@3sixty/api-auth-entity-storage-service 0.20.0-next.0 → 0.20.0-next.1

package/docs/reference/classes/AuthHeaderProcessor.md

@@ -132,6 +132,8 @@ The context IDs of the request.
 
 ##### processorState
 
+\{\[`id`: `string`\]: `unknown`; \}
+
 The state handed through the processors.
 
 #### Returns
@@ -180,6 +182,8 @@ The context IDs of the request.
 
 ##### processorState
 
+\{\[`id`: `string`\]: `unknown`; \}
+
 The state handed through the processors.
 
 #### Returns

package/docs/reference/classes/AuthenticationUser.md

@@ -54,14 +54,6 @@ The users organization.
 
 ***
 
-### scope {#scope}
-
-> **scope**: `string`
-
-The scope assigned to the user, comma separated.
-
-***
-
 ### passwordVersion? {#passwordversion}
 
 > `optional` **passwordVersion?**: `number`

package/docs/reference/classes/AuthenticationUserV0.md

@@ -0,0 +1,69 @@
+# Class: AuthenticationUserV0
+
+Class defining the storage for user login credentials.
+
+## Constructors
+
+### Constructor
+
+> **new AuthenticationUserV0**(): `AuthenticationUserV0`
+
+#### Returns
+
+`AuthenticationUserV0`
+
+## Properties
+
+### email {#email}
+
+> **email**: `string`
+
+The user e-mail address.
+
+***
+
+### password {#password}
+
+> **password**: `string`
+
+The encrypted password for the user.
+
+***
+
+### salt {#salt}
+
+> **salt**: `string`
+
+The salt for the password.
+
+***
+
+### identity {#identity}
+
+> **identity**: `string`
+
+The user identity.
+
+***
+
+### organization {#organization}
+
+> **organization**: `string`
+
+The users organization.
+
+***
+
+### scope {#scope}
+
+> **scope**: `string`
+
+The scope assigned to the user, comma separated.
+
+***
+
+### passwordVersion? {#passwordversion}
+
+> `optional` **passwordVersion?**: `number`
+
+The password version counter, incremented on every password change to invalidate existing tokens.

package/docs/reference/classes/EntityStorageAuthenticationAdminService.md

@@ -36,11 +36,19 @@ Runtime name for the class.
 
 ***
 
-### DEFAULT\_ESCALATED\_PRIVILEGE\_SCOPE {#default_escalated_privilege_scope}
+### DEFAULT\_ESCALATED\_PRIVILEGE\_ROLE {#default_escalated_privilege_role}
 
-> `readonly` `static` **DEFAULT\_ESCALATED\_PRIVILEGE\_SCOPE**: `string` = `"global-admin"`
+> `readonly` `static` **DEFAULT\_ESCALATED\_PRIVILEGE\_ROLE**: `string` = `"global-admin"`
 
-The scope value that grants permission to assign privileged roles.
+The default role that grants escalated privilege.
+
+***
+
+### DEFAULT\_AUTHORIZATION\_MODEL\_ID {#default_authorization_model_id}
+
+> `readonly` `static` **DEFAULT\_AUTHORIZATION\_MODEL\_ID**: `string` = `"system"`
+
+The default authorization model ID used to look up roles.
 
 ## Methods
 

package/docs/reference/classes/EntityStorageAuthenticationService.md

@@ -219,3 +219,21 @@ A promise that resolves when the password has been updated and the rate limit cl
 #### Implementation of
 
 `IAuthenticationComponent.updatePassword`
+
+***
+
+### passwordPolicy() {#passwordpolicy}
+
+> **passwordPolicy**(): `Promise`\<`IPasswordOptions`\>
+
+Get the password policy used for password validation.
+
+#### Returns
+
+`Promise`\<`IPasswordOptions`\>
+
+The password policy options.
+
+#### Implementation of
+
+`IAuthenticationComponent.passwordPolicy`

package/docs/reference/classes/PasswordHelper.md

@@ -24,7 +24,7 @@ Runtime name for the class.
 
