axiodb 9.7.9 → 11.9.12

package/README.md

@@ -63,6 +63,7 @@ SQLite is great, but it requires native bindings that break in Electron and cros
 - **Transaction Support:** ACID-compliant transactions with savepoints, rollback, and Write-Ahead Logging (WAL)
 - **Single Instance Architecture:** Unified management for unlimited databases, collections, and documents
 - **Web-Based GUI Dashboard:** Visual database administration, query execution, and real-time monitoring at `localhost:27018`
+- **Role-Based Access Control:** Built-in login for the Control Server with Super Admin/Admin/View roles and per-permission enforcement
 - **AxioDBCloud Remote Access:** TCP-based client for connecting to AxioDB from anywhere—Docker, Cloud, or local network
 - **Zero-Configuration Setup:** Serverless architecture—install and start building instantly
 - **Custom Database Path:** Flexible storage locations for better project organization
@@ -161,9 +162,47 @@ const results = await users.query({ role: "admin" })
 await client.disconnect();
 ```
 
+### 🔐 TCP Authentication (NEW!)
+
+TCP connections are unauthenticated by default (same as before). Opt in with `TCPAuth: true` to require a username/password on every connection, reusing the **exact same accounts and roles** as the GUI's RBAC system (see [Authentication & Access Control](#authentication--access-control-v98)) — one set of credentials for both.
+
+```javascript
+// Server
+const db = new AxioDB({ TCP: true, TCPAuth: true, RootName: 'MyDB', CustomPath: '.' });
+```
+
+```javascript
+// Client - pass credentials in the constructor options; connect() authenticates automatically
+const client = new AxioDBCloud("axiodb://localhost:27019", {
+  username: 'admin',
+  password: 'admin',
+});
+await client.connect();
+
+console.log(client.authenticatedUser); // { username, role, mustChangePassword }
+```
+
+Or authenticate after connecting, e.g. if credentials are supplied at runtime:
+
+```javascript
+const client = new AxioDBCloud("axiodb://localhost:27019");
+await client.connect();
+await client.login('admin', 'admin');
+```
+
+**What's enforced:**
+- Every command except `PING`/`DISCONNECT`/`AUTHENTICATE` requires a prior successful login on that connection.
+- The same role permissions as the GUI apply per command (e.g. a `View`-role user gets `403` on `CREATE_DB`).
+- The same per-IP login rate limiter as the GUI: 5 failed attempts within 15 minutes locks that IP out for 15 minutes (`429 Too Many Requests`), shared across both TCP and GUI login attempts from that IP.
+- **Accounts that still need their forced password change are rejected outright** (`403`), not allowed through with a warning — there's no TCP command to change a password today, so log into the GUI (`http://localhost:27018`) to complete it first, or authenticate with an account that already has.
+- If a Super Admin resets a user's password, changes their role, or deletes them via the GUI while that user has an open TCP connection, the TCP connection is immediately forced to re-authenticate on its next command.
+
+**Known limitations:** the TCP protocol itself is unencrypted (no TLS) — deploy behind a private network, VPN, or your own TLS termination if connecting over an untrusted network. There's currently no TCP command to change a password; that must go through the GUI.
+
 ### Features
 
 ✅ **35+ Commands** - Full CRUD, aggregation, indexing
+✅ **Optional Authentication (NEW!)** - Shared RBAC with the GUI, per-IP rate limiting, forced-password-change enforcement
 ✅ **Auto-Reconnect** - Exponential backoff with up to 10 retry attempts
 ✅ **Heartbeat Monitoring** - PING/PONG every 30 seconds
 ✅ **Request Correlation** - UUID-based request/response matching
@@ -254,6 +293,31 @@ const db = new AxioDB({ GUI: true, RootName: "MyDB", CustomPath: "./custom/path"
 
 Access the GUI at `http://localhost:27018` when enabled.
