@webda/core 4.0.0-beta.2 → 4.0.0-beta.4

package/lib/models/decorator.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Options accepted by `@Action()` and `@Operation()`.
+ *
+ * The compiler scans for these decorators by name to populate model and
+ * Behavior metadata. The runtime decorator itself is a no-op pass-through —
+ * its only job is to make `@Action()` a valid runtime call so the source
+ * compiles. All actual action wiring is metadata-driven (see
+ * `compiler/src/metadata/actions.ts` and `metadata/behaviors.ts`).
+ */
+export interface ActionOptions {
+    /** Override the registered action name (defaults to the method name). */
+    name?: string;
+    /** OpenAPI overrides for the registered route. */
+    openapi?: any;
+    /** HTTP methods accepted by the action; defaults to `["PUT"]`. */
+    methods?: string[];
+    /** Mark the action as global (class-level) rather than instance-level. */
+    global?: boolean;
+    /**
+     * Behavior-only override for the REST route registration.
+     *
+     *   - `route: "."` ⇒ `/<plural>/{uuid}/<attribute>` (no extra segment)
+     *   - `route: "url"` ⇒ `/<plural>/{uuid}/<attribute>/url`
+     *   - `route: "{hash}"` ⇒ `/<plural>/{uuid}/<attribute>/{hash}`
+     *
+     * `method` overrides the HTTP verb; defaults to `"PUT"` when omitted.
+     */
+    rest?: {
+        route?: string;
+        method?: string;
+    };
+    /** Free-form description forwarded into operation metadata. */
+    description?: string;
+    /** Free-form summary forwarded into operation metadata. */
+    summary?: string;
+}
+/**
+ * Marker decorator used to expose a method as a model or Behavior action.
+ *
+ * The body is intentionally empty. The compiler discovers `@Action`-decorated
+ * methods by inspecting the AST during module generation, then writes the
+ * action metadata into `webda.module.json`. At runtime the decorator simply
+ * returns the method untouched, so applying or omitting it has no behavioural
+ * effect on the method itself.
+ *
+ * Both `@Action` (no parens) and `@Action({...})` are supported.
+ */
+export declare const Action: {
+    (value: any, context: any): any;
+    (_options?: ActionOptions): (value: any, context: any) => any;
+};
+/**
+ * Some simple annotations that can be used to add some behavior to attributes
+ */
+export declare const Masked: {
+    (initialValue: undefined, context: any): void;
+    (context: any, mask: string): (initialValue: undefined, context: any) => void;
+};
+/**
+ * Placeholder that only prefixes the value with "ENCRYPTED:": it does NOT encrypt anything
+ * @deprecated use the {@link EncryptedField} behavior (`field: EncryptedField<T>`), encrypted with the CryptoService
+ */
+export declare const Encrypted: {
+    (initialValue: undefined, context: any): void;
+    (context: any): (initialValue: undefined, context: any) => void;
+};
+//# sourceMappingURL=decorator.d.ts.map

package/lib/models/decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator.d.ts","sourceRoot":"","sources":["../../src/models/decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM;;;CAAwF,CAAC;AAE5G;;GAEG;AACH,eAAO,MAAM,MAAM;;;CA0BjB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,SAAS;;;CAqBpB,CAAC"}

