@discover-cloud/shared 1.2.9 → 1.4.0

package/dist/context/request-context.storage.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestContextProvider = exports.requestContextStorage = void 0;
+const async_hooks_1 = require("async_hooks");
+exports.requestContextStorage = new async_hooks_1.AsyncLocalStorage();
+class RequestContextProvider {
+    /**
+     * Retrieves the current context if it exists.
+     */
+    static get() {
+        return exports.requestContextStorage.getStore();
+    }
+    /**
+     * Retrieves the current context or throws an error.
+     * Use this in deeper repositories where context is strictly required.
+     */
+    static getOrThrow() {
+        const ctx = exports.requestContextStorage.getStore();
+        if (!ctx) {
+            throw new Error('AuditRequestContext is missing. Ensure the context middleware is active.');
+        }
+        return ctx;
+    }
+    /**
+     * Attaches the authenticated actor to the current request context.
+     */
+    static setActor(actor) {
+        const ctx = exports.requestContextStorage.getStore();
+        if (!ctx) {
+            // Fail-fast: If we reach the authentication layer but have no context,
+            // the middleware pipeline is fundamentally broken.
+            throw new Error('Cannot set actor: AuditRequestContext is not initialized.');
+        }
+        ctx.actor = actor;
+    }
+}
+exports.RequestContextProvider = RequestContextProvider;

package/dist/contracts/auth-service/account.dto.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file account.dto.ts
+ * @description Data transfer objects (DTOs) for account management resources.
+ * Public DTOs never expose credentials, hashes, or encrypted secrets.
+ */
+import { AccountStatus } from '../../enums';
+/** Public account representation. */
+export interface AccountDto {
+    id: string;
+    email: string;
+    isVerified: boolean;
+    status: AccountStatus;
+    lastLoginAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** OAuth provider identity metadata. */
+export interface OAuthIdentityDto {
+    id: string;
+    accountId: string;
+    provider: string;
+    providerId: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Standard action tracking and confirmation signature message payload. */
+export interface ActionResponseDto {
+    action: string;
+    message: string;
+}

package/dist/contracts/auth-service/account.dto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * @file account.dto.ts
+ * @description Data transfer objects (DTOs) for account management resources.
+ * Public DTOs never expose credentials, hashes, or encrypted secrets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/contracts/auth-service/auth.dto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file auth.dto.ts
+ * @description Data transfer objects (DTOs) for authentication resources.
+ * Public DTOs never expose credentials, hashes, or encrypted secrets.
+ *
+ * Refresh tokens are never returned in the public HTTP body.
+ * They are transported securely using HttpOnly cookies.
+ */
+/** Tokens returned upon successful authentication. */
+export interface AuthTokenDto {
+    accessToken: string;
+}
+/** Internal auth-service resolution block mapping backend tokens to transport layers. */
+export interface AuthSessionResultDto {
+    accessToken: string;
+    refreshToken: string;
+}
+/** Generic message response payload contract. */
+export interface MessageResponseDto {
+    message: string;
+}

package/dist/contracts/auth-service/auth.dto.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * @file auth.dto.ts
+ * @description Data transfer objects (DTOs) for authentication resources.
+ * Public DTOs never expose credentials, hashes, or encrypted secrets.
+ *
+ * Refresh tokens are never returned in the public HTTP body.
+ * They are transported securely using HttpOnly cookies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/contracts/index.d.ts

@@ -0,0 +1 @@
+export * from './visibility';

package/dist/{security → contracts}/index.js

@@ -14,4 +14,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./guard"), exports);
+__exportStar(require("./visibility"), exports);