 
+### Authentication & Access Control (v9.8+)
+
+The Control Server ships with built-in login and role-based access control (RBAC). On first start with `GUI: true`, AxioDB seeds a reserved `config` database (hidden from the regular database list) containing three collections—`users`, `roles`, `permissions`—and a default account:
+
+```
+Username: admin
+Password: admin
+```
+
+You'll be forced to change this password on first login (this applies to every account, not just the default one). Three predefined roles are seeded automatically:
+
+| Role | Access |
+|------|--------|
+| **Super Admin** | Full access, including creating users/roles |
+| **Admin** | Full database/collection/document access, no user or role management |
+| **View** | Read-only access to databases, collections, and documents |
+
+A Super Admin can create additional roles from the predefined permission catalogue and create new users with any role. Sessions are held only in server memory (never persisted to disk) and are tied to an httpOnly cookie, so restarting the server logs everyone out.
+
+**Login rate limiting (NEW!):** after 5 failed login attempts from the same IP within 15 minutes, that IP is locked out for 15 minutes (`429 Too Many Requests`) — regardless of username. This limiter is shared with [TCP AUTHENTICATE attempts](#tcp-authentication-new), so brute-forcing either surface counts against the same per-IP cooldown.
+
+**Index management:** the Control Server also exposes `GET /api/index/list`, `POST /api/index/create`, and `DELETE /api/index/delete`, gated by the same `index:view` / `index:create` / `index:delete` permissions (View role gets view-only, Admin and Super Admin get all three).
+
+> **Security note:** RBAC protects the Control Server's HTTP API; it is still intended for trusted local/network access, not public internet exposure.
+
 ---
 
 ## ⚙️ Architecture & Internal Mechanisms
@@ -407,8 +471,9 @@ console.log(results);
 - `delete(query: object): Deleter`
 - `aggregate(pipeline: object[]): Aggregation`
 - `startSession(options?: SessionOptions): Session`
-- `createIndex(fieldName: string): Promise<SuccessInterface>`
+- `newIndex(...fieldNames: string[]): Promise<SuccessInterface>`
 - `dropIndex(indexName: string): Promise<SuccessInterface | ErrorInterface>`
+- `getIndexes(): Promise<SuccessInterface | ErrorInterface>` — lists all indexes registered on the collection (**NEW!**)
 
 ### Reader
 
@@ -523,7 +588,7 @@ Yes. Full type definitions are included — no separate `@types` package needed.
 No. AxioDB requires Node.js (v20+) and the filesystem. Server-side and desktop only.
 
 **Q: What is AxioDBCloud?**
-TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect.
+TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect. Optional username/password authentication (`TCPAuth: true`) reuses the same RBAC accounts as the GUI.
 
 ---
 

package/lib/Services/Auth/AuthEvents.service.d.ts

@@ -0,0 +1,15 @@
+import { EventEmitter } from "events";
+/**
+ * Process-wide event bus for auth state changes that need to propagate beyond the
+ * HTTP SessionStore - namely, TCP connections holding a cached `AuthenticatedUser`
+ * (see ConnectionManager) for a user whose role, password, or account was just
+ * changed via AuthService.
+ *
+ * Services/Auth owns this abstraction; tcp/ subscribes to it (see tcp/config/server.ts).
+ * Dependency direction stays tcp -> Services/Auth, same as everywhere else in the
+ * codebase - Services/Auth never imports from tcp/, avoiding a layering violation.
+ */
+declare class AuthEvents extends EventEmitter {
+}
+declare const _default: AuthEvents;
+export default _default;

package/lib/Services/Auth/AuthEvents.service.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const events_1 = require("events");
+/**
+ * Process-wide event bus for auth state changes that need to propagate beyond the
+ * HTTP SessionStore - namely, TCP connections holding a cached `AuthenticatedUser`
+ * (see ConnectionManager) for a user whose role, password, or account was just
+ * changed via AuthService.
+ *
+ * Services/Auth owns this abstraction; tcp/ subscribes to it (see tcp/config/server.ts).
+ * Dependency direction stays tcp -> Services/Auth, same as everywhere else in the
+ * codebase - Services/Auth never imports from tcp/, avoiding a layering violation.
