@tinyrack/tinyauth-server 0.0.7

package/dist/entities/jwt-key.entity.d.ts

@@ -0,0 +1,256 @@
+import { type InferEntity } from '@mikro-orm/core';
+import { JwtKeyRepository } from '../repositories/jwt-key.repository.ts';
+/**
+ * JWT Key status for rotation lifecycle
+ *
+ * - next: Key is generated but not yet active (pre-rotation)
+ * - active: Currently used for signing tokens
+ * - previous: Recently rotated out, still valid for verification
+ * - retired: No longer valid for any operation
+ */
+export declare const JwtKeyStatus: {
+    /** Generated but not yet active */
+    readonly NEXT: "next";
+    /** Currently used for signing */
+    readonly ACTIVE: "active";
+    /** Recently rotated, still valid for verification */
+    readonly PREVIOUS: "previous";
+    /** No longer valid */
+    readonly RETIRED: "retired";
+};
+export type JwtKeyStatus = (typeof JwtKeyStatus)[keyof typeof JwtKeyStatus];
+/**
+ * JWT Key Entity for asymmetric key management (RS256)
+ *
+ * Stores RSA key pairs for JWT signing and verification.
+ * Supports key rotation with multiple active keys for seamless transitions.
+ *
+ * Security notes:
+ * - Private keys are stored in PEM format
+ * - In production, consider encrypting private_key column at rest
+ * - Only 'active' keys are used for signing
+ * - 'active' and 'previous' keys are used for verification
+ * - 'previous' keys are exposed in JWKS for token verification
+ */
+export declare const JwtKeyEntitySchema: import("@mikro-orm/core").EntitySchemaWithMeta<"JwtKeyEntity", "jwt_key", import("@mikro-orm/core").InferEntityFromProperties<{
+    /**
+     * Key ID (kid) - unique identifier for JWT header
+     * Format: "key-{timestamp}-{random}"
+     */
+    readonly kid: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "primary"> & {
+        primary: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Private Key in PEM format
+     * Used for signing tokens (only when status is 'active')
+     */
+    readonly private_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "hidden"> & {
+        hidden: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Public Key in PEM format
+     * Used for token verification and exposed via JWKS endpoint
+     */
+    readonly public_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, import("@mikro-orm/core").EmptyOptions, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * JWT signing algorithm
+     */
+    readonly algorithm: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "RS256";
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Key status in rotation lifecycle
+     */
+    readonly status: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<"next" | "previous" | "active" | "retired", Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "next";
+    }, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">;
+    /**
+     * Timestamp when key was activated (started signing)
+     */
+    readonly activated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was deactivated (stopped signing)
+     */
+    readonly deactivated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was retired (no longer valid)
+     */
+    readonly retired_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Scheduled expiration date for automatic rotation
+     */
+    readonly expires_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, undefined, import("@mikro-orm/core").InferEntityFromProperties<{
+    readonly created_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    readonly updated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, undefined, never, never, false>, typeof JwtKeyRepository, false>, import("@mikro-orm/core").InferEntityFromProperties<{
+    readonly created_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    readonly updated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, undefined, never, never, false>, {
+    /**
+     * Key ID (kid) - unique identifier for JWT header
+     * Format: "key-{timestamp}-{random}"
+     */
+    readonly kid: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "primary"> & {
+        primary: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Private Key in PEM format
+     * Used for signing tokens (only when status is 'active')
+     */
+    readonly private_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "hidden"> & {
+        hidden: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Public Key in PEM format
+     * Used for token verification and exposed via JWKS endpoint
+     */
+    readonly public_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, import("@mikro-orm/core").EmptyOptions, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * JWT signing algorithm
+     */
+    readonly algorithm: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "RS256";
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Key status in rotation lifecycle
+     */
+    readonly status: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<"next" | "previous" | "active" | "retired", Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "next";
+    }, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">;
+    /**
+     * Timestamp when key was activated (started signing)
+     */
+    readonly activated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was deactivated (stopped signing)
+     */
+    readonly deactivated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was retired (no longer valid)
+     */
+    readonly retired_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Scheduled expiration date for automatic rotation
+     */
+    readonly expires_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, import("@mikro-orm/core").EntityCtor<import("@mikro-orm/core").InferEntityFromProperties<{
+    /**
+     * Key ID (kid) - unique identifier for JWT header
+     * Format: "key-{timestamp}-{random}"
+     */
+    readonly kid: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "primary"> & {
+        primary: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Private Key in PEM format
+     * Used for signing tokens (only when status is 'active')
+     */
+    readonly private_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "hidden"> & {
+        hidden: true;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * RSA Public Key in PEM format
+     * Used for token verification and exposed via JWKS endpoint
+     */
+    readonly public_key: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, import("@mikro-orm/core").EmptyOptions, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * JWT signing algorithm
+     */
+    readonly algorithm: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<string, Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "RS256";
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Key status in rotation lifecycle
+     */
+    readonly status: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<"next" | "previous" | "active" | "retired", Omit<import("@mikro-orm/core").EmptyOptions, "default"> & {
+        default: "next";
+    }, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">, "type" | "default" | "ref" | "hidden" | "length" | "serializedPrimaryKey" | "name" | "comment" | "array" | "fieldName" | "fieldNames" | "columnType" | "columnTypes" | "runtimeType" | "precision" | "scale" | "autoincrement" | "returning" | "onCreate" | "onUpdate" | "defaultRaw" | "formula" | "generated" | "nullable" | "unsigned" | "persist" | "hydrate" | "version" | "concurrencyCheck" | "index" | "unique" | "check" | "lazy" | "primary" | "setter" | "getter" | "getterName" | "accessor" | "serializer" | "serializedName" | "groups" | "customOrder" | "extra" | "ignoreSchemaChanges" | ("~options" | "~type" | "$type" | "strictNullable") | "nativeEnumName">;
+    /**
+     * Timestamp when key was activated (started signing)
+     */
+    readonly activated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was deactivated (stopped signing)
+     */
+    readonly deactivated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Timestamp when key was retired (no longer valid)
+     */
+    readonly retired_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    /**
+     * Scheduled expiration date for automatic rotation
+     */
+    readonly expires_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, Omit<Omit<import("@mikro-orm/core").EmptyOptions, "nullable"> & {
+        nullable: true;
+    }, "default"> & {
+        default: null;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, undefined, import("@mikro-orm/core").InferEntityFromProperties<{
+    readonly created_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+    readonly updated_at: Pick<import("@mikro-orm/core").UniversalPropertyOptionsBuilder<Date, import("@mikro-orm/core").EmptyOptions & {
+        onCreate: (...args: any[]) => any;
+    }, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>, keyof import("@mikro-orm/core").PropertyOptions<any> | ("~options" | "~type" | "$type" | "strictNullable")>;
+}, undefined, never, never, false>, typeof JwtKeyRepository, false>>>;
+export type IJwtKeyEntity = InferEntity<typeof JwtKeyEntitySchema>;
+export declare class JwtKeyEntity extends JwtKeyEntitySchema.class {
+    /**
+     * Check if key can be used for verification
+     */
+    isVerificationKey(): boolean;
+}
+//# sourceMappingURL=jwt-key.entity.d.ts.map

