@3sixty/api-auth-service 0.0.0-stage → 0.20.0-next.1

package/dist/es/processors/tenantOverrideProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantOverrideProcessor.js","sources":["../../../src/processors/tenantOverrideProcessor.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,eAAe,EAOf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAoB,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACnC;;OAEG;IACI,MAAM,CAAU,qBAAqB,GAAW,iBAAiB,CAAC;IAEzE;;OAEG;IACI,MAAM,CAAU,8BAA8B,GAAW,QAAQ,CAAC;IAEzE;;OAEG;IACI,MAAM,CAAU,gCAAgC,GAAW,cAAc,CAAC;IAEjF;;OAEG;IACI,MAAM,CAAU,UAAU,GAAW,yBAAyB,CAAC;IAEtE;;;OAGG;IACc,qBAAqB,CAAwB;IAE9D;;;OAGG;IACc,uBAAuB,CAA0B;IAElE;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACc,uBAAuB,CAAS;IAEjD;;;OAGG;IACc,qBAAqB,CAAS;IAE/C;;;OAGG;IACH,YAAY,OAAoD;QAC/D,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,GAAG,CAChD,OAAO,EAAE,wBAAwB,IAAI,cAAc,CACnD,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,gBAAgB,CAAC,GAAG,CAClD,OAAO,EAAE,0BAA0B,IAAI,eAAe,CACtD,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,IAAI,KAAK,CAAC;QACtE,IAAI,CAAC,uBAAuB;YAC3B,OAAO,EAAE,MAAM,EAAE,sBAAsB;gBACvC,uBAAuB,CAAC,gCAAgC,CAAC;QAC1D,IAAI,CAAC,qBAAqB;YACzB,OAAO,EAAE,MAAM,EAAE,oBAAoB;gBACrC,uBAAuB,CAAC,8BAA8B,CAAC;IACzD,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CACf,OAA2B,EAC3B,QAAuB,EACvB,KAA6B,EAC7B,UAAuB,EACvB,cAAyC;QAEzC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/D,OAAO;QACR,CAAC;QAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3F,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QAED,uEAAuE;QACvE,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;YAC1F,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,cAAc,CACvB,uBAAuB,CAAC,UAAU,EAClC,gCAAgC,CAChC,CAAC;YACH,CAAC;YAED,4FAA4F;YAC5F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CACnE,IAAI,CAAC,qBAAqB,EAC1B,MAAM,EACN,IAAI,CAAC,uBAAuB,CAC5B,CAAC;YAEF,iDAAiD;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,IAAI,cAAc,CACvB,uBAAuB,CAAC,UAAU,EAClC,mCAAmC,CACnC,CAAC;YACH,CAAC;YAED,gDAAgD;YAChD,MAAM,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YAEnD,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAChF,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,mBAAmB,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/D,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAChD,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,qFAAqF;YACrF,yDAAyD;YACzD,IACC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC;gBACpD,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,EAChD,CAAC;gBACF,MAAM,IAAI,aAAa,CACtB,uBAAuB,CAAC,UAAU,EAClC,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;QAED,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;CACD","sourcesContent":["// Copyright 2026 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport {\n\tForbiddenError,\n\tHttpContextIdKeys,\n\tHttpErrorHelper,\n\ttype IBaseRoute,\n\ttype IBaseRouteProcessor,\n\ttype IHttpResponse,\n\ttype IHttpServerRequest,\n\ttype ITenant,\n\ttype ITenantAdminComponent\n} from \"@3sixty/api-models\";\nimport type { IAuthorizationComponent } from \"@3sixty/authorization-models\";\nimport { ContextIdKeys, type IContextIds } from \"@3sixty/context\";\nimport { BaseError, ComponentFactory, GuardError, Is, NotFoundError } from \"@3sixty/core\";\n\nimport { HttpStatusCode } from \"@3sixty/web\";\nimport type { ITenantOverrideProcessorConstructorOptions } from \"../models/ITenantOverrideProcessorConstructorOptions.js\";\n\n/**\n * Processes the overrideTenant query parameter for routes that allow tenant override.\n * Requires the caller to hold the escalated privilege role. Runs after AuthHeaderProcessor so\n * authentication is always resolved in the caller's own partition first.\n */\nexport class TenantOverrideProcessor implements IBaseRouteProcessor {\n\t/**\n\t * The query parameter name used to supply the override tenant ID.\n\t */\n\tpublic static readonly OVERRIDE_TENANT_PARAM: string = \"override-tenant\";\n\n\t/**\n\t * The model identifier that is reserved for system-only use.\n\t */\n\tpublic static readonly DEFAULT_AUTHORIZATION_MODEL_ID: string = \"system\";\n\n\t/**\n\t * The role string required to perform a tenant override.\n\t */\n\tpublic static readonly DEFAULT_ESCALATED_PRIVILEGE_ROLE: string = \"global-admin\";\n\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = \"TenantOverrideProcessor\";\n\n\t/**\n\t * The component used to resolve tenants.\n\t * @internal\n\t */\n\tprivate readonly _tenantAdminComponent: ITenantAdminComponent;\n\n\t/**\n\t * The authorization component for checking authorization roles.\n\t * @internal\n\t */\n\tprivate readonly _authorizationComponent: IAuthorizationComponent;\n\n\t/**\n\t * Include the stack with errors.\n\t * @internal\n\t */\n\tprivate readonly _includeErrorStack: boolean;\n\n\t/**\n\t * The role value that grants cross-tenant access.\n\t * @internal\n\t */\n\tprivate readonly _escalatedPrivilegeRole: string;\n\n\t/**\n\t * The authorization model ID to use for REST requests.