package/lib/models/decorator.js

@@ -0,0 +1,67 @@
+import { createMethodDecorator, createPropertyDecorator } from "@webda/tsc-esm";
+import { truncate } from "fs/promises";
+/**
+ * Marker decorator used to expose a method as a model or Behavior action.
+ *
+ * The body is intentionally empty. The compiler discovers `@Action`-decorated
+ * methods by inspecting the AST during module generation, then writes the
+ * action metadata into `webda.module.json`. At runtime the decorator simply
+ * returns the method untouched, so applying or omitting it has no behavioural
+ * effect on the method itself.
+ *
+ * Both `@Action` (no parens) and `@Action({...})` are supported.
+ */
+export const Action = createMethodDecorator((value, _context, _options) => value);
+/**
+ * Some simple annotations that can be used to add some behavior to attributes
+ */
+export const Masked = createPropertyDecorator((value, context, mask) => {
+    if (context.kind === "field") {
+        context.addInitializer(function maskedInit() {
+            const descriptor = Object.getOwnPropertyDescriptor(this, context.name) || {};
+            Object.defineProperty(this, context.name, {
+                ...descriptor,
+                get: function maskedGet() {
+                    return this[`__${context.name}`];
+                },
+                set: function maskedSet(value) {
+                    value = value.padEnd(mask.length, "?");
+                    for (let i = 0; i < mask.length; i++) {
+                        if (mask[i] === "X") {
+                            value = value.substring(0, i) + "X" + value.substring(i + 1);
+                        }
+                    }
+                    if (truncate) {
+                        value = value.substring(0, mask.length);
+                    }
+                    this[`__${context.name}`] = value;
+                }
+            });
+        });
+    }
+});
+/**
+ * Placeholder that only prefixes the value with "ENCRYPTED:": it does NOT encrypt anything
+ * @deprecated use the {@link EncryptedField} behavior (`field: EncryptedField<T>`), encrypted with the CryptoService
+ */
+export const Encrypted = createPropertyDecorator((value, context) => {
+    if (context.kind === "field") {
+        context.addInitializer(function encryptedInit() {
+            const descriptor = Object.getOwnPropertyDescriptor(this, context.name) || {};
+            Object.defineProperty(this, context.name, {
+                ...descriptor,
+                get: function encryptedGet() {
+                    const val = this[`__${context.name}`];
+                    if (val && val.startsWith("ENCRYPTED:")) {
+                        return val.substring("ENCRYPTED:".length);
+                    }
+                    return val;
+                },
+                set: function encryptedSet(value) {
+                    this[`__${context.name}`] = "ENCRYPTED:" + value;
+                }
+            });
+        });
+    }
+});
+//# sourceMappingURL=decorator.js.map

package/lib/models/decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator.js","sourceRoot":"","sources":["../../src/models/decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAuCvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,KAAU,EAAE,QAAa,EAAE,QAAwB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAE5G;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,KAAU,EAAE,OAAO,EAAE,IAAY,EAAE,EAAE;IAClF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,cAAc,CAAC,SAAS,UAAU;YACxC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBACxC,GAAG,UAAU;gBAEb,GAAG,EAAE,SAAS,SAAS;oBACrB,OAAO,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC;gBAED,GAAG,EAAE,SAAS,SAAS,CAAC,KAAK;oBAC3B,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;4BACpB,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC/D,CAAC;oBACH,CAAC;oBACD,IAAI,QAAQ,EAAE,CAAC;wBACb,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC1C,CAAC;oBACD,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;gBACpC,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,CAAC,KAAU,EAAE,OAAO,EAAE,EAAE;IACvE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,cAAc,CAAC,SAAS,aAAa;YAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBACxC,GAAG,UAAU;gBAEb,GAAG,EAAE,SAAS,YAAY;oBACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;wBACxC,OAAO,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAC5C,CAAC;oBACD,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,GAAG,EAAE,SAAS,YAAY,CAAC,KAAK;oBAC9B,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,YAAY,GAAG,KAAK,CAAC;gBACnD,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/lib/models/deployment.d.ts

