@omnitron-dev/omnitron 0.1.1

package/dist/services/auth.service.js

@@ -0,0 +1,310 @@
+/**
+ * Omnitron Auth Service
+ *
+ * Portal authentication for the Omnitron webapp. Handles user sign-in,
+ * session lifecycle, JWT issuance, and password management.
+ *
+ * Uses Kysely directly against omnitron-pg (port 5480).
+ * Password hashing via Node's native crypto.scrypt (zero external deps).
+ * JWT via jose (HS256), already a Titan dependency.
+ */
+import { randomBytes, randomUUID, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+import { SignJWT, jwtVerify } from 'jose';
+const scryptAsync = promisify(scrypt);
+// =============================================================================
+// Constants
+// =============================================================================
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 64;
+const SESSION_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
+const JWT_EXPIRY = '1h';
+// =============================================================================
+// Auth Service
+// =============================================================================
+export class AuthService {
+    db;
+    jwtSecret;
+    constructor(db, jwtSecret) {
+        this.db = db;
+        // Derive JWT signing key from secret (or use a default for dev)
+        const secret = jwtSecret ?? 'omnitron-dev-jwt-secret-change-in-production';
+        this.jwtSecret = new TextEncoder().encode(secret);
+    }
+    // ===========================================================================
+    // Sign In
+    // ===========================================================================
+    async signIn(request) {
+        const { username, password, ipAddress, userAgent } = request;
+        // 1. Find user
+        const user = await this.db
+            .selectFrom('omnitron_users')
+            .selectAll()
+            .where('username', '=', username)
+            .executeTakeFirst();
+        if (!user) {
+            throw new Error('Invalid credentials');
+        }
+        // 2. Verify password
+        const valid = await this.verifyPassword(password, user.passwordHash);
+        if (!valid) {
+            throw new Error('Invalid credentials');
+        }
+        // 3. Create session (include role in JWT for RBAC enforcement)
+        const sessionId = randomUUID();
+        const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
+        const accessToken = await this.issueToken(user.id, sessionId, user.role);
+        await this.db
+            .insertInto('omnitron_sessions')
+            .values({
+            id: sessionId,
+            userId: user.id,
+            token: accessToken,
+            expiresAt,
+            ipAddress: ipAddress ?? null,
+            userAgent: userAgent ?? null,
+        })
+            .execute();
+        // 4. Update last login
+        await this.db
+            .updateTable('omnitron_users')
+            .set({ lastLoginAt: new Date() })
+            .where('id', '=', user.id)
+            .execute();
+        return {
+            user: {
+                id: user.id,
+                username: user.username,
+                displayName: user.displayName,
+                role: user.role,
+                totpEnabled: user.totpEnabled,
+                pgpEnabled: user.pgpEnabled,
+            },
+            session: { id: sessionId, expiresAt },
+            accessToken,
+        };
+    }
+    // ===========================================================================
+    // Sign Out
+    // ===========================================================================
+    async signOut(sessionId) {
+        await this.db
+            .deleteFrom('omnitron_sessions')
+            .where('id', '=', sessionId)
+            .execute();
+    }
+    // ===========================================================================
+    // Validate Session
+    // ===========================================================================
+    async validateSession(sessionId) {
+        const session = await this.db
+            .selectFrom('omnitron_sessions')
+            .selectAll()
+            .where('id', '=', sessionId)
+            .executeTakeFirst();
+        if (!session)
+            return null;
+        // Check expiry
+        if (new Date(session.expiresAt) < new Date()) {
+            // Expired — clean up
+            await this.db
+                .deleteFrom('omnitron_sessions')
+                .where('id', '=', sessionId)
+                .execute();
+            return null;
+        }
+        const user = await this.db
+            .selectFrom('omnitron_users')
+            .selectAll()
+            .where('id', '=', session.userId)
+            .executeTakeFirst();
+        if (!user)
+            return null;
+        return {
+            id: user.id,
+            username: user.username,
+            displayName: user.displayName,
+            role: user.role,
+            totpEnabled: user.totpEnabled,
+            pgpEnabled: user.pgpEnabled,
+        };
+    }
+    /**
+     * Get session info (expiry) without full user validation.
+     */
+    async getSessionInfo(sessionId) {
+        const session = await this.db
+            .selectFrom('omnitron_sessions')
+            .select(['expiresAt'])
+            .where('id', '=', sessionId)
+            .executeTakeFirst();
+        if (!session)
+            return null;
+        return { expiresAt: new Date(session.expiresAt) };
+    }
+    // ===========================================================================
+    // Validate Token (JWT)
+    // ===========================================================================
+    async validateToken(token) {
+        try {
+            const { payload } = await jwtVerify(token, this.jwtSecret, {
+                algorithms: ['HS256'],
+                issuer: 'omnitron',
+            });
+            const userId = payload.sub;
+            const sessionId = payload['sid'];
+            if (!userId || !sessionId)
+                return null;
+            // Verify session still exists and is not expired
+            const session = await this.db
+                .selectFrom('omnitron_sessions')
+                .select(['id', 'expiresAt'])
+                .where('id', '=', sessionId)
