@digitaldefiance/node-express-suite 1.0.23 → 1.0.25

package/src/interfaces/environment.ts

@@ -1,181 +0,0 @@
-import { SecureBuffer, SecureString } from '@digitaldefiance/ecies-lib';
-import { Timezone } from '@digitaldefiance/i18n-lib';
-import { Types } from 'mongoose';
-import { BackupCode } from '../backup-code';
-import { IMongoEnvironment } from './environment-mongo';
-
-export interface IEnvironment {
-  /**
-   * Whether to use a memory database for local development (eg with MongoMemoryServer)
-   * If set, this will create a new in-memory database instance on application start with the given database name
-   */
-  devDatabase?: string;
-  /**
-   * Whether to print certain console debug messages
-   */
-  debug: boolean;
-  /**
-   * Whether to enable super verbose debug messags
-   */
-  detailedDebug: boolean;
-  /**
-   * The host name of the server
-   */
-  host: string;
-  /**
-   * The port the server is running on
-   */
-  port: number;
-  /**
-   * The base path of the server
-   */
-  basePath: string;
-  /**
-   * The URL of the server
-   */
-  serverUrl: string;
-  /**
-   * The secret used to sign JWTs
-   */
-  jwtSecret: string;
-  /**
-   * The email address to send notifications from
-   */
-  emailSender: string;
-  /**
-   * API distribution directory
-   */
-  apiDistDir: string;
-  /**
-   * react dist dir
-   */
-  reactDistDir: string;
-  /**
-   * The directory and root filename to store HTTPS development certificates
-   */
-  httpsDevCertRoot?: string;
-  /**
-   * The port to use for HTTPS development certificates
-   */
-  httpsDevPort: number;
-  /**
-   * Disable email sending
-   */
-  disableEmailSend: boolean;
-  /**
-   * MongoDB configuration
-   */
-  mongo: IMongoEnvironment;
-  /**
-   * Mnemonic for the admin user
-   */
-  adminMnemonic?: SecureString;
-  /**
-   * The ID of the admin user
-   */
-  adminId?: Types.ObjectId;
-  /**
-   * The creation date of the admin user
-   */
-  adminCreatedAt?: Date;
-  /**
-   * The password of the admin user
-   */
-  adminPassword?: SecureString;
-  /**
-   * The ID of the admin user role object
-   */
-  adminRoleId?: Types.ObjectId;
-  /**
-   * The ID of the admin user's user role object
-   */
-  adminUserRoleId?: Types.ObjectId;
-  /**
-   * Backup codes for the admin user
-   */
-  adminBackupCodes?: BackupCode[];
-  /**
-   * Mnemonic for the member user
-   */
-  memberMnemonic?: SecureString;
-  /**
-   * The ID of the member user
-   */
-  memberId?: Types.ObjectId;
-  /**
-   * The creation date of the member user
-   */
-  memberCreatedAt?: Date;
-  /**
-   * The password of the member user
-   */
-  memberPassword?: SecureString;
-  /**
-   * The ID of the member user role object
-   */
-  memberRoleId?: Types.ObjectId;
-  /**
-   * The ID of the member user's user role object
-   */
-  memberUserRoleId?: Types.ObjectId;
-  /**
-   * Backup codes for the member user
-   */
-  memberBackupCodes?: BackupCode[];
-  /**
-   * Mnemonic for the system user
-   */
-  systemMnemonic?: SecureString;
-  /**
-   * The ID of the system user
-   */
-  systemId?: Types.ObjectId;
-  /**
-   * The creation date of the system user
-   */
-  systemCreatedAt?: Date;
-  /**
-   * The public key of the system user
-   */
-  systemPublicKeyHex?: string;
-  /**
-   * The password of the system user
-   */
-  systemPassword?: SecureString;
-  /**
-   * The ID of the system user role object
-   */
-  systemRoleId?: Types.ObjectId;
-  /**
-   * The ID of the system user's user role object
-   */
-  systemUserRoleId?: Types.ObjectId;
-  /**
-   * Backup codes for the system user
-   */
-  systemBackupCodes?: BackupCode[];
-  /**
-   * HMAC secret for mnemonic encryption
-   */
-  mnemonicHmacSecret: SecureBuffer;
-  /**
-   * Encryption key for mnemonics
-   */
-  mnemonicEncryptionKey: SecureBuffer;
-  /**
-   * The timezone for the server
-   */
-  timezone: Timezone;
-  /**
-   * The default language for the admin interface/CLI
-   */
-  adminLanguage: string;
-  /**
-   * The number of PBKDF2 iterations for key wrapping
-   */
-  pbkdf2Iterations: number;
-  /**
-   * Whether this is a production environment
-   */
-  production: boolean;
-}