package/dist/entities/jwt-key.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-key.entity.d.ts","sourceRoot":"","sources":["../../src/entities/jwt-key.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAGzE;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;IACvB,mCAAmC;;IAEnC,iCAAiC;;IAEjC,qDAAqD;;IAErD,sBAAsB;;CAEd,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB;IAO3B;;;OAGG;;;;IAGH;;;OAGG;;;;IAOH;;;OAGG;;IAGH;;OAEG;;;;IAMH;;OAEG;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;mBA8Bghb,GAAG;;;mBAAH,GAAG;;;;mBAAH,GAAG;;;mBAAH,GAAG;;;IAjGthb;;;OAGG;;;;IAGH;;;OAGG;;;;IAOH;;;OAGG;;IAGH;;OAEG;;;;IAMH;;OAEG;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;IAnEH;;;OAGG;;;;IAGH;;;OAGG;;;;IAOH;;;OAGG;;IAGH;;OAEG;;;;IAMH;;OAEG;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;mBA8Bghb,GAAG;;;mBAAH,GAAG;;qEAjBxhb,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,qBAAa,YAAa,SAAQ,kBAAkB,CAAC,KAAK;IACxD;;OAEG;IACH,iBAAiB,IAAI,OAAO;CAM7B"}

package/dist/entities/jwt-key.entity.js

@@ -0,0 +1,125 @@
+import { defineEntity } from '@mikro-orm/core';
+import { JwtKeyRepository } from "../repositories/jwt-key.repository.js";
+import { BaseSchema } from "./base.entity.js";
+/**
+ * JWT Key status for rotation lifecycle
+ *
+ * - next: Key is generated but not yet active (pre-rotation)
+ * - active: Currently used for signing tokens
+ * - previous: Recently rotated out, still valid for verification
+ * - retired: No longer valid for any operation
+ */
+export const JwtKeyStatus = {
+    /** Generated but not yet active */
+    NEXT: 'next',
+    /** Currently used for signing */
+    ACTIVE: 'active',
+    /** Recently rotated, still valid for verification */
+    PREVIOUS: 'previous',
+    /** No longer valid */
+    RETIRED: 'retired',
+};
+/**
+ * JWT Key Entity for asymmetric key management (RS256)
+ *
+ * Stores RSA key pairs for JWT signing and verification.
+ * Supports key rotation with multiple active keys for seamless transitions.
+ *
+ * Security notes:
+ * - Private keys are stored in PEM format
+ * - In production, consider encrypting private_key column at rest
+ * - Only 'active' keys are used for signing
+ * - 'active' and 'previous' keys are used for verification
+ * - 'previous' keys are exposed in JWKS for token verification
+ */
+export const JwtKeyEntitySchema = defineEntity({
+    name: 'JwtKeyEntity',
+    tableName: 'jwt_key',
+    comment: 'RSA key pairs for JWT signing (RS256)',
+    extends: BaseSchema,
+    repository: () => JwtKeyRepository,
+    properties: (p) => ({
+        /**
+         * Key ID (kid) - unique identifier for JWT header
+         * Format: "key-{timestamp}-{random}"
+         */
+        kid: p.string().primary().comment('Key ID for JWT header (kid claim)'),
+        /**
+         * RSA Private Key in PEM format
+         * Used for signing tokens (only when status is 'active')
+         */
+        private_key: p
+            .text()
+            .comment('RSA private key in PEM format')
+            .lazy()
+            .hidden(),
+        /**
+         * RSA Public Key in PEM format
+         * Used for token verification and exposed via JWKS endpoint
+         */
+        public_key: p.text().comment('RSA public key in PEM format'),
+        /**
+         * JWT signing algorithm
+         */
+        algorithm: p
+            .string()
+            .comment('JWT signing algorithm (RS256)')
+            .default('RS256'),
+        /**
+         * Key status in rotation lifecycle
+         */
+        status: p
+            .enum(() => JwtKeyStatus)
+            .comment('Key status: next, active, previous, retired')
