@webda/core 4.0.0-beta.3 → 4.0.0-beta.5

package/webda.module.json

@@ -57,130 +57,6 @@
       },
       "Configuration": "lib/services/audit.model:AuditServiceParameters"
     },
-    "Webda/Authentication": {
-      "Import": "lib/services/authentication.service:Authentication",
-      "Schema": {
-        "$schema": "http://json-schema.org/draft-07/schema#",
-        "additionalProperties": false,
-        "definitions": {
-          "email": {
-            "additionalProperties": false,
-            "description": "Enable the email authentication",
-            "properties": {
-              "delay": {
-                "default": "3600000 * 4",
-                "description": "Minimal delay between two password recovery or validation email",
-                "type": "number"
-              },
-              "failedLoginBeforeDelay": {
-                "default": 3,
-                "description": "When a delay is added between two attempt to authenticate",
-                "type": "number"
-              },
-              "mailer": {
-                "description": "Mailer service name",
-                "enum": [
-                  "Registry",
-                  "CryptoService",
-                  "SessionManager"
-                ],
-                "type": "string"
-              },
-              "postValidation": {
-                "default": false,
-                "description": "Allow user to create their account without validating their email first",
-                "type": "boolean"
-              },
-              "skipEmailValidation": {
-                "default": false,
-                "description": "Do not even validate the email at all",
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "password": {
-            "additionalProperties": false,
-            "properties": {
-              "regexp": {
-                "default": "{8,}",
-                "description": "Regexp that password must check",
-                "type": "string"
-              },
-              "verifier": {
-                "description": "Password verifier Service name",
-                "enum": [
-                  "Registry",
-                  "CryptoService",
-                  "SessionManager"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "description": "Parameters for the Authentication service including identity, email, and password settings",
-        "properties": {
-          "email": {
-            "$ref": "#/definitions/email",
-            "description": "Enable the email authentication"
-          },
-          "failureRedirect": {
-            "description": "Redirect to this page when email validation failed",
-            "type": "string"
-          },
-          "identModel": {
-            "default": "Webda/Ident",
-            "description": "Idents store for authentication identifiers",
-            "type": "string"
-          },
-          "password": {
-            "$ref": "#/definitions/password"
-          },
-          "registerRedirect": {
-            "description": "Redirect to this page once email is validate to finish the registration process",
-            "type": "string"
-          },
-          "salt": {
-            "description": "Number of salt iteration for bcrypt.hashSync",
-            "type": "string"
-          },
-          "successRedirect": {
-            "description": "Redirect to this page when email validation succeed",
-            "type": "string"
-          },
-          "type": {
-            "description": "Type of the service",
-            "type": "string"
-          },
-          "url": {
-            "default": "/auth",
-            "type": "string"
-          },
-          "userModel": {
-            "default": "Webda/User",
-            "description": "User store for authentication users",
-            "type": "string"
-          },
-          "openapi": {
-            "type": "object",
-            "additionalProperties": true
-          }
-        },
-        "required": [
-          "failureRedirect",
-          "password",
-          "registerRedirect",
-          "salt",
-          "successRedirect",
-          "type"
-        ],
-        "type": "object",
-        "title": "Authentication"
-      },
-      "Configuration": "lib/services/authentication.service:AuthenticationParameters"
-    },
     "Webda/Binary": {
       "Import": "lib/services/binary.service:BinaryService",
       "Schema": {
@@ -1413,6 +1289,7 @@
               "enum": [
                 "Registry",
                 "CryptoService",
+                "TokenService",
                 "SessionManager"
               ],
               "type": "string"
@@ -1695,6 +1572,40 @@
           ]
         }
       }
+    },
+    "Webda/TokenService": {
+      "Import": "lib/services/token.service:TokenService",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "description": "TokenService parameters",
+        "properties": {
+          "accessTtl": {
+            "default": 900,
+            "description": "Access token lifetime in seconds",
+            "type": "number"
+          },
+          "refreshTtl": {
+            "default": 2592000,
+            "description": "Refresh token lifetime in seconds",
