@andrewcaires/api 5.3.5 → 5.4.0

package/dist/index.d.ts

@@ -1,48 +1,37 @@
 /*!
- * @andrewcaires/api v5.3.5
+ * @andrewcaires/api v5.4.0
  * Simple api for small applications using express, jsonwebtoken, sequelize and websocket
  * (c) 2026 Andrew Caires
  * @license: MIT
  */
-import { Context, Application as Application$1, ExpressOptions, IStore, ResponseError } from '@andrewcaires/express';
-import { Encryptor, Env as Env$1 } from '@andrewcaires/node';
+import { Context, Application as Application$1, ExpressOptions, ResponseError } from '@andrewcaires/express';
 import { ModelFindOptions, ModelUpdateOptions, Model as Model$1, Sequelize } from '@andrewcaires/sequelize';
 import { TypeAnyObject, TypeObjectString, TypeAnyFunction, TypeAnyConstructor, EventEmitter, TypeObject, ValidationBase, ValidationShape } from '@andrewcaires/utils.js';
 import { WebSocketServer } from 'ws';
 import { Model, CreateOptions, Attributes, FindOptions, IncludeOptions, FindAttributeOptions, ModelStatic } from 'sequelize';
+import { Env as Env$1 } from '@andrewcaires/node';
 import { Store, SessionData } from 'express-session';
 
-interface IAuthParameters {
-    auth?: UserAuthModel;
-    decode?: TypeAnyObject;
-    forgot?: ForgotModel;
-    token?: string;
-    user?: UserModel;
+interface AuthResult {
+    access: UserAuthModel | UserKeyModel;
+    user: UserModel;
 }
 
 interface AuthEvents {
     "auth.activation": {
         ctx: Context;
-        register: RegisterModel;
-        user: UserModel;
     };
     "auth.failure": {
         ctx: Context;
-        user?: UserModel;
     };
     "auth.login": {
         ctx: Context;
-        auth: UserAuthModel;
-        user: UserModel;
     };
     "auth.logout": {
         ctx: Context;
-        auth: UserAuthModel;
-        user: UserModel;
     };
     "auth.renew": {
         ctx: Context;
-        auth: UserAuthModel;
     };
 }
 
@@ -81,7 +70,7 @@ interface ApplicationEvents extends AuthEvents, ForgotEvents, RegisterEvents {
 
 declare module "express-serve-static-core" {
     interface Request {
-        auth?: UserAuthModel;
+        access?: UserAuthModel | UserKeyModel;
     }
 }
 
@@ -97,12 +86,6 @@ declare module "express-serve-static-core" {
     }
 }
 
-declare module "express-serve-static-core" {
-    interface Request {
-        profile?: TypeObjectString;
-    }
-}
-
 declare module "express-serve-static-core" {
     interface Request {
         tenants?: Array<{
@@ -209,7 +192,7 @@ declare enum UserStatus {
 
 declare class RegisterModel extends Model$1 {
     readonly id: string;
-    secret: string;
+    hash: string;
     expired_at: number;
     active: boolean;
     readonly created_at: Date;
@@ -221,7 +204,7 @@ declare class RegisterModel extends Model$1 {
 
 declare class UserAuthModel extends Model$1 {
     readonly id: string;
-    secret: string;
+    hash: string;
     ip_address: string;
     user_agent: string;
     revoked_at: Date | null;
@@ -385,6 +368,14 @@ declare class MigrationModel extends Model$1 {
     readonly updated_at: Date;
 }
 
+declare class SecretModel extends Model$1 {
+    readonly id: string;
+    key: string;
+    hash: string;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+}
+
 declare class SessionModel extends Model$1 {
     readonly id: string;
     data: TypeAnyObject;
@@ -393,6 +384,21 @@ declare class SessionModel extends Model$1 {
     readonly updated_at: Date;
 }
 
+declare class UserKeyModel extends Model$1 {
+    readonly id: string;
+    name: string;
+    prefix: string;
+    hash: string;
+    last_used_at: Date | null;
+    expires_at: Date | null;
+    revoked_at: Date | null;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+    readonly deleted_at: Date | null;
+    user_id: string;
+    user: UserModel;
+}
+
 declare class Loggable {
     get log(): (message: string) => void;
     static get log(): (message: string) => void;
@@ -418,6 +424,15 @@ declare class Log {
     private static writeRaw;
 }
 
