@3sixty/api-auth-entity-storage-service 0.0.0-stage → 0.20.0-next.1

package/dist/es/routes/entityStorageAuthenticationRoutes.js

@@ -0,0 +1,291 @@
+import { ComponentFactory, Guards } from "@3sixty/core";
+import { HttpStatusCode } from "@3sixty/web";
+/**
+ * The source used when communicating about these routes.
+ */
+const ROUTES_SOURCE = "authenticationRoutes";
+/**
+ * The tag to associate with the routes.
+ */
+export const tagsAuthentication = [
+    {
+        name: "Authentication",
+        description: "Authentication endpoints for the REST server."
+    }
+];
+/**
+ * The REST routes for authentication.
+ * @param baseRouteName Prefix to prepend to the paths.
+ * @param componentName The name of the component to use in the routes stored in the ComponentFactory.
+ * @returns The generated routes.
+ */
+export function generateRestRoutesAuthentication(baseRouteName, componentName) {
+    const loginRoute = {
+        operationId: "authenticationLogin",
+        summary: "Login to the server",
+        tag: tagsAuthentication[0].name,
+        method: "POST",
+        path: `${baseRouteName}/login`,
+        handler: async (httpRequestContext, request) => authenticationLogin(httpRequestContext, componentName, request),
+        requestType: {
+            type: "ILoginRequest",
+            examples: [
+                {
+                    id: "loginRequestExample",
+                    description: "The request to login to the server.",
+                    request: {
+                        body: {
+                            email: "user@example.com",
+                            password: "MyPassword123!"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "ILoginResponse",
+                examples: [
+                    {
+                        id: "loginResponseExample",
+                        description: "The response for the login request.",
+                        response: {
+                            body: {
+                                expiry: 1722514341067
+                            }
+                        }
+                    }
+                ]
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        skipAuth: true
+    };
+    const logoutRoute = {
+        operationId: "authenticationLogout",
+        summary: "Logout from the server",
+        tag: tagsAuthentication[0].name,
+        method: "POST",
+        path: `${baseRouteName}/logout`,
+        handler: async (httpRequestContext, request) => authenticationLogout(httpRequestContext, componentName, request),
+        requestType: {
+            type: "ILogoutRequest",
+            examples: [
+                {
+                    id: "logoutRequestExample",
+                    description: "The request to logout from the server.",
+                    request: {
+                        body: {
+                            token: "eyJhbGciOiJIU...sw5c"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "INoContentResponse"
+            }
+        ]
+    };
+    const refreshTokenRoute = {
+        operationId: "authenticationRefreshToken",
+        summary: "Refresh an authentication token",
+        tag: tagsAuthentication[0].name,
+        method: "POST",
+        path: `${baseRouteName}/refresh`,
+        handler: async (httpRequestContext, request) => authenticationRefreshToken(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IRefreshTokenRequest",
+            examples: [
+                {
+                    id: "refreshTokenRequestExample",
+                    description: "The request to refresh an auth token.",
+                    request: {
+                        body: {
+                            token: "eyJhbGciOiJIU...sw5c"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "IRefreshTokenResponse",
+                examples: [
+                    {
+                        id: "refreshTokenResponseExample",
+                        description: "The response for the refresh token request.",
+                        response: {
+                            body: {
+                                expiry: 1722514341067
+                            }
+                        }
+                    }
+                ]
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ]
+    };
+    const updatePasswordRoute = {
+        operationId: "authenticationUpdatePassword",
+        summary: "Update the current user's password",
+        tag: tagsAuthentication[0].name,
+        method: "PUT",
+        path: `${baseRouteName}/password`,
+        handler: async (httpRequestContext, request) => authenticationUpdatePassword(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IUpdatePasswordRequest",
+            examples: [
+                {
+                    id: "updatePasswordRequestExample",
+                    description: "The request to update the current user's password.",
