@appweaver/core 1.0.0

package/security/oauth2/create-oauth2-plugin.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOAuth2Plugin = createOAuth2Plugin;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const oauth2_1 = __importDefault(require("@fastify/oauth2"));
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const errors_1 = require("../../errors");
+const auth_service_1 = require("../auth-service");
+const helper_1 = require("../helper");
+const oauth2_schema_1 = require("./oauth2-schema");
+function createOAuth2Plugin(authSource, oAuth2Config) {
+    const name = authSource.replace('oauth2', '');
+    const upperName = name.toUpperCase();
+    const lowerName = name.toLowerCase();
+    return (0, fastify_plugin_1.default)(async (server) => {
+        if (!oAuth2Config.enabled) {
+            return;
+        }
+        if (!oAuth2Config.clientId || !oAuth2Config.clientSecret) {
+            throw Error(`${name} OAuth2 configuration is missing`);
+        }
+        if (server[authSource] !== undefined) {
+            throw Error(`${name} OAuth2 provider is already registered`);
+        }
+        const authConfig = oauth2_1.default[`${upperName}_CONFIGURATION`];
+        if (!authConfig && !oAuth2Config.issuer) {
+            throw Error(`${name} OAuth2 provider is not supported`);
+        }
+        const authService = (0, context_1.inject)(auth_service_1.AuthService);
+        const securityStore = (0, context_1.inject)(common_1.SecurityStore);
+        const prefix = common_1.config.SECURITY_ROUTE_PREFIX.replace(/\/$/, '');
+        server.register(oauth2_1.default, {
+            name: authSource,
+            credentials: {
+                client: {
+                    id: oAuth2Config.clientId,
+                    secret: oAuth2Config.clientSecret
+                },
+                auth: authConfig
+            },
+            ...(oAuth2Config.issuer
+                ? { discovery: { issuer: oAuth2Config.issuer } }
+                : {}),
+            scope: oAuth2Config.scope,
+            schema: (0, oauth2_schema_1.createOAuth2RedirectSchema)(name),
+            startRedirectPath: `${prefix}/login/${lowerName}`,
+            callbackUri: `${common_1.config.APP_HOSTNAME}${prefix}/login/${lowerName}/callback`,
+            generateStateFunction: async (request) => {
+                const redirectToUrl = request.query.redirectToUrl;
+                const result = (0, helper_1.validateRedirectUrl)(redirectToUrl);
+                if (!result.valid) {
+                    throw new errors_1.HttpError(result.message, 400);
+                }
+                return securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.OAuth2State, { redirectToUrl }, common_1.config.SECURITY_OAUTH2_STATE_TTL);
+            },
+            checkStateFunction: async (request) => {
+                const state = request.query.state;
+                request.oauth2State =
+                    await securityStore.useOneTimeToken(state, common_1.AuthOTTPurpose.OAuth2State);
+                return true;
+            }
+        });
+        server.get(`${prefix}/login/${lowerName}/callback`, {
+            schema: (0, oauth2_schema_1.createOAuth2CallbackSchema)(name)
+        }, async function (request, reply) {
+            const { token } = await server[authSource].getAccessTokenFromAuthorizationCodeFlow(request);
+            const userInfo = await oAuth2Config.extractUserInfo(token.access_token);
+            let authUser = await authService.findByUsername(userInfo.email);
+            if (!authUser) {
+                authUser = await authService.registerAuthUser(authSource, userInfo.email, undefined, (0, common_1.pickProperties)(userInfo, ['firstName', 'lastName']));
+            }
+            else if (!authUser.verifiedEmail) {
+                throw new errors_1.HttpError('Auth user email address is not verified', 403);
+            }
+            const stateData = request.oauth2State;
+            const ott = await securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.Authentication, { authUserId: authUser.id, authSource }, common_1.config.SECURITY_AUTH_OTT_TTL);
+            const separator = stateData.redirectToUrl.includes('?') ? '&' : '?';
+            return reply.redirect(`${stateData.redirectToUrl}${separator}token=${ott}`);
+        });
+    });
+}

package/security/oauth2/index.d.ts

@@ -0,0 +1,3 @@
+export * from './oauth2-custom';
+export * from './oauth2-facebook';
+export * from './oauth2-google';

package/security/oauth2/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./oauth2-custom"), exports);
+__exportStar(require("./oauth2-facebook"), exports);
+__exportStar(require("./oauth2-google"), exports);

