@archlast/server 0.0.1

package/dist/admin/schema.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Admin Authentication Schema
+ *
+ * Uses IDatabaseClient for Document Store compatibility.
+ * Collections: _admin_users, _admin_sessions, _api_keys, _admin_tokens
+ */
+import type { IDatabaseClient, Document } from "../db/interfaces.js";
+export declare const ADMIN_USERS_COLLECTION = "_admin_users";
+export declare const ADMIN_SESSIONS_COLLECTION = "_admin_sessions";
+export declare const API_KEYS_COLLECTION = "_api_keys";
+export declare const ADMIN_TOKENS_COLLECTION = "_admin_tokens";
+export declare const ADMIN_COLLECTIONS: {
+    readonly users: "_admin_users";
+    readonly sessions: "_admin_sessions";
+    readonly apiKeys: "_api_keys";
+    readonly tokens: "_admin_tokens";
+};
+/**
+ * Validate username format
+ * - 3-32 characters
+ * - alphanumeric + underscore only
+ * - case-insensitive (stored lowercase)
+ */
+export declare function isValidUsername(username: string): boolean;
+/**
+ * Normalize username to lowercase
+ */
+export declare function normalizeUsername(username: string): string;
+/**
+ * Admin Schema Definition
+ * Uses defineSchema for proper introspection and relationship management.
+ * This can be merged with application schemas at runtime.
+ */
+export declare const adminSchema: {
+    tables: {
+        _admin_users: import("../schema/definition.js").TableDefinition<{
+            _id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            username: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            password_hash: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            avatar_url: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            is_super_admin: import("../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            created_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updated_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+        }>;
+        _admin_sessions: import("../schema/definition.js").TableDefinition<{
+            _id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            admin_user_id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            token: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expires_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            created_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            last_accessed_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            user_agent: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            ip_address: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        _api_keys: import("../schema/definition.js").TableDefinition<{
+            _id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            key: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            created_by_admin_id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            created_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            last_used_at: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            is_revoked: import("../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+        }>;
+        _admin_tokens: import("../schema/definition.js").TableDefinition<{
+            _id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            token: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            created_by_admin_id: import("../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            scopes: import("../schema/validators.js").FieldSchema<import("zod").ZodArray<import("zod").ZodString>>;
+            expires_at: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            last_used_at: import("../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            is_revoked: import("../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            created_at: import("../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+        }>;
+    };
+};
+export interface AdminUser extends Document {
+    _id: string;
+    _collection: string;
+    username: string;
+    password_hash: string;
+    name: string | null;
+    avatar_url: string | null;
+    is_super_admin: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface AdminToken extends Document {
+    _id: string;
+    _collection: string;
+    token: string;
+    name: string;
+    created_by_admin_id: string;
+    scopes: string[];
+    expires_at: number | null;
+    last_used_at: number | null;
+    is_revoked: boolean;
+    created_at: number;
+}
+export interface AdminSession extends Document {
+    _id: string;
+    _collection: string;
+    admin_user_id: string;
+    token: string;
+    expires_at: number;
+    created_at: number;
+    last_accessed_at: number;
+    user_agent: string | null;
+    ip_address: string | null;
+}
+export interface ApiKey extends Document {
+    _id: string;
+    _collection: string;
+    key: string;
+    name: string;
+    created_by_admin_id: string;
+    created_at: number;
+    last_used_at: number | null;
+    is_revoked: boolean;
+}
+/**
+ * Check if any admin users exist
+ */
+export declare function hasAnyAdminUsers(db: IDatabaseClient): Promise<boolean>;
+/**
+ * Create the first admin user (setup flow)
+ */
+export declare function createFirstAdminUser(db: IDatabaseClient, username: string, passwordHash: string, name?: string): Promise<AdminUser>;
+/**
+ * Find admin user by username
+ */
+export declare function findAdminUserByUsername(db: IDatabaseClient, username: string): Promise<AdminUser | null>;
+/**
+ * Find admin user by email (deprecated, use findAdminUserByUsername)
+ * @deprecated Use findAdminUserByUsername instead
+ */
+export declare function findAdminUserByEmail(db: IDatabaseClient, email: string): Promise<AdminUser | null>;
+/**
+ * Find admin user by ID
+ */
+export declare function findAdminUserById(db: IDatabaseClient, id: string): Promise<AdminUser | null>;
+/**
+ * Create admin session
+ */
+export declare function createAdminSession(db: IDatabaseClient, adminUserId: string, token: string, expiresInMs: number, userAgent: string | null, ipAddress: string | null): Promise<AdminSession>;