+                    request: {
+                        body: {
+                            currentPassword: "MyNewPassword123!",
+                            newPassword: "MyNewPassword123!"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "INoContentResponse"
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ]
+    };
+    const passwordPolicyRoute = {
+        operationId: "authenticationPasswordPolicy",
+        summary: "Get the password policy",
+        tag: tagsAuthentication[0].name,
+        method: "GET",
+        path: `${baseRouteName}/policy`,
+        handler: async (httpRequestContext, request) => authenticationPasswordPolicy(httpRequestContext, componentName, request),
+        requestType: {
+            type: "INoContentRequest"
+        },
+        responseType: [
+            {
+                type: "IPasswordPolicyResponse",
+                examples: [
+                    {
+                        id: "passwordPolicyResponseExample",
+                        description: "The response for the password policy request.",
+                        response: {
+                            body: {
+                                minPasswordLength: 15,
+                                maxPasswordLength: 128
+                            }
+                        }
+                    }
+                ]
+            }
+        ],
+        skipAuth: true,
+        skipTenant: true
+    };
+    return [loginRoute, logoutRoute, refreshTokenRoute, updatePasswordRoute, passwordPolicyRoute];
+}
+/**
+ * Login to the server.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationLogin(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.body", request.body);
+    const component = ComponentFactory.get(componentName);
+    const result = await component.login(request.body.email, request.body.password);
+    // Need to give a hint to any auth processors about the operation
+    // in case they need to manipulate the response
+    httpRequestContext.processorState.authOperation = "login";
+    httpRequestContext.processorState.authToken = result.token;
+    return {
+        body: {
+            expiry: result.expiry
+        }
+    };
+}
+/**
+ * Logout from the server.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationLogout(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    const component = ComponentFactory.get(componentName);
+    await component.logout(request.body?.token);
+    // Need to give a hint to any auth processors about the operation
+    // in case they need to manipulate the response
+    httpRequestContext.processorState.authOperation = "logout";
+    return {
+        statusCode: HttpStatusCode.noContent
+    };
+}
+/**
+ * Refresh the login token.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationRefreshToken(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    const component = ComponentFactory.get(componentName);
+    // If the token is not in the body, then maybe an auth processor has extracted it
+    // and stored it in the processor state
+    const token = request.body?.token ?? httpRequestContext.processorState.authToken;
+    const result = await component.refresh(token);
+    // Need to give a hint to any auth processors about the operation
+    // in case they need to manipulate the response
+    httpRequestContext.processorState.authOperation = "refresh";
+    httpRequestContext.processorState.authToken = result.token;
+    return {
+        body: {
+            expiry: result.expiry
+        }
+    };
+}
+/**
+ * Update the user's password.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationUpdatePassword(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.body", request.body);
+    const component = ComponentFactory.get(componentName);
+    await component.updatePassword(request.body.currentPassword, request.body.newPassword);
+    return {
+        statusCode: HttpStatusCode.noContent
+    };
+}
+/**
+ * Get the password policy.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationPasswordPolicy(httpRequestContext, componentName, request) {
+    const component = ComponentFactory.get(componentName);
+    const result = await component.passwordPolicy();
+    return {
+        body: result
+    };
+}
+//# sourceMappingURL=entityStorageAuthenticationRoutes.js.map

