@astralibx/staff-engine 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +168 -138
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.mts +231 -16
- package/dist/index.d.ts +231 -16
- package/dist/index.mjs +167 -139
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.d.mts
CHANGED
|
@@ -4,6 +4,7 @@ import { IStaff, IPermissionGroup, LogAdapter, IPermissionGroupCreateInput, IPer
|
|
|
4
4
|
export { DEFAULT_OPTIONS, ResolvedOptions, StaffEngineConfig } from '@astralibx/staff-types';
|
|
5
5
|
import { AlxError } from '@astralibx/core';
|
|
6
6
|
export { sendSuccess } from '@astralibx/core';
|
|
7
|
+
import { z } from 'zod';
|
|
7
8
|
|
|
8
9
|
interface IStaffDocument extends Omit<IStaff, '_id'>, Document {
|
|
9
10
|
_id: Types.ObjectId;
|
|
@@ -46,6 +47,35 @@ declare class PermissionService {
|
|
|
46
47
|
getAllPermissionKeys(): Promise<string[]>;
|
|
47
48
|
}
|
|
48
49
|
|
|
50
|
+
interface StaffServiceDeps {
|
|
51
|
+
Staff: Model<IStaffDocument>;
|
|
52
|
+
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
53
|
+
adapters: StaffAdapters;
|
|
54
|
+
hooks: StaffHooks;
|
|
55
|
+
permissionCache: PermissionCacheService;
|
|
56
|
+
logger: LogAdapter;
|
|
57
|
+
tenantId?: string;
|
|
58
|
+
requireEmailUniqueness: boolean;
|
|
59
|
+
}
|
|
60
|
+
declare class StaffService {
|
|
61
|
+
private Staff;
|
|
62
|
+
private PermissionGroup;
|
|
63
|
+
private adapters;
|
|
64
|
+
private hooks;
|
|
65
|
+
private permissionCache;
|
|
66
|
+
private logger;
|
|
67
|
+
private tenantId?;
|
|
68
|
+
private requireEmailUniqueness;
|
|
69
|
+
constructor(deps: StaffServiceDeps);
|
|
70
|
+
private get tenantFilter();
|
|
71
|
+
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
72
|
+
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
73
|
+
getById(staffId: string): Promise<IStaffDocument>;
|
|
74
|
+
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
75
|
+
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
76
|
+
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
77
|
+
}
|
|
78
|
+
|
|
49
79
|
declare class RateLimiterService {
|
|
50
80
|
private windowMs;
|
|
51
81
|
private maxAttempts;
|
|
@@ -67,36 +97,30 @@ declare class RateLimiterService {
|
|
|
67
97
|
private recordAttemptRedis;
|
|
68
98
|
}
|
|
69
99
|
|
|
70
|
-
interface
|
|
100
|
+
interface AuthServiceDeps {
|
|
71
101
|
Staff: Model<IStaffDocument>;
|
|
72
|
-
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
73
102
|
adapters: StaffAdapters;
|
|
74
103
|
hooks: StaffHooks;
|
|
75
|
-
permissionCache: PermissionCacheService;
|
|
76
104
|
rateLimiter: RateLimiterService;
|
|
77
105
|
logger: LogAdapter;
|
|
78
106
|
tenantId?: string;
|
|
79
107
|
jwtSecret: string;
|
|
80
108
|
staffTokenExpiry: string;
|
|
81
109
|
ownerTokenExpiry: string;
|
|
82
|
-
requireEmailUniqueness: boolean;
|
|
83
110
|
allowSelfPasswordChange: boolean;
|
|
84
111
|
}
|
|
85
|
-
declare class
|
|
112
|
+
declare class AuthService {
|
|
86
113
|
private Staff;
|
|
87
|
-
private PermissionGroup;
|
|
88
114
|
private adapters;
|
|
89
115
|
private hooks;
|
|
90
|
-
private permissionCache;
|
|
91
116
|
private rateLimiter;
|
|
92
117
|
private logger;
|
|
93
118
|
private tenantId?;
|
|
94
119
|
private jwtSecret;
|
|
95
120
|
private staffTokenExpiry;
|
|
96
121
|
private ownerTokenExpiry;
|
|
97
|
-
private requireEmailUniqueness;
|
|
98
122
|
private allowSelfPasswordChange;
|
|
99
|
-
constructor(deps:
|
|
123
|
+
constructor(deps: AuthServiceDeps);
|
|
100
124
|