package/dist/contracts/visibility.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @file visibility.ts
+ * @description Shared contracts for the Workspace-Centric Visibility Architecture.
+ *
+ * These are pure type definitions with no business logic.
+ * The VisibilityResolver lives in User Service behind the internal Visibility API.
+ * Insights Service repositories consume ResourceQueryScope, never VisibilityContext directly.
+ */
+/**
+ * Defines the resource-level filters that narrow which cloud resources
+ * belong to a workspace beyond just cloud account membership.
+ *
+ * All fields are optional — a null/empty ResourceFilter means no additional
+ * narrowing beyond cloud account membership.
+ */
+export interface ResourceFilter {
+    /** Match resources with these exact tag key-value pairs. */
+    tags?: Record<string, string>;
+    /** Restrict to these resource groups (Azure-specific). */
+    resourceGroups?: string[];
+    /** Restrict to these cloud provider regions. */
+    regions?: string[];
+    /** Restrict to these cloud service types (e.g. 'ec2', 's3', 'lambda'). */
+    services?: string[];
+}
+/**
+ * The resolved visibility boundary for a workspace.
+ * Produced by the User Service VisibilityResolver and returned by
+ * GET /internal/v1/workspaces/{workspaceId}/visibility.
+ *
+ * Must not be passed directly to repositories — application services
+ * must first map it to a ResourceQueryScope.
+ */
+export interface VisibilityContext {
+    /** The workspace this context belongs to. */
+    workspaceId: string;
+    /**
+     * Monotonically increasing version, incremented whenever
+     * WorkspaceCloudAccounts or resourceFilter changes.
+     * Used for cache validation.
+     */
+    version: number;
+    /** IDs of all cloud accounts this workspace is allowed to access. */
+    cloudAccountIds: string[];
+    /** Additional resource-level narrowing applied on top of account membership. */
+    resourceFilter: ResourceFilter;
+}
+/**
+ * Repository-specific query object derived from VisibilityContext.
+ * Application services transform VisibilityContext → ResourceQueryScope
+ * before passing it to repositories.
+ *
+ * Repositories must never receive VisibilityContext or call HTTP APIs.
+ * They only consume this scope object.
+ */
+export interface ResourceQueryScope {
+    /** The workspace whose data is being queried. */
+    workspaceId: string;
+    /** Cloud accounts whose data is visible in this scope. */
+    cloudAccountIds: string[];
+    /** Resource-level filter predicates. */
+    resourceFilter: ResourceFilter;
+}

package/dist/contracts/visibility.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * @file visibility.ts
+ * @description Shared contracts for the Workspace-Centric Visibility Architecture.
+ *
+ * These are pure type definitions with no business logic.
+ * The VisibilityResolver lives in User Service behind the internal Visibility API.
+ * Insights Service repositories consume ResourceQueryScope, never VisibilityContext directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/audit-service.types.d.ts

@@ -0,0 +1,42 @@
+export declare enum AuditActorType {
+    USER = "USER",
+    SERVICE = "SERVICE",
+    SYSTEM = "SYSTEM",
+    ANONYMOUS = "ANONYMOUS"
+}
+export declare enum AuditResourceType {
+    ACCOUNT = "ACCOUNT",
+    USER = "USER",
+    ORGANIZATION = "ORGANIZATION",
+    WORKSPACE = "WORKSPACE",
+    ROLE = "ROLE",
+    PERMISSION = "PERMISSION",
+    SERVICE_CLIENT = "SERVICE_CLIENT",
+    ALERT_RULE = "ALERT_RULE",
+    CLOUD_ACCOUNT = "CLOUD_ACCOUNT",
+    SYNC_JOB = "SYNC_JOB",
+    SYSTEM = "SYSTEM"
+}
+export declare enum AuditSeverity {
+    INFO = "info",
+    WARNING = "warning",
+    ERROR = "error",
+    CRITICAL = "critical"
+}
+export interface RecordAuditActionInput {
+    actorId?: string | null;
+    actorType?: AuditActorType;
+    action: string;
+    severity?: AuditSeverity;
+    resourceType: AuditResourceType;
+    resourceId?: string | null;
+    organizationId?: string | null;
+    workspaceId?: string | null;
+    /** For resources (like CloudAccount) owned by an org or personal workspace rather than a workspace directly. */
+    ownerId?: string | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    metadata?: Record<string, unknown>;
+    requestId?: string | null;
+    traceId?: string | null;
+}

