initialize interfaces package
This commit is contained in:
@@ -0,0 +1,13 @@
|
||||
export interface IAbuseWindow {
|
||||
id: string;
|
||||
data: {
|
||||
action: string;
|
||||
identifierHash: string;
|
||||
attemptCount: number;
|
||||
windowStartedAt: number;
|
||||
blockedUntil: number;
|
||||
validUntil: number;
|
||||
createdAt: number;
|
||||
updatedAt: number;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
export type TActivityAction =
|
||||
| 'login'
|
||||
| 'logout'
|
||||
| 'session_created'
|
||||
| 'session_revoked'
|
||||
| 'passport_device_enrolled'
|
||||
| 'passport_device_revoked'
|
||||
| 'passport_challenge_approved'
|
||||
| 'passport_challenge_rejected'
|
||||
| 'org_created'
|
||||
| 'org_updated'
|
||||
| 'org_deleted'
|
||||
| 'org_ownership_transferred'
|
||||
| 'org_joined'
|
||||
| 'org_left'
|
||||
| 'role_changed'
|
||||
| 'org_app_role_mappings_updated'
|
||||
| 'profile_updated'
|
||||
| 'app_connected'
|
||||
| 'app_disconnected';
|
||||
|
||||
export interface IActivityLog {
|
||||
id: string;
|
||||
data: {
|
||||
userId: string;
|
||||
action: TActivityAction;
|
||||
timestamp: number;
|
||||
metadata: {
|
||||
ip?: string;
|
||||
userAgent?: string;
|
||||
targetId?: string;
|
||||
targetType?: string;
|
||||
description: string;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
export type TAlertSeverity = 'low' | 'medium' | 'high' | 'critical';
|
||||
|
||||
export type TAlertStatus = 'pending' | 'seen' | 'dismissed';
|
||||
|
||||
export type TAlertCategory = 'security' | 'admin' | 'system';
|
||||
|
||||
export type TAlertNotificationStatus = 'pending' | 'sent' | 'failed' | 'seen';
|
||||
|
||||
export interface IAlert {
|
||||
id: string;
|
||||
data: {
|
||||
recipientUserId: string;
|
||||
organizationId?: string;
|
||||
category: TAlertCategory;
|
||||
eventType: string;
|
||||
severity: TAlertSeverity;
|
||||
title: string;
|
||||
body: string;
|
||||
actorUserId?: string;
|
||||
relatedEntityId?: string;
|
||||
relatedEntityType?: string;
|
||||
notification: {
|
||||
hintId: string;
|
||||
status: TAlertNotificationStatus;
|
||||
attemptCount: number;
|
||||
createdAt: number;
|
||||
deliveredAt?: number | null;
|
||||
seenAt?: number | null;
|
||||
lastError?: string | null;
|
||||
};
|
||||
createdAt: number;
|
||||
seenAt?: number | null;
|
||||
dismissedAt?: number | null;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
import type { TAlertSeverity } from './alert.js';
|
||||
|
||||
export type TAlertRuleScope = 'global' | 'organization';
|
||||
|
||||
export type TAlertRuleRecipientMode = 'global_admins' | 'org_admins' | 'specific_users';
|
||||
|
||||
export interface IAlertRule {
|
||||
id: string;
|
||||
data: {
|
||||
scope: TAlertRuleScope;
|
||||
organizationId?: string;
|
||||
eventType: string;
|
||||
minimumSeverity: TAlertSeverity;
|
||||
recipientMode: TAlertRuleRecipientMode;
|
||||
recipientUserIds?: string[];
|
||||
push: boolean;
|
||||
enabled: boolean;
|
||||
createdByUserId: string;
|
||||
createdAt: number;
|
||||
updatedAt: number;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
// App Types
|
||||
export type TAppType = 'global' | 'partner' | 'custom_oidc';
|
||||
export type TAppApprovalStatus = 'draft' | 'pending_review' | 'approved' | 'rejected' | 'suspended';
|
||||
|
||||
// OAuth Credentials
|
||||
export interface IOAuthCredentials {
|
||||
clientId: string;
|
||||
clientSecretHash: string;
|
||||
redirectUris: string[];
|
||||
allowedScopes: string[];
|
||||
grantTypes: ('authorization_code' | 'client_credentials' | 'refresh_token')[];
|
||||
}
|
||||
|
||||
// Base app data shared by all app types
|
||||
export interface IAppBaseData {
|
||||
name: string;
|
||||
description: string;
|
||||
logoUrl: string;
|
||||
appUrl: string;
|
||||
}
|
||||
|
||||
// Global App - First-party apps managed by platform (foss.global, task.vc, etc.)
