@3sixty/api-auth-entity-storage-service 0.0.0-stage → 0.20.0-next.1

package/docs/reference/functions/authenticationLogout.md

@@ -0,0 +1,31 @@
+# Function: authenticationLogout()
+
+> **authenticationLogout**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse` & `IRestRouteResponseOptions`\>
+
+Logout from the server.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`ILogoutRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse` & `IRestRouteResponseOptions`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationPasswordPolicy.md

@@ -0,0 +1,31 @@
+# Function: authenticationPasswordPolicy()
+
+> **authenticationPasswordPolicy**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IPasswordPolicyResponse` & `IRestRouteResponseOptions`\>
+
+Get the password policy.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`INoContentRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IPasswordPolicyResponse` & `IRestRouteResponseOptions`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationRefreshToken.md

@@ -0,0 +1,31 @@
+# Function: authenticationRefreshToken()
+
+> **authenticationRefreshToken**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IRefreshTokenResponse` & `IRestRouteResponseOptions`\>
+
+Refresh the login token.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IRefreshTokenRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IRefreshTokenResponse` & `IRestRouteResponseOptions`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationUpdatePassword.md

@@ -0,0 +1,31 @@
+# Function: authenticationUpdatePassword()
+
+> **authenticationUpdatePassword**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse`\>
+
+Update the user's password.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IUpdatePasswordRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/generateRestRoutesAuthentication.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthentication()
+
+> **generateRestRoutesAuthentication**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/generateRestRoutesAuthenticationAdmin.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthenticationAdmin()
+
+> **generateRestRoutesAuthenticationAdmin**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication admin.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/initSchema.md

@@ -0,0 +1,9 @@
+# Function: initSchema()
+
+> **initSchema**(): `void`
+
+Initialize the schema for the authentication service.
+
+## Returns
+
+`void`

package/docs/reference/index.md

@@ -0,0 +1,44 @@
+# @3sixty/api-auth-entity-storage-service
+
+## Classes
+
+- [AuthenticationUser](classes/AuthenticationUser.md)
+- [AuthenticationUserV0](classes/AuthenticationUserV0.md)
+- [AuthHeaderProcessor](classes/AuthHeaderProcessor.md)
+- [EntityStorageAuthenticationAdminService](classes/EntityStorageAuthenticationAdminService.md)
+- [EntityStorageAuthenticationService](classes/EntityStorageAuthenticationService.md)
+- [PasswordHelper](classes/PasswordHelper.md)
+- [TokenHelper](classes/TokenHelper.md)
+
+## Interfaces
+
+- [IAuthHeaderProcessorConfig](interfaces/IAuthHeaderProcessorConfig.md)
+- [IAuthHeaderProcessorConstructorOptions](interfaces/IAuthHeaderProcessorConstructorOptions.md)
+- [IAuthTokenContext](interfaces/IAuthTokenContext.md)
+- [IEntityStorageAuthenticationAdminServiceConfig](interfaces/IEntityStorageAuthenticationAdminServiceConfig.md)
+- [IEntityStorageAuthenticationAdminServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationServiceConfig](interfaces/IEntityStorageAuthenticationServiceConfig.md)
+- [IEntityStorageAuthenticationServiceConstructorOptions](interfaces/IEntityStorageAuthenticationServiceConstructorOptions.md)
+
+## Variables
+
+- [restEntryPoints](variables/restEntryPoints.md)
+- [tagsAuthenticationAdmin](variables/tagsAuthenticationAdmin.md)
+- [tagsAuthentication](variables/tagsAuthentication.md)
+
+## Functions
+
+- [generateRestRoutesAuthenticationAdmin](functions/generateRestRoutesAuthenticationAdmin.md)
+- [authenticationAdminCreateUser](functions/authenticationAdminCreateUser.md)
+- [authenticationAdminUpdateUser](functions/authenticationAdminUpdateUser.md)
+- [authenticationAdminUpdateUserPassword](functions/authenticationAdminUpdateUserPassword.md)
+- [authenticationAdminGetUser](functions/authenticationAdminGetUser.md)
+- [authenticationAdminGetUserByIdentity](functions/authenticationAdminGetUserByIdentity.md)
+- [authenticationAdminRemoveUser](functions/authenticationAdminRemoveUser.md)
+- [generateRestRoutesAuthentication](functions/generateRestRoutesAuthentication.md)
+- [authenticationLogin](functions/authenticationLogin.md)
+- [authenticationLogout](functions/authenticationLogout.md)
+- [authenticationRefreshToken](functions/authenticationRefreshToken.md)
+- [authenticationUpdatePassword](functions/authenticationUpdatePassword.md)
+- [authenticationPasswordPolicy](functions/authenticationPasswordPolicy.md)
+- [initSchema](functions/initSchema.md)