private get tenantFilter();
|
|
101
125
|
private generateToken;
|
|
102
126
|
setupOwner(data: {
|
|
@@ -111,12 +135,6 @@ declare class StaffService {
|
|
|
111
135
|
staff: IStaffDocument;
|
|
112
136
|
token: string;
|
|
113
137
|
}>;
|
|
114
|
-
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
115
|
-
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
116
|
-
getById(staffId: string): Promise<IStaffDocument>;
|
|
117
|
-
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
118
|
-
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
119
|
-
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
120
138
|
resetPassword(staffId: string, newPassword: string): Promise<void>;
|
|
121
139
|
changeOwnPassword(staffId: string, oldPassword: string, newPassword: string): Promise<void>;
|
|
122
140
|
}
|
|
@@ -238,10 +256,206 @@ declare class InvalidConfigError extends AlxStaffError {
|
|
|
238
256
|
*/
|
|
239
257
|
declare function validatePermissionPairs(permissions: string[], allGroups: IPermissionGroupDocument[]): void;
|
|
240
258
|
|
|
259
|
+
declare const StaffEngineConfigSchema: z.ZodObject<{
|
|
260
|
+
db: z.ZodObject<{
|
|
261
|
+
connection: z.ZodEffects<z.ZodUnknown, {}, unknown>;
|
|
262
|
+
collectionPrefix: z.ZodOptional<z.ZodString>;
|
|
263
|
+
}, "strip", z.ZodTypeAny, {
|
|
264
|
+
connection: {};
|
|
265
|
+
collectionPrefix?: string | undefined;
|
|
266
|
+
}, {
|
|
267
|
+
connection?: unknown;
|
|
268
|
+
collectionPrefix?: string | undefined;
|
|
269
|
+
}>;
|
|
270
|
+
redis: z.ZodOptional<z.ZodObject<{
|
|
271
|
+
connection: z.ZodUnknown;
|
|
272
|
+
keyPrefix: z.ZodOptional<z.ZodString>;
|
|
273
|
+
}, "strip", z.ZodTypeAny, {
|
|
274
|
+
connection?: unknown;
|
|
275
|
+
keyPrefix?: string | undefined;
|
|
276
|
+
}, {
|
|
277
|
+
connection?: unknown;
|
|
278
|
+
keyPrefix?: string | undefined;
|
|
279
|
+
}>>;
|
|
280
|
+
logger: z.ZodOptional<z.ZodObject<{
|
|
281
|
+
info: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
282
|
+
warn: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
283
|
+
error: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
284
|
+
}, "strip", z.ZodTypeAny, {
|
|
285
|
+
info: (...args: unknown[]) => unknown;
|
|
286
|
+
warn: (...args: unknown[]) => unknown;
|
|
287
|
+
error: (...args: unknown[]) => unknown;
|
|
288
|
+
}, {
|
|
289
|
+
info: (...args: unknown[]) => unknown;
|
|
290
|
+
warn: (...args: unknown[]) => unknown;
|
|
291
|
+
error: (...args: unknown[]) => unknown;
|
|
292
|
+
}>>;
|
|
293
|
+
tenantId: z.ZodOptional<z.ZodString>;
|
|
294
|
+
auth: z.ZodObject<{
|
|
295
|
+
jwtSecret: z.ZodString;
|
|
296
|
+
staffTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
297
|
+
ownerTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
298
|
+
permissionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
|
|
299
|
+
}, "strip", z.ZodTypeAny, {
|
|
300
|
+
jwtSecret: string;
|
|
301
|
+
staffTokenExpiry?: string | undefined;
|
|
302
|
+
ownerTokenExpiry?: string | undefined;
|
|
303
|
+
permissionCacheTtlMs?: number | undefined;
|
|
304
|
+
}, {
|
|
305
|
+
jwtSecret: string;
|
|
306
|
+
staffTokenExpiry?: string | undefined;
|
|
307
|
+
ownerTokenExpiry?: string | undefined;
|
|
308
|
+
permissionCacheTtlMs?: number | undefined;
|
|
309
|
+
}>;
|
|
310
|
+
adapters: z.ZodObject<{
|
|
311
|
+
hashPassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
312
|
+
comparePassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
313
|
+
}, "strip", z.ZodTypeAny, {
|
|
314
