@actuate-media/cms-core 0.35.1 → 0.37.0

package/dist/security/center/types.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export type SecurityStatusLevel = 'secure' | 'needs_attention' | 'at_risk' | 'unknown';
+export type CheckStatus = 'pass' | 'warning' | 'fail' | 'unknown';
+export interface SecurityCheck {
+    key: string;
+    label: string;
+    status: CheckStatus;
+    /** Short human value, e.g. "3 of 4 admins" or "Enabled". */
+    value?: string;
+    /** In-admin deep link the operator can follow to act on this check. */
+    actionHref?: string;
+}
+export type SecurityWarningCategory = 'auth' | 'sessions' | 'api_keys' | 'uploads' | 'rate_limit' | 'audit' | 'secrets' | 'access';
+export interface SecurityWarning {
+    id: string;
+    severity: 'critical' | 'warning' | 'info';
+    category: SecurityWarningCategory;
+    title: string;
+    description: string;
+    actionLabel?: string;
+    actionHref?: string;
+}
+export interface SecurityStatus {
+    status: SecurityStatusLevel;
+    /** 0–100 posture score (advisory; the level is the source of truth). */
+    score: number;
+    label: string;
+    description: string;
+    checks: SecurityCheck[];
+    warnings: SecurityWarning[];
+    lastCheckedAt: string;
+}
+/** Persisted, enforced MFA policy. */
+export interface MfaSettings {
+    required: boolean;
+    gracePeriodDays: number;
+    /** ISO timestamp when `required` was last switched on (drives the grace window). */
+    requiredAt?: string;
+}
+/** Persisted, enforced session policy. `maxConcurrentSessions = 0` ⇒ unlimited. */
+export interface SessionSettings {
+    maxConcurrentSessions: number;
+}
+export interface SecuritySettings {
+    mfa: MfaSettings;
+    session: SessionSettings;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+export interface UsersSecuritySummary {
+    totalUsers: number;
+    totalAdmins: number;
+    withMfa: number;
+    withoutMfa: number;
+    adminsWithoutMfa: number;
+    inactive: number;
+}
+export interface ApiKeysSecuritySummary {
+    active: number;
+    withoutExpiration: number;
+    broadScope: number;
+    staleUnused90d: number;
+}
+/** Status of secrets/encryption — never the values themselves. */
+export interface SecretsStatus {
+    cmsSecret: CheckStatus;
+    encryptionKey: CheckStatus;
+    rateLimitBackend: 'distributed' | 'in_memory';
+    apiKeysHashed: boolean;
+    webhookSecretsEncrypted: boolean;
+}
+export interface IpAllowlistStatus {
+    enabled: boolean;
+    source: 'config' | 'none';
+    ranges: string[];
+    currentIp: string | null;
+    currentIpAllowed: boolean | null;
+}
+export interface SecuritySourceMetadata {
+    source: 'config' | 'environment' | 'database' | 'plugin' | 'computed';
+    editable: boolean;
+    reason?: string;
+}
+/** Everything the admin Security tab needs in one round-trip. */
+export interface SecurityCenterData {
+    settings: SecuritySettings;
+    status: SecurityStatus;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+    /** Effective max session age in hours (config/default; read-only today). */
+    sessionMaxAgeHours: number;
+    /** Whether the current admin (the viewer) has TOTP enabled — drives lockout-safe MFA enable. */
+    viewerHasMfa: boolean;
+    environment: string;
+    sources: Record<string, SecuritySourceMetadata>;
+}
+/** Signals consumed by the pure {@link computeSecurityStatus}. */
+export interface SecurityStatusInput {
+    isProduction: boolean;
+    settings: SecuritySettings;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/center/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAA;AACtF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;AAEjE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,CAAA;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,UAAU,GACV,UAAU,GACV,SAAS,GACT,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,CAAA;AAEZ,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAA;IACzC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAA;IAChB,OAAO,EAAE,eAAe,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAA;IACtB,aAAa,EAAE,WAAW,CAAA;IAC1B,gBAAgB,EAAE,aAAa,GAAG,WAAW,CAAA;IAC7C,aAAa,EAAE,OAAO,CAAA;IACtB,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAA;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,MAAM,EAAE,cAAc,CAAA;IACtB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gGAAgG;IAChG,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;CACtB"}

package/dist/security/center/types.js

@@ -0,0 +1,12 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/center/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-core",
-  "version": "0.35.1",
+  "version": "0.37.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -54,6 +54,16 @@
       "import": "./dist/api/index.js",
       "default": "./dist/api/index.js"
     },
+    "./appearance": {
+      "types": "./dist/appearance/index.d.ts",
+      "import": "./dist/appearance/index.js",
+      "default": "./dist/appearance/index.js"
+    },
+    "./security-center": {
+      "types": "./dist/security/center/index.d.ts",
+      "import": "./dist/security/center/index.js",
+      "default": "./dist/security/center/index.js"
+    },
     "./page-builder": {
       "types": "./dist/page-builder/index.d.ts",
       "import": "./dist/page-builder/index.js",