@tstdl/base 0.93.87 → 0.93.89

package/authentication/server/authentication.audit.d.ts

@@ -5,7 +5,7 @@ export type AuthenticationAuditEvents = {
     };
     'login-failure': {
         subjectInput: SubjectInput;
-        subjectId: string | null;
+        resolvedSubjectId: string | null;
     };
     'logout': {
         sessionId: string;
@@ -27,11 +27,12 @@ export type AuthenticationAuditEvents = {
     'change-secret-success': {};
     'change-secret-failure': {
         subjectInput: SubjectInput;
-        subjectId: string | null;
+        resolvedSubjectId: string | null;
     };
     'init-secret-reset': {};
     'reset-secret-success': {};
     'reset-secret-failure': {
         reason: string;
     };
+    'invalidate-all-sessions': {};
 };

package/authentication/server/authentication.service.d.ts

@@ -1,7 +1,7 @@
 import { Auditor } from '../../audit/index.js';
 import { afterResolve, type AfterResolve } from '../../injector/index.js';
 import type { BinaryData, Record } from '../../types/index.js';
-import { Subject, type RefreshToken, type SecretCheckResult, type SecretResetToken, type Token } from '../models/index.js';
+import { AuthenticationSession, Subject, type RefreshToken, type SecretCheckResult, type SecretResetToken, type Token } from '../models/index.js';
 import type { SubjectInput } from '../types.js';
 import { type SecretTestResult } from './authentication-secret-requirements.validator.js';
 /**
@@ -202,6 +202,32 @@ export declare class AuthenticationService<AdditionalTokenPayload extends Record
      * @param auditor Auditor for auditing.
      */
     endSession(sessionId: string, auditor: Auditor): Promise<void>;
+    /**
+     * Invalidates all sessions for a subject.
+     * @param tenantId The tenant id of the subject.
+     * @param subjectId The id of the subject.
+     * @param auditor Auditor for auditing.
+     */
+    invalidateAllSessions(tenantId: string, subjectId: string, auditor: Auditor): Promise<void>;
+    /**
+     * Lists all sessions for a subject.
+     * @param tenantId The tenant id of the subject.
+     * @param subjectId The id of the subject.
+     * @returns List of sessions.
+     */
+    listSessions(tenantId: string, subjectId: string): Promise<AuthenticationSession[]>;
+    /**
+     * Gets a session.
+     * @param sessionId The id of the session.
+     * @returns The session.
+     */
+    getSession(sessionId: string): Promise<AuthenticationSession>;
+    /**
+     * Tries to get a session.
+     * @param sessionId The id of the session.
+     * @returns The session or undefined if not found.
+     */
+    tryGetSession(sessionId: string): Promise<AuthenticationSession | undefined>;
     /**
      * Refreshes a token.
      * @param refreshToken The refresh token to use.

package/authentication/server/authentication.service.js

@@ -15,8 +15,8 @@ import { NotImplementedError } from '../../errors/not-implemented.error.js';
 import { afterResolve, inject, provide, Singleton } from '../../injector/index.js';
 import { KeyValueStore } from '../../key-value-store/key-value.store.js';
 import { Logger } from '../../logger/logger.js';
+import { TRANSACTION_TIMESTAMP } from '../../orm/index.js';
 import { DatabaseConfig, injectRepository } from '../../orm/server/index.js';
-import { getEntityIds } from '../../orm/utils.js';
 import { Alphabet } from '../../utils/alphabet.js';
 import { asyncHook } from '../../utils/async-hook/async-hook.js';
 import { decodeBase64, encodeBase64 } from '../../utils/base64.js';
@@ -24,6 +24,7 @@ import { deriveBytesMultiple, importPbkdf2Key } from '../../utils/cryptography.j
 import { currentTimestamp, timestampToTimestampSeconds } from '../../utils/date-time.js';
