@tstdl/base 0.92.123 → 0.92.124

package/types/authentication/authentication.api.d.ts

@@ -0,0 +1,293 @@
+import { type ApiDefinition, type ApiEndpointsDefinition } from '../../api/types.js';
+import { type ObjectSchema, type ObjectSchemaOrType } from '../../schema/index.js';
+import type { SchemaTestable } from '../../schema/schema.js';
+import type { Record } from '../../types.js';
+import type { TokenPayload } from './index.js';
+import { SecretCheckResult } from './models/secret-check-result.model.js';
+export declare const dontWaitForValidToken: unique symbol;
+type GetAuthenticationApiEndpointsDefinition<AdditionalTokenPayload extends Record = Record<never>, AuthenticationData = void, AdditionalInitSecretResetData = void> = typeof getAuthenticationApiEndpointsDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>;
+type AuthenticationApiEndpointsDefinition<AdditionalTokenPayload extends Record = Record<never>, AuthenticationData = void, AdditionalInitSecretResetData = void> = ReturnType<GetAuthenticationApiEndpointsDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>>;
+export type AuthenticationApiDefinition<AdditionalTokenPayload extends Record = Record<never>, AuthenticationData = void, AdditionalInitSecretResetData = void> = ApiDefinition<string, AuthenticationApiEndpointsDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>>;
+export declare const authenticationApiDefinition: {
+    resource: string;
+    endpoints: {
+        getToken: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly secret: string;
+                readonly data: undefined;
+            }>;
+            result: ObjectSchema<TokenPayload<import("type-fest").EmptyObject>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        refresh: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly data: undefined;
+            }>;
+            result: ObjectSchema<TokenPayload<import("type-fest").EmptyObject>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        impersonate: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly data: undefined;
+            }>;
+            result: ObjectSchema<TokenPayload<import("type-fest").EmptyObject>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        unimpersonate: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly data: undefined;
+            }>;
+            result: ObjectSchema<TokenPayload<import("type-fest").EmptyObject>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        endSession: {
+            resource: string;
+            method: "POST";
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        initSecretReset: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly data: undefined;
+            }>;
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+        };
+        resetSecret: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                token: string;
+                newSecret: string;
+            }>;
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+        };
+        checkSecret: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                secret: string;
+            }>;
+            result: typeof SecretCheckResult;
+        };
+        timestamp: {
+            resource: string;
+            result: import("../../schema/index.js").NumberSchema;
+        };
+    };
+};
+export declare function getAuthenticationApiDefinition<AdditionalTokenPayload extends Record, AuthenticationData, AdditionalInitSecretResetData, AdditionalEndpoints extends ApiEndpointsDefinition>(additionalTokenPayloadSchema: ObjectSchemaOrType<AdditionalTokenPayload>, authenticationDataSchema: SchemaTestable<AuthenticationData>, initSecretResetDataSchema: SchemaTestable<AdditionalInitSecretResetData>, resource?: string, additionalEndpoints?: AdditionalEndpoints): {
+    resource: string;
+    endpoints: {
+        getToken: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly secret: string;
+                readonly data: AuthenticationData;
+            }>;
+            result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        refresh: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly data: AuthenticationData;
+            }>;
+            result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        impersonate: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly data: AuthenticationData;
+            }>;
+            result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        unimpersonate: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly data: AuthenticationData;
+            }>;
+            result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        endSession: {
+            resource: string;
+            method: "POST";
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+            credentials: true;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
+        };
+        initSecretReset: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                readonly subject: string;
+                readonly data: AdditionalInitSecretResetData;
+            }>;
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+        };
+        resetSecret: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                token: string;
+                newSecret: string;
+            }>;
+            result: import("../../schema/index.js").LiteralSchema<"ok">;
+        };
+        checkSecret: {
+            resource: string;
+            method: "POST";
+            parameters: ObjectSchema<{
+                secret: string;
+            }>;
+            result: typeof SecretCheckResult;
+        };
+        timestamp: {
+            resource: string;
+            result: import("../../schema/index.js").NumberSchema;
+        };
+    };
+};
+export declare function getAuthenticationApiEndpointsDefinition<AdditionalTokenPayload extends Record, AuthenticationData, AdditionalInitSecretResetData>(additionalTokenPayloadSchema: ObjectSchemaOrType<AdditionalTokenPayload>, authenticationDataSchema: SchemaTestable<AuthenticationData>, additionalInitSecretResetDataSchema: SchemaTestable<AdditionalInitSecretResetData>): {
+    getToken: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            readonly subject: string;
+            readonly secret: string;
+            readonly data: AuthenticationData;
+        }>;
+        result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+        credentials: true;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
+    };
+    refresh: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            readonly data: AuthenticationData;
+        }>;
+        result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+        credentials: true;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
+    };
+    impersonate: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            readonly subject: string;
+            readonly data: AuthenticationData;
+        }>;
+        result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+        credentials: true;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
+    };
+    unimpersonate: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            readonly data: AuthenticationData;
+        }>;
+        result: ObjectSchema<TokenPayload<AdditionalTokenPayload>>;
+        credentials: true;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
+    };
+    endSession: {
+        resource: string;
+        method: "POST";
+        result: import("../../schema/index.js").LiteralSchema<"ok">;
+        credentials: true;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
+    };
+    initSecretReset: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            readonly subject: string;
+            readonly data: AdditionalInitSecretResetData;
+        }>;
+        result: import("../../schema/index.js").LiteralSchema<"ok">;
+    };
+    resetSecret: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            token: string;
+            newSecret: string;
+        }>;
+        result: import("../../schema/index.js").LiteralSchema<"ok">;
+    };
+    checkSecret: {
+        resource: string;
+        method: "POST";
+        parameters: ObjectSchema<{
+            secret: string;
+        }>;
+        result: typeof SecretCheckResult;
+    };
+    timestamp: {
+        resource: string;
+        result: import("../../schema/index.js").NumberSchema;
+    };
+};
+export {};