\n\t * @internal\n\t */\n\tprivate readonly _authorizationModelId: string;\n\n\t/**\n\t * Create a new instance of TenantOverrideProcessor.\n\t * @param options Options for the processor.\n\t */\n\tconstructor(options?: ITenantOverrideProcessorConstructorOptions) {\n\t\tthis._tenantAdminComponent = ComponentFactory.get<ITenantAdminComponent>(\n\t\t\toptions?.tenantAdminComponentType ?? \"tenant-admin\"\n\t\t);\n\t\tthis._authorizationComponent = ComponentFactory.get(\n\t\t\toptions?.authorizationComponentType ?? \"authorization\"\n\t\t);\n\t\tthis._includeErrorStack = options?.config?.includeErrorStack ?? false;\n\t\tthis._escalatedPrivilegeRole =\n\t\t\toptions?.config?.escalatedPrivilegeRole ??\n\t\t\tTenantOverrideProcessor.DEFAULT_ESCALATED_PRIVILEGE_ROLE;\n\t\tthis._authorizationModelId =\n\t\t\toptions?.config?.authorizationModelId ??\n\t\t\tTenantOverrideProcessor.DEFAULT_AUTHORIZATION_MODEL_ID;\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The class name of the component.\n\t */\n\tpublic className(): string {\n\t\treturn TenantOverrideProcessor.CLASS_NAME;\n\t}\n\n\t/**\n\t * Pre process the REST request for the specified route.\n\t * @param request The incoming request.\n\t * @param response The outgoing response.\n\t * @param route The route to process.\n\t * @param contextIds The context IDs of the request.\n\t * @param processorState The state handed through the processors.\n\t * @returns A promise that resolves when the tenant override has been applied or skipped.\n\t */\n\tpublic async pre(\n\t\trequest: IHttpServerRequest,\n\t\tresponse: IHttpResponse,\n\t\troute: IBaseRoute | undefined,\n\t\tcontextIds: IContextIds,\n\t\tprocessorState: { [id: string]: unknown }\n\t): Promise<void> {\n\t\tif (Is.empty(route) || (route.disableTenantOverride ?? false)) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst overrideTenantParam = request.query?.[TenantOverrideProcessor.OVERRIDE_TENANT_PARAM];\n\t\tif (!Is.stringValue(overrideTenantParam)) {\n\t\t\treturn;\n\t\t}\n\n\t\t// If a prior processor already set an error response, skip processing.\n\t\tif (Is.notEmpty(response.statusCode) && response.statusCode >= HttpStatusCode.badRequest) {\n\t\t\treturn;\n\t\t}\n\n\t\ttry {\n\t\t\tconst userId = contextIds[ContextIdKeys.User];\n\t\t\tif (!Is.stringValue(userId)) {\n\t\t\t\tthrow new ForbiddenError(\n\t\t\t\t\tTenantOverrideProcessor.CLASS_NAME,\n\t\t\t\t\t\"missingUserIdForTenantOverride\"\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Role must be directly assigned to the user, not inherited through a group or other means.\n\t\t\tconst hasRole = await this._authorizationComponent.hasRoleForSubject(\n\t\t\t\tthis._authorizationModelId,\n\t\t\t\tuserId,\n\t\t\t\tthis._escalatedPrivilegeRole\n\t\t\t);\n\n\t\t\t// Caller must hold the escalated privilege role.\n\t\t\tif (!hasRole) {\n\t\t\t\tthrow new ForbiddenError(\n\t\t\t\t\tTenantOverrideProcessor.CLASS_NAME,\n\t\t\t\t\t\"insufficientRoleForTenantOverride\"\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Verify the tenant exists before substituting.\n\t\t\tawait this.verifyTenantExists(overrideTenantParam);\n\n\t\t\tcontextIds[HttpContextIdKeys.OriginalTenant] = contextIds[ContextIdKeys.Tenant];\n\t\t\tcontextIds[ContextIdKeys.Tenant] = overrideTenantParam;\n\t\t} catch (err) {\n\t\t\tconst error = BaseError.fromError(err);\n\t\t\tconst { httpStatusCode } = HttpErrorHelper.processError(error);\n\t\t\tHttpErrorHelper.buildResponse(response, error, httpStatusCode, this._includeErrorStack);\n\t\t}\n\t}\n\n\t/**\n\t * Confirm the tenant being switched to exists.\n\t * @param tenantId The tenant id from the override query parameter.\n\t * @throws NotFoundError if no tenant matches the id.\n\t * @internal\n\t */\n\tprivate async verifyTenantExists(tenantId: string): Promise<void> {\n\t\tlet tenant: ITenant;\n\n\t\ttry {\n\t\t\ttenant = await this._tenantAdminComponent.get(tenantId);\n\t\t} catch (err) {\n\t\t\t// An id that matches no tenant, or is not even well formed, is a not found; anything\n\t\t\t// else is a genuine fault and keeps its own status code.\n\t\t\tif (\n\t\t\t\tBaseError.isErrorName(err, NotFoundError.CLASS_NAME) ||\n\t\t\t\tBaseError.isErrorName(err, GuardError.CLASS_NAME)\n\t\t\t) {\n\t\t\t\tthrow new NotFoundError(\n\t\t\t\t\tTenantOverrideProcessor.CLASS_NAME,\n\t\t\t\t\t\"tenantNotFound\",\n\t\t\t\t\ttenantId,\n\t\t\t\t\tundefined,\n\t\t\t\t\terr\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow err;\n\t\t}\n\n\t\tif (tenant.id !== tenantId) {\n\t\t\tthrow new NotFoundError(TenantOverrideProcessor.CLASS_NAME, \"tenantNotFound\", tenantId);\n\t\t}\n\t}\n}\n"]}

package/dist/es/restEntryPoints.js

@@ -0,0 +1,13 @@
+import { generateRestRoutesAuthenticationAudit, tagsAuthenticationAudit } from "./routes/entityStorageAuthenticationAuditRoutes.js";
+/**
+ * REST entry points for the authentication audit service.