|
||||
export interface IGlobalApp {
|
||||
id: string;
|
||||
type: 'global';
|
||||
data: IAppBaseData & {
|
||||
oauthCredentials: IOAuthCredentials;
|
||||
isActive: boolean;
|
||||
category: string;
|
||||
createdAt: number;
|
||||
createdByUserId: string;
|
||||
};
|
||||
}
|
||||
|
||||
// Partner App - Third-party apps submitted to AppStore
|
||||
export interface IPartnerApp {
|
||||
id: string;
|
||||
type: 'partner';
|
||||
data: IAppBaseData & {
|
||||
ownerOrganizationId: string;
|
||||
oauthCredentials: IOAuthCredentials;
|
||||
appStoreMetadata: {
|
||||
shortDescription: string;
|
||||
longDescription: string;
|
||||
screenshots: string[];
|
||||
category: string;
|
||||
tags: string[];
|
||||
pricing: { model: 'free' | 'paid' | 'freemium' };
|
||||
};
|
||||
approvalStatus: TAppApprovalStatus;
|
||||
isPublished: boolean;
|
||||
installCount: number;
|
||||
};
|
||||
}
|
||||
|
||||
// Custom OIDC App - Organization-created OAuth clients
|
||||
export interface ICustomOidcApp {
|
||||
id: string;
|
||||
type: 'custom_oidc';
|
||||
data: IAppBaseData & {
|
||||
ownerOrganizationId: string;
|
||||
oauthCredentials: IOAuthCredentials;
|
||||
oidcSettings: {
|
||||
accessTokenLifetime: number; // seconds
|
||||
refreshTokenLifetime: number; // seconds
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
// Union type for all app types
|
||||
export type IApp = IGlobalApp | IPartnerApp | ICustomOidcApp;
|
||||
|
||||
/**
|
||||
* Legacy interface for backwards compatibility with existing code
|
||||
* that expects a flat app structure (e.g., idpclient, transfermanager)
|
||||
*/
|
||||
export interface IAppLegacy {
|
||||
/**
|
||||
* must be unique
|
||||
*/
|
||||
id: string;
|
||||
/**
|
||||
* should be unique
|
||||
*/
|
||||
name: string;
|
||||
description: string;
|
||||
logoUrl: string;
|
||||
appUrl: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Storage interface for SmartData documents
|
||||
* Uses the discriminated union approach with a 'type' field
|
||||
*/
|
||||
export interface IAppDocument {
|
||||
id: string;
|
||||
type: TAppType;
|
||||
data: IGlobalApp['data'] | IPartnerApp['data'] | ICustomOidcApp['data'];
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
import type { TAppType } from './app.js';
|
||||
import type { IAppRoleMapping } from './role.js';
|
||||
|
||||
export type TAppConnectionStatus = 'active' | 'disconnected';
|
||||
|
||||
export interface IAppConnection {
|
||||
id: string;
|
||||
data: {
|
||||
organizationId: string;
|
||||
appId: string;
|
||||
appType: TAppType;
|
||||
status: TAppConnectionStatus;
|
||||
connectedAt: number;
|
||||
connectedByUserId: string;
|
||||
grantedScopes: string[];
|
||||
roleMappings?: IAppRoleMapping[];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
|
||||
export type TSupportedCurrency = 'EUR';
|
||||
|
||||
export interface IBillableItem {
|
||||
name: string;
|
||||
monthlyPrice: number;
|
||||
currency: TSupportedCurrency;
|
||||
from: number;
|
||||
to: number;
|
||||
factoredOn30DayMonth: number;
|
||||
quantity: number;
|
||||
}
|
||||
|
||||
export interface IBillingPlan {
|
||||
id: string;
|
||||
data: {
|
||||
