@absolutejs/auth 0.55.7 → 0.55.9

package/dist/scim/routes.d.ts

@@ -0,0 +1,366 @@
+import { Elysia } from 'elysia';
+import { type ScimConfig } from './config';
+export declare const scimRoutes: ({ customAttributes, getScimGroup, getScimUser, listScimGroups, listScimUsers, onScimGroupCreate, onScimGroupDelete, onScimGroupReplace, onScimUserCreate, onScimUserDeactivate, onScimUserReplace, scimRoute, scimTokenStore }: ScimConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/scim/serialize.d.ts

@@ -0,0 +1,83 @@
+import type { ScimAttributeMap, ScimSchemaDefinition } from './extensions';
+import type { ScimFilter, ScimGroup, ScimGroupInput, ScimUser, ScimUserInput } from './types';
+declare const SCHEMA_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema";
+declare const RESOURCE_TYPE_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
+export declare const toUserResource: (user: ScimUser, location: string, map?: ScimAttributeMap) => Record<string, unknown>;
+export declare const parseUserInput: (body: unknown, map?: ScimAttributeMap) => ScimUserInput | undefined;
+export declare const applyPatch: (user: ScimUser, body: unknown) => ScimUserInput;
+export declare const listResponse: (resources: Record<string, unknown>[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const parseFilter: (filter: string | undefined) => ScimFilter | undefined;
+export declare const scimError: (httpStatus: number, detail: string, scimType?: string) => Response;
+export declare const scimJson: (resource: unknown, httpStatus: number) => Response;
+export declare const serviceProviderConfig: (location: string) => {
+    authenticationSchemes: {
+        description: string;
+        name: string;
+        primary: boolean;
+        specUri: string;
+        type: string;
+    }[];
+    bulk: {
+        maxOperations: number;
+        maxPayloadSize: number;
+        supported: boolean;
+    };
+    changePassword: {
+        supported: boolean;
+    };
+    etag: {
+        supported: boolean;
+    };
+    filter: {
+        maxResults: number;
+        supported: boolean;
+    };
+    meta: {
+        location: string;
+        resourceType: string;
+    };
+    patch: {
+        supported: boolean;
+    };
+    schemas: string[];
+    sort: {
+        supported: boolean;
+    };
+};
+export declare const schemaList: (location: string, extras?: ScimSchemaDefinition[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const schemaOne: (location: string, id: string, extras?: ScimSchemaDefinition[]) => Record<string, unknown> | undefined;
+export declare const resourceTypeList: (location: string, usersEndpoint: string, groupsEndpoint: string, extras?: ScimSchemaDefinition[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const resourceTypeOne: (location: string, id: string, usersEndpoint: string, groupsEndpoint: string, extras?: ScimSchemaDefinition[]) => {
+    description: string;
+    endpoint: string;
+    id: string;
+    meta: {
+        location: string;
+        resourceType: string;
+    };
+    name: string;
+    schema: string;
+    schemas: string[];
+} | undefined;
+export { RESOURCE_TYPE_SCHEMA, SCHEMA_SCHEMA };
+export declare const applyGroupPatch: (group: ScimGroup, body: unknown) => ScimGroupInput;
+export declare const parseGroupInput: (body: unknown) => ScimGroupInput | undefined;
+export declare const toGroupResource: (group: ScimGroup, location: string) => Record<string, unknown>;

package/dist/scim/types.d.ts

@@ -0,0 +1,54 @@
+import type { OrganizationId } from '../tenancy';
+export type ScimToken = {
+    createdAt: number;
+    hashedToken: string;
+    lastUsedAt?: number;
+    organizationId: OrganizationId;
+    tokenId: string;
+};
+export type ScimTokenStore = {
+    deleteToken: (tokenId: string) => Promise<void>;
+    findByHashedToken: (hashedToken: string) => Promise<ScimToken | undefined>;
+    listTokens: (organizationId: OrganizationId) => Promise<ScimToken[]>;
+    saveToken: (token: ScimToken) => Promise<void>;
+};
+export type ScimUser = {
+    active: boolean;
+    custom?: Record<string, unknown>;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    id: string;
+    userName: string;
+};
+export type ScimUserInput = {
+    active: boolean;
+    custom?: Record<string, unknown>;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    userName: string;
+};
+export type ScimGroupMember = {
+    display?: string;
+    value: string;
+};
+export type ScimGroup = {
+    displayName: string;
+    externalId?: string;
+    id: string;
+    members: ScimGroupMember[];
+};
+export type ScimGroupInput = {
+    displayName: string;
+    externalId?: string;
+    members: ScimGroupMember[];
+};
+export type ScimFilter = {
+    attribute: string;
+    value: string;
+};

