@learncard/lca-api-service 1.3.2 → 1.5.0

package/dist/helpers/seedEncryption.helpers.d.ts

@@ -0,0 +1,23 @@
+import { KMSClient } from '@aws-sdk/client-kms';
+import type { EncryptedSigningAuthoritySeed, SeedEncryptionConfig, SeedEncryption, SeedEncryptionFailure, SigningAuthoritySeedIdentity, SigningAuthoritySeedRecord } from 'types/seed-encryption';
+export declare const SA_SEED_ENCRYPTION_PURPOSE = "lca-signing-authority-seed";
+export declare class SeedEncryptionError extends Error {
+    readonly category: SeedEncryptionFailure;
+    readonly awsRequestId?: string | undefined;
+    constructor(category: SeedEncryptionFailure, awsRequestId?: string | undefined);
+}
+export declare const logSeedEncryptionFailure: (error: unknown, operation: string, record?: {
+    _id?: unknown;
+    keyVersion?: unknown;
+}) => void;
+export declare const getSeedIdentity: (record: {
+    _id?: unknown;
+    ownerDid: string;
+    name: string;
+    did?: string;
+}) => SigningAuthoritySeedIdentity;
+export declare const parseSeedEnvelope: (record: object) => EncryptedSigningAuthoritySeed | undefined;
+export declare const createSeedEncryption: (config: SeedEncryptionConfig, kms?: KMSClient) => SeedEncryption;
+export declare const seedEncryption: SeedEncryption;
+export declare const decryptSigningAuthoritySeed: (record: SigningAuthoritySeedRecord) => Promise<string>;
+export declare const getSeedCacheFingerprint: (record: SigningAuthoritySeedRecord) => string;

package/dist/helpers/seedEncryption.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/social-token.helpers.d.ts

@@ -0,0 +1,19 @@
+import type { JWTVerifyGetKey } from 'jose';
+export type SocialProviderId = 'google' | 'apple';
+export interface SocialProviderConfig {
+    issuers: string[];
+    audiences: string[];
+    jwksUri: string;
+}
+export interface SocialClaims {
+    sub: string;
+    iss: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export declare const getSocialProviderConfig: (provider: SocialProviderId) => SocialProviderConfig | null;
+export declare const setSocialJwksResolverForTests: (resolver: ((jwksUri: string) => JWTVerifyGetKey) | undefined) => void;
+export declare const getSocialJwks: (jwksUri: string) => JWTVerifyGetKey;
+export declare const verifySocialIdToken: (provider: SocialProviderId, token: string) => Promise<SocialClaims>;

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export type { AppRouter } from './app';
 export { appRouter as mainApp } from './app';
 export { app as didApp } from './dids';
+export { app as oidcApp } from './oidc';
 export { app as swaggerApp } from './openapi';

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 120281915 bytes
-sha256: 5ced11b8e911cdb7296d5c41f76d7e67fee6096c20a98f24ba308818feadfd6e
+size: 137933050 bytes
+sha256: 5d64b82c788a32e703cbe115ccb7dead043201ff159475b76d09fab29fade6ac

package/dist/jobs/escrowBlobRewrap.d.ts

@@ -0,0 +1,9 @@
+export interface EscrowBlobRewrapResult {
+    rewrapped: number;
+    skippedPendingHold: number;
+    failed: number;
+}
+export interface RunEscrowBlobRewrapOptions {
+    limit?: number;
+}
+export declare const runEscrowBlobRewrap: (options?: RunEscrowBlobRewrapOptions) => Promise<EscrowBlobRewrapResult>;

package/dist/jobs/escrowHoldReminders.d.ts

@@ -0,0 +1,12 @@
+import { notifyEscrowHoldEvent } from '../services/escrow-enclave';
+export interface EscrowHoldReminderResult {
+    reminded: number;
+    expired: number;
+    failed: number;
+}
+export interface RunEscrowHoldRemindersOptions {
+    now?: Date;
+    limit?: number;
+    notify?: typeof notifyEscrowHoldEvent;
+}
+export declare const runEscrowHoldReminders: (options?: RunEscrowHoldRemindersOptions) => Promise<EscrowHoldReminderResult>;

package/dist/migrations/signingAuthoritySeeds.d.ts

@@ -0,0 +1,13 @@
+import type { Db } from 'mongodb';
+import type { SeedMigrationCounts, SeedMigrationRequest, SeedMigrationResult } from 'types/seed-migration';
+export declare const SEED_MIGRATION_STATE_COLLECTION = "signingauthorityseedmigration";
+export declare const SEED_MIGRATION_RECEIPTS_COLLECTION = "signingauthorityseedverification";
+export declare class SeedMigrationError extends Error {
+    readonly category: string;
+    constructor(category: string);
+}
+export declare const countSeedMigrationDocuments: (db: Db) => Promise<SeedMigrationCounts>;
+export declare const runSeedMigrationBatch: (db: Db, request: SeedMigrationRequest, options: {
+    encryptedWritesEnabled: boolean;
+    remainingTime?: () => number;
+}) => Promise<SeedMigrationResult>;

package/dist/migrations/signingAuthoritySeedsCli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/models/AuthSubject.d.ts