type: 'Paddle' | 'AppSumo' | 'FairUsageFree' | 'Enterprise' | 'Internal' | 'Testing';
|
||||
proEnabled: boolean;
|
||||
organizationId: string;
|
||||
lastProcessed: number;
|
||||
seats: number;
|
||||
status: 'active' | 'activeOverdue' | 'pausedOverdue' | 'inactive' | 'suspended';
|
||||
paddleData?: {
|
||||
checkoutId: string;
|
||||
};
|
||||
alternativePaymentData?: {
|
||||
enterprise: boolean;
|
||||
appSumoCode: string;
|
||||
};
|
||||
nextBilling: {
|
||||
items: Array<IBillableItem>;
|
||||
method: 'paddle';
|
||||
ontrack: boolean;
|
||||
errorText?: string;
|
||||
selectedBillingDate: number;
|
||||
};
|
||||
billingEvents: Array<{
|
||||
timestamp: number;
|
||||
amount: number;
|
||||
currency: TSupportedCurrency;
|
||||
billedItems: Array<IBillableItem>;
|
||||
checkoutLink?: string;
|
||||
}>;
|
||||
communications: Array<any>;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
|
||||
export interface IDevice extends plugins.tsclass.network.IDevice {}
|
||||
@@ -0,0 +1,12 @@
|
||||
export type TEmailActionTokenAction = 'emailLogin' | 'passwordReset';
|
||||
|
||||
export interface IEmailActionToken {
|
||||
id: string;
|
||||
data: {
|
||||
email: string;
|
||||
action: TEmailActionTokenAction;
|
||||
tokenHash: string;
|
||||
validUntil: number;
|
||||
createdAt: number;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
export * from './abusewindow.js';
|
||||
export * from './activity.js';
|
||||
export * from './alert.js';
|
||||
export * from './alertrule.js';
|
||||
export * from './app.js';
|
||||
export * from './emailactiontoken.js';
|
||||
export * from './oidc.js';
|
||||
export * from './appconnection.js';
|
||||
export * from './billingplan.js';
|
||||
export * from './device.js';
|
||||
export * from './jwt.js';
|
||||
export * from './loginsession.js';
|
||||
export * from './organization.js';
|
||||
export * from './paddlecheckoutdata.js';
|
||||
export * from './passportchallenge.js';
|
||||
export * from './passportdevice.js';
|
||||
export * from './passportnonce.js';
|
||||
export * from './registrationsession.js';
|
||||
export * from './role.js';
|
||||
export * from './user.js';
|
||||
export * from './userinvitation.js';
|
||||
@@ -0,0 +1,43 @@
|
||||
export type TLoginStatus = 'loggedIn' | 'loggedOut' | 'invalidated' | 'not found' | 'transfer';
|
||||
export type TLoginAction = 'login' | 'logout' | 'manage';
|
||||
|
||||
export interface IJwt {
|
||||
id: string;
|
||||
blocked: boolean;
|
||||
data: {
|
||||
/**
|
||||
* the user id of the jwt
|
||||
*/
|
||||
userId: string;
|
||||
|
||||
/**
|
||||
* the login session backing this jwt
|
||||
*/
|
||||
sessionId?: string;
|
||||
|
||||
/**
|
||||
* the latest point of
|
||||
*/
|
||||
validUntil: number;
|
||||
/**
|
||||
* hold off from refreshing before
|
||||
*/
|
||||
refreshFrom: number;
|
||||
/**
|
||||
* an interval in millis to recheck token invalidation
|
||||
*/
|
||||
refreshEvery: number;
|
||||
|
||||
/**
|
||||
* legacy field kept for compatibility with already-issued jwt documents
|
||||
*/
|
||||
refreshToken?: string;
|
||||
|
||||
/**
|
||||
* just for looks/debugging
|
||||
*/
|
||||
justForLooks: {
|
||||
validUntilIsoString: string;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