package/src/interfaces/failable-result.ts

@@ -1,6 +0,0 @@
-export interface IFailableResult<T> {
-  success: boolean;
-  data?: T;
-  message?: string;
-  error?: string | Error;
-}

package/src/interfaces/fec-consts.ts

@@ -1,4 +0,0 @@
-export interface IFECConsts {
-  /** Maximum size of a single shard */
-  MAX_SHARD_SIZE: number;
-}

package/src/interfaces/handleable-error-options.ts

@@ -1,6 +0,0 @@
-export interface HandleableErrorOptions {
-  cause?: Error;
-  handled?: boolean;
-  statusCode?: number;
-  sourceData?: unknown;
-}

package/src/interfaces/jwt-consts.ts

@@ -1,23 +0,0 @@
-export interface IJwtConsts {
-  /**
-   * Algorithm to use for JWT
-   */
-  ALGORITHM:
-    | 'HS256'
-    | 'HS384'
-    | 'HS512'
-    | 'RS256'
-    | 'RS384'
-    | 'RS512'
-    | 'ES256'
-    | 'ES384'
-    | 'ES512'
-    | 'PS256'
-    | 'PS384'
-    | 'PS512';
-
-  /**
-   * The expiration time for a JWT token in seconds
-   */
-  EXPIRATION_SEC: number;
-}

package/src/interfaces/jwt-sign-response.ts

@@ -1,19 +0,0 @@
-import {
-  ITokenRole,
-  ITokenRoleDTO,
-  ITokenUser,
-} from '@digitaldefiance/suite-core-lib';
-import { Types } from 'mongoose';
-
-export interface IJwtSignResponse<
-  I = Types.ObjectId,
-  D extends Date = Date,
-  TTokenRole extends ITokenRole<I, D> = ITokenRole<I, D>,
-> {
-  token: string;
-  tokenUser: ITokenUser;
-  roleNames: string[];
-  roleTranslatedNames: string[];
-  roles: TTokenRole[];
-  roleDTOs: ITokenRoleDTO[];
-}

package/src/interfaces/mongo-errors.ts

@@ -1,5 +0,0 @@
-import { Error } from 'mongoose';
-
-export interface IMongoErrors {
-  [key: string]: Error.ValidatorError | Error.CastError;
-}

package/src/interfaces/request-user.ts

@@ -1,50 +0,0 @@
-import { IRoleDTO, IRoleFrontendObject } from '@digitaldefiance/suite-core-lib';
-import { Types } from 'mongoose';
-import { IRoleBackendObject } from './backend-objects/role';
-
-/**
- * Interface for the user object stored in the request object
- * This is not used for mongoose but for request handling
- */
-export interface IRequestUser<
-  I extends Types.ObjectId | string = string,
-  R extends
-    | Array<IRoleDTO>
-    | Array<IRoleFrontendObject>
-    | Array<IRoleBackendObject> = Array<IRoleDTO>,
-  S extends string = string,
-  D extends Date | string = string,
-> {
-  /**
-   * The ID of the user
-   */
-  id: I;
-  /**
-   * The roles associated with the user
-   */
-  roles: R;
-  /**
-   * The username of the user
-   */
-  username: string;
-  /**
-   * The email address of the user
-   */
-  email: string;
-  /**
-   * The timezone of the user
-   */
-  timezone: string;
-  /**
-   * The language of the user
-   */
-  siteLanguage: S;
-  /**
-   * The date the user last logged in
-   */
-  lastLogin?: D;
-  /**
-   * Whether the user has verified their email address
-   */
-  emailVerified: boolean;
-}

