@twin.org/api-auth-entity-storage-service 0.0.3-next.8 → 0.9.0-next.1

package/docs/reference/classes/TokenHelper.md

@@ -14,7 +14,7 @@ Helper class for token operations.
 
 ## Properties
 
-### CLASS\_NAME
+### CLASS\_NAME {#class_name}
 
 > `readonly` `static` **CLASS\_NAME**: `string`
 
@@ -22,9 +22,9 @@ Runtime name for the class.
 
 ## Methods
 
-### createToken()
+### createToken() {#createtoken}
 
-> `static` **createToken**(`vaultConnector`, `signingKeyName`, `userIdentity`, `organizationIdentity`, `tenantId`, `ttlMinutes`): `Promise`\<\{ `token`: `string`; `expiry`: `number`; \}\>
+> `static` **createToken**(`vaultConnector`, `nodeId`, `signingKeyName`, `userIdentity`, `organizationIdentity`, `tenantId`, `ttlMinutes`, `scope?`, `passwordVersion?`): `Promise`\<\{ `token`: `string`; `expiry`: `number`; \}\>
 
 Create a new token.
 
@@ -36,11 +36,17 @@ Create a new token.
 
 The vault connector.
 
+##### nodeId
+
+`string`
+
+The node identifier, embedded as the JWT issuer claim.
+
 ##### signingKeyName
 
 `string`
 
-The signing key name.
+The signing key name, embedded as the JWT key identifier.
 
 ##### userIdentity
 
@@ -50,15 +56,15 @@ The subject for the token.
 
 ##### organizationIdentity
 
-The organization for the token.
+`string` \| `undefined`
 
-`string` | `undefined`
+The organization for the token.
 
 ##### tenantId
 
-The tenant id for the token.
+`string` \| `undefined`
 
-`string` | `undefined`
+The tenant id for the token.
 
 ##### ttlMinutes
 
@@ -66,6 +72,18 @@ The tenant id for the token.
 
 The time to live for the token in minutes.
 
+##### scope?
+
+`string`
+
+The scopes for the token.
+
+##### passwordVersion?
+
+`number`
+
+The user's current password version counter, embedded in the token so that a password change invalidates existing tokens.
+
 #### Returns
 
 `Promise`\<\{ `token`: `string`; `expiry`: `number`; \}\>
@@ -74,9 +92,9 @@ The new token and its expiry date.
 
 ***
 
-### verify()
+### verify() {#verify}
 
-> `static` **verify**(`vaultConnector`, `signingKeyName`, `token`): `Promise`\<\{ `header`: `JWTHeaderParameters`; `payload`: `JWTPayload`; \}\>
+> `static` **verify**(`vaultConnector`, `nodeId`, `signingKeyName`, `token`, `requiredScopes?`, `verifyUser?`): `Promise`\<\{ `header`: `JWTHeaderParameters`; `payload`: `JWTPayload`; \}\>
 
 Verify the token.
 
@@ -88,17 +106,35 @@ Verify the token.
 
 The vault connector.
 
+##### nodeId
+
+`string`
+
+The node identifier, expected to match the JWT issuer claim.
+
 ##### signingKeyName
 
 `string`
 
-The signing key name.
+The signing key name, expected to match the JWT key identifier.
 
 ##### token
 
+`string` \| `undefined`
+
 The token to verify.
 
-`string` | `undefined`
+##### requiredScopes?
+
+`string`[]
+
+The required scopes.
+
+##### verifyUser?
+
+(`sub`, `org`, `tid`, `passwordVersion`) => `Promise`\<`string`[]\>
+
+A function to verify the user identity and organization. The password version counter embedded in the token (pver claim) is passed so callers can detect if the password has changed since the token was issued.
 
 #### Returns
 
@@ -112,7 +148,7 @@ UnauthorizedError if the token is missing, invalid or expired.
 