package/dist/server.js

@@ -12214,6 +12214,44 @@ var createSecretCipher = (keyMaterial) => ({
   decrypt: (ciphertext) => decryptSecret(ciphertext, keyMaterial),
   encrypt: (plaintext) => encryptSecret(plaintext, keyMaterial)
 });
+var VERSIONED_CIPHERTEXT_PREFIX = "absolute-vault";
+var VERSIONED_CIPHERTEXT_SEGMENTS = 3;
+var parseVersionedCiphertext = (value) => {
+  const [prefix, encodedVersion, ciphertext] = value.split(":", VERSIONED_CIPHERTEXT_SEGMENTS);
+  if (prefix !== VERSIONED_CIPHERTEXT_PREFIX || !encodedVersion || !ciphertext)
+    return null;
+  const version = Number(encodedVersion);
+  if (!Number.isSafeInteger(version) || version < 1)
+    return null;
+  return { ciphertext, version };
+};
+var createVersionedSecretCipher = ({
+  currentVersion,
+  keys,
+  legacyKey
+}) => {
+  if (!Number.isSafeInteger(currentVersion) || currentVersion < 1)
+    throw new Error("Vault key version must be a positive integer");
+  const currentKey = keys[currentVersion];
+  if (!currentKey)
+    throw new Error(`Vault key version ${currentVersion} is unavailable`);
+  return {
+    decrypt: async (value) => {
+      const envelope = parseVersionedCiphertext(value);
+      if (!envelope) {
+        if (!legacyKey)
+          throw new Error("Legacy vault ciphertext key is unavailable");
+        return decryptSecret(value, legacyKey);
+      }
+      const key = keys[envelope.version];
+      if (!key)
+        throw new Error(`Vault key version ${envelope.version} is unavailable`);
+      return decryptSecret(envelope.ciphertext, key);
+    },
+    encrypt: async (plaintext) => `${VERSIONED_CIPHERTEXT_PREFIX}:${currentVersion}:${await encryptSecret(plaintext, currentKey)}`,
+    needsReencryption: (value) => parseVersionedCiphertext(value)?.version !== currentVersion
+  };
+};
 
 // src/vault/config.ts
 var createVault = ({
@@ -12225,7 +12263,15 @@ var createVault = ({
     const entry = await store.getEntry(ownerId, name);
     if (entry === undefined)
       return;
-    return cipher.decrypt(entry.encryptedValue);
+    const plaintext = await cipher.decrypt(entry.encryptedValue);
+    if (cipher.needsReencryption?.(entry.encryptedValue)) {
+      await store.saveEntry({
+        ...entry,
+        encryptedValue: await cipher.encrypt(plaintext),
+        updatedAt: Date.now()
+      });
+    }
+    return plaintext;
   },
   list: async (ownerId) => (await store.listEntries(ownerId)).map((entry) => entry.name),
   put: async (ownerId, name, value) => {
@@ -12249,11 +12295,12 @@ var rotateVaultKey = async ({
   const newCipher = createSecretCipher(newKey);
   const entries = await store.listAllEntries();
   const now = Date.now();
-  for (const entry of entries) {
+  await entries.reduce(async (pending, entry) => {
+    await pending;
     const plaintext = await oldCipher.decrypt(entry.encryptedValue);
     const encryptedValue = await newCipher.encrypt(plaintext);
     await store.saveEntry({ ...entry, encryptedValue, updatedAt: now });
-  }
+  }, Promise.resolve());
   return { rotated: entries.length };
 };
 // src/vault/inMemoryVaultStore.ts
@@ -29614,5 +29661,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=73EC5483BC26C84964756E2164756E21
+//# debugId=F0ECED8EFCCFD6F964756E2164756E21
 //# sourceMappingURL=server.js.map