+ */
+class AuthEvents extends events_1.EventEmitter {
+}
+exports.default = new AuthEvents();
+//# sourceMappingURL=AuthEvents.service.js.map

package/lib/Services/Auth/AuthEvents.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthEvents.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/AuthEvents.service.ts"],"names":[],"mappings":";;AAAA,mCAAsC;AAEtC;;;;;;;;;GASG;AACH,MAAM,UAAW,SAAQ,qBAAY;CAAG;kBAEzB,IAAI,UAAU,EAAE"}

package/lib/Services/Auth/AuthSeeder.service.d.ts

@@ -0,0 +1,16 @@
+import { AxioDB } from "../Indexation.operation";
+/**
+ * Idempotently creates the `config` database and its `users`/`roles`/`permissions`
+ * collections on first control-server start, then hydrates PermissionChecker's
+ * in-memory role->permissions cache on every boot (including subsequent restarts,
+ * where seeding itself is a no-op but the cache still needs rebuilding).
+ */
+export default class AuthSeeder {
+    private readonly axioDBInstance;
+    constructor(axioDBInstance: AxioDB);
+    seedIfNeeded(): Promise<void>;
+    private seedPermissions;
+    private seedRoles;
+    private seedDefaultAdmin;
+    private hydratePermissionCache;
+}

package/lib/Services/Auth/AuthSeeder.service.js

@@ -0,0 +1,99 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const PasswordHasher_helper_1 = __importDefault(require("./PasswordHasher.helper"));
+const ConfigDatabase_service_1 = __importDefault(require("./ConfigDatabase.service"));
+const PermissionChecker_helper_1 = __importDefault(require("./PermissionChecker.helper"));
+const Permissions_1 = require("../../config/Keys/Permissions");
+/**
+ * Idempotently creates the `config` database and its `users`/`roles`/`permissions`
+ * collections on first control-server start, then hydrates PermissionChecker's
+ * in-memory role->permissions cache on every boot (including subsequent restarts,
+ * where seeding itself is a no-op but the cache still needs rebuilding).
+ */
+class AuthSeeder {
+    constructor(axioDBInstance) {
+        this.axioDBInstance = axioDBInstance;
+    }
+    seedIfNeeded() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const configDB = yield this.axioDBInstance.createDB(Permissions_1.RESERVED_DB_NAME);
+            const usersCollection = yield configDB.createCollection(Permissions_1.CONFIG_USERS_COLLECTION);
+            const rolesCollection = yield configDB.createCollection(Permissions_1.CONFIG_ROLES_COLLECTION);
+            const permissionsCollection = yield configDB.createCollection(Permissions_1.CONFIG_PERMISSIONS_COLLECTION);
+            ConfigDatabase_service_1.default.setCollections(usersCollection, rolesCollection, permissionsCollection);
+            // totalDocuments() counts the collection's "indexes" subfolder as an entry, so it
+            // reports a non-zero count even when no real document has been inserted yet - use
+            // an actual document query (filtered to real .axiodb files) to detect prior seeding.
+            const existingUsers = yield usersCollection.query({}).Limit(1).exec();
+            const alreadySeeded = "data" in existingUsers &&
+                Array.isArray((_a = existingUsers.data) === null || _a === void 0 ? void 0 : _a.documents) &&
+                existingUsers.data.documents.length > 0;
+            if (!alreadySeeded) {
+                yield this.seedPermissions(permissionsCollection);
+                yield this.seedRoles(rolesCollection);
+                yield this.seedDefaultAdmin(usersCollection);
+            }
+            yield this.hydratePermissionCache(rolesCollection);
+        });
+    }
+    seedPermissions(permissionsCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const documents = Permissions_1.PERMISSION_CATALOGUE.map((entry) => ({
+                key: entry.key,
+                group: entry.group,
+                description: entry.description,
+            }));
+            yield permissionsCollection.insertMany(documents);
+        });
+    }
+    seedRoles(rolesCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const now = new Date().toISOString();
+            const documents = Permissions_1.PREDEFINED_ROLES.map((role) => ({
+                roleName: role.roleName,
+                permissions: role.permissions,
+                isSystemRole: true,
+                createdAt: now,
+            }));
+            yield rolesCollection.insertMany(documents);
+        });
+    }
+    seedDefaultAdmin(usersCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(Permissions_1.DEFAULT_ADMIN_PASSWORD);
+            const document = {
+                username: Permissions_1.DEFAULT_ADMIN_USERNAME,
+                passwordHash,