+/**
+ * Find session by token
+ */
+export declare function findAdminSessionByToken(db: IDatabaseClient, token: string): Promise<AdminSession | null>;
+/**
+ * Update session last accessed time
+ */
+export declare function updateSessionLastAccessed(db: IDatabaseClient, sessionId: string): Promise<void>;
+/**
+ * Delete session (logout)
+ */
+export declare function deleteAdminSession(db: IDatabaseClient, token: string): Promise<void>;
+/**
+ * Delete all sessions for a user
+ */
+export declare function deleteAllUserSessions(db: IDatabaseClient, adminUserId: string): Promise<number>;
+/**
+ * List all sessions for an admin user
+ */
+export declare function listAdminSessions(db: IDatabaseClient, adminUserId: string): Promise<AdminSession[]>;
+/**
+ * Clean up expired sessions
+ */
+export declare function cleanupExpiredSessions(db: IDatabaseClient): Promise<number>;
+/**
+ * Create admin user (requires existing admin)
+ */
+export declare function createAdminUser(db: IDatabaseClient, username: string, passwordHash: string, isSuperAdmin?: boolean): Promise<AdminUser>;
+/**
+ * List all admin users
+ */
+export declare function listAdminUsers(db: IDatabaseClient): Promise<Omit<AdminUser, "password_hash">[]>;
+/**
+ * Delete admin user
+ */
+export declare function deleteAdminUser(db: IDatabaseClient, id: string): Promise<void>;
+/**
+ * Update admin user
+ */
+export declare function updateAdminUser(db: IDatabaseClient, id: string, data: Partial<Pick<AdminUser, "name" | "avatar_url">>): Promise<void>;
+/**
+ * Create API key
+ */
+export declare function createApiKey(db: IDatabaseClient, name: string, createdByAdminId: string): Promise<ApiKey>;
+/**
+ * Find API key by key string
+ */
+export declare function findApiKeyByKey(db: IDatabaseClient, key: string): Promise<ApiKey | null>;
+/**
+ * Update API key last used time
+ */
+export declare function updateApiKeyLastUsed(db: IDatabaseClient, keyId: string): Promise<void>;
+/**
+ * List API keys
+ */
+export declare function listApiKeys(db: IDatabaseClient): Promise<Omit<ApiKey, "key">[]>;
+/**
+ * Revoke API key
+ */
+export declare function revokeApiKey(db: IDatabaseClient, id: string): Promise<void>;
+/**
+ * Delete API key permanently
+ */
+export declare function deleteApiKey(db: IDatabaseClient, id: string): Promise<void>;
+/**
+ * Create admin token (sat_ prefix)
+ */
+export declare function createAdminToken(db: IDatabaseClient, name: string, createdByAdminId: string, expiresInDays?: number | null): Promise<AdminToken>;
+/**
+ * Find admin token by token string
+ */
+export declare function findAdminTokenByToken(db: IDatabaseClient, token: string): Promise<AdminToken | null>;
+/**
+ * Update admin token last used time
+ */
+export declare function updateAdminTokenLastUsed(db: IDatabaseClient, tokenId: string): Promise<void>;
+/**
+ * List admin tokens (masked, excludes token value)
+ */
+export declare function listAdminTokens(db: IDatabaseClient): Promise<Omit<AdminToken, "token">[]>;
+/**
+ * Get admin token by ID with full token value (for copy functionality)
+ * Warning: Only use this when user explicitly requests to reveal the token
+ */
+export declare function getAdminTokenById(db: IDatabaseClient, id: string): Promise<AdminToken | null>;
+/**
+ * Revoke admin token
+ */
+export declare function revokeAdminToken(db: IDatabaseClient, id: string): Promise<void>;
+/**
+ * Delete admin token permanently
+ */
+export declare function deleteAdminToken(db: IDatabaseClient, id: string): Promise<void>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/admin/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/admin/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIrE,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AACrD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAGvD,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGtB,CAAC;AAEH,MAAM,WAAW,SAAU,SAAQ,QAAQ;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACtC,EAAE,EAAE,eAAe,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA4BpB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CACzC,EAAE,EAAE,eAAe,EACnB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAI3B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACnC,EAAE,EAAE,eAAe,EACnB,EAAE,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,YAAY,CAAC,CAyBvB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CACzC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC3C,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1F;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACvC,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACnC,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,YAAY,EAAE,CAAC,CAKzB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAIjF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACjC,EAAE,EAAE,eAAe,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,OAAe,GAC9B,OAAO,CAAC,SAAS,CAAC,CAyBpB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAChC,EAAE,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAM7C;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAapF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACjC,EAAE,EAAE,eAAe,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,YAAY,CAC9B,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM9F;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5F;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAMrF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAClC,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,EACxB,aAAa,GAAE,MAAM,GAAG,IAAW,GACpC,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACvC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsB5B;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC1C,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,eAAe,CACjC,EAAE,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAMtC;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,EAAE,EAAE,eAAe,EACnB,EAAE,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrF;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF"}