+declare class Secret extends Loggable {
+    private static encryptor;
+    static all(keys?: Array<string>): Promise<Array<string>>;
+    static del(key: string): Promise<boolean>;
+    static get(key: string, value?: string): Promise<string>;
+    static set(key: string, value: string): Promise<void>;
+    private static init;
+}
+
 declare class SessionStore extends Store {
     constructor();
     all: (callback: TypeAnyFunction) => Promise<void>;
@@ -435,14 +450,23 @@ declare abstract class Service {
 }
 
 declare class AuthService extends Service {
+    private readonly options;
     private readonly userAttributes;
-    create(user: UserModel): Promise<IAuthParameters>;
-    destroy(auth?: UserAuthModel): Promise<boolean>;
-    renew(token: string): Promise<IAuthParameters>;
-    user(token: string): Promise<IAuthParameters>;
-    private options;
-    private verify;
-    key(value: string): Promise<IAuthParameters>;
+    private readonly userService;
+    constructor();
+    createApiKey(ctx: Context, name: string, expires_at: Date, user: UserModel): Promise<string>;
+    createApiToken(ctx: Context, user: UserModel): Promise<{
+        token: string;
+    }>;
+    renewApiToken(token: string): Promise<{
+        token: string;
+    }>;
+    apiAuth(ctx: Context): Promise<AuthResult>;
+    apiKeyAuth(key: string): Promise<AuthResult>;
+    apiTokenAuth(token: string): Promise<AuthResult>;
+    private attachAuthContext;
+    private safeEqual;
+    private verifyJwt;
 }
 
 declare class ModelService<M extends Model<any>> extends Service {
@@ -481,7 +505,6 @@ declare class UserService extends Service {
 }
 
 declare class Application<T extends ApplicationEvents = ApplicationEvents> extends Application$1<T> {
-    readonly encryptor: Encryptor;
     authService: AuthService;
     userService: UserService;
     private _webSocket?;
@@ -498,14 +521,13 @@ interface BaseController extends Loggable {
 declare abstract class BaseController<T extends TypeAnyObject = TypeAnyObject> extends EventEmitter<T> {
     protected readonly permissions: Array<string>;
     name(): string;
-    session(ctx: Context, user_agent: string, store: IStore): Promise<void>;
     sync(): Promise<void>;
 }
 
 declare abstract class ModelController<M extends Model<any>, T extends TypeAnyObject = TypeAnyObject> extends BaseController<T> {
     protected readonly attributes: Array<string>;
     protected abstract readonly model: ModelStatic<M>;
-    protected readonly permissions: Array<string>;
+    protected readonly permissions: string[];
     protected readonly search: Array<string>;
     private service;
     protected countAll(options: ModelArgumentsCount<M>): Promise<number>;
@@ -528,10 +550,10 @@ declare class AuditsController extends ModelController<AuditModel> {
 
 declare class AuthController extends BaseController<AuthEvents> {
     protected readonly authService: AuthService;
-    protected login(ctx: Context, user_agent: string, username: string, password: string, remember: boolean, app: Application): Promise<void>;
-    protected logout(ctx: Context, auth: UserAuthModel, user: UserModel, app: Application): Promise<void>;
-    protected renew(ctx: Context, user_agent: string, old: string, app: Application): Promise<void>;
-    protected user(ctx: Context, user: UserModel): Promise<void>;
+    protected login(ctx: Context, username: string, password: string, remember: boolean, app: Application): Promise<void>;
+    protected logout(ctx: Context, access: UserAuthModel | UserKeyModel, app: Application): Promise<void>;
+    protected user(ctx: Context): Promise<void>;
+    protected renew(ctx: Context, old: string, app: Application): Promise<void>;
 }
 
 declare abstract class CrudController<M extends Model<any>, T extends TypeAnyObject = TypeAnyObject> extends ModelController<M, T> {
@@ -592,6 +614,7 @@ declare class GroupsPermissionsController extends ModelController<PermissionMode
     protected set(ctx: Context, group_id: string, permissions: Array<string>): Promise<void>;
     private addPermissions;
     private checkGroup;
+    private checkPermissions;
 }
 
