@3sixty/api-auth-entity-storage-service 0.0.0-stage → 0.20.0-next.0

package/dist/es/schema.js

@@ -0,0 +1,15 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { EntitySchemaFactory, EntitySchemaHelper } from "@3sixty/entity";
+import { AuthenticationAuditEntry } from "./entities/authenticationAuditEntry.js";
+import { AuthenticationRateEntry } from "./entities/authenticationRateEntry.js";
+import { AuthenticationUser } from "./entities/authenticationUser.js";
+/**
+ * Initialize the schema for the authentication service.
+ */
+export function initSchema() {
+    EntitySchemaFactory.register("AuthenticationUser", () => EntitySchemaHelper.getSchema(AuthenticationUser));
+    EntitySchemaFactory.register("AuthenticationAuditEntry", () => EntitySchemaHelper.getSchema(AuthenticationAuditEntry));
+    EntitySchemaFactory.register("AuthenticationRateEntry", () => EntitySchemaHelper.getSchema(AuthenticationRateEntry));
+}
+//# sourceMappingURL=schema.js.map

package/dist/es/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,UAAU;IACzB,mBAAmB,CAAC,QAAQ,uBAA+B,GAAG,EAAE,CAC/D,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAChD,CAAC;IACF,mBAAmB,CAAC,QAAQ,6BAAqC,GAAG,EAAE,CACrE,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,CAAC,CACtD,CAAC;IACF,mBAAmB,CAAC,QAAQ,4BAAoC,GAAG,EAAE,CACpE,kBAAkB,CAAC,SAAS,CAAC,uBAAuB,CAAC,CACrD,CAAC;AACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { EntitySchemaFactory, EntitySchemaHelper } from \"@3sixty/entity\";\nimport { nameof } from \"@3sixty/nameof\";\nimport { AuthenticationAuditEntry } from \"./entities/authenticationAuditEntry.js\";\nimport { AuthenticationRateEntry } from \"./entities/authenticationRateEntry.js\";\nimport { AuthenticationUser } from \"./entities/authenticationUser.js\";\n\n/**\n * Initialize the schema for the authentication service.\n */\nexport function initSchema(): void {\n\tEntitySchemaFactory.register(nameof<AuthenticationUser>(), () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationUser)\n\t);\n\tEntitySchemaFactory.register(nameof<AuthenticationAuditEntry>(), () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationAuditEntry)\n\t);\n\tEntitySchemaFactory.register(nameof<AuthenticationRateEntry>(), () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationRateEntry)\n\t);\n}\n"]}

package/dist/es/services/entityStorageAuthenticationAdminService.js

@@ -0,0 +1,323 @@
+import { AuthAuditEvent } from "@3sixty/api-auth-entity-storage-models";
+import { ForbiddenError, HttpContextIdKeys, ScopeHelper } from "@3sixty/api-models";
+import { ContextIdKeys, ContextIdStore } from "@3sixty/context";
+import { BaseError, ComponentFactory, Converter, GeneralError, Guards, Is, NotFoundError, RandomHelper } from "@3sixty/core";
+import { PasswordGenerator, PasswordValidator } from "@3sixty/crypto";
+import { EntityStorageConnectorFactory } from "@3sixty/entity-storage-models";
+import { PasswordHelper } from "../utils/passwordHelper.js";
+/**
+ * Implementation of the authentication component using entity storage.
+ */
+export class EntityStorageAuthenticationAdminService {
+    /**
+     * Runtime name for the class.
+     */
+    static CLASS_NAME = "EntityStorageAuthenticationAdminService";
+    /**
+     * The scope value that grants permission to assign privileged roles.
+     */
+    static DEFAULT_ESCALATED_PRIVILEGE_SCOPE = "global-admin";
+    /**
+     * The entity storage for users.
+     * @internal
+     */
+    _userEntityStorage;
+    /**
+     * The audit service.
+     * @internal
+     */
+    _authenticationAuditService;
+    /**
+     * The minimum password length.
+     * @internal
+     */
+    _minPasswordLength;
+    /**
+     * The scope value that grants permission to assign privileged roles.
+     * @internal
+     */
+    _escalatedPrivilegeScope;
+    /**
+     * Create a new instance of EntityStorageAuthentication.
+     * @param options The dependencies for the identity connector.
+     */
+    constructor(options) {
+        this._userEntityStorage = EntityStorageConnectorFactory.get(options?.userEntityStorageType ?? "authentication-user");
+        this._authenticationAuditService = ComponentFactory.getIfExists(options?.authenticationAuditServiceType ?? "authentication-audit");
+        this._minPasswordLength = options?.config?.minPasswordLength;
+        this._escalatedPrivilegeScope = Is.stringValue(options?.config?.escalatedPrivilegeScope)
+            ? options?.config?.escalatedPrivilegeScope
+            : EntityStorageAuthenticationAdminService.DEFAULT_ESCALATED_PRIVILEGE_SCOPE;
+    }
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className() {
+        return EntityStorageAuthenticationAdminService.CLASS_NAME;
+    }
+    /**
+     * Create a login for the user.
+     * @param user The user to create.
+     * @returns A promise that resolves when the user account has been created and the audit entry recorded.
