@3sixty/api-auth-entity-storage-service 0.20.0-next.0 → 0.20.0-next.1

package/dist/types/index.d.ts

@@ -1,26 +1,18 @@
-export * from "./entities/authenticationAuditEntry.js";
-export * from "./entities/authenticationRateEntry.js";
 export * from "./entities/authenticationUser.js";
+export * from "./entities/authenticationUserV0.js";
 export * from "./models/IAuthHeaderProcessorConfig.js";
 export * from "./models/IAuthHeaderProcessorConstructorOptions.js";
 export * from "./models/IAuthTokenContext.js";
 export * from "./models/IEntityStorageAuthenticationAdminServiceConfig.js";
 export * from "./models/IEntityStorageAuthenticationAdminServiceConstructorOptions.js";
-export * from "./models/IEntityStorageAuthenticationAuditServiceConfig.js";
-export * from "./models/IEntityStorageAuthenticationAuditServiceConstructorOptions.js";
-export * from "./models/IEntityStorageAuthenticationRateServiceConfig.js";
-export * from "./models/IEntityStorageAuthenticationRateServiceConstructorOptions.js";
 export * from "./models/IEntityStorageAuthenticationServiceConfig.js";
 export * from "./models/IEntityStorageAuthenticationServiceConstructorOptions.js";
 export * from "./processors/authHeaderProcessor.js";
 export * from "./restEntryPoints.js";
 export * from "./routes/entityStorageAuthenticationAdminRoutes.js";
-export * from "./routes/entityStorageAuthenticationAuditRoutes.js";
 export * from "./routes/entityStorageAuthenticationRoutes.js";
 export * from "./schema.js";
 export * from "./services/entityStorageAuthenticationAdminService.js";
-export * from "./services/entityStorageAuthenticationAuditService.js";
-export * from "./services/entityStorageAuthenticationRateService.js";
 export * from "./services/entityStorageAuthenticationService.js";
 export * from "./utils/tokenHelper.js";
 export * from "./utils/passwordHelper.js";

package/dist/types/models/IAuthHeaderProcessorConfig.d.ts

@@ -21,8 +21,7 @@ export interface IAuthHeaderProcessorConfig {
      * was verified and not extended by use, set to 0 to disable caching. A hit skips the vault
      * signature check, the tenant lookup and the user lookup, so this is also the longest a password
      * change, a user removal or a signing key rotation can go unnoticed. An entry never outlives the
-     * expiry claim of its own token either. The scopes a route requires are still checked for every
-     * request.
+     * expiry claim of its own token either.
      * @default 30000
      */
     tokenCacheTtlMs?: number;

package/dist/types/models/IAuthTokenContext.d.ts

@@ -23,10 +23,6 @@ export interface IAuthTokenContext {
      * The organization of the verified user.
      */
     userOrganization?: string;
-    /**
-     * The comma separated scopes carried by the token.
-     */
-    scope?: string;
     /**
      * The expiry of the token in milliseconds since the epoch, if it carried one.
      */

package/dist/types/models/IEntityStorageAuthenticationAdminServiceConfig.d.ts

@@ -4,11 +4,22 @@
 export interface IEntityStorageAuthenticationAdminServiceConfig {
     /**
      * The minimum password length.
-     * @default 8
+     * @default 15
      */
     minPasswordLength?: number;
     /**
-     * The scope value that grants escalated privilege to assign privileged roles. Defaults to "global-admin".
+     * The maximum password length.
+     * @default 128
      */
-    escalatedPrivilegeScope?: string;
+    maxPasswordLength?: number;
+    /**
+     * The role that grants escalated privilege, only callers holding it can modify accounts that hold it.
+     * @default global-admin
+     */
+    escalatedPrivilegeRole?: string;
+    /**
+     * The authorization model ID used to look up roles.
+     * @default system
+     */
+    authorizationModelId?: string;
 }

package/dist/types/models/IEntityStorageAuthenticationAdminServiceConstructorOptions.d.ts