+            "type": "number"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "type"
+        ],
+        "type": "object",
+        "title": "TokenService"
+      },
+      "Configuration": "lib/services/token.service:TokenServiceParameters"
     }
   },
   "models": {
@@ -1731,7 +1642,7 @@
         "Output": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
-          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object\nThe owner can be changed by the owner",
+          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object, set from the caller on create.\nThe owner is never taken from client input.",
           "properties": {
             "_user": {
               "allOf": [
@@ -1767,7 +1678,7 @@
         "Input": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
-          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object\nThe owner can be changed by the owner",
+          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object, set from the caller on create.\nThe owner is never taken from client input.",
           "properties": {
             "_user": {
               "allOf": [
@@ -1803,7 +1714,7 @@
         "Stored": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
-          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object\nThe owner can be changed by the owner",
+          "description": "Abstract class to define an object with an owner\n\nThe owner is the user that created the object, set from the caller on create.\nThe owner is never taken from client input.",
           "properties": {
             "_user": {
               "allOf": [
@@ -2134,57 +2045,58 @@
         "links": [
           {
             "attribute": "_user",
+            "model": "Webda/User",
             "type": "LINK"
           }
+        ],
+        "behaviors": [
+          {
+            "attribute": "tokens",
+            "behavior": "Webda/Encrypted"
+          }
         ]
       },
-      "Ancestors": [
-        "Webda/OwnerModel",
-        "Webda/AbstractOwnerModel"
-      ],
+      "Ancestors": [],
       "Subclasses": [],
       "Reflection": {
-        "_type": {
+        "providerUid": {
           "type": "string"
         },
-        "uid": {
+        "provider": {
           "type": "string"
         },
-        "__profile": {
-          "type": "any"
+        "_user": {
+          "type": "ModelLink",
+          "typeParameters": [
+            "User"
+          ]
         },
-        "__tokens": {
-          "type": "IdentTokens"
+        "email": {
+          "type": "string"
         },
-        "_lastUsed": {
+        "verifiedAt": {
           "type": "Date"
         },
-        "_failedLogin": {
-          "type": "number"
+        "lastUsedAt": {
+          "type": "Date"
         },
-        "_lastValidationEmail": {
-          "type": "number"
+        "_throttle": {
+          "type": "IdentThrottle"
         },
-        "_validation": {
-          "type": "Date"
+        "_loginAttempts": {
+          "type": "number"
         },
-        "email": {
-          "type": "string"
+        "_lastLoginAttemptAt": {
+          "type": "number"
         },
-        "provider": {
-          "type": "string"
+        "__profile": {
+          "type": "any"
         },
-        "_user": {
-          "type": "ModelLink",
+        "tokens": {
+          "type": "EncryptedField",
           "typeParameters": [
-            "User"
+            "IdentTokens"
           ]
-        },
-        "public": {
-          "type": "boolean"
-        },
-        "uuid": {
-          "type": "string"
         }
       },
       "Schemas": {
@@ -2192,91 +2104,84 @@
           "$schema": "http://json-schema.org/draft-07/schema#",
           "WebdaModel": true,
           "additionalProperties": false,
-          "class": true,
           "definitions": {
-            "IdentTokens": {
+            "EncryptedField<IdentTokens>": {
+              "WebdaBehavior": "Webda/Encrypted",
               "additionalProperties": false,
-              "description": "OAuth tokens associated with an identity provider",
+              "description": "A model field encrypted at rest with the CryptoService\n\nOnly the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is\nJSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with\nthat key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService\nkeeps the old key.\n\n```typescript\nclass MyModel extends UuidModel {\n  secret: EncryptedField<{ apiKey: string }>;\n}\nawait model.secret.set({ apiKey: \"...\" });\nawait model.save();\nconst { apiKey } = await model.secret.get();\n```",
               "properties": {
-                "access": {
-                  "type": "string"
-                },
-                "refresh": {
+                "__ciphertext": {
+                  "description": "Encrypted value (a JWT wrapping the AES ciphertext), never output",
                   "type": "string"
                 }
               },
-              "required": [
-                "access",
-                "refresh"
-              ],
+              "type": "object"
+            },
+            "IdentThrottle": {
+              "additionalProperties": false,
+              "description": "Email sending throttle state of an ident (login failures are top-level `Ident` attributes)",
