@webda/core 4.0.0-beta.3 → 4.0.0-beta.5

package/lib/models/encrypted.model.d.ts

@@ -0,0 +1,46 @@
+import { WEBDA_STORAGE } from "@webda/models";
+/**
+ * A model field encrypted at rest with the CryptoService
+ *
+ * Only the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is
+ * JSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with
+ * that key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService
+ * keeps the old key.
+ *
+ * ```typescript
+ * class MyModel extends UuidModel {
+ *   secret: EncryptedField<{ apiKey: string }>;
+ * }
+ * await model.secret.set({ apiKey: "..." });
+ * await model.save();
+ * const { apiKey } = await model.secret.get();
+ * ```
+ * @WebdaBehavior Webda/Encrypted
+ */
+export declare class EncryptedField<T = any> {
+    [WEBDA_STORAGE]: Record<string, any>;
+    /** Encrypted value (a JWT wrapping the AES ciphertext), never output */
+    __ciphertext?: string;
+    /**
+     * @returns true when a value is stored
+     */
+    isSet(): boolean;
+    /**
+     * Encrypt and store a value (does not save the model); undefined clears it
+     * @param value - value to store, JSON-serialisable
+     */
+    set(value: T | undefined): Promise<void>;
+    /**
+     * Decrypt the stored value
+     * @returns the value, undefined when none is stored
+     * @throws Error when the ciphertext is invalid (tampered, or encrypted with an unknown key)
+     */
+    get(): Promise<T | undefined>;
+    /**
+     * Remove the stored value (does not save the model)
+     */
+    clear(): void;
+    get parent(): any;
+    toJSON(): Record<string, any>;
+}
+//# sourceMappingURL=encrypted.model.d.ts.map

package/lib/models/encrypted.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.model.d.ts","sourceRoot":"","sources":["../../src/models/encrypted.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAe9C;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG;IACjC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAM;IAC1C,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,KAAK,IAAI,OAAO,CAEf;IAED;;;OAGG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;OAIG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAKlC;IAED;;OAEG;IACH,KAAK,IAAI,IAAI,CAEZ;IACD,IAAI,MAAM,QAAgD;IAC1D,MAAM,wBAcL;CACF"}

package/lib/models/encrypted.model.js

@@ -0,0 +1,87 @@
+import { WEBDA_STORAGE } from "@webda/models";
+import { useDynamicService } from "../core/hooks.js";
+/**
+ * @returns the CryptoService
+ * @throws Error when no CryptoService is available
+ */
+function crypto() {
+    const service = useDynamicService("CryptoService");
+    if (!service) {
+        throw new Error("Encrypted fields require the CryptoService");
+    }
+    return service;
+}
+/**
+ * A model field encrypted at rest with the CryptoService
+ *
+ * Only the ciphertext is stored (`__ciphertext`, server-only: `__` keys never reach a public output). The value is
+ * JSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with
+ * that key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService
+ * keeps the old key.