@@ -0,0 +1,20 @@
+import type { Collection } from 'mongodb';
+export declare const AUTH_SUBJECTS_COLLECTION = "authsubjects";
+export interface AuthSubjectAttributes {
+    email?: string;
+    emailVerified: boolean;
+    displayName?: string;
+    pictureUrl?: string;
+}
+export interface MongoAuthSubjectType extends AuthSubjectAttributes {
+    subject: string;
+    identityKey: string;
+    createdAt: Date;
+    lastLoginAt: Date;
+}
+export declare const getAuthSubjectsCollection: () => Collection<MongoAuthSubjectType>;
+export declare const createAuthSubjectIndexes: () => Promise<void>;
+export declare const ensureAuthSubjectIndexes: () => Promise<void>;
+export declare const getOrCreateAuthSubject: (identityKey: string, attrs: AuthSubjectAttributes) => Promise<MongoAuthSubjectType>;
+export declare const getOrCreateAuthSubjectLinkedTo: (identityKey: string, subject: string, attrs: AuthSubjectAttributes) => Promise<MongoAuthSubjectType>;
+export declare const findAuthSubjectByIdentityKey: (identityKey: string) => Promise<MongoAuthSubjectType | null>;

package/dist/models/EscrowHold.d.ts

@@ -0,0 +1,153 @@
+import { z } from 'zod';
+import type { Collection } from 'mongodb';
+import { type AuthProviderMapping } from './UserKey';
+export declare const ESCROW_HOLDS_COLLECTION = "escrowholds";
+export declare const ESCROW_HOLD_STALE_WINDOW_MS: number;
+export declare const ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+export declare const ESCROW_HOLD_REMINDER_WINDOW_MS: number;
+export declare const EscrowHoldRecordValidator: z.ZodObject<{
+    hold: z.ZodObject<{
+        holdId: z.ZodString;
+        did: z.ZodString;
+        shareVersion: z.ZodNumber;
+        blobHash: z.ZodString;
+        enrollmentEpoch: z.ZodNumber;
+        releasePolicy: z.ZodEnum<{
+            pin: "pin";
+            hold: "hold";
+        }>;
+        clientEphemeralPublicKey: z.ZodString;
+        createdLo: z.ZodNumber;
+        createdHi: z.ZodNumber;
+        policyVersion: z.ZodNumber;
+        signature: z.ZodString;
+    }, z.core.$loose>;
+    holdDurationMs: z.ZodNumber;
+    ledgerSeq: z.ZodNumber;
+}, z.core.$loose>;
+export declare const EscrowHoldValidator: z.ZodObject<{
+    holdRecord: z.ZodObject<{
+        hold: z.ZodObject<{
+            holdId: z.ZodString;
+            did: z.ZodString;
+            shareVersion: z.ZodNumber;
+            blobHash: z.ZodString;
+            enrollmentEpoch: z.ZodNumber;
+            releasePolicy: z.ZodEnum<{
+                pin: "pin";
+                hold: "hold";
+            }>;
+            clientEphemeralPublicKey: z.ZodString;
+            createdLo: z.ZodNumber;
+            createdHi: z.ZodNumber;
+            policyVersion: z.ZodNumber;
+            signature: z.ZodString;
+        }, z.core.$loose>;
+        holdDurationMs: z.ZodNumber;
+        ledgerSeq: z.ZodNumber;
+    }, z.core.$loose>;
+    _id: z.ZodString;
+    authProvider: z.ZodObject<{
+        type: z.ZodEnum<{
+            firebase: "firebase";
+            supertokens: "supertokens";
+            keycloak: "keycloak";
+            oidc: "oidc";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    primaryDid: z.ZodString;
+    shareVersion: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        cancelled: "cancelled";
+        completed: "completed";
+        expired: "expired";
+    }>;
+    identityProofType: z.ZodEnum<{
+        "auth-token": "auth-token";
+        "recovery-session": "recovery-session";
+    }>;
+    requestedAt: z.ZodDate;
+    releaseAfter: z.ZodDate;
+    releasePolicy: z.ZodDefault<z.ZodEnum<{
+        pin: "pin";
+        hold: "hold";
+    }>>;
+    cancelReason: z.ZodOptional<z.ZodEnum<{
+        "pin-mismatch": "pin-mismatch";
+        "pin-locked": "pin-locked";
+        superseded: "superseded";
+        "release-failed": "release-failed";
+    }>>;
+    cancelledAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelPendingAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelConfirmedAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelAttempts: z.ZodOptional<z.ZodNumber>;
+    enclaveEnvelope: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
+    cancelledBy: z.ZodOptional<z.ZodEnum<{
+        did: "did";
+        link: "link";
+        system: "system";
+    }>>;
+    completedAt: z.ZodOptional<z.ZodDate>;
+    clientEphemeralPublicKey: z.ZodString;
+    resumeTokenHash: z.ZodString;
+    cancelTokenHash: z.ZodOptional<z.ZodString>;
+    cancelTokenUsedAt: z.ZodOptional<z.ZodDate>;
+    cancelTokenHashes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    startedNotificationPending: z.ZodOptional<z.ZodBoolean>;