package/src/interfaces/required-string-keys.ts

@@ -1,26 +0,0 @@
-/**
- * Base interface defining the minimum required string keys that must be implemented
- * by any application using this library
- */
-export interface RequiredStringKeys {
-  Common_UnexpectedError: string;
-  Error_EngineAlreadySet: string;
-  Error_EngineNotSet: string;
-  Error_LengthExceedsMaximum: string;
-  Error_LengthIsInvalidType: string;
-  // Validation errors
-  ValidationError: string;
-  Validation_MissingValidatedData: string;
-  Validation_MissingValidatedDataForField: string;
-
-  // Admin/system messages
-  Admin_NoMongoDbClientFoundFallingBack: string;
-  Admin_TransactionFailedTransientTemplate: string;
-  Admin_TransactionTimeoutTemplate: string;
-}
-
-/**
- * Type constraint to ensure user's string key enum extends the required keys
- */
-export type ExtendedStringKeys<T extends string> =
-  T extends keyof RequiredStringKeys ? T : T | keyof RequiredStringKeys;

package/src/interfaces/schema.ts

@@ -1,31 +0,0 @@
-import { Model, Schema } from 'mongoose';
-import { IBaseDocument } from '../documents/base';
-import { IDiscriminatorCollections } from '../interfaces/discriminator-collections';
-
-/**
- * Interface for each schema in the schema map
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export interface ISchema<T extends IBaseDocument<any>> {
-  /**
-   * The name of the collection, eg 'models'
-   */
-  collection: string;
-  /**
-   * The model for the schema
-   */
-
-  model: Model<T>;
-  /**
-   * The name of the model, eg 'Model'
-   */
-  modelName: string;
-  /**
-   * The schema for the model
-   */
-  schema: Schema;
-  /**
-   * Discriminators for the model
-   */
-  discriminators?: IDiscriminatorCollections<T>;
-}

package/src/interfaces/server-init-result.ts

@@ -1,37 +0,0 @@
-import { Member } from '@digitaldefiance/node-ecies-lib';
-import { IRoleDocument } from '../documents/role';
-import { IUserDocument } from '../documents/user';
-import { IUserRoleDocument } from '../documents/user-role';
-
-// Re-export essential document types
-export type { IRoleDocument, IUserDocument, IUserRoleDocument };
-
-export interface IServerInitResult {
-  adminRole: IRoleDocument;
-  adminUser: IUserDocument;
-  adminUsername: string;
-  adminEmail: string;
-  adminMnemonic: string;
-  adminPassword: string;
-  adminBackupCodes: Array<string>;
-  adminMember: Member;
-  adminUserRole: IUserRoleDocument;
-  memberRole: IRoleDocument;
-  memberUser: IUserDocument;
-  memberUsername: string;
-  memberEmail: string;
-  memberMnemonic: string;
-  memberPassword: string;
-  memberBackupCodes: Array<string>;
-  memberMember: Member;
-  memberUserRole: IUserRoleDocument;
-  systemRole: IRoleDocument;
-  systemUser: IUserDocument;
-  systemUsername: string;
-  systemEmail: string;
-  systemMnemonic: string;
-  systemPassword: string;
-  systemBackupCodes: Array<string>;
-  systemMember: Member;
-  systemUserRole: IUserRoleDocument;
-}

package/src/interfaces/status-code-response.ts

@@ -1,7 +0,0 @@
-import { ApiResponse } from '../types';
-
-export interface IStatusCodeResponse<T extends ApiResponse> {
-  statusCode: number;
-  response: T;
-  headers?: Record<string, string>;
-}

package/src/interfaces/symmetric-encryption-results.ts

@@ -1,4 +0,0 @@
-export interface ISymmetricEncryptionResults {
-  encryptedData: Buffer;
-  key: Buffer;
-}