 ### updatePassword() {#updatepassword}
 
-> `static` **updatePassword**(`userEntityStorage`, `authenticationAuditService`, `user`, `newPassword`, `currentPassword?`, `minPasswordLength?`): `Promise`\<`void`\>
+> `static` **updatePassword**(`userEntityStorage`, `authenticationAuditService`, `user`, `newPassword`, `currentPassword?`, `options?`): `Promise`\<`void`\>
 
 Update the password for a user.
 Validates password strength, verifies the current password if provided, then hashes and stores the new password and raises an audit event.
@@ -61,11 +61,11 @@ The new password to set.
 
 The current password to verify against, if supplied.
 
-##### minPasswordLength?
+##### options?
 
-`number`
+`IPasswordOptions`
 
-Optional minimum password length for validation.
+Optional password length validation options.
 
 #### Returns
 

package/docs/reference/classes/TokenHelper.md

@@ -24,7 +24,7 @@ Runtime name for the class.
 
 ### createToken() {#createtoken}
 
-> `static` **createToken**(`vaultConnector`, `nodeId`, `signingKeyName`, `userIdentity`, `organizationIdentity`, `tenantId`, `ttlMinutes`, `scope?`, `passwordVersion?`): `Promise`\<\{ `token`: `string`; `expiry`: `number`; \}\>
+> `static` **createToken**(`vaultConnector`, `nodeId`, `signingKeyName`, `userIdentity`, `organizationIdentity`, `tenantId`, `ttlMinutes`, `passwordVersion?`): `Promise`\<\{ `token`: `string`; `expiry`: `number`; \}\>
 
 Create a new token.
 
@@ -72,12 +72,6 @@ The tenant id for the token.
 
 The time to live for the token in minutes.
 
-##### scope?
-
-`string`
-
-The scopes for the token.
-
 ##### passwordVersion?
 
 `number`
@@ -94,7 +88,7 @@ The new token and its expiry date.
 
 ### verify() {#verify}
 
-> `static` **verify**(`vaultConnector`, `nodeId`, `signingKeyName`, `token`, `requiredScopes?`, `verifyUser?`): `Promise`\<\{ `header`: `JWTHeaderParameters`; `payload`: `JWTPayload`; \}\>
+> `static` **verify**(`vaultConnector`, `nodeId`, `signingKeyName`, `token`, `verifyUser?`): `Promise`\<\{ `header`: `JWTHeaderParameters`; `payload`: `JWTPayload`; \}\>
 
 Verify the token.
 
@@ -124,12 +118,6 @@ The signing key name, expected to match the JWT key identifier.
 
 The token to verify.
 
-##### requiredScopes?
-
-`string`[]
-
-The required scopes.
-
 ##### verifyUser?
 
 (`sub`, `org`, `tid`, `passwordVersion`) => `Promise`\<`string`[]\>
@@ -148,36 +136,6 @@ UnauthorizedError if the token is missing, invalid or expired.
 
 ***
 
-### verifyScopes() {#verifyscopes}
-
-> `static` **verifyScopes**(`scope`, `requiredScopes?`): `void`
-
-Verify that a token carries all of the required scopes.
-
-#### Parameters
-
-##### scope
-
-`string` \| `undefined`
-
-The comma separated scopes from the token.
-
-##### requiredScopes?
-
-`string`[]
-
-The scopes the caller must hold.
-
-#### Returns
-
-`void`
-
-#### Throws
-
-UnauthorizedError if any of the required scopes is missing.
-
-***
-
 ### extractTokenFromHeaders() {#extracttokenfromheaders}
 
