@twin.org/api-auth-entity-storage-service 0.0.3-next.22 → 0.0.3-next.24

package/docs/reference/interfaces/IAuthHeaderProcessorConstructorOptions.md

@@ -4,6 +4,20 @@ Options for the AuthHeaderProcessor constructor.
 
 ## Properties
 
+### authenticationAdminServiceType? {#authenticationadminservicetype}
+
+> `optional` **authenticationAdminServiceType?**: `string`
+
+The admin service.
+
+#### Default
+
+```ts
+authentication-admin
+```
+
+***
+
 ### vaultConnectorType? {#vaultconnectortype}
 
 > `optional` **vaultConnectorType?**: `string`

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md

@@ -18,6 +18,20 @@ authentication-user
 
 ***
 
+### authenticationAuditServiceType? {#authenticationauditservicetype}
+
+> `optional` **authenticationAuditServiceType?**: `string`
+
+The audit service.
+
+#### Default
+
+```ts
+authentication-audit
+```
+
+***
+
 ### config? {#config}
 
 > `optional` **config?**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConfig.md

@@ -0,0 +1,11 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConfig
+
+Config for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### ipHashSalt? {#iphashsalt}
+
+> `optional` **ipHashSalt?**: `string`
+
+The server-side salt for hashing IP addresses in audit logs, if configured.

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md

@@ -0,0 +1,25 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### authenticationAuditEntryStorageType? {#authenticationauditentrystoragetype}
+
+> `optional` **authenticationAuditEntryStorageType?**: `string`
+
+The entity storage for the audit entries.
+
+#### Default
+
+```ts
+authentication-audit-entry
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAuditServiceConfig`](IEntityStorageAuthenticationAuditServiceConfig.md)
+
+The configuration for the authentication audit service.

package/docs/reference/interfaces/IEntityStorageAuthenticationRateServiceConfig.md

@@ -0,0 +1,17 @@
+# Interface: IEntityStorageAuthenticationRateServiceConfig
+
+Configuration for the entity storage authentication rate service.
+
+## Properties
+
+### cleanupIntervalMinutes? {#cleanupintervalminutes}
+
+> `optional` **cleanupIntervalMinutes?**: `number`
+
+Interval between cleanup runs in minutes.
+
+#### Default
+
+```ts
+5
+```

package/docs/reference/interfaces/IEntityStorageAuthenticationRateServiceConstructorOptions.md

@@ -0,0 +1,39 @@
+# Interface: IEntityStorageAuthenticationRateServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationRateService constructor.
+
+## Properties
+
+### authenticationRateEntryStorageType? {#authenticationrateentrystoragetype}
+
+> `optional` **authenticationRateEntryStorageType?**: `string`
+
+The entity storage for authentication rate entries.
+
+#### Default
+
+```ts
+authentication-rate-entry
+```
+
+***
+
+### taskSchedulerComponentType? {#taskschedulercomponenttype}
+
+> `optional` **taskSchedulerComponentType?**: `string`
+
+The task scheduler component type.
+
+#### Default
+
+```ts
+task-scheduler
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationRateServiceConfig`](IEntityStorageAuthenticationRateServiceConfig.md)
+
+The configuration for the authentication rate service.

package/docs/reference/interfaces/IEntityStorageAuthenticationServiceConfig.md

@@ -27,5 +27,61 @@ The default time to live for the JWT.
 #### Default
 
 ```ts
-1440
+60
+```
+
+***
+
+### minPasswordLength? {#minpasswordlength}
+
+> `optional` **minPasswordLength?**: `number`
+
+The minimum password length for new password validation.
+
+#### Default
+
+```ts
+8
+```
+
+***
+
+### loginRateLimit? {#loginratelimit}
+
+> `optional` **loginRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for login failure rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### passwordChangeRateLimit? {#passwordchangeratelimit}
+
+> `optional` **passwordChangeRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for password change rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 5, windowMinutes: 15 }
+```
+
+***
+
+### tokenRefreshRateLimit? {#tokenrefreshratelimit}
+
+> `optional` **tokenRefreshRateLimit?**: `IAuthenticationRateActionConfig`
+
+Optional override for token refresh rate limit.
+
+#### Default
+
+```ts
+{ maxAttempts: 30, windowMinutes: 60 }
 ```

package/docs/reference/interfaces/IEntityStorageAuthenticationServiceConstructorOptions.md