+ */
+export const restEntryPoints = [
+    {
+        name: "authenticationAudit",
+        defaultBaseRoute: "authentication/audit",
+        tags: tagsAuthenticationAudit,
+        generateRoutes: generateRestRoutesAuthenticationAudit
+    }
+];
+//# sourceMappingURL=restEntryPoints.js.map

package/dist/es/restEntryPoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restEntryPoints.js","sources":["../../src/restEntryPoints.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,qCAAqC,EACrC,uBAAuB,EACvB,MAAM,oDAAoD,CAAC;AAE5D;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B;IACtD;QACC,IAAI,EAAE,qBAAqB;QAC3B,gBAAgB,EAAE,sBAAsB;QACxC,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,qCAAqC;KACrD;CACD,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type { IRestRouteEntryPoint } from \"@3sixty/api-models\";\nimport {\n\tgenerateRestRoutesAuthenticationAudit,\n\ttagsAuthenticationAudit\n} from \"./routes/entityStorageAuthenticationAuditRoutes.js\";\n\n/**\n * REST entry points for the authentication audit service.\n */\nexport const restEntryPoints: IRestRouteEntryPoint[] = [\n\t{\n\t\tname: \"authenticationAudit\",\n\t\tdefaultBaseRoute: \"authentication/audit\",\n\t\ttags: tagsAuthenticationAudit,\n\t\tgenerateRoutes: generateRestRoutesAuthenticationAudit\n\t}\n];\n"]}

package/dist/es/routes/entityStorageAuthenticationAuditRoutes.js

@@ -0,0 +1,355 @@
+import { HttpContextIdKeys, HttpHeaderHelper, HttpUrlHelper } from "@3sixty/api-models";
+import { ContextIdStore } from "@3sixty/context";
+import { Coerce, ComponentFactory, Guards } from "@3sixty/core";
+import { HeaderTypes, HttpStatusCode } from "@3sixty/web";
+/**
+ * The source used when communicating about these routes.
+ */
+const ROUTES_SOURCE = "authenticationAuditRoutes";
+/**
+ * The default authorization for the routes, used to seed authorization rules.
+ */
+const DEFAULT_AUTHORIZATION_READER = {
+    permission: "user-admin:read",
+    role: "user-admin"
+};
+const DEFAULT_AUTHORIZATION_WRITER = {
+    permission: "user-admin:write",
+    role: "user-admin",
+    inherits: [DEFAULT_AUTHORIZATION_READER.permission]
+};
+/**
+ * The tag to associate with the routes.
+ */
+export const tagsAuthenticationAudit = [
+    {
+        name: "Authentication Audit",
+        description: "Authentication audit endpoints for the REST server."
+    }
+];
+/**
+ * The REST routes for authentication audit.
+ * @param baseRouteName Prefix to prepend to the paths.
+ * @param componentName The name of the component to use in the routes stored in the ComponentFactory.
+ * @returns The generated routes.
+ */
+export function generateRestRoutesAuthenticationAudit(baseRouteName, componentName) {
+    const createRoute = {
+        operationId: "authenticationAuditCreate",
+        summary: "Create an authentication audit entry",
+        tag: tagsAuthenticationAudit[0].name,
+        method: "POST",
+        path: `${baseRouteName}`,
+        handler: async (httpRequestContext, request) => authenticationAuditCreate(httpRequestContext, componentName, request, baseRouteName),
+        requestType: {
+            type: "IAuditCreateRequest",
+            examples: [
+                {
+                    id: "authenticationAuditCreateRequestExample",
+                    description: "The request to create an authentication audit entry.",
+                    request: {
+                        body: {
+                            actorId: "user@example.com",
+                            event: "login-success",
+                            data: {
+                                organizationIdentity: "did:example:org1"
+                            }
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "ICreatedResponse",
+                examples: [
+                    {
+                        id: "authenticationAuditCreateResponseExample",
+                        description: "The response for creating an authentication audit entry.",
+                        response: {
+                            statusCode: 201,
+                            headers: {
+                                [HeaderTypes.Location]: "018f0b53d5d5704fa3a06d6ed2478575"
+                            }
+                        }
+                    }
+                ]
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        defaultAuthorization: DEFAULT_AUTHORIZATION_WRITER
+    };
+    const getRoute = {
+        operationId: "authenticationAuditGet",
+        summary: "Get an authentication audit entry",
+        tag: tagsAuthenticationAudit[0].name,
+        method: "GET",
+        path: `${baseRouteName}/:id`,
+        handler: async (httpRequestContext, request) => authenticationAuditGet(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IAuditGetRequest",
+            examples: [
+                {
+                    id: "authenticationAuditGetRequestExample",
+                    description: "The request to get an authentication audit entry.",
+                    request: {
+                        pathParams: {
+                            id: "018f0b53d5d5704fa3a06d6ed2478575"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "IAuditGetResponse",
+                examples: [
+                    {
+                        id: "authenticationAuditGetResponseExample",
+                        description: "The response for getting an authentication audit entry.",
+                        response: {
+                            body: {
+                                id: "018f0b53d5d5704fa3a06d6ed2478575",
+                                actorId: "user@example.com",
+                                dateCreated: "2026-01-12T09:05:23.123Z",
+                                event: "login-success",
+                                data: {
+                                    organizationIdentity: "did:example:org1"
+                                }
+                            }
+                        }