@@ -9,10 +9,15 @@ export interface IEntityStorageAuthenticationAdminServiceConstructorOptions {
      */
     userEntityStorageType?: string;
     /**
-     * The audit service.
+     * The audit component.
      * @default authentication-audit
      */
     authenticationAuditServiceType?: string;
+    /**
+     * The authorization component used to guard accounts with escalated privilege.
+     * @default authorization
+     */
+    authorizationComponentType?: string;
     /**
      * The configuration for the authentication.
      */

package/dist/types/models/IEntityStorageAuthenticationServiceConfig.d.ts

@@ -1,4 +1,4 @@
-import type { IAuthenticationRateActionConfig } from "@3sixty/api-auth-entity-storage-models";
+import type { IAuthenticationRateActionConfig } from "@3sixty/api-auth-models";
 /**
  * Configuration for the entity storage authentication service.
  */
@@ -15,9 +15,14 @@ export interface IEntityStorageAuthenticationServiceConfig {
     defaultTtlMinutes?: number;
     /**
      * The minimum password length for new password validation.
-     * @default 8
+     * @default 15
      */
     minPasswordLength?: number;
+    /**
+     * The maximum password length for new password validation.
+     * @default 128
+     */
+    maxPasswordLength?: number;
     /**
      * Optional override for login failure rate limit.
      * @default { maxAttempts: 5, windowMinutes: 15 }

package/dist/types/restEntryPoints.d.ts

@@ -1,5 +1,5 @@
 import type { IRestRouteEntryPoint } from "@3sixty/api-models";
 /**
- * REST entry points for the authentication, authentication admin, and authentication audit services.
+ * REST entry points for the authentication and authentication admin services.
  */
 export declare const restEntryPoints: IRestRouteEntryPoint[];

package/dist/types/routes/entityStorageAuthenticationRoutes.d.ts

@@ -1,5 +1,5 @@
-import type { ILoginRequest, ILoginResponse, ILogoutRequest, IRefreshTokenRequest, IRefreshTokenResponse, IUpdatePasswordRequest } from "@3sixty/api-auth-entity-storage-models";
-import type { IHttpRequestContext, INoContentResponse, IRestRoute, IRestRouteResponseOptions, ITag } from "@3sixty/api-models";
+import type { ILoginRequest, ILoginResponse, ILogoutRequest, IPasswordPolicyResponse, IRefreshTokenRequest, IRefreshTokenResponse, IUpdatePasswordRequest } from "@3sixty/api-auth-entity-storage-models";
+import type { IHttpRequestContext, INoContentRequest, INoContentResponse, IRestRoute, IRestRouteResponseOptions, ITag } from "@3sixty/api-models";
 /**
  * The tag to associate with the routes.
  */
@@ -43,3 +43,11 @@ export declare function authenticationRefreshToken(httpRequestContext: IHttpRequ
  * @returns The response object with additional http response properties.
  */
 export declare function authenticationUpdatePassword(httpRequestContext: IHttpRequestContext, componentName: string, request: IUpdatePasswordRequest): Promise<INoContentResponse>;
+/**
+ * Get the password policy.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationPasswordPolicy(httpRequestContext: IHttpRequestContext, componentName: string, request: INoContentRequest): Promise<IPasswordPolicyResponse & IRestRouteResponseOptions>;

package/dist/types/services/entityStorageAuthenticationAdminService.d.ts

@@ -9,9 +9,13 @@ export declare class EntityStorageAuthenticationAdminService implements IAuthent
      */
     static readonly CLASS_NAME: string;
     /**
-     * The scope value that grants permission to assign privileged roles.
+     * The default role that grants escalated privilege.
      */
-    static readonly DEFAULT_ESCALATED_PRIVILEGE_SCOPE: string;
+    static readonly DEFAULT_ESCALATED_PRIVILEGE_ROLE: string;
+    /**
+     * The default authorization model ID used to look up roles.
+     */
+    static readonly DEFAULT_AUTHORIZATION_MODEL_ID: string;
     /**
      * Create a new instance of EntityStorageAuthentication.
      * @param options The dependencies for the identity connector.