 declare class HealthController {
@@ -611,16 +634,14 @@ declare class McpController extends BaseController {
     sync(app?: Application): Promise<void>;
     protected get(ctx: Context): Promise<void>;
     protected options(ctx: Context): Promise<void>;
-    protected post(ctx: Context): Promise<void>;
-    protected delete(ctx: Context): Promise<void>;
-    private getMcpToolMetadata;
-    private discoverMcpTools;
-    private createMcpToolFromMetadata;
+    protected post(ctx: Context<any, Application>): Promise<void>;
+    protected delete(ctx: Context<any, Application>): Promise<void>;
     private isJsonParseError;
     private isMcpEndpoint;
     private jsonParseErrorResponse;
     private respond;
-    private setHeader;
+    private setResponseHeaders;
+    private getAllowedOrigin;
 }
 
 declare class PermissionsController extends CrudController<PermissionModel> {
@@ -732,6 +753,15 @@ interface McpSession {
     expiresAt: number;
     protocolVersion: McpProtocolVersion;
     initialized: boolean;
+    access?: unknown;
+    groups?: Array<string>;
+    permissions?: Array<string>;
+    tenants?: Array<{
+        id: string;
+        name: string;
+    }>;
+    user?: unknown;
+    userId?: string;
 }
 interface McpToolDefinition {
     name: string;
@@ -749,6 +779,15 @@ interface McpToolDeclaration {
 }
 interface McpToolContext {
     session: McpSession;
+    access?: unknown;
+    groups?: Array<string>;
+    permissions?: Array<string>;
+    tenants?: Array<{
+        id: string;
+        name: string;
+    }>;
+    user?: unknown;
+    userId?: string;
 }
 type McpToolInput = Record<string, unknown>;
 type McpToolOutput = unknown;
@@ -807,6 +846,7 @@ declare class McpToolRegistry {
     call(name: string, argumentsValue: unknown, session: McpSession): Promise<McpCallToolResult>;
     private isCallToolResult;
     private normalizeMcpValidation;
+    private normalizeSchema;
     private outputValidationError;
     private toolInputValidationError;
     private validateAdditionalProperties;
@@ -818,9 +858,12 @@ interface McpHttpHandlerOptions {
     logger?: McpLogger;
     serverName?: string;
     serverVersion?: string;
+    allowedHeaders?: Array<string>;
+    allowedOrigins?: Array<string>;
 }
 declare const MCP_HTTP_ALLOWED_METHODS: readonly ["POST", "DELETE", "OPTIONS"];
 declare const MCP_HTTP_ALLOW: string;
+declare const MCP_HTTP_DEFAULT_ALLOWED_HEADERS: readonly ["Content-Type", "Accept", "MCP-Session-Id", "MCP-Protocol-Version"];
 declare const isJsonParseError: (error: unknown) => error is Error & {
     status?: number;
     statusCode?: number;
@@ -833,9 +876,13 @@ declare class McpHttpHandler {
     private readonly logger?;
     private readonly serverName;
     private readonly serverVersion;
+    private readonly allowedHeaders;
+    private readonly allowedOrigins;
     constructor(options: McpHttpHandlerOptions);
     post(ctx: Context): Promise<McpHttpResponse>;
     delete(ctx: Context): McpHttpResponse;
+    get(ctx?: Context): McpHttpResponse;
+    options(ctx?: Context): McpHttpResponse;
     private initialize;
     private initialized;
     private callTool;
@@ -848,6 +895,14 @@ declare class McpHttpHandler {
     private validateObjectParams;
     private withTransportHeaders;
     private errorResponse;
+    private getBody;
+    private getHeader;
+    private getHeaderFromRequest;
+    private getHeaderFromRecord;
+    private normalizeHeaderValue;
+    private normalizeAllowedHeaders;
+    private getAllowedOrigin;
+    private getAuthContext;
 }
 
 declare const isJsonRpcId: (value: unknown) => value is McpJsonRpcId;
@@ -863,6 +918,9 @@ interface McpToolMetadata extends McpToolDeclaration {
 type McpDecoratedToolHandler = (_argumentsValue: Record<string, unknown>, _context: McpToolContext) => ReturnType<McpRegisteredTool["run"]>;
 declare const assertValidMcpToolDefinition: (definition: McpToolDeclaration) => void;
 