+     */
+    async create(user) {
+        Guards.object(EntityStorageAuthenticationAdminService.CLASS_NAME, "user", user);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.email", user.email);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.password", user.password);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.userIdentity", user.userIdentity);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.organizationIdentity", user.organizationIdentity);
+        Guards.array(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.scope", user.scope);
+        await this.guardEscalatedPrivilegeScopeAssignment(user.scope);
+        try {
+            PasswordValidator.validatePassword(user.password, {
+                minLength: this._minPasswordLength
+            });
+            const existingUser = await this._userEntityStorage.get(user.email);
+            if (Is.object(existingUser)) {
+                throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userExists");
+            }
+            const saltBytes = RandomHelper.generate(16);
+            const passwordBytes = Converter.utf8ToBytes(user.password);
+            const hashedPassword = await PasswordGenerator.hashPassword(passwordBytes, saltBytes);
+            const newUser = {
+                email: user.email,
+                salt: Converter.bytesToBase64(saltBytes),
+                password: hashedPassword,
+                identity: user.userIdentity,
+                organization: user.organizationIdentity,
+                scope: ScopeHelper.toString(user.scope),
+                passwordVersion: 0
+            };
+            await this._userEntityStorage.set(newUser);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: user.email,
+                event: AuthAuditEvent.AccountCreated,
+                data: {
+                    userIdentity: user.userIdentity,
+                    organizationIdentity: user.organizationIdentity,
+                    tenantId: requestorTenantId,
+                    originalTenantId,
+                    scope: user.scope
+                }
+            });
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "createUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Update a login for the user.
+     * @param user The user to update.
+     * @returns A promise that resolves when the user account has been updated and the audit entry recorded.
+     */
+    async update(user) {
+        Guards.object(EntityStorageAuthenticationAdminService.CLASS_NAME, "user", user);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.email", user.email);
+        if (!Is.empty(user.userIdentity)) {
+            Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.userIdentity", user.userIdentity);
+        }
+        if (!Is.empty(user.organizationIdentity)) {
+            Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.organizationIdentity", user.organizationIdentity);
+        }
+        if (!Is.empty(user.scope)) {
+            Guards.array(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.scope", user.scope);
+            await this.guardEscalatedPrivilegeScopeAssignment(user.scope);
+        }
+        try {
+            const existingUser = await this._userEntityStorage.get(user.email);
+            if (!Is.object(existingUser)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", user.email);
+            }
+            await this.guardEscalatedPrivilegeTarget(existingUser.scope);
+            const updatedFields = [];
+            const updatedScope = Is.array(user.scope)
+                ? ScopeHelper.toString(user.scope)
+                : existingUser.scope;
+            if (user.userIdentity !== undefined && user.userIdentity !== existingUser.identity) {
+                updatedFields.push("userIdentity");
+            }
+            if (user.organizationIdentity !== undefined &&
+                user.organizationIdentity !== existingUser.organization) {
+                updatedFields.push("organizationIdentity");
+            }
+            if (Is.array(user.scope) && updatedScope !== existingUser.scope) {
+                updatedFields.push("scope");
+            }
+            existingUser.identity = user.userIdentity ?? existingUser.identity;
+            existingUser.organization = user.organizationIdentity ?? existingUser.organization;
+            existingUser.scope = Is.array(user.scope) ? updatedScope : existingUser.scope;
+            await this._userEntityStorage.set(existingUser);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: existingUser.email,
+                event: AuthAuditEvent.AccountUpdated,
+                data: {
+                    updatedFields,
+                    userIdentity: existingUser.identity,
+                    organizationIdentity: existingUser.organization,
+                    tenantId: requestorTenantId,
+                    originalTenantId,
+                    scope: ScopeHelper.toArray(existingUser.scope)
+                }
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "updateUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Get a user by email.
+     * @param email The email address of the user to get.
+     * @returns The user details.
+     */
+    async get(email) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            return {
+                email: user.email,
+                userIdentity: user.identity,
+                organizationIdentity: user.organization,
+                scope: ScopeHelper.toArray(user.scope)
+            };
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "getUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Get a user by identity.
+     * @param identity The identity of the user to get.
+     * @returns The user details.
+     */
+    async getByIdentity(identity) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "identity", identity);
+        try {
+            const user = await this._userEntityStorage.get(identity, "identity");
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", identity);
+            }
+            return {
+                email: user.email,
+                userIdentity: user.identity,
+                organizationIdentity: user.organization,
+                scope: ScopeHelper.toArray(user.scope)
+            };
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "getUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove the current user.
+     * @param email The email address of the user to remove.
+     * @returns A promise that resolves when the user account has been removed and the audit entry recorded.
+     */
+    async remove(email) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            await this.guardEscalatedPrivilegeTarget(user.scope);
+            await this._userEntityStorage.remove(email);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: email,
+                event: AuthAuditEvent.AccountDeleted,
+                data: {
+                    userIdentity: user.identity,
+                    organizationIdentity: user.organization,
+                    tenantId: requestorTenantId,
+                    originalTenantId,
+                    scope: ScopeHelper.toArray(user.scope)
+                }
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "removeUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Update the user's password.
+     * @param email The email address of the user to update.
+     * @param newPassword The new password for the user.
+     * @param currentPassword The current password, optional, if supplied will check against existing.
+     * @returns A promise that resolves when the password has been updated.
+     */
+    async updatePassword(email, newPassword, currentPassword) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "newPassword", newPassword);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            await this.guardEscalatedPrivilegeTarget(user.scope);
+            await PasswordHelper.updatePassword(this._userEntityStorage, this._authenticationAuditService, user, newPassword, currentPassword, this._minPasswordLength);
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "updatePasswordFailed", undefined, error);
+        }
+    }
+    /**
+     * Throws ForbiddenError when the given scope list includes the escalated privilege scope but
+     * the calling request does not hold that scope itself.
+     * @param scopeList The scopes being assigned.
+     * @internal
+     */
+    async guardEscalatedPrivilegeScopeAssignment(scopeList) {
+        if (!ScopeHelper.includes(scopeList, this._escalatedPrivilegeScope)) {
+            return;
+        }
+        if (!(await this.callerHasEscalatedPrivilege())) {
+            throw new ForbiddenError(EntityStorageAuthenticationAdminService.CLASS_NAME, "insufficientScopeForEscalatedPrivilege", { scopeName: this._escalatedPrivilegeScope });
+        }
+    }
+    /**
+     * Throws ForbiddenError when the account being written to already holds the escalated privilege
+     * scope but the calling request does not hold that scope itself. Without this an admin with a
+     * lesser scope could reset the password of, remove, or demote a privileged account.
