zibri 2.4.0 → 2.4.1

package/src/auth/2fa/two-factor.service.test.ts

@@ -0,0 +1,151 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '@jest/globals';
+import { TOTP } from 'otpauth';
+
+import { OtpCredentials } from './methods/otp/otp-credentials.model';
+import { TwoFactorServiceInterface } from './two-factor-service.interface';
+import { createTestDataSource, defaultTestServerEntities } from '../../__testing__/test-server/create-test-data-source.function';
+import { startTestServer, StartedTestServer } from '../../__testing__/test-server/start-test-server.function';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { RequestContextToken } from '../../context/request/request-context-token.model';
+import { PostgresDataSource } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
+import { Repository } from '../../data-source/repository';
+import { repositoryTokenFor } from '../../di/decorators/inject-repository.decorator';
+import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
+import { inject } from '../../di/inject.function';
+import { BaseUserEntity } from '../models/base-user.model';
+import { OtpConfirmRegisterData, OtpTwoFactorMethod } from './methods/otp/otp.two-factor-method';
+import { Entity } from '../../entity/decorators/entity.decorator';
+import { Newable } from '../../types/newable.type';
+
+enum TestRole {
+    USER = 'user'
+}
+
+@Entity()
+class User extends BaseUserEntity(TestRole) {}
+
+let server: StartedTestServer;
+let twoFactorService: TwoFactorServiceInterface;
+let otpMethod: OtpTwoFactorMethod;
+let userRepo: Repository<User>;
+let otpCredentialsRepo: Repository<OtpCredentials>;
+let otpHeader: string; // injected value of ZIBRI_DI_TOKENS.OTP_HEADER
+let otpLength: number;
+
+describe('TwoFactorService (contract via OTP method)', () => {
+    beforeAll(async () => {
+        const dataSourceClass: Newable<PostgresDataSource> = createTestDataSource({
+            entities: [...defaultTestServerEntities, User]
+        });
+        server = await startTestServer({ dataSources: [dataSourceClass] });
+
+        twoFactorService = inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
+        otpMethod = inject(OtpTwoFactorMethod);
+        userRepo = inject(repositoryTokenFor(User));
+        otpCredentialsRepo = inject(repositoryTokenFor(OtpCredentials));
+        otpHeader = inject(ZIBRI_DI_TOKENS.OTP_HEADER);
+        otpLength = inject(ZIBRI_DI_TOKENS.OTP_LENGTH);
+    }, 15000);
+
+    afterAll(async () => {
+        await server.shutdown();
+    });
+
+    let user: User;
+
+    beforeEach(async () => {
+        // start fresh every test
+        await otpCredentialsRepo.deleteAll({});
+        await userRepo.deleteAll({});
+        user = await userRepo.create({ email: '2fa-test@example.com', roles: [TestRole.USER] });
+    });
+
+    it('requestRegister should create an unconfirmed credential', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0].secret).toBeTruthy();
+        expect(credentials[0].confirmed).toBe(false);
+    });
+
+    it('confirmRegister with a valid token should mark the credential as confirmed', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const secret: string = credentials[0].secret;
+
+        const validToken: string = new TOTP({ secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const updated: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(updated[0].confirmed).toBe(true);
+    });
+
+    it('confirmRegister with an invalid token should throw', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        await expect(
+            twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+                token: '000000'.slice(0, otpLength)
+            } as OtpConfirmRegisterData)
+        ).rejects.toThrow('The provided two factor code is invalid.');
+    });
+
+    it('has2fa should return true when a valid OTP header is present', async () => {
+        // register & confirm
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: validToken } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(true);
+    });
+
+    it('has2fa should return false when the token is invalid', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: '000000'.slice(0, otpLength) } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+
+    it('unregister should delete all credentials and make has2fa false', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: new TOTP({ secret: credentials[0].secret }).generate()
+        } as OtpConfirmRegisterData);
+
+        await twoFactorService.unregisterTwoFactorMethodForUser(user, otpMethod);
+
+        const remaining: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(remaining).toHaveLength(0);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: 'does-not-matter' } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+});