package/docs/reference/interfaces/IAuthHeaderProcessorConfig.md

@@ -0,0 +1,85 @@
+# Interface: IAuthHeaderProcessorConfig
+
+Configuration for the authentication header processor
+
+## Properties
+
+### signingKeyName? {#signingkeyname}
+
+> `optional` **signingKeyName?**: `string`
+
+The name of the key to retrieve from the vault for signing JWT.
+
+#### Default
+
+```ts
+auth-signing
+```
+
+***
+
+### cookieName? {#cookiename}
+
+> `optional` **cookieName?**: `string`
+
+The name of the cookie to use for the token.
+
+#### Default
+
+```ts
+access_token
+```
+
+***
+
+### includeErrorStack? {#includeerrorstack}
+
+> `optional` **includeErrorStack?**: `boolean`
+
+Include the stack with errors.
+
+***
+
+### tokenCacheTtlMs? {#tokencachettlms}
+
+> `optional` **tokenCacheTtlMs?**: `number`
+
+The time in milliseconds a verified token is kept in the in-memory cache, counted from when it
+was verified and not extended by use, set to 0 to disable caching. A hit skips the vault
+signature check, the tenant lookup and the user lookup, so this is also the longest a password
+change, a user removal or a signing key rotation can go unnoticed. An entry never outlives the
+expiry claim of its own token either.
+
+#### Default
+
+```ts
+30000
+```
+
+***
+
+### tokenCacheCapacity? {#tokencachecapacity}
+
+> `optional` **tokenCacheCapacity?**: `number`
+
+The maximum number of verified tokens to hold in the in-memory cache.
+
+#### Default
+
+```ts
+undefined (LfuCache default)
+```
+
+***
+
+### tokenCacheMutexTimeoutMs? {#tokencachemutextimeoutms}
+
+> `optional` **tokenCacheMutexTimeoutMs?**: `number`
+
+Maximum time in milliseconds to wait for the token cache mutex during a cache population.
+
+#### Default
+
+```ts
+undefined (LfuCache default)
+```

package/docs/reference/interfaces/IAuthHeaderProcessorConstructorOptions.md

@@ -0,0 +1,53 @@
+# Interface: IAuthHeaderProcessorConstructorOptions
+
+Options for the AuthHeaderProcessor constructor.
+
+## Properties
+
+### userEntityStorageType? {#userentitystoragetype}
+
+> `optional` **userEntityStorageType?**: `string`
+
+The entity storage for users.
+
+#### Default
+
+```ts
+authentication-user
+```
+
+***
+
+### vaultConnectorType? {#vaultconnectortype}
+
+> `optional` **vaultConnectorType?**: `string`
+
+The vault for the private keys.
+
+#### Default
+
+```ts
+vault
+```
+
+***
+
+### tenantAdminComponentType? {#tenantadmincomponenttype}
+
+> `optional` **tenantAdminComponentType?**: `string`
+
+The component to retrieve tenant information.
+
+#### Default
+
+```ts
+tenant-admin
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IAuthHeaderProcessorConfig`](IAuthHeaderProcessorConfig.md)
+
+The configuration for the processor.

package/docs/reference/interfaces/IAuthTokenContext.md

@@ -0,0 +1,52 @@
+# Interface: IAuthTokenContext
+
+The context resolved from an access token, everything a request needs that does not depend on
+the route being called.
+
+## Properties
+
+### tenantId? {#tenantid}
+
+> `optional` **tenantId?**: `string`
+
+The tenant id from the token, if it carried one.
+
+***
+
+### tenantOrganizationId? {#tenantorganizationid}
+
+> `optional` **tenantOrganizationId?**: `string`
+
+The organization id of the tenant the token belongs to.
+
+***
+
+### tenantPublicOrigin? {#tenantpublicorigin}
+
+> `optional` **tenantPublicOrigin?**: `string`
+
+The public origin of the tenant the token belongs to.
+
+***
+
+### userIdentity? {#useridentity}
+
+> `optional` **userIdentity?**: `string`
+
+The identity of the verified user.
+
+***
+
+### userOrganization? {#userorganization}
+
+> `optional` **userOrganization?**: `string`
+
+The organization of the verified user.
+
+***
+
+### expires? {#expires}
+
+> `optional` **expires?**: `number`
+
+The expiry of the token in milliseconds since the epoch, if it carried one.