@@ -1,24 +1,5 @@
 /**
- * This represent a deployment unit of the appllication
- *
- * Type can be a single Deployer or a chain of Deployer
+ * Deployment types moved to the application, kept here for compatibility
  */
-export interface DeploymentUnit {
-    name: string;
-    type: string;
-}
-/**
- * A Deployment is a configuration of an application along with its differents DeploymentUnit
- *
- * You can override the webda.config.json parameters and services parameters by specifying specific
- */
-export default interface Deployment {
-    $schema?: string;
-    parameters: any;
-    resources: any;
-    services: any;
-    units: DeploymentUnit[];
-    name?: string;
-}
-export { Deployment };
+export type { Deployment, DeploymentUnit } from "../application/deployment.js";
 //# sourceMappingURL=deployment.d.ts.map

package/lib/models/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/models/deployment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,WAAW,UAAU;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,GAAG,CAAC;IAChB,SAAS,EAAE,GAAG,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/models/deployment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC"}

package/lib/models/encrypted.model.d.ts

@@ -0,0 +1,46 @@
+import { WEBDA_STORAGE } from "@webda/models";
+/**
+ * A model field encrypted at rest with the CryptoService
+ *
+ * Only the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is
+ * JSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with
+ * that key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService
+ * keeps the old key.
+ *
+ * ```typescript
+ * class MyModel extends UuidModel {
+ *   secret: EncryptedField<{ apiKey: string }>;
+ * }
+ * await model.secret.set({ apiKey: "..." });
+ * await model.save();
+ * const { apiKey } = await model.secret.get();
+ * ```
+ * @WebdaBehavior Webda/Encrypted
+ */
+export declare class EncryptedField<T = any> {
+    [WEBDA_STORAGE]: Record<string, any>;
+    /** Encrypted value (a JWT wrapping the AES ciphertext), never output */
+    __ciphertext?: string;
+    /**
+     * @returns true when a value is stored
+     */
+    isSet(): boolean;
+    /**
+     * Encrypt and store a value (does not save the model); undefined clears it
+     * @param value - value to store, JSON-serialisable
+     */
+    set(value: T | undefined): Promise<void>;
+    /**
+     * Decrypt the stored value
+     * @returns the value, undefined when none is stored
+     * @throws Error when the ciphertext is invalid (tampered, or encrypted with an unknown key)
+     */
+    get(): Promise<T | undefined>;
+    /**
+     * Remove the stored value (does not save the model)
+     */
+    clear(): void;
+    get parent(): any;
+    toJSON(): Record<string, any>;
+}
+//# sourceMappingURL=encrypted.model.d.ts.map

package/lib/models/encrypted.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.model.d.ts","sourceRoot":"","sources":["../../src/models/encrypted.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAe9C;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG;IACjC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAM;IAC1C,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,KAAK,IAAI,OAAO,CAEf;IAED;;;OAGG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;OAIG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAKlC;IAED;;OAEG;IACH,KAAK,IAAI,IAAI,CAEZ;IACD,IAAI,MAAM,QAAgD;IAC1D,MAAM,wBAcL;CACF"}

package/lib/models/encrypted.model.js

@@ -0,0 +1,87 @@
+import { WEBDA_STORAGE } from "@webda/models";
+import { useDynamicService } from "../core/hooks.js";
+/**
+ * @returns the CryptoService
+ * @throws Error when no CryptoService is available
+ */
+function crypto() {
+    const service = useDynamicService("CryptoService");
+    if (!service) {
+        throw new Error("Encrypted fields require the CryptoService");
+    }
+    return service;
+}
+/**
+ * A model field encrypted at rest with the CryptoService
+ *
+ * Only the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is
+ * JSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with
+ * that key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService
+ * keeps the old key.
+ *
+ * ```typescript
+ * class MyModel extends UuidModel {
+ *   secret: EncryptedField<{ apiKey: string }>;
+ * }
+ * await model.secret.set({ apiKey: "..." });
+ * await model.save();
+ * const { apiKey } = await model.secret.get();
+ * ```
+ * @WebdaBehavior Webda/Encrypted
+ */
+export class EncryptedField {
+    [WEBDA_STORAGE] = {};
+    /** Encrypted value (a JWT wrapping the AES ciphertext), never output */
+    __ciphertext;
+    /**
+     * @returns true when a value is stored
+     */
+    isSet() {
+        return typeof this.__ciphertext === "string" && this.__ciphertext.length > 0;
+    }
+    /**
+     * Encrypt and store a value (does not save the model); undefined clears it
+     * @param value - value to store, JSON-serialisable
+     */
+    async set(value) {
+        if (value === undefined) {
+            this.clear();
+            return;
+        }
+        this.__ciphertext = await crypto().encrypt(value);
+    }
+    /**
+     * Decrypt the stored value
+     * @returns the value, undefined when none is stored
+     * @throws Error when the ciphertext is invalid (tampered, or encrypted with an unknown key)
+     */
+    async get() {
+        if (!this.isSet()) {
+            return undefined;
+        }
+        return crypto().decrypt(this.__ciphertext);
+    }
+    /**
+     * Remove the stored value (does not save the model)
+     */
+    clear() {
+        this.__ciphertext = undefined;
+    }
+    get parent() { return this[WEBDA_STORAGE]["__parent__"]; }
+    toJSON() {
+        const result = {};
+        for (const key of Object.keys(this)) {
+            result[key] = this[key];
+        }
+        const storage = this[WEBDA_STORAGE];
+        if (storage) {
+            for (const key of Object.keys(storage)) {
+                if (key !== "__parent__") {
+                    result[key] = storage[key];
+                }
+            }
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=encrypted.model.js.map