package/dist/es/routes/entityStorageAuthenticationRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityStorageAuthenticationRoutes.js","sources":["../../../src/routes/entityStorageAuthenticationRoutes.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW;IACzC;QACC,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,+CAA+C;KAC5D;CACD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC/C,aAAqB,EACrB,aAAqB;IAErB,MAAM,UAAU,GAA8C;QAC7D,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,aAAa,QAAQ;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,mBAAmB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QAChE,WAAW,EAAE;YACZ,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,qBAAqB;oBACzB,WAAW,EAAE,qCAAqC;oBAClD,OAAO,EAAE;wBACR,IAAI,EAAE;4BACL,KAAK,EAAE,kBAAkB;4BACzB,QAAQ,EAAE,gBAAgB;yBAC1B;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,sBAAsB;wBAC1B,WAAW,EAAE,qCAAqC;wBAClD,QAAQ,EAAE;4BACT,IAAI,EAAE;gCACL,MAAM,EAAE,aAAa;6BACrB;yBACD;qBACD;iBACD;aACD;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,QAAQ,EAAE,IAAI;KACd,CAAC;IAEF,MAAM,WAAW,GAAmD;QACnE,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,wBAAwB;QACjC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,aAAa,SAAS;QAC/B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,oBAAoB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACjE,WAAW,EAAE;YACZ,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,WAAW,EAAE,wCAAwC;oBACrD,OAAO,EAAE;wBACR,IAAI,EAAE;4BACL,KAAK,EAAE,sBAAsB;yBAC7B;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,oBAAoB;aAC1B;SACD;KACD,CAAC;IAEF,MAAM,iBAAiB,GAA4D;QAClF,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,aAAa,UAAU;QAChC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,0BAA0B,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACvE,WAAW,EAAE;YACZ,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,4BAA4B;oBAChC,WAAW,EAAE,uCAAuC;oBACpD,OAAO,EAAE;wBACR,IAAI,EAAE;4BACL,KAAK,EAAE,sBAAsB;yBAC7B;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,6BAA6B;wBACjC,WAAW,EAAE,6CAA6C;wBAC1D,QAAQ,EAAE;4BACT,IAAI,EAAE;gCACL,MAAM,EAAE,aAAa;6BACrB;yBACD;qBACD;iBACD;aACD;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;KACD,CAAC;IAEF,MAAM,mBAAmB,GAA2D;QACnF,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,oCAAoC;QAC7C,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,aAAa,WAAW;QACjC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,4BAA4B,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACzE,WAAW,EAAE;YACZ,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,8BAA8B;oBAClC,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE;wBACR,IAAI,EAAE;4BACL,eAAe,EAAE,mBAAmB;4BACpC,WAAW,EAAE,mBAAmB;yBAChC;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,oBAAoB;aAC1B;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;KACD,CAAC;IAEF,MAAM,mBAAmB,GAA2D;QACnF,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,yBAAyB;QAClC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,aAAa,SAAS;QAC/B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,4BAA4B,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACzE,WAAW,EAAE;YACZ,IAAI,EAAE,mBAAmB;SACzB;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,+BAA+B;wBACnC,WAAW,EAAE,+CAA+C;wBAC5D,QAAQ,EAAE;4BACT,IAAI,EAAE;gCACL,iBAAiB,EAAE,EAAE;gCACrB,iBAAiB,EAAE,GAAG;6BACtB;yBACD;qBACD;iBACD;aACD;SACD;QACD,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KAChB,CAAC;IAEF,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,kBAAuC,EACvC,aAAqB,EACrB,OAAsB;IAEtB,MAAM,CAAC,MAAM,CAAgB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,CAAwB,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAA2B,aAAa,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEhF,iEAAiE;IACjE,+CAA+C;IAC/C,kBAAkB,CAAC,cAAc,CAAC,aAAa,GAAG,OAAO,CAAC;IAC1D,kBAAkB,CAAC,cAAc,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3D,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB;KACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,kBAAuC,EACvC,aAAqB,EACrB,OAAuB;IAEvB,MAAM,CAAC,MAAM,CAAiB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAA2B,aAAa,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE5C,iEAAiE;IACjE,+CAA+C;IAC/C,kBAAkB,CAAC,cAAc,CAAC,aAAa,GAAG,QAAQ,CAAC;IAE3D,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,SAAS;KACpC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,kBAAuC,EACvC,aAAqB,EACrB,OAA6B;IAE7B,MAAM,CAAC,MAAM,CAAuB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAA2B,aAAa,CAAC,CAAC;IAEhF,iFAAiF;IACjF,uCAAuC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAK,kBAAkB,CAAC,cAAc,CAAC,SAAoB,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9C,iEAAiE;IACjE,+CAA+C;IAC/C,kBAAkB,CAAC,cAAc,CAAC,aAAa,GAAG,SAAS,CAAC;IAC5D,kBAAkB,CAAC,cAAc,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3D,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB;KACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,kBAAuC,EACvC,aAAqB,EACrB,OAA+B;IAE/B,MAAM,CAAC,MAAM,CAAyB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,CAAC,MAAM,CAAiC,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAA2B,aAAa,CAAC,CAAC;IAEhF,MAAM,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvF,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,SAAS;KACpC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,kBAAuC,EACvC,aAAqB,EACrB,OAA0B;IAE1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAA2B,aAAa,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC;IAEhD,OAAO;QACN,IAAI,EAAE,MAAM;KACZ,CAAC;AACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type {\n\tIAuthenticationComponent,\n\tILoginRequest,\n\tILoginResponse,\n\tILogoutRequest,\n\tIPasswordPolicyResponse,\n\tIRefreshTokenRequest,\n\tIRefreshTokenResponse,\n\tIUpdatePasswordRequest\n} from \"@3sixty/api-auth-entity-storage-models\";\nimport type {\n\tIHttpRequestContext,\n\tINoContentRequest,\n\tINoContentResponse,\n\tIRestRoute,\n\tIRestRouteResponseOptions,\n\tITag,\n\tIUnauthorizedResponse\n} from \"@3sixty/api-models\";\nimport { ComponentFactory, Guards } from \"@3sixty/core\";\n\nimport { HttpStatusCode } from \"@3sixty/web\";\n\n/**\n * The source used when communicating about these routes.