@3sixty/api-auth-service 0.20.0-next.0 → 0.20.0-next.1

package/dist/types/models/IEntityStorageAuthenticationRateServiceConstructorOptions.d.ts

@@ -0,0 +1,25 @@
+import type { IEntityStorageAuthenticationRateServiceConfig } from "./IEntityStorageAuthenticationRateServiceConfig.js";
+/**
+ * Options for the EntityStorageAuthenticationRateService constructor.
+ */
+export interface IEntityStorageAuthenticationRateServiceConstructorOptions {
+    /**
+     * The entity storage for authentication rate entries.
+     * @default authentication-rate-entry
+     */
+    authenticationRateEntryStorageType?: string;
+    /**
+     * The task scheduler component type.
+     * @default task-scheduler
+     */
+    taskSchedulerComponentType?: string;
+    /**
+     * The platform component type, used to run the periodic cleanup per tenant.
+     * @default platform
+     */
+    platformComponentType?: string;
+    /**
+     * The configuration for the authentication rate service.
+     */
+    config?: IEntityStorageAuthenticationRateServiceConfig;
+}

package/dist/types/models/ITenantOverrideProcessorConfig.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Configuration for the TenantOverrideProcessor.
+ */
+export interface ITenantOverrideProcessorConfig {
+    /**
+     * Include the stack with errors.
+     */
+    includeErrorStack?: boolean;
+    /**
+     * The role value that grants escalated privilege for cross-tenant access.
+     * @default global-admin
+     */
+    escalatedPrivilegeRole?: string;
+    /**
+     * The authorization model ID to use for REST requests.
+     * @default system
+     */
+    authorizationModelId?: string;
+}

package/dist/types/models/ITenantOverrideProcessorConstructorOptions.d.ts

@@ -0,0 +1,20 @@
+import type { ITenantOverrideProcessorConfig } from "./ITenantOverrideProcessorConfig.js";
+/**
+ * Options for the TenantOverrideProcessor constructor.
+ */
+export interface ITenantOverrideProcessorConstructorOptions {
+    /**
+     * The tenant admin component type.
+     * @default tenant-admin
+     */
+    tenantAdminComponentType?: string;
+    /**
+     * The authorization component type.
+     * @default authorization
+     */
+    authorizationComponentType?: string;
+    /**
+     * Configuration for the processor.
+     */
+    config?: ITenantOverrideProcessorConfig;
+}

package/dist/types/processors/tenantOverrideProcessor.d.ts

@@ -0,0 +1,48 @@
+import { type IBaseRoute, type IBaseRouteProcessor, type IHttpResponse, type IHttpServerRequest } from "@3sixty/api-models";
+import { type IContextIds } from "@3sixty/context";
+import type { ITenantOverrideProcessorConstructorOptions } from "../models/ITenantOverrideProcessorConstructorOptions.js";
+/**
+ * Processes the overrideTenant query parameter for routes that allow tenant override.
+ * Requires the caller to hold the escalated privilege role. Runs after AuthHeaderProcessor so
+ * authentication is always resolved in the caller's own partition first.
+ */
+export declare class TenantOverrideProcessor implements IBaseRouteProcessor {
+    /**
+     * The query parameter name used to supply the override tenant ID.
+     */
+    static readonly OVERRIDE_TENANT_PARAM: string;
+    /**
+     * The model identifier that is reserved for system-only use.
+     */
+    static readonly DEFAULT_AUTHORIZATION_MODEL_ID: string;
+    /**
+     * The role string required to perform a tenant override.
+     */
+    static readonly DEFAULT_ESCALATED_PRIVILEGE_ROLE: string;
+    /**
+     * Runtime name for the class.
+     */
+    static readonly CLASS_NAME: string;
+    /**
+     * Create a new instance of TenantOverrideProcessor.
+     * @param options Options for the processor.
+     */
+    constructor(options?: ITenantOverrideProcessorConstructorOptions);
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className(): string;
+    /**
+     * Pre process the REST request for the specified route.
+     * @param request The incoming request.
+     * @param response The outgoing response.
+     * @param route The route to process.
+     * @param contextIds The context IDs of the request.
+     * @param processorState The state handed through the processors.
+     * @returns A promise that resolves when the tenant override has been applied or skipped.
+     */
+    pre(request: IHttpServerRequest, response: IHttpResponse, route: IBaseRoute | undefined, contextIds: IContextIds, processorState: {
+        [id: string]: unknown;
+    }): Promise<void>;
+}

