@discover-cloud/shared 1.3.0 → 1.5.0

package/dist/authorization/index.d.ts

@@ -1,2 +1,2 @@
-export * from "./permission-cache.service";
-export * from "./permission-checker";
+export * from './permission-cache.service';
+export * from './permission-checker';

package/dist/authorization/permission-cache.service.js

@@ -8,10 +8,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PermissionCacheService = void 0;
 const redis_1 = require("redis");
+const env_util_1 = require("../utils/env.util");
 const CACHE_TTL_SECONDS = 24 * 60 * 60; // 24 hours
-const PLATFORM_PREFIX = "perms:platform";
-const ORG_PREFIX = "perms:org";
-const WORKSPACE_PREFIX = "perms:workspace";
+const PLATFORM_PREFIX = 'perms:platform';
+const ORG_PREFIX = 'perms:org';
+const WORKSPACE_PREFIX = 'perms:workspace';
 /**
  * Redis-backed permission cache.
  *
@@ -33,19 +34,19 @@ class PermissionCacheService {
      */
     constructor() {
         this.client = (0, redis_1.createClient)({
-            url: process.env["REDIS_URL"] ?? "redis://localhost:6379",
+            url: (0, env_util_1.getEnv)('REDIS_URL'),
         });
-        this.client.on("error", (err) => {
-            console.error("[PermissionCache] Redis error", err);
+        this.client.on('error', (err) => {
+            console.error('[PermissionCache] Redis error', err);
         });
-        this.client.on("ready", () => {
-            console.info("[PermissionCache] Redis ready");
+        this.client.on('ready', () => {
+            console.info('[PermissionCache] Redis ready');
         });
-        this.client.on("reconnecting", () => {
-            console.warn("[PermissionCache] Redis reconnecting...");
+        this.client.on('reconnecting', () => {
+            console.warn('[PermissionCache] Redis reconnecting...');
         });
         this.client.connect().catch((err) => {
-            console.error("[PermissionCache] Redis connection failed", err);
+            console.error('[PermissionCache] Redis connection failed', err);
         });
     }
     /* ---------------------------------------------------------------------------
@@ -61,6 +62,9 @@ class PermissionCacheService {
     async resolvePlatformPermissions(accountId, resolver) {
         return this.resolve(this.platformKey(accountId), resolver);
     }
+    /* --------------------------------------------------------------------------
+     resolveOrganizationPermissions
+  -------------------------------------------------------------------------- */
     /**
      * Resolves organization-scoped permissions.
      *
@@ -72,6 +76,9 @@ class PermissionCacheService {
     async resolveOrganizationPermissions(userId, organizationId, resolver) {
         return this.resolve(this.organizationKey(userId, organizationId), resolver);
     }
+    /* --------------------------------------------------------------------------
+     resolveWorkspacePermissions
+  -------------------------------------------------------------------------- */
     /**
      * Resolves workspace-scoped permissions.
      *
@@ -94,6 +101,9 @@ class PermissionCacheService {
     async invalidatePlatform(accountId) {
         await this.delete(this.platformKey(accountId));
     }
+    /* --------------------------------------------------------------------------
+     invalidateOrganization
+  -------------------------------------------------------------------------- */
     /**
      * Invalidates organization permission cache.
      *
@@ -103,6 +113,9 @@ class PermissionCacheService {
     async invalidateOrganization(userId, organizationId) {
         await this.delete(this.organizationKey(userId, organizationId));
     }
+    /* --------------------------------------------------------------------------
+     invalidateWorkspace
+  -------------------------------------------------------------------------- */
     /**
      * Invalidates workspace permission cache.
      *
@@ -112,6 +125,9 @@ class PermissionCacheService {
     async invalidateWorkspace(userId, workspaceId) {
         await this.delete(this.workspaceKey(userId, workspaceId));
     }
+    /* --------------------------------------------------------------------------
+     disconnect
+  -------------------------------------------------------------------------- */
     /**
      * Gracefully closes Redis connection.
      */

package/dist/context/index.d.ts

@@ -0,0 +1 @@
+export * from './request-context.storage';

package/dist/context/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./request-context.storage"), exports);

package/dist/context/request-context.storage.d.ts

@@ -0,0 +1,21 @@
+import { AsyncLocalStorage } from 'async_hooks';
+import { RequestMetadataContext, UserContext, MachineContext } from '../types';
+export type AuditRequestContext = RequestMetadataContext & {
+    actor?: UserContext | MachineContext;
+};
+export declare const requestContextStorage: AsyncLocalStorage<AuditRequestContext>;
+export declare class RequestContextProvider {
+    /**
+     * Retrieves the current context if it exists.
+     */
+    static get(): AuditRequestContext | undefined;
+    /**
+     * Retrieves the current context or throws an error.
+     * Use this in deeper repositories where context is strictly required.
+     */
+    static getOrThrow(): AuditRequestContext;
+    /**
+     * Attaches the authenticated actor to the current request context.
+     */
+    static setActor(actor: UserContext | MachineContext): void;
+}

package/dist/context/request-context.storage.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestContextProvider = exports.requestContextStorage = void 0;
+const async_hooks_1 = require("async_hooks");
+exports.requestContextStorage = new async_hooks_1.AsyncLocalStorage();
+class RequestContextProvider {
+    /**
+     * Retrieves the current context if it exists.
+     */
+    static get() {
+        return exports.requestContextStorage.getStore();
+    }
+    /**
+     * Retrieves the current context or throws an error.
+     * Use this in deeper repositories where context is strictly required.
+     */
+    static getOrThrow() {
+        const ctx = exports.requestContextStorage.getStore();
+        if (!ctx) {
+            throw new Error('AuditRequestContext is missing. Ensure the context middleware is active.');
+        }
+        return ctx;
+    }
+    /**
+     * Attaches the authenticated actor to the current request context.
+     */
+    static setActor(actor) {
+        const ctx = exports.requestContextStorage.getStore();
+        if (!ctx) {
+            // Fail-fast: If we reach the authentication layer but have no context,
+            // the middleware pipeline is fundamentally broken.
+            throw new Error('Cannot set actor: AuditRequestContext is not initialized.');
+        }
+        ctx.actor = actor;
+    }
+}
+exports.RequestContextProvider = RequestContextProvider;

package/dist/contracts/auth-service/account.dto.d.ts

@@ -3,7 +3,7 @@
  * @description Data transfer objects (DTOs) for account management resources.
  * Public DTOs never expose credentials, hashes, or encrypted secrets.
  */
-import { AccountStatus } from "../../enums";
+import { AccountStatus } from '../../enums';
 /** Public account representation. */
 export interface AccountDto {
     id: string;

package/dist/contracts/index.d.ts

@@ -0,0 +1 @@
+export * from './visibility';

package/dist/contracts/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./visibility"), exports);