+                role: Permissions_1.SUPER_ADMIN_ROLE,
+                mustChangePassword: true,
+                isActive: true,
+                createdAt: new Date().toISOString(),
+            };
+            yield usersCollection.insert(document);
+        });
+    }
+    hydratePermissionCache(rolesCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield rolesCollection.query({}).Limit(1000).exec();
+            if ("data" in result && result.data && Array.isArray(result.data.documents)) {
+                const roles = result.data.documents;
+                PermissionChecker_helper_1.default.hydrate(roles.map((role) => ({ roleName: role.roleName, permissions: role.permissions })));
+            }
+        });
+    }
+}
+exports.default = AuthSeeder;
+//# sourceMappingURL=AuthSeeder.service.js.map

package/lib/Services/Auth/AuthSeeder.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthSeeder.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/AuthSeeder.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAEA,oFAAqD;AACrD,sFAAsD;AACtD,0FAA2D;AAM3D,+DAUuC;AAEvC;;;;;GAKG;AACH;IAGE,YAAY,cAAsB;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAEY,YAAY;;;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,8BAAgB,CAAC,CAAC;YAEtE,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,qCAAuB,CAAC,CAAC;YACjF,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,qCAAuB,CAAC,CAAC;YACjF,MAAM,qBAAqB,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAC3D,2CAA6B,CAC9B,CAAC;YAEF,gCAAc,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;YAEvF,kFAAkF;YAClF,kFAAkF;YAClF,qFAAqF;YACrF,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,aAAa,GACjB,MAAM,IAAI,aAAa;gBACvB,KAAK,CAAC,OAAO,CAAC,MAAA,aAAa,CAAC,IAAI,0CAAE,SAAS,CAAC;gBAC5C,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YAE1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC;KAAA;IAEa,eAAe,CAAC,qBAAiC;;YAC7D,MAAM,SAAS,GAAyB,kCAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3E,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC,CAAC;YACJ,MAAM,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;KAAA;IAEa,SAAS,CAAC,eAA2B;;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAmB,8BAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC,CAAC;YACJ,MAAM,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;KAAA;IAEa,gBAAgB,CAAC,eAA2B;;YACxD,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,oCAAsB,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ,EAAE,oCAAsB;gBAChC,YAAY;gBACZ,IAAI,EAAE,8BAAgB;gBACtB,kBAAkB,EAAE,IAAI;gBACxB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;KAAA;IAEa,sBAAsB,CAAC,eAA2B;;YAC9D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;gBACtD,kCAAiB,CAAC,OAAO,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF"}

package/lib/Services/Auth/AuthService.service.d.ts

@@ -0,0 +1,53 @@
+import { UserDocument, RoleDocument } from "../../config/Interfaces/Auth/auth.interface";
+export interface AuthResult {
+    success: boolean;
+    message: string;
+    user?: UserDocument;
+}
+export interface MutationResult {
+    success: boolean;
+    message: string;
+    /** True when the failure means "this already exists" (HTTP 409) rather than a validation failure (HTTP 400). */
+    conflict?: boolean;
+}
+export interface SafeUser {
+    username: string;
+    role: string;
+    mustChangePassword: boolean;
+    isActive: boolean;
+    createdAt: string;
+}
+/**
+ * Business logic for login, password management, and user/role administration.
+ * Backed entirely by AxioDB's own Collection API against the `config` database
+ * (see ConfigDatabase.service.ts) - no separate storage mechanism.
+ */
+export default class AuthService {
+    login(username: string, password: string): Promise<AuthResult>;
+    findUserByUsername(username: string): Promise<UserDocument | null>;
+    listUsers(): Promise<SafeUser[]>;
+    createUser(username: string, password: string, role: string): Promise<MutationResult>;
+    changeOwnPassword(username: string, currentPassword: string, newPassword: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    resetUserPassword(username: string, newPassword: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    updateUserRole(username: string, newRole: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    deleteUser(username: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    createRole(roleName: string, permissions: string[]): Promise<MutationResult>;
+    listRoles(): Promise<RoleDocument[]>;
+    /**
+     * Rejects an operation that would leave zero active Super Admin users behind,
+     * preventing a permanent RBAC lockout.