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConfig.md

@@ -0,0 +1,59 @@
+# Interface: IEntityStorageAuthenticationAdminServiceConfig
+
+Configuration for the entity storage authentication admin service.
+
+## Properties
+
+### minPasswordLength? {#minpasswordlength}
+
+> `optional` **minPasswordLength?**: `number`
+
+The minimum password length.
+
+#### Default
+
+```ts
+15
+```
+
+***
+
+### maxPasswordLength? {#maxpasswordlength}
+
+> `optional` **maxPasswordLength?**: `number`
+
+The maximum password length.
+
+#### Default
+
+```ts
+128
+```
+
+***
+
+### escalatedPrivilegeRole? {#escalatedprivilegerole}
+
+> `optional` **escalatedPrivilegeRole?**: `string`
+
+The role that grants escalated privilege, only callers holding it can modify accounts that hold it.
+
+#### Default
+
+```ts
+global-admin
+```
+
+***
+
+### authorizationModelId? {#authorizationmodelid}
+
+> `optional` **authorizationModelId?**: `string`
+
+The authorization model ID used to look up roles.
+
+#### Default
+
+```ts
+system
+```

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md

@@ -0,0 +1,53 @@
+# Interface: IEntityStorageAuthenticationAdminServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationAdminService constructor.
+
+## Properties
+
+### userEntityStorageType? {#userentitystoragetype}
+
+> `optional` **userEntityStorageType?**: `string`
+
+The entity storage for the users.
+
+#### Default
+
+```ts
+authentication-user
+```
+
+***
+
+### authenticationAuditServiceType? {#authenticationauditservicetype}
+
+> `optional` **authenticationAuditServiceType?**: `string`
+
+The audit component.
+
+#### Default
+
+```ts
+authentication-audit
+```
+
+***
+
+### authorizationComponentType? {#authorizationcomponenttype}
+
+> `optional` **authorizationComponentType?**: `string`
+
+The authorization component used to guard accounts with escalated privilege.
+
+#### Default
+
+```ts
+authorization
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)
+
+The configuration for the authentication.

package/docs/reference/interfaces/IEntityStorageAuthenticationServiceConfig.md

@@ -0,0 +1,101 @@
+# Interface: IEntityStorageAuthenticationServiceConfig
+
+Configuration for the entity storage authentication service.
+
+## Properties
+
+### signingKeyName? {#signingkeyname}
+
+> `optional` **signingKeyName?**: `string`
+
+The name of the key to retrieve from the vault for signing JWT.
+
+#### Default
+
+```ts
+auth-signing
+```
+
+***
+
+### defaultTtlMinutes? {#defaultttlminutes}
+
+> `optional` **defaultTtlMinutes?**: `number`
+
+The default time to live for the JWT.
+
+#### Default
+
+```ts
+60
+```
+
+***
+
+### minPasswordLength? {#minpasswordlength}
+
+> `optional` **minPasswordLength?**: `number`
+
+The minimum password length for new password validation.
+
+#### Default
+
+```ts
+15
+```
+
+***
+
+### maxPasswordLength? {#maxpasswordlength}
+
+> `optional` **maxPasswordLength?**: `number`
+
+The maximum password length for new password validation.
+
+#### Default
+
+```ts
+128
+```
+
+***
+
+### loginRateLimit? {#loginratelimit}
+
+> `optional` **loginRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for login failure rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### passwordChangeRateLimit? {#passwordchangeratelimit}
+
+> `optional` **passwordChangeRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for password change rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### tokenRefreshRateLimit? {#tokenrefreshratelimit}
+
+> `optional` **tokenRefreshRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for token refresh rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 30, windowMinutes: 60 }
+```