 ***
 
-### extractTokenFromHeaders()
+### extractTokenFromHeaders() {#extracttokenfromheaders}
 
 > `static` **extractTokenFromHeaders**(`headers?`, `cookieName?`): \{ `token`: `string`; `location`: `"authorization"` \| `"cookie"`; \} \| `undefined`
 

package/docs/reference/functions/authenticationAdminCreateUser.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminCreateUser()
+
+> **authenticationAdminCreateUser**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`ICreatedResponse`\>
+
+Create a new user.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserCreateRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`ICreatedResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAdminGetUser.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminGetUser()
+
+> **authenticationAdminGetUser**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IAdminUserGetResponse`\>
+
+Get an existing user.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserGetRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IAdminUserGetResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAdminGetUserByIdentity.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminGetUserByIdentity()
+
+> **authenticationAdminGetUserByIdentity**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IAdminUserGetResponse`\>
+
+Get an existing user by identity.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserGetByIdentityRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IAdminUserGetResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAdminRemoveUser.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminRemoveUser()
+
+> **authenticationAdminRemoveUser**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse`\>
+
+Remove an existing user.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserRemoveRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAdminUpdateUser.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminUpdateUser()
+
+> **authenticationAdminUpdateUser**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse`\>
+
+Update an existing user.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserUpdateRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAdminUpdateUserPassword.md

@@ -0,0 +1,31 @@
+# Function: authenticationAdminUpdateUserPassword()
+
+> **authenticationAdminUpdateUserPassword**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`INoContentResponse`\>
+
+Update an existing user password.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAdminUserUpdatePasswordRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`INoContentResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAuditCreate.md

@@ -0,0 +1,31 @@
+# Function: authenticationAuditCreate()
+
+> **authenticationAuditCreate**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`ICreatedResponse`\>
+
+Create an authentication audit entry.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAuditCreateRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`ICreatedResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/authenticationAuditQuery.md

@@ -0,0 +1,31 @@
+# Function: authenticationAuditQuery()
+
+> **authenticationAuditQuery**(`httpRequestContext`, `componentName`, `request`): `Promise`\<`IAuditQueryResponse`\>
+
+Query authentication audit entries.
+
+## Parameters
+
+### httpRequestContext
+
+`IHttpRequestContext`
+
+The request context for the API.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes.
+
+### request
+
+`IAuditQueryRequest`
+
+The request.
+
+## Returns
+
+`Promise`\<`IAuditQueryResponse`\>
+
+The response object with additional http response properties.

package/docs/reference/functions/generateRestRoutesAuthenticationAdmin.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthenticationAdmin()
+
+> **generateRestRoutesAuthenticationAdmin**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication admin.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/functions/generateRestRoutesAuthenticationAudit.md

@@ -0,0 +1,25 @@
+# Function: generateRestRoutesAuthenticationAudit()
+
+> **generateRestRoutesAuthenticationAudit**(`baseRouteName`, `componentName`): `IRestRoute`\<`any`, `any`\>[]
+
+The REST routes for authentication audit.
+
+## Parameters
+
+### baseRouteName
+
+`string`
+
+Prefix to prepend to the paths.
+
+### componentName
+
+`string`
+
+The name of the component to use in the routes stored in the ComponentFactory.
+
+## Returns
+
+`IRestRoute`\<`any`, `any`\>[]
+
+The generated routes.