+                .where('userId', '=', userId)
+                .executeTakeFirst();
+            if (!session)
+                return null;
+            if (new Date(session.expiresAt) < new Date())
+                return null;
+            return { userId, sessionId };
+        }
+        catch {
+            return null;
+        }
+    }
+    // ===========================================================================
+    // Get Active Sessions
+    // ===========================================================================
+    async getActiveSessions(userId, currentSessionId) {
+        const sessions = await this.db
+            .selectFrom('omnitron_sessions')
+            .selectAll()
+            .where('userId', '=', userId)
+            .where('expiresAt', '>', new Date())
+            .orderBy('createdAt', 'desc')
+            .execute();
+        return sessions.map((s) => ({
+            id: s.id,
+            ipAddress: s.ipAddress,
+            userAgent: s.userAgent,
+            createdAt: new Date(s.createdAt),
+            expiresAt: new Date(s.expiresAt),
+            current: s.id === currentSessionId,
+        }));
+    }
+    // ===========================================================================
+    // Refresh Session
+    // ===========================================================================
+    async refreshSession(sessionId) {
+        const session = await this.db
+            .selectFrom('omnitron_sessions')
+            .selectAll()
+            .where('id', '=', sessionId)
+            .executeTakeFirst();
+        if (!session)
+            return null;
+        // Session must still be valid (allow refresh up to 5 min after expiry for grace)
+        const gracePeriod = 5 * 60 * 1000;
+        if (new Date(session.expiresAt).getTime() + gracePeriod < Date.now()) {
+            await this.db.deleteFrom('omnitron_sessions').where('id', '=', sessionId).execute();
+            return null;
+        }
+        const user = await this.db
+            .selectFrom('omnitron_users')
+            .selectAll()
+            .where('id', '=', session.userId)
+            .executeTakeFirst();
+        if (!user)
+            return null;
+        // Issue new token and extend session (include role for RBAC)
+        const newExpiresAt = new Date(Date.now() + SESSION_DURATION_MS);
+        const newToken = await this.issueToken(user.id, sessionId, user.role);
+        await this.db
+            .updateTable('omnitron_sessions')
+            .set({ token: newToken, expiresAt: newExpiresAt })
+            .where('id', '=', sessionId)
+            .execute();
+        return {
+            user: {
+                id: user.id,
+                username: user.username,
+                displayName: user.displayName,
+                role: user.role,
+                totpEnabled: user.totpEnabled,
+                pgpEnabled: user.pgpEnabled,
+            },
+            session: { id: sessionId, expiresAt: newExpiresAt },
+            accessToken: newToken,
+        };
+    }
+    // ===========================================================================
+    // Change Password
+    // ===========================================================================
+    async changePassword(userId, oldPassword, newPassword, currentSessionId) {
+        const user = await this.db
+            .selectFrom('omnitron_users')
+            .select(['id', 'passwordHash'])
+            .where('id', '=', userId)
+            .executeTakeFirst();
+        if (!user) {
+            throw new Error('User not found');
+        }
+        const valid = await this.verifyPassword(oldPassword, user.passwordHash);
+        if (!valid) {
+            throw new Error('Invalid current password');
+        }
+        const newHash = await this.hashPassword(newPassword);
+        await this.db
+            .updateTable('omnitron_users')
+            .set({ passwordHash: newHash, updatedAt: new Date() })
+            .where('id', '=', userId)
+            .execute();
+        // Revoke all sessions except the caller's current session
+        let query = this.db.deleteFrom('omnitron_sessions').where('userId', '=', userId);
+        if (currentSessionId) {
+            query = query.where('id', '!=', currentSessionId);
+        }
+        await query.execute();
+    }
+    // ===========================================================================
+    // Password Hashing (crypto.scrypt — no external deps)
+    // ===========================================================================
+    async hashPassword(password) {
+        const salt = randomBytes(SALT_LENGTH);
+        const derived = (await scryptAsync(password, salt, KEY_LENGTH));
+        return `scrypt:${salt.toString('hex')}:${derived.toString('hex')}`;
+    }
+    async verifyPassword(password, hash) {
+        const parts = hash.split(':');
+        if (parts[0] !== 'scrypt' || parts.length !== 3)
+            return false;
+        const salt = Buffer.from(parts[1], 'hex');
+        const stored = Buffer.from(parts[2], 'hex');
+        const derived = (await scryptAsync(password, salt, KEY_LENGTH));
+        return timingSafeEqual(stored, derived);
+    }
+    // ===========================================================================
+    // JWT
+    // ===========================================================================
+    async issueToken(userId, sessionId, role = 'viewer') {
+        return new SignJWT({ sid: sessionId, role })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setSubject(userId)
+            .setIssuer('omnitron')
+            .setIssuedAt()
+            .setExpirationTime(JWT_EXPIRY)
+            .sign(this.jwtSecret);
+    }
+    // ===========================================================================
+    // Cleanup
+    // ===========================================================================
+    /** Remove all expired sessions — call periodically */
+    async cleanupExpiredSessions() {
+        const result = await this.db
+            .deleteFrom('omnitron_sessions')
+            .where('expiresAt', '<', new Date())
+            .executeTakeFirst();
+        return Number(result.numDeletedRows ?? 0);
+    }
+}
+//# sourceMappingURL=auth.service.js.map

