant node, cached at startup.
+     * @internal
+     */
+    _nodeOrganizationId;
+    /**
+     * Create a new instance of AuthHeaderProcessor.
+     * @param options Options for the processor.
+     */
+    constructor(options) {
+        this._vaultConnector = VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
+        this._userEntityStorage = EntityStorageConnectorFactory.get(options?.userEntityStorageType ?? "authentication-user");
+        this._tenantAdminComponent = ComponentFactory.getIfExists(options?.tenantAdminComponentType ?? "tenant-admin");
+        this._signingKeyName = options?.config?.signingKeyName ?? "auth-signing";
+        this._cookieName = options?.config?.cookieName ?? AuthHeaderProcessor.DEFAULT_COOKIE_NAME;
+        this._includeErrorStack = options?.config?.includeErrorStack ?? false;
+        this._tokenCacheTtlMs =
+            options?.config?.tokenCacheTtlMs ?? AuthHeaderProcessor._DEFAULT_TOKEN_CACHE_TTL_MS;
+        if (this._tokenCacheTtlMs > 0) {
+            this._tokenCache = new LfuCache({
+                capacity: options?.config?.tokenCacheCapacity,
+                ttiMs: this._tokenCacheTtlMs,
+                mutexTimeoutMs: options?.config?.tokenCacheMutexTimeoutMs
+            });
+        }
+    }
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className() {
+        return AuthHeaderProcessor.CLASS_NAME;
+    }
+    /**
+     * The service needs to be started when the application is initialized.
+     * @param nodeLoggingComponentType The node logging component type.
+     * @returns A promise that resolves when the node identity and organization ID have been cached.
+     */
+    async start(nodeLoggingComponentType) {
+        const contextIds = await ContextIdStore.getContextIds();
+        ContextIdHelper.guard(contextIds, ContextIdKeys.Node);
+        this._nodeId = contextIds[ContextIdKeys.Node];
+        this._nodeOrganizationId = contextIds[ContextIdKeys.Organization];
+    }
+    /**
+     * Stop the processor and release the token cache.
+     * @returns A promise that resolves when the processor has stopped.
+     */
+    async stop() {
+        this._tokenCache?.destroy();
+    }
+    /**
+     * Pre process the REST request for the specified route.
+     * @param request The incoming request.
+     * @param response The outgoing response.
+     * @param route The route to process.
+     * @param contextIds The context IDs of the request.
+     * @param processorState The state handed through the processors.
+     * @returns A promise that resolves when the JWT has been verified and the context populated, or an error response set.
+     */
+    async pre(request, response, route, contextIds, processorState) {
+        if (!Is.empty(route) && !(route.skipAuth ?? false)) {
+            try {
+                if (!Is.stringValue(this._nodeId)) {
+                    throw new GeneralError(AuthHeaderProcessor.CLASS_NAME, "nodeIdNotSet");
+                }
+                const tokenAndLocation = TokenHelper.extractTokenFromHeaders(request.headers, this._cookieName);
+                const tokenContext = await this.resolveTokenContext(this._nodeId, tokenAndLocation?.token, contextIds);
+                // The scopes a route demands vary from route to route, so this is checked for every
+                // request and never forms part of the cached context.
+                TokenHelper.verifyScopes(tokenContext.scope, route.requiredScope);
+                contextIds[ContextIdKeys.Tenant] = tokenContext.tenantId;
+                // In a multi-tenant environment the tenant organization ID is authoritative,
+                // in a single-tenant environment we fall back to the node organization ID.
+                contextIds[ContextIdKeys.Organization] =
+                    tokenContext.tenantOrganizationId ?? this._nodeOrganizationId;
+                contextIds[ContextIdKeys.User] = tokenContext.userIdentity;
+                contextIds[ContextIdKeys.UserOrganization] = tokenContext.userOrganization;
+                contextIds[HttpContextIdKeys.Scope] = tokenContext.scope;
+                // If the tenant has a custom public origin, we set it in the context for downstream processors to use.
+                if (Is.stringValue(tokenContext.tenantPublicOrigin)) {
+                    contextIds[HttpContextIdKeys.PublicOrigin] = tokenContext.tenantPublicOrigin;
+                }
+                processorState.authToken = tokenAndLocation?.token;
+                processorState.authTokenLocation = tokenAndLocation?.location;
+            }
+            catch (err) {
+                const error = BaseError.fromError(err);
+                HttpErrorHelper.buildResponse(response, error, HttpStatusCode.unauthorized, this._includeErrorStack);
+            }
+        }
+    }
+    /**
+     * Post process the REST request for the specified route.
+     * @param request The incoming request.
+     * @param response The outgoing response.
+     * @param route The route to process.
+     * @param contextIds The context IDs of the request.