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
315
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
316
|
+
}, {
|
|
317
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
318
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
319
|
+
}>;
|
|
320
|
+
hooks: z.ZodOptional<z.ZodObject<{
|
|
321
|
+
onStaffCreated: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
322
|
+
onLogin: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
323
|
+
onLoginFailed: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
324
|
+
onPermissionsChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
325
|
+
onStatusChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
326
|
+
onMetric: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
327
|
+
}, "strip", z.ZodTypeAny, {
|
|
328
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
329
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
330
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
331
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
332
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
333
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
334
|
+
}, {
|
|
335
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
336
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
337
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
338
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
339
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
340
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
341
|
+
}>>;
|
|
342
|
+
options: z.ZodOptional<z.ZodObject<{
|
|
343
|
+
requireEmailUniqueness: z.ZodOptional<z.ZodBoolean>;
|
|
344
|
+
allowSelfPasswordChange: z.ZodOptional<z.ZodBoolean>;
|
|
345
|
+
rateLimiter: z.ZodOptional<z.ZodObject<{
|
|
346
|
+
windowMs: z.ZodOptional<z.ZodNumber>;
|
|
347
|
+
maxAttempts: z.ZodOptional<z.ZodNumber>;
|
|
348
|
+
}, "strip", z.ZodTypeAny, {
|
|
349
|
+
windowMs?: number | undefined;
|
|
350
|
+
maxAttempts?: number | undefined;
|
|
351
|
+
}, {
|
|
352
|
+
windowMs?: number | undefined;
|
|
353
|
+
maxAttempts?: number | undefined;
|
|
354
|
+
}>>;
|
|
355
|
+
}, "strip", z.ZodTypeAny, {
|
|
356
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
357
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
358
|
+
rateLimiter?: {
|
|
359
|
+
windowMs?: number | undefined;
|
|
360
|
+
maxAttempts?: number | undefined;
|
|
361
|
+
} | undefined;
|
|
362
|
+
}, {
|
|
363
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
364
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
365
|
+
rateLimiter?: {
|
|
366
|
+
windowMs?: number | undefined;
|
|
367
|
+
maxAttempts?: number | undefined;
|
|
368
|
+
} | undefined;
|
|
369
|
+
}>>;
|
|
370
|
+
}, "strip", z.ZodTypeAny, {
|
|
371
|
+
db: {
|
|
372
|
+
connection: {};
|
|
373
|
+
collectionPrefix?: string | undefined;
|
|
374
|
+
};
|
|
375
|
+
auth: {
|
|
376
|
+
jwtSecret: string;
|
|
377
|
+
staffTokenExpiry?: string | undefined;
|
|
378
|
+
ownerTokenExpiry?: string | undefined;
|
|
379
|
+
permissionCacheTtlMs?: number | undefined;
|
|
380
|
+
};
|
|
381
|
+
adapters: {
|
|
382
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
383
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
384
|
+
};
|
|
385
|
+
tenantId?: string | undefined;
|
|
386
|
+
options?: {
|
|
387
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
388
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
389
|
+
rateLimiter?: {
|
|
390
|
+
windowMs?: number | undefined;
|
|
391
|
+