package/lib/models/encrypted.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.model.js","sourceRoot":"","sources":["../../src/models/encrypted.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;GAGG;AACH,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,iBAAiB,CAAM,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,cAAc;IACzB,CAAC,aAAa,CAAC,GAAwB,EAAE,CAAC;IAC1C,wEAAwE;IACxE,YAAY,CAAU;IAEtB;;OAEG;IACH,KAAK;QACH,OAAO,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,KAAoB;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM;QACJ,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAqC,IAAY,CAAC,aAAa,CAAC,CAAC;QAC9E,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/lib/models/ident.model.d.ts

@@ -0,0 +1,128 @@
+import type { PrimaryKeyType } from "@webda/models";
+import { Model, ModelLink, WEBDA_PRIMARY_KEY, WEBDA_PRIMARY_KEY_SEPARATOR, type Settable } from "@webda/models";
+import * as WebdaError from "../errors/errors.js";
+import type { IOperationContext } from "../contexts/icontext.js";
+import { User } from "./user.model.js";
+import { EncryptedField } from "./encrypted.model.js";
+/** Tokens (credentials) of an identity provider, as the provider returns them */
+export interface IdentTokens {
+    /** Access token */
+    access_token?: string;
+    /** Refresh token */
+    refresh_token?: string;
+    /** Any other provider field */
+    [key: string]: any;
+}
+/** Email sending throttle state of an ident (login failures are top-level `Ident` attributes) */
+export interface IdentThrottle {
+    /** Timestamp of the last email sent */
+    lastSentAt?: number;
+}
+/** Raised for malformed ident keys (400 INVALID_IDENT) */
+export declare class InvalidIdent extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message?: string);
+}
+/**
+ * An identity linked to a user: `<providerUid>:<provider>`
+ * @WebdaModel
+ */
+export declare class Ident extends Model {
+    /** Composite primary key */
+    [WEBDA_PRIMARY_KEY]: readonly ["providerUid", "provider"];
+    [WEBDA_PRIMARY_KEY_SEPARATOR]: string;
+    /** Identifier on the provider (normalised email for "email") */
+    providerUid: string;
+    /** Provider name */
+    provider: string;
+    /** Owner */
+    get _user(): ModelLink<User>;
+    set _user(value: string | User | PrimaryKeyType<User> | ModelLink<User>);
+    /** Email asserted for this ident */
+    email?: string;
+    /** When the ident was verified */
+    get verifiedAt(): Date;
+    set verifiedAt(value: string | number | Date);
+    /** Last login with this ident */
+    get lastUsedAt(): Date;
+    set lastUsedAt(value: string | number | Date);
+    /** Email sending throttle state */
+    _throttle: IdentThrottle;
+    /**
+     * Login attempts counted since the last successful login
+     *
+     * Top-level so stores can increment it atomically (nested-path atomic operations are not portable)
+     */
+    _loginAttempts: number;
+    /** Timestamp (ms) of the last counted login attempt */
+    _lastLoginAttemptAt?: number;
+    /** Provider profile */
+    __profile?: any;
+    /** Provider tokens, encrypted at rest (`await ident.tokens.get()`) */
+    tokens: EncryptedField<IdentTokens>;
+    /** @param data - initial data */
+    constructor(data?: Settable<Ident>);
+    /**
+     * Build and validate a key
+     * @param providerUid - uid on the provider
+     * @param provider - provider name
+     * @returns the composite key
+     */
+    static key(providerUid: string, provider: string): {
+        providerUid: string;
+        provider: string;
+    };
+    /**