package/dist/dtos/audit-service.types.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditSeverity = exports.AuditResourceType = exports.AuditActorType = void 0;
+var AuditActorType;
+(function (AuditActorType) {
+    AuditActorType["USER"] = "USER";
+    AuditActorType["SERVICE"] = "SERVICE";
+    AuditActorType["SYSTEM"] = "SYSTEM";
+    AuditActorType["ANONYMOUS"] = "ANONYMOUS";
+})(AuditActorType || (exports.AuditActorType = AuditActorType = {}));
+var AuditResourceType;
+(function (AuditResourceType) {
+    AuditResourceType["ACCOUNT"] = "ACCOUNT";
+    AuditResourceType["USER"] = "USER";
+    AuditResourceType["ORGANIZATION"] = "ORGANIZATION";
+    AuditResourceType["WORKSPACE"] = "WORKSPACE";
+    AuditResourceType["ROLE"] = "ROLE";
+    AuditResourceType["PERMISSION"] = "PERMISSION";
+    AuditResourceType["SERVICE_CLIENT"] = "SERVICE_CLIENT";
+    AuditResourceType["ALERT_RULE"] = "ALERT_RULE";
+    AuditResourceType["CLOUD_ACCOUNT"] = "CLOUD_ACCOUNT";
+    AuditResourceType["SYNC_JOB"] = "SYNC_JOB";
+    AuditResourceType["SYSTEM"] = "SYSTEM";
+})(AuditResourceType || (exports.AuditResourceType = AuditResourceType = {}));
+var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["INFO"] = "info";
+    AuditSeverity["WARNING"] = "warning";
+    AuditSeverity["ERROR"] = "error";
+    AuditSeverity["CRITICAL"] = "critical";
+})(AuditSeverity || (exports.AuditSeverity = AuditSeverity = {}));

package/dist/dtos/auth-service.dto.d.ts

@@ -1,31 +1,25 @@
-import { AccountStatus } from "../enums";
 /**
- * AUTH SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────
- * Internal data shapes produced by the auth service.
- *
- * SECURITY RULE: DTOs containing secrets (token, hash fields) must NEVER
- * be returned directly in HTTP responses. They exist so internal service
- * methods have typed return values — mappers are responsible for stripping
- * secrets before anything reaches the wire.
- *
- * Secret fields are annotated with  // SECRET — internal use only
- * to make accidental exposure visible at a glance during code review.
+ * @file account.dto.ts
+ * @description Transport-safe DTOs for Account domain entities.
  */
 export interface AccountDto {
     id: string;
     email: string;
     isVerified: boolean;
-    status: AccountStatus;
+    status: string;
+    mfaEnabled: boolean;
+    lastLoginAt: string | null;
     createdAt: string;
     updatedAt: string;
 }
-export interface EmailVerificationDto {
+export interface SessionDto {
     id: string;
     accountId: string;
-    token: string;
+    familyId: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    device: string | null;
     expiresAt: string;
-    isUsed: boolean;
     createdAt: string;
 }
 export interface OAuthIdentityDto {
@@ -34,24 +28,91 @@ export interface OAuthIdentityDto {
     provider: string;
     providerId: string;
     createdAt: string;
+}
+export interface ServiceClientDto {
+    id: string;
+    serviceId: string;
+    name: string;
+    scopes: string[];
+    status: string;
+    lastUsedAt: string | null;
+    rotatedAt: string | null;
+    expiresAt: string | null;
+    createdById: string | null;
+    createdAt: string;
     updatedAt: string;
 }
-export interface PasswordResetDto {
+export interface PlatformPermissionDto {
     id: string;
-    accountId: string;
-    token: string;
-    expiresAt: string;
-    isUsed: boolean;
+    key: string;
+    resource: string;
+    action: string;
+    category: string;
+    description: string | null;
+    serviceOwner: string | null;
+    dangerous: boolean;
     createdAt: string;
 }
-export interface SessionDto {
+export interface PlatformRoleDto {
+    id: string;
+    name: string;
+    type: string;
+    category: string;
+    isProtected: boolean;
+    createdById: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface PlatformRoleWithPermissionsDto extends PlatformRoleDto {
+    permissions: PlatformPermissionDto[];
+}
+export interface PlatformRoleAssignmentDto {
     id: string;
     accountId: string;
-    expiresAt: string;
+    roleId: string;
+    status: string;
+    assignedById: string | null;
+    revokedById: string | null;
     revokedAt: string | null;
-    ipAddress: string | null;
-    userAgent: string | null;
-    device: string | null;
+    role?: PlatformRoleDto;
     createdAt: string;
     updatedAt: string;
 }
+export interface AuthTokensDto {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+export interface LoginResponseDto {
+    tokens: AuthTokensDto;
+    account: AccountDto;
+    mfaRequired: false;
+}
+export interface MfaRequiredResponseDto {
+    mfaRequired: true;
+    mfaToken: string;
+}
+export type LoginOrMfaResponseDto = LoginResponseDto | MfaRequiredResponseDto;
+export interface MfaSetupDto {
+    secret: string;
+    otpauthUrl: string;
+    qrCodeDataUrl: string;
+}
+export interface MfaBackupCodesDto {
+    backupCodes: string[];
+}
+export interface AuthResponseDto {
+    tokens: AuthTokensDto;
+    account: AccountDto;
+}
+export interface PlatformPermissionCheckDto {
+    accountId: string;
+    permissionKey: string;
+}
+export interface PlatformPermissionCheckResultDto extends PlatformPermissionCheckDto {
+    granted: boolean;
+}
+export interface ServiceClientCreatedResponseDto {
+    client: ServiceClientDto;
+    secret: string;
+}