package/security/oauth2/oauth2-custom.d.ts

@@ -0,0 +1,7 @@
+export type OAuth2UserInfo = {
+    sub: string;
+    email: string;
+    given_name: string;
+    family_name: string;
+};
+export declare const oauth2Custom: (server: import("../..").Server) => Promise<void>;

package/security/oauth2/oauth2-custom.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauth2Custom = void 0;
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const errors_1 = require("../../errors");
+const create_oauth2_plugin_1 = require("./create-oauth2-plugin");
+exports.oauth2Custom = (0, create_oauth2_plugin_1.createOAuth2Plugin)(common_1.AuthSource.OAuth2Custom, {
+    enabled: common_1.config.SECURITY_OAUTH2_CUSTOM_ENABLED,
+    clientId: common_1.config.SECURITY_OAUTH2_CUSTOM_CLIENT_ID,
+    clientSecret: common_1.config.SECURITY_OAUTH2_CUSTOM_CLIENT_SECRET,
+    issuer: common_1.config.SECURITY_OAUTH2_CUSTOM_ISSUER,
+    scope: ['openid', 'profile', 'email'],
+    extractUserInfo: (accessToken) => fetchCustomUser(accessToken)
+});
+async function fetchCustomUser(accessToken) {
+    const server = context_1.context.server;
+    if (!server) {
+        throw new errors_1.HttpError('Server is not available', 500);
+    }
+    const customOauth2 = server[common_1.AuthSource.OAuth2Custom];
+    let data;
+    if (typeof customOauth2?.userinfo === 'function') {
+        data = (await customOauth2.userinfo(accessToken));
+    }
+    else {
+        // Fallback to direct API call if the plugin is not initialized
+        const resp = await fetch(`${common_1.config.SECURITY_OAUTH2_CUSTOM_ISSUER}/protocol/openid-connect/userinfo`, { method: 'GET', headers: { authorization: `Bearer ${accessToken}` } });
+        if (!resp.ok) {
+            throw new errors_1.HttpError(`Custom OAuth2 API error: ${resp.status} ${resp.statusText}`, 500);
+        }
+        data = await resp.json();
+    }
+    return {
+        id: data.sub,
+        email: data.email,
+        firstName: data.given_name,
+        lastName: data.family_name
+    };
+}

package/security/oauth2/oauth2-facebook.d.ts

@@ -0,0 +1 @@
+export declare const oauth2Facebook: (server: import("../..").Server) => Promise<void>;

package/security/oauth2/oauth2-facebook.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauth2Facebook = void 0;
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../../errors");
+const create_oauth2_plugin_1 = require("./create-oauth2-plugin");
+exports.oauth2Facebook = (0, create_oauth2_plugin_1.createOAuth2Plugin)(common_1.AuthSource.OAuth2Facebook, {
+    enabled: common_1.config.SECURITY_OAUTH2_FACEBOOK_ENABLED,
+    clientId: common_1.config.SECURITY_OAUTH2_FACEBOOK_CLIENT_ID,
+    clientSecret: common_1.config.SECURITY_OAUTH2_FACEBOOK_CLIENT_SECRET,
+    scope: ['public_profile', 'email'],
+    extractUserInfo: (accessToken) => fetchFacebookUser(accessToken)
+});
+async function fetchFacebookUser(accessToken) {
+    const params = new URLSearchParams();
+    params.append('fields', 'id,name,email');
+    params.append('access_token', accessToken);
+    const resp = await fetch(`${common_1.config.SECURITY_OAUTH2_FACEBOOK_USER_INFO_URL}?${params}`, { method: 'GET' });
+    if (!resp.ok) {
+        throw new errors_1.HttpError(`Facebook Graph API error: ${resp.status} ${resp.statusText}`, 500);
+    }
+    const data = await resp.json();
+    const [firstName, lastName] = data.name.split(' ');
+    return {
+        id: data.id,
+        email: data.email,
+        firstName,
+        lastName
+    };
+}

package/security/oauth2/oauth2-google.d.ts

@@ -0,0 +1 @@
+export declare const oauth2Google: (server: import("../..").Server) => Promise<void>;

