@astralibx/staff-engine 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -0
- package/dist/index.cjs +170 -140
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.mts +234 -17
- package/dist/index.d.ts +234 -17
- package/dist/index.mjs +169 -141
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.d.mts
CHANGED
|
@@ -4,6 +4,7 @@ import { IStaff, IPermissionGroup, LogAdapter, IPermissionGroupCreateInput, IPer
|
|
|
4
4
|
export { DEFAULT_OPTIONS, ResolvedOptions, StaffEngineConfig } from '@astralibx/staff-types';
|
|
5
5
|
import { AlxError } from '@astralibx/core';
|
|
6
6
|
export { sendSuccess } from '@astralibx/core';
|
|
7
|
+
import { z } from 'zod';
|
|
7
8
|
|
|
8
9
|
interface IStaffDocument extends Omit<IStaff, '_id'>, Document {
|
|
9
10
|
_id: Types.ObjectId;
|
|
@@ -46,6 +47,35 @@ declare class PermissionService {
|
|
|
46
47
|
getAllPermissionKeys(): Promise<string[]>;
|
|
47
48
|
}
|
|
48
49
|
|
|
50
|
+
interface StaffServiceDeps {
|
|
51
|
+
Staff: Model<IStaffDocument>;
|
|
52
|
+
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
53
|
+
adapters: StaffAdapters;
|
|
54
|
+
hooks: StaffHooks;
|
|
55
|
+
permissionCache: PermissionCacheService;
|
|
56
|
+
logger: LogAdapter;
|
|
57
|
+
tenantId?: string;
|
|
58
|
+
requireEmailUniqueness: boolean;
|
|
59
|
+
}
|
|
60
|
+
declare class StaffService {
|
|
61
|
+
private Staff;
|
|
62
|
+
private PermissionGroup;
|
|
63
|
+
private adapters;
|
|
64
|
+
private hooks;
|
|
65
|
+
private permissionCache;
|
|
66
|
+
private logger;
|
|
67
|
+
private tenantId?;
|
|
68
|
+
private requireEmailUniqueness;
|
|
69
|
+
constructor(deps: StaffServiceDeps);
|
|
70
|
+
private get tenantFilter();
|
|
71
|
+
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
72
|
+
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
73
|
+
getById(staffId: string): Promise<IStaffDocument>;
|
|
74
|
+
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
75
|
+
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
76
|
+
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
77
|
+
}
|
|
78
|
+
|
|
49
79
|
declare class RateLimiterService {
|
|
50
80
|
private windowMs;
|
|
51
81
|
private maxAttempts;
|
|
@@ -67,38 +97,32 @@ declare class RateLimiterService {
|
|
|
67
97
|
private recordAttemptRedis;
|
|
68
98
|
}
|
|
69
99
|
|
|
70
|
-
interface
|
|
100
|
+
interface AuthServiceDeps {
|
|
71
101
|
Staff: Model<IStaffDocument>;
|
|
72
|
-
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
73
102
|
adapters: StaffAdapters;
|
|
74
103
|
hooks: StaffHooks;
|
|
75
|
-
permissionCache: PermissionCacheService;
|
|
76
104
|
rateLimiter: RateLimiterService;
|
|
77
105
|
logger: LogAdapter;
|
|
78
106
|
tenantId?: string;
|
|
79
107
|
jwtSecret: string;
|
|
80
108
|
staffTokenExpiry: string;
|
|
81
109
|
ownerTokenExpiry: string;
|
|
82
|
-
requireEmailUniqueness: boolean;
|
|
83
110
|
allowSelfPasswordChange: boolean;
|
|
84
111
|
}
|
|
85
|
-
declare class
|
|
112
|
+
declare class AuthService {
|
|
86
113
|
private Staff;
|
|
87
|
-
private PermissionGroup;
|
|
88
114
|
private adapters;
|
|
89
115
|
private hooks;
|
|
90
|
-
private permissionCache;
|
|
91
116
|
private rateLimiter;
|
|
92
117
|
private logger;
|
|
93
118
|
private tenantId?;
|
|
94
119
|
private jwtSecret;
|
|
95
120
|
private staffTokenExpiry;
|
|
96
121
|
private ownerTokenExpiry;
|
|
97
|
-
private requireEmailUniqueness;
|
|
98
122
|
private allowSelfPasswordChange;
|
|
99
|
-
constructor(deps:
|
|
123
|
+
constructor(deps: AuthServiceDeps);
|
|
100
124
|
private get tenantFilter();
|
|
101
|
-
|
|
125
|
+
generateToken(staffId: string, role: string): string;
|
|
102
126