+              "properties": {
+                "lastSentAt": {
+                  "description": "Timestamp of the last email sent",
+                  "type": "number"
+                }
+              },
               "type": "object"
             }
           },
-          "description": "First basic model for Ident",
+          "description": "An identity linked to a user: `<providerUid>:<provider>`",
           "properties": {
             "__profile": {
               "description": "Provider profile"
             },
-            "__tokens": {
-              "$ref": "#/definitions/IdentTokens",
-              "description": "Tokens for this ident"
-            },
-            "_failedLogin": {
-              "description": "If the ident is validated",
+            "_lastLoginAttemptAt": {
+              "description": "Timestamp (ms) of the last counted login attempt",
               "type": "number"
             },
-            "_lastUsed": {
-              "description": "Last time the ident was used",
-              "format": "date-time",
-              "type": "string"
-            },
-            "_lastValidationEmail": {
-              "description": "If EmailIdent",
+            "_loginAttempts": {
+              "description": "Login attempts counted since the last successful login\n\nTop-level so stores can increment it atomically (nested-path atomic operations are not portable)",
               "type": "number"
             },
-            "_type": {
-              "description": "Type of the ident",
-              "type": "string"
+            "_throttle": {
+              "$ref": "#/definitions/IdentThrottle",
+              "description": "Email sending throttle state"
             },
             "_user": {
-              "description": "Default owner of the object",
+              "description": "Owner",
               "type": "string"
             },
-            "_validation": {
-              "description": "When the ident was validated",
-              "format": "date-time",
+            "email": {
+              "description": "Email asserted for this ident",
               "type": "string"
             },
-            "email": {
-              "description": "Email for this ident if it exist",
+            "lastUsedAt": {
+              "description": "Last login with this ident",
+              "format": "date-time",
               "type": "string"
             },
             "provider": {
-              "description": "Provider id",
+              "description": "Provider name",
               "type": "string"
             },
-            "public": {
-              "default": false,
-              "description": "Define if the object is publicly readable",
-              "type": "boolean"
-            },
-            "uid": {
-              "description": "Uid on the provider",
+            "providerUid": {
+              "description": "Identifier on the provider (normalised email for \"email\")",
               "type": "string"
             },
-            "uuid": {
-              "description": "UUID of the model",
-              "format": "uuid",
+            "tokens": {
+              "$ref": "#/definitions/EncryptedField%3CIdentTokens%3E",
+              "description": "Provider tokens, encrypted at rest (`await ident.tokens.get()`)"
+            },
+            "verifiedAt": {
+              "description": "When the ident was verified",
+              "format": "date-time",
               "type": "string"
             }
           },
           "required": [
-            "__profile",
-            "__tokens",
-            "_type",
             "_user",
-            "uid",
-            "uuid"
+            "provider",
+            "providerUid",
+            "tokens"
           ],
           "type": "object",
           "$webda": "toDto$auto"
@@ -2285,91 +2190,84 @@
           "$schema": "http://json-schema.org/draft-07/schema#",
           "WebdaModel": true,
           "additionalProperties": false,
-          "class": true,
           "definitions": {
-            "IdentTokens": {
+            "EncryptedField<IdentTokens>": {
+              "WebdaBehavior": "Webda/Encrypted",
               "additionalProperties": false,
-              "description": "OAuth tokens associated with an identity provider",
+              "description": "A model field encrypted at rest with the CryptoService\n\nOnly the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is\nJSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with\nthat key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService\nkeeps the old key.\n\n```typescript\nclass MyModel extends UuidModel {\n  secret: EncryptedField<{ apiKey: string }>;\n}\nawait model.secret.set({ apiKey: \"...\" });\nawait model.save();\nconst { apiKey } = await model.secret.get();\n```",
               "properties": {
-                "access": {
-                  "type": "string"
-                },
-                "refresh": {
+                "__ciphertext": {
+                  "description": "Encrypted value (a JWT wrapping the AES ciphertext), never output",
                   "type": "string"
                 }
               },
-              "required": [
-                "access",
