@fonderie/admin 1.0.3 → 1.2.0

package/dist/index.d.ts

@@ -42,6 +42,21 @@ interface IAdminOptions {
     host?: string | string[];
     store?: IStoreAdapter;
     env?: string[];
+    /**
+     * Operator accounts: people sign in to the console with email, password and
+     * an authenticator app (backup codes as the fallback) instead of pasting a
+     * token. On by default whenever a `store` is given; `false` turns the sign-in
+     * routes off. There is no registration: the first operator is claimed once
+     * with the root adminToken, every other one is invited by an operator.
+     * adminToken stays the machine credential (CLI, CI) and the break-glass.
+     */
+    operators?: boolean;
+    /**
+     * 64 hex chars (`openssl rand -hex 32`). Encrypts operators' authenticator
+     * secrets at rest (AES-256-GCM). Unset ⇒ they are stored as-is and readiness
+     * warns. Keep it stable: changing it invalidates every enrolled authenticator.
+     */
+    operatorKey?: string;
 }
 interface IAdminModuleEntry {
     name: string;
@@ -270,6 +285,9 @@ declare function issueToken(store: IStoreAdapter, input: {
     record: IAdminTokenRecord;
 }>;
 declare function revokeToken(store: IStoreAdapter, id: string): Promise<boolean>;
-declare function requireAdminScope(bootstrap: string, store: IStoreAdapter | undefined, needed: AdminScope | 'root'): Middleware;
+declare function requireAdminScope(bootstrap: string, store: IStoreAdapter | undefined, needed: AdminScope | 'root', opts?: {
+    stepUp?: boolean;
+    operators?: boolean;
+}): Middleware;
 
 export { ADMIN_VERSION, AdminModule, type AdminRouteGuard, type AdminScope, DEFAULT_ACTOR, DEFAULT_ADMIN_PATH, DEFAULT_CHECK_TIMEOUT_MS, type IAdminAttention, type IAdminAttentionItem, type IAdminCheckResult, type IAdminDoctorReport, type IAdminEnvEntry, type IAdminEnvironmentReport, type IAdminLogEntry, type IAdminLogPage, type IAdminManifest, type IAdminMigrationModule, type IAdminMigrationsReport, type IAdminModuleEntry, type IAdminOptions, type IAdminPendingMigration, type IAdminRouteEntry, type IAdminRoutesReport, type IAdminTokenEntry, type IAdminTokenRecord, type IAdminTokensReport, type IMigrationSet, MAX_PAGE, SCOPES, adminLog, applyMigrationsSchema, applyModuleMigrations, attention, buildManifest, collectChecks, environmentReport, grants, hashToken, issueToken, listTokens, migrationsReport, readAdminLog, requireAdminScope, revokeToken, routesReport, runDoctor, scopeFor, tokensReport };