package/src/auth/auth.service.test.ts

@@ -0,0 +1,381 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '@jest/globals';
+
+import { AuthServiceInterface } from './auth-service.interface';
+import { Auth } from './decorators/auth.decorator';
+import { BelongsToMetadata } from './models/belongs-to-metadata.model';
+import { HasRoleMetadata } from './models/has-role-metadata.model';
+import { IsLoggedInMetadata } from './models/is-logged-in-metadata.model';
+import { IsNotLoggedInMetadata } from './models/is-not-logged-in-metadata.model';
+import { Require2faMetadata } from './models/require-2fa-metadata.model';
+import { AuthStrategies } from './strategies/auth-strategies.model';
+import { JwtUser } from '../__testing__/mocks/entities/jwt-user.entity';
+import { Roles } from '../__testing__/mocks/entities/roles.enum';
+import { createTestDataSource, defaultTestServerEntities } from '../__testing__/test-server/create-test-data-source.function';
+import { StartedTestServer, startTestServer } from '../__testing__/test-server/start-test-server.function';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { Repository } from '../data-source/repository';
+import { repositoryTokenFor } from '../di/decorators/inject-repository.decorator';
+import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
+import { inject } from '../di/inject.function';
+import { BaseEntity } from '../entity/base-entity.model';
+import { PasswordResetToken, PasswordResetTokenCreateData } from './models/password-reset-token.model';
+import { Entity } from '../entity/decorators/entity.decorator';
+import { Property } from '../entity/decorators/property.decorator';
+import { Controller } from '../routing/decorators/controller.decorator';
+import { Get } from '../routing/decorators/get.decorator';
+import { Newable } from '../types/newable.type';
+import { JwtAuthData } from './strategies/jwt/jwt-auth-data.model';
+import { JwtCredentials, JwtCredentialsCreateData } from './strategies/jwt/jwt-credentials.model';
+import { JwtAuthStrategy } from './strategies/jwt/jwt.auth-strategy';
+import { DefaultTestServerUserRepository } from '../__testing__/test-server/user-repository';
+import { Transaction } from '../data-source/transaction/transaction.model';
+
+@Entity()
+class Note extends BaseEntity {
+    @Property.string()
+    title!: string;
+
+    @Property.string({ format: 'uuid' })
+    userId!: string;
+}
+
+// ----- dummy controller with auth decorators -----
+@Controller('/dummy')
+class DummyController {
+    @Get('/open')
+    open(): void {}
+
+    @Get('/login-required')
+    @Auth.isLoggedIn([JwtAuthStrategy])
+    loginRequired(): void {}
+
+    @Get('/admin-only')
+    @Auth.hasRole([Roles.ADMIN], [JwtAuthStrategy])
+    adminOnly(): void {}
+
+    @Get('/note/:id')
+    @Auth.belongsTo(Note, 'id', 'userId', [JwtAuthStrategy])
+    belongsToNote(): void {}
+
+    @Get('/2fa-required')
+    @Auth.require2fa([])
+    require2fa(): void {}
+
+    @Get('/logged-out-only')
+    @Auth.isNotLoggedIn([JwtAuthStrategy])
+    loggedOutOnly(): void {}
+
+    @Get('/skip-auth')
+    @Auth.skip()
+    skipAuth(): void {}
+}
+
+// ---- helper to build contexts ----
+function buildContext(accessToken?: string, params?: Record<string, string>): HttpRequestContext {
+    return {
+        request: {
+            headers: accessToken ? { authorization: `Bearer ${accessToken}` } : {},
+            params: params ?? {}
+        },
+        has: () => false
+        // minimal other properties as needed by your actual HttpRequestContext interface
+    } as unknown as HttpRequestContext;
+}
+
+let server: StartedTestServer;
+let authService: AuthServiceInterface;
+let userRepo: DefaultTestServerUserRepository;
+let credentialsRepository: Repository<JwtCredentials, JwtCredentialsCreateData>;
+let noteRepo: Repository<Note>;
+const strategies: AuthStrategies = [JwtAuthStrategy];
+
+const adminEmail: string = 'auth-test@example.com';
+const adminPassword: string = 'secure123';
+const userEmail: string = 'auth-test2@example.com';
+const userPassword: string = 'secure123';
+
+describe('AuthService contract', () => {