package/types/authentication/client/api.client.d.ts

@@ -0,0 +1,9 @@
+import { type ApiClient } from '../../../api/client/index.js';
+import { type ObjectSchemaOrType, type SchemaTestable } from '../../../schema/index.js';
+import type { Record } from '../../../types.js';
+import { type AuthenticationApiDefinition } from '../authentication.api.js';
+export declare function getAuthenticationApiClient<AdditionalTokenPayload extends Record, AuthenticationData, AdditionalInitSecretResetData>(additionalTokenPayloadSchema: ObjectSchemaOrType<AdditionalTokenPayload>, authenticationDataSchema: SchemaTestable<AuthenticationData>, additionalInitSecretResetData: SchemaTestable<AdditionalInitSecretResetData>): ApiClient<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>>;
+declare const defaultAuthenticationApiClient: ApiClient<AuthenticationApiDefinition<import("type-fest").EmptyObject, unknown, import("type-fest").EmptyObject>>;
+export declare class AuthenticationApiClient extends defaultAuthenticationApiClient {
+}
+export {};

package/types/authentication/client/authentication.service.d.ts

@@ -0,0 +1,61 @@
+import type { AsyncDisposable } from '../../../disposable/index.js';
+import { disposeAsync } from '../../../disposable/index.js';
+import type { AfterResolve } from '../../../injector/index.js';
+import { afterResolve } from '../../../injector/index.js';
+import type { Record } from '../../../types.js';
+import type { SecretCheckResult, TokenPayload } from '../models/index.js';
+export declare class AuthenticationClientService<AdditionalTokenPayload extends Record = Record, AuthenticationData = any, AdditionalInitSecretResetData = void> implements AfterResolve, AsyncDisposable {
+    private readonly client;
+    private readonly errorSubject;
+    private readonly tokenUpdateBus;
+    private readonly loggedOutBus;
+    private readonly forceRefreshToken;
+    private readonly lock;
+    private readonly logger;
+    private readonly disposeToken;
+    readonly error$: import("rxjs").Observable<Error>;
+    readonly token: import("../../../signals/api.js").WritableSignal<TokenPayload<AdditionalTokenPayload> | undefined>;
+    readonly isLoggedIn: import("../../../signals/api.js").Signal<boolean>;
+    readonly subject: import("../../../signals/api.js").Signal<string | undefined>;
+    readonly sessionId: import("../../../signals/api.js").Signal<string | undefined>;
+    readonly impersonator: import("../../../signals/api.js").Signal<string | undefined>;
+    readonly impersonated: import("../../../signals/api.js").Signal<boolean>;
+    readonly token$: import("rxjs").Observable<TokenPayload<AdditionalTokenPayload> | undefined>;
+    readonly definedToken$: import("rxjs").Observable<Exclude<TokenPayload<AdditionalTokenPayload>, void | undefined>>;
+    readonly validToken$: import("rxjs").Observable<Exclude<TokenPayload<AdditionalTokenPayload>, void | undefined>>;