+     */
+    private assertNotLastSuperAdmin;
+}

package/lib/Services/Auth/AuthService.service.js

@@ -0,0 +1,221 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const PasswordHasher_helper_1 = __importDefault(require("./PasswordHasher.helper"));
+const ConfigDatabase_service_1 = __importDefault(require("./ConfigDatabase.service"));
+const PermissionChecker_helper_1 = __importDefault(require("./PermissionChecker.helper"));
+const SessionStore_service_1 = __importDefault(require("./SessionStore.service"));
+const AuthEvents_service_1 = __importDefault(require("./AuthEvents.service"));
+const Permissions_1 = require("../../config/Keys/Permissions");
+/**
+ * Business logic for login, password management, and user/role administration.
+ * Backed entirely by AxioDB's own Collection API against the `config` database
+ * (see ConfigDatabase.service.ts) - no separate storage mechanism.
+ */
+class AuthService {
+    login(username, password) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user || user.isActive === false) {
+                return { success: false, message: "Invalid username or password" };
+            }
+            const passwordMatches = yield PasswordHasher_helper_1.default.verifyPassword(password, user.passwordHash);
+            if (!passwordMatches) {
+                return { success: false, message: "Invalid username or password" };
+            }
+            return { success: true, message: "Login successful", user };
+        });
+    }
+    findUserByUsername(username) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection()
+                .query({ username })
+                .findOne(true)
+                .exec();
+            if ("data" in result && result.data && result.data.documents) {
+                return result.data.documents;
+            }
+            return null;
+        });
+    }
+    listUsers() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection().query({}).Limit(1000).exec();
+            if (!("data" in result) || !((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents)) {
+                return [];
+            }
+            const users = result.data.documents;
+            return users.map((user) => ({
+                username: user.username,
+                role: user.role,
+                mustChangePassword: user.mustChangePassword,
+                isActive: user.isActive,
+                createdAt: user.createdAt,
+            }));
+        });
+    }
+    createUser(username, password, role) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!PermissionChecker_helper_1.default.roleExists(role)) {
+                return { success: false, message: `Role "${role}" does not exist` };
+            }
+            const existingUser = yield this.findUserByUsername(username);
+            if (existingUser) {
+                return { success: false, message: "Username already exists", conflict: true };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(password);
+            const document = {
+                username,
+                passwordHash,
+                role,
+                mustChangePassword: true,
+                isActive: true,
+                createdAt: new Date().toISOString(),
+            };
+            yield ConfigDatabase_service_1.default.getUsersCollection().insert(document);
+            return { success: true, message: "User created successfully" };
+        });
+    }
+    changeOwnPassword(username, currentPassword, newPassword) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            const currentPasswordMatches = yield PasswordHasher_helper_1.default.verifyPassword(currentPassword, user.passwordHash);
+            if (!currentPasswordMatches) {
+                return { success: false, message: "Current password is incorrect" };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(newPassword);
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ passwordHash, mustChangePassword: false });
+            return { success: true, message: "Password changed successfully" };
+        });
+    }
+    resetUserPassword(username, newPassword) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(newPassword);
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ passwordHash, mustChangePassword: true });
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            AuthEvents_service_1.default.emit("user-revoked", username);
+            return { success: true, message: "Password reset successfully" };
+        });
+    }
+    updateUserRole(username, newRole) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!PermissionChecker_helper_1.default.roleExists(newRole)) {
+                return { success: false, message: `Role "${newRole}" does not exist` };
+            }
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            if (user.role === Permissions_1.SUPER_ADMIN_ROLE && newRole !== Permissions_1.SUPER_ADMIN_ROLE) {
+                const lastAdminGuard = yield this.assertNotLastSuperAdmin(username);
+                if (!lastAdminGuard.success) {
+                    return lastAdminGuard;
+                }
+            }
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ role: newRole });
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            AuthEvents_service_1.default.emit("user-revoked", username);
+            return { success: true, message: "Role updated successfully" };
+        });
+    }
+    deleteUser(username) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            if (user.role === Permissions_1.SUPER_ADMIN_ROLE) {
+                const lastAdminGuard = yield this.assertNotLastSuperAdmin(username);
+                if (!lastAdminGuard.success) {
+                    return lastAdminGuard;
+                }
+            }
+            yield ConfigDatabase_service_1.default.getUsersCollection().delete({ username }).deleteOne();
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            AuthEvents_service_1.default.emit("user-revoked", username);
+            return { success: true, message: "User deleted successfully" };
+        });
+    }
+    createRole(roleName, permissions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (PermissionChecker_helper_1.default.roleExists(roleName)) {
+                return { success: false, message: "Role already exists", conflict: true };
+            }
