zibri 2.2.1 → 2.4.0

package/src/auth/2fa/methods/otp/otp.two-factor-method.ts

@@ -4,16 +4,14 @@ import { HiBase32Utilities } from './hi-base32.utilities';
 import { TwoFactorMethod } from '../two-factor-method.interface';
 import { OtpCredentials, OtpCredentialsCreateData } from './otp-credentials.model';
 import { OtpUtilities } from './otp.utilities';
+import { HttpRequestContext } from '../../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../../context/request/websocket-request.context';
 import { Repository } from '../../../../data-source/repository';
-import { repositoryTokenFor } from '../../../../di/decorators/inject-repository.decorator';
+import { InjectRepository } from '../../../../di/decorators/inject-repository.decorator';
 import { Inject } from '../../../../di/decorators/inject.decorator';
 import { ZIBRI_DI_TOKENS } from '../../../../di/default/zibri-di-tokens.default';
-import { inject } from '../../../../di/inject.function';
 import { UnauthorizedError } from '../../../../error-handling/errors/unauthorized.error';
-import { HttpRequest } from '../../../../http/http-request.model';
 import { KnownHeader } from '../../../../http/known-header.enum';
-import { validateEntitiesRegistered } from '../../../../utilities/validate-entities-registered.function';
-import { WebsocketRequest } from '../../../../websocket/models/websocket-request.model';
 import { BaseUser } from '../../../models/base-user.model';
 
 /**
@@ -31,29 +29,15 @@ export type OtpConfirmRegisterData = {
  */
 export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegisterData> {
 
-    private get otpCredentialsRepository(): Repository<OtpCredentials, OtpCredentialsCreateData> {
-        return inject(repositoryTokenFor(OtpCredentials));
-    }
-
     constructor(
         @Inject(ZIBRI_DI_TOKENS.OTP_HEADER)
         private readonly otpHeader: KnownHeader,
         @Inject(ZIBRI_DI_TOKENS.OTP_LENGTH)
-        private readonly otpLength: number
+        private readonly otpLength: number,
+        @InjectRepository(OtpCredentials)
+        private readonly otpCredentialsRepository: Repository<OtpCredentials, OtpCredentialsCreateData>
     ) {}
 
-    // eslint-disable-next-line jsdoc/require-jsdoc
-    init(): void {
-        if (this.otpHeader == undefined) {
-            throw new Error('No value provided for ZIBRI_DI_TOKENS.OTP_HEADER');
-        }
-        if (this.otpLength == undefined) {
-            throw new Error('No value provided for ZIBRI_DI_TOKENS.OTP_LENGTH');
-        }
-
-        validateEntitiesRegistered(this.constructor.name, OtpCredentials);
-    }
-
     // eslint-disable-next-line jsdoc/require-jsdoc
     async requestRegisterForUser<Role extends string, UserType extends BaseUser<Role>>(
         user: UserType
@@ -87,10 +71,10 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
     // eslint-disable-next-line jsdoc/require-jsdoc
     async validate<Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ): Promise<void> {
         const credentials: OtpCredentials[] = await this.otpCredentialsRepository.findAll({ where: { userId: user.id } });
-        const token: string = this.extractTokenFromRequest(request);
+        const token: string = this.extractTokenFromRequestContext(context);
         for (const c of credentials) {
             if (OtpUtilities.validate(c.secret, token)) {
                 return;
@@ -99,8 +83,8 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
         throw new UnauthorizedError('The provided two factor code is invalid.');
     }
 
-    private extractTokenFromRequest(request: HttpRequest | WebsocketRequest): string {
-        const code: string | undefined = request.headers[this.otpHeader];
+    private extractTokenFromRequestContext(context: HttpRequestContext | WebsocketRequestContext): string {
+        const code: string | undefined = context.request.headers[this.otpHeader];
         if (!code) {
             throw new UnauthorizedError(`"${this.otpHeader}" header not found`);
         }

package/src/auth/2fa/methods/two-factor-method.interface.ts

@@ -1,15 +1,11 @@
-import { HttpRequest } from '../../../http/http-request.model';
-import { WebsocketRequest } from '../../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../context/request/websocket-request.context';
 import { BaseUser } from '../../models/base-user.model';
 