+declare const getMcpToolMetadata: (target: object | TypeAnyConstructor<object>) => Array<McpToolMetadata>;
+declare const discoverMcpTools: (controllers: Array<object>) => Array<McpRegisteredTool>;
+
 declare class TestController extends BaseController {
     protected json(ctx: Context): Promise<void>;
     protected sum(args: TypeAnyObject, _context: McpToolContext): Promise<{
@@ -922,10 +980,11 @@ declare class TestController extends BaseController {
 
 declare class UsersController extends ModelController<UserModel> {
     protected readonly model: typeof UserModel;
+    protected readonly permissions: string[];
     path: string;
     constructor();
     protected avatar(ctx: Context, user: UserModel): Promise<void>;
-    private token_new;
+    protected avatar_del(ctx: Context, user: UserModel): Promise<void>;
     protected add(ctx: Context): Promise<void>;
     protected all(ctx: Context): Promise<void>;
     protected rows(ctx: Context): Promise<void>;
@@ -942,6 +1001,17 @@ declare class UsersGroupsController extends ModelController<GroupModel> {
     protected del(ctx: Context, user_id: string, groups: Array<string>): Promise<void>;
     protected set(ctx: Context, user_id: string, groups: Array<string>): Promise<void>;
     private addGroups;
+    private checkGroups;
+    private checkUser;
+}
+
+declare class UsersKeysController extends ModelController<UserKeyModel> {
+    protected readonly model: typeof UserKeyModel;
+    protected readonly permissions: string[];
+    protected add(ctx: Context, user: UserModel, body: TypeAnyObject, app: Application): Promise<void>;
+    protected add_admin(ctx: Context, id: string, body: TypeAnyObject, app: Application): Promise<void>;
+    protected all(ctx: Context, user: UserModel): Promise<void>;
+    protected all_admin(ctx: Context, id: string): Promise<void>;
     private checkUser;
 }
 
@@ -953,6 +1023,7 @@ declare class UsersTenantsController extends ModelController<TenantModel> {
     protected del(ctx: Context, user_id: string, tenants: Array<string>): Promise<void>;
     protected set(ctx: Context, user_id: string, tenants: Array<string>): Promise<void>;
     private addTenants;
+    private checkTenants;
     private checkUser;
 }
 
@@ -972,9 +1043,11 @@ declare const HasGroups: (...groups: Array<string>) => MethodDecorator;
 
 declare const HasPermissions: (...permissions: Array<string>) => MethodDecorator;
 
+declare const HasScope: (scope?: string) => MethodDecorator;
+
 declare const IsAuthenticated: () => MethodDecorator;
 
-declare const ReqAuth: (key?: string) => ParameterDecorator;
+declare const ReqAccess: (key?: string) => ParameterDecorator;
 
 declare const ReqGroup: (key?: string) => ParameterDecorator;
 
@@ -984,6 +1057,10 @@ declare const ReqPermission: (key?: string) => ParameterDecorator;
 
 declare const ReqPermissions: (key?: string) => ParameterDecorator;
 
+declare const ReqTenant: (key?: string) => ParameterDecorator;
+
+declare const ReqTenants: (key?: string) => ParameterDecorator;
+
 declare const ReqUser: (key?: string) => ParameterDecorator;
 
 type McpToolOptions = Omit<McpToolMetadata, "propertyKey">;
@@ -992,6 +1069,7 @@ declare const McpTool: (options: McpToolOptions) => MethodDecorator;
 declare const Audit: (active?: boolean) => ClassDecorator;
 