maxAttempts?: number | undefined;
|
|
392
|
+
} | undefined;
|
|
393
|
+
} | undefined;
|
|
394
|
+
redis?: {
|
|
395
|
+
connection?: unknown;
|
|
396
|
+
keyPrefix?: string | undefined;
|
|
397
|
+
} | undefined;
|
|
398
|
+
logger?: {
|
|
399
|
+
info: (...args: unknown[]) => unknown;
|
|
400
|
+
warn: (...args: unknown[]) => unknown;
|
|
401
|
+
error: (...args: unknown[]) => unknown;
|
|
402
|
+
} | undefined;
|
|
403
|
+
hooks?: {
|
|
404
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
405
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
406
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
407
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
408
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
409
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
410
|
+
} | undefined;
|
|
411
|
+
}, {
|
|
412
|
+
db: {
|
|
413
|
+
connection?: unknown;
|
|
414
|
+
collectionPrefix?: string | undefined;
|
|
415
|
+
};
|
|
416
|
+
auth: {
|
|
417
|
+
jwtSecret: string;
|
|
418
|
+
staffTokenExpiry?: string | undefined;
|
|
419
|
+
ownerTokenExpiry?: string | undefined;
|
|
420
|
+
permissionCacheTtlMs?: number | undefined;
|
|
421
|
+
};
|
|
422
|
+
adapters: {
|
|
423
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
424
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
425
|
+
};
|
|
426
|
+
tenantId?: string | undefined;
|
|
427
|
+
options?: {
|
|
428
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
429
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
430
|
+
rateLimiter?: {
|
|
431
|
+
windowMs?: number | undefined;
|
|
432
|
+
maxAttempts?: number | undefined;
|
|
433
|
+
} | undefined;
|
|
434
|
+
} | undefined;
|
|
435
|
+
redis?: {
|
|
436
|
+
connection?: unknown;
|
|
437
|
+
keyPrefix?: string | undefined;
|
|
438
|
+
} | undefined;
|
|
439
|
+
logger?: {
|
|
440
|
+
info: (...args: unknown[]) => unknown;
|
|
441
|
+
warn: (...args: unknown[]) => unknown;
|
|
442
|
+
error: (...args: unknown[]) => unknown;
|
|
443
|
+
} | undefined;
|
|
444
|
+
hooks?: {
|
|
445
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
446
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
447
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
448
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
449
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
450
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
451
|
+
} | undefined;
|
|
452
|
+
}>;
|
|
453
|
+
|
|
241
454
|
declare function handleStaffError(res: Response, error: unknown, logger: LogAdapter): void;
|
|
242
455
|
|
|
243
456
|
interface RouteServices {
|
|
244
457
|
staff: StaffService;
|
|
458
|
+
auth: AuthService;
|
|
245
459
|
permissions: PermissionService;
|
|
246
460
|
}
|
|
247
461
|
declare function createRoutes(services: RouteServices, auth: AuthMiddleware, logger: LogAdapter, allowSelfPasswordChange: boolean): Router;
|
|
@@ -250,6 +464,7 @@ interface StaffEngine {
|
|
|
250
464
|
routes: Router;
|
|
251
465
|
auth: AuthMiddleware;
|
|
252
466
|
staff: StaffService;
|
|
467
|
+
authService: AuthService;
|
|
253
468
|
permissions: PermissionService;
|
|
254
469
|
models: {
|
|
255
470
|
Staff: Model<IStaffDocument>;
|
|
@@ -259,4 +474,4 @@ interface StaffEngine {
|
|
|
259
474
|
}
|
|
260
475
|
declare function createStaffEngine(config: StaffEngineConfig): StaffEngine;
|
|
261
476
|
|
|
262
|
-
export { AlxStaffError, type AuthMiddleware, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
|
477
|
+