+     * Parse a v3 storage key `"<providerUid>_<provider>"`, split on its LAST "_" (provider names never
+     * contain "_", provider uids such as emails may)
+     *
+     * Consulted by repositories for keys that are not `"<providerUid>:<provider>"` (see `WEBDA_LEGACY_UID`),
+     * so v3 records stay addressable and queryable until they are upgraded.
+     * @param uid - raw storage key
+     * @returns the key parts, or undefined when the key is not a v3 ident key
+     */
+    static parseLegacyUID(uid: string): {
+        providerUid: string;
+        provider: string;
+    } | undefined;
+    /**
+     * v3 storage key of a record stored before the composite key (v3 kept it as `uuid` in the body)
+     *
+     * Such an ident has no `providerUid`: it must be upgraded (`@webda/auth` `upgradeIdent`) before use.
+     * @returns the v3 key, or undefined for a current ident
+     */
+    getLegacyUID(): string | undefined;
+    /**
+     * Normalise an email for use as providerUid
+     * @param email - raw email
+     * @returns trimmed lowercase email
+     */
+    static normalizeEmail(email: string): string;
+    /**
+     * @returns the owner link
+     */
+    getUser(): ModelLink<User>;
+    /**
+     * @param user - owner uuid or user
+     */
+    setUser(user: string | User): void;
+    /**
+     * @returns the email of this ident
+     */
+    getEmail(): string | undefined;
+    /**
+     * @returns true when verified
+     */
+    isVerified(): boolean;
+    /**
+     * Only the owner may act on an ident
+     * @param ctx - operation context
+     * @param action - action name
+     * @returns true or a refusal reason
+     */
+    canAct(ctx: IOperationContext, action: string): Promise<string | boolean>;
+    /** Generated by @webda/content-mapper: include values held in WEBDA_STORAGE. */
+    toJSON(): any;
+    protected __hydrateBehaviors(rawData?: any): void;
+}
+//# sourceMappingURL=ident.model.d.ts.map

package/lib/models/ident.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ident.model.d.ts","sourceRoot":"","sources":["../../src/models/ident.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,qBAAa,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAE,MAAwB,EAE5C;CACF;AAID;;;GAGG;AACH,qBAAa,KAAM,SAAQ,KAAK;IAC9B,4BAA4B;IAC5B,CAAC,iBAAiB,CAAC,YAAI,aAAa,EAAE,UAAU,EAAW;IAE3D,CAAC,2BAA2B,CAAC,SAAO;IACpC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY;IACZ,IAAI,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAE3B;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAUtE;IACD,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,IAAI,UAAU,IAAI,IAAI,CAErB;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE3C;IACD,iCAAiC;IACjC,IAAI,UAAU,IAAI,IAAI,CAErB;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE3C;IACD,mCAAmC;IACnC,SAAS,EAAE,aAAa,CAAM;IAC9B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAK;IAC3B,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IAEpC,iCAAiC;IACjC,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAOjC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAU3F;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CASxF;IAED;;;;;OAKG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS,CAMjC;IAED;;;;OAIG;IACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;OAEG;IACH,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAEzB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAIjC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;OAEG;IACH,UAAU,IAAI,OAAO,CAEpB;IAED;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAK9E;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,CAQZ;IACD,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CAiBhD;CACF"}