package/dist/contracts/visibility.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @file visibility.ts
+ * @description Shared contracts for the Workspace-Centric Visibility Architecture.
+ *
+ * These are pure type definitions with no business logic.
+ * The VisibilityResolver lives in User Service behind the internal Visibility API.
+ * Insights Service repositories consume ResourceQueryScope, never VisibilityContext directly.
+ */
+/**
+ * Defines the resource-level filters that narrow which cloud resources
+ * belong to a workspace beyond just cloud account membership.
+ *
+ * All fields are optional — a null/empty ResourceFilter means no additional
+ * narrowing beyond cloud account membership.
+ */
+export interface ResourceFilter {
+    /** Match resources with these exact tag key-value pairs. */
+    tags?: Record<string, string>;
+    /** Restrict to these resource groups (Azure-specific). */
+    resourceGroups?: string[];
+    /** Restrict to these cloud provider regions. */
+    regions?: string[];
+    /** Restrict to these cloud service types (e.g. 'ec2', 's3', 'lambda'). */
+    services?: string[];
+}
+/**
+ * The resolved visibility boundary for a workspace.
+ * Produced by the User Service VisibilityResolver and returned by
+ * GET /internal/v1/workspaces/{workspaceId}/visibility.
+ *
+ * Must not be passed directly to repositories — application services
+ * must first map it to a ResourceQueryScope.
+ */
+export interface VisibilityContext {
+    /** The workspace this context belongs to. */
+    workspaceId: string;
+    /**
+     * Monotonically increasing version, incremented whenever
+     * WorkspaceCloudAccounts or resourceFilter changes.
+     * Used for cache validation.
+     */
+    version: number;
+    /** IDs of all cloud accounts this workspace is allowed to access. */
+    cloudAccountIds: string[];
+    /** Additional resource-level narrowing applied on top of account membership. */
+    resourceFilter: ResourceFilter;
+}
+/**
+ * Repository-specific query object derived from VisibilityContext.
+ * Application services transform VisibilityContext → ResourceQueryScope
+ * before passing it to repositories.
+ *
+ * Repositories must never receive VisibilityContext or call HTTP APIs.
+ * They only consume this scope object.
+ */
+export interface ResourceQueryScope {
+    /** The workspace whose data is being queried. */
+    workspaceId: string;
+    /** Cloud accounts whose data is visible in this scope. */
+    cloudAccountIds: string[];
+    /** Resource-level filter predicates. */
+    resourceFilter: ResourceFilter;
+}

package/dist/contracts/visibility.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * @file visibility.ts
+ * @description Shared contracts for the Workspace-Centric Visibility Architecture.
+ *
+ * These are pure type definitions with no business logic.
+ * The VisibilityResolver lives in User Service behind the internal Visibility API.
+ * Insights Service repositories consume ResourceQueryScope, never VisibilityContext directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/audit-service.types.d.ts

@@ -0,0 +1,42 @@
+export declare enum AuditActorType {
+    USER = "USER",
+    SERVICE = "SERVICE",
+    SYSTEM = "SYSTEM",
+    ANONYMOUS = "ANONYMOUS"
+}
+export declare enum AuditResourceType {
+    ACCOUNT = "ACCOUNT",
+    USER = "USER",
+    ORGANIZATION = "ORGANIZATION",
+    WORKSPACE = "WORKSPACE",
+    ROLE = "ROLE",
+    PERMISSION = "PERMISSION",
+    SERVICE_CLIENT = "SERVICE_CLIENT",
+    ALERT_RULE = "ALERT_RULE",
+    CLOUD_ACCOUNT = "CLOUD_ACCOUNT",
+    SYNC_JOB = "SYNC_JOB",
+    SYSTEM = "SYSTEM"
+}
+export declare enum AuditSeverity {
+    INFO = "info",
+    WARNING = "warning",
+    ERROR = "error",
+    CRITICAL = "critical"
+}
+export interface RecordAuditActionInput {
+    actorId?: string | null;
+    actorType?: AuditActorType;
+    action: string;
+    severity?: AuditSeverity;
+    resourceType: AuditResourceType;
+    resourceId?: string | null;
+    organizationId?: string | null;
+    workspaceId?: string | null;
+    /** For resources (like CloudAccount) owned by an org or personal workspace rather than a workspace directly. */
+    ownerId?: string | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    metadata?: Record<string, unknown>;
+    requestId?: string | null;
+    traceId?: string | null;
+}