+    let testAdmin: JwtUser;
+    let testUser: JwtUser;
+    let adminAuthData: JwtAuthData<Roles>;
+    let userAuthData: JwtAuthData<Roles>;
+
+    beforeAll(async () => {
+        server = await startTestServer({
+            dataSources: [createTestDataSource({ entities: [...defaultTestServerEntities, Note] })],
+            controllers: [DummyController]
+        });
+        authService = inject(ZIBRI_DI_TOKENS.AUTH_SERVICE);
+        userRepo = inject(DefaultTestServerUserRepository);
+        credentialsRepository = inject(repositoryTokenFor(JwtCredentials));
+        noteRepo = inject(repositoryTokenFor(Note));
+    }, 15000);
+
+    afterAll(async () => {
+        await server.shutdown();
+    });
+
+    beforeEach(async () => {
+        await noteRepo.deleteAll({});
+        await userRepo.deleteAll({});
+        await credentialsRepository.deleteAll({});
+
+        testAdmin = await userRepo.create({
+            email: adminEmail,
+            roles: [Roles.USER, Roles.ADMIN]
+        });
+        await credentialsRepository.create({ email: adminEmail, password: adminPassword, userId: testAdmin.id });
+        testUser = await userRepo.create({
+            email: userEmail,
+            roles: [Roles.USER]
+        });
+        await credentialsRepository.create({ email: userEmail, password: userPassword, userId: testUser.id });
+
+        adminAuthData = await authService.login(
+            JwtAuthStrategy<Roles>,
+            { email: adminEmail, password: adminPassword }
+        );
+        userAuthData = await authService.login(
+            JwtAuthStrategy<Roles>,
+            { email: userEmail, password: userPassword }
+        );
+    });
+
+    // --------- login & logout ----------
+    describe('login / logout / refresh', () => {
+        it('login returns valid auth data', () => {
+            expect(adminAuthData.accessToken).toBeTruthy();
+            expect(adminAuthData.refreshToken).toBeTruthy();
+            expect(adminAuthData.roles).toBeTruthy();
+            expect(adminAuthData.userId).toBeTruthy();
+        });
+
+        it('refreshLogin returns fresh auth data', async () => {
+            const transaction: Transaction = await userRepo.dataSource.startTransaction();
+            const refreshed: JwtAuthData<Roles> = await authService.refreshLogin(
+                JwtAuthStrategy<Roles>,
+                { refreshToken: adminAuthData.refreshToken.value, transaction }
+            );
+            await transaction.commit();
+
+            expect(refreshed).toHaveProperty('accessToken');
+            expect(refreshed.accessToken).not.toBe(adminAuthData.accessToken);
+        });
+
+        it('logout invalidates the refresh token (refreshLogin fails)', async () => {
+            await authService.logout(
+                JwtAuthStrategy,
+                { refreshToken: adminAuthData.refreshToken.value }
+            );
+            // Attempt to refresh after logout – must throw.
+            await expect(
+                authService.refreshLogin(
+                    JwtAuthStrategy<Roles>,
+                    { refreshToken: adminAuthData.refreshToken.value, transaction: await userRepo.dataSource.startTransaction() }
+                )
+            ).rejects.toThrow();
+        });
+    });
+
+    // --------- getCurrentUser ----------
+    describe('getCurrentUser', () => {
+        it('returns the logged in user', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            const current: JwtUser = await authService.getCurrentUser(ctx, strategies, true);
+            expect(current.id).toBe(testAdmin.id);
+            expect(current.email).toBe(adminEmail);
+        });
+
+        it('required=false returns undefined without token', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            const current: JwtUser | undefined = await authService.getCurrentUser(ctx, strategies, false);
+            expect(current).toBeUndefined();
+        });
+
+        it('required=true throws without token', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            await expect(