+     * @param processorState The state handed through the processors.
+     * @returns A promise that resolves when the Set-Cookie header has been applied to the response if required.
+     */
+    async post(request, response, route, contextIds, processorState) {
+        const responseAuthOperation = processorState?.authOperation;
+        const responseAuthToken = processorState?.authToken;
+        // We don't populate the cookie if the incoming request was from an authorization header.
+        if (!Is.empty(route) &&
+            Is.stringValue(responseAuthOperation) &&
+            processorState.authTokenLocation !== "authorization") {
+            if ((responseAuthOperation === "login" || responseAuthOperation === "refresh") &&
+                Is.stringValue(responseAuthToken)) {
+                response.headers ??= {};
+                response.headers[HeaderTypes.SetCookie] = CookieHelper.createCookie(this._cookieName, responseAuthToken, {
+                    secure: true,
+                    httpOnly: true,
+                    sameSite: "None",
+                    path: "/"
+                });
+            }
+            else if (responseAuthOperation === "logout") {
+                response.headers ??= {};
+                response.headers[HeaderTypes.SetCookie] = CookieHelper.deleteCookie(this._cookieName, {
+                    secure: true,
+                    httpOnly: true,
+                    sameSite: "None",
+                    path: "/"
+                });
+            }
+        }
+    }
+    /**
+     * Resolve the route independent context for a token, through the cache when one is enabled.
+     * @param nodeId The node identifier the token must have been issued by.
+     * @param token The token from the request, if there was one.
+     * @param contextIds The context IDs of the request.
+     * @returns The resolved context.
+     * @internal
+     */
+    async resolveTokenContext(nodeId, token, contextIds) {
+        if (Is.empty(this._tokenCache) || !Is.stringValue(token)) {
+            return this.verifyToken(nodeId, token, contextIds);
+        }
+        // Use hash of token so we don't store the raw token in memory.
+        const cacheKey = Converter.bytesToHex(Blake2b.sum256(Converter.utf8ToBytes(token)));
+        const tokenContext = await this._tokenCache.getOrSet(cacheKey, async () => this.verifyToken(nodeId, token, contextIds), Date.now() + this._tokenCacheTtlMs);
+        // A token can expire while its context sits in the cache.
+        if (Is.integer(tokenContext.expires) && tokenContext.expires <= Date.now()) {
+            this._tokenCache.delete(cacheKey);
+            return this.verifyToken(nodeId, token, contextIds);
+        }
+        return tokenContext;
+    }
+    /**
+     * Verify a token against the vault and resolve the tenant and user it refers to.
+     * @param nodeId The node identifier the token must have been issued by.
+     * @param token The token from the request, if there was one.
+     * @param contextIds The context IDs of the request.
+     * @returns The resolved context.
+     * @internal
+     */
+    async verifyToken(nodeId, token, contextIds) {
+        let user;
+        let tenantId;
+        let tenantOrganizationId;
+        let tenantPublicOrigin;
+        const { payload } = await TokenHelper.verify(this._vaultConnector, nodeId, this._signingKeyName, token, undefined, async (sub, org, tid, passwordVersion) => {
+            const validParts = [];
+            tenantId = tid;
+            if (Is.stringValue(tenantId)) {
+                const tenant = await this._tenantAdminComponent?.get(tenantId);
+                if (tenant?.id === tenantId) {
+                    validParts.push("tenant");
+                    tenantOrganizationId = tenant.organizationId;
+                    tenantPublicOrigin = tenant.publicOrigin;
+                }
+            }
+            // We use the tenant id from the token, if the user is not in that
+            // partition then the get will fail
+            const contextIdsForUserLookup = {
+                ...contextIds,
+                [ContextIdKeys.Tenant]: tid
+            };
+            // Wrap the user lookup in the request context so partitioned storage uses the correct tenant.