+    readonly subject$: import("rxjs").Observable<string | undefined>;
+    readonly definedSubject$: import("rxjs").Observable<string>;
+    readonly sessionId$: import("rxjs").Observable<string | undefined>;
+    readonly definedSessionId$: import("rxjs").Observable<string>;
+    readonly isLoggedIn$: import("rxjs").Observable<boolean>;
+    readonly loggedOut$: import("rxjs").Observable<void>;
+    private get authenticationData();
+    private set authenticationData(value);
+    private get impersonatorAuthenticationData();
+    private set impersonatorAuthenticationData(value);
+    get definedToken(): TokenPayload<AdditionalTokenPayload>;
+    get definedSubject(): string;
+    get definedSessionId(): string;
+    get hasValidToken(): boolean;
+    constructor(initialAuthenticationData: AuthenticationData | undefined);
+    [afterResolve](): void;
+    initialize(): void;
+    [disposeAsync](): Promise<void>;
+    dispose(): Promise<void>;
+    setAdditionalData(data: AuthenticationData): void;
+    login(subject: string, secret: string, data?: AuthenticationData): Promise<void>;
+    logout(): Promise<void>;
+    requestRefresh(data?: AuthenticationData): void;
+    refresh(data?: AuthenticationData): Promise<void>;
+    impersonate(subject: string, data?: AuthenticationData): Promise<void>;
+    unimpersonate(data?: AuthenticationData): Promise<void>;
+    initResetSecret(subject: string, data: AdditionalInitSecretResetData): Promise<void>;
+    resetSecret(token: string, newSecret: string): Promise<void>;
+    checkSecret(secret: string): Promise<SecretCheckResult>;
+    private saveToken;
+    private loadToken;
+    private setNewToken;
+    private refreshLoop;
+    private refreshLoopIteration;
+    private handleRefreshError;
+}

package/types/authentication/client/http-client.middleware.d.ts

@@ -0,0 +1,4 @@
+import type { HttpClientMiddleware } from '../../../http/client/middleware.js';
+import { type ValueOrAsyncProvider } from '../../../utils/value-or-provider.js';
+import type { AuthenticationClientService } from './authentication.service.js';
+export declare function waitForAuthenticationCredentialsMiddleware(authenticationServiceOrProvider: ValueOrAsyncProvider<AuthenticationClientService>): HttpClientMiddleware;

package/types/authentication/client/module.d.ts

@@ -0,0 +1,10 @@
+import type { ApiClientImplementation } from '../../../api/index.js';
+import { Injector } from '../../../injector/injector.js';
+import type { Type } from '../../../types.js';
+import type { AuthenticationApiDefinition } from '../authentication.api.js';
+export type AuthenticationClientModuleConfig = {
+    authenticationApiClient?: Type<ApiClientImplementation<AuthenticationApiDefinition<any, any, any>>>;
+    initialAuthenticationData?: unknown;
+    registerMiddleware?: boolean;
+};
+export declare function configureAuthenticationClient(config: AuthenticationClientModuleConfig, injector?: Injector | null): void;

