@hapiboo/module-auth 1.0.0

package/dist/service/authentication.js

@@ -0,0 +1,569 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticationService = void 0;
+const uuid_1 = require("uuid");
+const core_1 = require("@hapiboo/core");
+const repository_1 = require("./repository");
+const settings_1 = require("./settings");
+const security_1 = require("./security");
+const models_1 = require("../models");
+const authorization_1 = require("./authorization");
+var helper;
+(function (helper) {
+    let tokens;
+    (function (tokens) {
+        function getJwt(user_id, account_id, is_admin, data, refreshCode) {
+            const refreshToken = security_1.securityService.token.refresh(user_id, refreshCode, 720);
+            const token = security_1.securityService.token.data(user_id, account_id, is_admin, 24, data);
+            return { token: token, refreshToken: refreshToken };
+        }
+        tokens.getJwt = getJwt;
+        function generateWithRefreshIfNeeded(credential, user, payload, confirmData) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                if (credential.refreshCode === '' && credential.setRefreshCode((0, uuid_1.v4)())) {
+                    core_1.promise.check(repository_1.repository.credential.update(credential), reject)
+                        .then(() => {
+                        if (confirmData) {
+                            core_1.promise.checkVoid(repository_1.repository.user.update(user.confirm()), reject)
+                                .then(() => {
+                                resolve(getJwt(user.id, user.account_id, user.type === 'admin', payload, credential.refreshCode));
+                            });
+                        }
+                        else {
+                            resolve(getJwt(user.id, user.account_id, user.type === 'admin', payload, credential.refreshCode));
+                        }
+                    });
+                }
+                else {
+                    if (confirmData) {
+                        core_1.promise.check(repository_1.repository.credential.update(credential), reject)
+                            .then(() => {
+                            core_1.promise.checkVoid(repository_1.repository.user.update(user.confirm()), reject)
+                                .then(() => {
+                                resolve(getJwt(user.id, user.account_id, user.type === 'admin', payload, credential.refreshCode));
+                            });
+                        });
+                    }
+                    else {
+                        resolve(getJwt(user.id, user.account_id, user.type === 'admin', payload, credential.refreshCode));
+                    }
+                }
+            });
+        }
+        function generate(user, credential, confirmData) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                if (user.type === 'standard' && user.account_id !== '') {
+                    core_1.promise.check(settings_1.authSettings.getTokenPayload(user), reject)
+                        .then((payload) => {
+                        core_1.promise.resolve(generateWithRefreshIfNeeded(credential, user, payload, confirmData), resolve, reject);
+                    });
+                }
+                else {
+                    core_1.promise.resolve(generateWithRefreshIfNeeded(credential, user, undefined, confirmData), resolve, reject);
+                }
+            });
+        }
+        tokens.generate = generate;
+        function generateFull(credential, confirmData) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.user.getById(credential.user_id), reject)
+                    .then((user) => {
+                    core_1.promise.resolve(generate(user, credential, confirmData), resolve, reject);
+                });
+            });
+        }
+        tokens.generateFull = generateFull;
+    })(tokens = helper.tokens || (helper.tokens = {}));
+    let users;
+    (function (users) {
+        function registerPassword(display, email, credentialName, password, admin, isInvited, account_id, baseUrl) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                //we need to find out if credentialName is not used
+                core_1.promise.check(searchPassword(credentialName, true), reject)
+                    .then((value) => {
+                    if (value.found) {
+                        reject(core_1.ResponseError.getMessageResponse(409, 'credential name already registered'));
+                    }
+                    else {
+                        if (display && email && credentialName) {
+                            //let's create actual user data
+                            const user_id = (0, uuid_1.v4)();
+                            let confirm = (0, uuid_1.v4)().substring(0, 6).toUpperCase();
+                            let invite = undefined;
+                            if (isInvited) {
+                                confirm = undefined;
+                                invite = (0, uuid_1.v4)().substring(0, 6).toUpperCase();
+                                password = '';
+                            }
+                            core_1.promise.check(repository_1.repository.credential.create(new models_1.Credential().createPassword((0, uuid_1.v4)(), credentialName, user_id, 'pending', password, confirm, invite)), reject)
+                                .then((cred) => {