+            user = await ContextIdStore.run(contextIdsForUserLookup, async () => this._userEntityStorage.get(sub, "identity"));
+            if (user?.identity === sub && (passwordVersion ?? 0) === (user.passwordVersion ?? 0)) {
+                validParts.push("user");
+            }
+            if (user?.organization === org) {
+                validParts.push("organization");
+            }
+            return validParts;
+        });
+        const expiresSeconds = Coerce.integer(payload.exp);
+        return {
+            tenantId,
+            tenantOrganizationId,
+            tenantPublicOrigin,
+            userIdentity: user?.identity,
+            userOrganization: user?.organization,
+            scope: Coerce.string(payload.scope),
+            expires: Is.integer(expiresSeconds) ? expiresSeconds * 1000 : undefined
+        };
+    }
+}
+//# sourceMappingURL=authHeaderProcessor.js.map

package/dist/es/processors/authHeaderProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authHeaderProcessor.js","sourceRoot":"","sources":["../../../src/processors/authHeaderProcessor.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EACN,iBAAiB,EACjB,eAAe,EAMf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAoB,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACN,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,EAAE,EACF,QAAQ,EACR,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACN,6BAA6B,EAE7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAC/B;;;OAGG;IACI,MAAM,CAAU,mBAAmB,GAAW,cAAc,CAAC;IAEpE;;OAEG;IACI,MAAM,CAAU,UAAU,yBAAyC;IAE1E;;;OAGG;IACK,MAAM,CAAU,2BAA2B,GAAW,KAAK,CAAC;IAEpE;;;OAGG;IACc,eAAe,CAAkB;IAElD;;;OAGG;IACc,qBAAqB,CAAyB;IAE/D;;;OAGG;IACc,kBAAkB,CAA8C;IAEjF;;;OAGG;IACc,eAAe,CAAS;IAEzC;;;OAGG;IACc,WAAW,CAAS;IAErC;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACc,WAAW,CAA+B;IAE3D;;;OAGG;IACc,gBAAgB,CAAS;IAE1C;;;OAGG;IACK,OAAO,CAAU;IAEzB;;;OAGG;IACK,mBAAmB,CAAU;IAErC;;;OAGG;IACH,YAAY,OAAgD;QAC3D,IAAI,CAAC,eAAe,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC,CAAC;QACzF,IAAI,CAAC,kBAAkB,GAAG,6BAA6B,CAAC,GAAG,CAC1D,OAAO,EAAE,qBAAqB,IAAI,qBAAqB,CACvD,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,WAAW,CACxD,OAAO,EAAE,wBAAwB,IAAI,cAAc,CACnD,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,MAAM,EAAE,cAAc,IAAI,cAAc,CAAC;QACzE,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC,mBAAmB,CAAC;QAC1F,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,IAAI,KAAK,CAAC;QAEtE,IAAI,CAAC,gBAAgB;YACpB,OAAO,EAAE,MAAM,EAAE,eAAe,IAAI,mBAAmB,CAAC,2BAA2B,CAAC;QACrF,IAAI,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,QAAQ,CAAoB;gBAClD,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB;gBAC7C,KAAK,EAAE,IAAI,CAAC,gBAAgB;gBAC5B,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB;aACzD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,KAAK,CAAC,wBAAiC;QACnD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;QACxD,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CACf,OAA2B,EAC3B,QAAuB,EACvB,KAA6B,EAC7B,UAAuB,EACvB,cAAyC;QAEzC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC;gBACJ,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,YAAY,CAAC,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBACxE,CAAC;gBAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,uBAAuB,CAC3D,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,WAAW,CAChB,CAAC;gBAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAClD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAAE,KAAK,EACvB,UAAU,CACV,CAAC;gBAEF,oFAAoF;gBACpF,sDAAsD;gBACtD,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAElE,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC;gBACzD,6EAA6E;gBAC7E,2EAA2E;gBAC3E,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC;oBACrC,YAAY,CAAC,oBAAoB,IAAI,IAAI,CAAC,mBAAmB,CAAC;gBAC/D,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC;gBAC3D,UAAU,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,gBAAgB,CAAC;gBAC3E,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;gBAEzD,uGAAuG;gBACvG,IAAI,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACrD,UAAU,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC,kBAAkB,CAAC;gBAC9E,CAAC;gBAED,cAAc,CAAC,SAAS,GAAG,gBAAgB,EAAE,KAAK,CAAC;gBACnD,cAAc,CAAC,iBAAiB,GAAG,gBAAgB,EAAE,QAAQ,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACvC,eAAe,CAAC,aAAa,CAC5B,QAAQ,EACR,KAAK,EACL,cAAc,CAAC,YAAY,EAC3B,IAAI,CAAC,kBAAkB,CACvB,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,IAAI,CAChB,OAA2B,EAC3B,QAAuB,EACvB,KAA6B,EAC7B,UAAuB,EACvB,cAAyC;QAEzC,MAAM,qBAAqB,GAAG,cAAc,EAAE,aAAa,CAAC;QAC5D,MAAM,iBAAiB,GAAG,cAAc,EAAE,SAAS,CAAC;QAEpD,yFAAyF;QACzF,IACC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YAChB,EAAE,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACrC,cAAc,CAAC,iBAAiB,KAAK,eAAe,EACnD,CAAC;YACF,IACC,CAAC,qBAAqB,KAAK,OAAO,IAAI,qBAAqB,KAAK,SAAS,CAAC;gBAC1E,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAChC,CAAC;gBACF,QAAQ,CAAC,OAAO,KAAK,EAAE,CAAC;gBACxB,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC,YAAY,CAClE,IAAI,CAAC,WAAW,EAChB,iBAAiB,EACjB;oBACC,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,GAAG;iBACT,CACD,CAAC;YACH,CAAC;iBAAM,IAAI,qBAAqB,KAAK,QAAQ,EAAE,CAAC;gBAC/C,QAAQ,CAAC,OAAO,KAAK,EAAE,CAAC;gBACxB,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE;oBACrF,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,GAAG;iBACT,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAChC,MAAc,EACd,KAAyB,EACzB,UAAuB;QAEvB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CACnD,QAAQ,EACR,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EACvD,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAClC,CAAC;QAEF,0DAA0D;QAC1D,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,YAAY,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACxB,MAAc,EACd,KAAyB,EACzB,UAAuB;QAEvB,IAAI,IAAoC,CAAC;QACzC,IAAI,QAA4B,CAAC;QACjC,IAAI,oBAAwC,CAAC;QAC7C,IAAI,kBAAsC,CAAC;QAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAC3C,IAAI,CAAC,eAAe,EACpB,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,SAAS,EACT,KAAK,EACJ,GAAW,EACX,GAAW,EACX,GAAuB,EACvB,eAAmC,EAClC,EAAE;YACH,MAAM,UAAU,GAAG,EAAE,CAAC;YAEtB,QAAQ,GAAG,GAAG,CAAC;YAEf,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/D,IAAI,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC7B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC1B,oBAAoB,GAAG,MAAM,CAAC,cAAc,CAAC;oBAC7C,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC1C,CAAC;YACF,CAAC;YAED,kEAAkE;YAClE,mCAAmC;YACnC,MAAM,uBAAuB,GAAG;gBAC/B,GAAG,UAAU;gBACb,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG;aAC3B,CAAC;YAEF,8FAA8F;YAC9F,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE,CACnE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAC5C,CAAC;YAEF,IAAI,IAAI,EAAE,QAAQ,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,CAAC;gBACtF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,IAAI,EAAE,YAAY,KAAK,GAAG,EAAE,CAAC;gBAChC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,CAAC;YAED,OAAO,UAAU,CAAC;QACnB,CAAC,CACD,CAAC;QAEF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEnD,OAAO;YACN,QAAQ;YACR,oBAAoB;YACpB,kBAAkB;YAClB,YAAY,EAAE,IAAI,EAAE,QAAQ;YAC5B,gBAAgB,EAAE,IAAI,EAAE,YAAY;YACpC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC;IACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport {\n\tHttpContextIdKeys,\n\tHttpErrorHelper,\n\ttype IBaseRoute,\n\ttype IBaseRouteProcessor,\n\ttype IHttpResponse,\n\ttype IHttpServerRequest,\n\ttype ITenantAdminComponent\n} from \"@3sixty/api-models\";\nimport { ContextIdHelper, ContextIdKeys, ContextIdStore, type IContextIds } from \"@3sixty/context\";\nimport {\n\tBaseError,\n\tCoerce,\n\tComponentFactory,\n\tConverter,\n\tGeneralError,\n\tIs,\n\tLfuCache\n} from \"@3sixty/core\";\nimport { Blake2b } from \"@3sixty/crypto\";\nimport {\n\tEntityStorageConnectorFactory,\n\ttype IEntityStorageConnector\n} from \"@3sixty/entity-storage-models\";\nimport { nameof } from \"@3sixty/nameof\";\nimport { VaultConnectorFactory, type IVaultConnector } from \"@3sixty/vault-models\";\nimport { CookieHelper, HeaderTypes, HttpStatusCode } from \"@3sixty/web\";\nimport type { AuthenticationUser } from \"../entities/authenticationUser.js\";\nimport type { IAuthHeaderProcessorConstructorOptions } from \"../models/IAuthHeaderProcessorConstructorOptions.js\";\nimport type { IAuthTokenContext } from \"../models/IAuthTokenContext.js\";\nimport { TokenHelper } from \"../utils/tokenHelper.js\";\n\n/**\n * Handle a JWT token in the authorization header or cookies and validate it to populate request context identity.\n */\nexport class AuthHeaderProcessor implements IBaseRouteProcessor {\n\t/**\n\t * The default name for the access token as a cookie.