|
setupOwner(data: {
|
|
103
127
|
name: string;
|
|
104
128
|
email: string;
|
|
@@ -111,18 +135,14 @@ declare class StaffService {
|
|
|
111
135
|
staff: IStaffDocument;
|
|
112
136
|
token: string;
|
|
113
137
|
}>;
|
|
114
|
-
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
115
|
-
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
116
|
-
getById(staffId: string): Promise<IStaffDocument>;
|
|
117
|
-
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
118
|
-
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
119
|
-
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
120
138
|
resetPassword(staffId: string, newPassword: string): Promise<void>;
|
|
121
139
|
changeOwnPassword(staffId: string, oldPassword: string, newPassword: string): Promise<void>;
|
|
122
140
|
}
|
|
123
141
|
|
|
124
142
|
interface StaffUser {
|
|
125
143
|
staffId: string;
|
|
144
|
+
name: string;
|
|
145
|
+
email: string;
|
|
126
146
|
role: string;
|
|
127
147
|
permissions: string[];
|
|
128
148
|
}
|
|
@@ -238,10 +258,206 @@ declare class InvalidConfigError extends AlxStaffError {
|
|
|
238
258
|
*/
|
|
239
259
|
declare function validatePermissionPairs(permissions: string[], allGroups: IPermissionGroupDocument[]): void;
|
|
240
260
|
|
|
261
|
+
declare const StaffEngineConfigSchema: z.ZodObject<{
|
|
262
|
+
db: z.ZodObject<{
|
|
263
|
+
connection: z.ZodEffects<z.ZodUnknown, {}, unknown>;
|
|
264
|
+
collectionPrefix: z.ZodOptional<z.ZodString>;
|
|
265
|
+
}, "strip", z.ZodTypeAny, {
|
|
266
|
+
connection: {};
|
|
267
|
+
collectionPrefix?: string | undefined;
|
|
268
|
+
}, {
|
|
269
|
+
connection?: unknown;
|
|
270
|
+
collectionPrefix?: string | undefined;
|
|
271
|
+
}>;
|
|
272
|
+
redis: z.ZodOptional<z.ZodObject<{
|
|
273
|
+
connection: z.ZodUnknown;
|
|
274
|
+
keyPrefix: z.ZodOptional<z.ZodString>;
|
|
275
|
+
}, "strip", z.ZodTypeAny, {
|
|
276
|
+
connection?: unknown;
|
|
277
|
+
keyPrefix?: string | undefined;
|
|
278
|
+
}, {
|
|
279
|
+
connection?: unknown;
|
|
280
|
+
keyPrefix?: string | undefined;
|
|
281
|
+
}>>;
|
|
282
|
+
logger: z.ZodOptional<z.ZodObject<{
|
|
283
|
+
info: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
284
|
+
warn: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
285
|
+
error: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
286
|
+
}, "strip", z.ZodTypeAny, {
|
|
287
|
+
info: (...args: unknown[]) => unknown;
|
|
288
|
+
warn: (...args: unknown[]) => unknown;
|
|
289
|
+
error: (...args: unknown[]) => unknown;
|
|
290
|
+
}, {
|
|
291
|
+
info: (...args: unknown[]) => unknown;
|
|
292
|
+
warn: (...args: unknown[]) => unknown;
|
|
293
|
+
error: (...args: unknown[]) => unknown;
|
|
294
|
+
}>>;
|
|
295
|
+
tenantId: z.ZodOptional<z.ZodString>;
|
|
296
|
+
auth: z.ZodObject<{
|
|
297
|
+
jwtSecret: z.ZodString;
|
|
298
|
+
staffTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
299
|
+
ownerTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
300
|
+
permissionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
|
|
301
|
+
}, "strip", z.ZodTypeAny, {
|
|
302
|
+
jwtSecret: string;
|
|
303
|
+
staffTokenExpiry?: string | undefined;
|
|
304
|
+
ownerTokenExpiry?: string | undefined;
|
|
305
|
+
permissionCacheTtlMs?: number | undefined;
|
|
306
|
+
}, {
|
|
307
|
+
jwtSecret: string;
|
|
308
|
+
staffTokenExpiry?: string | undefined;
|
|
309
|
+
ownerTokenExpiry?: string | undefined;
|
|
310
|
+
permissionCacheTtlMs?: number | undefined;
|
|
311
|
+
}>;
|
|
312
|
+
adapters: z.ZodObject<{
|
|
313
|
+
hashPassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
314
|
+
comparePassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