 declare class Env extends Env$1 {
+    static readonly AUDIT_IGNORE: string[];
     static readonly BASE_NAME: string;
     static readonly CONSOLE_ERROR: boolean;
     static readonly DATABASE_URI: string;
@@ -1001,12 +1079,15 @@ declare class Env extends Env$1 {
     static readonly DATABASE_TIMEZONE: string;
     static readonly ENCRYPTION_SECRET: string;
     static readonly HTTP_CROSS: string;
+    static readonly HTTP_HYBRID: boolean;
+    static readonly HTTP_NOTFOUND: string;
+    static readonly HTTP_PATH: string;
     static readonly HTTP_PORT: number;
     static readonly HTTP_PUBLIC: string;
+    static readonly HTTP_REDIRECT: string;
     static readonly HTTP_TLS_CA: Buffer<ArrayBufferLike> | null;
     static readonly HTTP_TLS_CRT: Buffer<ArrayBufferLike> | null;
     static readonly HTTP_TLS_KEY: Buffer<ArrayBufferLike> | null;
-    static readonly KEY_HEADER: string;
     static readonly MODEL_LIMIT: number;
     static readonly MODEL_LIMIT_MAX: number;
     static readonly MCP_SESSION_TTL: number;
@@ -1019,9 +1100,12 @@ declare class Env extends Env$1 {
     static readonly SLEEP_FORGOT: number;
     static readonly SLEEP_REGISTRY: number;
     static readonly TENANT_HEADER: string;
-    static readonly TOKEN_CRT: Buffer<ArrayBufferLike> | null;
+    static readonly TOKEN_COOKIE: string;
+    static readonly TOKEN_COOKIE_SET: boolean;
     static readonly TOKEN_HEADER: string;
-    static readonly TOKEN_KEY: Buffer<ArrayBufferLike> | null;
+    static readonly TOKEN_PEPPER: string;
+    static readonly TOKEN_PREFIX: string;
+    static readonly TOKEN_SECRET: string;
     static readonly TOKEN_TTL: number;
     static readonly TOKEN_TTL_FORGOT: number;
     static readonly TOKEN_TTL_RENEW: number;
@@ -1030,18 +1114,12 @@ declare class Env extends Env$1 {
     static readonly API_BODYPARSER_INFLATE: boolean;
     static readonly API_BODYPARSER_LIMIT: string;
     static readonly API_BODYPARSER_TYPE: string;
-    static readonly API_HTTP_HYBRID: boolean;
-    static readonly API_HTTP_NOTFOUND: string;
-    static readonly API_HTTP_PATH: string;
-    static readonly API_HTTP_REDIRECT: string;
     static readonly API_SESSION_NAME: string;
     static readonly API_SESSION_LIFETIME: number;
     static readonly API_SESSION_SECRET: string;
-    static readonly API_TOKEN_COOKIE: string;
-    static readonly API_TOKEN_COOKIE_SET: boolean;
     static readonly API_USER_HISTORY: boolean;
     static readonly API_WEBSOCKET_START: boolean;
 }
 