@@ -32,16 +32,30 @@ vault
 
 ***
 
-### authenticationAdminServiceType? {#authenticationadminservicetype}
+### authenticationAuditServiceType? {#authenticationauditservicetype}
 
-> `optional` **authenticationAdminServiceType?**: `string`
+> `optional` **authenticationAuditServiceType?**: `string`
 
-The admin service.
+The audit service.
 
 #### Default
 
 ```ts
-authentication-admin
+authentication-audit
+```
+
+***
+
+### authenticationRateServiceType? {#authenticationrateservicetype}
+
+> `optional` **authenticationRateServiceType?**: `string`
+
+The rate service.
+
+#### Default
+
+```ts
+authentication-rate
 ```
 
 ***

package/docs/reference/variables/tagsAuthenticationAudit.md

@@ -0,0 +1,5 @@
+# Variable: tagsAuthenticationAudit
+
+> `const` **tagsAuthenticationAudit**: `ITag`[]
+
+The tag to associate with the routes.

package/locales/en.json

@@ -12,18 +12,29 @@
 			"updateUserFailed": "Updating the user failed",
 			"removeUserFailed": "Removing the user failed",
 			"updatePasswordFailed": "Updating the user's password failed",
-			"userNotFound": "The user with the specified e-mail could not be found \"{notFoundId}\"",
+			"userNotFound": "The user with the specified e-mail could not be found \"{notFoundId}\""
+		},
+		"passwordHelper": {
 			"currentPasswordMismatch": "The current password is incorrect"
 		},
+		"entityStorageAuthenticationRateService": {
+			"actionConfigMissing": "No rate-limit configuration exists for action \"{action}\".",
+			"rateLimitExceeded": "The rate limit for action \"{action}\" has been exceeded. Retry after {retryAfterSeconds} seconds."
+		},
 		"tokenHelper": {
 			"missing": "The JSON Web token could not be found in the authorization header",
 			"payloadMissingSubject": "The JSON Web token payload does not contain a subject",
 			"payloadMissingOrganization": "The JSON Web token payload does not contain an organization",
 			"expired": "The JSON Web token has expired",
-			"insufficientScopes": "The JSON Web token does not have the required scopes to access this resource"
+			"insufficientScopes": "The JSON Web token does not have the required scopes to access this resource",
+			"userNotVerified": "The user associated with the JSON Web token could not be verified",
+			"organizationNotVerified": "The organization associated with the JSON Web token could not be verified"
 		},
 		"authHeaderProcessor": {
 			"tenantIdMismatch": "The tenant ID in the token does not match the tenant ID in the context"
+		},
+		"validation": {
+			"saltEntropyTooLow": "Salt must have at least 8 unique characters for sufficient entropy."
 		}
 	}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@twin.org/api-auth-entity-storage-service",
-	"version": "0.0.3-next.22",
+	"version": "0.0.3-next.24",
 	"description": "Authentication service implementation and REST routes backed by entity storage.",
 	"repository": {
 		"type": "git",
@@ -14,9 +14,10 @@
 		"node": ">=20.0.0"
 	},
 	"dependencies": {
-		"@twin.org/api-auth-entity-storage-models": "0.0.3-next.22",
-		"@twin.org/api-core": "0.0.3-next.22",
-		"@twin.org/api-models": "0.0.3-next.22",
+		"@twin.org/api-auth-entity-storage-models": "0.0.3-next.24",
+		"@twin.org/api-core": "0.0.3-next.24",
+		"@twin.org/api-models": "0.0.3-next.24",
+		"@twin.org/background-task-models": "next",
 		"@twin.org/context": "next",
 		"@twin.org/core": "next",
 		"@twin.org/crypto": "next",