package/docs/reference/index.md

@@ -2,9 +2,13 @@
 
 ## Classes
 
+- [AuthenticationAuditEntry](classes/AuthenticationAuditEntry.md)
+- [AuthenticationRateEntry](classes/AuthenticationRateEntry.md)
 - [AuthenticationUser](classes/AuthenticationUser.md)
 - [AuthHeaderProcessor](classes/AuthHeaderProcessor.md)
 - [EntityStorageAuthenticationAdminService](classes/EntityStorageAuthenticationAdminService.md)
+- [EntityStorageAuthenticationAuditService](classes/EntityStorageAuthenticationAuditService.md)
+- [EntityStorageAuthenticationRateService](classes/EntityStorageAuthenticationRateService.md)
 - [EntityStorageAuthenticationService](classes/EntityStorageAuthenticationService.md)
 - [PasswordHelper](classes/PasswordHelper.md)
 - [TokenHelper](classes/TokenHelper.md)
@@ -15,16 +19,32 @@
 - [IAuthHeaderProcessorConstructorOptions](interfaces/IAuthHeaderProcessorConstructorOptions.md)
 - [IEntityStorageAuthenticationAdminServiceConfig](interfaces/IEntityStorageAuthenticationAdminServiceConfig.md)
 - [IEntityStorageAuthenticationAdminServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationAuditServiceConfig](interfaces/IEntityStorageAuthenticationAuditServiceConfig.md)
+- [IEntityStorageAuthenticationAuditServiceConstructorOptions](interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md)
+- [IEntityStorageAuthenticationRateServiceConfig](interfaces/IEntityStorageAuthenticationRateServiceConfig.md)
+- [IEntityStorageAuthenticationRateServiceConstructorOptions](interfaces/IEntityStorageAuthenticationRateServiceConstructorOptions.md)
 - [IEntityStorageAuthenticationServiceConfig](interfaces/IEntityStorageAuthenticationServiceConfig.md)
 - [IEntityStorageAuthenticationServiceConstructorOptions](interfaces/IEntityStorageAuthenticationServiceConstructorOptions.md)
 
 ## Variables
 
 - [restEntryPoints](variables/restEntryPoints.md)
+- [tagsAuthenticationAdmin](variables/tagsAuthenticationAdmin.md)
+- [tagsAuthenticationAudit](variables/tagsAuthenticationAudit.md)
 - [tagsAuthentication](variables/tagsAuthentication.md)
 
 ## Functions
 
+- [generateRestRoutesAuthenticationAdmin](functions/generateRestRoutesAuthenticationAdmin.md)
+- [authenticationAdminCreateUser](functions/authenticationAdminCreateUser.md)
+- [authenticationAdminUpdateUser](functions/authenticationAdminUpdateUser.md)
+- [authenticationAdminUpdateUserPassword](functions/authenticationAdminUpdateUserPassword.md)
+- [authenticationAdminGetUser](functions/authenticationAdminGetUser.md)
+- [authenticationAdminGetUserByIdentity](functions/authenticationAdminGetUserByIdentity.md)
+- [authenticationAdminRemoveUser](functions/authenticationAdminRemoveUser.md)
+- [generateRestRoutesAuthenticationAudit](functions/generateRestRoutesAuthenticationAudit.md)
+- [authenticationAuditCreate](functions/authenticationAuditCreate.md)
+- [authenticationAuditQuery](functions/authenticationAuditQuery.md)
 - [generateRestRoutesAuthentication](functions/generateRestRoutesAuthentication.md)
 - [authenticationLogin](functions/authenticationLogin.md)
 - [authenticationLogout](functions/authenticationLogout.md)

package/docs/reference/interfaces/IAuthHeaderProcessorConfig.md

@@ -4,9 +4,9 @@ Configuration for the authentication header processor
 
 ## Properties
 
-### signingKeyName?
+### signingKeyName? {#signingkeyname}
 
-> `optional` **signingKeyName**: `string`
+> `optional` **signingKeyName?**: `string`
 
 The name of the key to retrieve from the vault for signing JWT.
 
@@ -18,9 +18,9 @@ auth-signing
 
 ***
 
-### cookieName?
+### cookieName? {#cookiename}
 
-> `optional` **cookieName**: `string`
+> `optional` **cookieName?**: `string`
 
 The name of the cookie to use for the token.
 

package/docs/reference/interfaces/IAuthHeaderProcessorConstructorOptions.md

@@ -4,9 +4,23 @@ Options for the AuthHeaderProcessor constructor.
 