 > `static` **extractTokenFromHeaders**(`headers?`, `cookieName?`): \{ `token`: `string`; `location`: `"authorization"` \| `"cookie"`; \} \| `undefined`

package/docs/reference/functions/authenticationPasswordPolicy.md

@@ -0,0 +1,31 @@
+# Function: authenticationPasswordPolicy()
+
+> **authenticationPasswordPolicy**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IPasswordPolicyResponse` & `IRestRouteResponseOptions`\>
+
+Get the password policy.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`INoContentRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IPasswordPolicyResponse` & `IRestRouteResponseOptions`\>
+
+The response object with additional http response properties.

package/docs/reference/index.md

@@ -2,13 +2,10 @@
 
 ## Classes
 
-- [AuthenticationAuditEntry](classes/AuthenticationAuditEntry.md)
-- [AuthenticationRateEntry](classes/AuthenticationRateEntry.md)
 - [AuthenticationUser](classes/AuthenticationUser.md)
+- [AuthenticationUserV0](classes/AuthenticationUserV0.md)
 - [AuthHeaderProcessor](classes/AuthHeaderProcessor.md)
 - [EntityStorageAuthenticationAdminService](classes/EntityStorageAuthenticationAdminService.md)
-- [EntityStorageAuthenticationAuditService](classes/EntityStorageAuthenticationAuditService.md)
-- [EntityStorageAuthenticationRateService](classes/EntityStorageAuthenticationRateService.md)
 - [EntityStorageAuthenticationService](classes/EntityStorageAuthenticationService.md)
 - [PasswordHelper](classes/PasswordHelper.md)
 - [TokenHelper](classes/TokenHelper.md)
@@ -20,10 +17,6 @@
 - [IAuthTokenContext](interfaces/IAuthTokenContext.md)
 - [IEntityStorageAuthenticationAdminServiceConfig](interfaces/IEntityStorageAuthenticationAdminServiceConfig.md)
 - [IEntityStorageAuthenticationAdminServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md)
-- [IEntityStorageAuthenticationAuditServiceConfig](interfaces/IEntityStorageAuthenticationAuditServiceConfig.md)
-- [IEntityStorageAuthenticationAuditServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md)
-- [IEntityStorageAuthenticationRateServiceConfig](interfaces/IEntityStorageAuthenticationRateServiceConfig.md)
-- [IEntityStorageAuthenticationRateServiceConstructorOptions](interfaces/IEntityStorageAuthenticationRateServiceConstructorOptions.md)
 - [IEntityStorageAuthenticationServiceConfig](interfaces/IEntityStorageAuthenticationServiceConfig.md)
 - [IEntityStorageAuthenticationServiceConstructorOptions](interfaces/IEntityStorageAuthenticationServiceConstructorOptions.md)
 
@@ -31,7 +24,6 @@
 
 - [restEntryPoints](variables/restEntryPoints.md)
 - [tagsAuthenticationAdmin](variables/tagsAuthenticationAdmin.md)
-- [tagsAuthenticationAudit](variables/tagsAuthenticationAudit.md)
 - [tagsAuthentication](variables/tagsAuthentication.md)
 
 ## Functions
@@ -43,15 +35,10 @@
 - [authenticationAdminGetUser](functions/authenticationAdminGetUser.md)
 - [authenticationAdminGetUserByIdentity](functions/authenticationAdminGetUserByIdentity.md)
 - [authenticationAdminRemoveUser](functions/authenticationAdminRemoveUser.md)
-- [generateRestRoutesAuthenticationAudit](functions/generateRestRoutesAuthenticationAudit.md)
-- [authenticationAuditCreate](functions/authenticationAuditCreate.md)
-- [authenticationAuditGet](functions/authenticationAuditGet.md)
-- [authenticationAuditUpdate](functions/authenticationAuditUpdate.md)
-- [authenticationAuditRemove](functions/authenticationAuditRemove.md)
-- [authenticationAuditQuery](functions/authenticationAuditQuery.md)
 - [generateRestRoutesAuthentication](functions/generateRestRoutesAuthentication.md)
 - [authenticationLogin](functions/authenticationLogin.md)
 - [authenticationLogout](functions/authenticationLogout.md)
 - [authenticationRefreshToken](functions/authenticationRefreshToken.md)
 - [authenticationUpdatePassword](functions/authenticationUpdatePassword.md)
+- [authenticationPasswordPolicy](functions/authenticationPasswordPolicy.md)
 - [initSchema](functions/initSchema.md)