315
|
+
}, "strip", z.ZodTypeAny, {
|
|
316
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
317
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
318
|
+
}, {
|
|
319
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
320
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
321
|
+
}>;
|
|
322
|
+
hooks: z.ZodOptional<z.ZodObject<{
|
|
323
|
+
onStaffCreated: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
324
|
+
onLogin: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
325
|
+
onLoginFailed: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
326
|
+
onPermissionsChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
327
|
+
onStatusChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
328
|
+
onMetric: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
329
|
+
}, "strip", z.ZodTypeAny, {
|
|
330
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
331
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
332
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
333
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
334
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
335
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
336
|
+
}, {
|
|
337
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
338
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
339
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
340
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
341
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
342
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
343
|
+
}>>;
|
|
344
|
+
options: z.ZodOptional<z.ZodObject<{
|
|
345
|
+
requireEmailUniqueness: z.ZodOptional<z.ZodBoolean>;
|
|
346
|
+
allowSelfPasswordChange: z.ZodOptional<z.ZodBoolean>;
|
|
347
|
+
rateLimiter: z.ZodOptional<z.ZodObject<{
|
|
348
|
+
windowMs: z.ZodOptional<z.ZodNumber>;
|
|
349
|
+
maxAttempts: z.ZodOptional<z.ZodNumber>;
|
|
350
|
+
}, "strip", z.ZodTypeAny, {
|
|
351
|
+
windowMs?: number | undefined;
|
|
352
|
+
maxAttempts?: number | undefined;
|
|
353
|
+
}, {
|
|
354
|
+
windowMs?: number | undefined;
|
|
355
|
+
maxAttempts?: number | undefined;
|
|
356
|
+
}>>;
|
|
357
|
+
}, "strip", z.ZodTypeAny, {
|
|
358
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
359
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
360
|
+
rateLimiter?: {
|
|
361
|
+
windowMs?: number | undefined;
|
|
362
|
+
maxAttempts?: number | undefined;
|
|
363
|
+
} | undefined;
|
|
364
|
+
}, {
|
|
365
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
366
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
367
|
+
rateLimiter?: {
|
|
368
|
+
windowMs?: number | undefined;
|
|
369
|
+
maxAttempts?: number | undefined;
|
|
370
|
+
} | undefined;
|
|
371
|
+
}>>;
|
|
372
|
+
}, "strip", z.ZodTypeAny, {
|
|
373
|
+
db: {
|
|
374
|
+
connection: {};
|
|
375
|
+
collectionPrefix?: string | undefined;
|
|
376
|
+
};
|
|
377
|
+
auth: {
|
|
378
|
+
jwtSecret: string;
|
|
379
|
+
staffTokenExpiry?: string | undefined;
|
|
380
|
+
ownerTokenExpiry?: string | undefined;
|
|
381
|
+
permissionCacheTtlMs?: number | undefined;
|
|
382
|
+
};
|
|
383
|
+
adapters: {
|
|
384
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
385
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
386
|
+
};
|
|
387
|
+
tenantId?: string | undefined;
|
|
388
|
+
options?: {
|
|
389
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
390
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
391
|
+
rateLimiter?: {
|
|
392
|
+
windowMs?: number | undefined;
|
|
393
|
+
maxAttempts?: number | undefined;
|
|
394
|
+
} | undefined;
|
|
395
|
+
} | undefined;
|
|
396
|