 /**
  * Interface for a two factor method.
  */
 export interface TwoFactorMethod<TwoFactorRequestRegisterData, TwoFactorConfirmRegisterData> {
-    /**
-     * Initializes the two factor method.
-     */
-    init: () => void,
     /**
      * Requests to register the two factor method for the given user.
      */
@@ -33,6 +29,29 @@ export interface TwoFactorMethod<TwoFactorRequestRegisterData, TwoFactorConfirmR
      */
     validate: <Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => void | Promise<void>
+}
+
+/**
+ * Checks whether or not the given value is a two factor method.
+ * @param value - The value to check.
+ * @returns True if all keys of the TwoFactorMethod interface are present, false otherwise.
+ */
+export function isTwoFactorMethod(value: unknown): value is TwoFactorMethod<unknown, unknown> {
+    if (value == undefined) {
+        return false;
+    }
+    if (typeof value !== 'object') {
+        return false;
+    }
+
+    const keys: (keyof TwoFactorMethod<unknown, unknown>)[] = [
+        'requestRegisterForUser',
+        'confirmRegisterForUser',
+        'unregisterForUser',
+        'validate'
+    ];
+
+    return !keys.find(key => !(key in value));
 }

package/src/auth/2fa/two-factor-service.interface.ts

@@ -1,7 +1,7 @@
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
-import { HttpRequest } from '../../http/http-request.model';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { BaseUser } from '../models/base-user.model';
 
 /**
@@ -12,10 +12,6 @@ export interface TwoFactorServiceInterface {
      * The different two factor methods provided.
      */
     readonly twoFactorMethods: TwoFactorMethods,
-    /**
-     * Initializes the service.
-     */
-    init: (twoFactorMethods: TwoFactorMethods) => Promise<void>,
     /**
      * Requests the registration of the given two factor method for the given user.
      */
@@ -56,7 +52,7 @@ export interface TwoFactorServiceInterface {
      */
     has2fa: (
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods?: TwoFactorMethods
     ) => Promise<boolean>
 }

package/src/auth/2fa/two-factor.service.ts

@@ -1,9 +1,14 @@
+import { ZibriApplication } from '../../application';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { ZIBRI_REQUEST_CONTEXT_TOKENS } from '../../context/request/request-context-token.model';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
+import { Inject } from '../../di/decorators/inject.decorator';
+import { Injectable } from '../../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
 import { inject } from '../../di/inject.function';
 import { register } from '../../di/register.function';
-import { HttpRequest } from '../../http/http-request.model';
-import { LoggerInterface } from '../../logging/logger.interface';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
+import { OnAppInit } from '../../global/on-app-init.interface';
+import { type LoggerInterface } from '../../logging/logger.interface';
 import { BaseUser } from '../models/base-user.model';
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
@@ -12,21 +17,19 @@ import { TwoFactorServiceInterface } from './two-factor-service.interface';
 /**
  * Default implementation of the two factor service.
  */
-export class TwoFactorService implements TwoFactorServiceInterface {
+@Injectable({ register: 'onUse' })
+export class TwoFactorService implements TwoFactorServiceInterface, OnAppInit {
     // eslint-disable-next-line jsdoc/require-jsdoc
     readonly twoFactorMethods: TwoFactorMethods = [];
 
-    /**
-     * A logger.
-     */
-    protected readonly logger: LoggerInterface;
-
-    constructor() {
-        this.logger = inject(ZIBRI_DI_TOKENS.LOGGER);
-    }
+    constructor(
+        @Inject(ZIBRI_DI_TOKENS.LOGGER)
+        private readonly logger: LoggerInterface
+    ) { }
 