export { AlxStaffError, type AuthMiddleware, AuthService, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffEngineConfigSchema, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
package/dist/index.d.ts
CHANGED
|
@@ -4,6 +4,7 @@ import { IStaff, IPermissionGroup, LogAdapter, IPermissionGroupCreateInput, IPer
|
|
|
4
4
|
export { DEFAULT_OPTIONS, ResolvedOptions, StaffEngineConfig } from '@astralibx/staff-types';
|
|
5
5
|
import { AlxError } from '@astralibx/core';
|
|
6
6
|
export { sendSuccess } from '@astralibx/core';
|
|
7
|
+
import { z } from 'zod';
|
|
7
8
|
|
|
8
9
|
interface IStaffDocument extends Omit<IStaff, '_id'>, Document {
|
|
9
10
|
_id: Types.ObjectId;
|
|
@@ -46,6 +47,35 @@ declare class PermissionService {
|
|
|
46
47
|
getAllPermissionKeys(): Promise<string[]>;
|
|
47
48
|
}
|
|
48
49
|
|
|
50
|
+
interface StaffServiceDeps {
|
|
51
|
+
Staff: Model<IStaffDocument>;
|
|
52
|
+
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
53
|
+
adapters: StaffAdapters;
|
|
54
|
+
hooks: StaffHooks;
|
|
55
|
+
permissionCache: PermissionCacheService;
|
|
56
|
+
logger: LogAdapter;
|
|
57
|
+
tenantId?: string;
|
|
58
|
+
requireEmailUniqueness: boolean;
|
|
59
|
+
}
|
|
60
|
+
declare class StaffService {
|
|
61
|
+
private Staff;
|
|
62
|
+
private PermissionGroup;
|
|
63
|
+
private adapters;
|
|
64
|
+
private hooks;
|
|
65
|
+
private permissionCache;
|
|
66
|
+
private logger;
|
|
67
|
+
private tenantId?;
|
|
68
|
+
private requireEmailUniqueness;
|
|
69
|
+
constructor(deps: StaffServiceDeps);
|
|
70
|
+
private get tenantFilter();
|
|
71
|
+
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
72
|
+
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
73
|
+
getById(staffId: string): Promise<IStaffDocument>;
|
|
74
|
+
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
75
|
+
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
76
|
+
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
77
|
+
}
|
|
78
|
+
|
|
49
79
|
declare class RateLimiterService {
|
|
50
80
|
private windowMs;
|
|
51
81
|
private maxAttempts;
|
|
@@ -67,36 +97,30 @@ declare class RateLimiterService {
|
|
|
67
97
|
private recordAttemptRedis;
|
|
68
98
|
}
|
|
69
99
|
|
|
70
|
-
interface
|
|
100
|
+
interface AuthServiceDeps {
|
|
71
101
|
Staff: Model<IStaffDocument>;
|
|
72
|
-
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
73
102
|
adapters: StaffAdapters;
|
|
74
103
|
hooks: StaffHooks;
|
|
75
|
-
permissionCache: PermissionCacheService;
|
|
76
104
|
rateLimiter: RateLimiterService;
|
|
77
105
|
logger: LogAdapter;
|
|
78
106
|
tenantId?: string;
|
|
79
107
|
jwtSecret: string;
|
|
80
108
|
staffTokenExpiry: string;
|
|
81
109
|
ownerTokenExpiry: string;
|
|
82
|
-
requireEmailUniqueness: boolean;
|
|
83
110
|
allowSelfPasswordChange: boolean;
|
|
84
111
|
}
|
|
85
|
-
declare class
|
|
112
|
+
declare class AuthService {
|
|
86
113
|
private Staff;
|
|
87
|
-
private PermissionGroup;
|
|
88
114
|
private adapters;
|
|
89
115
|
private hooks;
|
|
90
|
-
private permissionCache;
|
|
91
116
|
private rateLimiter;
|
|
92
117
|
private logger;
|
|
93
118
|
private tenantId?;
|
|
94
119
|
private jwtSecret;
|
|
95
120
|
private staffTokenExpiry;
|
|
96
121
|
private ownerTokenExpiry;
|
|
97
|
-
private requireEmailUniqueness;
|
|
98
122
|
private allowSelfPasswordChange;
|
|
99
|
-
constructor(deps:
|
|
123
|
+
constructor(deps: AuthServiceDeps);
|
|
100
124
|
private get tenantFilter();
|
|
101
125
|
private generateToken;
|
|
102
126
|
setupOwner(data: {
|
|
@@ -111,12 +135,6 @@ declare class StaffService {