-                "refresh"
-              ],
+              "type": "object"
+            },
+            "IdentThrottle": {
+              "additionalProperties": false,
+              "description": "Email sending throttle state of an ident (login failures are top-level `Ident` attributes)",
+              "properties": {
+                "lastSentAt": {
+                  "description": "Timestamp of the last email sent",
+                  "type": "number"
+                }
+              },
               "type": "object"
             }
           },
-          "description": "First basic model for Ident",
+          "description": "An identity linked to a user: `<providerUid>:<provider>`",
           "properties": {
             "__profile": {
               "description": "Provider profile"
             },
-            "__tokens": {
-              "$ref": "#/definitions/IdentTokens",
-              "description": "Tokens for this ident"
-            },
-            "_failedLogin": {
-              "description": "If the ident is validated",
+            "_lastLoginAttemptAt": {
+              "description": "Timestamp (ms) of the last counted login attempt",
               "type": "number"
             },
-            "_lastUsed": {
-              "description": "Last time the ident was used",
-              "format": "date-time",
-              "type": "string"
-            },
-            "_lastValidationEmail": {
-              "description": "If EmailIdent",
+            "_loginAttempts": {
+              "description": "Login attempts counted since the last successful login\n\nTop-level so stores can increment it atomically (nested-path atomic operations are not portable)",
               "type": "number"
             },
-            "_type": {
-              "description": "Type of the ident",
-              "type": "string"
+            "_throttle": {
+              "$ref": "#/definitions/IdentThrottle",
+              "description": "Email sending throttle state"
             },
             "_user": {
-              "description": "Default owner of the object",
+              "description": "Owner",
               "type": "string"
             },
-            "_validation": {
-              "description": "When the ident was validated",
-              "format": "date-time",
+            "email": {
+              "description": "Email asserted for this ident",
               "type": "string"
             },
-            "email": {
-              "description": "Email for this ident if it exist",
+            "lastUsedAt": {
+              "description": "Last login with this ident",
+              "format": "date-time",
               "type": "string"
             },
             "provider": {
-              "description": "Provider id",
+              "description": "Provider name",
               "type": "string"
             },
-            "public": {
-              "default": false,
-              "description": "Define if the object is publicly readable",
-              "type": "boolean"
-            },
-            "uid": {
-              "description": "Uid on the provider",
+            "providerUid": {
+              "description": "Identifier on the provider (normalised email for \"email\")",
               "type": "string"
             },
-            "uuid": {
-              "description": "UUID of the model",
-              "format": "uuid",
+            "tokens": {
+              "$ref": "#/definitions/EncryptedField%3CIdentTokens%3E",
+              "description": "Provider tokens, encrypted at rest (`await ident.tokens.get()`)"
+            },
+            "verifiedAt": {
+              "description": "When the ident was verified",
+              "format": "date-time",
               "type": "string"
             }
           },
           "required": [
-            "__profile",
-            "__tokens",
-            "_type",
             "_user",
-            "uid",
-            "uuid"
+            "provider",
+            "providerUid",
+            "tokens"
           ],
           "type": "object",
           "$webda": "fromDto$auto"
@@ -2378,91 +2276,84 @@
           "$schema": "http://json-schema.org/draft-07/schema#",
           "WebdaModel": true,
           "additionalProperties": false,
-          "class": true,
           "definitions": {
-            "IdentTokens": {
+            "EncryptedField<IdentTokens>": {
+              "WebdaBehavior": "Webda/Encrypted",
               "additionalProperties": false,
-              "description": "OAuth tokens associated with an identity provider",
+              "description": "A model field encrypted at rest with the CryptoService\n\nOnly the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is\nJSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with\nthat key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService\nkeeps the old key.\n\n```typescript\nclass MyModel extends UuidModel {\n  secret: EncryptedField<{ apiKey: string }>;\n}\nawait model.secret.set({ apiKey: \"...\" });\nawait model.save();\nconst { apiKey } = await model.secret.get();\n```",
               "properties": {
-                "access": {
-                  "type": "string"
-                },