 import { timingSafeBinaryEquals } from '../../utils/equals.js';
 import { createJwtTokenString } from '../../utils/jwt.js';
+import { isUuid } from '../../utils/patterns.js';
 import { getRandomBytes, getRandomString } from '../../utils/random.js';
 import { isBinaryData, isDefined, isString, isUndefined } from '../../utils/type-guards.js';
 import { millisecondsPerDay, millisecondsPerMinute } from '../../utils/units.js';
@@ -227,10 +228,11 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         if (!authenticationResult.success) {
             const actualSubject = await this.tryResolveSubject(subjectInput);
             await authAuditor.warn('login-failure', {
+                actorType: ActorType.Anonymous,
                 tenantId: actualSubject?.tenantId ?? subjectInput.tenantId,
                 targetId: actualSubject?.id ?? NIL_UUID,
                 targetType: 'User',
-                details: { subjectInput, subjectId: actualSubject?.id ?? null },
+                details: { subjectInput, resolvedSubjectId: actualSubject?.id ?? null },
             });
             throw new InvalidCredentialsError();
         }
@@ -241,7 +243,7 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         await authAuditor.info('login-success', {
             tenantId: authenticationResult.subject.tenantId,
             actor: authenticationResult.subject.id,
-            actorType: ActorType.User,
+            actorType: ActorType.Subject,
             targetId: authenticationResult.subject.id,
             targetType: 'User',
             network: { sessionId },
@@ -266,12 +268,54 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         await authAuditor.info('logout', {
             tenantId: session.tenantId,
             actor: session.subjectId,
-            actorType: ActorType.User,
+            actorType: ActorType.Subject,
             targetId: session.subjectId,
             targetType: 'User',
             details: { sessionId },
         });
     }
+    /**
+     * Invalidates all sessions for a subject.
+     * @param tenantId The tenant id of the subject.
+     * @param subjectId The id of the subject.
+     * @param auditor Auditor for auditing.
+     */
+    async invalidateAllSessions(tenantId, subjectId, auditor) {
+        const authAuditor = auditor.fork(AuthenticationService_1.name);
+        await this.#sessionRepository.updateManyByQuery({ tenantId, subjectId, end: { $gt: TRANSACTION_TIMESTAMP } }, { end: TRANSACTION_TIMESTAMP });
+        await authAuditor.info('invalidate-all-sessions', {
+            tenantId,
+            actor: subjectId,
+            actorType: ActorType.Subject,
+            targetId: subjectId,
+            targetType: 'User',
+        });
+    }
+    /**
+     * Lists all sessions for a subject.
+     * @param tenantId The tenant id of the subject.
+     * @param subjectId The id of the subject.
+     * @returns List of sessions.
+     */
+    async listSessions(tenantId, subjectId) {
+        return await this.#sessionRepository.loadManyByQuery({ tenantId, subjectId });
+    }
+    /**
+     * Gets a session.
+     * @param sessionId The id of the session.
+     * @returns The session.
+     */
+    async getSession(sessionId) {
+        return await this.#sessionRepository.load(sessionId);
+    }
+    /**
+     * Tries to get a session.
+     * @param sessionId The id of the session.
+     * @returns The session or undefined if not found.
+     */
+    async tryGetSession(sessionId) {
+        return await this.#sessionRepository.tryLoad(sessionId);
+    }
     /**
      * Refreshes a token.
      * @param refreshToken The refresh token to use.