     // eslint-disable-next-line jsdoc/require-jsdoc
-    async init(twoFactorMethods: TwoFactorMethods): Promise<void> {
+    async onAppInit({ options }: ZibriApplication): Promise<void> {
+        const { twoFactorMethods } = options;
         for (const method of twoFactorMethods) {
             register({ token: method, useClass: method });
             this.twoFactorMethods.push(method);
@@ -37,7 +40,6 @@ export class TwoFactorService implements TwoFactorServiceInterface {
             );
             for (const method of twoFactorMethods) {
                 await this.logger.info(`  - ${method.name}`);
-                inject(method).init();
             }
         }
     }
@@ -86,12 +88,15 @@ export class TwoFactorService implements TwoFactorServiceInterface {
     // eslint-disable-next-line jsdoc/require-jsdoc
     async has2fa(
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods: TwoFactorMethods = this.twoFactorMethods
     ): Promise<boolean> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA)) {
+            return context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA);
+        }
         try {
             await Promise.any(
-                allowedMethods.map(m => inject(m).validate(user, request))
+                allowedMethods.map(m => inject(m).validate(user, context))
             );
             return true;
         }

package/src/auth/auth-service.interface.ts

@@ -1,5 +1,4 @@
 import { BaseEntity } from '../entity/base-entity.model';
-import { HttpRequest } from '../http/http-request.model';
 import { Newable } from '../types/newable.type';
 import { BaseUser } from './models/base-user.model';
 import { BelongsToMetadata } from './models/belongs-to-metadata.model';
@@ -9,7 +8,8 @@ import { IsNotLoggedInMetadata } from './models/is-not-logged-in-metadata.model'
 import { Require2faMetadata } from './models/require-2fa-metadata.model';
 import { AuthStrategies } from './strategies/auth-strategies.model';
 import { AuthStrategyInterface } from './strategies/auth-strategy.interface';
-import { WebsocketRequest } from '../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { WebsocketRequestContext } from '../context/request/websocket-request.context';
 
 /**
  * Interface for an auth service.
@@ -19,34 +19,34 @@ export interface AuthServiceInterface {
      * The different auth strategies provided.
      */
     readonly strategies: AuthStrategies,
-    /**
-     * Initializes the service.
-     */
-    init: (strategies: AuthStrategies) => void | Promise<void>,
     /**
      * Checks if the provided method on the provided controller can be accessed by the current user.
      */
     checkAccess: (
         controllerClass: Newable<unknown>,
         controllerMethod: string,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => Promise<void>,
     /**
      * Checks whether there is a currently logged in user.
      */
     isLoggedIn: (
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies
     ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user has one of the provided roles.
      */
-    hasRole: (request: HttpRequest | WebsocketRequest, allowedStrategies: AuthStrategies, allowedRoles: string[]) => Promise<boolean>,
+    hasRole: (
+        context: HttpRequestContext | WebsocketRequestContext,
+        allowedStrategies: AuthStrategies,
+        allowedRoles: string[]
+    ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user belongs to the target entity.
      */
     belongsTo: <TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
@@ -153,7 +153,7 @@ export interface AuthServiceInterface {
         UserType extends BaseUser<Role>,
         B extends boolean = true
     >(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         required: B
     ) => Promise<B extends false ? UserType | undefined : UserType>,