package/docs/reference/interfaces/IAuthHeaderProcessorConfig.md

@@ -48,8 +48,7 @@ The time in milliseconds a verified token is kept in the in-memory cache, counte
 was verified and not extended by use, set to 0 to disable caching. A hit skips the vault
 signature check, the tenant lookup and the user lookup, so this is also the longest a password
 change, a user removal or a signing key rotation can go unnoticed. An entry never outlives the
-expiry claim of its own token either. The scopes a route requires are still checked for every
-request.
+expiry claim of its own token either.
 
 #### Default
 

package/docs/reference/interfaces/IAuthTokenContext.md

@@ -45,14 +45,6 @@ The organization of the verified user.
 
 ***
 
-### scope? {#scope}
-
-> `optional` **scope?**: `string`
-
-The comma separated scopes carried by the token.
-
-***
-
 ### expires? {#expires}
 
 > `optional` **expires?**: `number`

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConfig.md

@@ -13,13 +13,47 @@ The minimum password length.
 #### Default
 
 ```ts
-8
+15
 ```
 
 ***
 
-### escalatedPrivilegeScope? {#escalatedprivilegescope}
+### maxPasswordLength? {#maxpasswordlength}
 
-> `optional` **escalatedPrivilegeScope?**: `string`
+> `optional` **maxPasswordLength?**: `number`
 
-The scope value that grants escalated privilege to assign privileged roles. Defaults to "global-admin".
+The maximum password length.
+
+#### Default
+
+```ts
+128
+```
+
+***
+
+### escalatedPrivilegeRole? {#escalatedprivilegerole}
+
+> `optional` **escalatedPrivilegeRole?**: `string`
+
+The role that grants escalated privilege, only callers holding it can modify accounts that hold it.
+
+#### Default
+
+```ts
+global-admin
+```
+
+***
+
+### authorizationModelId? {#authorizationmodelid}
+
+> `optional` **authorizationModelId?**: `string`
+
+The authorization model ID used to look up roles.
+
+#### Default
+
+```ts
+system
+```

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md

@@ -22,7 +22,7 @@ authentication-user
 
 > `optional` **authenticationAuditServiceType?**: `string`
 
-The audit service.
+The audit component.
 
 #### Default
 
@@ -32,6 +32,20 @@ authentication-audit
 
 ***
 
+### authorizationComponentType? {#authorizationcomponenttype}
+
+> `optional` **authorizationComponentType?**: `string`
+
+The authorization component used to guard accounts with escalated privilege.
+
+#### Default
+
+```ts
+authorization
+```
+
+***
+
 ### config? {#config}
 
 > `optional` **config?**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)

package/docs/reference/interfaces/IEntityStorageAuthenticationServiceConfig.md

@@ -41,7 +41,21 @@ The minimum password length for new password validation.
 #### Default
 
 ```ts
-8
+15
+```
+
+***
+
+### maxPasswordLength? {#maxpasswordlength}
+
+> `optional` **maxPasswordLength?**: `number`
+
+The maximum password length for new password validation.
+
+#### Default
+
+```ts
+128
 ```
 
 ***

package/docs/reference/variables/restEntryPoints.md

@@ -2,4 +2,4 @@
 
 > `const` **restEntryPoints**: `IRestRouteEntryPoint`[]
 
-REST entry points for the authentication, authentication admin, and authentication audit services.
+REST entry points for the authentication and authentication admin services.