+     * @param targetScope The scopes currently held by the account being written to.
+     * @internal
+     */
+    async guardEscalatedPrivilegeTarget(targetScope) {
+        if (!ScopeHelper.includes(targetScope, this._escalatedPrivilegeScope)) {
+            return;
+        }
+        if (!(await this.callerHasEscalatedPrivilege())) {
+            throw new ForbiddenError(EntityStorageAuthenticationAdminService.CLASS_NAME, "insufficientScopeForEscalatedTarget", { scopeName: this._escalatedPrivilegeScope });
+        }
+    }
+    /**
+     * Does the calling request hold the escalated privilege scope.
+     * @returns True when the caller holds the escalated privilege scope.
+     * @internal
+     */
+    async callerHasEscalatedPrivilege() {
+        const contextIds = await ContextIdStore.getContextIds();
+        return ScopeHelper.includes(contextIds?.[HttpContextIdKeys.Scope], this._escalatedPrivilegeScope);
+    }
+}
+//# sourceMappingURL=entityStorageAuthenticationAdminService.js.map

package/dist/es/services/entityStorageAuthenticationAdminService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityStorageAuthenticationAdminService.js","sourceRoot":"","sources":["../../../src/services/entityStorageAuthenticationAdminService.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACN,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,MAAM,EACN,EAAE,EACF,aAAa,EACb,YAAY,EACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACN,6BAA6B,EAE7B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;GAEG;AACH,MAAM,OAAO,uCAAuC;IACnD;;OAEG;IACI,MAAM,CAAU,UAAU,6CAA6D;IAE9F;;OAEG;IACI,MAAM,CAAU,iCAAiC,GAAW,cAAc,CAAC;IAElF;;;OAGG;IACc,kBAAkB,CAA8C;IAEjF;;;OAGG;IACc,2BAA2B,CAAiC;IAE7E;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACc,wBAAwB,CAAS;IAElD;;;OAGG;IACH,YAAY,OAAoE;QAC/E,IAAI,CAAC,kBAAkB,GAAG,6BAA6B,CAAC,GAAG,CAC1D,OAAO,EAAE,qBAAqB,IAAI,qBAAqB,CACvD,CAAC;QAEF,IAAI,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,WAAW,CAC9D,OAAO,EAAE,8BAA8B,IAAI,sBAAsB,CACjE,CAAC;QAEF,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC;QAC7D,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,CAAC;YACvF,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB;YAC1C,CAAC,CAAC,uCAAuC,CAAC,iCAAiC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,uCAAuC,CAAC,UAAU,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,IAAgD;QACnE,MAAM,CAAC,MAAM,CACZ,uCAAuC,CAAC,UAAU,UAElD,IAAI,CACJ,CAAC;QACF,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,gBAElD,IAAI,CAAC,KAAK,CACV,CAAC;QACF,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,mBAElD,IAAI,CAAC,QAAQ,CACb,CAAC;QACF,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,uBAElD,IAAI,CAAC,YAAY,CACjB,CAAC;QACF,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,+BAElD,IAAI,CAAC,oBAAoB,CACzB,CAAC;QACF,MAAM,CAAC,KAAK,CACX,uCAAuC,CAAC,UAAU,gBAElD,IAAI,CAAC,KAAK,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9D,IAAI,CAAC;YACJ,iBAAiB,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACjD,SAAS,EAAE,IAAI,CAAC,kBAAkB;aAClC,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,EAAE,CAAC,MAAM,CAAqB,YAAY,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,YAAY,CAAC,uCAAuC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3D,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAEtF,MAAM,OAAO,GAAuB;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC;gBACxC,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,YAAY,EAAE,IAAI,CAAC,oBAAoB;gBACvC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACvC,eAAe,EAAE,CAAC;aAClB,CAAC;YAEF,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,gBAAgB,GAAG,UAAU,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC;gBAC9C,OAAO,EAAE,IAAI,CAAC,KAAK;gBACnB,KAAK,EAAE,cAAc,CAAC,cAAc;gBACpC,IAAI,EAAE;oBACL,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;oBAC/C,QAAQ,EAAE,iBAAiB;oBAC3B,gBAAgB;oBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;iBACjB;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,kBAAkB,EAClB,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,IAAkC;QACrD,MAAM,CAAC,MAAM,CACZ,uCAAuC,CAAC,UAAU,UAElD,IAAI,CACJ,CAAC;QACF,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,gBAElD,IAAI,CAAC,KAAK,CACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,uBAElD,IAAI,CAAC,YAAY,CACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,+BAElD,IAAI,CAAC,oBAAoB,CACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CACX,uCAAuC,CAAC,UAAU,gBAElD,IAAI,CAAC,KAAK,CACV,CAAC;YACF,MAAM,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAqB,YAAY,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,aAAa,CACtB,uCAAuC,CAAC,UAAU,EAClD,cAAc,EACd,IAAI,CAAC,KAAK,CACV,CAAC;YACH,CAAC;YAED,MAAM,IAAI,CAAC,6BAA6B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAE7D,MAAM,aAAa,GAAa,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAClC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;YAEtB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACpF,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;YACD,IACC,IAAI,CAAC,oBAAoB,KAAK,SAAS;gBACvC,IAAI,CAAC,oBAAoB,KAAK,YAAY,CAAC,YAAY,EACtD,CAAC;gBACF,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;gBACjE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ,CAAC;YACnE,YAAY,CAAC,YAAY,GAAG,IAAI,CAAC,oBAAoB,IAAI,YAAY,CAAC,YAAY,CAAC;YACnF,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;YAE9E,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEhD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,gBAAgB,GAAG,UAAU,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC;gBAC9C,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,KAAK,EAAE,cAAc,CAAC,cAAc;gBACpC,IAAI,EAAE;oBACL,aAAa;oBACb,YAAY,EAAE,YAAY,CAAC,QAAQ;oBACnC,oBAAoB,EAAE,YAAY,CAAC,YAAY;oBAC/C,QAAQ,EAAE,iBAAiB;oBAC3B,gBAAgB;oBAChB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;iBAC9C;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,kBAAkB,EAClB,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,KAAa;QAC7B,MAAM,CAAC,WAAW,CAAC,uCAAuC,CAAC,UAAU,WAAiB,KAAK,CAAC,CAAC;QAE7F,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAqB,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACtB,uCAAuC,CAAC,UAAU,EAClD,cAAc,EACd,KAAK,CACL,CAAC;YACH,CAAC;YAED,OAAO;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,YAAY;gBACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;aACtC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,eAAe,EACf,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,cAElD,QAAQ,CACR,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAqB,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACtB,uCAAuC,CAAC,UAAU,EAClD,cAAc,EACd,QAAQ,CACR,CAAC;YACH,CAAC;YAED,OAAO;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,YAAY;gBACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;aACtC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,eAAe,EACf,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa;QAChC,MAAM,CAAC,WAAW,CAAC,uCAAuC,CAAC,UAAU,WAAiB,KAAK,CAAC,CAAC;QAE7F,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAqB,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACtB,uCAAuC,CAAC,UAAU,EAClD,cAAc,EACd,KAAK,CACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,gBAAgB,GAAG,UAAU,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC;gBAC9C,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc,CAAC,cAAc;gBACpC,IAAI,EAAE;oBACL,YAAY,EAAE,IAAI,CAAC,QAAQ;oBAC3B,oBAAoB,EAAE,IAAI,CAAC,YAAY;oBACvC,QAAQ,EAAE,iBAAiB;oBAC3B,gBAAgB;oBAChB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;iBACtC;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,kBAAkB,EAClB,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CAC1B,KAAa,EACb,WAAmB,EACnB,eAAwB;QAExB,MAAM,CAAC,WAAW,CAAC,uCAAuC,CAAC,UAAU,WAAiB,KAAK,CAAC,CAAC;QAC7F,MAAM,CAAC,WAAW,CACjB,uCAAuC,CAAC,UAAU,iBAElD,WAAW,CACX,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAqB,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACtB,uCAAuC,CAAC,UAAU,EAClD,cAAc,EACd,KAAK,CACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErD,MAAM,cAAc,CAAC,cAAc,CAClC,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,2BAA2B,EAChC,IAAI,EACJ,WAAW,EACX,eAAe,EACf,IAAI,CAAC,kBAAkB,CACvB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,IAAI,YAAY,CACrB,uCAAuC,CAAC,UAAU,EAClD,sBAAsB,EACtB,SAAS,EACT,KAAK,CACL,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,sCAAsC,CAAC,SAAmB;QACvE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrE,OAAO;QACR,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,cAAc,CACvB,uCAAuC,CAAC,UAAU,EAClD,wCAAwC,EACxC,EAAE,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAC5C,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,6BAA6B,CAAC,WAA8B;QACzE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACvE,OAAO;QACR,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,cAAc,CACvB,uCAAuC,CAAC,UAAU,EAClD,qCAAqC,EACrC,EAAE,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAC5C,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,2BAA2B;QACxC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;QACxD,OAAO,WAAW,CAAC,QAAQ,CAC1B,UAAU,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EACrC,IAAI,CAAC,wBAAwB,CAC7B,CAAC;IACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type {\n\tIAuthenticationAdminComponent,\n\tIAuthenticationAuditComponent,\n\tIAuthenticationUser\n} from \"@3sixty/api-auth-entity-storage-models\";\nimport { AuthAuditEvent } from \"@3sixty/api-auth-entity-storage-models\";\nimport { ForbiddenError, HttpContextIdKeys, ScopeHelper } from \"@3sixty/api-models\";\nimport { ContextIdKeys, ContextIdStore } from \"@3sixty/context\";\nimport {\n\tBaseError,\n\tComponentFactory,\n\tConverter,\n\tGeneralError,\n\tGuards,\n\tIs,\n\tNotFoundError,\n\tRandomHelper\n} from \"@3sixty/core\";\nimport { PasswordGenerator, PasswordValidator } from \"@3sixty/crypto\";\nimport {\n\tEntityStorageConnectorFactory,\n\ttype IEntityStorageConnector\n} from \"@3sixty/entity-storage-models\";\nimport { nameof } from \"@3sixty/nameof\";\nimport type { AuthenticationUser } from \"../entities/authenticationUser.js\";\nimport type { IEntityStorageAuthenticationAdminServiceConstructorOptions } from \"../models/IEntityStorageAuthenticationAdminServiceConstructorOptions.js\";\nimport { PasswordHelper } from \"../utils/passwordHelper.js\";\n\n/**\n * Implementation of the authentication component using entity storage.\n */\nexport class EntityStorageAuthenticationAdminService implements IAuthenticationAdminComponent {\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = nameof<EntityStorageAuthenticationAdminService>();\n\n\t/**\n\t * The scope value that grants permission to assign privileged roles.\n\t */\n\tpublic static readonly DEFAULT_ESCALATED_PRIVILEGE_SCOPE: string = \"global-admin\";\n\n\t/**\n\t * The entity storage for users.\n\t * @internal\n\t */\n\tprivate readonly _userEntityStorage: IEntityStorageConnector<AuthenticationUser>;\n\n\t/**\n\t * The audit service.\n\t * @internal\n\t */\n\tprivate readonly _authenticationAuditService?: IAuthenticationAuditComponent;\n\n\t/**\n\t * The minimum password length.\n\t * @internal\n\t */\n\tprivate readonly _minPasswordLength?: number;\n\n\t/**\n\t * The scope value that grants permission to assign privileged roles.\n\t * @internal\n\t */\n\tprivate readonly _escalatedPrivilegeScope: string;\n\n\t/**\n\t * Create a new instance of EntityStorageAuthentication.