@twin.org/api-auth-entity-storage-service 0.0.3-next.4 → 0.0.3-next.41

package/dist/types/utils/tokenHelper.d.ts

@@ -1,3 +1,4 @@
+import type { IUrlTransformerComponent } from "@twin.org/api-models";
 import { type IVaultConnector } from "@twin.org/vault-models";
 import { type IHttpHeaders, type IJwtHeader, type IJwtPayload } from "@twin.org/web";
 /**
@@ -11,13 +12,17 @@ export declare class TokenHelper {
     /**
      * Create a new token.
      * @param vaultConnector The vault connector.
+     * @param urlTransformerComponent The URL transformer component, used to encrypt the tenant ID for inclusion in the token.
      * @param signingKeyName The signing key name.
      * @param userIdentity The subject for the token.
      * @param organizationIdentity The organization for the token.
+     * @param tenantId The tenant id for the token.
      * @param ttlMinutes The time to live for the token in minutes.
+     * @param scope The scopes for the token.
+     * @param passwordVersion The user's current password version counter, embedded in the token so that a password change invalidates existing tokens.
      * @returns The new token and its expiry date.
      */
-    static createToken(vaultConnector: IVaultConnector, signingKeyName: string, userIdentity: string, organizationIdentity: string | undefined, ttlMinutes: number): Promise<{
+    static createToken(vaultConnector: IVaultConnector, urlTransformerComponent: IUrlTransformerComponent, signingKeyName: string, userIdentity: string, organizationIdentity: string | undefined, tenantId: string | undefined, ttlMinutes: number, scope?: string, passwordVersion?: number): Promise<{
         token: string;
         expiry: number;
     }>;
@@ -26,10 +31,12 @@ export declare class TokenHelper {
      * @param vaultConnector The vault connector.
      * @param signingKeyName The signing key name.
      * @param token The token to verify.
+     * @param requiredScopes The required scopes.
+     * @param verifyUser A function to verify the user identity and organization. The password version counter embedded in the token (pver claim) is passed so callers can detect if the password has changed since the token was issued.
      * @returns The verified details.
      * @throws UnauthorizedError if the token is missing, invalid or expired.
      */
-    static verify(vaultConnector: IVaultConnector, signingKeyName: string, token: string | undefined): Promise<{
+    static verify(vaultConnector: IVaultConnector, signingKeyName: string, token: string | undefined, requiredScopes?: string[], verifyUser?: (userIdentity: string, organizationIdentity: string, encryptedTenantId: string | undefined, passwordVersion: number | undefined) => Promise<string[]>): Promise<{
         header: IJwtHeader;
         payload: IJwtPayload;
     }>;