+                                //now, create user
+                                core_1.promise.check(repository_1.repository.user.create(new models_1.User().create(user_id, account_id, admin ? 'admin' : 'standard', 'created', display, email)), reject)
+                                    .then((dataItem) => {
+                                    //and send the code to confirm
+                                    emails.confirm(email, display, isInvited, isInvited ? cred.invite : cred.confirmation, baseUrl)
+                                        .then(() => {
+                                        resolve({ user: dataItem, credentials: cred });
+                                    }).catch((reason) => {
+                                        console.error(reason.message);
+                                        //in case of error, we need to remove all created data
+                                        repository_1.repository.user.remove(dataItem.id)
+                                            .then(() => {
+                                            repository_1.repository.credential.remove(cred.id)
+                                                .then(() => {
+                                                reject(reason);
+                                            }).catch((reasonCred) => {
+                                                //we have 2 errors, and needs to combine them
+                                                reject(core_1.ResponseError.getCollectionResponse([reason, reasonCred]));
+                                            });
+                                        }).catch((reasonUser) => {
+                                            //despite error, let's try to clean up other data
+                                            repository_1.repository.credential.remove(cred.id)
+                                                .then(() => {
+                                                //we have 2 errors, and needs to combine them
+                                                reject(core_1.ResponseError.getCollectionResponse([reason, reasonUser]));
+                                            }).catch((reasonCred) => {
+                                                //we have 3 errors, and needs to combine them
+                                                reject(core_1.ResponseError.getCollectionResponse([reason, reasonUser, reasonCred]));
+                                            });
+                                        });
+                                    });
+                                });
+                            });
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(400, 'data is not valid'));
+                        }
+                    }
+                });
+            });
+        }
+        users.registerPassword = registerPassword;
+        function searchPassword(credential_name, includeAll) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.credential.filter(credential_name, undefined, undefined, undefined, undefined, 'password'), reject)
+                    .then((data) => {
+                    if (data && data.length === 1) {
+                        const credential = data[0];
+                        if (credential.status === 'active' || includeAll) {
+                            core_1.promise.check(repository_1.repository.user.getById(credential.user_id), reject)
+                                .then((user) => {
+                                resolve({ found: true, credential, user });
+                            });
+                        }
+                        else {
+                            resolve({ found: false });
+                        }
+                    }
+                    else {
+                        resolve({ found: false });
+                    }
+                });
+            });
+        }
+        users.searchPassword = searchPassword;
+    })(users = helper.users || (helper.users = {}));
+    let emails;
+    (function (emails) {
+        function url(host, path) {
+            if (host != '') {
+                if (host.endsWith('/')) {
+                    if (path.startsWith('/')) {
+                        return host + path.substring(1);
+                    }
+                    else {
+                        return host + path;
+                    }
+                }
+                else {
+                    if (path.startsWith('/')) {
+                        return host + path;
+                    }
+                    else {
+                        return host + '/' + path;
+                    }
+                }
+            }
+            else {
+                return path;
+            }
+        }
+        function confirm(emailAddress, displayName, isInvited, code, baseUrl) {
+            return core_1.promise.createVoidPromise((resolve, reject) => {
+                const link = isInvited ? { url: url(baseUrl, 'invitation/?code=' + code), title: 'Confirm Invitation' } : { url: url(baseUrl, 'confirm/?code=' + code), title: 'Confirm Account' };
+                core_1.promise.resolveVoid(settings_1.authSettings.sendConfirmation(emailAddress, displayName, isInvited, link), resolve, reject);
+            });
+        }
+        emails.confirm = confirm;
+        function recover(emailAddress, code, baseUrl) {
+            return core_1.promise.createVoidPromise((resolve, reject) => {