\n\t * @param options The dependencies for the identity connector.\n\t */\n\tconstructor(options?: IEntityStorageAuthenticationAdminServiceConstructorOptions) {\n\t\tthis._userEntityStorage = EntityStorageConnectorFactory.get(\n\t\t\toptions?.userEntityStorageType ?? \"authentication-user\"\n\t\t);\n\n\t\tthis._authenticationAuditService = ComponentFactory.getIfExists<IAuthenticationAuditComponent>(\n\t\t\toptions?.authenticationAuditServiceType ?? \"authentication-audit\"\n\t\t);\n\n\t\tthis._minPasswordLength = options?.config?.minPasswordLength;\n\t\tthis._escalatedPrivilegeScope = Is.stringValue(options?.config?.escalatedPrivilegeScope)\n\t\t\t? options?.config?.escalatedPrivilegeScope\n\t\t\t: EntityStorageAuthenticationAdminService.DEFAULT_ESCALATED_PRIVILEGE_SCOPE;\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The class name of the component.\n\t */\n\tpublic className(): string {\n\t\treturn EntityStorageAuthenticationAdminService.CLASS_NAME;\n\t}\n\n\t/**\n\t * Create a login for the user.\n\t * @param user The user to create.\n\t * @returns A promise that resolves when the user account has been created and the audit entry recorded.\n\t */\n\tpublic async create(user: IAuthenticationUser & { password: string }): Promise<void> {\n\t\tGuards.object<IAuthenticationUser>(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user),\n\t\t\tuser\n\t\t);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.email),\n\t\t\tuser.email\n\t\t);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.password),\n\t\t\tuser.password\n\t\t);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.userIdentity),\n\t\t\tuser.userIdentity\n\t\t);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.organizationIdentity),\n\t\t\tuser.organizationIdentity\n\t\t);\n\t\tGuards.array<string>(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.scope),\n\t\t\tuser.scope\n\t\t);\n\n\t\tawait this.guardEscalatedPrivilegeScopeAssignment(user.scope);\n\n\t\ttry {\n\t\t\tPasswordValidator.validatePassword(user.password, {\n\t\t\t\tminLength: this._minPasswordLength\n\t\t\t});\n\n\t\t\tconst existingUser = await this._userEntityStorage.get(user.email);\n\t\t\tif (Is.object<AuthenticationUser>(existingUser)) {\n\t\t\t\tthrow new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, \"userExists\");\n\t\t\t}\n\n\t\t\tconst saltBytes = RandomHelper.generate(16);\n\t\t\tconst passwordBytes = Converter.utf8ToBytes(user.password);\n\n\t\t\tconst hashedPassword = await PasswordGenerator.hashPassword(passwordBytes, saltBytes);\n\n\t\t\tconst newUser: AuthenticationUser = {\n\t\t\t\temail: user.email,\n\t\t\t\tsalt: Converter.bytesToBase64(saltBytes),\n\t\t\t\tpassword: hashedPassword,\n\t\t\t\tidentity: user.userIdentity,\n\t\t\t\torganization: user.organizationIdentity,\n\t\t\t\tscope: ScopeHelper.toString(user.scope),\n\t\t\t\tpasswordVersion: 0\n\t\t\t};\n\n\t\t\tawait this._userEntityStorage.set(newUser);\n\n\t\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\t\tconst requestorTenantId = contextIds?.[ContextIdKeys.Tenant];\n\t\t\tconst originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];\n\t\t\tawait this._authenticationAuditService?.create({\n\t\t\t\tactorId: user.email,\n\t\t\t\tevent: AuthAuditEvent.AccountCreated,\n\t\t\t\tdata: {\n\t\t\t\t\tuserIdentity: user.userIdentity,\n\t\t\t\t\torganizationIdentity: user.organizationIdentity,\n\t\t\t\t\ttenantId: requestorTenantId,\n\t\t\t\t\toriginalTenantId,\n\t\t\t\t\tscope: user.scope\n\t\t\t\t}\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"createUserFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Update a login for the user.\n\t * @param user The user to update.\n\t * @returns A promise that resolves when the user account has been updated and the audit entry recorded.\n\t */\n\tpublic async update(user: Partial<IAuthenticationUser>): Promise<void> {\n\t\tGuards.object<IAuthenticationUser>(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user),\n\t\t\tuser\n\t\t);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(user.email),\n\t\t\tuser.email\n\t\t);\n\n\t\tif (!Is.empty(user.userIdentity)) {\n\t\t\tGuards.stringValue(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\tnameof(user.userIdentity),\n\t\t\t\tuser.userIdentity\n\t\t\t);\n\t\t}\n\t\tif (!Is.empty(user.organizationIdentity)) {\n\t\t\tGuards.stringValue(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\tnameof(user.organizationIdentity),\n\t\t\t\tuser.organizationIdentity\n\t\t\t);\n\t\t}\n\t\tif (!Is.empty(user.scope)) {\n\t\t\tGuards.array<string>(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\tnameof(user.scope),\n\t\t\t\tuser.scope\n\t\t\t);\n\t\t\tawait this.guardEscalatedPrivilegeScopeAssignment(user.scope);\n\t\t}\n\n\t\ttry {\n\t\t\tconst existingUser = await this._userEntityStorage.get(user.email);\n\t\t\tif (!Is.object<AuthenticationUser>(existingUser)) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\t\"userNotFound\",\n\t\t\t\t\tuser.email\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tawait this.guardEscalatedPrivilegeTarget(existingUser.scope);\n\n\t\t\tconst updatedFields: string[] = [];\n\t\t\tconst updatedScope = Is.array(user.scope)\n\t\t\t\t? ScopeHelper.toString(user.scope)\n\t\t\t\t: existingUser.scope;\n\n\t\t\tif (user.userIdentity !== undefined && user.userIdentity !== existingUser.identity) {\n\t\t\t\tupdatedFields.push(\"userIdentity\");\n\t\t\t}\n\t\t\tif (\n\t\t\t\tuser.organizationIdentity !== undefined &&\n\t\t\t\tuser.organizationIdentity !== existingUser.organization\n\t\t\t) {\n\t\t\t\tupdatedFields.push(\"organizationIdentity\");\n\t\t\t}\n\t\t\tif (Is.array(user.scope) && updatedScope !