package/dist/dtos/auth-service.dto.js

@@ -1,2 +1,6 @@
 "use strict";
+/**
+ * @file account.dto.ts
+ * @description Transport-safe DTOs for Account domain entities.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/cloud-service.dto.d.ts

@@ -1,31 +1,18 @@
-import { CloudProvider, CloudAccountStatus, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from "../enums";
 /**
- * CLOUD SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────
- * Shapes produced and consumed by the cloud service.
- *
- * Date handling:
- *   JSON has no Date type. Domain models use Date internally; these DTOs
- *   are the serialised form at the HTTP boundary — all timestamps are ISO 8601 strings.
- *
- * Credential handling:
- *   CloudAccountDto intentionally omits encryptedCredentials — credentials
- *   are write-only. The connect DTOs accept credentials as `unknown` because
- *   the shape differs per provider and per authMethod; Zod schemas in the
- *   cloud service validate the concrete shape at runtime.
- *
- * SyncJobDto:
- *   Read-only. Sync jobs are created internally by the scheduler and exposed
- *   for status polling only — clients never POST a sync job directly.
- *
- * Provider push DTOs (CloudCostRecordDto, CloudResourceDto, CloudBudgetDto):
- *   Used when cloud-service pushes collected data to insights-service.
- *   They include cloudAccountId for scoping — insights-service uses this to
- *   associate records with the correct account without re-fetching.
+ * @file cloud-service.dto.ts
+ * @description Data transfer objects (DTOs) for cloud accounts,
+ * sync jobs, provider ingestion, and insights communication.
  */
+import { CloudProvider, CloudAccountStatus, CloudAccountOwnerType, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from '../enums';
+/** Public representation of a connected cloud account. */
 export interface CloudAccountDto {
     id: string;
-    userId: string;
+    /** Whether this account belongs to an Organization or a Personal Workspace. */
+    ownerType: CloudAccountOwnerType;
+    /** The ID of the owning entity (organizationId or workspaceId depending on ownerType). */
+    ownerId: string;
+    /** User who originally connected this account. */
+    createdBy: string;
     alias: string;
     provider: CloudProvider;
     status: CloudAccountStatus;
@@ -36,24 +23,25 @@ export interface CloudAccountDto {
     createdAt: string;
     updatedAt: string;
 }
-/** Credential payload for a new AWS cloud account connection. */
+/** Request payload to connect a new AWS account. */
 export interface ConnectAwsAccountDto {
     alias: string;
     authMethod: AwsAuthMethod;
     credentials: unknown;
 }
-/** Credential payload for a new GCP cloud account connection. */
+/** Request payload to connect a new GCP account. */
 export interface ConnectGcpAccountDto {
     alias: string;
     authMethod: GcpAuthMethod;
     credentials: unknown;
 }
-/** Credential payload for a new Azure cloud account connection. */
+/** Request payload to connect a new Azure account. */
 export interface ConnectAzureAccountDto {
     alias: string;
     authMethod: AzureAuthMethod;
     credentials: unknown;
 }
+/** Metadata tracking a single cloud synchronization job. */
 export interface SyncJobDto {