+                const link = { url: url(baseUrl, 'recover/?code=' + code), title: 'Reset Password' };
+                core_1.promise.resolveVoid(settings_1.authSettings.sendRecover(emailAddress, link), resolve, reject);
+            });
+        }
+        emails.recover = recover;
+    })(emails = helper.emails || (helper.emails = {}));
+})(helper || (helper = {}));
+var authenticationService;
+(function (authenticationService) {
+    let general;
+    (function (general) {
+        function initData(baseURL) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.user.count(), reject)
+                    .then((count) => {
+                    if (count === 0) {
+                        core_1.promise.resolve(admin.invite(settings_1.authSettings.firstAdmin.email, settings_1.authSettings.firstAdmin.email, settings_1.authSettings.firstAdmin.name, baseURL), resolve, reject);
+                    }
+                    else {
+                        resolve({ id: '' });
+                    }
+                });
+            });
+        }
+        general.initData = initData;
+        function get(user_id) {
+            return repository_1.repository.user.getById(user_id);
+        }
+        general.get = get;
+    })(general = authenticationService.general || (authenticationService.general = {}));
+    let me;
+    (function (me) {
+        function get(user_id) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.user.getById(user_id), reject)
+                    .then((data) => {
+                    if (!data) {
+                        reject(core_1.ResponseError.getMessageResponse(404, 'user not found'));
+                    }
+                    else {
+                        core_1.promise.check(authorization_1.authorizationService.access.getForUser(data.id), reject)
+                            .then((roles) => {
+                            const permission_ids = roles.map((item) => { return item.permission_id; });
+                            resolve({ id: data.id, email: data.profile.email, name: data.profile.display, account_id: data.account_id, admin: data.type === 'admin', permissions: permission_ids });
+                        });
+                    }
+                });
+            });
+        }
+        me.get = get;
+        function update(user_id, name) {
+            return core_1.promise.createPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.user.getById(user_id), reject)
+                    .then((data) => {
+                    if (!data) {
+                        reject(core_1.ResponseError.getMessageResponse(404, 'user not found'));
+                    }
+                    else {
+                        core_1.promise.resolve(repository_1.repository.user.update(new models_1.User().clone(data).updateName(name)), resolve, reject);
+                    }
+                });
+            });
+        }
+        me.update = update;
+        function passwordLogin(name, password) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(helper.users.searchPassword(name.toLowerCase(), false), reject)
+                    .then((value) => {
+                    if (!value.found || !value.credential || !value.user) {
+                        reject(core_1.ResponseError.getMessageResponse(400, 'email or password is not correct'));
+                    }
+                    else {
+                        if (value.credential.checkPasswordCorrectness(password)) {
+                            core_1.promise.resolve(helper.tokens.generate(value.user, value.credential, false), resolve, reject);
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(400, 'user or password is not correct'));
+                        }
+                    }
+                });
+            });
+        }
+        me.passwordLogin = passwordLogin;
+        function changePassword(user_id, credentialName, oldPassword, newPassword) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                //get login
+                core_1.promise.check(repository_1.repository.credential.filter(credentialName, user_id, undefined, undefined, undefined, 'password'), reject)
+                    .then((credentials) => {
+                    if (credentials.length === 1) {
+                        const model = credentials[0];
+                        //check & change password
+                        if (!model.changePassword(oldPassword, newPassword)) {
+                            reject(core_1.ResponseError.getMessageResponse(406, 'incorrect password'));
+                        }
+                        else {
+                            core_1.promise.check(repository_1.repository.user.getById(model.user_id), reject)
+                                .then((user) => {
+                                core_1.promise.check(helper.tokens.generate(user, model, false), reject)
+                                    .then((tokens) => {
+                                    core_1.promise.checkVoid(settings_1.authSettings.sendAfterPasswordChanged(user.profile.email), reject)
+                                        .then(() => {
+                                        resolve(tokens);
+                                    });
+                                });
+                            });
+                        }
+                    }
+                    else {
+                        reject(core_1.ResponseError.getMessageResponse(403, 'incorrect parameters'));