-export { Application, Audit, AuditModel, AuditTypes, AuditsController, AuthController, AuthService, BaseController, CanCreate, CanDelete, CanRead, CanUpdate, Config, ConfigModel, CrudController, Env, FilesController, ForgotController, ForgotModel, GroupModel, GroupPermissionModel, GroupTypes, GroupsController, GroupsPermissionsController, HasGroups, HasPermissions, HealthController, IsAuthenticated, Log, LogLevels, LogModel, Loggable, LogsController, MCP_DEFAULT_PROTOCOL_VERSION, MCP_HTTP_ALLOW, MCP_HTTP_ALLOWED_METHODS, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_ID_HEADER, MCP_SUPPORTED_PROTOCOL_VERSIONS, MCP_TOOL_METADATA, McpController, McpError, McpErrorCode, McpHttpHandler, McpInternalError, McpInvalidParamsError, McpInvalidRequestError, McpInvalidSessionError, McpMethodNotFoundError, McpParseError, McpServerError, McpSessionStore, McpTool, McpToolNotFoundError, McpToolRegistry, MigrationModel, ModelController, ModelService, PermissionModel, PermissionsController, RegisterController, RegisterModel, ReqAuth, ReqGroup, ReqGroups, ReqPermission, ReqPermissions, ReqUser, Service, SessionModel, SessionStore, SetupController, TenantModel, TenantStatus, TenantsController, TestController, UserAuthModel, UserGroupModel, UserModel, UserPasswordModel, UserService, UserStatus, UserTenantModel, UsersController, UsersGroupsController, UsersTenantsController, assertValidMcpToolDefinition, canFactory, isJsonParseError, isJsonRpcId, jsonParseErrorResponse, jsonRpcError, jsonRpcErrorFromCode, jsonRpcResult, parseJsonRpcRequest, sequelize };
-export type { ApplicationEvents, AuthEvents, ForgotEvents, IAuthParameters, McpCallToolResult, McpDecoratedToolHandler, McpHttpHandlerOptions, McpHttpResponse, McpJsonRpcErrorBody, McpJsonRpcErrorResult, McpJsonRpcId, McpJsonRpcRequest, McpJsonRpcResult, McpLogger, McpNormalizedValidation, McpProtocolVersion, McpRegisteredTool, McpSession, McpToolCallLog, McpToolContext, McpToolDeclaration, McpToolDefinition, McpToolHandlerResult, McpToolInput, McpToolMetadata, McpToolOptions, McpToolOutput, ModelArgumentsBase, ModelArgumentsCount, ModelArgumentsCreate, ModelArgumentsDelete, ModelArgumentsFindAll, ModelArgumentsFindOne, ModelArgumentsInclude, ModelArgumentsUpdate, ModelCallbackFindAll, ModelCallbackFindOne, ModelOptions, ModelResultFindAll, RegisterEvents };
+export { Application, Audit, AuditModel, AuditTypes, AuditsController, AuthController, AuthService, BaseController, CanCreate, CanDelete, CanRead, CanUpdate, Config, ConfigModel, CrudController, Env, FilesController, ForgotController, ForgotModel, GroupModel, GroupPermissionModel, GroupTypes, GroupsController, GroupsPermissionsController, HasGroups, HasPermissions, HasScope, HealthController, IsAuthenticated, Log, LogLevels, LogModel, Loggable, LogsController, MCP_DEFAULT_PROTOCOL_VERSION, MCP_HTTP_ALLOW, MCP_HTTP_ALLOWED_METHODS, MCP_HTTP_DEFAULT_ALLOWED_HEADERS, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_ID_HEADER, MCP_SUPPORTED_PROTOCOL_VERSIONS, MCP_TOOL_METADATA, McpController, McpError, McpErrorCode, McpHttpHandler, McpInternalError, McpInvalidParamsError, McpInvalidRequestError, McpInvalidSessionError, McpMethodNotFoundError, McpParseError, McpServerError, McpSessionStore, McpTool, McpToolNotFoundError, McpToolRegistry, MigrationModel, ModelController, ModelService, PermissionModel, PermissionsController, RegisterController, RegisterModel, ReqAccess, ReqGroup, ReqGroups, ReqPermission, ReqPermissions, ReqTenant, ReqTenants, ReqUser, Secret, SecretModel, Service, SessionModel, SessionStore, SetupController, TenantModel, TenantStatus, TenantsController, TestController, UserAuthModel, UserGroupModel, UserKeyModel, UserModel, UserPasswordModel, UserService, UserStatus, UserTenantModel, UsersController, UsersGroupsController, UsersKeysController, UsersTenantsController, assertValidMcpToolDefinition, canFactory, discoverMcpTools, getMcpToolMetadata, isJsonParseError, isJsonRpcId, jsonParseErrorResponse, jsonRpcError, jsonRpcErrorFromCode, jsonRpcResult, parseJsonRpcRequest, sequelize };
+export type { ApplicationEvents, AuthEvents, AuthResult, ForgotEvents, McpCallToolResult, McpDecoratedToolHandler, McpHttpHandlerOptions, McpHttpResponse, McpJsonRpcErrorBody, McpJsonRpcErrorResult, McpJsonRpcId, McpJsonRpcRequest, McpJsonRpcResult, McpLogger, McpNormalizedValidation, McpProtocolVersion, McpRegisteredTool, McpSession, McpToolCallLog, McpToolContext, McpToolDeclaration, McpToolDefinition, McpToolHandlerResult, McpToolInput, McpToolMetadata, McpToolOptions, McpToolOutput, ModelArgumentsBase, ModelArgumentsCount, ModelArgumentsCreate, ModelArgumentsDelete, ModelArgumentsFindAll, ModelArgumentsFindOne, ModelArgumentsInclude, ModelArgumentsUpdate, ModelCallbackFindAll, ModelCallbackFindOne, ModelOptions, ModelResultFindAll, RegisterEvents };