+                authService.getCurrentUser(ctx, strategies, true)
+            ).rejects.toThrow();
+        });
+    });
+
+    // --------- isLoggedIn / hasRole ----------
+    describe('isLoggedIn / hasRole', () => {
+        it('isLoggedIn returns true with valid token', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            expect(await authService.isLoggedIn(ctx, strategies)).toBe(true);
+        });
+
+        it('isLoggedIn returns false without token', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            expect(await authService.isLoggedIn(ctx, strategies)).toBe(false);
+        });
+
+        it('hasRole returns true if role present', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            expect(await authService.hasRole(ctx, strategies, [Roles.ADMIN])).toBe(true);
+        });
+
+        it('hasRole returns false if role missing', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            expect(await authService.hasRole(ctx, strategies, ['nonexistent'])).toBe(false);
+        });
+
+        it('hasRole returns false without token', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            expect(await authService.hasRole(ctx, strategies, [Roles.USER])).toBe(false);
+        });
+    });
+
+    // --------- belongsTo ----------
+    describe('belongsTo', () => {
+        let note: Note;
+
+        beforeEach(async () => {
+            note = await noteRepo.create({ title: 'my note', userId: testAdmin.id });
+        });
+
+        it('returns true for owned resource', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value, { id: note.id });
+            const result: boolean = await authService.belongsTo(ctx, strategies, Note, 'userId', 'id');
+            expect(result).toBe(true);
+        });
+
+        it('returns false for resource owned by someone else', async () => {
+            const ctx: HttpRequestContext = buildContext(userAuthData.accessToken.value, { id: note.id });
+            const result: boolean = await authService.belongsTo(ctx, strategies, Note, 'userId', 'id');
+            expect(result).toBe(false);
+        });
+    });
+
+    // --------- metadata resolvers ----------
+    describe('resolve*Metadata', () => {
+        it('resolveIsLoggedInMetadata reads @Auth.isLoggedIn', async () => {
+            const meta: IsLoggedInMetadata | undefined = await authService.resolveIsLoggedInMetadata(DummyController, 'loginRequired');
+            expect(meta).toBeDefined();
+            expect((meta as IsLoggedInMetadata).allowedStrategies).toEqual([JwtAuthStrategy]);
+        });
+
+        it('resolveIsNotLoggedInMetadata reads @Auth.isNotLoggedIn', async () => {
+            const meta: IsNotLoggedInMetadata | undefined = await authService.resolveIsNotLoggedInMetadata(DummyController, 'loggedOutOnly');
+            expect(meta).toBeDefined();
+        });
+
+        it('resolveHasRoleMetadata reads @Auth.hasRole', async () => {
+            const meta: HasRoleMetadata | undefined = await authService.resolveHasRoleMetadata(DummyController, 'adminOnly');
+            expect(meta).toBeDefined();
+            const hasRoleMeta: HasRoleMetadata = meta as HasRoleMetadata;
+            expect(hasRoleMeta.allowedRoles).toEqual([Roles.ADMIN]);
+        });
+
+        it('resolveBelongsToMetadata reads @Auth.belongsTo', async () => {
+            const meta: BelongsToMetadata<Newable<BaseEntity>> | undefined = await authService.resolveBelongsToMetadata(DummyController, 'belongsToNote');
+            expect(meta).toBeDefined();
+            const belongsMeta: BelongsToMetadata<Newable<BaseEntity>> = meta as BelongsToMetadata<Newable<BaseEntity>>;
+            expect(belongsMeta.targetEntity).toBe(Note);
+            expect(belongsMeta.targetUserIdKey).toBe('userId');
+        });
+
+        it('resolveRequire2faMetadata reads @Auth.require2fa', async () => {
+            const meta: Require2faMetadata | undefined = await authService.resolveRequire2faMetadata(DummyController, 'require2fa');
+            expect(meta).toBeDefined();
+        });
+    });
+
+    // --------- checkAccess ----------