package/types/authentication/client/tokens.d.ts

@@ -0,0 +1,4 @@
+import type { ApiClientImplementation } from '../../../api/index.js';
+import type { AuthenticationApiDefinition } from '../authentication.api.js';
+export declare const AUTHENTICATION_API_CLIENT: import("../../../injector/token.js").InjectionToken<ApiClientImplementation<AuthenticationApiDefinition<any, any, any>>, never>;
+export declare const INITIAL_AUTHENTICATION_DATA: import("../../../injector/token.js").InjectionToken<unknown, never>;

package/types/authentication/errors/secret-requirements.error.d.ts

@@ -0,0 +1,5 @@
+import { CustomError } from '../../../errors/custom.error.js';
+export declare class SecretRequirementsError extends CustomError {
+    static readonly errorName = "SecretRequirementsError";
+    constructor(message?: string);
+}

package/types/authentication/models/authentication-credentials.model.d.ts

@@ -0,0 +1,7 @@
+import { Entity } from '../../../orm/index.js';
+export declare class AuthenticationCredentials extends Entity {
+    subject: string;
+    hashVersion: number;
+    salt: Uint8Array;
+    hash: Uint8Array;
+}

package/types/authentication/models/authentication-session.model.d.ts

@@ -0,0 +1,10 @@
+import { Entity } from '../../../orm/entity.js';
+import { Timestamp } from '../../../orm/types.js';
+export declare class AuthenticationSession extends Entity {
+    subject: string;
+    begin: Timestamp;
+    end: Timestamp;
+    refreshTokenHashVersion: number;
+    refreshTokenSalt: Uint8Array;
+    refreshTokenHash: Uint8Array;
+}

package/types/authentication/models/schemas.d.ts

@@ -0,0 +1,5 @@
+import { AuthenticationCredentials } from './authentication-credentials.model.js';
+import { AuthenticationSession } from './authentication-session.model.js';
+export declare const authenticationSchema: import("../../../orm/server/database-schema.js").DatabaseSchema<"authentication">;
+export declare const authenticationCredentials: import("../../orm/server/types.js").PgTableFromType<typeof AuthenticationCredentials, "authentication">;
+export declare const authenticationSession: import("../../orm/server/types.js").PgTableFromType<typeof AuthenticationSession, "authentication">;

package/types/authentication/models/secret-check-result.model.d.ts

@@ -0,0 +1,3 @@
+import { PasswordCheckResult } from '../../../password/password-check-result.model.js';
+export declare class SecretCheckResult extends PasswordCheckResult {
+}

package/types/authentication/models/token.model.d.ts

@@ -0,0 +1,20 @@
+import type { Record } from '../../../types.js';
+import type { JwtToken, JwtTokenHeader } from '../../../utils/jwt.js';
+import type { TokenPayloadBase } from './token-payload-base.model.js';
+export type TokenHeader = {
+    v: number;
+};
+export type Token<AdditionalTokenPayload extends Record = Record<never>> = JwtToken<TokenPayload<AdditionalTokenPayload>, JwtTokenHeader<TokenHeader>>;
+export type TokenPayload<T extends Record = Record<never>> = T & TokenPayloadBase;
+export type RefreshToken = JwtToken<{
+    /** expiration timestamp in seconds */
+    exp: number;
+    subject: string;
+    impersonator?: string;
+    sessionId: string;
+    secret: string;
+}>;
+export type SecretResetToken = JwtToken<{
+    exp: number;
+    subject: string;
+}>;