package/dist/types/restEntryPoints.d.ts

@@ -0,0 +1,5 @@
+import type { IRestRouteEntryPoint } from "@3sixty/api-models";
+/**
+ * REST entry points for the authentication audit service.
+ */
+export declare const restEntryPoints: IRestRouteEntryPoint[];

package/dist/types/routes/entityStorageAuthenticationAuditRoutes.d.ts

@@ -0,0 +1,54 @@
+import type { IAuditCreateRequest, IAuditGetRequest, IAuditGetResponse, IAuditQueryRequest, IAuditQueryResponse, IAuditRemoveRequest, IAuditUpdateRequest } from "@3sixty/api-auth-models";
+import { type ICreatedResponse, type IHttpRequestContext, type INoContentResponse, type IRestRoute, type ITag } from "@3sixty/api-models";
+/**
+ * The tag to associate with the routes.
+ */
+export declare const tagsAuthenticationAudit: ITag[];
+/**
+ * The REST routes for authentication audit.
+ * @param baseRouteName Prefix to prepend to the paths.
+ * @param componentName The name of the component to use in the routes stored in the ComponentFactory.
+ * @returns The generated routes.
+ */
+export declare function generateRestRoutesAuthenticationAudit(baseRouteName: string, componentName: string): IRestRoute[];
+/**
+ * Create an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @param baseRouteName The base route name to use for the location header.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationAuditCreate(httpRequestContext: IHttpRequestContext, componentName: string, request: IAuditCreateRequest, baseRouteName: string): Promise<ICreatedResponse>;
+/**
+ * Get an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationAuditGet(httpRequestContext: IHttpRequestContext, componentName: string, request: IAuditGetRequest): Promise<IAuditGetResponse>;
+/**
+ * Update an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationAuditUpdate(httpRequestContext: IHttpRequestContext, componentName: string, request: IAuditUpdateRequest): Promise<INoContentResponse>;
+/**
+ * Remove an authentication audit entry.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationAuditRemove(httpRequestContext: IHttpRequestContext, componentName: string, request: IAuditRemoveRequest): Promise<INoContentResponse>;
+/**
+ * Query authentication audit entries.
+ * @param httpRequestContext The request context for the API.
+ * @param componentName The name of the component to use in the routes.
+ * @param request The request.
+ * @returns The response object with additional http response properties.
+ */
+export declare function authenticationAuditQuery(httpRequestContext: IHttpRequestContext, componentName: string, request: IAuditQueryRequest): Promise<IAuditQueryResponse>;

package/dist/types/schema.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Initialize the schema for the authentication audit and rate services.
+ */
+export declare function initSchema(): void;