+                    }
+                ]
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        defaultAuthorization: DEFAULT_AUTHORIZATION_READER
+    };
+    const updateRoute = {
+        operationId: "authenticationAuditUpdate",
+        summary: "Update an authentication audit entry",
+        tag: tagsAuthenticationAudit[0].name,
+        method: "PUT",
+        path: `${baseRouteName}/:id`,
+        handler: async (httpRequestContext, request) => authenticationAuditUpdate(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IAuditUpdateRequest",
+            examples: [
+                {
+                    id: "authenticationAuditUpdateRequestExample",
+                    description: "The request to update an authentication audit entry.",
+                    request: {
+                        pathParams: {
+                            id: "018f0b53d5d5704fa3a06d6ed2478575"
+                        },
+                        body: {
+                            data: {
+                                organizationIdentity: "did:example:org1"
+                            }
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "INoContentResponse"
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        defaultAuthorization: DEFAULT_AUTHORIZATION_WRITER
+    };
+    const removeRoute = {
+        operationId: "authenticationAuditRemove",
+        summary: "Remove an authentication audit entry",
+        tag: tagsAuthenticationAudit[0].name,
+        method: "DELETE",
+        path: `${baseRouteName}/:id`,
+        handler: async (httpRequestContext, request) => authenticationAuditRemove(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IAuditRemoveRequest",
+            examples: [
+                {
+                    id: "authenticationAuditRemoveRequestExample",
+                    description: "The request to remove an authentication audit entry.",
+                    request: {
+                        pathParams: {
+                            id: "018f0b53d5d5704fa3a06d6ed2478575"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "INoContentResponse"
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        defaultAuthorization: DEFAULT_AUTHORIZATION_WRITER
+    };
+    const queryRoute = {
+        operationId: "authenticationAuditQuery",
+        summary: "Query authentication audit entries",
+        tag: tagsAuthenticationAudit[0].name,
+        method: "GET",
+        path: `${baseRouteName}`,
+        handler: async (httpRequestContext, request) => authenticationAuditQuery(httpRequestContext, componentName, request),
+        requestType: {
+            type: "IAuditQueryRequest",
+            examples: [
+                {
+                    id: "authenticationAuditQueryRequestExample",
+                    description: "The request to query authentication audit entries.",
+                    request: {
+                        query: {
+                            actorId: "user@example.com",
+                            event: "login-success",
+                            startDate: "2026-01-01T00:00:00.000Z",
+                            endDate: "2026-01-31T23:59:59.999Z",
+                            limit: "50"
+                        }
+                    }
+                }
+            ]
+        },
+        responseType: [
+            {
+                type: "IAuditQueryResponse",
+                examples: [
+                    {
+                        id: "authenticationAuditQueryResponseExample",
+                        description: "The response for querying authentication audit entries.",
+                        response: {
+                            body: {
+                                entries: [
+                                    {
+                                        id: "018f0b53d5d5704fa3a06d6ed2478575",
+                                        actorId: "user@example.com",
+                                        dateCreated: "2026-01-12T09:05:23.123Z",
+                                        event: "login-success",
+                                        data: {
+                                            organizationIdentity: "did:example:org1"
+                                        }
+                                    }
+                                ],
+                                cursor: "next-cursor"
+                            }
+                        }
+                    }
+                ]
+            },
+            {
+                type: "IUnauthorizedResponse"
+            }
+        ],
+        defaultAuthorization: DEFAULT_AUTHORIZATION_READER
+    };
+    return [createRoute, getRoute, updateRoute, removeRoute, queryRoute];
+}
+/**
+ * Create an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @param baseRouteName The base route name to use for the location header.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationAuditCreate(httpRequestContext, componentName, request, baseRouteName) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.body", request.body);
+    const component = ComponentFactory.get(componentName);
+    const id = await component.create(request.body);
+    const contextIds = await ContextIdStore.getContextIds();
+    const publicOrigin = contextIds?.[HttpContextIdKeys.PublicOrigin];
+    const headers = {};
+    HttpHeaderHelper.buildId(headers, id, HttpUrlHelper.combineOriginPath(publicOrigin, `${baseRouteName}/:id`));
+    return {
+        statusCode: HttpStatusCode.created,
+        headers
+    };
+}
+/**
+ * Get an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationAuditGet(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.pathParams", request.pathParams);
+    const component = ComponentFactory.get(componentName);
+    const entry = await component.get(request.pathParams.id);
+    return {
+        body: entry
+    };
+}
+/**