+            const invalidPermissions = permissions.filter((key) => !Permissions_1.ALL_PERMISSION_KEYS.includes(key));
+            if (invalidPermissions.length > 0) {
+                return {
+                    success: false,
+                    message: `Unknown permission key(s): ${invalidPermissions.join(", ")}`,
+                };
+            }
+            const document = {
+                roleName,
+                permissions,
+                isSystemRole: false,
+                createdAt: new Date().toISOString(),
+            };
+            yield ConfigDatabase_service_1.default.getRolesCollection().insert(document);
+            PermissionChecker_helper_1.default.setRolePermissions(roleName, permissions);
+            return { success: true, message: "Role created successfully" };
+        });
+    }
+    listRoles() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getRolesCollection().query({}).Limit(1000).exec();
+            if (!("data" in result) || !((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents)) {
+                return [];
+            }
+            return result.data.documents;
+        });
+    }
+    /**
+     * Rejects an operation that would leave zero active Super Admin users behind,
+     * preventing a permanent RBAC lockout.
+     */
+    assertNotLastSuperAdmin(excludingUsername) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection()
+                .query({ role: Permissions_1.SUPER_ADMIN_ROLE })
+                .Limit(1000)
+                .exec();
+            const superAdmins = "data" in result && ((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents) ? result.data.documents : [];
+            const remaining = superAdmins.filter((user) => user.username !== excludingUsername && user.isActive !== false);
+            if (remaining.length === 0) {
+                return {
+                    success: false,
+                    message: "Cannot remove the last remaining Super Admin",
+                };
+            }
+            return { success: true, message: "OK" };
+        });
+    }
+}
+exports.default = AuthService;
+//# sourceMappingURL=AuthService.service.js.map

package/lib/Services/Auth/AuthService.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/AuthService.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,oFAAqD;AACrD,sFAAsD;AACtD,0FAA2D;AAC3D,kFAAkD;AAClD,8EAA8C;AAK9C,+DAAsF;AAuBtF;;;;GAIG;AACH;IACe,KAAK,CAAC,QAAgB,EAAE,QAAgB;;YACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACrE,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,+BAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACrE,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;IAEY,kBAAkB,CAAC,QAAgB;;YAC9C,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACrD,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACnB,OAAO,CAAC,IAAI,CAAC;iBACb,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAyB,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEY,SAAS;;;YACpB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAC,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,EAAE,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;YACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;KAAA;IAEY,UAAU,CACrB,QAAgB,EAChB,QAAgB,EAChB,IAAY;;YAEZ,IAAI,CAAC,kCAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC;YACtE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ;gBACR,YAAY;gBACZ,IAAI;gBACJ,kBAAkB,EAAE,IAAI;gBACxB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,iBAAiB,CAC5B,QAAgB,EAChB,eAAuB,EACvB,WAAmB;;YAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,MAAM,sBAAsB,GAAG,MAAM,+BAAc,CAAC,cAAc,CAChE,eAAe,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;YACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YACtE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACpE,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QACrE,CAAC;KAAA;IAEY,iBAAiB,CAC5B,QAAgB,EAChB,WAAmB;;YAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACpE,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEzD,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,4BAAU,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACnE,CAAC;KAAA;IAEY,cAAc,CACzB,QAAgB,EAChB,OAAe;;YAEf,IAAI,CAAC,kCAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,OAAO,kBAAkB,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAgB,IAAI,OAAO,KAAK,8BAAgB,EAAE,CAAC;gBACnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAEhC,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,4BAAU,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,UAAU,CAAC,QAAgB;;YACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAgB,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3E,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,4BAAU,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,UAAU,CACrB,QAAgB,EAChB,WAAqB;;YAErB,IAAI,kCAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5E,CAAC;YAED,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iCAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3F,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACvE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ;gBACR,WAAW;gBACX,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,kCAAiB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,SAAS;;;YACpB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAC,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,EAAE,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;QACjD,CAAC;KAAA;IAED;;;OAGG;IACW,uBAAuB,CACnC,iBAAyB;;;YAEzB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACrD,KAAK,CAAC,EAAE,IAAI,EAAE,8BAAgB,EAAE,CAAC;iBACjC,KAAK,CAAC,IAAI,CAAC;iBACX,IAAI,EAAE,CAAC;YAEV,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,KAAI,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,CAAC,CAAC,CAAE,MAAM,CAAC,IAAI,CAAC,SAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CACzE,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,8CAA8C;iBACxD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;KAAA;CACF"}

package/lib/Services/Auth/ConfigDatabase.service.d.ts

@@ -0,0 +1,22 @@
+import Collection from "../Collection/collection.operation";
+/**
+ * Holds long-lived references to the `config` database's `users`/`roles`/`permissions`
+ * collections. Collection instances are reused across requests instead of being
+ * recreated per call, since each `Collection` eagerly loads its index cache on
+ * construction - recreating it per request would repeatedly reload indexes for
+ * no benefit.