package/types/authentication/server/authentication-ancillary.service.d.ts

@@ -0,0 +1,27 @@
+import { type EnumType } from '../../../enumeration/enumeration.js';
+import type { Record } from '../../../types.js';
+import type { TokenPayload } from '../index.js';
+import type { InitSecretResetData } from '../models/init-secret-reset-data.model.js';
+export declare const GetTokenPayloadContextAction: {
+    readonly GetToken: "get-token";
+    readonly Refresh: "refresh";
+};
+export type GetTokenPayloadContextAction = EnumType<typeof GetTokenPayloadContextAction>;
+export type GetTokenPayloadContext = {
+    action: GetTokenPayloadContextAction;
+};
+export declare abstract class AuthenticationAncillaryService<AdditionalTokenPayload extends Record = Record<never>, AuthenticationData = void, AdditionalInitSecretResetData = void> {
+    /**
+     * Resolve a provided subject to the actual subject used for authentication.
+     * Useful for example if you want to be able to login via mail but actual subject is the user id.
+     */
+    abstract resolveSubject(providedSubject: string): string | Promise<string>;
+    abstract getTokenPayload(subject: string, authenticationData: AuthenticationData, context: GetTokenPayloadContext): AdditionalTokenPayload | Promise<AdditionalTokenPayload>;
+    abstract handleInitSecretReset(data: InitSecretResetData & AdditionalInitSecretResetData): void | Promise<void>;
+    /**
+     * Check if token is allowed to impersonate subject
+     * @param token Token which tries to impersonate
+     * @param subject Subject to impersonate
+     */
+    abstract canImpersonate(token: TokenPayload<AdditionalTokenPayload>, subject: string, authenticationData: AuthenticationData): boolean | Promise<boolean>;
+}

package/types/authentication/server/authentication-api-request-token.provider.d.ts

@@ -0,0 +1,8 @@
+import type { ApiRequestData } from '../../../api/index.js';
+import { ApiRequestTokenProvider } from '../../../api/server/api-request-token.provider.js';
+import { AuthenticationService } from './authentication.service.js';
+export declare class AuthenticationApiRequestTokenProvider extends ApiRequestTokenProvider {
+    private readonly authenticationService;
+    constructor(authenticationService: AuthenticationService);
+    getToken<T>(data: ApiRequestData): Promise<T>;
+}

package/types/authentication/server/authentication.api-controller.d.ts

@@ -0,0 +1,23 @@
+import type { ApiController, ApiRequestContext, ApiServerResult } from '../../../api/types.js';
+import { HttpServerResponse } from '../../../http/server/index.js';
+import type { ObjectSchemaOrType, SchemaTestable } from '../../../schema/index.js';
+import type { Record, Type } from '../../../types.js';
+import type { AuthenticationApiDefinition } from '../authentication.api.js';
+import type { TokenResult } from './authentication.service.js';
+import { AuthenticationService } from './authentication.service.js';
+export declare class AuthenticationApiController<AdditionalTokenPayload extends Record, AuthenticationData, AdditionalInitSecretResetData = void> implements ApiController<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>> {
+    readonly authenticationService: AuthenticationService<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>;
+    constructor(authenticationService: AuthenticationService<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>);
+    getToken({ parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'getToken'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'getToken'>>;
+    refresh({ request, parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'refresh'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'refresh'>>;
+    impersonate({ request, parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'impersonate'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'impersonate'>>;
+    unimpersonate({ request, parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'unimpersonate'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'unimpersonate'>>;
+    endSession({ request }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'endSession'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'endSession'>>;
+    initSecretReset({ parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'initSecretReset'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'initSecretReset'>>;
+    resetSecret({ parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'resetSecret'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'resetSecret'>>;
+    checkSecret({ parameters }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'checkSecret'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'checkSecret'>>;
+    timestamp(): ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>, 'timestamp'>;
+    protected getTokenResponse({ token, jsonToken, refreshToken, omitImpersonatorRefreshToken, impersonatorRefreshToken, impersonatorRefreshTokenExpiration }: TokenResult<AdditionalTokenPayload>): HttpServerResponse;
+}
+export declare function getAuthenticationApiController<AdditionalTokenPayload extends Record, AuthenticationData, AdditionalInitSecretResetData = void>(// eslint-disable-line @typescript-eslint/explicit-function-return-type
+additionalTokenPayloadSchema: ObjectSchemaOrType<AdditionalTokenPayload>, authenticationDataSchema: SchemaTestable<AuthenticationData>, additionalInitSecretResetData: SchemaTestable<AdditionalInitSecretResetData>): Type<AuthenticationApiController<AdditionalTokenPayload, AuthenticationData, AdditionalInitSecretResetData>>;