\n\t * @internal\n\t */\n\tpublic static readonly DEFAULT_COOKIE_NAME: string = \"access_token\";\n\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = nameof<AuthHeaderProcessor>();\n\n\t/**\n\t * The default time to keep a verified token in the cache.\n\t * @internal\n\t */\n\tprivate static readonly _DEFAULT_TOKEN_CACHE_TTL_MS: number = 30000;\n\n\t/**\n\t * The vault for the keys.\n\t * @internal\n\t */\n\tprivate readonly _vaultConnector: IVaultConnector;\n\n\t/**\n\t * The component to retrieve tenant information.\n\t * @internal\n\t */\n\tprivate readonly _tenantAdminComponent?: ITenantAdminComponent;\n\n\t/**\n\t * The entity storage for users.\n\t * @internal\n\t */\n\tprivate readonly _userEntityStorage: IEntityStorageConnector<AuthenticationUser>;\n\n\t/**\n\t * The name of the key to retrieve from the vault for signing JWT.\n\t * @internal\n\t */\n\tprivate readonly _signingKeyName: string;\n\n\t/**\n\t * The name of the cookie to use for the token.\n\t * @internal\n\t */\n\tprivate readonly _cookieName: string;\n\n\t/**\n\t * Include the stack with errors.\n\t * @internal\n\t */\n\tprivate readonly _includeErrorStack: boolean;\n\n\t/**\n\t * The cache of contexts resolved from verified tokens, undefined when caching is disabled.\n\t * @internal\n\t */\n\tprivate readonly _tokenCache?: LfuCache<IAuthTokenContext>;\n\n\t/**\n\t * How long a cached token context may live, counted from when it was resolved.\n\t * @internal\n\t */\n\tprivate readonly _tokenCacheTtlMs: number;\n\n\t/**\n\t * The node identity.\n\t * @internal\n\t */\n\tprivate _nodeId?: string;\n\n\t/**\n\t * The organization ID for the single-tenant node, cached at startup.\n\t * @internal\n\t */\n\tprivate _nodeOrganizationId?: string;\n\n\t/**\n\t * Create a new instance of AuthHeaderProcessor.\n\t * @param options Options for the processor.\n\t */\n\tconstructor(options?: IAuthHeaderProcessorConstructorOptions) {\n\t\tthis._vaultConnector = VaultConnectorFactory.get(options?.vaultConnectorType ?? \"vault\");\n\t\tthis._userEntityStorage = EntityStorageConnectorFactory.get(\n\t\t\toptions?.userEntityStorageType ?? \"authentication-user\"\n\t\t);\n\t\tthis._tenantAdminComponent = ComponentFactory.getIfExists<ITenantAdminComponent>(\n\t\t\toptions?.tenantAdminComponentType ?? \"tenant-admin\"\n\t\t);\n\n\t\tthis._signingKeyName = options?.config?.signingKeyName ?? \"auth-signing\";\n\t\tthis._cookieName = options?.config?.cookieName ?? AuthHeaderProcessor.DEFAULT_COOKIE_NAME;\n\t\tthis._includeErrorStack = options?.config?.includeErrorStack ?? false;\n\n\t\tthis._tokenCacheTtlMs =\n\t\t\toptions?.config?.tokenCacheTtlMs ?? AuthHeaderProcessor._DEFAULT_TOKEN_CACHE_TTL_MS;\n\t\tif (this._tokenCacheTtlMs > 0) {\n\t\t\tthis._tokenCache = new LfuCache<IAuthTokenContext>({\n\t\t\t\tcapacity: options?.config?.tokenCacheCapacity,\n\t\t\t\tttiMs: this._tokenCacheTtlMs,\n\t\t\t\tmutexTimeoutMs: options?.config?.tokenCacheMutexTimeoutMs\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The class name of the component.\n\t */\n\tpublic className(): string {\n\t\treturn AuthHeaderProcessor.CLASS_NAME;\n\t}\n\n\t/**\n\t * The service needs to be started when the application is initialized.\n\t * @param nodeLoggingComponentType The node logging component type.\n\t * @returns A promise that resolves when the node identity and organization ID have been cached.\n\t */\n\tpublic async start(nodeLoggingComponentType?: string): Promise<void> {\n\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\tContextIdHelper.guard(contextIds, ContextIdKeys.Node);\n\t\tthis._nodeId = contextIds[ContextIdKeys.Node];\n\t\tthis._nodeOrganizationId = contextIds[ContextIdKeys.Organization];\n\t}\n\n\t/**\n\t * Stop the processor and release the token cache.\n\t * @returns A promise that resolves when the processor has stopped.\n\t */\n\tpublic async stop(): Promise<void> {\n\t\tthis._tokenCache?.destroy();\n\t}\n\n\t/**\n\t * Pre process the REST request for the specified route.\n\t * @param request The incoming request.\n\t * @param response The outgoing response.\n\t * @param route The route to process.\n\t * @param contextIds The context IDs of the request.\n\t * @param processorState The state handed through the processors.