package/locales/en.json

@@ -14,8 +14,7 @@
 			"removeUserFailed": "Removing the user failed",
 			"updatePasswordFailed": "Updating the user's password failed",
 			"userNotFound": "The user with the specified e-mail could not be found \"{notFoundId}\"",
-			"insufficientScopeForEscalatedPrivilege": "Caller does not hold the required scope \"{scopeName}\" to assign a role with escalated privilege.",
-			"insufficientScopeForEscalatedTarget": "Caller does not hold the required scope \"{scopeName}\" to modify an account with escalated privilege."
+			"insufficientRoleForEscalatedTarget": "Caller does not hold the required role \"{roleName}\" to modify an account with escalated privilege."
 		},
 		"authHeaderProcessor": {
 			"nodeIdNotSet": "The node ID has not been set"
@@ -23,16 +22,6 @@
 		"passwordHelper": {
 			"currentPasswordMismatch": "The current password is incorrect"
 		},
-		"entityStorageAuthenticationAuditService": {
-			"auditEntryNotFound": "The audit entry with the specified identifier could not be found \"{notFoundId}\"",
-			"getAuditEntryFailed": "Getting the audit entry failed",
-			"updateAuditEntryFailed": "Updating the audit entry failed",
-			"removeAuditEntryFailed": "Removing the audit entry failed"
-		},
-		"entityStorageAuthenticationRateService": {
-			"actionConfigMissing": "No rate-limit configuration exists for action \"{action}\".",
-			"rateLimitExceeded": "The rate limit for action \"{action}\" has been exceeded. Retry after {retryAfterSeconds} seconds."
-		},
 		"tokenHelper": {
 			"missing": "The JSON Web token could not be found in the authorization header",
 			"headerKeyIdMismatch": "The JSON Web token key identifier does not match the expected signing key",
@@ -40,13 +29,9 @@
 			"payloadMissingSubject": "The JSON Web token payload does not contain a subject",
 			"payloadMissingOrganization": "The JSON Web token payload does not contain an organization",
 			"expired": "The JSON Web token has expired",
-			"insufficientScopes": "The JSON Web token does not have the required scopes to access this resource",
 			"userNotVerified": "The user associated with the JSON Web token could not be verified",
 			"organizationNotVerified": "The organization associated with the JSON Web token could not be verified",
 			"tenantNotVerified": "The tenant associated with the JSON Web token could not be verified"
-		},
-		"validation": {
-			"saltEntropyTooLow": "Salt must have at least 8 unique characters for sufficient entropy."
 		}
 	}
 }

package/package.json

@@ -1,10 +1,10 @@
 {
 	"name": "@3sixty/api-auth-entity-storage-service",
-	"version": "0.20.0-next.0",
+	"version": "0.20.0-next.1",
 	"description": "Authentication service implementation and REST routes backed by entity storage.",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/3sixtyglobal/api.git",
+		"url": "git+https://github.com/3sixtyglobal/api-auth.git",
 		"directory": "packages/api-auth-entity-storage-service"
 	},
 	"author": "martyn.janes@iota.org",
@@ -14,16 +14,15 @@
 		"node": ">=24.0.0"
 	},
 	"dependencies": {
-		"@3sixty/api-auth-entity-storage-models": "0.20.0-next.0",
-		"@3sixty/api-core": "0.20.0-next.0",
-		"@3sixty/api-models": "0.20.0-next.0",
-		"@3sixty/background-task-models": "next",
+		"@3sixty/api-auth-entity-storage-models": "0.20.0-next.1",
+		"@3sixty/api-auth-models": "0.20.0-next.1",
+		"@3sixty/api-models": "next",
+		"@3sixty/authorization-models": "next",
 		"@3sixty/context": "next",
 		"@3sixty/core": "next",
 		"@3sixty/crypto": "next",
 		"@3sixty/entity": "next",
 		"@3sixty/entity-storage-models": "next",
-		"@3sixty/logging-models": "next",
 		"@3sixty/nameof": "next",
 		"@3sixty/vault-models": "next",
 		"@3sixty/web": "next"
@@ -59,7 +58,7 @@
 		"business-logic"
 	],
 	"bugs": {
-		"url": "git+https://github.com/3sixtyglobal/api/issues"
+		"url": "git+https://github.com/3sixtyglobal/api-auth/issues"
 	},
 	"homepage": "https://3sixty.global"
 }