+            .default(JwtKeyStatus.NEXT),
+        /**
+         * Timestamp when key was activated (started signing)
+         */
+        activated_at: p
+            .datetime()
+            .comment('When the key was activated for signing')
+            .nullable()
+            .default(null),
+        /**
+         * Timestamp when key was deactivated (stopped signing)
+         */
+        deactivated_at: p
+            .datetime()
+            .comment('When the key was deactivated from signing')
+            .nullable()
+            .default(null),
+        /**
+         * Timestamp when key was retired (no longer valid)
+         */
+        retired_at: p
+            .datetime()
+            .comment('When the key was fully retired')
+            .nullable()
+            .default(null),
+        /**
+         * Scheduled expiration date for automatic rotation
+         */
+        expires_at: p
+            .datetime()
+            .comment('Scheduled expiration for automatic rotation')
+            .nullable()
+            .default(null),
+    }),
+    indexes: [
+        {
+            name: 'jwt_key_status_idx',
+            properties: ['status'],
+        },
+    ],
+});
+export class JwtKeyEntity extends JwtKeyEntitySchema.class {
+    /**
+     * Check if key can be used for verification
+     */
+    isVerificationKey() {
+        return (this.status === JwtKeyStatus.ACTIVE ||
+            this.status === JwtKeyStatus.PREVIOUS);
+    }
+}
+JwtKeyEntitySchema.setClass(JwtKeyEntity);
+//# sourceMappingURL=jwt-key.entity.js.map

package/dist/entities/jwt-key.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-key.entity.js","sourceRoot":"","sources":["../../src/entities/jwt-key.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mCAAmC;IACnC,IAAI,EAAE,MAAM;IACZ,iCAAiC;IACjC,MAAM,EAAE,QAAQ;IAChB,qDAAqD;IACrD,QAAQ,EAAE,UAAU;IACpB,sBAAsB;IACtB,OAAO,EAAE,SAAS;CACV,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,SAAS,EAAE,SAAS;IACpB,OAAO,EAAE,uCAAuC;IAChD,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB;IAClC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB;;;WAGG;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC;QAEtE;;;WAGG;QACH,WAAW,EAAE,CAAC;aACX,IAAI,EAAE;aACN,OAAO,CAAC,+BAA+B,CAAC;aACxC,IAAI,EAAE;aACN,MAAM,EAAE;QAEX;;;WAGG;QACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC;QAE5D;;WAEG;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,OAAO,CAAC,+BAA+B,CAAC;aACxC,OAAO,CAAC,OAAO,CAAC;QAEnB;;WAEG;QACH,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;aACxB,OAAO,CAAC,6CAA6C,CAAC;aACtD,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;QAE7B;;WAEG;QACH,YAAY,EAAE,CAAC;aACZ,QAAQ,EAAE;aACV,OAAO,CAAC,wCAAwC,CAAC;aACjD,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;QAEhB;;WAEG;QACH,cAAc,EAAE,CAAC;aACd,QAAQ,EAAE;aACV,OAAO,CAAC,2CAA2C,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;QAEhB;;WAEG;QACH,UAAU,EAAE,CAAC;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,gCAAgC,CAAC;aACzC,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;QAEhB;;WAEG;QACH,UAAU,EAAE,CAAC;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,6CAA6C,CAAC;aACtD,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;KACjB,CAAC;IACF,OAAO,EAAE;QACP;YACE,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,CAAC,QAAQ,CAAC;SACvB;KACF;CACF,CAAC,CAAC;AAIH,MAAM,OAAO,YAAa,SAAQ,kBAAkB,CAAC,KAAK;IACxD;;OAEG;IACH,iBAAiB;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YACnC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CACtC,CAAC;IACJ,CAAC;CACF;AAED,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC"}