== existingUser.scope) {\n\t\t\t\tupdatedFields.push(\"scope\");\n\t\t\t}\n\n\t\t\texistingUser.identity = user.userIdentity ?? existingUser.identity;\n\t\t\texistingUser.organization = user.organizationIdentity ?? existingUser.organization;\n\t\t\texistingUser.scope = Is.array(user.scope) ? updatedScope : existingUser.scope;\n\n\t\t\tawait this._userEntityStorage.set(existingUser);\n\n\t\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\t\tconst requestorTenantId = contextIds?.[ContextIdKeys.Tenant];\n\t\t\tconst originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];\n\t\t\tawait this._authenticationAuditService?.create({\n\t\t\t\tactorId: existingUser.email,\n\t\t\t\tevent: AuthAuditEvent.AccountUpdated,\n\t\t\t\tdata: {\n\t\t\t\t\tupdatedFields,\n\t\t\t\t\tuserIdentity: existingUser.identity,\n\t\t\t\t\torganizationIdentity: existingUser.organization,\n\t\t\t\t\ttenantId: requestorTenantId,\n\t\t\t\t\toriginalTenantId,\n\t\t\t\t\tscope: ScopeHelper.toArray(existingUser.scope)\n\t\t\t\t}\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"updateUserFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Get a user by email.\n\t * @param email The email address of the user to get.\n\t * @returns The user details.\n\t */\n\tpublic async get(email: string): Promise<IAuthenticationUser> {\n\t\tGuards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, nameof(email), email);\n\n\t\ttry {\n\t\t\tconst user = await this._userEntityStorage.get(email);\n\t\t\tif (!Is.object<AuthenticationUser>(user)) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\t\"userNotFound\",\n\t\t\t\t\temail\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\temail: user.email,\n\t\t\t\tuserIdentity: user.identity,\n\t\t\t\torganizationIdentity: user.organization,\n\t\t\t\tscope: ScopeHelper.toArray(user.scope)\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"getUserFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Get a user by identity.\n\t * @param identity The identity of the user to get.\n\t * @returns The user details.\n\t */\n\tpublic async getByIdentity(identity: string): Promise<IAuthenticationUser> {\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(identity),\n\t\t\tidentity\n\t\t);\n\n\t\ttry {\n\t\t\tconst user = await this._userEntityStorage.get(identity, \"identity\");\n\t\t\tif (!Is.object<AuthenticationUser>(user)) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\t\"userNotFound\",\n\t\t\t\t\tidentity\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\temail: user.email,\n\t\t\t\tuserIdentity: user.identity,\n\t\t\t\torganizationIdentity: user.organization,\n\t\t\t\tscope: ScopeHelper.toArray(user.scope)\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"getUserFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Remove the current user.\n\t * @param email The email address of the user to remove.\n\t * @returns A promise that resolves when the user account has been removed and the audit entry recorded.\n\t */\n\tpublic async remove(email: string): Promise<void> {\n\t\tGuards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, nameof(email), email);\n\n\t\ttry {\n\t\t\tconst user = await this._userEntityStorage.get(email);\n\t\t\tif (!Is.object<AuthenticationUser>(user)) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\t\"userNotFound\",\n\t\t\t\t\temail\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tawait this.guardEscalatedPrivilegeTarget(user.scope);\n\n\t\t\tawait this._userEntityStorage.remove(email);\n\n\t\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\t\tconst requestorTenantId = contextIds?.[ContextIdKeys.Tenant];\n\t\t\tconst originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];\n\t\t\tawait this._authenticationAuditService?.create({\n\t\t\t\tactorId: email,\n\t\t\t\tevent: AuthAuditEvent.AccountDeleted,\n\t\t\t\tdata: {\n\t\t\t\t\tuserIdentity: user.identity,\n\t\t\t\t\torganizationIdentity: user.organization,\n\t\t\t\t\ttenantId: requestorTenantId,\n\t\t\t\t\toriginalTenantId,\n\t\t\t\t\tscope: ScopeHelper.toArray(user.scope)\n\t\t\t\t}\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"removeUserFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Update the user's password.\n\t * @param email The email address of the user to update.\n\t * @param newPassword The new password for the user.\n\t * @param currentPassword The current password, optional, if supplied will check against existing.\n\t * @returns A promise that resolves when the password has been updated.\n\t */\n\tpublic async updatePassword(\n\t\temail: string,\n\t\tnewPassword: string,\n\t\tcurrentPassword?: string\n\t): Promise<void> {\n\t\tGuards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, nameof(email), email);\n\t\tGuards.stringValue(\n\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\tnameof(newPassword),\n\t\t\tnewPassword\n\t\t);\n\n\t\ttry {\n\t\t\tconst user = await this._userEntityStorage.get(email);\n\t\t\tif (!Is.object<AuthenticationUser>(user)) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\t\"userNotFound\",\n\t\t\t\t\temail\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tawait this.guardEscalatedPrivilegeTarget(user.scope);\n\n\t\t\tawait PasswordHelper.updatePassword(\n\t\t\t\tthis._userEntityStorage,\n\t\t\t\tthis._authenticationAuditService,\n\t\t\t\tuser,\n\t\t\t\tnewPassword,\n\t\t\t\tcurrentPassword,\n\t\t\t\tthis._minPasswordLength\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tthrow new GeneralError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"updatePasswordFailed\",\n\t\t\t\tundefined,\n\t\t\t\terror\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Throws ForbiddenError when the given scope list includes the escalated privilege scope but\n\t * the calling request does not hold that scope itself.