package/dist/es/entities/authenticationAuditEntry.js

@@ -1,121 +0,0 @@
-// Copyright 2026 IOTA Stiftung.
-// SPDX-License-Identifier: Apache-2.0.
-import { SortDirection, entity, property } from "@3sixty/entity";
-/**
- * Class defining the storage for authentication audit entries.
- */
-let AuthenticationAuditEntry = class AuthenticationAuditEntry {
-    /**
-     * The unique identifier for the audit entry.
-     */
-    id;
-    /**
-     * The timestamp of the audit entry in ISO 8601 format.
-     */
-    dateCreated;
-    /**
-     * The audit event that occurred.
-     */
-    event;
-    /**
-     * The actor identifier, could be e-mail, username, or other unique identifier.
-     */
-    actorId;
-    /**
-     * The node identifier associated with the audit entry, if applicable.
-     */
-    nodeId;
-    /**
-     * The organization identifier associated with the audit entry, if applicable.
-     */
-    organizationId;
-    /**
-     * The tenant identifier associated with the audit entry, if applicable.
-     */
-    tenantId;
-    /**
-     * The hashed IP addresses of the client.
-     */
-    ipAddressHashes;
-    /**
-     * The user agent string of the client.
-     */
-    userAgent;
-    /**
-     * The correlation ID for request tracing.
-     */
-    correlationId;
-    /**
-     * Additional data related to the audit entry, such as IP address, user agent, etc.
-     */
-    data;
-};
-__decorate([
-    property({ type: "string", isPrimary: true, maxLength: 255 }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "id", void 0);
-__decorate([
-    property({
-        type: "string",
-        format: "date-time",
-        isSecondary: true,
-        indexGroup: [{ name: "actorDate", direction: SortDirection.Descending, index: 1 }]
-    }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "dateCreated", void 0);
-__decorate([
-    property({
-        type: "string",
-        maxLength: 128,
-        isSecondary: true
-    }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "event", void 0);
-__decorate([
-    property({
-        type: "string",
-        maxLength: 255,
-        isSecondary: true,
-        optional: true,
-        indexGroup: [{ name: "actorDate", direction: SortDirection.Ascending, index: 0 }]
-    }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "actorId", void 0);
-__decorate([
-    property({ type: "string", maxLength: 255, isSecondary: true, optional: true }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "nodeId", void 0);
-__decorate([
-    property({ type: "string", maxLength: 255, isSecondary: true, optional: true }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "organizationId", void 0);
-__decorate([
-    property({
-        type: "string",
-        maxLength: 255,
-        isSecondary: true,
-        optional: true
-    }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "tenantId", void 0);
-__decorate([
-    property({ type: "array", optional: true }),
-    __metadata("design:type", Array)
-], AuthenticationAuditEntry.prototype, "ipAddressHashes", void 0);
-__decorate([
-    property({ type: "string", maxLength: 1024, optional: true }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "userAgent", void 0);
-__decorate([
-    property({ type: "string", maxLength: 255, optional: true }),
-    __metadata("design:type", String)
-], AuthenticationAuditEntry.prototype, "correlationId", void 0);
-__decorate([
-    property({ type: "object", optional: true }),
-    __metadata("design:type", Object)
-], AuthenticationAuditEntry.prototype, "data", void 0);
-AuthenticationAuditEntry = __decorate([
-    entity()
-], AuthenticationAuditEntry);
-export { AuthenticationAuditEntry };
-//# sourceMappingURL=authenticationAuditEntry.js.map