package/dist/types/services/entityStorageAuthenticationService.d.ts

@@ -1,4 +1,4 @@
-import type { IAuthenticationComponent } from "@3sixty/api-auth-entity-storage-models";
+import type { IAuthenticationComponent, IPasswordOptions } from "@3sixty/api-auth-entity-storage-models";
 import type { IEntityStorageAuthenticationServiceConstructorOptions } from "../models/IEntityStorageAuthenticationServiceConstructorOptions.js";
 /**
  * Implementation of the authentication component using entity storage.
@@ -62,4 +62,9 @@ export declare class EntityStorageAuthenticationService implements IAuthenticati
      * @returns A promise that resolves when the password has been updated and the rate limit cleared.
      */
     updatePassword(currentPassword: string, newPassword: string): Promise<void>;
+    /**
+     * Get the password policy used for password validation.
+     * @returns The password policy options.
+     */
+    passwordPolicy(): Promise<IPasswordOptions>;
 }

package/dist/types/utils/passwordHelper.d.ts

@@ -1,4 +1,5 @@
-import type { IAuthenticationAuditComponent } from "@3sixty/api-auth-entity-storage-models";
+import type { IPasswordOptions } from "@3sixty/api-auth-entity-storage-models";
+import type { IAuthenticationAuditComponent } from "@3sixty/api-auth-models";
 import type { IEntityStorageConnector } from "@3sixty/entity-storage-models";
 import type { AuthenticationUser } from "../entities/authenticationUser.js";
 /**
@@ -17,8 +18,10 @@ export declare class PasswordHelper {
      * @param user The user whose password is being updated.
      * @param newPassword The new password to set.
      * @param currentPassword The current password to verify against, if supplied.
-     * @param minPasswordLength Optional minimum password length for validation.
+     * @param options Optional password length validation options.
+     * @param options.minPasswordLength Optional minimum password length for validation.
+     * @param options.maxPasswordLength Optional maximum password length for validation.
      * @returns A promise that resolves when the new password has been stored and the audit entry recorded.
      */
-    static updatePassword(userEntityStorage: IEntityStorageConnector<AuthenticationUser>, authenticationAuditService: IAuthenticationAuditComponent | undefined, user: AuthenticationUser, newPassword: string, currentPassword?: string, minPasswordLength?: number): Promise<void>;
+    static updatePassword(userEntityStorage: IEntityStorageConnector<AuthenticationUser>, authenticationAuditService: IAuthenticationAuditComponent | undefined, user: AuthenticationUser, newPassword: string, currentPassword?: string, options?: IPasswordOptions): Promise<void>;
 }