package/lib/models/ident.model.js

@@ -0,0 +1,207 @@
+import { WEBDA_STORAGE } from "@webda/models";
+import { Model, ModelLink, WEBDA_PRIMARY_KEY, WEBDA_PRIMARY_KEY_SEPARATOR } from "@webda/models";
+import * as WebdaError from "../errors/errors.js";
+import { User } from "./user.model.js";
+import { EncryptedField } from "./encrypted.model.js";
+/** Raised for malformed ident keys (400 INVALID_IDENT) */
+export class InvalidIdent extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message = "Invalid ident") {
+        super(message, 400);
+    }
+}
+const SEPARATOR = ":";
+/**
+ * An identity linked to a user: `<providerUid>:<provider>`
+ * @WebdaModel
+ */
+export class Ident extends Model {
+    /** Composite primary key */
+    [WEBDA_PRIMARY_KEY] = ["providerUid", "provider"];
+    // Must stay a string literal: the content mapper reads it textually
+    [WEBDA_PRIMARY_KEY_SEPARATOR] = ":";
+    /** Identifier on the provider (normalised email for "email") */
+    providerUid;
+    /** Provider name */
+    provider;
+    /** Owner */
+    get _user() {
+        return this[WEBDA_STORAGE]["_user"];
+    }
+    set _user(value) {
+        if (value instanceof ModelLink) {
+            this[WEBDA_STORAGE]["_user"] = value;
+        }
+        else if (value != null) {
+            const inst = this[WEBDA_STORAGE]["_user"] || new ModelLink(User);
+            inst.set(value);
+            this[WEBDA_STORAGE]["_user"] = inst;
+        }
+        else {
+            this[WEBDA_STORAGE]["_user"] = value;
+        }
+    }
+    /** Email asserted for this ident */
+    email;
+    /** When the ident was verified */
+    get verifiedAt() {
+        return this[WEBDA_STORAGE]["verifiedAt"];
+    }
+    set verifiedAt(value) {
+        this[WEBDA_STORAGE]["verifiedAt"] = value !== undefined && value !== null ? new Date(value) : value;
+    }
+    /** Last login with this ident */
+    get lastUsedAt() {
+        return this[WEBDA_STORAGE]["lastUsedAt"];
+    }
+    set lastUsedAt(value) {
+        this[WEBDA_STORAGE]["lastUsedAt"] = value !== undefined && value !== null ? new Date(value) : value;
+    }
+    /** Email sending throttle state */
+    _throttle = {};
+    /**
+     * Login attempts counted since the last successful login
+     *
+     * Top-level so stores can increment it atomically (nested-path atomic operations are not portable)
+     */
+    _loginAttempts = 0;
+    /** Timestamp (ms) of the last counted login attempt */
+    _lastLoginAttemptAt;
+    /** Provider profile */
+    __profile;
+    /** Provider tokens, encrypted at rest (`await ident.tokens.get()`) */
+    tokens;
+    /** @param data - initial data */
+    constructor(data) {
+        super();
+        Object.assign(this, data);
+        // Raw stored data (or none) must become an EncryptedField behavior
+        if (!(this.tokens instanceof EncryptedField)) {
+            this.__hydrateBehaviors?.({ tokens: data?.tokens ?? {} });
+        }
+    }
+    /**
+     * Build and validate a key
+     * @param providerUid - uid on the provider
+     * @param provider - provider name
+     * @returns the composite key
+     */
+    static key(providerUid, provider) {
+        for (const [name, v] of [
+            ["providerUid", providerUid],
+            ["provider", provider]
+        ]) {
+            if (typeof v !== "string" || v.length === 0 || v.includes(SEPARATOR)) {
+                throw new InvalidIdent(`${name} must be a non-empty string without '${SEPARATOR}'`);
+            }
+        }
+        return { providerUid, provider };
+    }
+    /**
+     * Parse a v3 storage key `"<providerUid>_<provider>"`, split on its LAST "_" (provider names never