package/security/oauth2/oauth2-google.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauth2Google = void 0;
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../../errors");
+const create_oauth2_plugin_1 = require("./create-oauth2-plugin");
+exports.oauth2Google = (0, create_oauth2_plugin_1.createOAuth2Plugin)(common_1.AuthSource.OAuth2Google, {
+    enabled: common_1.config.SECURITY_OAUTH2_GOOGLE_ENABLED,
+    clientId: common_1.config.SECURITY_OAUTH2_GOOGLE_CLIENT_ID,
+    clientSecret: common_1.config.SECURITY_OAUTH2_GOOGLE_CLIENT_SECRET,
+    scope: ['profile', 'email'],
+    extractUserInfo: (accessToken) => fetchGoogleUser(accessToken)
+});
+async function fetchGoogleUser(accessToken) {
+    const params = new URLSearchParams();
+    params.append('access_token', accessToken);
+    const resp = await fetch(`${common_1.config.SECURITY_OAUTH2_GOOGLE_USER_INFO_URL}?${params}`, { method: 'GET' });
+    if (!resp.ok) {
+        throw new errors_1.HttpError(`Google API error: ${resp.status} ${resp.statusText}`, 500);
+    }
+    const data = await resp.json();
+    return {
+        id: data.id,
+        email: data.email,
+        firstName: data.given_name,
+        lastName: data.family_name
+    };
+}

package/security/oauth2/oauth2-schema.d.ts

@@ -0,0 +1,10 @@
+import { RouteSchema } from '@appweaver/common';
+export declare const OAuth2RedirectQuery: import("@sinclair/typebox").TObject<{
+    redirectToUrl: import("@sinclair/typebox").TString;
+}>;
+export declare const OAuth2CallbackQuery: import("@sinclair/typebox").TObject<{
+    code: import("@sinclair/typebox").TString;
+    state: import("@sinclair/typebox").TString;
+}>;
+export declare function createOAuth2RedirectSchema(providerName: string): RouteSchema;
+export declare function createOAuth2CallbackSchema(providerName: string): RouteSchema;

package/security/oauth2/oauth2-schema.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2CallbackQuery = exports.OAuth2RedirectQuery = void 0;
+exports.createOAuth2RedirectSchema = createOAuth2RedirectSchema;
+exports.createOAuth2CallbackSchema = createOAuth2CallbackSchema;
+const typebox_1 = require("@sinclair/typebox");
+const errors_1 = require("../../errors");
+exports.OAuth2RedirectQuery = typebox_1.Type.Object({
+    redirectToUrl: typebox_1.Type.String({
+        format: 'uri',
+        description: 'A URL to redirect to with one-time-token after successful' +
+            ' authentication. The client then needs to exchange this token for' +
+            ' an JWT access token',
+        example: 'https://example.com/login/handler'
+    })
+});
+exports.OAuth2CallbackQuery = typebox_1.Type.Object({
+    code: typebox_1.Type.String({
+        description: 'Authorization code from OAuth2 provider',
+        example: '3b7bdc9982feac0e20cf4ddc9be52a1a027142e25b4d14c1b5a280595bc20'
+    }),
+    state: typebox_1.Type.String({
+        description: 'Authorization state returned from OAuth2 provider',
+        example: '89bbb34d76801fcf8251193a02a1d62c7c87a'
+    })
+});
+function createOAuth2RedirectSchema(providerName) {
+    return {
+        tags: ['Auth'],
+        summary: `Redirect to ${providerName} authentication page`,
+        description: `Redirect to ${providerName} authentication page`,
+        querystring: exports.OAuth2RedirectQuery,
+        response: {
+            302: {
+                description: `Redirect to ${providerName} authentication page`
+            }
+        }
+    };
+}
+function createOAuth2CallbackSchema(providerName) {
+    return {
+        tags: ['Auth'],
+        summary: `Authenticate identity from ${providerName} callback`,
+        description: `Authenticate identity from ${providerName} callback`,
+        querystring: exports.OAuth2CallbackQuery,
+        response: {
+            302: {
+                description: `Redirect to 'redirectToUrl' provided when initiating OAuth2 authentication`
+            },
+            ...errors_1.AllErrorResponses
+        }
+    };
+}

package/security/recaptcha/index.d.ts

@@ -0,0 +1,2 @@
+export * from './recaptcha';
+export * from './recaptcha-verify';

package/security/recaptcha/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./recaptcha"), exports);
+__exportStar(require("./recaptcha-verify"), exports);

package/security/recaptcha/recaptcha-verify.d.ts

@@ -0,0 +1 @@
+export declare function recaptchaVerify(token: string, remoteIp?: string, action?: string): Promise<void>;