-                "refresh": {
+                "__ciphertext": {
+                  "description": "Encrypted value (a JWT wrapping the AES ciphertext), never output",
                   "type": "string"
                 }
               },
-              "required": [
-                "access",
-                "refresh"
-              ],
+              "type": "object"
+            },
+            "IdentThrottle": {
+              "additionalProperties": false,
+              "description": "Email sending throttle state of an ident (login failures are top-level `Ident` attributes)",
+              "properties": {
+                "lastSentAt": {
+                  "description": "Timestamp of the last email sent",
+                  "type": "number"
+                }
+              },
               "type": "object"
             }
           },
-          "description": "First basic model for Ident",
+          "description": "An identity linked to a user: `<providerUid>:<provider>`",
           "properties": {
             "__profile": {
               "description": "Provider profile"
             },
-            "__tokens": {
-              "$ref": "#/definitions/IdentTokens",
-              "description": "Tokens for this ident"
-            },
-            "_failedLogin": {
-              "description": "If the ident is validated",
+            "_lastLoginAttemptAt": {
+              "description": "Timestamp (ms) of the last counted login attempt",
               "type": "number"
             },
-            "_lastUsed": {
-              "description": "Last time the ident was used",
-              "format": "date-time",
-              "type": "string"
-            },
-            "_lastValidationEmail": {
-              "description": "If EmailIdent",
+            "_loginAttempts": {
+              "description": "Login attempts counted since the last successful login\n\nTop-level so stores can increment it atomically (nested-path atomic operations are not portable)",
               "type": "number"
             },
-            "_type": {
-              "description": "Type of the ident",
-              "type": "string"
+            "_throttle": {
+              "$ref": "#/definitions/IdentThrottle",
+              "description": "Email sending throttle state"
             },
             "_user": {
-              "description": "Default owner of the object",
+              "description": "Owner",
               "type": "string"
             },
-            "_validation": {
-              "description": "When the ident was validated",
-              "format": "date-time",
+            "email": {
+              "description": "Email asserted for this ident",
               "type": "string"
             },
-            "email": {
-              "description": "Email for this ident if it exist",
+            "lastUsedAt": {
+              "description": "Last login with this ident",
+              "format": "date-time",
               "type": "string"
             },
             "provider": {
-              "description": "Provider id",
+              "description": "Provider name",
               "type": "string"
             },
-            "public": {
-              "default": false,
-              "description": "Define if the object is publicly readable",
-              "type": "boolean"
-            },
-            "uid": {
-              "description": "Uid on the provider",
+            "providerUid": {
+              "description": "Identifier on the provider (normalised email for \"email\")",
               "type": "string"
             },
-            "uuid": {
-              "description": "UUID of the model",
-              "format": "uuid",
+            "tokens": {
+              "$ref": "#/definitions/EncryptedField%3CIdentTokens%3E",
+              "description": "Provider tokens, encrypted at rest (`await ident.tokens.get()`)"
+            },
+            "verifiedAt": {
+              "description": "When the ident was verified",
+              "format": "date-time",
               "type": "string"
             }
           },
           "required": [
-            "__profile",
-            "__tokens",
-            "_type",
             "_user",
-            "uid",
-            "uuid"
+            "provider",
+            "providerUid",
+            "tokens"
           ],
           "type": "object",
           "$webda": "toJSON$return"
@@ -2484,9 +2375,11 @@
         "Queried"
       ],
       "PrimaryKey": [
-        "uuid"
+        "providerUid",
+        "provider"
       ],
-      "Identifier": "Webda/Ident"
+      "Identifier": "Webda/Ident",
+      "PrimaryKeySeparator": ":"
     },
     "Webda/OwnerModel": {
       "Plural": "OwnerModels",
@@ -2502,9 +2395,7 @@
       "Ancestors": [
         "Webda/AbstractOwnerModel"
       ],
-      "Subclasses": [
-        "Webda/Ident"
-      ],
+      "Subclasses": [],
       "Reflection": {
         "_user": {
           "type": "ModelLink",
@@ -2622,25 +2513,286 @@
       ],
       "Identifier": "Webda/OwnerModel"
     },
-    "Webda/RegistryEntry": {
-      "Plural": "RegistryEntries",
-      "Import": "lib/models/registry.model:RegistryEntry",
+    "Webda/RefreshToken": {
+      "Plural": "RefreshTokens",