+    describe('checkAccess', () => {
+        it('throws when not logged in for loginRequired', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            await expect(
+                authService.checkAccess(DummyController, 'loginRequired', ctx)
+            ).rejects.toThrow();
+        });
+
+        it('succeeds when logged in for loginRequired', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            await expect(
+                authService.checkAccess(DummyController, 'loginRequired', ctx)
+            ).resolves.toBeUndefined();
+        });
+
+        it('throws when missing role for adminOnly', async () => {
+            const ctx: HttpRequestContext = buildContext(userAuthData.accessToken.value);
+            await expect(
+                authService.checkAccess(DummyController, 'adminOnly', ctx)
+            ).rejects.toThrow();
+        });
+
+        it('succeeds when role present for adminOnly', async () => {
+            const ctx: HttpRequestContext = buildContext(adminAuthData.accessToken.value);
+            await expect(
+                authService.checkAccess(DummyController, 'adminOnly', ctx)
+            ).resolves.toBeUndefined();
+        });
+
+        it('skip auth always succeeds', async () => {
+            const ctx: HttpRequestContext = buildContext();
+            await expect(
+                authService.checkAccess(DummyController, 'skipAuth', ctx)
+            ).resolves.toBeUndefined();
+        });
+    });
+
+    // --------- password reset ----------
+    describe('requestPasswordReset / confirmPasswordReset', () => {
+        let resetTokenRepo: Repository<PasswordResetToken, PasswordResetTokenCreateData>;
+
+        beforeAll(() => {
+            resetTokenRepo = inject(repositoryTokenFor(PasswordResetToken));
+        });
+
+        beforeEach(async () => {
+            await resetTokenRepo.deleteAll({});
+        });
+
+        it('requestPasswordReset creates a reset token', async () => {
+            const transaction: Transaction = await userRepo.dataSource.startTransaction();
+            await authService.requestPasswordReset(
+                JwtAuthStrategy,
+                { user: testAdmin, transaction }
+            );
+            await transaction.commit();
+
+            const tokens: PasswordResetToken[] = await resetTokenRepo.findAll({ where: { userId: testAdmin.id } });
+            expect(tokens).toHaveLength(1);
+            expect(tokens[0].value).toBeTruthy();
+            expect(tokens[0].expirationDate).toBeInstanceOf(Date);
+        });
+
+        it('confirmPasswordReset with valid token updates password', async () => {
+            // 1. Request reset → token created
+            const transaction: Transaction = await userRepo.dataSource.startTransaction();
+            await authService.requestPasswordReset(
+                JwtAuthStrategy,
+                { user: testAdmin, transaction }
+            );
+            await transaction.commit();
+            const tokens: PasswordResetToken[] = await resetTokenRepo.findAll({ where: { userId: testAdmin.id } });
+            const resetValue: string = tokens[0].value;
+
+            // 2. Confirm reset with new password
+            const transaction2: Transaction = await userRepo.dataSource.startTransaction();
+            await authService.confirmPasswordReset(
+                JwtAuthStrategy,
+                { resetToken: resetValue, newPassword: 'newPass456', transaction: transaction2 }
+            );
+            await transaction2.commit();
+
+            // 3. Verify the token is consumed (deleted / no longer valid)
+            const afterTokens: PasswordResetToken[] = await resetTokenRepo.findAll({ where: { userId: testAdmin.id } });
+            expect(afterTokens).toHaveLength(0);
+
+            // 4. Verify login with new password works
+            const authData: JwtAuthData<Roles> = await authService.login(
+                JwtAuthStrategy<Roles>,
+                { email: adminEmail, password: 'newPass456' }
+            );
+            expect(authData.accessToken).toBeTruthy();
+        });
+    });
+});