+ *
+ * ```typescript
+ * class MyModel extends UuidModel {
+ *   secret: EncryptedField<{ apiKey: string }>;
+ * }
+ * await model.secret.set({ apiKey: "..." });
+ * await model.save();
+ * const { apiKey } = await model.secret.get();
+ * ```
+ * @WebdaBehavior Webda/Encrypted
+ */
+export class EncryptedField {
+    [WEBDA_STORAGE] = {};
+    /** Encrypted value (a JWT wrapping the AES ciphertext), never output */
+    __ciphertext;
+    /**
+     * @returns true when a value is stored
+     */
+    isSet() {
+        return typeof this.__ciphertext === "string" && this.__ciphertext.length > 0;
+    }
+    /**
+     * Encrypt and store a value (does not save the model); undefined clears it
+     * @param value - value to store, JSON-serialisable
+     */
+    async set(value) {
+        if (value === undefined) {
+            this.clear();
+            return;
+        }
+        this.__ciphertext = await crypto().encrypt(value);
+    }
+    /**
+     * Decrypt the stored value
+     * @returns the value, undefined when none is stored
+     * @throws Error when the ciphertext is invalid (tampered, or encrypted with an unknown key)
+     */
+    async get() {
+        if (!this.isSet()) {
+            return undefined;
+        }
+        return crypto().decrypt(this.__ciphertext);
+    }
+    /**
+     * Remove the stored value (does not save the model)
+     */
+    clear() {
+        this.__ciphertext = undefined;
+    }
+    get parent() { return this[WEBDA_STORAGE]["__parent__"]; }
+    toJSON() {
+        const result = {};
+        for (const key of Object.keys(this)) {
+            result[key] = this[key];
+        }
+        const storage = this[WEBDA_STORAGE];
+        if (storage) {
+            for (const key of Object.keys(storage)) {
+                if (key !== "__parent__") {
+                    result[key] = storage[key];
+                }
+            }
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=encrypted.model.js.map

package/lib/models/encrypted.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.model.js","sourceRoot":"","sources":["../../src/models/encrypted.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;GAGG;AACH,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,iBAAiB,CAAM,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,cAAc;IACzB,CAAC,aAAa,CAAC,GAAwB,EAAE,CAAC;IAC1C,wEAAwE;IACxE,YAAY,CAAU;IAEtB;;OAEG;IACH,KAAK;QACH,OAAO,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,KAAoB;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM;QACJ,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAqC,IAAY,CAAC,aAAa,CAAC,CAAC;QAC9E,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/lib/models/ident.model.d.ts

@@ -1,89 +1,128 @@
-import type { Settable } from "@webda/models";
-import { OwnerModel } from "./ownermodel.model.js";
-import type { User } from "./user.model.js";
-/** OAuth tokens associated with an identity provider */
-export declare class IdentTokens {
-    refresh: string;
-    access: string;
+import type { PrimaryKeyType } from "@webda/models";
+import { Model, ModelLink, WEBDA_PRIMARY_KEY, WEBDA_PRIMARY_KEY_SEPARATOR, type Settable } from "@webda/models";
+import * as WebdaError from "../errors/errors.js";
+import type { IOperationContext } from "../contexts/icontext.js";
+import { User } from "./user.model.js";
+import { EncryptedField } from "./encrypted.model.js";
+/** Tokens (credentials) of an identity provider, as the provider returns them */
+export interface IdentTokens {
+    /** Access token */
+    access_token?: string;
+    /** Refresh token */
+    refresh_token?: string;
+    /** Any other provider field */
+    [key: string]: any;
+}
+/** Email sending throttle state of an ident (login failures are top-level `Ident` attributes) */
+export interface IdentThrottle {
+    /** Timestamp of the last email sent */
+    lastSentAt?: number;
+}
+/** Raised for malformed ident keys (400 INVALID_IDENT) */
+export declare class InvalidIdent extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message?: string);
 }
 /**
- * First basic model for Ident
- * @class
+ * An identity linked to a user: `<providerUid>:<provider>`
  * @WebdaModel
  */
-export declare class Ident extends OwnerModel {
-    /** Create a new Ident
-     * @param data - initial data
-     */
-    constructor(data?: Settable<Ident>);