+                    }
+                });
+            });
+        }
+        me.changePassword = changePassword;
+        function refreshTokenLogin(user_id, refreshCode) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.credential.filter(undefined, user_id, undefined, undefined, undefined, 'password'), reject)
+                    .then((credentials) => {
+                    if (credentials.length === 1) {
+                        const model = credentials[0];
+                        if (model.refreshCode === refreshCode) {
+                            core_1.promise.resolve(helper.tokens.generateFull(model, false), resolve, reject);
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(403, 'incorrect token'));
+                        }
+                    }
+                    else {
+                        reject(core_1.ResponseError.getMessageResponse(403, 'incorrect parameters'));
+                    }
+                });
+            });
+        }
+        me.refreshTokenLogin = refreshTokenLogin;
+    })(me = authenticationService.me || (authenticationService.me = {}));
+    let admin;
+    (function (admin) {
+        function invite(name, emailAddress, displayName, baseURL) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                emailAddress = emailAddress.toLowerCase();
+                core_1.promise.check(helper.users.registerPassword(displayName, emailAddress, name, '', true, true, undefined, baseURL), reject)
+                    .then((data) => {
+                    resolve({ id: data.user.id });
+                });
+            });
+        }
+        admin.invite = invite;
+        function remove(id, currentUserId) {
+            return core_1.promise.createDelayedVoidPromise((resolve, reject) => {
+                if (id === currentUserId) {
+                    reject(core_1.ResponseError.getMessageResponse(400, 'cannot remove own user'));
+                }
+                else {
+                    core_1.promise.check(repository_1.repository.user.getById(id), reject)
+                        .then((user) => {
+                        if (user.type !== 'admin' || user.account_id) {
+                            reject(core_1.ResponseError.getMessageResponse(404, 'cannot remove non-admin user'));
+                        }
+                        else {
+                            //user is ok to remove - removing User object
+                            core_1.promise.checkVoid(repository_1.repository.user.remove(user.id), reject)
+                                .then(() => {
+                                //now remove all associated credentials
+                                core_1.promise.check(repository_1.repository.credential.filter(undefined, user.id, undefined, undefined, undefined, undefined), reject)
+                                    .then((credentials) => {
+                                    core_1.promise.resolveVoid(core_1.promise.all(credentials.map((credential) => {
+                                        return repository_1.repository.credential.remove(credential.id);
+                                    })), resolve, reject);
+                                });
+                            });
+                        }
+                    });
+                }
+            });
+        }
+        admin.remove = remove;
+        function getAll() {
+            return repository_1.repository.user.filter(undefined, 'admin', undefined);
+        }
+        admin.getAll = getAll;
+    })(admin = authenticationService.admin || (authenticationService.admin = {}));
+    let user;
+    (function (user_1) {
+        function registerPassword(credentialName, userDisplayName, userEmailAddress, password, account_name, account_email, baseUrl) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                const account_id = (0, uuid_1.v4)();
+                userEmailAddress = userEmailAddress.toLowerCase();
+                core_1.promise.check(helper.users.registerPassword(userDisplayName, userEmailAddress, credentialName, password, false, false, account_id, baseUrl), reject)
+                    .then((data) => {
+                    core_1.promise.check(settings_1.authSettings.afterRegistration(account_id, data.user.id, account_name, account_email), reject)
+                        .then((afterData) => {
+                        resolve({ user: data.user.id, account: afterData.id });
+                    });
+                });
+            });
+        }
+        user_1.registerPassword = registerPassword;
+        function invite(account_id, credentialName, displayName, emailAddress, baseUrl) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                emailAddress = emailAddress.toLowerCase();
+                core_1.promise.check(helper.users.registerPassword(displayName, emailAddress, credentialName, '', false, true, account_id, baseUrl), reject)
+                    .then((data) => {
+                    resolve({ id: data.user.id });
+                });
+            });
+        }
+        user_1.invite = invite;
+        function updatePayload(user_id, account_id, payload) {
+            return helper.tokens.getJwt(user_id, account_id, false, payload, (0, uuid_1.v4)()).token;
+        }
+        user_1.updatePayload = updatePayload;
+        function remove(user_id, currentUserId, account_id) {
+            return core_1.promise.createDelayedVoidPromise((resolve, reject) => {