package/src/auth/encryption/encryption-key.model.ts

@@ -29,8 +29,13 @@ export class EncryptionKey extends BaseEntity {
     /**
      * The encryption strategy that this key belongs to.
      */
-    @Property.manyToOne({ target: () => EncryptionStrategyEntity, inverseSide: 'keys' })
+    @Property.manyToOne({ target: () => EncryptionStrategyEntity, joinColumn: 'strategyId', inverseSide: 'keys' })
     strategy!: EncryptionStrategyEntity;
+    /**
+     * The id of the strategy that this key belongs to.
+     */
+    @Property.string({ format: 'uuid' })
+    strategyId!: string;
     /**
      * The status of the key.
      */
@@ -41,7 +46,7 @@ export class EncryptionKey extends BaseEntity {
 /**
  * The data for creating a new key.
  */
-export type EncryptionKeyCreateData = OmitStrict<EncryptionKey, 'id' | 'strategy' | 'status'>
+export type EncryptionKeyCreateData = OmitStrict<EncryptionKey, 'id' | 'strategy' | 'strategyId' | 'status'>
     & DeepPartial<Pick<EncryptionKey, 'strategy'>>
     & {
         /**

package/src/auth/strategies/cookie/cookie-auth.auth-strategy.ts

@@ -9,6 +9,7 @@ import { CookieAuthSession, CookieAuthSessionCreateData } from './cookie-auth-se
 import { ZibriApplication } from '../../../application';
 import { HttpRequestContext } from '../../../context/request/http-request.context';
 import { WebsocketRequestContext } from '../../../context/request/websocket-request.context';
+import { RepositoryTypeForEntity } from '../../../data-source/data-sources/data-source.interface';
 import { Repository } from '../../../data-source/repository';
 import { Transaction } from '../../../data-source/transaction/transaction.model';
 import { InjectRepository, repositoryTokenFor } from '../../../di/decorators/inject-repository.decorator';
@@ -326,12 +327,12 @@ export class CookieAuthStrategy<
         }
 
         try {
-            const repo: Repository<InstanceType<TargetEntity>> = inject(repositoryTokenFor(targetEntity));
+            const repo: RepositoryTypeForEntity<InstanceType<TargetEntity>> = inject(repositoryTokenFor(targetEntity));
             const targetId: string | undefined = context.request.params?.[targetIdParamKey];
             if (targetId == undefined) {
                 throw new Error(`Could not find the target id specified as path param "${targetId}"`);
             }
-            const foundTarget: InstanceType<TargetEntity> = await repo.findById(targetId);
+            const foundTarget: InstanceType<TargetEntity> = await repo.findById(targetId) as InstanceType<TargetEntity>;
             const userIdProperty: unknown = foundTarget[targetUserIdKey];
             if (Array.isArray(userIdProperty)) {
                 return userIdProperty.includes(session.userId);

package/src/auth/strategies/jwt/jwt-credentials.model.ts

@@ -43,4 +43,10 @@ export class JwtCredentialsDto extends OmitClass(JwtCredentials, ['id', 'userId'
 /**
  * The data for creating new jwt credentials.
  */
-export class JwtCredentialsCreateData extends OmitClass(JwtCredentials, ['id']) {}
+export class JwtCredentialsCreateData extends OmitClass(JwtCredentials, ['id', 'password']) {
+    /**
+     * The password.
+     */
+    @Property.string({ hash: true })
+    password!: string;
+}