\n */\nconst ROUTES_SOURCE = \"authenticationRoutes\";\n\n/**\n * The tag to associate with the routes.\n */\nexport const tagsAuthentication: ITag[] = [\n\t{\n\t\tname: \"Authentication\",\n\t\tdescription: \"Authentication endpoints for the REST server.\"\n\t}\n];\n\n/**\n * The REST routes for authentication.\n * @param baseRouteName Prefix to prepend to the paths.\n * @param componentName The name of the component to use in the routes stored in the ComponentFactory.\n * @returns The generated routes.\n */\nexport function generateRestRoutesAuthentication(\n\tbaseRouteName: string,\n\tcomponentName: string\n): IRestRoute[] {\n\tconst loginRoute: IRestRoute<ILoginRequest, ILoginResponse> = {\n\t\toperationId: \"authenticationLogin\",\n\t\tsummary: \"Login to the server\",\n\t\ttag: tagsAuthentication[0].name,\n\t\tmethod: \"POST\",\n\t\tpath: `${baseRouteName}/login`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationLogin(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"ILoginRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"loginRequestExample\",\n\t\t\t\t\tdescription: \"The request to login to the server.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\temail: \"user@example.com\",\n\t\t\t\t\t\t\tpassword: \"MyPassword123!\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"ILoginResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"loginResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for the login request.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\texpiry: 1722514341067\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tskipAuth: true\n\t};\n\n\tconst logoutRoute: IRestRoute<ILogoutRequest, INoContentResponse> = {\n\t\toperationId: \"authenticationLogout\",\n\t\tsummary: \"Logout from the server\",\n\t\ttag: tagsAuthentication[0].name,\n\t\tmethod: \"POST\",\n\t\tpath: `${baseRouteName}/logout`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationLogout(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"ILogoutRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"logoutRequestExample\",\n\t\t\t\t\tdescription: \"The request to logout from the server.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\ttoken: \"eyJhbGciOiJIU...sw5c\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"INoContentResponse\"\n\t\t\t}\n\t\t]\n\t};\n\n\tconst refreshTokenRoute: IRestRoute<IRefreshTokenRequest, IRefreshTokenResponse> = {\n\t\toperationId: \"authenticationRefreshToken\",\n\t\tsummary: \"Refresh an authentication token\",\n\t\ttag: tagsAuthentication[0].name,\n\t\tmethod: \"POST\",\n\t\tpath: `${baseRouteName}/refresh`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationRefreshToken(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IRefreshTokenRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"refreshTokenRequestExample\",\n\t\t\t\t\tdescription: \"The request to refresh an auth token.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\ttoken: \"eyJhbGciOiJIU...sw5c\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"IRefreshTokenResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"refreshTokenResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for the refresh token request.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\texpiry: 1722514341067\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t]\n\t};\n\n\tconst updatePasswordRoute: IRestRoute<IUpdatePasswordRequest, INoContentResponse> = {\n\t\toperationId: \"authenticationUpdatePassword\",\n\t\tsummary: \"Update the current user's password\",\n\t\ttag: tagsAuthentication[0].name,\n\t\tmethod: \"PUT\",\n\t\tpath: `${baseRouteName}/password`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationUpdatePassword(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IUpdatePasswordRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"updatePasswordRequestExample\",\n\t\t\t\t\tdescription: \"The request to update the current user's password.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\tcurrentPassword: \"MyNewPassword123!\",\n\t\t\t\t\t\t\tnewPassword: \"MyNewPassword123!