+                if (user_id === currentUserId) {
+                    reject(core_1.ResponseError.getMessageResponse(400, 'cannot remove own user'));
+                }
+                else {
+                    core_1.promise.check(repository_1.repository.user.getById(user_id), reject)
+                        .then((user) => {
+                        if (user.type !== 'standard' || user.account_id === undefined || user.account_id !== account_id) {
+                            reject(core_1.ResponseError.getMessageResponse(404, 'cannot remove user'));
+                        }
+                        else {
+                            //user is ok to remove - removing User object
+                            core_1.promise.checkVoid(repository_1.repository.user.remove(user.id), reject)
+                                .then(() => {
+                                //now is the time to remove all permissions and roles
+                                core_1.promise.checkVoid(authorization_1.authorizationService.access.removeAllForUser(user.id), reject)
+                                    .then(() => {
+                                    //now remove all associated credentials
+                                    core_1.promise.check(repository_1.repository.credential.filter(undefined, user.id, undefined, undefined, undefined, undefined), reject)
+                                        .then((credentials) => {
+                                        core_1.promise.resolveVoid(core_1.promise.all(credentials.map((credential) => {
+                                            return repository_1.repository.credential.remove(credential.id);
+                                        })), resolve, reject);
+                                    });
+                                });
+                            });
+                        }
+                    });
+                }
+            });
+        }
+        user_1.remove = remove;
+        function getForAccount(account_id) {
+            return repository_1.repository.user.filter(undefined, 'standard', account_id);
+        }
+        user_1.getForAccount = getForAccount;
+    })(user = authenticationService.user || (authenticationService.user = {}));
+    let actions;
+    (function (actions) {
+        function resendConfirmation(user_id, baseUrl) {
+            return core_1.promise.createDelayedVoidPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.user.getById(user_id), reject)
+                    .then((user) => {
+                    if (user.status === 'created') {
+                        core_1.promise.check(repository_1.repository.credential.filter(undefined, user_id, undefined, undefined, undefined, 'password'), reject)
+                            .then((credentials) => {
+                            if (credentials.length !== 1) {
+                                reject(core_1.ResponseError.getMessageResponse(422, 'user not found'));
+                            }
+                            else {
+                                const credential = credentials[0];
+                                if (credential.status !== 'pending') {
+                                    reject(core_1.ResponseError.getMessageResponse(422, 'user already confirmed'));
+                                }
+                                else {
+                                    core_1.promise.resolveVoid(helper.emails.confirm(user.profile.email, user.profile.display, credential.invite != '', credential.invite != '' ? credential.invite : credential.confirmation, baseUrl), resolve, reject);
+                                }
+                            }
+                        })
+                            .catch((error) => {
+                            reject(error);
+                        });
+                    }
+                });
+            });
+        }
+        actions.resendConfirmation = resendConfirmation;
+        function confirmRegistration(code, password) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.credential.filter(undefined, undefined, code, undefined, undefined, 'password'), reject)
+                    .then((models) => {
+                    if (models.length === 1) {
+                        const model = models.pop();
+                        if (model.status !== 'pending') {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'login already confirmed'));
+                        }
+                        else if (model.checkConfirmed(code, password)) {
+                            core_1.promise.resolve(helper.tokens.generateFull(model, true), resolve, reject);
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'incorrect confirmation data'));
+                        }
+                    }
+                    else {
+                        reject(core_1.ResponseError.getMessageResponse(422, 'incorrect confirmation data'));
+                    }
+                });
+            });
+        }
+        actions.confirmRegistration = confirmRegistration;
+        function confirmInvitation(code, password) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.credential.filter(undefined, undefined, undefined, undefined, code, 'password'), reject)
+                    .then((models) => {
+                    if (models.length === 1) {
+                        const model = models.pop();