package/src/middlewares/authenticate-crypto.ts

@@ -1,243 +0,0 @@
-import { IECIESConfig, SecureString } from '@digitaldefiance/ecies-lib';
-import {
-  Member as BackendMember,
-  ECIESService,
-} from '@digitaldefiance/node-ecies-lib';
-import {
-  AccountStatus,
-  getSuiteCoreTranslation,
-  InvalidCredentialsError,
-  SuiteCoreStringKey,
-} from '@digitaldefiance/suite-core-lib';
-import { NextFunction, Request, Response } from 'express';
-import { ClientSession, Types } from 'mongoose';
-import { IUserDocument } from '../documents/user';
-import { BaseModelName } from '../enumerations';
-import { InvalidPasswordError } from '../errors';
-import { IApplication } from '../interfaces/application';
-import { emailServiceRegistry } from '../registry';
-import { BackupCodeService } from '../services/backup-code';
-import { KeyWrappingService } from '../services/key-wrapping';
-import { RoleService } from '../services/role';
-import { UserService } from '../services/user';
-import { withTransaction } from '../utils';
-import { IBaseDocument } from '../documents';
-import { Environment } from '../environment';
-import { IConstants } from '../interfaces';
-
-/**
- * Middleware to authenticate crypto operations requiring private key access
- * Expects mnemonic or password in request body for fresh authentication
- */
-export async function authenticateCrypto<
-  TAccountStatus extends string = AccountStatus,
->(
-  application: IApplication<any, Types.ObjectId, IBaseDocument<any, Types.ObjectId>, Environment, IConstants>,
-  req: Request,
-  res: Response,
-  next: NextFunction,
-  activeStatusValue: TAccountStatus = AccountStatus.Active as TAccountStatus,
-): Promise<Response | void> {
-  if (!req.user) {
-    return res
-      .status(401)
-      .send(
-        // amazonq-ignore-next-line false positive, hardcoded string
-        getSuiteCoreTranslation(SuiteCoreStringKey.Validation_InvalidToken),
-      );
-  }
-
-  // Try validatedBody first (if validation has run), then fall back to raw body
-  // Note: This middleware runs BEFORE validation, so validatedBody may not exist yet
-  const validatedBody = (req as Request & { validatedBody?: unknown })
-    .validatedBody as Record<string, unknown> | undefined;
-  const rawBody = req.body as Record<string, unknown> | undefined;
-  const sourceBody = validatedBody ?? rawBody;
-
-  if (!sourceBody) {
-    return res.status(400).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-      ),
-    });
-  }
-
-  const mnemonic =
-    typeof sourceBody['mnemonic'] === 'string'
-      ? (sourceBody['mnemonic'] as string)
-      : undefined;
-  const password =
-    // amazonq-ignore-next-line false positive
-    typeof sourceBody['password'] === 'string'
-      ? (sourceBody['password'] as string)
-      : undefined;
-  if (!mnemonic && !password) {
-    return res.status(400).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-      ),
-    });
-  }
-  const UserModel = application.getModel<IUserDocument<string>>(
-    BaseModelName.User,
-  );
-  const config: IECIESConfig = {
-    curveName: application.constants.ECIES.CURVE_NAME,
-    primaryKeyDerivationPath:
-      application.constants.ECIES.PRIMARY_KEY_DERIVATION_PATH,
-    mnemonicStrength: application.constants.ECIES.MNEMONIC_STRENGTH,
-    symmetricAlgorithm:
-      application.constants.ECIES.SYMMETRIC_ALGORITHM_CONFIGURATION,
-    symmetricKeyBits: application.constants.ECIES.SYMMETRIC.KEY_BITS,
-    symmetricKeyMode: application.constants.ECIES.SYMMETRIC.MODE,
-  };
-  const keyWrappingService = new KeyWrappingService();
-
-  const roleService = new RoleService(application);
-  const userService = new UserService(
-    application,
-    roleService,
-    emailServiceRegistry.getService(),
-    keyWrappingService,
-    new BackupCodeService(
-      application,
-      new ECIESService(config),
-      keyWrappingService,
-      roleService,
-    ),
-  );
-
-  try {
-    return await withTransaction<Response | void>(
-      application.db.connection,
-      application.environment.mongo.useTransactions,
-      undefined,