\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"INoContentResponse\"\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t]\n\t};\n\n\tconst passwordPolicyRoute: IRestRoute<INoContentRequest, IPasswordPolicyResponse> = {\n\t\toperationId: \"authenticationPasswordPolicy\",\n\t\tsummary: \"Get the password policy\",\n\t\ttag: tagsAuthentication[0].name,\n\t\tmethod: \"GET\",\n\t\tpath: `${baseRouteName}/policy`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationPasswordPolicy(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"INoContentRequest\"\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"IPasswordPolicyResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"passwordPolicyResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for the password policy request.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\tminPasswordLength: 15,\n\t\t\t\t\t\t\t\tmaxPasswordLength: 128\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t}\n\t\t],\n\t\tskipAuth: true,\n\t\tskipTenant: true\n\t};\n\n\treturn [loginRoute, logoutRoute, refreshTokenRoute, updatePasswordRoute, passwordPolicyRoute];\n}\n\n/**\n * Login to the server.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationLogin(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: ILoginRequest\n): Promise<ILoginResponse & IRestRouteResponseOptions> {\n\tGuards.object<ILoginRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<ILoginRequest[\"body\"]>(ROUTES_SOURCE, \"request.body\", request.body);\n\n\tconst component = ComponentFactory.get<IAuthenticationComponent>(componentName);\n\tconst result = await component.login(request.body.email, request.body.password);\n\n\t// Need to give a hint to any auth processors about the operation\n\t// in case they need to manipulate the response\n\thttpRequestContext.processorState.authOperation = \"login\";\n\thttpRequestContext.processorState.authToken = result.token;\n\n\treturn {\n\t\tbody: {\n\t\t\texpiry: result.expiry\n\t\t}\n\t};\n}\n\n/**\n * Logout from the server.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationLogout(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: ILogoutRequest\n): Promise<INoContentResponse & IRestRouteResponseOptions> {\n\tGuards.object<ILogoutRequest>(ROUTES_SOURCE, \"request\", request);\n\n\tconst component = ComponentFactory.get<IAuthenticationComponent>(componentName);\n\tawait component.logout(request.body?.token);\n\n\t// Need to give a hint to any auth processors about the operation\n\t// in case they need to manipulate the response\n\thttpRequestContext.processorState.authOperation = \"logout\";\n\n\treturn {\n\t\tstatusCode: HttpStatusCode.noContent\n\t};\n}\n\n/**\n * Refresh the login token.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationRefreshToken(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IRefreshTokenRequest\n): Promise<IRefreshTokenResponse & IRestRouteResponseOptions> {\n\tGuards.object<IRefreshTokenRequest>(ROUTES_SOURCE, \"request\", request);\n\n\tconst component = ComponentFactory.get<IAuthenticationComponent>(componentName);\n\n\t// If the token is not in the body, then maybe an auth processor has extracted it\n\t// and stored it in the processor state\n\tconst token = request.body?.token ?? (httpRequestContext.processorState.authToken as string);\n\tconst result = await component.refresh(token);\n\n\t// Need to give a hint to any auth processors about the operation\n\t// in case they need to manipulate the response\n\thttpRequestContext.processorState.authOperation = \"refresh\";\n\thttpRequestContext.processorState.authToken = result.token;\n\n\treturn {\n\t\tbody: {\n\t\t\texpiry: result.expiry\n\t\t}\n\t};\n}\n\n/**\n * Update the user's password.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationUpdatePassword(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IUpdatePasswordRequest\n): Promise<INoContentResponse> {\n\tGuards.object<IUpdatePasswordRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<IUpdatePasswordRequest[\"body\"]>(ROUTES_SOURCE, \"request.body\", request.body);\n\n\tconst component = ComponentFactory.get<IAuthenticationComponent>(componentName);\n\n\tawait component.updatePassword(request.body.currentPassword, request.body.newPassword);\n\n\treturn {\n\t\tstatusCode: HttpStatusCode.noContent\n\t};\n}\n\n/**\n * Get the password policy.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationPasswordPolicy(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: INoContentRequest\n): Promise<IPasswordPolicyResponse & IRestRouteResponseOptions> {\n\tconst component = ComponentFactory.get<IAuthenticationComponent>(componentName);\n\tconst result = await component.passwordPolicy();\n\n\treturn {\n\t\tbody: result\n\t};\n}\n"]}

package/dist/es/schema.js

@@ -0,0 +1,13 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { EntitySchemaFactory, EntitySchemaHelper } from "@3sixty/entity";
+import { AuthenticationUser } from "./entities/authenticationUser.js";
+import { AuthenticationUserV0 } from "./entities/authenticationUserV0.js";
+/**
+ * Initialize the schema for the authentication service.