package/dist/services/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAI1C,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AA0CtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,OAAO,WAAW;IAIH;IAHF,SAAS,CAAa;IAEvC,YACmB,EAA4B,EAC7C,SAAkB;QADD,OAAE,GAAF,EAAE,CAA0B;QAG7C,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,IAAI,8CAA8C,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,KAAK,CAAC,MAAM,CAAC,OAA8B;QACzC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAE7D,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,WAAW;YAClB,SAAS;YACT,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;aACD,OAAO,EAAE,CAAC;QAEb,uBAAuB;QACvB,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAChC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACrC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,EAAE;aACV,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,qBAAqB;YACrB,MAAM,IAAI,CAAC,EAAE;iBACV,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAuB,CAAC;YAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEvC,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC1B,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;iBAC3B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YAEtB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,gBAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,UAAU,CAAC,mBAAmB,CAAC;aAC/B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC;aAChC,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,mBAAmB,CAAC;aAChC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;aACjD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;aAC3B,OAAO,EAAE,CAAC;QAEb,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE;YACnD,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAmB,EAAE,gBAAyB;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;aAC9B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;aACxB,OAAO,EAAE,CAAC;QAEb,0DAA0D;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAE9E,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAC1E,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAW,CAAC;QAE1E,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAI,GAAG,QAAQ;QACzE,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,UAAU,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,UAAU,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E,sDAAsD;IACtD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,UAAU,CAAC,mBAAmB,CAAC;aAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/services/backup.rpc-service.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Backup RPC Service
+ *
+ * Netron RPC endpoints for database backup management from webapp and CLI.
+ */
+import type { BackupService, BackupInfo } from './backup.service.js';
+export declare class BackupRpcService {
+    private readonly backups;
+    constructor(backups: BackupService);
+    createBackup(data: {
+        database: string;
+        compress?: boolean;
+    }): Promise<BackupInfo>;
+    listBackups(data?: {
+        database?: string;
+    }): Promise<BackupInfo[]>;
+    restoreBackup(data: {
+        backupId: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    deleteBackup(data: {
+        backupId: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    setSchedule(data: {
+        database: string;
+        cron: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    getSchedule(data: {
+        database: string;
+    }): Promise<string | null>;
+}
+//# sourceMappingURL=backup.rpc-service.d.ts.map

package/dist/services/backup.rpc-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/backup.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAErE,qBACa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,aAAa;IAG7C,YAAY,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAKjF,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAKhE,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMxE,YAAY,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMvE,WAAW,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMpF,WAAW,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGtE"}