-    /**
-     * Type of the ident
-     */
-    _type: string;
-    /**
-     * Uid on the provider
-     */
-    uid: string;
-    /**
-     * Provider profile
-     */
-    __profile: any;
-    /**
-     * Tokens for this ident
-     */
-    __tokens: IdentTokens;
-    /**
-     * Last time the ident was used
-     */
-    get _lastUsed(): Date;
-    set _lastUsed(value: string | number | Date);
+export declare class Ident extends Model {
+    /** Composite primary key */
+    [WEBDA_PRIMARY_KEY]: readonly ["providerUid", "provider"];
+    [WEBDA_PRIMARY_KEY_SEPARATOR]: string;
+    /** Identifier on the provider (normalised email for "email") */
+    providerUid: string;
+    /** Provider name */
+    provider: string;
+    /** Owner */
+    get _user(): ModelLink<User>;
+    set _user(value: string | User | PrimaryKeyType<User> | ModelLink<User>);
+    /** Email asserted for this ident */
+    email?: string;
+    /** When the ident was verified */
+    get verifiedAt(): Date;
+    set verifiedAt(value: string | number | Date);
+    /** Last login with this ident */
+    get lastUsedAt(): Date;
+    set lastUsedAt(value: string | number | Date);
+    /** Email sending throttle state */
+    _throttle: IdentThrottle;
     /**
-     * If the ident is validated
-     */
-    _failedLogin: number;
+     * Login attempts counted since the last successful login
+     *
+     * Top-level so stores can increment it atomically (nested-path atomic operations are not portable)
+     */
+    _loginAttempts: number;
+    /** Timestamp (ms) of the last counted login attempt */
+    _lastLoginAttemptAt?: number;
+    /** Provider profile */
+    __profile?: any;
+    /** Provider tokens, encrypted at rest (`await ident.tokens.get()`) */
+    tokens: EncryptedField<IdentTokens>;
+    /** @param data - initial data */
+    constructor(data?: Settable<Ident>);
     /**
-     * If EmailIdent
-     */
-    _lastValidationEmail?: number;
+     * Build and validate a key
+     * @param providerUid - uid on the provider
+     * @param provider - provider name
+     * @returns the composite key
+     */
+    static key(providerUid: string, provider: string): {
+        providerUid: string;
+        provider: string;
+    };
     /**
-     * When the ident was validated
-     */
-    get _validation(): Date;
-    set _validation(value: string | number | Date);
+     * Parse a v3 storage key `"<providerUid>_<provider>"`, split on its LAST "_" (provider names never
+     * contain "_", provider uids such as emails may)
+     *
+     * Consulted by repositories for keys that are not `"<providerUid>:<provider>"` (see `WEBDA_LEGACY_UID`),
+     * so v3 records stay addressable and queryable until they are upgraded.
+     * @param uid - raw storage key
+     * @returns the key parts, or undefined when the key is not a v3 ident key
+     */
+    static parseLegacyUID(uid: string): {
+        providerUid: string;
+        provider: string;
+    } | undefined;
     /**
-     * Email for this ident if it exist
+     * v3 storage key of a record stored before the composite key (v3 kept it as `uuid` in the body)
+     *
+     * Such an ident has no `providerUid`: it must be upgraded (`@webda/auth` `upgradeIdent`) before use.
+     * @returns the v3 key, or undefined for a current ident
      */
-    email?: string;
+    getLegacyUID(): string | undefined;
     /**
-     * Provider id
+     * Normalise an email for use as providerUid
+     * @param email - raw email
+     * @returns trimmed lowercase email
      */
-    provider?: string;
+    static normalizeEmail(email: string): string;
     /**
-     * Get the email for this ident
-     * @returns the result string
+     * @returns the owner link
      */
-    getEmail(): string;
+    getUser(): ModelLink<User>;
     /**
-     * Get the provider type
-     * @returns the result
+     * @param user - owner uuid or user
      */
-    getType(): string;
+    setUser(user: string | User): void;
     /**
-     * Set the provider type
-     * @param type - the type to look up
+     * @returns the email of this ident
      */
-    setType(type: any): void;
+    getEmail(): string | undefined;
     /**
-     * Get the user who owns this ident
-     * @returns the result
+     * @returns true when verified
      */
-    getUser(): import("@webda/models").ModelLink<User>;