package/src/auth/auth.service.ts

@@ -1,7 +1,8 @@
 import { AuthServiceInterface } from './auth-service.interface';
+import { ZibriApplication } from '../application';
 import { register } from '../di/register.function';
 import { BaseEntity } from '../entity/base-entity.model';
-import { TwoFactorServiceInterface } from './2fa/two-factor-service.interface';
+import { type TwoFactorServiceInterface } from './2fa/two-factor-service.interface';
 import { BaseUser } from './models/base-user.model';
 import { BelongsToMetadata, SkipBelongsToMetadata } from './models/belongs-to-metadata.model';
 import { HasRoleMetadata, SkipHasRoleMetadata } from './models/has-role-metadata.model';
@@ -11,39 +12,38 @@ import { Require2faMetadata, SkipRequire2faMetadata } from './models/require-2fa
 import { SkipAuthMetadata } from './models/skip-auth-metadata.model';
 import { AuthStrategies } from './strategies/auth-strategies.model';
 import { AuthStrategyInterface } from './strategies/auth-strategy.interface';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { ZIBRI_REQUEST_CONTEXT_TOKENS } from '../context/request/request-context-token.model';
+import { WebsocketRequestContext } from '../context/request/websocket-request.context';
+import { Inject } from '../di/decorators/inject.decorator';
+import { Injectable } from '../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
 import { inject } from '../di/inject.function';
 import { UnauthorizedError } from '../error-handling/errors/unauthorized.error';
-import { HttpRequest } from '../http/http-request.model';
-import { LoggerInterface } from '../logging/logger.interface';
+import { OnAppInit } from '../global/on-app-init.interface';
+import { type LoggerInterface } from '../logging/logger.interface';
 import { Newable } from '../types/newable.type';
 import { MetadataUtilities } from '../utilities/metadata.utilities';
 import { PromiseUtilities } from '../utilities/promise.utilities';
-import { WebsocketRequest } from '../websocket/models/websocket-request.model';
 
 /**
  * Default auth service implementation of Zibri.
  */
-export class AuthService implements AuthServiceInterface {
-    /**
-     * A logger.
-     */
-    protected readonly logger: LoggerInterface;
-
+@Injectable({ register: 'onUse' })
+export class AuthService implements AuthServiceInterface, OnAppInit {
     // eslint-disable-next-line jsdoc/require-jsdoc
     readonly strategies: AuthStrategies = [];
 
-    // eslint-disable-next-line jsdoc/require-jsdoc
-    get twoFactorService(): TwoFactorServiceInterface {
-        return inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
-    }
-
-    constructor() {
-        this.logger = inject(ZIBRI_DI_TOKENS.LOGGER);
-    }
+    constructor(
+        @Inject(ZIBRI_DI_TOKENS.LOGGER)
+        private readonly logger: LoggerInterface,
+        @Inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE)
+        private readonly twoFactorService: TwoFactorServiceInterface
+    ) {}
 
     // eslint-disable-next-line jsdoc/require-jsdoc
-    async init(authStrategies: AuthStrategies): Promise<void> {
+    async onAppInit(app: ZibriApplication): Promise<void> {
+        const { authStrategies } = app.options;
         for (const strategy of authStrategies) {
             register({ token: strategy, useClass: strategy });
             this.strategies.push(strategy);
@@ -54,7 +54,7 @@ export class AuthService implements AuthServiceInterface {
             );
             for (const strategy of authStrategies) {
                 await this.logger.info(`  - ${strategy.name}`);
-                inject(strategy).init();
+                await inject(strategy).init?.(app);
             }
         }
     }
@@ -121,15 +121,18 @@ export class AuthService implements AuthServiceInterface {
         UserType extends BaseUser<Role>,
         B extends boolean = true
     >(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         required: B
     ): Promise<B extends false ? UserType | undefined : UserType> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.CURRENT_USER)) {
+            return await context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.CURRENT_USER) as B extends false ? UserType | undefined : UserType;
+        }
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<Role, UserType, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(
             s => inject(s)
         ) as unknown as AuthStrategyInterface<Role, UserType, unknown, unknown, unknown, unknown, unknown, unknown>[];
-        const res: PromiseSettledResult<UserType | undefined>[] = await Promise.allSettled(strategies.map(s => s.resolveUser(request)));
+        const res: PromiseSettledResult<UserType | undefined>[] = await Promise.allSettled(strategies.map(s => s.resolveUser(context)));
         const currentUser: UserType | undefined = (
             res.find(r => r.status === 'fulfilled' && r.value !== undefined) as PromiseFulfilledResult<UserType> | undefined
         )?.value;
@@ -199,7 +202,7 @@ export class AuthService implements AuthServiceInterface {
     async checkAccess(
         controllerClass: Newable<unknown>,
         controllerMethod: string,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ): Promise<void> {
         const isLoggedInMetadata: IsLoggedInMetadata | undefined = await this.resolveIsLoggedInMetadata(controllerClass, controllerMethod);
         const isNotLoggedInMetadata: IsNotLoggedInMetadata | undefined = await this.resolveIsNotLoggedInMetadata(
@@ -228,14 +231,14 @@ export class AuthService implements AuthServiceInterface {
         // isLoggedIn
         if (
             (isLoggedInMetadata || hasRoleMetadata || belongsToMetadata || require2faMetadata)
-            && !await this.isLoggedIn(request, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
+            && !await this.isLoggedIn(context, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
         ) {
             throw new UnauthorizedError('You need to be logged in to access this route.');
         }
         // isNotLoggedIn
         if (
             isNotLoggedInMetadata
-            && await this.isLoggedIn(request, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
+            && await this.isLoggedIn(context, isNotLoggedInMetadata.allowedStrategies ?? this.strategies)
         ) {
             throw new UnauthorizedError('You cannot be logged in when accessing this route.');
         }
@@ -243,15 +246,15 @@ export class AuthService implements AuthServiceInterface {
         // hasRole
         if (
             hasRoleMetadata
-            && !await this.hasRole(request, hasRoleMetadata.allowedStrategies ?? this.strategies, hasRoleMetadata.allowedRoles)
+            && !await this.hasRole(context, hasRoleMetadata.allowedStrategies ?? this.strategies, hasRoleMetadata.allowedRoles)
         ) {
             throw new UnauthorizedError(`You need to have one role of ${hasRoleMetadata.allowedRoles} to access this route.`);
         }
 