+ * Update an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationAuditUpdate(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.pathParams", request.pathParams);
+    Guards.object(ROUTES_SOURCE, "request.body", request.body);
+    const component = ComponentFactory.get(componentName);
+    await component.update(request.pathParams.id, request.body);
+    return {
+        statusCode: HttpStatusCode.noContent
+    };
+}
+/**
+ * Remove an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationAuditRemove(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    Guards.object(ROUTES_SOURCE, "request.pathParams", request.pathParams);
+    const component = ComponentFactory.get(componentName);
+    await component.remove(request.pathParams.id);
+    return {
+        statusCode: HttpStatusCode.noContent
+    };
+}
+/**
+ * Query authentication audit entries.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export async function authenticationAuditQuery(httpRequestContext, componentName, request) {
+    Guards.object(ROUTES_SOURCE, "request", request);
+    const component = ComponentFactory.get(componentName);
+    const result = await component.query({
+        actorId: request.query?.actorId,
+        organizationId: request.query?.organizationId,
+        tenantId: request.query?.tenantId,
+        nodeId: request.query?.nodeId,
+        event: request.query?.event,
+        startDate: request.query?.startDate,
+        endDate: request.query?.endDate
+    }, request.query?.cursor, Coerce.integer(request.query?.limit));
+    return {
+        body: {
+            entries: result.entries,
+            cursor: result.cursor
+        }
+    };
+}
+//# sourceMappingURL=entityStorageAuthenticationAuditRoutes.js.map

package/dist/es/routes/entityStorageAuthenticationAuditRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityStorageAuthenticationAuditRoutes.js","sources":["../../../src/routes/entityStorageAuthenticationAuditRoutes.ts"],"names":[],"mappings":"AAYA,OAAO,EACN,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EAQb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAqB,MAAM,aAAa,CAAC;AAE7E;;GAEG;AACH,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD;;GAEG;AACH,MAAM,4BAA4B,GAAwB;IACzD,UAAU,EAAE,iBAAiB;IAC7B,IAAI,EAAE,YAAY;CAClB,CAAC;AACF,MAAM,4BAA4B,GAAwB;IACzD,UAAU,EAAE,kBAAkB;IAC9B,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,CAAC,4BAA4B,CAAC,UAAU,CAAC;CACnD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAW;IAC9C;QACC,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,qDAAqD;KAClE;CACD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACpD,aAAqB,EACrB,aAAqB;IAErB,MAAM,WAAW,GAAsD;QACtE,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,aAAa,EAAE;QACxB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,yBAAyB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC;QACrF,WAAW,EAAE;YACZ,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,yCAAyC;oBAC7C,WAAW,EAAE,sDAAsD;oBACnE,OAAO,EAAE;wBACR,IAAI,EAAE;4BACL,OAAO,EAAE,kBAAkB;4BAC3B,KAAK,EAAE,eAAe;4BACtB,IAAI,EAAE;gCACL,oBAAoB,EAAE,kBAAkB;6BACxC;yBACD;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,0CAA0C;wBAC9C,WAAW,EAAE,0DAA0D;wBACvE,QAAQ,EAAE;4BACT,UAAU,EAAE,GAAG;4BACf,OAAO,EAAE;gCACR,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,kCAAkC;6BAC1D;yBACD;qBACD;iBACD;aACD;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,oBAAoB,EAAE,4BAA4B;KAClD,CAAC;IAEF,MAAM,QAAQ,GAAoD;QACjE,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,aAAa,MAAM;QAC5B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,sBAAsB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACnE,WAAW,EAAE;YACZ,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,sCAAsC;oBAC1C,WAAW,EAAE,mDAAmD;oBAChE,OAAO,EAAE;wBACR,UAAU,EAAE;4BACX,EAAE,EAAE,kCAAkC;yBACtC;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,uCAAuC;wBAC3C,WAAW,EAAE,yDAAyD;wBACtE,QAAQ,EAAE;4BACT,IAAI,EAAE;gCACL,EAAE,EAAE,kCAAkC;gCACtC,OAAO,EAAE,kBAAkB;gCAC3B,WAAW,EAAE,0BAA0B;gCACvC,KAAK,EAAE,eAAe;gCACtB,IAAI,EAAE;oCACL,oBAAoB,EAAE,kBAAkB;iCACxC;6BACD;yBACD;qBACD;iBACD;aACD;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,oBAAoB,EAAE,4BAA4B;KAClD,CAAC;IAEF,MAAM,WAAW,GAAwD;QACxE,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,aAAa,MAAM;QAC5B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,yBAAyB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACtE,WAAW,EAAE;YACZ,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,yCAAyC;oBAC7C,WAAW,EAAE,sDAAsD;oBACnE,OAAO,EAAE;wBACR,UAAU,EAAE;4BACX,EAAE,EAAE,kCAAkC;yBACtC;wBACD,IAAI,EAAE;4BACL,IAAI,EAAE;gCACL,oBAAoB,EAAE,kBAAkB;6BACxC;yBACD;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,oBAAoB;aAC1B;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,oBAAoB,EAAE,4BAA4B;KAClD,CAAC;IAEF,MAAM,WAAW,GAAwD;QACxE,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,aAAa,MAAM;QAC5B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,yBAAyB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACtE,WAAW,EAAE;YACZ,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,yCAAyC;oBAC7C,WAAW,EAAE,sDAAsD;oBACnE,OAAO,EAAE;wBACR,UAAU,EAAE;4BACX,EAAE,EAAE,kCAAkC;yBACtC;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,oBAAoB;aAC1B;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,oBAAoB,EAAE,4BAA4B;KAClD,CAAC;IAEF,MAAM,UAAU,GAAwD;QACvE,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,oCAAoC;QAC7C,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,aAAa,EAAE;QACxB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAC9C,wBAAwB,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC;QACrE,WAAW,EAAE;YACZ,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE;gBACT;oBACC,EAAE,EAAE,wCAAwC;oBAC5C,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE;wBACR,KAAK,EAAE;4BACN,OAAO,EAAE,kBAAkB;4BAC3B,KAAK,EAAE,eAAe;4BACtB,SAAS,EAAE,0BAA0B;4BACrC,OAAO,EAAE,0BAA0B;4BACnC,KAAK,EAAE,IAAI;yBACX;qBACD;iBACD;aACD;SACD;QACD,YAAY,EAAE;YACb;gBACC,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE;oBACT;wBACC,EAAE,EAAE,yCAAyC;wBAC7C,WAAW,EAAE,yDAAyD;wBACtE,QAAQ,EAAE;4BACT,IAAI,EAAE;gCACL,OAAO,EAAE;oCACR;wCACC,EAAE,EAAE,kCAAkC;wCACtC,OAAO,EAAE,kBAAkB;wCAC3B,WAAW,EAAE,0BAA0B;wCACvC,KAAK,EAAE,eAAe;wCACtB,IAAI,EAAE;4CACL,oBAAoB,EAAE,kBAAkB;yCACxC;qCACD;iCACD;gCACD,MAAM,EAAE,aAAa;6BACrB;yBACD;qBACD;iBACD;aACD;YACD;gBACC,IAAI,EAAE,uBAAuB;aAC7B;SACD;QACD,oBAAoB,EAAE,4BAA4B;KAClD,CAAC;IAEF,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,kBAAuC,EACvC,aAAqB,EACrB,OAA4B,EAC5B,aAAqB;IAErB,MAAM,CAAC,MAAM,CAAsB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CAA8B,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAExF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAgC,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAElE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,gBAAgB,CAAC,OAAO,CACvB,OAAO,EACP,EAAE,EACF,aAAa,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,aAAa,MAAM,CAAC,CACrE,CAAC;IAEF,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,OAAO;QAClC,OAAO;KACP,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,kBAAuC,EACvC,aAAqB,EACrB,OAAyB;IAEzB,MAAM,CAAC,MAAM,CAAmB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,CAAC,MAAM,CACZ,aAAa,EACb,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAClB,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAgC,aAAa,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAEzD,OAAO;QACN,IAAI,EAAE,KAAK;KACX,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,kBAAuC,EACvC,aAAqB,EACrB,OAA4B;IAE5B,MAAM,CAAC,MAAM,CAAsB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CACZ,aAAa,EACb,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAClB,CAAC;IACF,MAAM,CAAC,MAAM,CAA8B,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAExF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAgC,aAAa,CAAC,CAAC;IACrF,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,SAAS;KACpC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,kBAAuC,EACvC,aAAqB,EACrB,OAA4B;IAE5B,MAAM,CAAC,MAAM,CAAsB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CACZ,aAAa,EACb,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAClB,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAgC,aAAa,CAAC,CAAC;IACrF,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAE9C,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,SAAS;KACpC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,kBAAuC,EACvC,aAAqB,EACrB,OAA2B;IAE3B,MAAM,CAAC,MAAM,CAAqB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAgC,aAAa,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CACnC;QACC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO;QAC/B,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc;QAC7C,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ;QACjC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK;QAC3B,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS;QACnC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO;KAC/B,EACD,OAAO,CAAC,KAAK,EAAE,MAAM,EACrB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CACpC,CAAC;IAEF,OAAO;QACN,IAAI,EAAE;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB;KACD,CAAC;AACH,CAAC","sourcesContent":["// Copyright 2026 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport type {\n\tIAuditCreateRequest,\n\tIAuditGetRequest,\n\tIAuditGetResponse,\n\tIAuditQueryRequest,\n\tIAuditQueryResponse,\n\tIAuditRemoveRequest,\n\tIAuditUpdateRequest,\n\tIAuthenticationAuditComponent\n} from \"@3sixty/api-auth-models\";\nimport {\n\tHttpContextIdKeys,\n\tHttpHeaderHelper,\n\tHttpUrlHelper,\n\ttype ICreatedResponse,\n\ttype IHttpRequestContext,\n\ttype INoContentResponse,\n\ttype IRestRoute,\n\ttype IRouteAuthorization,\n\ttype ITag,\n\ttype IUnauthorizedResponse\n} from \"@3sixty/api-models\";\nimport { ContextIdStore } from \"@3sixty/context\";\nimport { Coerce, ComponentFactory, Guards } from \"@3sixty/core\";\n\nimport { HeaderTypes, HttpStatusCode, type IHttpHeaders } from \"@3sixty/web\";\n\n/**\n * The source used when communicating about these routes.\n */\nconst ROUTES_SOURCE = \"authenticationAuditRoutes\";\n\n/**\n * The default authorization for the routes, used to seed authorization rules.\n */\nconst DEFAULT_AUTHORIZATION_READER: IRouteAuthorization = {\n\tpermission: \"user-admin:read\",\n\trole: \"user-admin\"\n};\nconst DEFAULT_AUTHORIZATION_WRITER: IRouteAuthorization = {\n\tpermission: \"user-admin:write\",\n\trole: \"user-admin\",\n\tinherits: [DEFAULT_AUTHORIZATION_READER.permission]\n};\n\n/**\n * The tag to associate with the routes.\n */\nexport const tagsAuthenticationAudit: ITag[] = [\n\t{\n\t\tname: \"Authentication Audit\",\n\t\tdescription: \"Authentication audit endpoints for the REST server.\"\n\t}\n];\n\n/**\n * The REST routes for authentication audit.\n * @param baseRouteName Prefix to prepend to the paths.\n * @param componentName The name of the component to use in the routes stored in the ComponentFactory.\n * @returns The generated routes.\n */\nexport function generateRestRoutesAuthenticationAudit(\n\tbaseRouteName: string,\n\tcomponentName: string\n): IRestRoute[] {\n\tconst createRoute: IRestRoute<IAuditCreateRequest, ICreatedResponse> = {\n\t\toperationId: \"authenticationAuditCreate\",\n\t\tsummary: \"Create an authentication audit entry\",\n\t\ttag: tagsAuthenticationAudit[0].name,\n\t\tmethod: \"POST\",\n\t\tpath: `${baseRouteName}`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationAuditCreate(httpRequestContext, componentName, request, baseRouteName),\n\t\trequestType: {\n\t\t\ttype: \"IAuditCreateRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"authenticationAuditCreateRequestExample\",\n\t\t\t\t\tdescription: \"The request to create an authentication audit entry.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\tactorId: \"user@example.com\",\n\t\t\t\t\t\t\tevent: \"login-success\",\n\t\t\t\t\t\t\tdata: {\n\t\t\t\t\t\t\t\torganizationIdentity: \"did:example:org1\"\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"ICreatedResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"authenticationAuditCreateResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for creating an authentication audit entry.