+    reminderClaimedUntil: z.ZodOptional<z.ZodDate>;
+    startedNotificationAttemptedAt: z.ZodOptional<z.ZodDate>;
+    reminderAttemptedAt: z.ZodOptional<z.ZodDate>;
+    notifications: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            cancelled: "cancelled";
+            completed: "completed";
+            "pin-locked": "pin-locked";
+            started: "started";
+            reminder: "reminder";
+        }>;
+        sentAt: z.ZodDate;
+    }, z.core.$strip>>>;
+    requestIp: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type EscrowHold = z.infer<typeof EscrowHoldValidator>;
+export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason' | 'cancelTokenUsedAt' | 'enclaveCancelPendingAt' | 'enclaveCancelConfirmedAt' | 'enclaveCancelAttempts'>;
+export declare const getEscrowHoldsCollection: () => Collection<EscrowHold>;
+export declare const createEscrowHoldsIndexes: () => Promise<void>;
+export declare const createEscrowHold: (input: CreateEscrowHoldInput) => Promise<EscrowHold>;
+export declare const findPendingEscrowHoldByAuthProvider: (authProvider: AuthProviderMapping, releasePolicy?: EscrowHold["releasePolicy"]) => Promise<EscrowHold | null>;
+export declare const findEscrowHoldById: (id: string) => Promise<EscrowHold | null>;
+export declare const hasUnconfirmedEscrowCancellation: (primaryDid: string) => Promise<boolean>;
+export declare const findEscrowHoldsPendingEnclaveCancellation: (limit: number) => Promise<EscrowHold[]>;
+export declare const countEscrowCancellationsNearRelease: (now: Date) => Promise<number>;
+export declare const recordEscrowEnclaveCancelAttempt: (id: string) => Promise<boolean>;
+export declare const confirmEscrowEnclaveCancellation: (id: string) => Promise<void>;
+export declare const cancelEscrowHold: (id: string, cancelledBy: "did" | "system", cancelReason?: EscrowHold["cancelReason"]) => Promise<EscrowHold | null>;
+export declare const cancelEscrowHoldByCancelToken: (id: string, cancelTokenHash: string) => Promise<EscrowHold | null>;
+export declare const completeEscrowHold: (id: string) => Promise<EscrowHold | null>;
+export declare const hasCompletedEscrowHoldForVersion: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
+export declare const expireStaleEscrowHolds: (now: Date) => Promise<number>;
+export declare const markClaimedEscrowHoldFailed: (id: string, reason: "pin-mismatch" | "pin-locked" | "release-failed", completedAt: Date) => Promise<void>;
+export declare const retryClaimedEscrowHold: (id: string, completedAt: Date) => Promise<void>;
+export declare const findEscrowHoldsPendingStartNotification: (limit: number) => Promise<EscrowHold[]>;
+export declare const recordEscrowStartNotificationAttempt: (id: string, now: Date) => Promise<void>;
+export declare const findEscrowHoldsDueForReminder: (now: Date, limit: number) => Promise<EscrowHold[]>;
+export declare const claimEscrowHoldForReminder: (id: string, now: Date) => Promise<EscrowHold | null>;
+export declare const releaseEscrowReminderClaim: (hold: EscrowHold) => Promise<void>;
+export declare const hashEscrowResumeToken: (token: string) => string;
+export declare const generateEscrowResumeToken: () => string;
+export declare const recordEscrowHoldNotification: (holdId: string, kind: EscrowHold["notifications"][number]["kind"]) => Promise<void>;
+export declare const rotateEscrowCancelToken: (holdId: string) => Promise<string | null>;

package/dist/models/Notification.d.ts

@@ -167,6 +167,11 @@ export declare const MongoNotificationValidator: z.ZodObject<{
                 approvedAt: z.ZodString;
                 contractUpdatedAt: z.ZodString;
             }, z.core.$strip>>;
+            referral: z.ZodOptional<z.ZodObject<{
+                requestId: z.ZodString;
+                requestedBy: z.ZodString;
+                externalReferenceId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
             id: z.ZodString;
             action: z.ZodEnum<{
                 write: "write";

package/dist/models/SigningAuthority.d.ts

@@ -4,7 +4,13 @@ export declare const MongoSigningAuthorityValidator: z.ZodObject<{
     _id: z.ZodOptional<z.ZodString>;
     ownerDid: z.ZodString;
     name: z.ZodString;
-    seed: z.ZodString;
+    seed: z.ZodOptional<z.ZodString>;
+    encryptedSeed: z.ZodOptional<z.ZodString>;
+    encryptedDek: z.ZodOptional<z.ZodString>;
+    keyVersion: z.ZodOptional<z.ZodEnum<{
+        "kms-v1": "kms-v1";
+        "local-v1": "local-v1";
+    }>>;
     did: z.ZodOptional<z.ZodString>;
     endpoint: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;