         // require2fa
         if (require2faMetadata) {
-            const user: BaseUser<string> = await this.getCurrentUser(request, this.strategies, true);
-            if (!await this.twoFactorService.has2fa(user, request, require2faMetadata.allowedMethods)) {
+            const user: BaseUser<string> = await this.getCurrentUser(context, this.strategies, true);
+            if (!await this.twoFactorService.has2fa(user, context, require2faMetadata.allowedMethods)) {
                 throw new UnauthorizedError('You need to provide a second factor to access this route.');
             }
         }
@@ -260,14 +263,14 @@ export class AuthService implements AuthServiceInterface {
         if (
             belongsToMetadata
             && !await this.belongsTo(
-                request,
+                context,
                 belongsToMetadata.allowedStrategies ?? this.strategies,
                 belongsToMetadata.targetEntity,
                 belongsToMetadata.targetUserIdKey,
                 belongsToMetadata.targetIdParamKey
             )
         ) {
-            const targetId: string | undefined = request.params?.[belongsToMetadata.targetIdParamKey];
+            const targetId: string | undefined = context.request.params?.[belongsToMetadata.targetIdParamKey];
             throw new UnauthorizedError(
                 // eslint-disable-next-line stylistic/max-len
                 `You need to to have access to the ${belongsToMetadata.targetEntity.name} entity with the id ${String(targetId)} to access this route.`
@@ -277,13 +280,16 @@ export class AuthService implements AuthServiceInterface {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async isLoggedIn(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies
     ): Promise<boolean> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.IS_LOGGED_IN)) {
+            return context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.IS_LOGGED_IN);
+        }
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<string, BaseUser<string>, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(s => inject(s));
         try {
-            return await PromiseUtilities.anyValueTrue(strategies, s => s.isLoggedIn(request));
+            return await PromiseUtilities.anyValueTrue(strategies, s => s.isLoggedIn(context));
         }
         catch {
             return false;
@@ -292,14 +298,14 @@ export class AuthService implements AuthServiceInterface {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async hasRole(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         allowedRoles: string[]
     ): Promise<boolean> {
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<string, BaseUser<string>, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(s => inject(s));
         try {
-            return await PromiseUtilities.anyValueTrue(strategies, s => s.hasRole(request, allowedRoles));
+            return await PromiseUtilities.anyValueTrue(strategies, s => s.hasRole(context, allowedRoles));
         }
         catch {
             return false;
@@ -308,7 +314,7 @@ export class AuthService implements AuthServiceInterface {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async belongsTo<TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
@@ -319,7 +325,7 @@ export class AuthService implements AuthServiceInterface {
         try {
             return await PromiseUtilities.anyValueTrue(
                 strategies,
-                s => s.belongsTo(request, targetEntity, targetUserIdKey, targetIdParamKey)
+                s => s.belongsTo(context, targetEntity, targetUserIdKey, targetIdParamKey)
             );
         }
         catch {