 ## Properties
 
-### vaultConnectorType?
+### userEntityStorageType? {#userentitystoragetype}
 
-> `optional` **vaultConnectorType**: `string`
+> `optional` **userEntityStorageType?**: `string`
+
+The entity storage for users.
+
+#### Default
+
+```ts
+authentication-user
+```
+
+***
+
+### vaultConnectorType? {#vaultconnectortype}
+
+> `optional` **vaultConnectorType?**: `string`
 
 The vault for the private keys.
 
@@ -18,8 +32,22 @@ vault
 
 ***
 
-### config?
+### tenantAdminComponentType? {#tenantadmincomponenttype}
+
+> `optional` **tenantAdminComponentType?**: `string`
+
+The component to retrieve tenant information.
+
+#### Default
+
+```ts
+tenant-admin
+```
+
+***
+
+### config? {#config}
 
-> `optional` **config**: [`IAuthHeaderProcessorConfig`](IAuthHeaderProcessorConfig.md)
+> `optional` **config?**: [`IAuthHeaderProcessorConfig`](IAuthHeaderProcessorConfig.md)
 
 The configuration for the processor.

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConfig.md

@@ -4,9 +4,9 @@ Configuration for the entity storage authentication admin service.
 
 ## Properties
 
-### minPasswordLength?
+### minPasswordLength? {#minpasswordlength}
 
-> `optional` **minPasswordLength**: `number`
+> `optional` **minPasswordLength?**: `number`
 
 The minimum password length.
 

package/docs/reference/interfaces/IEntityStorageAuthenticationAdminServiceConstructorOptions.md

@@ -4,9 +4,9 @@ Options for the EntityStorageAuthenticationAdminService constructor.
 
 ## Properties
 
-### userEntityStorageType?
+### userEntityStorageType? {#userentitystoragetype}
 
-> `optional` **userEntityStorageType**: `string`
+> `optional` **userEntityStorageType?**: `string`
 
 The entity storage for the users.
 
@@ -18,8 +18,22 @@ authentication-user
 
 ***
 
-### config?
+### authenticationAuditServiceType? {#authenticationauditservicetype}
 
-> `optional` **config**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)
+> `optional` **authenticationAuditServiceType?**: `string`
+
+The audit service.
+
+#### Default
+
+```ts
+authentication-audit
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAdminServiceConfig`](IEntityStorageAuthenticationAdminServiceConfig.md)
 
 The configuration for the authentication.

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConfig.md

@@ -0,0 +1,11 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConfig
+
+Config for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### ipHashSalt? {#iphashsalt}
+
+> `optional` **ipHashSalt?**: `string`
+
+The server-side salt for hashing IP addresses in audit logs, if configured.

package/docs/reference/interfaces/IEntityStorageAuthenticationAuditServiceConstructorOptions.md

@@ -0,0 +1,25 @@
+# Interface: IEntityStorageAuthenticationAuditServiceConstructorOptions
+
+Options for the EntityStorageAuthenticationAuditService constructor.
+
+## Properties
+
+### authenticationAuditEntryStorageType? {#authenticationauditentrystoragetype}
+
+> `optional` **authenticationAuditEntryStorageType?**: `string`
+
+The entity storage for the audit entries.
+
+#### Default
+
+```ts
+authentication-audit-entry
+```
+
+***
+
+### config? {#config}
+
+> `optional` **config?**: [`IEntityStorageAuthenticationAuditServiceConfig`](IEntityStorageAuthenticationAuditServiceConfig.md)
+
+The configuration for the authentication audit service.

package/docs/reference/interfaces/IEntityStorageAuthenticationRateServiceConfig.md

@@ -0,0 +1,17 @@
+# Interface: IEntityStorageAuthenticationRateServiceConfig
+
+Configuration for the entity storage authentication rate service.
+
+## Properties
+
+### cleanupIntervalMinutes? {#cleanupintervalminutes}
+
+> `optional` **cleanupIntervalMinutes?**: `number`
+
+Interval between cleanup runs in minutes.
+
+#### Default
+
+```ts
+5
+```