+
redis?: {
|
|
397
|
+
connection?: unknown;
|
|
398
|
+
keyPrefix?: string | undefined;
|
|
399
|
+
} | undefined;
|
|
400
|
+
logger?: {
|
|
401
|
+
info: (...args: unknown[]) => unknown;
|
|
402
|
+
warn: (...args: unknown[]) => unknown;
|
|
403
|
+
error: (...args: unknown[]) => unknown;
|
|
404
|
+
} | undefined;
|
|
405
|
+
hooks?: {
|
|
406
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
407
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
408
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
409
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
410
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
411
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
412
|
+
} | undefined;
|
|
413
|
+
}, {
|
|
414
|
+
db: {
|
|
415
|
+
connection?: unknown;
|
|
416
|
+
collectionPrefix?: string | undefined;
|
|
417
|
+
};
|
|
418
|
+
auth: {
|
|
419
|
+
jwtSecret: string;
|
|
420
|
+
staffTokenExpiry?: string | undefined;
|
|
421
|
+
ownerTokenExpiry?: string | undefined;
|
|
422
|
+
permissionCacheTtlMs?: number | undefined;
|
|
423
|
+
};
|
|
424
|
+
adapters: {
|
|
425
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
426
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
427
|
+
};
|
|
428
|
+
tenantId?: string | undefined;
|
|
429
|
+
options?: {
|
|
430
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
431
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
432
|
+
rateLimiter?: {
|
|
433
|
+
windowMs?: number | undefined;
|
|
434
|
+
maxAttempts?: number | undefined;
|
|
435
|
+
} | undefined;
|
|
436
|
+
} | undefined;
|
|
437
|
+
redis?: {
|
|
438
|
+
connection?: unknown;
|
|
439
|
+
keyPrefix?: string | undefined;
|
|
440
|
+
} | undefined;
|
|
441
|
+
logger?: {
|
|
442
|
+
info: (...args: unknown[]) => unknown;
|
|
443
|
+
warn: (...args: unknown[]) => unknown;
|
|
444
|
+
error: (...args: unknown[]) => unknown;
|
|
445
|
+
} | undefined;
|
|
446
|
+
hooks?: {
|
|
447
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
448
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
449
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
450
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
451
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
452
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
453
|
+
} | undefined;
|
|
454
|
+
}>;
|
|
455
|
+
|
|
241
456
|
declare function handleStaffError(res: Response, error: unknown, logger: LogAdapter): void;
|
|
242
457
|
|
|
243
458
|
interface RouteServices {
|
|
244
459
|
staff: StaffService;
|
|
460
|
+
auth: AuthService;
|
|
245
461
|
permissions: PermissionService;
|
|
246
462
|
}
|
|
247
463
|
declare function createRoutes(services: RouteServices, auth: AuthMiddleware, logger: LogAdapter, allowSelfPasswordChange: boolean): Router;
|
|
@@ -250,6 +466,7 @@ interface StaffEngine {
|
|
|
250
466
|
routes: Router;
|
|
251
467
|
auth: AuthMiddleware;
|
|
252
468
|
staff: StaffService;
|
|
469
|
+
authService: AuthService;
|
|
253
470
|
permissions: PermissionService;
|
|
254
471
|
models: {
|
|
255
472
|
Staff: Model<IStaffDocument>;
|
|
@@ -259,4 +476,4 @@ interface StaffEngine {
|
|
|
259
476
|
}
|
|
260
477
|
declare function createStaffEngine(config: StaffEngineConfig): StaffEngine;
|
|
261
478
|
|
|
262
|
-
export { AlxStaffError, type AuthMiddleware, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
|
479
|
+
export { AlxStaffError, type AuthMiddleware, AuthService, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffEngineConfigSchema, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
package/dist/index.d.ts
CHANGED
|
@@ -4,6 +4,7 @@ import { IStaff, IPermissionGroup, LogAdapter, IPermissionGroupCreateInput, IPer