+ */
+export function initSchema() {
+    EntitySchemaFactory.register("AuthenticationUser", () => EntitySchemaHelper.getSchema(AuthenticationUser));
+    EntitySchemaFactory.register("AuthenticationUserV0", () => EntitySchemaHelper.getSchema(AuthenticationUserV0));
+}
+//# sourceMappingURL=schema.js.map

package/dist/es/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sources":["../../src/schema.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;GAEG;AACH,MAAM,UAAU,UAAU;IACzB,mBAAmB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CACvD,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAChD,CAAC;IACF,mBAAmB,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE,CACzD,kBAAkB,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAClD,CAAC;AACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { EntitySchemaFactory, EntitySchemaHelper } from \"@3sixty/entity\";\n\nimport { AuthenticationUser } from \"./entities/authenticationUser.js\";\nimport { AuthenticationUserV0 } from \"./entities/authenticationUserV0.js\";\n\n/**\n * Initialize the schema for the authentication service.\n */\nexport function initSchema(): void {\n\tEntitySchemaFactory.register(\"AuthenticationUser\", () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationUser)\n\t);\n\tEntitySchemaFactory.register(\"AuthenticationUserV0\", () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationUserV0)\n\t);\n}\n"]}

package/dist/es/services/entityStorageAuthenticationAdminService.js

@@ -0,0 +1,324 @@
+import { AuthAuditEvent } from "@3sixty/api-auth-models";
+import { ForbiddenError, HttpContextIdKeys } from "@3sixty/api-models";
+import { ContextIdKeys, ContextIdStore } from "@3sixty/context";
+import { BaseError, ComponentFactory, Converter, GeneralError, Guards, Is, NotFoundError, RandomHelper } from "@3sixty/core";
+import { PasswordGenerator, PasswordValidator } from "@3sixty/crypto";
+import { EntityStorageConnectorFactory } from "@3sixty/entity-storage-models";
+import { PasswordHelper } from "../utils/passwordHelper.js";
+/**
+ * Implementation of the authentication component using entity storage.
+ */
+export class EntityStorageAuthenticationAdminService {
+    /**
+     * Runtime name for the class.
+     */
+    static CLASS_NAME = "EntityStorageAuthenticationAdminService";
+    /**
+     * The default role that grants escalated privilege.
+     */
+    static DEFAULT_ESCALATED_PRIVILEGE_ROLE = "global-admin";
+    /**
+     * The default authorization model ID used to look up roles.
+     */
+    static DEFAULT_AUTHORIZATION_MODEL_ID = "system";
+    /**
+     * The entity storage for users.
+     * @internal
+     */
+    _userEntityStorage;
+    /**
+     * The audit component.
+     * @internal
+     */
+    _authenticationAuditService;
+    /**
+     * The authorization component used to guard accounts with escalated privilege.
+     * @internal
+     */
+    _authorizationComponent;
+    /**
+     * The role that grants escalated privilege.
+     * @internal
+     */
+    _escalatedPrivilegeRole;
+    /**
+     * The authorization model ID used to look up roles.
+     * @internal
+     */
+    _authorizationModelId;
+    /**
+     * The minimum password length.
+     * @internal
+     */
+    _minPasswordLength;
+    /**
+     * The maximum password length.
+     * @internal
+     */
+    _maxPasswordLength;
+    /**
+     * Create a new instance of EntityStorageAuthentication.
+     * @param options The dependencies for the identity connector.