package/src/auth/strategies/jwt/jwt.auth-strategy.ts

@@ -14,6 +14,7 @@ import { JwtUtilities } from './jwt.utilities';
 import { ZibriApplication } from '../../../application';
 import { HttpRequestContext } from '../../../context/request/http-request.context';
 import { WebsocketRequestContext } from '../../../context/request/websocket-request.context';
+import { RepositoryTypeForEntity } from '../../../data-source/data-sources/data-source.interface';
 import { Repository } from '../../../data-source/repository';
 import { Transaction } from '../../../data-source/transaction/transaction.model';
 import { InjectRepository, repositoryTokenFor } from '../../../di/decorators/inject-repository.decorator';
@@ -362,12 +363,12 @@ implements AuthStrategyInterface<
             return false;
         }
         try {
-            const repo: Repository<InstanceType<TargetEntity>> = inject(repositoryTokenFor(targetEntity));
+            const repo: RepositoryTypeForEntity<InstanceType<TargetEntity>> = inject(repositoryTokenFor(targetEntity));
             const targetId: string | undefined = context.request.params?.[targetIdParamKey];
             if (targetId == undefined) {
                 throw new Error(`Could not find the target id specified as path param "${targetId}"`);
             }
-            const foundTarget: InstanceType<TargetEntity> = await repo.findById(targetId);
+            const foundTarget: InstanceType<TargetEntity> = await repo.findById(targetId) as InstanceType<TargetEntity>;
             const userIdProperty: unknown = foundTarget[targetUserIdKey];
             if (Array.isArray(userIdProperty)) {
                 return userIdProperty.includes(jwtData.payload.id);
@@ -419,7 +420,8 @@ implements AuthStrategyInterface<
 
         return await JwtUtilities.sign(payload, this.refreshTokenSecret, {
             expiresIn: this.refreshTokenExpiresInMs / Ms.SECOND,
-            issuer: GlobalRegistry.getAppData('name')
+            issuer: GlobalRegistry.getAppData('name'),
+            jwtid: UUIDUtilities.generate()
         });
     }
 }

package/src/backup/backup-resource-entity.model.ts

@@ -32,11 +32,16 @@ export class BackupResourceEntity extends BaseEntity {
     /**
      * The backup that this resource belongs to.
      */
-    @Property.belongsToOne({ target: () => BackupEntity, inverseSide: 'resources' })
+    @Property.belongsToOne({ target: () => BackupEntity, joinColumn: 'backupId', inverseSide: 'resources' })
     backup!: BackupEntity;
+    /**
+     * The id of the backup that this resource belongs to.
+     */
+    @Property.string({ format: 'uuid' })
+    backupId!: string;
 }
 
 /**
  * The data required to create a new backup resource.
  */
-export type BackupResourceEntityCreateData = OmitStrict<BackupResourceEntity, 'id' | 'completed' | 'backup' | 'size'>;
+export type BackupResourceEntityCreateData = OmitStrict<BackupResourceEntity, 'id' | 'completed' | 'backup' | 'backupId' | 'size'>;

package/src/backup/backup-service.test.ts

@@ -8,7 +8,7 @@ import { Backup } from './decorators/backup-resource.decorator';
 import { FsBackupTransport } from './transports/fs.backup-transport';
 import { defaultTestServerEntities } from '../__testing__/test-server/create-test-data-source.function';
 import { StartedTestServer, startTestServer } from '../__testing__/test-server/start-test-server.function';
-import { PostgresDataSource, PostgresOptions } from '../data-source/data-sources/postgres-data-source.model';
+import { PostgresDataSource, PostgresOptions } from '../data-source/data-sources/postgres-typeorm-data-source.model';
 import { DataSource } from '../data-source/decorators/data-source.decorator';
 import { Repository } from '../data-source/repository';
 import { repositoryTokenFor } from '../di/decorators/inject-repository.decorator';

package/src/backup/backup.service.ts

@@ -7,7 +7,7 @@ import { BackupResourceEntity, BackupResourceEntityCreateData } from './backup-r
 import { BackupResourceInterface } from './backup-resource.interface';
 import { BackupCreateData, BackupServiceInterface } from './backup-service.interface';
 import { ZibriApplication } from '../application';
-import { PostgresDataSource } from '../data-source/data-sources/postgres-data-source.model';
+import { PostgresDataSource } from '../data-source/data-sources/postgres-typeorm-data-source.model';
 import { repositoryTokenFor } from '../di/decorators/inject-repository.decorator';
 import { Inject } from '../di/decorators/inject.decorator';
 import { Injectable } from '../di/decorators/injectable.decorator';