\n\t * @param scopeList The scopes being assigned.\n\t * @internal\n\t */\n\tprivate async guardEscalatedPrivilegeScopeAssignment(scopeList: string[]): Promise<void> {\n\t\tif (!ScopeHelper.includes(scopeList, this._escalatedPrivilegeScope)) {\n\t\t\treturn;\n\t\t}\n\t\tif (!(await this.callerHasEscalatedPrivilege())) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"insufficientScopeForEscalatedPrivilege\",\n\t\t\t\t{ scopeName: this._escalatedPrivilegeScope }\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Throws ForbiddenError when the account being written to already holds the escalated privilege\n\t * scope but the calling request does not hold that scope itself. Without this an admin with a\n\t * lesser scope could reset the password of, remove, or demote a privileged account.\n\t * @param targetScope The scopes currently held by the account being written to.\n\t * @internal\n\t */\n\tprivate async guardEscalatedPrivilegeTarget(targetScope: string | string[]): Promise<void> {\n\t\tif (!ScopeHelper.includes(targetScope, this._escalatedPrivilegeScope)) {\n\t\t\treturn;\n\t\t}\n\t\tif (!(await this.callerHasEscalatedPrivilege())) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\tEntityStorageAuthenticationAdminService.CLASS_NAME,\n\t\t\t\t\"insufficientScopeForEscalatedTarget\",\n\t\t\t\t{ scopeName: this._escalatedPrivilegeScope }\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Does the calling request hold the escalated privilege scope.\n\t * @returns True when the caller holds the escalated privilege scope.\n\t * @internal\n\t */\n\tprivate async callerHasEscalatedPrivilege(): Promise<boolean> {\n\t\tconst contextIds = await ContextIdStore.getContextIds();\n\t\treturn ScopeHelper.includes(\n\t\t\tcontextIds?.[HttpContextIdKeys.Scope],\n\t\t\tthis._escalatedPrivilegeScope\n\t\t);\n\t}\n}\n"]}

package/dist/es/services/entityStorageAuthenticationAuditService.js

@@ -0,0 +1,240 @@
+import { HttpContextIdKeys } from "@3sixty/api-models";
+import { ContextIdStore, ContextIdKeys } from "@3sixty/context";
+import { Converter, GeneralError, Guards, Is, NotFoundError, RandomHelper, Validation } from "@3sixty/core";
+import { Sha256 } from "@3sixty/crypto";
+import { ComparisonOperator } from "@3sixty/entity";
+import { EntityStorageConnectorFactory } from "@3sixty/entity-storage-models";
+/**
+ * Implementation of the authentication audit component using entity storage.
+ */
+export class EntityStorageAuthenticationAuditService {
+    /**
+     * Runtime name for the class.
+     */
+    static CLASS_NAME = "EntityStorageAuthenticationAuditService";
+    /**
+     * The entity storage for authentication audit entries.
+     * @internal
+     */
+    _authenticationAuditEntryEntityStorage;
+    /**
+     * The server-side salt for hashing IP addresses in audit logs, if configured.
+     * @internal
+     */
+    _ipHashSalt;
+    /**
+     * Create a new instance of EntityStorageAuthenticationAuditService.
+     * @param options The dependencies for the identity connector.
+     */
+    constructor(options) {
+        this._authenticationAuditEntryEntityStorage = EntityStorageConnectorFactory.get(options?.authenticationAuditEntryStorageType ?? "authentication-audit-entry");
+        const salt = options?.config?.ipHashSalt?.trim();
+        if (Is.stringValue(salt)) {
+            const validationFailures = [];
+            Validation.stringValue("options.config.ipHashSalt", salt, validationFailures, undefined, { minLength: 32 });
+            const entropy = new Set(salt).size;
+            if (entropy < 8) {
+                validationFailures.push({
+                    property: "options.config.ipHashSalt",
+                    reason: "validation.saltEntropyTooLow"
+                });
+            }
+            Validation.asValidationError(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.config.ipHashSalt", validationFailures);
+            this._ipHashSalt = salt;
+        }
+    }
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className() {
+        return EntityStorageAuthenticationAuditService.CLASS_NAME;
+    }
+    /**
+     * Create a new audit entry.
+     * @param entry The audit entry to be logged.
+     * @returns The unique identifier of the created audit entry.
+     */
+    async create(entry) {
+        Guards.object(EntityStorageAuthenticationAuditService.CLASS_NAME, "entry", entry);
+        Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "entry.event", entry.event);
+        const contextIds = await ContextIdStore.getContextIds();
+        const newAuditEntry = {
+            id: RandomHelper.generateUuidV7("compact"),
+            dateCreated: new Date().toISOString(),
+            event: entry.event,
+            actorId: entry.actorId ?? contextIds?.[ContextIdKeys.User],
+            nodeId: entry.nodeId ?? contextIds?.[ContextIdKeys.Node],
+            organizationId: entry.organizationId ?? contextIds?.[ContextIdKeys.Organization],
+            tenantId: entry.tenantId ?? contextIds?.[ContextIdKeys.Tenant],
+            data: entry.data,
+            ipAddressHashes: this.hashIpAddresses(contextIds?.[HttpContextIdKeys.IpAddress]?.split("|")),
+            userAgent: contextIds?.[HttpContextIdKeys.UserAgent],
+            correlationId: contextIds?.[HttpContextIdKeys.CorrelationId]
+        };
+        try {
+            await this._authenticationAuditEntryEntityStorage.set(newAuditEntry);
+        }
+        catch {
+            // Best-effort audit logging: do not interrupt auth/admin flows if persistence fails.