package/security/recaptcha/recaptcha-verify.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recaptchaVerify = recaptchaVerify;
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../../errors");
+async function recaptchaVerify(token, remoteIp, action) {
+    const params = new URLSearchParams();
+    params.set('secret', common_1.config.SECURITY_RECAPTCHA_SECRET);
+    params.set('response', token);
+    if (remoteIp) {
+        params.set('remoteip', remoteIp);
+    }
+    const resp = await fetch(common_1.config.SECURITY_RECAPTCHA_VERIFY_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: params.toString()
+    });
+    if (!resp.ok) {
+        common_1.logger.error(`reCAPTCHA request failed: ${resp.statusText}`);
+        throw new errors_1.HttpError('reCAPTCHA request failed', 500);
+    }
+    const data = await resp.json();
+    common_1.logger.debug(data, 'reCAPTCHA verified');
+    if (!data.success) {
+        throw new errors_1.HttpError('reCAPTCHA invalid token', 400);
+    }
+    if (action && data.action !== action) {
+        throw new errors_1.HttpError('reCAPTCHA action mismatch', 403);
+    }
+    if (data.score < common_1.config.SECURITY_RECAPTCHA_MIN_SCORE) {
+        throw new errors_1.HttpError('reCAPTCHA low score', 403);
+    }
+}

package/security/recaptcha/recaptcha.d.ts

@@ -0,0 +1,2 @@
+import { Server } from '../../types';
+export declare const recaptcha: (server: Server) => Promise<void>;

package/security/recaptcha/recaptcha.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recaptcha = void 0;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../../errors");
+const recaptcha_verify_1 = require("./recaptcha-verify");
+exports.recaptcha = (0, fastify_plugin_1.default)(async (server) => {
+    if (!common_1.config.SECURITY_RECAPTCHA_SECRET) {
+        throw Error('reCAPTCHA secret is not set');
+    }
+    server.decorate('recaptcha', async (request) => {
+        const token = request.headers[common_1.config.SECURITY_RECAPTCHA_HEADER_NAME.toLowerCase()];
+        if (!token) {
+            throw new errors_1.HttpError(`Missing reCAPTCHA header: ${common_1.config.SECURITY_RECAPTCHA_HEADER_NAME}`, 401);
+        }
+        await (0, recaptcha_verify_1.recaptchaVerify)(String(token).trim(), request.ip, request.routeOptions.config.recaptchaAction);
+    });
+});

package/security/resources/api-key/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel | undefined;
+export default _default;

package/security/resources/api-key/model.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const factory_1 = require("../../../factory");
+const helper_1 = require("../../helper");
+const authModel = (0, helper_1.resourceAuthModel)();
+const shouldCreateModel = common_1.config.SECURITY_API_KEY_ENABLED ||
+    common_1.config.SECURITY_API_KEY_KEEP_DATABASE_TABLE;
+exports.default = shouldCreateModel
+    ? (0, factory_1.createModel)({
+        name: 'ApiKey',
+        scalars: {
+            key: {
+                type: 'string'
+            },
+            keyHash: {
+                type: 'string',
+                unique: true,
+                hidden: true
+            },
+            name: {
+                type: 'string',
+                required: false,
+                maxLength: 255
+            },
+            description: {
+                type: 'string',
+                required: false
+            },
+            enabled: {
+                type: 'boolean',
+                default: true
+            },
+            expiresAt: {
+                type: 'dateTime',
+                required: false
+            }
+        },
+        ...(authModel
+            ? {
+                relations: {
+                    [(0, common_1.uncapitalize)(authModel.name)]: {
+                        model: authModel.name,
+                        mappedBy: 'apiKeys',
+                        owner: true,
+                        input: {
+                            type: 'none'
+                        },
+                        output: {
+                            type: 'none'
+                        }
+                    }
+                }
+            }
+            : {}),
+        create: {
+            omit: ['key']
+        },
+        update: {
+            omit: ['key', 'expiresAt']
+        }
+    })
+    : undefined;

package/security/resources/api-key/policy.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourcePolicyConfig<any> | undefined;
+export default _default;

package/security/resources/api-key/policy.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const factory_1 = require("../../../factory");
+const helper_1 = require("../../helper");
+function authModelField() {
+    return (0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name);
+}
+exports.default = common_1.config.SECURITY_API_KEY_ENABLED
+    ? (0, factory_1.createPolicy)({
+        modelName: 'ApiKey',
+        checkAccess: (action, resource) => {
+            const authFieldName = authModelField();
+            const currentAuthId = (0, helper_1.currentAuthUser)().id;
+            if (action === 'create') {
+                return resource[authFieldName].id === currentAuthId;
+            }
+            else {
+                return resource[`${authFieldName}Id`] === currentAuthId;
+            }
+        },
+        readRestrictions: () => {
+            return { [authModelField()]: { id: (0, helper_1.currentAuthUser)().id } };
+        }
+    })
+    : undefined;