\n\t * @returns A promise that resolves when the JWT has been verified and the context populated, or an error response set.\n\t */\n\tpublic async pre(\n\t\trequest: IHttpServerRequest,\n\t\tresponse: IHttpResponse,\n\t\troute: IBaseRoute | undefined,\n\t\tcontextIds: IContextIds,\n\t\tprocessorState: { [id: string]: unknown }\n\t): Promise<void> {\n\t\tif (!Is.empty(route) && !(route.skipAuth ?? false)) {\n\t\t\ttry {\n\t\t\t\tif (!Is.stringValue(this._nodeId)) {\n\t\t\t\t\tthrow new GeneralError(AuthHeaderProcessor.CLASS_NAME, \"nodeIdNotSet\");\n\t\t\t\t}\n\n\t\t\t\tconst tokenAndLocation = TokenHelper.extractTokenFromHeaders(\n\t\t\t\t\trequest.headers,\n\t\t\t\t\tthis._cookieName\n\t\t\t\t);\n\n\t\t\t\tconst tokenContext = await this.resolveTokenContext(\n\t\t\t\t\tthis._nodeId,\n\t\t\t\t\ttokenAndLocation?.token,\n\t\t\t\t\tcontextIds\n\t\t\t\t);\n\n\t\t\t\t// The scopes a route demands vary from route to route, so this is checked for every\n\t\t\t\t// request and never forms part of the cached context.\n\t\t\t\tTokenHelper.verifyScopes(tokenContext.scope, route.requiredScope);\n\n\t\t\t\tcontextIds[ContextIdKeys.Tenant] = tokenContext.tenantId;\n\t\t\t\t// In a multi-tenant environment the tenant organization ID is authoritative,\n\t\t\t\t// in a single-tenant environment we fall back to the node organization ID.\n\t\t\t\tcontextIds[ContextIdKeys.Organization] =\n\t\t\t\t\ttokenContext.tenantOrganizationId ?? this._nodeOrganizationId;\n\t\t\t\tcontextIds[ContextIdKeys.User] = tokenContext.userIdentity;\n\t\t\t\tcontextIds[ContextIdKeys.UserOrganization] = tokenContext.userOrganization;\n\t\t\t\tcontextIds[HttpContextIdKeys.Scope] = tokenContext.scope;\n\n\t\t\t\t// If the tenant has a custom public origin, we set it in the context for downstream processors to use.\n\t\t\t\tif (Is.stringValue(tokenContext.tenantPublicOrigin)) {\n\t\t\t\t\tcontextIds[HttpContextIdKeys.PublicOrigin] = tokenContext.tenantPublicOrigin;\n\t\t\t\t}\n\n\t\t\t\tprocessorState.authToken = tokenAndLocation?.token;\n\t\t\t\tprocessorState.authTokenLocation = tokenAndLocation?.location;\n\t\t\t} catch (err) {\n\t\t\t\tconst error = BaseError.fromError(err);\n\t\t\t\tHttpErrorHelper.buildResponse(\n\t\t\t\t\tresponse,\n\t\t\t\t\terror,\n\t\t\t\t\tHttpStatusCode.unauthorized,\n\t\t\t\t\tthis._includeErrorStack\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Post process the REST request for the specified route.\n\t * @param request The incoming request.\n\t * @param response The outgoing response.\n\t * @param route The route to process.\n\t * @param contextIds The context IDs of the request.\n\t * @param processorState The state handed through the processors.\n\t * @returns A promise that resolves when the Set-Cookie header has been applied to the response if required.\n\t */\n\tpublic async post(\n\t\trequest: IHttpServerRequest,\n\t\tresponse: IHttpResponse,\n\t\troute: IBaseRoute | undefined,\n\t\tcontextIds: IContextIds,\n\t\tprocessorState: { [id: string]: unknown }\n\t): Promise<void> {\n\t\tconst responseAuthOperation = processorState?.authOperation;\n\t\tconst responseAuthToken = processorState?.authToken;\n\n\t\t// We don't populate the cookie if the incoming request was from an authorization header.\n\t\tif (\n\t\t\t!Is.empty(route) &&\n\t\t\tIs.stringValue(responseAuthOperation) &&\n\t\t\tprocessorState.authTokenLocation !== \"authorization\"\n\t\t) {\n\t\t\tif (\n\t\t\t\t(responseAuthOperation === \"login\" || responseAuthOperation === \"refresh\") &&\n\t\t\t\tIs.stringValue(responseAuthToken)\n\t\t\t) {\n\t\t\t\tresponse.headers ??= {};\n\t\t\t\tresponse.headers[HeaderTypes.SetCookie] = CookieHelper.createCookie(\n\t\t\t\t\tthis._cookieName,\n\t\t\t\t\tresponseAuthToken,\n\t\t\t\t\t{\n\t\t\t\t\t\tsecure: true,\n\t\t\t\t\t\thttpOnly: true,\n\t\t\t\t\t\tsameSite: \"None\",\n\t\t\t\t\t\tpath: \"/\"\n\t\t\t\t\t}\n\t\t\t\t);\n\t\t\t} else if (responseAuthOperation === \"logout\") {\n\t\t\t\tresponse.headers ??= {};\n\t\t\t\tresponse.headers[HeaderTypes.SetCookie] = CookieHelper.deleteCookie(this._cookieName, {\n\t\t\t\t\tsecure: true,\n\t\t\t\t\thttpOnly: true,\n\t\t\t\t\tsameSite: \"None\",\n\t\t\t\t\tpath: \"/\"\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Resolve the route independent context for a token, through the cache when one is enabled.