-      async (sess: ClientSession | undefined) => {
-        const userDoc = await UserModel.findById(req.user!.id)
-          .session(sess ?? null)
-          .exec();
-
-        if (!userDoc || userDoc.accountStatus !== activeStatusValue) {
-          return (
-            res
-              .status(403)
-              .send(
-                // amazonq-ignore-next-line false positive, hardcoded string
-                getSuiteCoreTranslation(
-                  SuiteCoreStringKey.Validation_UserNotFound,
-                ),
-              )
-          );
-        }
-
-        // Ensure we're only authenticating the currently logged-in user
-        if (userDoc._id.toString() !== req.user!.id) {
-          return (
-            res
-              .status(403)
-              .send(
-                // amazonq-ignore-next-line false positive, hardcoded string
-                getSuiteCoreTranslation(
-                  SuiteCoreStringKey.Validation_InvalidCredentials,
-                ),
-              )
-          );
-        }
-
-        let loginResult: {
-          userDoc: IUserDocument;
-          userMember: BackendMember;
-          adminMember: BackendMember;
-        };
-
-        if (mnemonic) {
-          // Authenticate with mnemonic
-          const userMnemonic = new SecureString(mnemonic);
-          try {
-            loginResult = await userService.loginWithMnemonic(
-              userDoc.email,
-              userMnemonic,
-              sess,
-            );
-          } finally {
-            userMnemonic.dispose();
-          }
-        } else if (password) {
-          // Authenticate with password
-          loginResult = await userService.loginWithPassword(
-            userDoc.email,
-            password,
-            sess,
-          );
-        } else {
-          // Should not happen due to earlier guard; keeps TypeScript happy
-          return res.status(400).send({
-            // amazonq-ignore-next-line false positive, hardcoded string
-            message: getSuiteCoreTranslation(
-              SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-            ),
-          });
-        }
-
-        // Double-check authenticated user matches logged-in user
-        if (loginResult.userDoc._id.toString() !== req.user!.id) {
-          return (
-            res
-              .status(403)
-              .send(
-                // amazonq-ignore-next-line false positive, hardcoded string
-                getSuiteCoreTranslation(
-                  SuiteCoreStringKey.Validation_InvalidCredentials,
-                ),
-              )
-          );
-        }
-
-        // Attach the fully authenticated member (with private key) to the request
-        req.eciesUser = loginResult.userMember;
-        // Do not attach the admin user to the request; it's a process-wide singleton
-        // and must not be disposed as part of request cleanup.
-
-        next();
-        return;
-      },
-      {
-        timeoutMs: application.environment.mongo.transactionTimeout,
-      },
-    );
-  } catch (err) {
-    if (
-      err instanceof InvalidCredentialsError ||
-      err instanceof InvalidPasswordError
-    ) {
-      // amazonq-ignore-next-line false positive
-      console.error(
-        'Crypto authentication failed:',
-        `userId=${String(req.user?.id || 'unknown').replace(
-          /[\r\n]/g,
-          '',
-        )} hasPassword=${!!password} hasMnemonic=${!!mnemonic}`,
-      );
-      return res.status(401).send({
-        // amazonq-ignore-next-line false positive, hardcoded string
-        message: getSuiteCoreTranslation(
-          SuiteCoreStringKey.Validation_InvalidCredentials,
-        ),
-      });
-    }
-    const sanitizedErr =
-      err instanceof Error
-        ? err.message.replace(/[\r\n]/g, ' ')
-        : String(err).replace(/[\r\n]/g, ' ');
-    console.error('Unexpected error in authenticateCrypto:', sanitizedErr);
-    return res.status(500).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Common_UnexpectedError,
-      ),
-      error: err,
-    });
-  }
-}