|
|
|
4
4
|
export { DEFAULT_OPTIONS, ResolvedOptions, StaffEngineConfig } from '@astralibx/staff-types';
|
|
5
5
|
import { AlxError } from '@astralibx/core';
|
|
6
6
|
export { sendSuccess } from '@astralibx/core';
|
|
7
|
+
import { z } from 'zod';
|
|
7
8
|
|
|
8
9
|
interface IStaffDocument extends Omit<IStaff, '_id'>, Document {
|
|
9
10
|
_id: Types.ObjectId;
|
|
@@ -46,6 +47,35 @@ declare class PermissionService {
|
|
|
46
47
|
getAllPermissionKeys(): Promise<string[]>;
|
|
47
48
|
}
|
|
48
49
|
|
|
50
|
+
interface StaffServiceDeps {
|
|
51
|
+
Staff: Model<IStaffDocument>;
|
|
52
|
+
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
53
|
+
adapters: StaffAdapters;
|
|
54
|
+
hooks: StaffHooks;
|
|
55
|
+
permissionCache: PermissionCacheService;
|
|
56
|
+
logger: LogAdapter;
|
|
57
|
+
tenantId?: string;
|
|
58
|
+
requireEmailUniqueness: boolean;
|
|
59
|
+
}
|
|
60
|
+
declare class StaffService {
|
|
61
|
+
private Staff;
|
|
62
|
+
private PermissionGroup;
|
|
63
|
+
private adapters;
|
|
64
|
+
private hooks;
|
|
65
|
+
private permissionCache;
|
|
66
|
+
private logger;
|
|
67
|
+
private tenantId?;
|
|
68
|
+
private requireEmailUniqueness;
|
|
69
|
+
constructor(deps: StaffServiceDeps);
|
|
70
|
+
private get tenantFilter();
|
|
71
|
+
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
72
|
+
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
73
|
+
getById(staffId: string): Promise<IStaffDocument>;
|
|
74
|
+
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
75
|
+
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
76
|
+
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
77
|
+
}
|
|
78
|
+
|
|
49
79
|
declare class RateLimiterService {
|
|
50
80
|
private windowMs;
|
|
51
81
|
private maxAttempts;
|
|
@@ -67,38 +97,32 @@ declare class RateLimiterService {
|
|
|
67
97
|
private recordAttemptRedis;
|
|
68
98
|
}
|
|
69
99
|
|
|
70
|
-
interface
|
|
100
|
+
interface AuthServiceDeps {
|
|
71
101
|
Staff: Model<IStaffDocument>;
|
|
72
|
-
PermissionGroup: Model<IPermissionGroupDocument>;
|
|
73
102
|
adapters: StaffAdapters;
|
|
74
103
|
hooks: StaffHooks;
|
|
75
|
-
permissionCache: PermissionCacheService;
|
|
76
104
|
rateLimiter: RateLimiterService;
|
|
77
105
|
logger: LogAdapter;
|
|
78
106
|
tenantId?: string;
|
|
79
107
|
jwtSecret: string;
|
|
80
108
|
staffTokenExpiry: string;
|
|
81
109
|
ownerTokenExpiry: string;
|
|
82
|
-
requireEmailUniqueness: boolean;
|
|
83
110
|
allowSelfPasswordChange: boolean;
|
|
84
111
|
}
|
|
85
|
-
declare class
|
|
112
|
+
declare class AuthService {
|
|
86
113
|
private Staff;
|
|
87
|
-
private PermissionGroup;
|
|
88
114
|
private adapters;
|
|
89
115
|
private hooks;
|
|
90
|
-
private permissionCache;
|
|
91
116
|
private rateLimiter;
|
|
92
117
|
private logger;
|
|
93
118
|
private tenantId?;
|
|
94
119
|
private jwtSecret;
|
|
95
120
|
private staffTokenExpiry;
|
|
96
121
|
private ownerTokenExpiry;
|
|
97
|
-
private requireEmailUniqueness;
|
|
98
122
|
private allowSelfPasswordChange;
|
|
99
|
-
constructor(deps:
|
|
123
|
+
constructor(deps: AuthServiceDeps);
|
|
100
124
|
private get tenantFilter();
|
|
101
|
-
|
|
125
|
+
generateToken(staffId: string, role: string): string;
|
|
102
126
|
setupOwner(data: {
|
|
103
127
|
name: string;
|
|
104
128
|
email: string;
|
|
@@ -111,18 +135,14 @@ declare class StaffService {
|
|
|
111
135
|
staff: IStaffDocument;
|
|
112
136
|
token: string;
|
|
113
137
|
}>;
|
|
114
|
-
create(data: IStaffCreateInput): Promise<IStaffDocument>;
|
|
115
|
-
list(filters?: IStaffListFilters): Promise<IPaginatedResult<IStaffDocument>>;