|
|
|
111
135
|
staff: IStaffDocument;
|
|
112
136
|
token: string;
|
|
113
137
|
}>;
|
|
114
|
-
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
115
|
-
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
116
|
-
getById(staffId: string): Promise<IStaffDocument>;
|
|
117
|
-
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
118
|
-
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
119
|
-
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
120
138
|
resetPassword(staffId: string, newPassword: string): Promise<void>;
|
|
121
139
|
changeOwnPassword(staffId: string, oldPassword: string, newPassword: string): Promise<void>;
|
|
122
140
|
}
|
|
@@ -238,10 +256,206 @@ declare class InvalidConfigError extends AlxStaffError {
|
|
|
238
256
|
*/
|
|
239
257
|
declare function validatePermissionPairs(permissions: string[], allGroups: IPermissionGroupDocument[]): void;
|
|
240
258
|
|
|
259
|
+
declare const StaffEngineConfigSchema: z.ZodObject<{
|
|
260
|
+
db: z.ZodObject<{
|
|
261
|
+
connection: z.ZodEffects<z.ZodUnknown, {}, unknown>;
|
|
262
|
+
collectionPrefix: z.ZodOptional<z.ZodString>;
|
|
263
|
+
}, "strip", z.ZodTypeAny, {
|
|
264
|
+
connection: {};
|
|
265
|
+
collectionPrefix?: string | undefined;
|
|
266
|
+
}, {
|
|
267
|
+
connection?: unknown;
|
|
268
|
+
collectionPrefix?: string | undefined;
|
|
269
|
+
}>;
|
|
270
|
+
redis: z.ZodOptional<z.ZodObject<{
|
|
271
|
+
connection: z.ZodUnknown;
|
|
272
|
+
keyPrefix: z.ZodOptional<z.ZodString>;
|
|
273
|
+
}, "strip", z.ZodTypeAny, {
|
|
274
|
+
connection?: unknown;
|
|
275
|
+
keyPrefix?: string | undefined;
|
|
276
|
+
}, {
|
|
277
|
+
connection?: unknown;
|
|
278
|
+
keyPrefix?: string | undefined;
|
|
279
|
+
}>>;
|
|
280
|
+
logger: z.ZodOptional<z.ZodObject<{
|
|
281
|
+
info: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
282
|
+
warn: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
283
|
+
error: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
284
|
+
}, "strip", z.ZodTypeAny, {
|
|
285
|
+
info: (...args: unknown[]) => unknown;
|
|
286
|
+
warn: (...args: unknown[]) => unknown;
|
|
287
|
+
error: (...args: unknown[]) => unknown;
|
|
288
|
+
}, {
|
|
289
|
+
info: (...args: unknown[]) => unknown;
|
|
290
|
+
warn: (...args: unknown[]) => unknown;
|
|
291
|
+
error: (...args: unknown[]) => unknown;
|
|
292
|
+
}>>;
|
|
293
|
+
tenantId: z.ZodOptional<z.ZodString>;
|
|
294
|
+
auth: z.ZodObject<{
|
|
295
|
+
jwtSecret: z.ZodString;
|
|
296
|
+
staffTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
297
|
+
ownerTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
298
|
+
permissionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
|
|
299
|
+
}, "strip", z.ZodTypeAny, {
|
|
300
|
+
jwtSecret: string;
|
|
301
|
+
staffTokenExpiry?: string | undefined;
|
|
302
|
+
ownerTokenExpiry?: string | undefined;
|
|
303
|
+
permissionCacheTtlMs?: number | undefined;
|
|
304
|
+
}, {
|
|
305
|
+
jwtSecret: string;
|
|
306
|
+
staffTokenExpiry?: string | undefined;
|
|
307
|
+
ownerTokenExpiry?: string | undefined;
|
|
308
|
+
permissionCacheTtlMs?: number | undefined;
|
|
309
|
+
}>;
|
|
310
|
+
adapters: z.ZodObject<{
|
|
311
|
+
hashPassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
312
|
+
comparePassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
313
|
+
}, "strip", z.ZodTypeAny, {
|
|
314
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
315
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
316
|
+
}, {
|
|