package/src/auth/encryption/encryption-key.model.ts

@@ -0,0 +1,51 @@
+import { type EncryptionString } from './encryption.utilities';
+import { EncryptionStrategyEntity } from './strategies/encryption-strategy-entity.model';
+import { BaseEntity } from '../../entity/base-entity.model';
+import { Entity } from '../../entity/decorators/entity.decorator';
+import { Property } from '../../entity/decorators/property.decorator';
+import { DeepPartial } from '../../types/deep-partial.type';
+import { ExcludeStrict } from '../../types/exclude-strict.type';
+import { OmitStrict } from '../../types/omit-strict.type';
+
+/**
+ * The status that an encryption key can have.
+ */
+export enum EncryptionKeyStatus {
+    ACTIVE = 'ACTIVE',
+    DEFAULT = 'DEFAULT',
+    DEPRECATED = 'DEPRECATED'
+}
+
+/**
+ * A key used for encrypting data.
+ */
+@Entity({ allowOrphan: true })
+export class EncryptionKey extends BaseEntity {
+    /**
+     * The actual key value, stored encrypted.
+     */
+    @Property.string()
+    value!: EncryptionString;
+    /**
+     * The encryption strategy that this key belongs to.
+     */
+    @Property.manyToOne({ target: () => EncryptionStrategyEntity, inverseSide: 'keys' })
+    strategy!: EncryptionStrategyEntity;
+    /**
+     * The status of the key.
+     */
+    @Property.string({ enum: EncryptionKeyStatus })
+    status!: EncryptionKeyStatus;
+}
+
+/**
+ * The data for creating a new key.
+ */
+export type EncryptionKeyCreateData = OmitStrict<EncryptionKey, 'id' | 'strategy' | 'status'>
+    & DeepPartial<Pick<EncryptionKey, 'strategy'>>
+    & {
+        /**
+         * The status of the key.
+         */
+        status: ExcludeStrict<EncryptionKeyStatus, EncryptionKeyStatus.DEPRECATED>
+    };

package/src/auth/encryption/encryption-master-options.model.ts

@@ -0,0 +1,41 @@
+import { BaseDecryptOptions, BaseEncryptOptions, EncryptionStrategyInterface } from './strategies/encryption-strategy.interface';
+
+/**
+ * Definition of the key used to encrypt encryption keys.
+ */
+export type EncryptionMasterKey<TKey> = {
+    /**
+     * The id of the key.
+     */
+    id: string,
+    /**
+     * The actual value.
+     */
+    value: TKey
+};
+
+/**
+ * Options on how encryption keys should be encrypted.
+ */
+export type EncryptionMasterOptions<
+    TKey,
+    TEncryptOptions extends BaseEncryptOptions<TKey> = BaseEncryptOptions<TKey>,
+    TDecryptOptions extends BaseDecryptOptions<TKey> = BaseEncryptOptions<TKey>
+> = {
+    /**
+     * The current master key for encrypting encryption keys.
+     */
+    currentMasterKey: EncryptionMasterKey<TKey>,
+    /**
+     * The strategy that is used to encrypt encryption keys.
+     */
+    currentMasterStrategy: EncryptionStrategyInterface<TKey, TEncryptOptions, TDecryptOptions>,
+    /**
+     * Any old master keys.
+     */
+    oldMasterKeys?: EncryptionMasterKey<unknown>[],
+    /**
+     * Any old master strategies.
+     */
+    oldMasterStrategies?: EncryptionStrategyInterface<unknown>[]
+};