+      "Import": "lib/models/refreshtoken.model:RefreshToken",
       "Relations": {},
       "Ancestors": [],
       "Subclasses": [],
       "Reflection": {
-        "uuid": {
+        "hash": {
+          "type": "string"
+        },
+        "userId": {
+          "type": "string"
+        },
+        "identId": {
+          "type": "string"
+        },
+        "provider": {
+          "type": "string"
+        },
+        "amr": {
+          "type": "Array",
+          "typeParameters": [
+            "string"
+          ]
+        },
+        "mfa": {
+          "type": "MfaState"
+        },
+        "family": {
           "type": "string"
+        },
+        "expiresAt": {
+          "type": "number"
+        },
+        "rotatedAt": {
+          "type": "number"
+        },
+        "revokedAt": {
+          "type": "number"
         }
       },
       "Schemas": {
         "Output": {
           "$schema": "http://json-schema.org/draft-07/schema#",
+          "WebdaModel": true,
           "additionalProperties": false,
-          "description": "Specific type for registry",
+          "description": "Stored refresh token (only its SHA-256 hash)",
           "properties": {
-            "uuid": {
-              "description": "UUID of the model",
+            "amr": {
+              "description": "Authentication methods",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "expiresAt": {
+              "description": "Expiry, ms since epoch",
+              "type": "number"
+            },
+            "family": {
+              "description": "Rotation family",
+              "type": "string"
+            },
+            "hash": {
+              "description": "SHA-256 hex of the token",
+              "type": "string"
+            },
+            "identId": {
+              "description": "Ident used to log in",
+              "type": "string"
+            },
+            "mfa": {
+              "default": "none",
+              "description": "MFA state of the session that issued the token",
+              "enum": [
+                "none",
+                "pending",
+                "verified"
+              ],
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider used",
+              "type": "string"
+            },
+            "revokedAt": {
+              "description": "Set when revoked",
+              "type": "number"
+            },
+            "rotatedAt": {
+              "description": "Set once exchanged",
+              "type": "number"
+            },
+            "userId": {
+              "description": "Owner",
+              "type": "string"
+            }
+          },
+          "required": [
+            "expiresAt",
+            "family",
+            "hash",
+            "identId",
+            "userId"
+          ],
+          "type": "object",
+          "$webda": "toDto$auto"
+        },
+        "Input": {
+          "$schema": "http://json-schema.org/draft-07/schema#",
+          "WebdaModel": true,
+          "additionalProperties": false,
+          "description": "Stored refresh token (only its SHA-256 hash)",
+          "properties": {
+            "amr": {
+              "description": "Authentication methods",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "expiresAt": {
+              "description": "Expiry, ms since epoch",
+              "type": "number"
+            },
+            "family": {
+              "description": "Rotation family",
+              "type": "string"
+            },
+            "hash": {
+              "description": "SHA-256 hex of the token",
+              "type": "string"
+            },
+            "identId": {
+              "description": "Ident used to log in",
+              "type": "string"
+            },
+            "mfa": {
+              "default": "none",
+              "description": "MFA state of the session that issued the token",
+              "enum": [
+                "none",
+                "pending",
+                "verified"
+              ],
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider used",
+              "type": "string"
+            },
+            "revokedAt": {
+              "description": "Set when revoked",
+              "type": "number"
+            },
+            "rotatedAt": {
+              "description": "Set once exchanged",
+              "type": "number"
+            },
+            "userId": {
+              "description": "Owner",
+              "type": "string"
+            }
+          },
+          "required": [
+            "expiresAt",
+            "family",
+            "hash",
+            "identId",
+            "userId"
+          ],
+          "type": "object",
+          "$webda": "fromDto$auto"
+        },
+        "Stored": {
+          "$schema": "http://json-schema.org/draft-07/schema#",
+          "WebdaModel": true,
+          "additionalProperties": false,
+          "description": "Stored refresh token (only its SHA-256 hash)",
+          "properties": {
+            "amr": {
+              "description": "Authentication methods",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "expiresAt": {
+              "description": "Expiry, ms since epoch",
+              "type": "number"
+            },
+            "family": {