     id: string;
     cloudAccountId: string;
@@ -68,6 +56,42 @@ export interface SyncJobDto {
     createdAt: string;
     updatedAt: string;
 }
+/** Consolidated collection metrics normalized from a cloud provider. */
+export interface ProviderFetchResultDto {
+    costs: ProviderCostDto[];
+    resources: ProviderResourceDto[];
+    budgets: ProviderBudgetDto[];
+}
+/** Normalized cost record details fetched from a cloud provider. */
+export interface ProviderCostDto {
+    service: string;
+    region: string;
+    amount: number;
+    currency: string;
+    periodStart: string;
+    periodEnd: string;
+    usageType: string;
+}
+/** Normalized resource metadata details fetched from a cloud provider. */
+export interface ProviderResourceDto {
+    resourceType: string;
+    resourceId: string;
+    region: string;
+    name: string | null;
+    status: string;
+    tags: Record<string, string>;
+    metadata: Record<string, unknown>;
+}
+/** Normalized budget configuration fetched from a cloud provider. */
+export interface ProviderBudgetDto {
+    name: string;
+    limitAmount: number;
+    currency: string;
+    period: string;
+    actualSpend?: number;
+    forecastSpend?: number;
+}
+/** Enriched cost record details pushed to the insights service. */
 export interface CloudCostRecordDto {
     cloudAccountId: string;
     provider: CloudProvider;
@@ -79,6 +103,7 @@ export interface CloudCostRecordDto {
     periodEnd: string;
     usageType: string;
 }
+/** Enriched resource metadata details pushed to the insights service. */
 export interface CloudResourceDto {
     cloudAccountId: string;
     provider: CloudProvider;
@@ -90,6 +115,7 @@ export interface CloudResourceDto {
     tags: Record<string, string>;
     metadata: Record<string, unknown>;
 }
+/** Enriched budget configuration details pushed to the insights service. */
 export interface CloudBudgetDto {
     cloudAccountId: string;
     name: string;
@@ -99,3 +125,7 @@ export interface CloudBudgetDto {
     forecastSpend: number;
     period: string;
 }
+export interface BulkDeleteCloudAccountsResponseDto {
+    deletedCount: number;
+    skippedAccountIds: string[];
+}

package/dist/dtos/cloud-service.dto.js

@@ -1,2 +1,7 @@
 "use strict";
+/**
+ * @file cloud-service.dto.ts
+ * @description Data transfer objects (DTOs) for cloud accounts,
+ * sync jobs, provider ingestion, and insights communication.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/index.d.ts

@@ -1,5 +1,6 @@
-export * from "./user-service.dto";
-export * from "./auth-service.dto";
-export * from "./cloud-service.dto";
-export * from "./insights-service.dto";
-export * from "./response.dto";
+export * from './user-service.dto';
+export * from './auth-service.dto';
+export * from './cloud-service.dto';
+export * from './insights-service.dto';
+export * from './audit-service.types';
+export * from './response.dto';

package/dist/dtos/index.js

@@ -18,4 +18,5 @@ __exportStar(require("./user-service.dto"), exports);
 __exportStar(require("./auth-service.dto"), exports);
 __exportStar(require("./cloud-service.dto"), exports);
 __exportStar(require("./insights-service.dto"), exports);
+__exportStar(require("./audit-service.types"), exports);
 __exportStar(require("./response.dto"), exports);