\n\t * @param nodeId The node identifier the token must have been issued by.\n\t * @param token The token from the request, if there was one.\n\t * @param contextIds The context IDs of the request.\n\t * @returns The resolved context.\n\t * @internal\n\t */\n\tprivate async resolveTokenContext(\n\t\tnodeId: string,\n\t\ttoken: string | undefined,\n\t\tcontextIds: IContextIds\n\t): Promise<IAuthTokenContext> {\n\t\tif (Is.empty(this._tokenCache) || !Is.stringValue(token)) {\n\t\t\treturn this.verifyToken(nodeId, token, contextIds);\n\t\t}\n\n\t\t// Use hash of token so we don't store the raw token in memory.\n\t\tconst cacheKey = Converter.bytesToHex(Blake2b.sum256(Converter.utf8ToBytes(token)));\n\n\t\tconst tokenContext = await this._tokenCache.getOrSet(\n\t\t\tcacheKey,\n\t\t\tasync () => this.verifyToken(nodeId, token, contextIds),\n\t\t\tDate.now() + this._tokenCacheTtlMs\n\t\t);\n\n\t\t// A token can expire while its context sits in the cache.\n\t\tif (Is.integer(tokenContext.expires) && tokenContext.expires <= Date.now()) {\n\t\t\tthis._tokenCache.delete(cacheKey);\n\t\t\treturn this.verifyToken(nodeId, token, contextIds);\n\t\t}\n\n\t\treturn tokenContext;\n\t}\n\n\t/**\n\t * Verify a token against the vault and resolve the tenant and user it refers to.\n\t * @param nodeId The node identifier the token must have been issued by.\n\t * @param token The token from the request, if there was one.\n\t * @param contextIds The context IDs of the request.\n\t * @returns The resolved context.\n\t * @internal\n\t */\n\tprivate async verifyToken(\n\t\tnodeId: string,\n\t\ttoken: string | undefined,\n\t\tcontextIds: IContextIds\n\t): Promise<IAuthTokenContext> {\n\t\tlet user: AuthenticationUser | undefined;\n\t\tlet tenantId: string | undefined;\n\t\tlet tenantOrganizationId: string | undefined;\n\t\tlet tenantPublicOrigin: string | undefined;\n\n\t\tconst { payload } = await TokenHelper.verify(\n\t\t\tthis._vaultConnector,\n\t\t\tnodeId,\n\t\t\tthis._signingKeyName,\n\t\t\ttoken,\n\t\t\tundefined,\n\t\t\tasync (\n\t\t\t\tsub: string,\n\t\t\t\torg: string,\n\t\t\t\ttid: string | undefined,\n\t\t\t\tpasswordVersion: number | undefined\n\t\t\t) => {\n\t\t\t\tconst validParts = [];\n\n\t\t\t\ttenantId = tid;\n\n\t\t\t\tif (Is.stringValue(tenantId)) {\n\t\t\t\t\tconst tenant = await this._tenantAdminComponent?.get(tenantId);\n\t\t\t\t\tif (tenant?.id === tenantId) {\n\t\t\t\t\t\tvalidParts.push(\"tenant\");\n\t\t\t\t\t\ttenantOrganizationId = tenant.organizationId;\n\t\t\t\t\t\ttenantPublicOrigin = tenant.publicOrigin;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// We use the tenant id from the token, if the user is not in that\n\t\t\t\t// partition then the get will fail\n\t\t\t\tconst contextIdsForUserLookup = {\n\t\t\t\t\t...contextIds,\n\t\t\t\t\t[ContextIdKeys.Tenant]: tid\n\t\t\t\t};\n\n\t\t\t\t// Wrap the user lookup in the request context so partitioned storage uses the correct tenant.\n\t\t\t\tuser = await ContextIdStore.run(contextIdsForUserLookup, async () =>\n\t\t\t\t\tthis._userEntityStorage.get(sub, \"identity\")\n\t\t\t\t);\n\n\t\t\t\tif (user?.identity === sub && (passwordVersion ?? 0) === (user.passwordVersion ?? 0)) {\n\t\t\t\t\tvalidParts.push(\"user\");\n\t\t\t\t}\n\t\t\t\tif (user?.organization === org) {\n\t\t\t\t\tvalidParts.push(\"organization\");\n\t\t\t\t}\n\n\t\t\t\treturn validParts;\n\t\t\t}\n\t\t);\n\n\t\tconst expiresSeconds = Coerce.integer(payload.exp);\n\n\t\treturn {\n\t\t\ttenantId,\n\t\t\ttenantOrganizationId,\n\t\t\ttenantPublicOrigin,\n\t\t\tuserIdentity: user?.identity,\n\t\t\tuserOrganization: user?.organization,\n\t\t\tscope: Coerce.string(payload.scope),\n\t\t\texpires: Is.integer(expiresSeconds) ? expiresSeconds * 1000 : undefined\n\t\t};\n\t}\n}\n"]}

package/dist/es/restEntryPoints.js

@@ -0,0 +1,27 @@
+import { generateRestRoutesAuthenticationAdmin, tagsAuthenticationAdmin } from "./routes/entityStorageAuthenticationAdminRoutes.js";
+import { generateRestRoutesAuthenticationAudit, tagsAuthenticationAudit } from "./routes/entityStorageAuthenticationAuditRoutes.js";
+import { generateRestRoutesAuthentication, tagsAuthentication } from "./routes/entityStorageAuthenticationRoutes.js";
+/**
+ * REST entry points for the authentication, authentication admin, and authentication audit services.