package/dist/services/backup.rpc-service.js

@@ -0,0 +1,85 @@
+/**
+ * Backup RPC Service
+ *
+ * Netron RPC endpoints for database backup management from webapp and CLI.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { VIEWER_ROLES, ADMIN_ROLES } from '../shared/roles.js';
+let BackupRpcService = class BackupRpcService {
+    backups;
+    constructor(backups) {
+        this.backups = backups;
+    }
+    async createBackup(data) {
+        return this.backups.createBackup(data.database, data.compress != null ? { compress: data.compress } : undefined);
+    }
+    async listBackups(data) {
+        return this.backups.listBackups(data?.database);
+    }
+    async restoreBackup(data) {
+        await this.backups.restoreBackup(data.backupId);
+        return { success: true };
+    }
+    async deleteBackup(data) {
+        await this.backups.deleteBackup(data.backupId);
+        return { success: true };
+    }
+    async setSchedule(data) {
+        await this.backups.setSchedule(data.database, data.cron);
+        return { success: true };
+    }
+    async getSchedule(data) {
+        return this.backups.getSchedule(data.database);
+    }
+};
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "createBackup", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "listBackups", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "restoreBackup", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "deleteBackup", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "setSchedule", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BackupRpcService.prototype, "getSchedule", null);
+BackupRpcService = __decorate([
+    Service({ name: 'OmnitronBackups' }),
+    __metadata("design:paramtypes", [Function])
+], BackupRpcService);
+export { BackupRpcService };
+//# sourceMappingURL=backup.rpc-service.js.map

package/dist/services/backup.rpc-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.rpc-service.js","sourceRoot":"","sources":["../../src/services/backup.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIxD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IACE;IAA7B,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAGjD,AAAN,KAAK,CAAC,YAAY,CAAC,IAA8C;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnH,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAA4B;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAA0B;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAC,IAA0B;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAwC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAA0B;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AA/BO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;oDAGxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;mDAGzC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;qDAIxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;oDAIxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;mDAIxC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;mDAGzC;AAlCU,gBAAgB;IAD5B,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;GACxB,gBAAgB,CAmC5B"}

package/dist/services/backup.service.d.ts

@@ -0,0 +1,45 @@
+/**
+ * BackupService — Database backup and restore automation
+ *
+ * Manages PostgreSQL database backups for omnitron-pg and app databases.
+ * Backups stored as compressed pg_dump files in ~/.omnitron/backups/.
+ * Uses Docker exec for pg_dump/pg_restore when databases are containerised.
+ *
+ * Features:
+ * - Create on-demand backups (compressed gzip)
+ * - List available backups with metadata
+ * - Restore from backup
+ * - Scheduled automated backups (cron expressions)
+ * - Automatic cleanup of old backups
+ */
+import type { ILogger } from '@omnitron-dev/titan/module/logger';
+export interface BackupInfo {
+    id: string;
+    database: string;
+    filename: string;
+    size: number;
+    createdAt: string;
+    compressed: boolean;
+}
+export declare class BackupService {
+    private readonly logger;
+    private readonly backupDir;
+    private schedules;
+    constructor(logger: ILogger, backupDir?: string);
+    createBackup(database: string, options?: {
+        compress?: boolean;
+    }): Promise<BackupInfo>;
+    listBackups(database?: string): Promise<BackupInfo[]>;
+    restoreBackup(backupId: string): Promise<void>;
+    deleteBackup(backupId: string): Promise<void>;
+    setSchedule(database: string, cron: string): Promise<void>;
+    getSchedule(database: string): Promise<string | null>;
+    dispose(): void;
+    private pgDumpDocker;
+    private pgRestoreDocker;
+    private pgDumpLocal;
+    private pgRestoreLocal;
+    private resolveDbConfig;
+    private parseCronInterval;
+}
+//# sourceMappingURL=backup.service.d.ts.map

package/dist/services/backup.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.service.d.ts","sourceRoot":"","sources":["../../src/services/backup.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAMjE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAYD,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,SAAS,CAAoC;gBAGlC,MAAM,EAAE,OAAO,EAChC,SAAS,CAAC,EAAE,MAAM;IAUd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAiDrF,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA2BrD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB9C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7C,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB1D,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3D,OAAO,IAAI,IAAI;YAWD,YAAY;YA4BZ,eAAe;YAuBf,WAAW;YAsBX,cAAc;IAqB5B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,iBAAiB;CAkB1B"}