+     */
+    constructor(options) {
+        this._userEntityStorage = EntityStorageConnectorFactory.get(options?.userEntityStorageType ?? "authentication-user");
+        this._authenticationAuditService = ComponentFactory.getIfExists(options?.authenticationAuditServiceType ?? "authentication-audit");
+        this._authorizationComponent = ComponentFactory.getIfExists(options?.authorizationComponentType ?? "authorization");
+        this._minPasswordLength = options?.config?.minPasswordLength;
+        this._maxPasswordLength = options?.config?.maxPasswordLength;
+        this._escalatedPrivilegeRole =
+            options?.config?.escalatedPrivilegeRole ??
+                EntityStorageAuthenticationAdminService.DEFAULT_ESCALATED_PRIVILEGE_ROLE;
+        this._authorizationModelId =
+            options?.config?.authorizationModelId ??
+                EntityStorageAuthenticationAdminService.DEFAULT_AUTHORIZATION_MODEL_ID;
+    }
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className() {
+        return EntityStorageAuthenticationAdminService.CLASS_NAME;
+    }
+    /**
+     * Create a login for the user.
+     * @param user The user to create.
+     * @returns A promise that resolves when the user account has been created and the audit entry recorded.
+     */
+    async create(user) {
+        Guards.object(EntityStorageAuthenticationAdminService.CLASS_NAME, "user", user);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.email", user.email);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.password", user.password);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.userIdentity", user.userIdentity);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.organizationIdentity", user.organizationIdentity);
+        try {
+            PasswordValidator.validatePassword(user.password, {
+                minLength: this._minPasswordLength,
+                maxLength: this._maxPasswordLength
+            });
+            const existingUser = await this._userEntityStorage.get(user.email);
+            if (Is.object(existingUser)) {
+                throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userExists");
+            }
+            // Roles belong to the identity, so a login mapped to an escalated identity inherits them.
+            await this.guardEscalatedPrivilegeTarget(user.userIdentity);
+            const saltBytes = RandomHelper.generate(16);
+            const passwordBytes = Converter.utf8ToBytes(user.password);
+            const hashedPassword = await PasswordGenerator.hashPassword(passwordBytes, saltBytes);
+            const newUser = {
+                email: user.email,
+                salt: Converter.bytesToBase64(saltBytes),
+                password: hashedPassword,
+                identity: user.userIdentity,
+                organization: user.organizationIdentity,
+                passwordVersion: 0
+            };
+            await this._userEntityStorage.set(newUser);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: user.email,
+                event: AuthAuditEvent.AccountCreated,
+                data: {
+                    userIdentity: user.userIdentity,
+                    organizationIdentity: user.organizationIdentity,
+                    tenantId: requestorTenantId,
+                    originalTenantId
+                }
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "createUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Update a login for the user.
+     * @param user The user to update.
+     * @returns A promise that resolves when the user account has been updated and the audit entry recorded.
+     */
+    async update(user) {
+        Guards.object(EntityStorageAuthenticationAdminService.CLASS_NAME, "user", user);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.email", user.email);
+        if (!Is.empty(user.userIdentity)) {
+            Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.userIdentity", user.userIdentity);
+        }
+        if (!Is.empty(user.organizationIdentity)) {
+            Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "user.organizationIdentity", user.organizationIdentity);
+        }
+        try {
+            const existingUser = await this._userEntityStorage.get(user.email);
+            if (!Is.object(existingUser)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", user.email);
+            }
+            await this.guardEscalatedPrivilegeTarget(existingUser.identity);
+            if (Is.stringValue(user.userIdentity) && user.userIdentity !== existingUser.identity) {
+                await this.guardEscalatedPrivilegeTarget(user.userIdentity);
+            }
+            const updatedFields = [];
+            if (user.userIdentity !== undefined && user.userIdentity !== existingUser.identity) {
+                updatedFields.push("userIdentity");
+            }
+            if (user.organizationIdentity !== undefined &&
+                user.organizationIdentity !== existingUser.organization) {
+                updatedFields.push("organizationIdentity");
+            }
+            existingUser.identity = user.userIdentity ?? existingUser.identity;
+            existingUser.organization = user.organizationIdentity ?? existingUser.organization;
+            await this._userEntityStorage.set(existingUser);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: existingUser.email,
+                event: AuthAuditEvent.AccountUpdated,
+                data: {
+                    updatedFields,
+                    userIdentity: existingUser.identity,
+                    organizationIdentity: existingUser.organization,
+                    tenantId: requestorTenantId,
+                    originalTenantId
+                }
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "updateUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Get a user by email.