@@ -283,10 +327,11 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
      */
     async refresh(refreshToken, authenticationData, options = {}, auditor) {
         const authAuditor = auditor.fork(AuthenticationService_1.name);
+        let session;
         try {
             const validatedRefreshToken = await this.validateRefreshToken(refreshToken);
             const sessionId = validatedRefreshToken.payload.session;
-            const session = await this.#sessionRepository.load(sessionId);
+            session = await this.#sessionRepository.load(sessionId);
             const hash = await this.getHash(validatedRefreshToken.payload.secret, session.refreshTokenSalt);
             if (session.end <= currentTimestamp()) {
                 throw new InvalidTokenError('Session is expired.');
@@ -294,7 +339,9 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
             if (!timingSafeBinaryEquals(hash, session.refreshTokenHash)) {
                 await this.endSession(sessionId, auditor);
                 await authAuditor.warn('refresh-failure', {
-                    targetId: session.tenantId,
+                    actorType: ActorType.Anonymous,
+                    tenantId: session.tenantId,
+                    targetId: session.subjectId,
                     targetType: 'User',
                     details: { sessionId, reason: 'Token reuse detected. Session revoked.' },
                 });
@@ -316,7 +363,7 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
             await authAuditor.info('refresh-success', {
                 tenantId: session.tenantId,
                 actor: session.subjectId,
-                actorType: ActorType.User,
+                actorType: ActorType.Subject,
                 targetId: session.subjectId,
                 targetType: 'User',
                 details: { sessionId },
@@ -325,7 +372,8 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         }
         catch (error) {
             await authAuditor.warn('refresh-failure', {
-                targetId: NIL_UUID,
+                actorType: ActorType.Anonymous,
+                targetId: session?.subjectId ?? NIL_UUID,
                 targetType: 'User',
                 details: { sessionId: null, reason: error.message },
             });
@@ -353,7 +401,7 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
                 outcome: AuditOutcome.Denied,
                 tenantId: impersonatorSubject.tenantId,
                 actor: impersonatorSubject.id,
-                actorType: ActorType.User,
+                actorType: ActorType.Subject,
                 targetId: subjectId,
                 targetType: 'User',
                 details: { impersonatedSubjectId: subjectId },
@@ -365,9 +413,9 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         await authAuditor.info('impersonate-success', {
             tenantId: subject.tenantId,
             actor: validatedImpersonatorToken.payload.subject,
-            actorType: ActorType.User,
+            actorType: ActorType.Subject,
             impersonator: validatedImpersonatorToken.payload.subject,
-            impersonatorType: ActorType.User,
+            impersonatorType: ActorType.Subject,
             targetId: tokenResult.jsonToken.payload.subject,
             targetType: 'User',
             details: { impersonatedSubjectId: subjectId },
@@ -391,9 +439,9 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         await authAuditor.info('unimpersonate-success', {
             tenantId: tokenResult.jsonToken.payload.tenant,
             actor: tokenResult.jsonToken.payload.subject,
-            actorType: ActorType.User,
+            actorType: ActorType.Subject,
             targetId: tokenResult.jsonToken.payload.subject,
-            impersonatorType: ActorType.User,
+            impersonatorType: ActorType.Subject,
             impersonator: tokenResult.jsonToken.payload.impersonator,
             targetType: 'User',
         });
@@ -447,10 +495,11 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         if (!authenticationResult.success) {
             const resolvedSubject = await this.tryResolveSubject(subjectInput);
             await authAuditor.warn('change-secret-failure', {