317
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
318
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
319
|
+
}>;
|
|
320
|
+
hooks: z.ZodOptional<z.ZodObject<{
|
|
321
|
+
onStaffCreated: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
322
|
+
onLogin: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
323
|
+
onLoginFailed: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
324
|
+
onPermissionsChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
325
|
+
onStatusChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
326
|
+
onMetric: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
327
|
+
}, "strip", z.ZodTypeAny, {
|
|
328
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
329
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
330
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
331
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
332
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
333
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
334
|
+
}, {
|
|
335
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
336
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
337
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
338
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
339
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
340
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
341
|
+
}>>;
|
|
342
|
+
options: z.ZodOptional<z.ZodObject<{
|
|
343
|
+
requireEmailUniqueness: z.ZodOptional<z.ZodBoolean>;
|
|
344
|
+
allowSelfPasswordChange: z.ZodOptional<z.ZodBoolean>;
|
|
345
|
+
rateLimiter: z.ZodOptional<z.ZodObject<{
|
|
346
|
+
windowMs: z.ZodOptional<z.ZodNumber>;
|
|
347
|
+
maxAttempts: z.ZodOptional<z.ZodNumber>;
|
|
348
|
+
}, "strip", z.ZodTypeAny, {
|
|
349
|
+
windowMs?: number | undefined;
|
|
350
|
+
maxAttempts?: number | undefined;
|
|
351
|
+
}, {
|
|
352
|
+
windowMs?: number | undefined;
|
|
353
|
+
maxAttempts?: number | undefined;
|
|
354
|
+
}>>;
|
|
355
|
+
}, "strip", z.ZodTypeAny, {
|
|
356
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
357
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
358
|
+
rateLimiter?: {
|
|
359
|
+
windowMs?: number | undefined;
|
|
360
|
+
maxAttempts?: number | undefined;
|
|
361
|
+
} | undefined;
|
|
362
|
+
}, {
|
|
363
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
364
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
365
|
+
rateLimiter?: {
|
|
366
|
+
windowMs?: number | undefined;
|
|
367
|
+
maxAttempts?: number | undefined;
|
|
368
|
+
} | undefined;
|
|
369
|
+
}>>;
|
|
370
|
+
}, "strip", z.ZodTypeAny, {
|
|
371
|
+
db: {
|
|
372
|
+
connection: {};
|
|
373
|
+
collectionPrefix?: string | undefined;
|
|
374
|
+
};
|
|
375
|
+
auth: {
|
|
376
|
+
jwtSecret: string;
|
|
377
|
+
staffTokenExpiry?: string | undefined;
|
|
378
|
+
ownerTokenExpiry?: string | undefined;
|
|
379
|
+
permissionCacheTtlMs?: number | undefined;
|
|
380
|
+
};
|
|
381
|
+
adapters: {
|
|
382
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
383
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
384
|
+
};
|
|
385
|
+
tenantId?: string | undefined;
|
|
386
|
+
options?: {
|
|
387
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
388
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
389
|
+
rateLimiter?: {
|
|
390
|
+
windowMs?: number | undefined;
|
|
391
|
+
maxAttempts?: number | undefined;
|
|
392
|
+
} | undefined;
|
|
393
|
+
} | undefined;
|
|
394
|
+
redis?: {
|
|
395
|
+
connection?: unknown;
|