package/dist/types/utils/tokenHelper.d.ts

@@ -17,11 +17,10 @@ export declare class TokenHelper {
      * @param organizationIdentity The organization for the token.
      * @param tenantId The tenant id for the token.
      * @param ttlMinutes The time to live for the token in minutes.
-     * @param scope The scopes for the token.
      * @param passwordVersion The user's current password version counter, embedded in the token so that a password change invalidates existing tokens.
      * @returns The new token and its expiry date.
      */
-    static createToken(vaultConnector: IVaultConnector, nodeId: string, signingKeyName: string, userIdentity: string, organizationIdentity: string | undefined, tenantId: string | undefined, ttlMinutes: number, scope?: string, passwordVersion?: number): Promise<{
+    static createToken(vaultConnector: IVaultConnector, nodeId: string, signingKeyName: string, userIdentity: string, organizationIdentity: string | undefined, tenantId: string | undefined, ttlMinutes: number, passwordVersion?: number): Promise<{
         token: string;
         expiry: number;
     }>;
@@ -31,22 +30,14 @@ export declare class TokenHelper {
      * @param nodeId The node identifier, expected to match the JWT issuer claim.
      * @param signingKeyName The signing key name, expected to match the JWT key identifier.
      * @param token The token to verify.
-     * @param requiredScopes The required scopes.
      * @param verifyUser A function to verify the user identity and organization. The password version counter embedded in the token (pver claim) is passed so callers can detect if the password has changed since the token was issued.
      * @returns The verified details.
      * @throws UnauthorizedError if the token is missing, invalid or expired.
      */
-    static verify(vaultConnector: IVaultConnector, nodeId: string, signingKeyName: string, token: string | undefined, requiredScopes?: string[], verifyUser?: (sub: string, org: string, tid: string | undefined, passwordVersion: number | undefined) => Promise<string[]>): Promise<{
+    static verify(vaultConnector: IVaultConnector, nodeId: string, signingKeyName: string, token: string | undefined, verifyUser?: (sub: string, org: string, tid: string | undefined, passwordVersion: number | undefined) => Promise<string[]>): Promise<{
         header: IJwtHeader;
         payload: IJwtPayload;
     }>;
-    /**
-     * Verify that a token carries all of the required scopes.
-     * @param scope The comma separated scopes from the token.
-     * @param requiredScopes The scopes the caller must hold.
-     * @throws UnauthorizedError if any of the required scopes is missing.
-     */
-    static verifyScopes(scope: string | undefined, requiredScopes?: string[]): void;
     /**
      * Extract the auth token from the headers, either from the authorization header or the cookie header.
      * @param headers The headers to extract the token from.

package/docs/changelog.md

@@ -0,0 +1,19 @@
+# Changelog
+
+## [0.20.0-next.1](https://github.com/3sixtyglobal/api-auth/compare/api-auth-entity-storage-service-v0.20.0-next.0...api-auth-entity-storage-service-v0.20.0-next.1) (2026-10-23)
+
+
+### Features
+
+* authorization ([#3](https://github.com/3sixtyglobal/api-auth/issues/3)) ([5688693](https://github.com/3sixtyglobal/api-auth/commit/568869364065b9d2c82c5c17c81f07cbdc64ec8b))
+* initial commit ([b9112fb](https://github.com/3sixtyglobal/api-auth/commit/b9112fb6994758b43effdde1b9e41435ff50fe50))
+* publish packages under the [@3sixty](https://github.com/3sixty) namespace ([6c22482](https://github.com/3sixtyglobal/api-auth/commit/6c2248295620000807ff91087c3b1dfc9b018b31))
+* updated ts compile ([83c72bd](https://github.com/3sixtyglobal/api-auth/commit/83c72bd5d2e9d81208b7a2755450d96fbbb04004))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @3sixty/api-auth-entity-storage-models bumped from 0.20.0-next.0 to 0.20.0-next.1
+    * @3sixty/api-auth-models bumped from 0.20.0-next.0 to 0.20.0-next.1

package/docs/examples.md

@@ -15,19 +15,18 @@ await adminService.create({
   email: 'owner@example.org',
   password: 'StartPassword123',
   userIdentity: 'did:example:owner',
-  organizationIdentity: 'did:example:org',
-  scope: ['admin']
+  organizationIdentity: 'did:example:org'
 });
 
 await adminService.update({
   email: 'owner@example.org',
-  scope: ['admin', 'security']
+  organizationIdentity: 'did:example:org:security'
 });
 
 await adminService.updatePassword('owner@example.org', 'StartPassword124', 'StartPassword123');
 
 const fromIdentity = await adminService.getByIdentity('did:example:owner');
-console.log(fromIdentity.scope.length); // 2
+console.log(fromIdentity.organizationIdentity); // did:example:org:security
 ```
 
 ```typescript
@@ -50,6 +49,9 @@ const authService = new EntityStorageAuthenticationService();
 await authService.start('default');
 console.log(authService.className()); // EntityStorageAuthenticationService
 