+                actorType: ActorType.Anonymous,
                 tenantId: resolvedSubject?.tenantId,
                 targetId: resolvedSubject?.id ?? NIL_UUID,
                 targetType: 'User',
-                details: { subjectInput, subjectId: resolvedSubject?.id ?? null },
+                details: { subjectInput, resolvedSubjectId: resolvedSubject?.id ?? null },
             });
             throw new InvalidCredentialsError();
         }
@@ -459,6 +508,8 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         await this.hooks.afterChangeSecret.trigger({ subject: authenticationResult.subject });
         await authAuditor.info('change-secret-success', {
             tenantId: authenticationResult.subject.tenantId,
+            actor: authenticationResult.subject.id,
+            actorType: ActorType.Subject,
             targetId: authenticationResult.subject.id,
             targetType: 'User',
         });
@@ -660,12 +711,10 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
     }
     async defaultResolveSubjects({ tenantId, subject }) {
         const [subjectsById, usersByMail] = await Promise.all([
-            this.#subjectRepository.loadManyByQuery({ tenantId, id: subject }),
+            isUuid(subject) ? this.#subjectRepository.loadManyByQuery({ tenantId, id: subject }) : Promise.resolve([]),
             this.#userRepository.loadManyByQuery({ tenantId, email: subject }),
         ]);
-        const userIds = getEntityIds(usersByMail);
-        const subjectsByUser = (userIds.length == 0) ? [] : await this.#subjectRepository.loadManyByQuery({ tenantId, userId: { $in: userIds } });
-        return [...subjectsById, ...subjectsByUser];
+        return [...subjectsById, ...usersByMail];
     }
     async defaultResolveSubject({ tenantId, subject }) {
         const subjects = await this.defaultResolveSubjects({ tenantId, subject });

package/authentication/server/drizzle/{0000_normal_paper_doll.sql → 0000_soft_tag.sql}

@@ -1,5 +1,5 @@
+CREATE TYPE "authentication"."subject_status" AS ENUM('active', 'inactive', 'suspended', 'pending-approval', 'invited');--> statement-breakpoint
 CREATE TYPE "authentication"."subject_type" AS ENUM('system', 'user', 'service-account');--> statement-breakpoint
-CREATE TYPE "authentication"."user_status" AS ENUM('active', 'suspended', 'pending-approval', 'invited');--> statement-breakpoint
 CREATE TABLE "authentication"."credentials" (
 	"id" uuid DEFAULT gen_random_uuid() NOT NULL,
 	"tenant_id" uuid NOT NULL,
@@ -36,69 +36,62 @@ CREATE TABLE "authentication"."session" (
 CREATE TABLE "authentication"."service_account" (
 	"id" uuid DEFAULT gen_random_uuid() NOT NULL,
 	"tenant_id" uuid NOT NULL,
+	"type" "authentication"."subject_type" NOT NULL,
+	"display_name" text NOT NULL,
 	"description" text NOT NULL,
 	"parent" uuid,
-	"revision" integer NOT NULL,
-	"revision_timestamp" timestamp with time zone NOT NULL,
-	"create_timestamp" timestamp with time zone NOT NULL,
-	"delete_timestamp" timestamp with time zone,
-	"attributes" jsonb DEFAULT '{}'::jsonb NOT NULL,
-	CONSTRAINT "service_account_tenant_id_id_pk" PRIMARY KEY("tenant_id","id")
+	CONSTRAINT "service_account_tenant_id_id_pk" PRIMARY KEY("tenant_id","id"),
+	CONSTRAINT "service_account_tenant_id_type_id_unique" UNIQUE("tenant_id","type","id"),
+	CONSTRAINT "service_account_id_unique" UNIQUE("id"),
+	CONSTRAINT "service_account_type_check" CHECK ("authentication"."service_account"."type" = 'service-account')
 );
 --> statement-breakpoint
 CREATE TABLE "authentication"."subject" (
 	"id" uuid DEFAULT gen_random_uuid() NOT NULL,
 	"tenant_id" uuid NOT NULL,
 	"type" "authentication"."subject_type" NOT NULL,
-	"display_name" text NOT NULL,
-	"system_account_id" uuid,
-	"user_id" uuid,
-	"service_account_id" uuid,
+	"status" "authentication"."subject_status" NOT NULL,
+	"last_activity_timestamp" timestamp with time zone,
 	"revision" integer NOT NULL,
 	"revision_timestamp" timestamp with time zone NOT NULL,
 	"create_timestamp" timestamp with time zone NOT NULL,
 	"delete_timestamp" timestamp with time zone,
 	"attributes" jsonb DEFAULT '{}'::jsonb NOT NULL,
 	CONSTRAINT "subject_tenant_id_id_pk" PRIMARY KEY("tenant_id","id"),