package/dist/dtos/audit-service.types.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditSeverity = exports.AuditResourceType = exports.AuditActorType = void 0;
+var AuditActorType;
+(function (AuditActorType) {
+    AuditActorType["USER"] = "USER";
+    AuditActorType["SERVICE"] = "SERVICE";
+    AuditActorType["SYSTEM"] = "SYSTEM";
+    AuditActorType["ANONYMOUS"] = "ANONYMOUS";
+})(AuditActorType || (exports.AuditActorType = AuditActorType = {}));
+var AuditResourceType;
+(function (AuditResourceType) {
+    AuditResourceType["ACCOUNT"] = "ACCOUNT";
+    AuditResourceType["USER"] = "USER";
+    AuditResourceType["ORGANIZATION"] = "ORGANIZATION";
+    AuditResourceType["WORKSPACE"] = "WORKSPACE";
+    AuditResourceType["ROLE"] = "ROLE";
+    AuditResourceType["PERMISSION"] = "PERMISSION";
+    AuditResourceType["SERVICE_CLIENT"] = "SERVICE_CLIENT";
+    AuditResourceType["ALERT_RULE"] = "ALERT_RULE";
+    AuditResourceType["CLOUD_ACCOUNT"] = "CLOUD_ACCOUNT";
+    AuditResourceType["SYNC_JOB"] = "SYNC_JOB";
+    AuditResourceType["SYSTEM"] = "SYSTEM";
+})(AuditResourceType || (exports.AuditResourceType = AuditResourceType = {}));
+var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["INFO"] = "info";
+    AuditSeverity["WARNING"] = "warning";
+    AuditSeverity["ERROR"] = "error";
+    AuditSeverity["CRITICAL"] = "critical";
+})(AuditSeverity || (exports.AuditSeverity = AuditSeverity = {}));

package/dist/dtos/auth-service.dto.d.ts

@@ -34,7 +34,7 @@ export interface ServiceClientDto {
     serviceId: string;
     name: string;
     scopes: string[];
-    isActive: boolean;
+    status: string;
     lastUsedAt: string | null;
     rotatedAt: string | null;
     expiresAt: string | null;
@@ -101,3 +101,18 @@ export interface MfaSetupDto {
 export interface MfaBackupCodesDto {
     backupCodes: string[];
 }
+export interface AuthResponseDto {
+    tokens: AuthTokensDto;
+    account: AccountDto;
+}
+export interface PlatformPermissionCheckDto {
+    accountId: string;
+    permissionKey: string;
+}
+export interface PlatformPermissionCheckResultDto extends PlatformPermissionCheckDto {
+    granted: boolean;
+}
+export interface ServiceClientCreatedResponseDto {
+    client: ServiceClientDto;
+    secret: string;
+}

package/dist/dtos/cloud-service.dto.d.ts

@@ -3,12 +3,14 @@
  * @description Data transfer objects (DTOs) for cloud accounts,
  * sync jobs, provider ingestion, and insights communication.
  */
-import { CloudProvider, CloudAccountStatus, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from "../enums";
+import { CloudProvider, CloudAccountStatus, CloudAccountOwnerType, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from '../enums';
 /** Public representation of a connected cloud account. */
 export interface CloudAccountDto {
     id: string;
-    /** Workspace that owns this cloud account. */
-    workspaceId: string;
+    /** Whether this account belongs to an Organization or a Personal Workspace. */
+    ownerType: CloudAccountOwnerType;
+    /** The ID of the owning entity (organizationId or workspaceId depending on ownerType). */
+    ownerId: string;
     /** User who originally connected this account. */
     createdBy: string;
     alias: string;
@@ -123,3 +125,7 @@ export interface CloudBudgetDto {
     forecastSpend: number;
     period: string;
 }
+export interface BulkDeleteCloudAccountsResponseDto {
+    deletedCount: number;
+    skippedAccountIds: string[];
+}

package/dist/dtos/index.d.ts

@@ -1,5 +1,6 @@
-export * from "./user-service.dto";
-export * from "./auth-service.dto";
-export * from "./cloud-service.dto";
-export * from "./insights-service.dto";
-export * from "./response.dto";
+export * from './user-service.dto';
+export * from './auth-service.dto';
+export * from './cloud-service.dto';
+export * from './insights-service.dto';
+export * from './audit-service.types';
+export * from './response.dto';

package/dist/dtos/index.js

@@ -18,4 +18,5 @@ __exportStar(require("./user-service.dto"), exports);
 __exportStar(require("./auth-service.dto"), exports);
 __exportStar(require("./cloud-service.dto"), exports);
 __exportStar(require("./insights-service.dto"), exports);
+__exportStar(require("./audit-service.types"), exports);
 __exportStar(require("./response.dto"), exports);