package/security/resources/api-key/routes.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceRoutes | undefined;
+export default _default;

package/security/resources/api-key/routes.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const factory_1 = require("../../../factory");
+exports.default = common_1.config.SECURITY_API_KEY_ENABLED
+    ? (0, factory_1.createRoutes)({
+        modelName: 'ApiKey',
+        aggregate: {
+            exclude: true
+        },
+        export: {
+            exclude: true
+        }
+    })
+    : undefined;

package/security/resources/api-key/service.d.ts

@@ -0,0 +1,3 @@
+import { ApiKey } from '../../../types';
+declare const _default: import("@appweaver/common").Ctor<import("../../..").ResourceService<ApiKey, ApiKey, ApiKey, any, any>> | undefined;
+export default _default;

package/security/resources/api-key/service.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const factory_1 = require("../../../factory");
+const helper_1 = require("../../helper");
+const context_1 = require("../../../context");
+exports.default = common_1.config.SECURITY_API_KEY_ENABLED
+    ? (0, factory_1.createService)({
+        modelName: 'ApiKey',
+        beforeCreate: (data) => {
+            data.key = (0, common_1.randomString)(64, { special: false });
+            data.keyHash = (0, common_1.makeHash)(data.key);
+            // Add relation to the current user when creating a new API Key
+            data[(0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name)] = {
+                id: (0, helper_1.currentAuthUser)().id
+            };
+            // Enforces max API key duration based on config value
+            const maxDuration = common_1.config.SECURITY_API_KEY_MAX_DURATION;
+            if (maxDuration) {
+                const maxExpiryDate = new Date(Date.now() + maxDuration * 1000);
+                if (!data.expiresAt ||
+                    new Date(data.expiresAt).getTime() > maxExpiryDate.getTime()) {
+                    data.expiresAt = maxExpiryDate;
+                }
+            }
+        },
+        afterCreate: async (data) => {
+            const service = (0, context_1.injectService)('ApiKey');
+            await service.update(data.id, { key: `...${data.key.slice(-6)}` });
+            data.key = `${data.id}${common_1.config.SECURITY_API_KEY_DELIMITER}${data.key}`;
+        }
+    })
+    : undefined;

package/security/resources/one-time-token/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel | undefined;
+export default _default;

package/security/resources/one-time-token/model.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const factory_1 = require("../../../factory");
+const shouldCreateModel = common_1.config.SECURITY_STORE_PROVIDER ===
+    '@appweaver/core/security/store/database-security-store' ||
+    common_1.config.SECURITY_STORE_KEEP_DATABASE_TABLE;
+exports.default = shouldCreateModel
+    ? (0, factory_1.createModel)({
+        name: 'OneTimeToken',
+        audit: {
+            createdById: false
+        },
+        scalars: {
+            tokenHash: {
+                type: 'string',
+                maxLength: 511
+            },
+            purpose: {
+                type: 'string',
+                maxLength: 255
+            },
+            expiresAt: {
+                type: 'dateTime'
+            },
+            data: {
+                type: 'json'
+            }
+        },
+        index: [['tokenHash', 'purpose']]
+    })
+    : undefined;

package/security/resources/permission/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel;
+export default _default;

package/security/resources/permission/model.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const factory_1 = require("../../../factory");
+exports.default = (0, factory_1.createModel)({
+    name: 'Permission',
+    scalars: {
+        name: {
+            type: 'string',
+            unique: true,
+            maxLength: 255
+        }
+    },
+    read: {
+        omit: ['updatedAt', 'createdAt', 'createdById']
+    }
+});

package/security/resources/role/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel;
+export default _default;

package/security/resources/role/model.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const factory_1 = require("../../../factory");
+exports.default = (0, factory_1.createModel)({
+    name: 'Role',
+    scalars: {
+        name: {
+            type: 'string',
+            unique: true,
+            maxLength: 255
+        }
+    },
+    relations: {
+        permissions: {
+            model: 'Permission',
+            array: true
+        }
+    },
+    read: {
+        omit: ['updatedAt', 'createdAt', 'createdById']
+    }
+});

package/security/store/database-security-store.d.ts

@@ -0,0 +1,5 @@
+import { SecurityStore, ValidationResult } from '@appweaver/common';
+export declare class DatabaseSecurityStore extends SecurityStore {
+    generateOneTimeToken<T = any>(purpose: string, data: T, ttl: number): Promise<string>;
+    useOneTimeToken<T = any>(token: string, purpose: string, validateContent?: (value: T) => ValidationResult): Promise<T>;
+}