+              "description": "Rotation family",
+              "type": "string"
+            },
+            "hash": {
+              "description": "SHA-256 hex of the token",
+              "type": "string"
+            },
+            "identId": {
+              "description": "Ident used to log in",
+              "type": "string"
+            },
+            "mfa": {
+              "default": "none",
+              "description": "MFA state of the session that issued the token",
+              "enum": [
+                "none",
+                "pending",
+                "verified"
+              ],
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider used",
+              "type": "string"
+            },
+            "revokedAt": {
+              "description": "Set when revoked",
+              "type": "number"
+            },
+            "rotatedAt": {
+              "description": "Set once exchanged",
+              "type": "number"
+            },
+            "userId": {
+              "description": "Owner",
+              "type": "string"
+            }
+          },
+          "required": [
+            "expiresAt",
+            "family",
+            "hash",
+            "identId",
+            "userId"
+          ],
+          "type": "object",
+          "$webda": "toJSON$return"
+        }
+      },
+      "Actions": {},
+      "Events": [
+        "Create",
+        "PartialUpdate",
+        "Delete",
+        "Update",
+        "Patch",
+        "Query",
+        "Created",
+        "PartialUpdated",
+        "Deleted",
+        "Patched",
+        "Updated",
+        "Queried"
+      ],
+      "PrimaryKey": [
+        "hash"
+      ],
+      "Identifier": "Webda/RefreshToken"
+    },
+    "Webda/RegistryEntry": {
+      "Plural": "RegistryEntries",
+      "Import": "lib/models/registry.model:RegistryEntry",
+      "Relations": {},
+      "Ancestors": [],
+      "Subclasses": [],
+      "Reflection": {
+        "uuid": {
+          "type": "string"
+        }
+      },
+      "Schemas": {
+        "Output": {
+          "$schema": "http://json-schema.org/draft-07/schema#",
+          "additionalProperties": false,
+          "description": "Specific type for registry",
+          "properties": {
+            "uuid": {
+              "description": "UUID of the model",
               "format": "uuid",
               "type": "string"
             }
@@ -2872,6 +3024,12 @@
             "model": "Webda/Ident",
             "targetAttribute": "User"
           }
+        ],
+        "behaviors": [
+          {
+            "attribute": "password",
+            "behavior": "Webda/Password"
+          }
         ]
       },
       "Ancestors": [
@@ -2899,15 +3057,12 @@
             "\"_user\""
           ]
         },
-        "__password": {
-          "type": "string"
+        "password": {
+          "type": "Password"
         },
         "displayName": {
           "type": "string"
         },
-        "_lastPasswordRecovery": {
-          "type": "number"
-        },
         "_avatar": {
           "type": "string"
         },
@@ -2925,12 +3080,26 @@
         "Output": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "Simple user offers groups and roles management\n\nGroups and roles are defined just as string, no\nmodels",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
@@ -2942,10 +3111,6 @@
               },
               "type": "array"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "_roles": {
               "description": "Roles of the user",
               "items": {
@@ -2967,6 +3132,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -2983,12 +3152,26 @@
         "Input": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "Simple user offers groups and roles management\n\nGroups and roles are defined just as string, no\nmodels",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
@@ -3000,10 +3183,6 @@
               },
               "type": "array"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "_roles": {
               "description": "Roles of the user",
               "items": {
@@ -3025,6 +3204,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -3041,12 +3224,26 @@
         "Stored": {
           "$schema": "http://json-schema.org/draft-07/schema#",
           "additionalProperties": false,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "Simple user offers groups and roles management\n\nGroups and roles are defined just as string, no\nmodels",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
@@ -3058,10 +3255,6 @@
               },
               "type": "array"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "_roles": {
               "description": "Roles of the user",
               "items": {
@@ -3083,6 +3276,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -3122,21 +3319,25 @@
     "Webda/User": {
       "Plural": "Users",
       "Import": "lib/models/user.model:User",
-      "Relations": {},
+      "Relations": {
+        "behaviors": [
+          {
+            "attribute": "password",
+            "behavior": "Webda/Password"
+          }
+        ]
+      },
       "Ancestors": [],
       "Subclasses": [
         "Webda/SimpleUser"
       ],
       "Reflection": {
-        "__password": {