+    isVerified(): boolean;
     /**
-     * Set the user who owns this ident
-     * @param uuid - the unique identifier
+     * Only the owner may act on an ident
+     * @param ctx - operation context
+     * @param action - action name
+     * @returns true or a refusal reason
      */
-    setUser(uuid: string | User): void;
+    canAct(ctx: IOperationContext, action: string): Promise<string | boolean>;
     /** Generated by @webda/content-mapper: include values held in WEBDA_STORAGE. */
     toJSON(): any;
+    protected __hydrateBehaviors(rawData?: any): void;
 }
 //# sourceMappingURL=ident.model.d.ts.map

package/lib/models/ident.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ident.model.d.ts","sourceRoot":"","sources":["../../src/models/ident.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA8B,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,wDAAwD;AACxD,qBAAa,WAAW;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,KAAM,SAAQ,UAAU;IACnC;;OAEG;IACH,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAEjC;IACD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,SAAS,EAAE,GAAG,CAAC;IACf;;OAEG;IACH,QAAQ,EAAE,WAAW,CAAC;IACtB;;OAEG;IACH,IAAI,SAAS,IAAI,IAAI,CAEpB;IACD,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE1C;IACD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAK;IACzB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAK;IAClC;;OAEG;IACH,IAAI,WAAW,IAAI,IAAI,CAEtB;IACD,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE5C;IACD;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IAED;;;OAGG;IACH,OAAO,WAEN;IAED;;;OAGG;IACH,OAAO,CAAC,IAAI,KAAA,QAEX;IAED;;;OAGG;IACH,OAAO,4CAEN;IAED;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,QAE1B;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,CAOZ;CACF"}
+{"version":3,"file":"ident.model.d.ts","sourceRoot":"","sources":["../../src/models/ident.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,qBAAa,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAE,MAAwB,EAE5C;CACF;AAID;;;GAGG;AACH,qBAAa,KAAM,SAAQ,KAAK;IAC9B,4BAA4B;IAC5B,CAAC,iBAAiB,CAAC,YAAI,aAAa,EAAE,UAAU,EAAW;IAE3D,CAAC,2BAA2B,CAAC,SAAO;IACpC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY;IACZ,IAAI,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAE3B;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAUtE;IACD,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,IAAI,UAAU,IAAI,IAAI,CAErB;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE3C;IACD,iCAAiC;IACjC,IAAI,UAAU,IAAI,IAAI,CAErB;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAE3C;IACD,mCAAmC;IACnC,SAAS,EAAE,aAAa,CAAM;IAC9B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAK;IAC3B,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IAEpC,iCAAiC;IACjC,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAOjC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAU3F;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CASxF;IAED;;;;;OAKG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS,CAMjC;IAED;;;;OAIG;IACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;OAEG;IACH,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAEzB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAIjC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;OAEG;IACH,UAAU,IAAI,OAAO,CAEpB;IAED;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAK9E;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,CAQZ;IACD,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CAiBhD;CACF"}

package/lib/models/ident.model.js

@@ -1,115 +1,207 @@
 import { WEBDA_STORAGE } from "@webda/models";
-import { OwnerModel } from "./ownermodel.model.js";
-/** OAuth tokens associated with an identity provider */
-export class IdentTokens {
-    refresh;
-    access;
+import { Model, ModelLink, WEBDA_PRIMARY_KEY, WEBDA_PRIMARY_KEY_SEPARATOR } from "@webda/models";
+import * as WebdaError from "../errors/errors.js";
+import { User } from "./user.model.js";
+import { EncryptedField } from "./encrypted.model.js";
+/** Raised for malformed ident keys (400 INVALID_IDENT) */
+export class InvalidIdent extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message = "Invalid ident") {
+        super(message, 400);
+    }
 }
+const SEPARATOR = ":";
 /**
- * First basic model for Ident
- * @class
+ * An identity linked to a user: `<providerUid>:<provider>`
  * @WebdaModel
  */