+        }
+        return newAuditEntry.id;
+    }
+    /**
+     * Get an audit entry by id.
+     * @param id The unique identifier of the audit entry.
+     * @returns The audit entry.
+     */
+    async get(id) {
+        Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "id", id);
+        try {
+            const entry = await this._authenticationAuditEntryEntityStorage.get(id);
+            if (Is.empty(entry)) {
+                throw new NotFoundError(EntityStorageAuthenticationAuditService.CLASS_NAME, "auditEntryNotFound", id);
+            }
+            return entry;
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAuditService.CLASS_NAME, "getAuditEntryFailed", undefined, error);
+        }
+    }
+    /**
+     * Update an audit entry.
+     * @param id The unique identifier of the audit entry to update.
+     * @param entry The fields to update on the audit entry.
+     * @returns A promise that resolves when the audit entry has been updated.
+     */
+    async update(id, entry) {
+        Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "id", id);
+        Guards.object(EntityStorageAuthenticationAuditService.CLASS_NAME, "entry", entry);
+        try {
+            const existing = await this._authenticationAuditEntryEntityStorage.get(id);
+            if (Is.empty(existing)) {
+                throw new NotFoundError(EntityStorageAuthenticationAuditService.CLASS_NAME, "auditEntryNotFound", id);
+            }
+            await this._authenticationAuditEntryEntityStorage.set({
+                ...existing,
+                ...entry,
+                id,
+                dateCreated: existing.dateCreated
+            });
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAuditService.CLASS_NAME, "updateAuditEntryFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove an audit entry.
+     * @param id The unique identifier of the audit entry to remove.
+     * @returns A promise that resolves when the audit entry has been removed.
+     */
+    async remove(id) {
+        Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "id", id);
+        try {
+            const existing = await this._authenticationAuditEntryEntityStorage.get(id);
+            if (Is.empty(existing)) {
+                throw new NotFoundError(EntityStorageAuthenticationAuditService.CLASS_NAME, "auditEntryNotFound", id);
+            }
+            await this._authenticationAuditEntryEntityStorage.remove(id);
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAuditService.CLASS_NAME, "removeAuditEntryFailed", undefined, error);
+        }
+    }
+    /**
+     * Query the audit entries.
+     * @param options The query options.
+     * @param options.actorId The actor identifier to filter the audit entries, optional.
+     * @param options.organizationId The organization identifier to filter the audit entries, optional.
+     * @param options.tenantId The tenant identifier to filter the audit entries, optional.
+     * @param options.nodeId The node identifier to filter the audit entries, optional.
+     * @param options.event The audit event to filter the audit entries, optional.
+     * @param options.startDate The start date to filter the audit entries, optional.
+     * @param options.endDate The end date to filter the audit entries, optional.
+     * @param cursor The cursor for pagination.
+     * @param limit The maximum number of entries to return.
+     * @returns The audit entries.
+     */
+    async query(options, cursor, limit) {
+        const conditions = [];
+        if (Is.object(options)) {
+            if (!Is.empty(options.actorId)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.actorId", options.actorId);
+                conditions.push({
+                    property: "actorId",
+                    value: options.actorId,
+                    comparison: ComparisonOperator.Equals
+                });
+            }
+            if (!Is.empty(options.organizationId)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.organizationId", options.organizationId);
+                conditions.push({
+                    property: "organizationId",
+                    value: options.organizationId,
+                    comparison: ComparisonOperator.Equals
+                });
+            }
+            if (!Is.empty(options.tenantId)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.tenantId", options.tenantId);
+                conditions.push({
+                    property: "tenantId",
+                    value: options.tenantId,
+                    comparison: ComparisonOperator.Equals
+                });
+            }
+            if (!Is.empty(options.nodeId)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.nodeId", options.nodeId);
+                conditions.push({
+                    property: "nodeId",
+                    value: options.nodeId,
+                    comparison: ComparisonOperator.Equals
+                });
+            }
+            if (!Is.empty(options.event)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.event", options.event);
+                conditions.push({
+                    property: "event",
+                    value: options.event,
+                    comparison: ComparisonOperator.Equals
+                });
+            }
+            if (!Is.empty(options.startDate)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.startDate", options.startDate);
+                conditions.push({
+                    property: "dateCreated",
+                    value: options.startDate,
+                    comparison: ComparisonOperator.GreaterThanOrEqual
+                });
+            }
+            if (!Is.empty(options.endDate)) {
+                Guards.stringValue(EntityStorageAuthenticationAuditService.CLASS_NAME, "options.endDate", options.endDate);
+                conditions.push({
+                    property: "dateCreated",
+                    value: options.endDate,
+                    comparison: ComparisonOperator.LessThanOrEqual
+                });
+            }
+        }
+        const result = await this._authenticationAuditEntryEntityStorage.query(conditions.length > 0 ? { conditions } : undefined, undefined, undefined, cursor, limit);
+        return {
+            entries: result.entities,
+            cursor: result.cursor
+        };
+    }
+    /**
+     * Hash a list of IP addresses using SHA-256.
+     * @param ipAddresses The IP addresses to hash.
+     * @returns The hexadecimal hashes of the salted IPs.
+     * @internal
+     */
+    hashIpAddresses(ipAddresses) {
+        if (!Is.stringValue(this._ipHashSalt) || !Is.array(ipAddresses)) {
+            return undefined;
+        }
+        return ipAddresses.map(ip => {
+            const hash = Sha256.sum256(Converter.utf8ToBytes(`${this._ipHashSalt}:${ip}`));
+            return Converter.bytesToHex(hash);
+        });
+    }
+}
+//# sourceMappingURL=entityStorageAuthenticationAuditService.js.map