+ */
+export const restEntryPoints = [
+    {
+        name: "authentication",
+        defaultBaseRoute: "authentication",
+        tags: tagsAuthentication,
+        generateRoutes: generateRestRoutesAuthentication
+    },
+    {
+        name: "authenticationAdmin",
+        defaultBaseRoute: "authentication/admin",
+        tags: tagsAuthenticationAdmin,
+        generateRoutes: generateRestRoutesAuthenticationAdmin
+    },
+    {
+        name: "authenticationAudit",
+        defaultBaseRoute: "authentication/audit",
+        tags: tagsAuthenticationAudit,
+        generateRoutes: generateRestRoutesAuthenticationAudit
+    }
+];
+//# sourceMappingURL=restEntryPoints.js.map

package/dist/es/restEntryPoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restEntryPoints.js","sourceRoot":"","sources":["../../src/restEntryPoints.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,qCAAqC,EACrC,uBAAuB,EACvB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACN,qCAAqC,EACrC,uBAAuB,EACvB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACN,gCAAgC,EAChC,kBAAkB,EAClB,MAAM,+CAA+C,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B;IACtD;QACC,IAAI,EAAE,gBAAgB;QACtB,gBAAgB,EAAE,gBAAgB;QAClC,IAAI,EAAE,kBAAkB;QACxB,cAAc,EAAE,gCAAgC;KAChD;IACD;QACC,IAAI,EAAE,qBAAqB;QAC3B,gBAAgB,EAAE,sBAAsB;QACxC,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,qCAAqC;KACrD;IACD;QACC,IAAI,EAAE,qBAAqB;QAC3B,gBAAgB,EAAE,sBAAsB;QACxC,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,qCAAqC;KACrD;CACD,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type { IRestRouteEntryPoint } from \"@3sixty/api-models\";\nimport {\n\tgenerateRestRoutesAuthenticationAdmin,\n\ttagsAuthenticationAdmin\n} from \"./routes/entityStorageAuthenticationAdminRoutes.js\";\nimport {\n\tgenerateRestRoutesAuthenticationAudit,\n\ttagsAuthenticationAudit\n} from \"./routes/entityStorageAuthenticationAuditRoutes.js\";\nimport {\n\tgenerateRestRoutesAuthentication,\n\ttagsAuthentication\n} from \"./routes/entityStorageAuthenticationRoutes.js\";\n\n/**\n * REST entry points for the authentication, authentication admin, and authentication audit services.\n */\nexport const restEntryPoints: IRestRouteEntryPoint[] = [\n\t{\n\t\tname: \"authentication\",\n\t\tdefaultBaseRoute: \"authentication\",\n\t\ttags: tagsAuthentication,\n\t\tgenerateRoutes: generateRestRoutesAuthentication\n\t},\n\t{\n\t\tname: \"authenticationAdmin\",\n\t\tdefaultBaseRoute: \"authentication/admin\",\n\t\ttags: tagsAuthenticationAdmin,\n\t\tgenerateRoutes: generateRestRoutesAuthenticationAdmin\n\t},\n\t{\n\t\tname: \"authenticationAudit\",\n\t\tdefaultBaseRoute: \"authentication/audit\",\n\t\ttags: tagsAuthenticationAudit,\n\t\tgenerateRoutes: generateRestRoutesAuthenticationAudit\n\t}\n];\n"]}