@vsaas/loopback 12.1.1 → 12.2.0

package/README.md

@@ -11,6 +11,8 @@ The goal of this fork is practical compatibility for the common upstream use cas
 - public legacy subpaths preserved through `exports` even though the old root `.js` wrappers were removed
 - modern tooling with `tsdown`, `vitest`, and `oxlint`
 - callback-compatible APIs that continue to work with `Promise` and `async/await`
+- general fixed-window and failure-lockout rate limiting with weighted/batch consumption
+- optional TOTP and one-time recovery-code authentication for `User` models
 
 ## Installation
 
@@ -23,9 +25,13 @@ If you are also using the related forks, pair it with `@vsaas/loopback-boot`, `@
 ## Documentation
 
 - [Application guide](./docs/application-guide.md)
+- [Rate limiting](./docs/rate-limiting.md)
+- [Two-factor authentication](./docs/two-factor-authentication.md)
+- [Two-factor authenticator loss runbook](./docs/two-factor-authenticator-loss-runbook.md)
 - [@vsaas/loopback-boot](../loopback-boot/README.md)
 - [@vsaas/loopback-datasource-juggler](../loopback-datasource-juggler/README.md)
 - [@vsaas/remoting](../remoting/README.md)
+- [@vsaas/loopback-component-rate-limit-redis](../loopback-component-rate-limit-redis/README.md)
 - [@vsaas/loopback-component-storage](../loopback-component-storage/README.md)
 - [@vsaas/loopback-softdelete-mixin4](../loopback-softdelete-mixin/README.md)
 

package/common/models/rate-limit-state.json

@@ -0,0 +1,121 @@
+{
+  "name": "RateLimitState",
+  "base": "PersistedModel",
+  "strict": true,
+  "properties": {
+    "id": {
+      "type": "string",
+      "id": true
+    },
+    "namespace": {
+      "type": "string",
+      "required": true
+    },
+    "scope": {
+      "type": "string",
+      "required": true
+    },
+    "subjectType": {
+      "type": "string",
+      "required": true
+    },
+    "bucket": {
+      "type": "string",
+      "required": true
+    },
+    "subjectKeyId": {
+      "type": "string",
+      "required": true
+    },
+    "formatVersion": {
+      "type": "number",
+      "required": true,
+      "default": 1
+    },
+    "policyFingerprint": {
+      "type": "string",
+      "required": true
+    },
+    "failureCount": {
+      "type": "number",
+      "required": true,
+      "default": 0
+    },
+    "attemptCount": {
+      "type": "number",
+      "required": true,
+      "default": 0
+    },
+    "lockoutLevel": {
+      "type": "number",
+      "required": true,
+      "default": 0
+    },
+    "windowStartedAt": {
+      "type": "date"
+    },
+    "lastAttemptAt": {
+      "type": "date"
+    },
+    "lastFailureAt": {
+      "type": "date"
+    },
+    "blockedUntil": {
+      "type": "date"
+    },
+    "revision": {
+      "type": "number",
+      "required": true,
+      "default": 0
+    },
+    "lastOperationId": {
+      "type": "string"
+    },
+    "lastOperationResultJson": {
+      "type": "string"
+    },
+    "createdAt": {
+      "type": "date",
+      "defaultFn": "now"
+    },
+    "updatedAt": {
+      "type": "date",
+      "defaultFn": "now"
+    },
+    "expiresAt": {
+      "type": "date",
+      "required": true
+    }
+  },
+  "indexes": {
+    "rate_limit_expiry": {
+      "keys": {
+        "expiresAt": 1
+      }
+    },
+    "rate_limit_bucket": {
+      "keys": {
+        "namespace": 1,
+        "scope": 1,
+        "subjectType": 1,
+        "bucket": 1,
+        "blockedUntil": 1
+      }
+    },
+    "rate_limit_policy": {
+      "keys": {
+        "namespace": 1,
+        "scope": 1,
+        "bucket": 1,
+        "policyFingerprint": 1
+      }
+    }
+  },
+  "acls": [
+    {
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    }
+  ]
+}