+                        if (model.status !== 'pending') {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'invite already confirmed'));
+                        }
+                        else if (model.checkInvite(code, password)) {
+                            core_1.promise.resolve(helper.tokens.generateFull(model, true), resolve, reject);
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'incorrect invitation data'));
+                        }
+                    }
+                    else {
+                        reject(core_1.ResponseError.getMessageResponse(422, 'incorrect invitation data'));
+                    }
+                });
+            });
+        }
+        actions.confirmInvitation = confirmInvitation;
+        function recoverPassword(recovery, password) {
+            return core_1.promise.createDelayedPromise((resolve, reject) => {
+                core_1.promise.check(repository_1.repository.credential.filter(undefined, undefined, undefined, recovery, undefined, 'password'), reject)
+                    .then((models) => {
+                    if (models.length === 1) {
+                        const model = models.pop();
+                        if (model.status === 'revoked') {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'cannot recover password for revoked credential'));
+                        }
+                        else if (model.checkRecovery(recovery, password)) {
+                            core_1.promise.resolve(helper.tokens.generateFull(model, true), resolve, reject);
+                        }
+                        else {
+                            reject(core_1.ResponseError.getMessageResponse(422, 'recovery code is not correct'));
+                        }
+                    }
+                    else {
+                        reject(core_1.ResponseError.getMessageResponse(422, 'recovery code is not correct'));
+                    }
+                });
+            });
+        }
+        actions.recoverPassword = recoverPassword;
+        function forgotPassword(credentialName, baseUrl) {
+            return core_1.promise.createDelayedVoidPromise((resolve, reject) => {
+                //find credential
+                core_1.promise.check(helper.users.searchPassword(credentialName, false), reject)
+                    .then((value) => {
+                    if (!value.found) {
+                        reject(core_1.ResponseError.getMessageResponse(404, 'user not found'));
+                    }
+                    else {
+                        //create recovery code
+                        value.credential.recovery = (0, uuid_1.v4)().substring(0, 8).toUpperCase();
+                        core_1.promise.check(repository_1.repository.credential.update(value.credential), reject)
+                            .then(() => {
+                            core_1.promise.resolveVoid(helper.emails.recover(value.user.profile.email, value.credential.recovery, baseUrl), resolve, reject);
+                        });
+                    }
+                });
+            });
+        }
+        actions.forgotPassword = forgotPassword;
+    })(actions = authenticationService.actions || (authenticationService.actions = {}));
+})(authenticationService || (exports.authenticationService = authenticationService = {}));

package/dist/service/authorization.d.ts

@@ -0,0 +1,38 @@
+import { NextFunction, Response } from 'express';
+import { IResponsePromise, IResponsePromiseVoid } from '@hapiboo/core';
+import { Permission, Role, UserAccess } from '../models';
+import { IFluxRequest } from './security';
+export declare namespace authorizationService {
+    namespace permission {
+        function create(name: string): IResponsePromise<Permission>;
+        function edit(id: string, name: string): IResponsePromise<Permission>;
+        function all(): IResponsePromise<Permission[]>;
+    }
+    namespace role {
+        function create(name: string, description: string, lucide_icon: string, permissions: string[]): IResponsePromise<Role>;
+        function edit(id: string, name: string, description: string, lucide_icon: string, permissions: string[]): IResponsePromise<Role>;
+        function all(): IResponsePromise<Role[]>;
+    }
+    namespace access {
+        namespace byRole {
+            function assign(account_id: string, user_id: string, role_id: string): IResponsePromise<UserAccess[]>;
+            function assignList(account_id: string, user_id: string, role_ids: string[]): IResponsePromise<UserAccess[]>;
+            function remove(account_id: string, user_id: string): IResponsePromiseVoid;
+        }
+        namespace byPermission {
+            function assign(_user_id: string, _permission_id: string): void;
+            function assignList(_user_id: string, _permission_id: string[]): void;
+            function remove(_account_id: string, _user_id: string): IResponsePromiseVoid;
+        }
+        function removeAllForUser(user_id: string): IResponsePromiseVoid;
+        function getForAccount(account_id: string): IResponsePromise<UserAccess[]>;
+        function getForUser(user_id: string): IResponsePromise<UserAccess[]>;
+        function split(user_access: UserAccess[]): {
+            roles: UserAccess[];
+            permissions: UserAccess[];
+        };
+    }
+    namespace middleware {
+        function permission(permission_id: string): (request: IFluxRequest, response: Response, next: NextFunction) => void;
+    }
+}