-	CONSTRAINT "subject_tenant_id_service_account_id_unique" UNIQUE("tenant_id","service_account_id"),
-	CONSTRAINT "subject_tenant_id_user_id_unique" UNIQUE("tenant_id","user_id"),
-	CONSTRAINT "subject_tenant_id_system_account_id_unique" UNIQUE("tenant_id","system_account_id"),
-	CONSTRAINT "subject_id_unique" UNIQUE("id"),
-	CONSTRAINT "authentication_subject_reference_check" CHECK (num_nonnulls("authentication"."subject"."system_account_id", "authentication"."subject"."user_id", "authentication"."subject"."service_account_id") = 1)
+	CONSTRAINT "subject_tenant_id_type_id_unique" UNIQUE("tenant_id","type","id"),
+	CONSTRAINT "subject_id_unique" UNIQUE("id")
 );
 --> statement-breakpoint
 CREATE TABLE "authentication"."system_account" (
 	"id" uuid DEFAULT gen_random_uuid() NOT NULL,
 	"tenant_id" uuid NOT NULL,
+	"type" "authentication"."subject_type" NOT NULL,
 	"identifier" text NOT NULL,
-	"revision" integer NOT NULL,
-	"revision_timestamp" timestamp with time zone NOT NULL,
-	"create_timestamp" timestamp with time zone NOT NULL,
-	"delete_timestamp" timestamp with time zone,
-	"attributes" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"display_name" text NOT NULL,
 	CONSTRAINT "system_account_tenant_id_id_pk" PRIMARY KEY("tenant_id","id"),
-	CONSTRAINT "system_account_identifier_unique" UNIQUE("identifier")
+	CONSTRAINT "system_account_tenant_id_type_id_unique" UNIQUE("tenant_id","type","id"),
+	CONSTRAINT "system_account_tenant_id_identifier_unique" UNIQUE("tenant_id","identifier"),
+	CONSTRAINT "system_account_id_unique" UNIQUE("id"),
+	CONSTRAINT "system_account_type_check" CHECK ("authentication"."system_account"."type" = 'system')
 );
 --> statement-breakpoint
 CREATE TABLE "authentication"."user" (
 	"id" uuid DEFAULT gen_random_uuid() NOT NULL,
 	"tenant_id" uuid NOT NULL,
-	"status" "authentication"."user_status" NOT NULL,
+	"type" "authentication"."subject_type" NOT NULL,
 	"email" text NOT NULL,
 	"first_name" text NOT NULL,
 	"last_name" text NOT NULL,
-	"revision" integer NOT NULL,
-	"revision_timestamp" timestamp with time zone NOT NULL,
-	"create_timestamp" timestamp with time zone NOT NULL,
-	"delete_timestamp" timestamp with time zone,
-	"attributes" jsonb DEFAULT '{}'::jsonb NOT NULL,
 	CONSTRAINT "user_tenant_id_id_pk" PRIMARY KEY("tenant_id","id"),
-	CONSTRAINT "user_tenant_id_email_unique" UNIQUE("tenant_id","email")
+	CONSTRAINT "user_tenant_id_type_id_unique" UNIQUE("tenant_id","type","id"),
+	CONSTRAINT "user_tenant_id_email_unique" UNIQUE("tenant_id","email"),
+	CONSTRAINT "user_id_unique" UNIQUE("id"),
+	CONSTRAINT "user_type_check" CHECK ("authentication"."user"."type" = 'user')
 );
 --> statement-breakpoint
 ALTER TABLE "authentication"."credentials" ADD CONSTRAINT "credentials_id_subject_fkey" FOREIGN KEY ("tenant_id","subject_id") REFERENCES "authentication"."subject"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "authentication"."session" ADD CONSTRAINT "session_id_subject_fkey" FOREIGN KEY ("tenant_id","subject_id") REFERENCES "authentication"."subject"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "authentication"."service_account" ADD CONSTRAINT "service_account_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "authentication"."service_account" ADD CONSTRAINT "service_account_id_subject_fkey" FOREIGN KEY ("tenant_id","parent") REFERENCES "authentication"."subject"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "authentication"."subject" ADD CONSTRAINT "subject_id_system_account_fkey" FOREIGN KEY ("tenant_id","system_account_id") REFERENCES "authentication"."system_account"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "authentication"."subject" ADD CONSTRAINT "subject_id_user_fkey" FOREIGN KEY ("tenant_id","user_id") REFERENCES "authentication"."user"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "authentication"."subject" ADD CONSTRAINT "subject_id_service_account_fkey" FOREIGN KEY ("tenant_id","service_account_id") REFERENCES "authentication"."service_account"("tenant_id","id") ON DELETE no action ON UPDATE no action;
+ALTER TABLE "authentication"."system_account" ADD CONSTRAINT "system_account_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "authentication"."user" ADD CONSTRAINT "user_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;