package/common/models/two-factor-challenge.json

@@ -0,0 +1,112 @@
+{
+  "name": "TwoFactorChallenge",
+  "base": "PersistedModel",
+  "strict": true,
+  "properties": {
+    "id": {
+      "type": "string",
+      "id": true
+    },
+    "principalType": {
+      "type": "string",
+      "required": true
+    },
+    "principalId": {
+      "type": "string",
+      "required": true
+    },
+    "credentialId": {
+      "type": "string",
+      "required": true
+    },
+    "credentialVersion": {
+      "type": "number",
+      "required": true
+    },
+    "flowType": {
+      "type": "string",
+      "required": true,
+      "default": "external"
+    },
+    "principalBindingKeyId": {
+      "type": "string",
+      "required": true
+    },
+    "principalBindingDigest": {
+      "type": "string",
+      "required": true
+    },
+    "status": {
+      "type": "string",
+      "required": true,
+      "default": "pending"
+    },
+    "attempts": {
+      "type": "number",
+      "required": true,
+      "default": 0
+    },
+    "maxAttempts": {
+      "type": "number",
+      "required": true
+    },
+    "verificationLeaseId": {
+      "type": "string"
+    },
+    "verificationLeaseExpiresAt": {
+      "type": "date"
+    },
+    "encryptedLoginContext": {
+      "type": "string",
+      "required": true
+    },
+    "loginContextKeyId": {
+      "type": "string",
+      "required": true
+    },
+    "includeUser": {
+      "type": "boolean",
+      "required": true,
+      "default": false
+    },
+    "createdAt": {
+      "type": "date",
+      "defaultFn": "now"
+    },
+    "expiresAt": {
+      "type": "date",
+      "required": true
+    },
+    "claimedAt": {
+      "type": "date"
+    },
+    "consumedAt": {
+      "type": "date"
+    },
+    "issuedTokenId": {
+      "type": "string"
+    }
+  },
+  "hidden": ["encryptedLoginContext", "principalBindingDigest", "issuedTokenId"],
+  "indexes": {
+    "two_factor_challenge_expiry": {
+      "keys": {
+        "expiresAt": 1
+      }
+    },
+    "two_factor_challenge_principal_status": {
+      "keys": {
+        "principalType": 1,
+        "principalId": 1,
+        "status": 1
+      }
+    }
+  },
+  "acls": [
+    {
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    }
+  ]
+}

package/common/models/two-factor-credential.json

@@ -0,0 +1,117 @@
+{
+  "name": "TwoFactorCredential",
+  "base": "PersistedModel",
+  "strict": true,
+  "properties": {
+    "id": {
+      "type": "string",
+      "id": true,
+      "defaultFn": "guid"
+    },
+    "principalType": {
+      "type": "string",
+      "required": true
+    },
+    "principalId": {
+      "type": "string",
+      "required": true
+    },
+    "provider": {
+      "type": "string",
+      "required": true,
+      "default": "totp"
+    },
+    "totpAlgorithm": {
+      "type": "string",
+      "required": true,
+      "default": "SHA1"
+    },
+    "totpDigits": {
+      "type": "number",
+      "required": true,
+      "default": 6
+    },
+    "totpPeriod": {
+      "type": "number",
+      "required": true,
+      "default": 30
+    },
+    "status": {
+      "type": "string",
+      "required": true,
+      "default": "pending"
+    },
+    "version": {
+      "type": "number",
+      "required": true,
+      "default": 1
+    },
+    "encryptedSecret": {
+      "type": "string"
+    },
+    "secretKeyId": {
+      "type": "string"
+    },
+    "enrollmentTokenDigest": {
+      "type": "string"
+    },
+    "activeRecoveryCodeSetId": {
+      "type": "string"
+    },
+    "activeRecoveryCodeFormatVersion": {
+      "type": "number"
+    },
+    "activeRecoveryCodeLength": {
+      "type": "number"
+    },
+    "lastUsedCounter": {
+      "type": "number",
+      "required": true,
+      "default": -1
+    },
+    "pendingExpiresAt": {
+      "type": "date"
+    },
+    "confirmedAt": {
+      "type": "date"
+    },
+    "disabledAt": {
+      "type": "date"
+    },
+    "createdAt": {
+      "type": "date",
+      "defaultFn": "now"
+    },
+    "updatedAt": {
+      "type": "date",
+      "defaultFn": "now"
+    }
+  },
+  "hidden": ["encryptedSecret", "enrollmentTokenDigest"],
+  "indexes": {
+    "two_factor_principal_provider_unique": {
+      "keys": {
+        "principalType": 1,
+        "principalId": 1,
+        "provider": 1
+      },
+      "options": {
+        "unique": true
+      }
+    },
+    "two_factor_principal_status": {
+      "keys": {
+        "principalType": 1,
+        "principalId": 1,
+        "status": 1
+      }
+    }
+  },
+  "acls": [
+    {
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    }
+  ]
+}

package/common/models/two-factor-recovery-code.json

@@ -0,0 +1,63 @@
+{
+  "name": "TwoFactorRecoveryCode",
+  "base": "PersistedModel",
+  "strict": true,
+  "properties": {
+    "id": {
+      "type": "string",
+      "id": true
+    },
+    "credentialId": {
+      "type": "string",
+      "required": true
+    },
+    "setId": {
+      "type": "string",
+      "required": true
+    },
+    "keyId": {
+      "type": "string",
+      "required": true
+    },
+    "status": {
+      "type": "string",
+      "required": true,
+      "default": "unused"
+    },
+    "reservationId": {
+      "type": "string"
+    },
+    "reservationExpiresAt": {
+      "type": "date"
+    },
+    "reservationOwnerType": {
+      "type": "string"
+    },
+    "reservationOwnerId": {
+      "type": "string"
+    },
+    "createdAt": {
+      "type": "date",
+      "defaultFn": "now"
+    },
+    "usedAt": {
+      "type": "date"
+    }
+  },
+  "indexes": {
+    "two_factor_recovery_credential": {
+      "keys": {
+        "credentialId": 1,
+        "setId": 1,
+        "status": 1
+      }
+    }
+  },
+  "acls": [
+    {
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    }
+  ]
+}