-          "type": "string"
+        "password": {
+          "type": "Password"
         },
         "displayName": {
           "type": "string"
         },
-        "_lastPasswordRecovery": {
-          "type": "number"
-        },
         "_avatar": {
           "type": "string"
         },
@@ -3156,20 +3357,30 @@
           "WebdaModel": true,
           "additionalProperties": false,
           "class": true,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "First basic model for User",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "displayName": {
               "Frontend": true,
               "description": "Display name for this user",
@@ -3184,6 +3395,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -3202,20 +3417,30 @@
           "WebdaModel": true,
           "additionalProperties": false,
           "class": true,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "First basic model for User",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "displayName": {
               "Frontend": true,
               "description": "Display name for this user",
@@ -3230,6 +3455,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -3248,20 +3477,30 @@
           "WebdaModel": true,
           "additionalProperties": false,
           "class": true,
+          "definitions": {
+            "Password": {
+              "WebdaBehavior": "Webda/Password",
+              "additionalProperties": false,
+              "description": "Password credential of a user: bcrypt hash and change timestamp",
+              "properties": {
+                "__hash": {
+                  "description": "bcrypt hash, never output",
+                  "type": "string"
+                },
+                "changedAt": {
+                  "description": "Last change, ms since epoch",
+                  "type": "number"
+                }
+              },
+              "type": "object"
+            }
+          },
           "description": "First basic model for User",
           "properties": {
-            "__password": {
-              "description": "Password of the user if defined",
-              "type": "string"
-            },
             "_avatar": {
               "description": "Define the user avatar if exists",
               "type": "string"
             },
-            "_lastPasswordRecovery": {
-              "description": "Last time the password was recovered",
-              "type": "number"
-            },
             "displayName": {
               "Frontend": true,
               "description": "Display name for this user",
@@ -3276,6 +3515,10 @@
               "description": "Contains the locale of the user if known",
               "type": "string"
             },
+            "password": {
+              "$ref": "#/definitions/Password",
+              "description": "Password credential"
+            },
             "uuid": {
               "description": "UUID of the model",
               "format": "uuid",
@@ -3320,10 +3563,6 @@
       "additionalProperties": false,
       "description": "Represent a file to store",
       "properties": {
-        "challenge": {
-          "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
-          "type": "string"
-        },
         "hash": {
           "description": "Will be computed by the service\n\nhash of the content",
           "type": "string"
@@ -3356,6 +3595,25 @@
       "type": "object",
       "title": "BinaryFile"
     },
+    "Webda/Password.change.input": {
+      "type": "object",
+      "properties": {
+        "current": {
+          "type": "string"
+        },
+        "next": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "current",
+        "next"
+      ]
+    },
+    "Webda/Password.change.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
     "Webda/Binary.delete.input": {
       "type": "object",
       "properties": {
@@ -3463,10 +3721,6 @@
           "class": "BinaryMap",
           "description": "This is a map used to retrieve binary",
           "properties": {
-            "challenge": {
-              "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
-              "type": "string"
-            },
             "hash": {
               "description": "Will be computed by the service\n\nhash of the content",
               "type": "string"
@@ -3623,10 +3877,6 @@
           "class": "BinaryMap",
           "description": "This is a map used to retrieve binary",
           "properties": {
-            "challenge": {
-              "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
-              "type": "string"
-            },
             "hash": {
               "description": "Will be computed by the service\n\nhash of the content",
               "type": "string"
@@ -3784,6 +4034,22 @@
           }
         }
       }
+    },
+    "Webda/Password": {
+      "Identifier": "Webda/Password",
+      "Import": "lib/models/password.model:Password",
+      "Actions": {
+        "change": {
+          "rest": {
+            "method": "PUT"
+          }
+        }
+      }
+    },
+    "Webda/Encrypted": {
+      "Identifier": "Webda/Encrypted",
+      "Import": "lib/models/encrypted.model:EncryptedField",
+      "Actions": {}
     }
   },
   "capabilities": {