+     * @param email The email address of the user to get.
+     * @returns The user details.
+     */
+    async get(email) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            return {
+                email: user.email,
+                userIdentity: user.identity,
+                organizationIdentity: user.organization
+            };
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "getUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Get a user by identity.
+     * @param identity The identity of the user to get.
+     * @returns The user details.
+     */
+    async getByIdentity(identity) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "identity", identity);
+        try {
+            const user = await this._userEntityStorage.get(identity, "identity");
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", identity);
+            }
+            return {
+                email: user.email,
+                userIdentity: user.identity,
+                organizationIdentity: user.organization
+            };
+        }
+        catch (error) {
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "getUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Remove the current user.
+     * @param email The email address of the user to remove.
+     * @returns A promise that resolves when the user account has been removed and the audit entry recorded.
+     */
+    async remove(email) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            await this.guardEscalatedPrivilegeTarget(user.identity);
+            await this._userEntityStorage.remove(email);
+            const contextIds = await ContextIdStore.getContextIds();
+            const requestorTenantId = contextIds?.[ContextIdKeys.Tenant];
+            const originalTenantId = contextIds?.[HttpContextIdKeys.OriginalTenant];
+            await this._authenticationAuditService?.create({
+                actorId: email,
+                event: AuthAuditEvent.AccountDeleted,
+                data: {
+                    userIdentity: user.identity,
+                    organizationIdentity: user.organization,
+                    tenantId: requestorTenantId,
+                    originalTenantId
+                }
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "removeUserFailed", undefined, error);
+        }
+    }
+    /**
+     * Update the user's password.
+     * @param email The email address of the user to update.
+     * @param newPassword The new password for the user.
+     * @param currentPassword The current password, optional, if supplied will check against existing.
+     * @returns A promise that resolves when the password has been updated.
+     */
+    async updatePassword(email, newPassword, currentPassword) {
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "email", email);
+        Guards.stringValue(EntityStorageAuthenticationAdminService.CLASS_NAME, "newPassword", newPassword);
+        try {
+            const user = await this._userEntityStorage.get(email);
+            if (!Is.object(user)) {
+                throw new NotFoundError(EntityStorageAuthenticationAdminService.CLASS_NAME, "userNotFound", email);
+            }
+            await this.guardEscalatedPrivilegeTarget(user.identity);
+            await PasswordHelper.updatePassword(this._userEntityStorage, this._authenticationAuditService, user, newPassword, currentPassword, {
+                minPasswordLength: this._minPasswordLength,
+                maxPasswordLength: this._maxPasswordLength
+            });
+        }
+        catch (error) {
+            if (BaseError.isErrorName(error, ForbiddenError.CLASS_NAME)) {
+                throw error;
+            }
+            throw new GeneralError(EntityStorageAuthenticationAdminService.CLASS_NAME, "updatePasswordFailed", undefined, error);
+        }
+    }
+    /**
+     * Ensure the caller holds escalated privilege when the target identity holds it.
+     * @param targetIdentity The identity of the account being modified.
+     * @throws ForbiddenError if the target holds escalated privilege and the caller does not.
+     * @internal
+     */
+    async guardEscalatedPrivilegeTarget(targetIdentity) {
+        if (Is.empty(this._authorizationComponent)) {
+            return;
+        }
+        const targetIsEscalated = await this._authorizationComponent.hasRoleForSubject(this._authorizationModelId, targetIdentity, this._escalatedPrivilegeRole);
+        if (!targetIsEscalated) {
+            return;
+        }
+        const contextIds = await ContextIdStore.getContextIds();
+        const callerIdentity = contextIds?.[ContextIdKeys.User];
+        const callerIsEscalated = Is.stringValue(callerIdentity) &&
+            (await this._authorizationComponent.hasRoleForSubject(this._authorizationModelId, callerIdentity, this._escalatedPrivilegeRole));
+        if (!callerIsEscalated) {
+            throw new ForbiddenError(EntityStorageAuthenticationAdminService.CLASS_NAME, "insufficientRoleForEscalatedTarget", { roleName: this._escalatedPrivilegeRole });
+        }
+    }
+}
+//# sourceMappingURL=entityStorageAuthenticationAdminService.js.map