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tstatusCode: 201,\n\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t[HeaderTypes.Location]: \"018f0b53d5d5704fa3a06d6ed2478575\"\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tdefaultAuthorization: DEFAULT_AUTHORIZATION_WRITER\n\t};\n\n\tconst getRoute: IRestRoute<IAuditGetRequest, IAuditGetResponse> = {\n\t\toperationId: \"authenticationAuditGet\",\n\t\tsummary: \"Get an authentication audit entry\",\n\t\ttag: tagsAuthenticationAudit[0].name,\n\t\tmethod: \"GET\",\n\t\tpath: `${baseRouteName}/:id`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationAuditGet(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IAuditGetRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"authenticationAuditGetRequestExample\",\n\t\t\t\t\tdescription: \"The request to get an authentication audit entry.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tpathParams: {\n\t\t\t\t\t\t\tid: \"018f0b53d5d5704fa3a06d6ed2478575\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"IAuditGetResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"authenticationAuditGetResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for getting an authentication audit entry.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\tid: \"018f0b53d5d5704fa3a06d6ed2478575\",\n\t\t\t\t\t\t\t\tactorId: \"user@example.com\",\n\t\t\t\t\t\t\t\tdateCreated: \"2026-01-12T09:05:23.123Z\",\n\t\t\t\t\t\t\t\tevent: \"login-success\",\n\t\t\t\t\t\t\t\tdata: {\n\t\t\t\t\t\t\t\t\torganizationIdentity: \"did:example:org1\"\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tdefaultAuthorization: DEFAULT_AUTHORIZATION_READER\n\t};\n\n\tconst updateRoute: IRestRoute<IAuditUpdateRequest, INoContentResponse> = {\n\t\toperationId: \"authenticationAuditUpdate\",\n\t\tsummary: \"Update an authentication audit entry\",\n\t\ttag: tagsAuthenticationAudit[0].name,\n\t\tmethod: \"PUT\",\n\t\tpath: `${baseRouteName}/:id`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationAuditUpdate(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IAuditUpdateRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"authenticationAuditUpdateRequestExample\",\n\t\t\t\t\tdescription: \"The request to update an authentication audit entry.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tpathParams: {\n\t\t\t\t\t\t\tid: \"018f0b53d5d5704fa3a06d6ed2478575\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\tdata: {\n\t\t\t\t\t\t\t\torganizationIdentity: \"did:example:org1\"\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"INoContentResponse\"\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tdefaultAuthorization: DEFAULT_AUTHORIZATION_WRITER\n\t};\n\n\tconst removeRoute: IRestRoute<IAuditRemoveRequest, INoContentResponse> = {\n\t\toperationId: \"authenticationAuditRemove\",\n\t\tsummary: \"Remove an authentication audit entry\",\n\t\ttag: tagsAuthenticationAudit[0].name,\n\t\tmethod: \"DELETE\",\n\t\tpath: `${baseRouteName}/:id`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationAuditRemove(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IAuditRemoveRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"authenticationAuditRemoveRequestExample\",\n\t\t\t\t\tdescription: \"The request to remove an authentication audit entry.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tpathParams: {\n\t\t\t\t\t\t\tid: \"018f0b53d5d5704fa3a06d6ed2478575\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"INoContentResponse\"\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tdefaultAuthorization: DEFAULT_AUTHORIZATION_WRITER\n\t};\n\n\tconst queryRoute: IRestRoute<IAuditQueryRequest, IAuditQueryResponse> = {\n\t\toperationId: \"authenticationAuditQuery\",\n\t\tsummary: \"Query authentication audit entries\",\n\t\ttag: tagsAuthenticationAudit[0].name,\n\t\tmethod: \"GET\",\n\t\tpath: `${baseRouteName}`,\n\t\thandler: async (httpRequestContext, request) =>\n\t\t\tauthenticationAuditQuery(httpRequestContext, componentName, request),\n\t\trequestType: {\n\t\t\ttype: \"IAuditQueryRequest\",\n\t\t\texamples: [\n\t\t\t\t{\n\t\t\t\t\tid: \"authenticationAuditQueryRequestExample\",\n\t\t\t\t\tdescription: \"The request to query authentication audit entries.\",\n\t\t\t\t\trequest: {\n\t\t\t\t\t\tquery: {\n\t\t\t\t\t\t\tactorId: \"user@example.com\",\n\t\t\t\t\t\t\tevent: \"login-success\",\n\t\t\t\t\t\t\tstartDate: \"2026-01-01T00:00:00.000Z\",\n\t\t\t\t\t\t\tendDate: \"2026-01-31T23:59:59.999Z\",\n\t\t\t\t\t\t\tlimit: \"50\"\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\tresponseType: [\n\t\t\t{\n\t\t\t\ttype: \"IAuditQueryResponse\",\n\t\t\t\texamples: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: \"authenticationAuditQueryResponseExample\",\n\t\t\t\t\t\tdescription: \"The response for querying authentication audit entries.\",\n\t\t\t\t\t\tresponse: {\n\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\tentries: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\tid: \"018f0b53d5d5704fa3a06d6ed2478575\",\n\t\t\t\t\t\t\t\t\t\tactorId: \"user@example.com\",\n\t\t\t\t\t\t\t\t\t\tdateCreated: \"2026-01-12T09:05:23.123Z\",\n\t\t\t\t\t\t\t\t\t\tevent: \"login-success\",\n\t\t\t\t\t\t\t\t\t\tdata: {\n\t\t\t\t\t\t\t\t\t\t\torganizationIdentity: \"did:example:org1\"\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tcursor: \"next-cursor\"\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t},\n\t\t\t{\n\t\t\t\ttype: \"IUnauthorizedResponse\"\n\t\t\t}\n\t\t],\n\t\tdefaultAuthorization: DEFAULT_AUTHORIZATION_READER\n\t};\n\n\treturn [createRoute, getRoute, updateRoute, removeRoute, queryRoute];\n}\n\n/**\n * Create an authentication audit entry.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @param baseRouteName The base route name to use for the location header.