package/common/models/user.json

@@ -46,6 +46,36 @@
       "permission": "ALLOW",
       "property": "login"
     },
+    {
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW",
+      "property": "verifyTwoFactor"
+    },
+    {
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW",
+      "property": "beginTwoFactorEnrollment"
+    },
+    {
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW",
+      "property": "confirmTwoFactorEnrollment"
+    },
+    {
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW",
+      "property": "regenerateTwoFactorRecoveryCodes"
+    },
+    {
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW",
+      "property": "disableTwoFactor"
+    },
     {
       "principalType": "ROLE",
       "principalId": "$everyone",

package/dist/_virtual/_rolldown/runtime.cjs

@@ -3,8 +3,15 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
 	for (var name in all) __defProp(target, name, {

package/dist/common/models/access-token.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/access-token.d.ts
+declare function configureAccessToken(AccessToken: any): void;
+export = configureAccessToken;

package/dist/common/models/acl.cjs

@@ -50,9 +50,7 @@ var require_acl = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mod
 					case ACL.EXECUTE:
 						isMatchingAccessType = true;
 						break;
-					case ACL.WRITE:
-						isMatchingAccessType = requestedValue === ACL.REPLICATE;
-						break;
+					case ACL.WRITE: isMatchingAccessType = requestedValue === ACL.REPLICATE;
 				}
 				if (isMatchingMethodName || isMatchingAccessType) score += 3;
 				else if (ruleValue === ACL.ALL) score += 2;

package/dist/common/models/acl.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/common/models/application.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/application.d.ts
+declare function configureApplication(Application: any): void;
+export = configureApplication;

package/dist/common/models/change.cjs

@@ -124,18 +124,19 @@ var require_change = /* @__PURE__ */ require_runtime.__commonJSMin(((exports, mo
 				});
 			}
 			function doRectify(checkpoint, rev) {
-				if (rev) if (currentRev === rev) {
-					change.debug("ASSERTION FAILED: Change currentRev==rev should have been already handled");
-					return cb(null, change);
-				} else {
-					change.rev = rev;
-					change.debug("updated revision (was " + currentRev + ")");
-					if (change.checkpoint !== checkpoint) {
-						change.prev = currentRev;
-						change.debug("updated prev");
+				if (rev) {
+					if (currentRev === rev) {
+						change.debug("ASSERTION FAILED: Change currentRev==rev should have been already handled");
+						return cb(null, change);
+					} else {
+						change.rev = rev;
+						change.debug("updated revision (was " + currentRev + ")");
+						if (change.checkpoint !== checkpoint) {
+							change.prev = currentRev;
+							change.debug("updated prev");
+						}
 					}
-				}
-				else {
+				} else {
 					change.rev = null;
 					change.debug("updated revision (was " + currentRev + ")");
 					if (change.checkpoint !== checkpoint) {
@@ -226,13 +227,15 @@ var require_change = /* @__PURE__ */ require_runtime.__commonJSMin(((exports, mo
 					localChange = new Change(localChange);
 					localModelIds.push(localChange.modelId);
 					const remoteChange = remoteChangeIndex[localChange.modelId];
-					if (remoteChange && !localChange.equals(remoteChange)) if (remoteChange.conflictsWith(localChange)) {
-						remoteChange.debug("remote conflict");
-						localChange.debug("local conflict");
-						conflicts.push(localChange);
-					} else {
-						remoteChange.debug("remote delta");
-						deltas.push(remoteChange);
+					if (remoteChange && !localChange.equals(remoteChange)) {
+						if (remoteChange.conflictsWith(localChange)) {
+							remoteChange.debug("remote conflict");
+							localChange.debug("local conflict");
+							conflicts.push(localChange);
+						} else {
+							remoteChange.debug("remote delta");
+							deltas.push(remoteChange);
+						}
 					}
 				});
 				modelIds.forEach(function(id) {

package/dist/common/models/change.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/common/models/checkpoint.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/checkpoint.d.ts
+declare function configureCheckpoint(Checkpoint: any): void;
+export = configureCheckpoint;

package/dist/common/models/email.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/email.d.ts
+declare function configureEmail(Email: any): void;
+export = configureEmail;

package/dist/common/models/key-value-model.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/key-value-model.d.ts
+declare function configureKeyValueModel(KeyValueModel: any): void;
+export = configureKeyValueModel;

package/dist/common/models/rate-limit-state.cjs

@@ -0,0 +1,7 @@
+"use strict";
+//#region src/common/models/rate-limit-state.ts
+var require_rate_limit_state = /* @__PURE__ */ require("../../_virtual/_rolldown/runtime.cjs").__commonJSMin(((exports, module) => {
+	module.exports = function configureRateLimitState(_RateLimitState) {};
+}));
+//#endregion
+module.exports = require_rate_limit_state();

package/dist/common/models/rate-limit-state.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/rate-limit-state.d.ts
+declare const _default: (_RateLimitState: any) => void;
+export = _default;