+const policy = await authService.passwordPolicy();
+console.log(policy.minPasswordLength); // 8
+
 const loginResult = await authService.login('alice@example.org', 'correct-horse-battery-staple');
 
 const refreshResult = await authService.refresh(loginResult.token);
@@ -58,96 +60,8 @@ await authService.updatePassword('correct-horse-battery-staple', 'correct-horse-
 
 await authService.logout(refreshResult.token);
 console.log(refreshResult.expiry > 0); // true
-```
-
-## EntityStorageAuthenticationRateService
-
-```typescript
-import { EntityStorageAuthenticationRateService } from '@3sixty/api-auth-entity-storage-service';
-import { BaseError, GeneralError } from '@3sixty/core';
-import { TooManyRequestsError } from '@3sixty/api-models';
-
-const rateService = new EntityStorageAuthenticationRateService({
-  config: {
-    cleanupIntervalMinutes: 5
-  }
-});
-
-console.log(rateService.className()); // EntityStorageAuthenticationRateService
-
-await rateService.registerAction('login', {
-  maxAttempts: 3,
-  windowMinutes: 15
-});
-
-await rateService.start('default');
-
-await rateService.check('login', 'alice@example.org');
-await rateService.check('login', 'alice@example.org');
-await rateService.check('login', 'alice@example.org');
-
-try {
-  await rateService.check('login', 'alice@example.org');
-} catch (error) {
-  if (BaseError.isErrorName(error, TooManyRequestsError.CLASS_NAME)) {
-    const tooMany = error as TooManyRequestsError;
-    console.log(tooMany.properties?.retryAfterSeconds); // 900
-    console.log(tooMany.properties?.nextRequestTime); // 2026-04-13T10:15:00.000Z
-  }
-}
-
-await rateService.clear('login', 'alice@example.org');
-await rateService.unregisterAction('login');
 
-try {
-  await rateService.check('login', 'alice@example.org');
-} catch (error) {
-  if (BaseError.isErrorName(error, GeneralError.CLASS_NAME)) {
-    console.log((error as GeneralError).name); // GeneralError
-  }
-}
-
-await rateService.stop('default');
-```
-
-## EntityStorageAuthenticationAuditService
-
-```typescript
-import { EntityStorageAuthenticationAuditService } from '@3sixty/api-auth-entity-storage-service';
-
-const auditService = new EntityStorageAuthenticationAuditService({
-  config: {
-    ipHashSalt: 'StrongServerSideSaltForAuditHashing123'
-  }
-});
-
-console.log(auditService.className()); // EntityStorageAuthenticationAuditService
-
-const createdAuditId = await auditService.create({
-  event: 'login-failure',
-  actorId: 'did:example:user:alice',
-  nodeId: 'did:example:node:eu-west-1',
-  organizationId: 'did:example:org:core',
-  tenantId: 'did:example:tenant:alpha',
-  data: {
-    reason: 'invalid-password'
-  }
-});
-
-const auditPage = await auditService.query(
-  {
-    actorId: 'did:example:user:alice',
-    event: 'login-failure',
-    startDate: '2026-04-01T00:00:00.000Z',
-    endDate: '2026-04-30T23:59:59.999Z'
-  },
-  undefined,
-  50
-);
-
-console.log(createdAuditId); // 018f2f67bb9d4a0caad8386f56df85ce
-console.log(auditPage.entries.length); // 1
-console.log(auditPage.cursor); // eyJpZCI6IjAxOGYyZjY3YmI5ZDRhMGNhYWQ4Mzg2ZjU2ZGY4NWNlIn0=
+await authService.stop('default');
 ```
 
 ## AuthHeaderProcessor
@@ -175,4 +89,6 @@ const processorState: { [id: string]: unknown } = {};
 await processor.pre(request, response, { skipAuth: false }, contextIds, processorState);
 
 await processor.post(request, response, { skipAuth: false }, contextIds, processorState);
+
+await processor.stop();
 ```