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationAuditCreate(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IAuditCreateRequest,\n\tbaseRouteName: string\n): Promise<ICreatedResponse> {\n\tGuards.object<IAuditCreateRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<IAuditCreateRequest[\"body\"]>(ROUTES_SOURCE, \"request.body\", request.body);\n\n\tconst component = ComponentFactory.get<IAuthenticationAuditComponent>(componentName);\n\tconst id = await component.create(request.body);\n\n\tconst contextIds = await ContextIdStore.getContextIds();\n\tconst publicOrigin = contextIds?.[HttpContextIdKeys.PublicOrigin];\n\n\tconst headers: IHttpHeaders = {};\n\tHttpHeaderHelper.buildId(\n\t\theaders,\n\t\tid,\n\t\tHttpUrlHelper.combineOriginPath(publicOrigin, `${baseRouteName}/:id`)\n\t);\n\n\treturn {\n\t\tstatusCode: HttpStatusCode.created,\n\t\theaders\n\t};\n}\n\n/**\n * Get an authentication audit entry.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationAuditGet(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IAuditGetRequest\n): Promise<IAuditGetResponse> {\n\tGuards.object<IAuditGetRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<IAuditGetRequest[\"pathParams\"]>(\n\t\tROUTES_SOURCE,\n\t\t\"request.pathParams\",\n\t\trequest.pathParams\n\t);\n\n\tconst component = ComponentFactory.get<IAuthenticationAuditComponent>(componentName);\n\tconst entry = await component.get(request.pathParams.id);\n\n\treturn {\n\t\tbody: entry\n\t};\n}\n\n/**\n * Update an authentication audit entry.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationAuditUpdate(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IAuditUpdateRequest\n): Promise<INoContentResponse> {\n\tGuards.object<IAuditUpdateRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<IAuditUpdateRequest[\"pathParams\"]>(\n\t\tROUTES_SOURCE,\n\t\t\"request.pathParams\",\n\t\trequest.pathParams\n\t);\n\tGuards.object<IAuditUpdateRequest[\"body\"]>(ROUTES_SOURCE, \"request.body\", request.body);\n\n\tconst component = ComponentFactory.get<IAuthenticationAuditComponent>(componentName);\n\tawait component.update(request.pathParams.id, request.body);\n\n\treturn {\n\t\tstatusCode: HttpStatusCode.noContent\n\t};\n}\n\n/**\n * Remove an authentication audit entry.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationAuditRemove(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IAuditRemoveRequest\n): Promise<INoContentResponse> {\n\tGuards.object<IAuditRemoveRequest>(ROUTES_SOURCE, \"request\", request);\n\tGuards.object<IAuditRemoveRequest[\"pathParams\"]>(\n\t\tROUTES_SOURCE,\n\t\t\"request.pathParams\",\n\t\trequest.pathParams\n\t);\n\n\tconst component = ComponentFactory.get<IAuthenticationAuditComponent>(componentName);\n\tawait component.remove(request.pathParams.id);\n\n\treturn {\n\t\tstatusCode: HttpStatusCode.noContent\n\t};\n}\n\n/**\n * Query authentication audit entries.\n * @param httpRequestContext The request context for the API.\n * @param componentName The name of the component to use in the routes.\n * @param request The request.\n * @returns The response object with additional http response properties.\n */\nexport async function authenticationAuditQuery(\n\thttpRequestContext: IHttpRequestContext,\n\tcomponentName: string,\n\trequest: IAuditQueryRequest\n): Promise<IAuditQueryResponse> {\n\tGuards.object<IAuditQueryRequest>(ROUTES_SOURCE, \"request\", request);\n\n\tconst component = ComponentFactory.get<IAuthenticationAuditComponent>(componentName);\n\tconst result = await component.query(\n\t\t{\n\t\t\tactorId: request.query?.actorId,\n\t\t\torganizationId: request.query?.organizationId,\n\t\t\ttenantId: request.query?.tenantId,\n\t\t\tnodeId: request.query?.nodeId,\n\t\t\tevent: request.query?.event,\n\t\t\tstartDate: request.query?.startDate,\n\t\t\tendDate: request.query?.endDate\n\t\t},\n\t\trequest.query?.cursor,\n\t\tCoerce.integer(request.query?.limit)\n\t);\n\n\treturn {\n\t\tbody: {\n\t\t\tentries: result.entries,\n\t\t\tcursor: result.cursor\n\t\t}\n\t};\n}\n"]}

package/dist/es/schema.js

@@ -0,0 +1,13 @@
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { EntitySchemaFactory, EntitySchemaHelper } from "@3sixty/entity";
+import { AuthenticationAuditEntry } from "./entities/authenticationAuditEntry.js";
+import { AuthenticationRateEntry } from "./entities/authenticationRateEntry.js";
+/**
+ * Initialize the schema for the authentication audit and rate services.
+ */
+export function initSchema() {
+    EntitySchemaFactory.register("AuthenticationAuditEntry", () => EntitySchemaHelper.getSchema(AuthenticationAuditEntry));
+    EntitySchemaFactory.register("AuthenticationRateEntry", () => EntitySchemaHelper.getSchema(AuthenticationRateEntry));
+}
+//# sourceMappingURL=schema.js.map

package/dist/es/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sources":["../../src/schema.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF;;GAEG;AACH,MAAM,UAAU,UAAU;IACzB,mBAAmB,CAAC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAC7D,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,CAAC,CACtD,CAAC;IACF,mBAAmB,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC5D,kBAAkB,CAAC,SAAS,CAAC,uBAAuB,CAAC,CACrD,CAAC;AACH,CAAC","sourcesContent":["// Copyright 2024 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { EntitySchemaFactory, EntitySchemaHelper } from \"@3sixty/entity\";\n\nimport { AuthenticationAuditEntry } from \"./entities/authenticationAuditEntry.js\";\nimport { AuthenticationRateEntry } from \"./entities/authenticationRateEntry.js\";\n\n/**\n * Initialize the schema for the authentication audit and rate services.\n */\nexport function initSchema(): void {\n\tEntitySchemaFactory.register(\"AuthenticationAuditEntry\", () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationAuditEntry)\n\t);\n\tEntitySchemaFactory.register(\"AuthenticationRateEntry\", () =>\n\t\tEntitySchemaHelper.getSchema(AuthenticationRateEntry)\n\t);\n}\n"]}