package/types/authentication/server/authentication.service.d.ts

@@ -0,0 +1,110 @@
+import { type AfterResolve, afterResolve } from '../../../injector/index.js';
+import type { BinaryData, Record } from '../../../types.js';
+import { type RefreshToken, type SecretCheckResult, type SecretResetToken, type Token } from '../models/index.js';
+import { type SecretTestResult } from './authentication-secret-requirements.validator.js';
+export type CreateTokenData<AdditionalTokenPayload extends Record> = {
+    tokenVersion?: number;
+    jwtId?: string;
+    issuedAt?: number;
+    expiration?: number;
+    additionalTokenPayload: AdditionalTokenPayload;
+    subject: string;
+    sessionId: string;
+    impersonator: string | undefined;
+    refreshTokenExpiration: number;
+    timestamp?: number;
+};
+export declare class AuthenticationServiceOptions {
+    /**
+     * Secrets used for signing tokens and refreshTokens
+     * If single secret is provided, multiple secrets are derived internally
+     */
+    secret: string | BinaryData | {
+        tokenSigningSecret: Uint8Array;
+        refreshTokenSigningSecret: Uint8Array;
+        secretResetTokenSigningSecret: Uint8Array;
+    };
+    /** Token version, forces refresh on mismatch (useful if payload changes) */
+    version?: number;
+    /** How long a token is valid */
+    tokenTimeToLive?: number;
+    /** How long a refresh token is valid. Implies session time to live. */
+    refreshTokenTimeToLive?: number;
+    /** How long a secret reset token is valid. */
+    secretResetTokenTimeToLive?: number;
+}
+export type AuthenticationResult = {
+    success: true;
+    subject: string;
+} | {
+    success: false;
+    subject?: undefined;
+};
+export type TokenResult<AdditionalTokenPayload extends Record> = {
+    token: string;
+    jsonToken: Token<AdditionalTokenPayload>;
+    refreshToken: string;
+    omitImpersonatorRefreshToken?: boolean;
+    impersonatorRefreshToken?: string;
+    impersonatorRefreshTokenExpiration?: number;
+};
+export type SetCredentialsOptions = {
+    /** skip validation for password strength */
+    skipValidation?: boolean;
+};
+type CreateTokenResult<AdditionalTokenPayload extends Record> = {
+    token: string;
+    jsonToken: Token<AdditionalTokenPayload>;
+};
+type CreateRefreshTokenResult = {
+    token: string;
+    jsonToken: RefreshToken;
+    salt: Uint8Array;
+    hash: Uint8Array;
+};
+export declare class AuthenticationService<AdditionalTokenPayload extends Record = Record<never>, AuthenticationData = void, AdditionalInitSecretResetData = void> implements AfterResolve {
+    private readonly credentialsRepository;
+    private readonly sessionRepository;
+    private readonly authenticationSecretRequirementsValidator;
+    private readonly authenticationAncillaryService;
+    private readonly options;
+    private readonly tokenVersion;
+    private readonly tokenTimeToLive;
+    private readonly refreshTokenTimeToLive;
+    private readonly secretResetTokenTimeToLive;
+    private derivedTokenSigningSecret;
+    private derivedRefreshTokenSigningSecret;
+    private derivedSecretResetTokenSigningSecret;
+    [afterResolve](): Promise<void>;
+    initialize(): Promise<void>;
+    setCredentials(subject: string, secret: string, options?: SetCredentialsOptions): Promise<void>;
+    authenticate(subject: string, secret: string): Promise<AuthenticationResult>;
+    getToken(subject: string, authenticationData: AuthenticationData, { impersonator }?: {
+        impersonator?: string;
+    }): Promise<TokenResult<AdditionalTokenPayload>>;
+    endSession(sessionId: string): Promise<void>;
+    refresh(refreshToken: string, authenticationData: AuthenticationData, { omitImpersonator }?: {
+        omitImpersonator?: boolean;
+    }): Promise<TokenResult<AdditionalTokenPayload>>;
+    impersonate(impersonatorRoken: string, impersonatorRefreshToken: string, subject: string, authenticationData: AuthenticationData): Promise<TokenResult<AdditionalTokenPayload>>;
+    unimpersonate(impersonatorRefreshToken: string, authenticationData: AuthenticationData): Promise<TokenResult<AdditionalTokenPayload>>;
+    initSecretReset(subject: string, data: AdditionalInitSecretResetData): Promise<void>;
+    resetSecret(tokenString: string, newSecret: string): Promise<void>;
+    checkSecret(secret: string): Promise<SecretCheckResult>;
+    testSecret(secret: string): Promise<SecretTestResult>;
+    validateSecret(secret: string): Promise<void>;
+    validateToken(token: string): Promise<Token<AdditionalTokenPayload>>;
+    validateRefreshToken(token: string): Promise<RefreshToken>;
+    validateSecretResetToken(token: string): Promise<SecretResetToken>;
+    resolveSubject(subject: string): Promise<string>;
+    /** Creates a token without session or refresh token and is not saved in database */
+    createToken({ tokenVersion, jwtId, issuedAt, expiration, additionalTokenPayload, subject, sessionId, refreshTokenExpiration, impersonator: impersonatedBy, timestamp }: CreateTokenData<AdditionalTokenPayload>): Promise<CreateTokenResult<AdditionalTokenPayload>>;
+    /** Creates a refresh token without session or something else. */
+    createRefreshToken(subject: string, sessionId: string, expirationTimestamp: number, options?: {
+        impersonator?: string;
+    }): Promise<CreateRefreshTokenResult>;
+    private createSecretResetToken;
+    private deriveSigningSecrets;
+    private getHash;
+}
+export {};