-export class Ident extends OwnerModel {
-    /** Create a new Ident
-     * @param data - initial data
-     */
-    constructor(data) {
-        super(data);
+export class Ident extends Model {
+    /** Composite primary key */
+    [WEBDA_PRIMARY_KEY] = ["providerUid", "provider"];
+    // Must stay a string literal: the content mapper reads it textually
+    [WEBDA_PRIMARY_KEY_SEPARATOR] = ":";
+    /** Identifier on the provider (normalised email for "email") */
+    providerUid;
+    /** Provider name */
+    provider;
+    /** Owner */
+    get _user() {
+        return this[WEBDA_STORAGE]["_user"];
     }
-    /**
-     * Type of the ident
-     */
-    _type;
-    /**
-     * Uid on the provider
-     */
-    uid;
-    /**
-     * Provider profile
-     */
-    __profile;
-    /**
-     * Tokens for this ident
-     */
-    __tokens;
-    /**
-     * Last time the ident was used
-     */
-    get _lastUsed() {
-        return this[WEBDA_STORAGE]["_lastUsed"] ?? undefined;
+    set _user(value) {
+        if (value instanceof ModelLink) {
+            this[WEBDA_STORAGE]["_user"] = value;
+        }
+        else if (value != null) {
+            const inst = this[WEBDA_STORAGE]["_user"] || new ModelLink(User);
+            inst.set(value);
+            this[WEBDA_STORAGE]["_user"] = inst;
+        }
+        else {
+            this[WEBDA_STORAGE]["_user"] = value;
+        }
+    }
+    /** Email asserted for this ident */
+    email;
+    /** When the ident was verified */
+    get verifiedAt() {
+        return this[WEBDA_STORAGE]["verifiedAt"];
     }
-    set _lastUsed(value) {
-        this[WEBDA_STORAGE]["_lastUsed"] = value !== undefined && value !== null ? new Date(value) : value;
+    set verifiedAt(value) {
+        this[WEBDA_STORAGE]["verifiedAt"] = value !== undefined && value !== null ? new Date(value) : value;
     }
+    /** Last login with this ident */
+    get lastUsedAt() {
+        return this[WEBDA_STORAGE]["lastUsedAt"];
+    }
+    set lastUsedAt(value) {
+        this[WEBDA_STORAGE]["lastUsedAt"] = value !== undefined && value !== null ? new Date(value) : value;
+    }
+    /** Email sending throttle state */
+    _throttle = {};
     /**
-     * If the ident is validated
-     */
-    _failedLogin = 0;
-    /**
-     * If EmailIdent
-     */
-    _lastValidationEmail = 0;
+     * Login attempts counted since the last successful login
+     *
+     * Top-level so stores can increment it atomically (nested-path atomic operations are not portable)
+     */
+    _loginAttempts = 0;
+    /** Timestamp (ms) of the last counted login attempt */
+    _lastLoginAttemptAt;
+    /** Provider profile */
+    __profile;
+    /** Provider tokens, encrypted at rest (`await ident.tokens.get()`) */
+    tokens;
+    /** @param data - initial data */
+    constructor(data) {
+        super();
+        Object.assign(this, data);
+        // Raw stored data (or none) must become an EncryptedField behavior
+        if (!(this.tokens instanceof EncryptedField)) {
+            this.__hydrateBehaviors?.({ tokens: data?.tokens ?? {} });
+        }
+    }
     /**
-     * When the ident was validated
-     */
-    get _validation() {
-        return this[WEBDA_STORAGE]["_validation"];
+     * Build and validate a key
+     * @param providerUid - uid on the provider
+     * @param provider - provider name
+     * @returns the composite key
+     */
+    static key(providerUid, provider) {
+        for (const [name, v] of [
+            ["providerUid", providerUid],
+            ["provider", provider]
+        ]) {
+            if (typeof v !== "string" || v.length === 0 || v.includes(SEPARATOR)) {
+                throw new InvalidIdent(`${name} must be a non-empty string without '${SEPARATOR}'`);
+            }
+        }
+        return { providerUid, provider };
     }
-    set _validation(value) {
-        this[WEBDA_STORAGE]["_validation"] = value !== undefined && value !== null ? new Date(value) : value;
+    /**
+     * Parse a v3 storage key `"<providerUid>_<provider>"`, split on its LAST "_" (provider names never
+     * contain "_", provider uids such as emails may)
+     *
+     * Consulted by repositories for keys that are not `"<providerUid>:<provider>"` (see `WEBDA_LEGACY_UID`),
+     * so v3 records stay addressable and queryable until they are upgraded.