|
|
116
|
-
getById(staffId: string): Promise<IStaffDocument>;
|
|
117
|
-
update(staffId: string, data: IStaffUpdateInput): Promise<IStaffDocument>;
|
|
118
|
-
updatePermissions(staffId: string, permissions: string[]): Promise<IStaffDocument>;
|
|
119
|
-
updateStatus(staffId: string, status: string): Promise<IStaffDocument>;
|
|
120
138
|
resetPassword(staffId: string, newPassword: string): Promise<void>;
|
|
121
139
|
changeOwnPassword(staffId: string, oldPassword: string, newPassword: string): Promise<void>;
|
|
122
140
|
}
|
|
123
141
|
|
|
124
142
|
interface StaffUser {
|
|
125
143
|
staffId: string;
|
|
144
|
+
name: string;
|
|
145
|
+
email: string;
|
|
126
146
|
role: string;
|
|
127
147
|
permissions: string[];
|
|
128
148
|
}
|
|
@@ -238,10 +258,206 @@ declare class InvalidConfigError extends AlxStaffError {
|
|
|
238
258
|
*/
|
|
239
259
|
declare function validatePermissionPairs(permissions: string[], allGroups: IPermissionGroupDocument[]): void;
|
|
240
260
|
|
|
261
|
+
declare const StaffEngineConfigSchema: z.ZodObject<{
|
|
262
|
+
db: z.ZodObject<{
|
|
263
|
+
connection: z.ZodEffects<z.ZodUnknown, {}, unknown>;
|
|
264
|
+
collectionPrefix: z.ZodOptional<z.ZodString>;
|
|
265
|
+
}, "strip", z.ZodTypeAny, {
|
|
266
|
+
connection: {};
|
|
267
|
+
collectionPrefix?: string | undefined;
|
|
268
|
+
}, {
|
|
269
|
+
connection?: unknown;
|
|
270
|
+
collectionPrefix?: string | undefined;
|
|
271
|
+
}>;
|
|
272
|
+
redis: z.ZodOptional<z.ZodObject<{
|
|
273
|
+
connection: z.ZodUnknown;
|
|
274
|
+
keyPrefix: z.ZodOptional<z.ZodString>;
|
|
275
|
+
}, "strip", z.ZodTypeAny, {
|
|
276
|
+
connection?: unknown;
|
|
277
|
+
keyPrefix?: string | undefined;
|
|
278
|
+
}, {
|
|
279
|
+
connection?: unknown;
|
|
280
|
+
keyPrefix?: string | undefined;
|
|
281
|
+
}>>;
|
|
282
|
+
logger: z.ZodOptional<z.ZodObject<{
|
|
283
|
+
info: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
284
|
+
warn: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
285
|
+
error: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
286
|
+
}, "strip", z.ZodTypeAny, {
|
|
287
|
+
info: (...args: unknown[]) => unknown;
|
|
288
|
+
warn: (...args: unknown[]) => unknown;
|
|
289
|
+
error: (...args: unknown[]) => unknown;
|
|
290
|
+
}, {
|
|
291
|
+
info: (...args: unknown[]) => unknown;
|
|
292
|
+
warn: (...args: unknown[]) => unknown;
|
|
293
|
+
error: (...args: unknown[]) => unknown;
|
|
294
|
+
}>>;
|
|
295
|
+
tenantId: z.ZodOptional<z.ZodString>;
|
|
296
|
+
auth: z.ZodObject<{
|
|
297
|
+
jwtSecret: z.ZodString;
|
|
298
|
+
staffTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
299
|
+
ownerTokenExpiry: z.ZodOptional<z.ZodString>;
|
|
300
|
+
permissionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
|
|
301
|
+
}, "strip", z.ZodTypeAny, {
|
|
302
|
+
jwtSecret: string;
|
|
303
|
+
staffTokenExpiry?: string | undefined;
|
|
304
|
+
ownerTokenExpiry?: string | undefined;
|
|
305
|
+
permissionCacheTtlMs?: number | undefined;
|
|
306
|
+
}, {
|
|
307
|
+
jwtSecret: string;
|
|
308
|
+
staffTokenExpiry?: string | undefined;
|
|
309
|
+
ownerTokenExpiry?: string | undefined;
|
|
310
|
+
permissionCacheTtlMs?: number | undefined;
|
|
311
|
+
}>;
|
|
312
|
+
adapters: z.ZodObject<{
|
|
313
|
+
hashPassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
314
|
+
comparePassword: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>;
|
|
315
|
+
}, "strip", z.ZodTypeAny, {
|
|
316
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
317
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
318
|
+
}, {
|
|
319
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
320