package/types/authentication/server/helper.d.ts

@@ -0,0 +1,15 @@
+import type { HttpServerRequest } from '../../../http/server/index.js';
+import type { BinaryData, Record } from '../../../types.js';
+import type { RefreshToken, SecretResetToken, Token } from '../models/index.js';
+/**
+ *
+ * @param request
+ * @param cookieName (default "authorization")
+ * @returns token string
+ */
+export declare function tryGetAuthorizationTokenStringFromRequest(request: HttpServerRequest, cookieName?: string, fromCookieOnly?: boolean): string | undefined;
+export declare function tryGetTokenFromRequest<AdditionalTokenPayload extends Record = Record<never>>(request: HttpServerRequest, tokenVersion: number, secret: string | BinaryData): Promise<Token<AdditionalTokenPayload> | undefined>;
+export declare function getTokenFromRequest<AdditionalTokenPayload extends Record = Record<never>>(request: HttpServerRequest, tokenVersion: number, secret: string | BinaryData): Promise<Token<AdditionalTokenPayload>>;
+export declare function getTokenFromString<AdditionalTokenPayload extends Record = Record<never>>(tokenString: string, tokenVersion: number, secret: string | BinaryData): Promise<Token<AdditionalTokenPayload>>;
+export declare function getRefreshTokenFromString(tokenString: string, secret: string | BinaryData): Promise<RefreshToken>;
+export declare function getSecretResetTokenFromString(tokenString: string, secret: string | BinaryData): Promise<SecretResetToken>;