+ */
+declare class ConfigDatabase {
+    private static instance;
+    private usersCollection;
+    private rolesCollection;
+    private permissionsCollection;
+    static getInstance(): ConfigDatabase;
+    setCollections(usersCollection: Collection, rolesCollection: Collection, permissionsCollection: Collection): void;
+    isInitialized(): boolean;
+    getUsersCollection(): Collection;
+    getRolesCollection(): Collection;
+    getPermissionsCollection(): Collection;
+}
+declare const _default: ConfigDatabase;
+export default _default;

package/lib/Services/Auth/ConfigDatabase.service.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Holds long-lived references to the `config` database's `users`/`roles`/`permissions`
+ * collections. Collection instances are reused across requests instead of being
+ * recreated per call, since each `Collection` eagerly loads its index cache on
+ * construction - recreating it per request would repeatedly reload indexes for
+ * no benefit.
+ */
+class ConfigDatabase {
+    static getInstance() {
+        if (!ConfigDatabase.instance) {
+            ConfigDatabase.instance = new ConfigDatabase();
+        }
+        return ConfigDatabase.instance;
+    }
+    setCollections(usersCollection, rolesCollection, permissionsCollection) {
+        this.usersCollection = usersCollection;
+        this.rolesCollection = rolesCollection;
+        this.permissionsCollection = permissionsCollection;
+    }
+    isInitialized() {
+        return (this.usersCollection !== undefined &&
+            this.rolesCollection !== undefined &&
+            this.permissionsCollection !== undefined);
+    }
+    getUsersCollection() {
+        if (!this.usersCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.usersCollection;
+    }
+    getRolesCollection() {
+        if (!this.rolesCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.rolesCollection;
+    }
+    getPermissionsCollection() {
+        if (!this.permissionsCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.permissionsCollection;
+    }
+}
+exports.default = ConfigDatabase.getInstance();
+//# sourceMappingURL=ConfigDatabase.service.js.map

package/lib/Services/Auth/ConfigDatabase.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigDatabase.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/ConfigDatabase.service.ts"],"names":[],"mappings":";;AAEA;;;;;;GAMG;AACH,MAAM,cAAc;IAMX,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,CAAC;IACjC,CAAC;IAEM,cAAc,CACnB,eAA2B,EAC3B,eAA2B,EAC3B,qBAAiC;QAEjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAEM,aAAa;QAClB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,IAAI,CAAC,qBAAqB,KAAK,SAAS,CACzC,CAAC;IACJ,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEM,wBAAwB;QAC7B,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;CACF;kBAEc,cAAc,CAAC,WAAW,EAAE"}

package/lib/Services/Auth/CookieCodec.helper.d.ts

@@ -0,0 +1,10 @@
+import { CookiePayload } from "../../config/Interfaces/Auth/auth.interface";
+/**
+ * Encodes/decodes the session cookie value. The cookie is intentionally not the
+ * security boundary by itself - it only carries a random `sid` used to look up the
+ * real session record in SessionStore's in-memory map. See SessionStore.service.ts.
+ */
+export default class CookieCodec {
+    static encode(payload: CookiePayload): string;
+    static decode(rawCookieValue: string): CookiePayload | null;
+}