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
321
|
+
}>;
|
|
322
|
+
hooks: z.ZodOptional<z.ZodObject<{
|
|
323
|
+
onStaffCreated: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
324
|
+
onLogin: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
325
|
+
onLoginFailed: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
326
|
+
onPermissionsChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
327
|
+
onStatusChanged: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
328
|
+
onMetric: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
|
|
329
|
+
}, "strip", z.ZodTypeAny, {
|
|
330
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
331
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
332
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
333
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
334
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
335
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
336
|
+
}, {
|
|
337
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
338
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
339
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
340
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
341
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
342
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
343
|
+
}>>;
|
|
344
|
+
options: z.ZodOptional<z.ZodObject<{
|
|
345
|
+
requireEmailUniqueness: z.ZodOptional<z.ZodBoolean>;
|
|
346
|
+
allowSelfPasswordChange: z.ZodOptional<z.ZodBoolean>;
|
|
347
|
+
rateLimiter: z.ZodOptional<z.ZodObject<{
|
|
348
|
+
windowMs: z.ZodOptional<z.ZodNumber>;
|
|
349
|
+
maxAttempts: z.ZodOptional<z.ZodNumber>;
|
|
350
|
+
}, "strip", z.ZodTypeAny, {
|
|
351
|
+
windowMs?: number | undefined;
|
|
352
|
+
maxAttempts?: number | undefined;
|
|
353
|
+
}, {
|
|
354
|
+
windowMs?: number | undefined;
|
|
355
|
+
maxAttempts?: number | undefined;
|
|
356
|
+
}>>;
|
|
357
|
+
}, "strip", z.ZodTypeAny, {
|
|
358
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
359
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
360
|
+
rateLimiter?: {
|
|
361
|
+
windowMs?: number | undefined;
|
|
362
|
+
maxAttempts?: number | undefined;
|
|
363
|
+
} | undefined;
|
|
364
|
+
}, {
|
|
365
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
366
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
367
|
+
rateLimiter?: {
|
|
368
|
+
windowMs?: number | undefined;
|
|
369
|
+
maxAttempts?: number | undefined;
|
|
370
|
+
} | undefined;
|
|
371
|
+
}>>;
|
|
372
|
+
}, "strip", z.ZodTypeAny, {
|
|
373
|
+
db: {
|
|
374
|
+
connection: {};
|
|
375
|
+
collectionPrefix?: string | undefined;
|
|
376
|
+
};
|
|
377
|
+
auth: {
|
|
378
|
+
jwtSecret: string;
|
|
379
|
+
staffTokenExpiry?: string | undefined;
|
|
380
|
+
ownerTokenExpiry?: string | undefined;
|
|
381
|
+
permissionCacheTtlMs?: number | undefined;
|
|
382
|
+
};
|
|
383
|
+
adapters: {
|
|
384
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
385
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
386
|
+
};
|
|
387
|
+
tenantId?: string | undefined;
|
|
388
|
+
options?: {
|
|
389
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
390
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
391
|
+
rateLimiter?: {
|
|
392
|
+
windowMs?: number | undefined;
|
|
393
|
+
maxAttempts?: number | undefined;
|
|
394
|
+
} | undefined;
|
|
395
|
+
} | undefined;
|
|
396
|
+
redis?: {
|
|
397
|
+
connection?: unknown;
|
|
398
|
+
keyPrefix?: string | undefined;
|
|
399
|
+
} | undefined;
|
|
400
|
+
logger?: {
|
|
401
|
+
info: (...args: unknown[]) => unknown;
|
|
402
|
+
warn: (...args: unknown[]) => unknown;
|
|
403
|
+