package/dist/types/services/entityStorageAuthenticationAuditService.d.ts

@@ -0,0 +1,72 @@
+import type { AuthAuditEvent, IAuthenticationAuditComponent, IAuthenticationAuditEntry } from "@3sixty/api-auth-models";
+import type { IEntityStorageAuthenticationAuditServiceConstructorOptions } from "../models/IEntityStorageAuthenticationAuditServiceConstructorOptions.js";
+/**
+ * Implementation of the authentication audit component using entity storage.
+ */
+export declare class EntityStorageAuthenticationAuditService implements IAuthenticationAuditComponent {
+    /**
+     * Runtime name for the class.
+     */
+    static readonly CLASS_NAME: string;
+    /**
+     * Create a new instance of EntityStorageAuthenticationAuditService.
+     * @param options The dependencies for the identity connector.
+     */
+    constructor(options?: IEntityStorageAuthenticationAuditServiceConstructorOptions);
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className(): string;
+    /**
+     * Create a new audit entry.
+     * @param entry The audit entry to be logged.
+     * @returns The unique identifier of the created audit entry.
+     */
+    create(entry: Omit<IAuthenticationAuditEntry, "id" | "dateCreated">): Promise<string>;
+    /**
+     * Get an audit entry by id.
+     * @param id The unique identifier of the audit entry.
+     * @returns The audit entry.
+     */
+    get(id: string): Promise<IAuthenticationAuditEntry>;
+    /**
+     * Update an audit entry.
+     * @param id The unique identifier of the audit entry to update.
+     * @param entry The fields to update on the audit entry.
+     * @returns A promise that resolves when the audit entry has been updated.
+     */
+    update(id: string, entry: Partial<Omit<IAuthenticationAuditEntry, "id" | "dateCreated">>): Promise<void>;
+    /**
+     * Remove an audit entry.
+     * @param id The unique identifier of the audit entry to remove.
+     * @returns A promise that resolves when the audit entry has been removed.
+     */
+    remove(id: string): Promise<void>;
+    /**
+     * Query the audit entries.
+     * @param options The query options.
+     * @param options.actorId The actor identifier to filter the audit entries, optional.
+     * @param options.organizationId The organization identifier to filter the audit entries, optional.
+     * @param options.tenantId The tenant identifier to filter the audit entries, optional.
+     * @param options.nodeId The node identifier to filter the audit entries, optional.
+     * @param options.event The audit event to filter the audit entries, optional.
+     * @param options.startDate The start date to filter the audit entries, optional.
+     * @param options.endDate The end date to filter the audit entries, optional.
+     * @param cursor The cursor for pagination.
+     * @param limit The maximum number of entries to return.
+     * @returns The audit entries.
+     */
+    query(options?: {
+        actorId?: string;
+        organizationId?: string;
+        tenantId?: string;
+        nodeId?: string;
+        event?: AuthAuditEvent | string;
+        startDate?: string;
+        endDate?: string;
+    }, cursor?: string, limit?: number): Promise<{
+        entries: IAuthenticationAuditEntry[];
+        cursor?: string;
+    }>;
+}

package/dist/types/services/entityStorageAuthenticationRateService.d.ts

@@ -0,0 +1,60 @@
+import type { IAuthenticationRateActionConfig, IAuthenticationRateComponent } from "@3sixty/api-auth-models";
+import type { IEntityStorageAuthenticationRateServiceConstructorOptions } from "../models/IEntityStorageAuthenticationRateServiceConstructorOptions.js";
+/**
+ * Implementation of the authentication rate component using entity storage.
+ */
+export declare class EntityStorageAuthenticationRateService implements IAuthenticationRateComponent {
+    /**
+     * Runtime name for the class.
+     */
+    static readonly CLASS_NAME: string;
+    /**
+     * Create a new instance of EntityStorageAuthenticationRateService.
+     * @param options The constructor options.
+     */
+    constructor(options?: IEntityStorageAuthenticationRateServiceConstructorOptions);
+    /**
+     * Register or update rate-limit configuration for an action.
+     * @param action The action name.
+     * @param config The action configuration.
+     * @returns A promise that resolves when the action configuration has been stored.
+     */
+    registerAction(action: string, config: IAuthenticationRateActionConfig): Promise<void>;
+    /**
+     * Unregister rate-limit configuration for an action.
+     * @param action The action name.
+     * @returns A promise that resolves when the action configuration has been removed.
+     */
+    unregisterAction(action: string): Promise<void>;
+    /**
+     * Returns the class name of the component.
+     * @returns The class name of the component.
+     */
+    className(): string;
+    /**
+     * The service needs to be started when the application is initialized.
+     * @param nodeLoggingComponentType The node logging component type.
+     * @returns A promise that resolves when the periodic cleanup task has been registered.
+     */
+    start(nodeLoggingComponentType?: string): Promise<void>;
+    /**
+     * The component needs to be stopped when the node is closed.
+     * @param nodeLoggingComponentType The node logging component type.
+     * @returns A promise that resolves when the periodic cleanup task has been removed.
+     */
+    stop(nodeLoggingComponentType?: string): Promise<void>;
+    /**
+     * Check the authentication rate for a given action and identifier.
+     * @param action The action to be checked.
+     * @param identifier The identifier to be checked.
+     * @returns The rate entry id.
+     */
+    check(action: string, identifier: string): Promise<string>;
+    /**
+     * Clear the authentication rate entry for the given action and identifier.
+     * @param action The action to clear.
+     * @param identifier The identifier to clear.
+     * @returns A promise that resolves when the rate entry has been removed.
+     */
+    clear(action: string, identifier: string): Promise<void>;
+}