|
396
|
+
keyPrefix?: string | undefined;
|
|
397
|
+
} | undefined;
|
|
398
|
+
logger?: {
|
|
399
|
+
info: (...args: unknown[]) => unknown;
|
|
400
|
+
warn: (...args: unknown[]) => unknown;
|
|
401
|
+
error: (...args: unknown[]) => unknown;
|
|
402
|
+
} | undefined;
|
|
403
|
+
hooks?: {
|
|
404
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
405
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
406
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
407
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
408
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
409
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
410
|
+
} | undefined;
|
|
411
|
+
}, {
|
|
412
|
+
db: {
|
|
413
|
+
connection?: unknown;
|
|
414
|
+
collectionPrefix?: string | undefined;
|
|
415
|
+
};
|
|
416
|
+
auth: {
|
|
417
|
+
jwtSecret: string;
|
|
418
|
+
staffTokenExpiry?: string | undefined;
|
|
419
|
+
ownerTokenExpiry?: string | undefined;
|
|
420
|
+
permissionCacheTtlMs?: number | undefined;
|
|
421
|
+
};
|
|
422
|
+
adapters: {
|
|
423
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
424
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
425
|
+
};
|
|
426
|
+
tenantId?: string | undefined;
|
|
427
|
+
options?: {
|
|
428
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
429
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
430
|
+
rateLimiter?: {
|
|
431
|
+
windowMs?: number | undefined;
|
|
432
|
+
maxAttempts?: number | undefined;
|
|
433
|
+
} | undefined;
|
|
434
|
+
} | undefined;
|
|
435
|
+
redis?: {
|
|
436
|
+
connection?: unknown;
|
|
437
|
+
keyPrefix?: string | undefined;
|
|
438
|
+
} | undefined;
|
|
439
|
+
logger?: {
|
|
440
|
+
info: (...args: unknown[]) => unknown;
|
|
441
|
+
warn: (...args: unknown[]) => unknown;
|
|
442
|
+
error: (...args: unknown[]) => unknown;
|
|
443
|
+
} | undefined;
|
|
444
|
+
hooks?: {
|
|
445
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
446
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
447
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
448
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
449
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
450
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
451
|
+
} | undefined;
|
|
452
|
+
}>;
|
|
453
|
+
|
|
241
454
|
declare function handleStaffError(res: Response, error: unknown, logger: LogAdapter): void;
|
|
242
455
|
|
|
243
456
|
interface RouteServices {
|
|
244
457
|
staff: StaffService;
|
|
458
|
+
auth: AuthService;
|
|
245
459
|
permissions: PermissionService;
|
|
246
460
|
}
|
|
247
461
|
declare function createRoutes(services: RouteServices, auth: AuthMiddleware, logger: LogAdapter, allowSelfPasswordChange: boolean): Router;
|
|
@@ -250,6 +464,7 @@ interface StaffEngine {
|
|
|
250
464
|
routes: Router;
|
|
251
465
|
auth: AuthMiddleware;
|
|
252
466
|
staff: StaffService;
|
|
467
|
+
authService: AuthService;
|
|
253
468
|
permissions: PermissionService;
|
|
254
469
|
models: {
|
|
255
470
|
Staff: Model<IStaffDocument>;
|
|
@@ -259,4 +474,4 @@ interface StaffEngine {
|
|
|
259
474
|
}
|
|
260
475
|
declare function createStaffEngine(config: StaffEngineConfig): StaffEngine;
|
|
261
476
|
|
|
262
|
-
export { AlxStaffError, type AuthMiddleware, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
|
477
|
+
export { AlxStaffError, type AuthMiddleware, AuthService, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffEngineConfigSchema, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|