error: (...args: unknown[]) => unknown;
|
|
404
|
+
} | undefined;
|
|
405
|
+
hooks?: {
|
|
406
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
407
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
408
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
409
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
410
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
411
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
412
|
+
} | undefined;
|
|
413
|
+
}, {
|
|
414
|
+
db: {
|
|
415
|
+
connection?: unknown;
|
|
416
|
+
collectionPrefix?: string | undefined;
|
|
417
|
+
};
|
|
418
|
+
auth: {
|
|
419
|
+
jwtSecret: string;
|
|
420
|
+
staffTokenExpiry?: string | undefined;
|
|
421
|
+
ownerTokenExpiry?: string | undefined;
|
|
422
|
+
permissionCacheTtlMs?: number | undefined;
|
|
423
|
+
};
|
|
424
|
+
adapters: {
|
|
425
|
+
hashPassword: (...args: unknown[]) => unknown;
|
|
426
|
+
comparePassword: (...args: unknown[]) => unknown;
|
|
427
|
+
};
|
|
428
|
+
tenantId?: string | undefined;
|
|
429
|
+
options?: {
|
|
430
|
+
requireEmailUniqueness?: boolean | undefined;
|
|
431
|
+
allowSelfPasswordChange?: boolean | undefined;
|
|
432
|
+
rateLimiter?: {
|
|
433
|
+
windowMs?: number | undefined;
|
|
434
|
+
maxAttempts?: number | undefined;
|
|
435
|
+
} | undefined;
|
|
436
|
+
} | undefined;
|
|
437
|
+
redis?: {
|
|
438
|
+
connection?: unknown;
|
|
439
|
+
keyPrefix?: string | undefined;
|
|
440
|
+
} | undefined;
|
|
441
|
+
logger?: {
|
|
442
|
+
info: (...args: unknown[]) => unknown;
|
|
443
|
+
warn: (...args: unknown[]) => unknown;
|
|
444
|
+
error: (...args: unknown[]) => unknown;
|
|
445
|
+
} | undefined;
|
|
446
|
+
hooks?: {
|
|
447
|
+
onStaffCreated?: ((...args: unknown[]) => unknown) | undefined;
|
|
448
|
+
onLogin?: ((...args: unknown[]) => unknown) | undefined;
|
|
449
|
+
onLoginFailed?: ((...args: unknown[]) => unknown) | undefined;
|
|
450
|
+
onPermissionsChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
451
|
+
onStatusChanged?: ((...args: unknown[]) => unknown) | undefined;
|
|
452
|
+
onMetric?: ((...args: unknown[]) => unknown) | undefined;
|
|
453
|
+
} | undefined;
|
|
454
|
+
}>;
|
|
455
|
+
|
|
241
456
|
declare function handleStaffError(res: Response, error: unknown, logger: LogAdapter): void;
|
|
242
457
|
|
|
243
458
|
interface RouteServices {
|
|
244
459
|
staff: StaffService;
|
|
460
|
+
auth: AuthService;
|
|
245
461
|
permissions: PermissionService;
|
|
246
462
|
}
|
|
247
463
|
declare function createRoutes(services: RouteServices, auth: AuthMiddleware, logger: LogAdapter, allowSelfPasswordChange: boolean): Router;
|
|
@@ -250,6 +466,7 @@ interface StaffEngine {
|
|
|
250
466
|
routes: Router;
|
|
251
467
|
auth: AuthMiddleware;
|
|
252
468
|
staff: StaffService;
|
|
469
|
+
authService: AuthService;
|
|
253
470
|
permissions: PermissionService;
|
|
254
471
|
models: {
|
|
255
472
|
Staff: Model<IStaffDocument>;
|
|
@@ -259,4 +476,4 @@ interface StaffEngine {
|
|
|
259
476
|
}
|
|
260
477
|
declare function createStaffEngine(config: StaffEngineConfig): StaffEngine;
|
|
261
478
|
|
|
262
|
-
export { AlxStaffError, type AuthMiddleware, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|
|
479
|
+
export { AlxStaffError, type AuthMiddleware, AuthService, type AuthenticatedRequest, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, type ErrorCode, GroupNotFoundError, type IPermissionGroupDocument, type IStaffDocument, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, type StaffEngine, StaffEngineConfigSchema, StaffNotFoundError, StaffService, type StaffUser, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
|