+     * contain "_", provider uids such as emails may)
+     *
+     * Consulted by repositories for keys that are not `"<providerUid>:<provider>"` (see `WEBDA_LEGACY_UID`),
+     * so v3 records stay addressable and queryable until they are upgraded.
+     * @param uid - raw storage key
+     * @returns the key parts, or undefined when the key is not a v3 ident key
+     */
+    static parseLegacyUID(uid) {
+        if (typeof uid !== "string" || uid.includes(SEPARATOR)) {
+            return undefined;
+        }
+        const i = uid.lastIndexOf("_");
+        if (i <= 0 || i === uid.length - 1) {
+            return undefined;
+        }
+        return { providerUid: uid.substring(0, i), provider: uid.substring(i + 1) };
+    }
+    /**
+     * v3 storage key of a record stored before the composite key (v3 kept it as `uuid` in the body)
+     *
+     * Such an ident has no `providerUid`: it must be upgraded (`@webda/auth` `upgradeIdent`) before use.
+     * @returns the v3 key, or undefined for a current ident
+     */
+    getLegacyUID() {
+        const uuid = this.uuid;
+        if (this.providerUid || typeof uuid !== "string" || !Ident.parseLegacyUID(uuid)) {
+            return undefined;
+        }
+        return uuid;
+    }
+    /**
+     * Normalise an email for use as providerUid
+     * @param email - raw email
+     * @returns trimmed lowercase email
+     */
+    static normalizeEmail(email) {
+        return `${email ?? ""}`.trim().toLowerCase();
+    }
+    /**
+     * @returns the owner link
+     */
+    getUser() {
+        return this._user;
+    }
+    /**
+     * @param user - owner uuid or user
+     */
+    setUser(user) {
+        const uuid = typeof user === "string" ? user : user.getUUID();
+        this._user ??= new ModelLink(User).set(uuid);
+        this._user.set(uuid);
+    }
+    /**
+     * @returns the email of this ident
+     */
+    getEmail() {
+        return this.email;
+    }
+    /**
+     * @returns true when verified
+     */
+    isVerified() {
+        return this.verifiedAt !== undefined && this.verifiedAt !== null;
+    }
+    /**
+     * Only the owner may act on an ident
+     * @param ctx - operation context
+     * @param action - action name
+     * @returns true or a refusal reason
+     */
+    async canAct(ctx, action) {
+        if (!ctx.getCurrentUserId() || this._user?.toString() !== ctx.getCurrentUserId()) {
+            return "You can't act on this ident";
+        }
+        return true;
+    }
+    /** Generated by @webda/content-mapper: include values held in WEBDA_STORAGE. */
+    toJSON() {
+        const parent = super.toJSON ? super.toJSON() : {};
+        const result = parent === this ? {} : parent;
+        for (const key of Object.keys(this)) {
+            result[key] = this[key];
+        }
+        Object.assign(result, this[WEBDA_STORAGE]);
+        return result;
+    }
+    __hydrateBehaviors(rawData) {
+        {
+            let v = this.tokens;
+            if (rawData !== undefined && rawData !== null && rawData["tokens"] !== undefined) {
+                v = rawData["tokens"];
+            }
+            if (!(v instanceof EncryptedField)) {
+                const inst = new EncryptedField();
+                if (v !== undefined && v !== null) {
+                    Object.assign(inst, v);
+                }
+                v = inst;
+            }
+            v[WEBDA_STORAGE] = v[WEBDA_STORAGE] || {};
+            v[WEBDA_STORAGE]["__parent__"] = { instance: this, attribute: "tokens" };
+            this.tokens = v;
+        }
+    }
+}
+//# sourceMappingURL=ident.model.js.map