+     * @param uid - raw storage key
+     * @returns the key parts, or undefined when the key is not a v3 ident key
+     */
+    static parseLegacyUID(uid) {
+        if (typeof uid !== "string" || uid.includes(SEPARATOR)) {
+            return undefined;
+        }
+        const i = uid.lastIndexOf("_");
+        if (i <= 0 || i === uid.length - 1) {
+            return undefined;
+        }
+        return { providerUid: uid.substring(0, i), provider: uid.substring(i + 1) };
     }
     /**
-     * Email for this ident if it exist
-     */
-    email;
+     * v3 storage key of a record stored before the composite key (v3 kept it as `uuid` in the body)
+     *
+     * Such an ident has no `providerUid`: it must be upgraded (`@webda/auth` `upgradeIdent`) before use.
+     * @returns the v3 key, or undefined for a current ident
+     */
+    getLegacyUID() {
+        const uuid = this.uuid;
+        if (this.providerUid || typeof uuid !== "string" || !Ident.parseLegacyUID(uuid)) {
+            return undefined;
+        }
+        return uuid;
+    }
     /**
-     * Provider id
+     * Normalise an email for use as providerUid
+     * @param email - raw email
+     * @returns trimmed lowercase email
      */
-    provider;
+    static normalizeEmail(email) {
+        return `${email ?? ""}`.trim().toLowerCase();
+    }
     /**
-     * Get the email for this ident
-     * @returns the result string
+     * @returns the owner link
      */
-    getEmail() {
-        return this.email;
+    getUser() {
+        return this._user;
     }
     /**
-     * Get the provider type
-     * @returns the result
+     * @param user - owner uuid or user
      */
-    getType() {
-        return this._type;
+    setUser(user) {
+        const uuid = typeof user === "string" ? user : user.getUUID();
+        this._user ??= new ModelLink(User).set(uuid);
+        this._user.set(uuid);
     }
     /**
-     * Set the provider type
-     * @param type - the type to look up
+     * @returns the email of this ident
      */
-    setType(type) {
-        this._type = type;
+    getEmail() {
+        return this.email;
     }
     /**
-     * Get the user who owns this ident
-     * @returns the result
+     * @returns true when verified
      */
-    getUser() {
-        return this.getOwner();
+    isVerified() {
+        return this.verifiedAt !== undefined && this.verifiedAt !== null;
     }
     /**
-     * Set the user who owns this ident
-     * @param uuid - the unique identifier
-     */
-    setUser(uuid) {
-        this.setOwner(typeof uuid === "string" ? uuid : uuid.getPrimaryKey());
+     * Only the owner may act on an ident
+     * @param ctx - operation context
+     * @param action - action name
+     * @returns true or a refusal reason
+     */
+    async canAct(ctx, action) {
+        if (!ctx.getCurrentUserId() || this._user?.toString() !== ctx.getCurrentUserId()) {
+            return "You can't act on this ident";
+        }
+        return true;
     }
     /** Generated by @webda/content-mapper: include values held in WEBDA_STORAGE. */
     toJSON() {
-        const result = super.toJSON ? super.toJSON() : {};
+        const parent = super.toJSON ? super.toJSON() : {};
+        const result = parent === this ? {} : parent;
         for (const key of Object.keys(this)) {
             result[key] = this[key];
         }
         Object.assign(result, this[WEBDA_STORAGE]);
         return result;
     }
+    __hydrateBehaviors(rawData) {
+        {
+            let v = this.tokens;
+            if (rawData !== undefined && rawData !== null && rawData["tokens"] !== undefined) {
+                v = rawData["tokens"];
+            }
+            if (!(v instanceof EncryptedField)) {
+                const inst = new EncryptedField();
+                if (v !== undefined && v !== null) {
+                    Object.assign(inst, v);
+                }
+                v = inst;
+            }
+            v[WEBDA_STORAGE] = v[WEBDA_STORAGE] || {};
+            v[WEBDA_STORAGE]["__parent__"] = { instance: this, attribute: "tokens" };
+            this.tokens = v;
+        }
+    }
 }
 //# sourceMappingURL=ident.model.js.map