export interface ILoginSession {
|
||||
id: string;
|
||||
data: {
|
||||
userId: string | null;
|
||||
validUntil: number;
|
||||
invalidated: boolean;
|
||||
/**
|
||||
* legacy plaintext refresh token field kept so existing sessions can migrate on first use
|
||||
*/
|
||||
refreshToken?: string | null;
|
||||
refreshTokenHash?: string | null;
|
||||
rotatedRefreshTokenHashes?: string[];
|
||||
transferTokenHash?: string | null;
|
||||
transferTokenExpiresAt?: number | null;
|
||||
/**
|
||||
* a device id that can be used to share the login session
|
||||
* in different contexts on the same device
|
||||
*/
|
||||
deviceId?: string | null;
|
||||
/**
|
||||
* Device metadata for session display
|
||||
*/
|
||||
deviceInfo?: {
|
||||
deviceName: string;
|
||||
browser: string;
|
||||
os: string;
|
||||
ip: string;
|
||||
} | null;
|
||||
/**
|
||||
* When this session was created
|
||||
*/
|
||||
createdAt?: number;
|
||||
/**
|
||||
* Last time this session was active (e.g., refreshed)
|
||||
*/
|
||||
lastActive?: number;
|
||||
};
|
||||
}
|
||||
+281
@@ -0,0 +1,281 @@
|
||||
/**
|
||||
* OIDC (OpenID Connect) data interfaces for third-party client support
|
||||
*/
|
||||
|
||||
/**
|
||||
* Supported OIDC scopes
|
||||
*/
|
||||
export type TOidcScope = 'openid' | 'profile' | 'email' | 'organizations' | 'roles';
|
||||
|
||||
/**
|
||||
* Authorization code for OAuth 2.0 authorization code flow
|
||||
*/
|
||||
export interface IAuthorizationCode {
|
||||
id: string;
|
||||
data: {
|
||||
/** Hashed authorization code string */
|
||||
codeHash: string;
|
||||
/** OAuth client ID */
|
||||
clientId: string;
|
||||
/** User ID who authorized */
|
||||
userId: string;
|
||||
/** Scopes granted */
|
||||
scopes: TOidcScope[];
|
||||
/** Redirect URI used in authorization request */
|
||||
redirectUri: string;
|
||||
/** PKCE code challenge (S256 hashed) */
|
||||
codeChallenge?: string;
|
||||
/** PKCE code challenge method */
|
||||
codeChallengeMethod?: 'S256';
|
||||
/** Nonce from authorization request (for ID token) */
|
||||
nonce?: string;
|
||||
/** Expiration timestamp (10 minutes from creation) */
|
||||
expiresAt: number;
|
||||
/** Creation timestamp */
|
||||
issuedAt: number;
|
||||
/** Whether the code has been used (single-use) */
|
||||
used: boolean;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* OIDC Access Token (opaque or JWT)
|
||||
*/
|
||||
export interface IOidcAccessToken {
|
||||
id: string;
|
||||
data: {
|
||||
/** The access token string hash for storage */
|
||||
tokenHash: string;
|
||||
/** OAuth client ID */
|
||||
clientId: string;
|
||||
/** User ID */
|
||||
userId: string;
|
||||
/** Granted scopes */
|
||||
scopes: TOidcScope[];
|
||||
/** Expiration timestamp */
|
||||
expiresAt: number;
|
||||
/** Creation timestamp */
|
||||
issuedAt: number;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* OIDC Refresh Token
|
||||
*/
|
||||
export interface IOidcRefreshToken {
|
||||
id: string;
|
||||
data: {
|
||||
/** The refresh token string hash for storage */
|
||||
tokenHash: string;
|
||||
/** OAuth client ID */
|
||||
clientId: string;
|
||||
/** User ID */
|
||||
userId: string;
|
||||
/** Granted scopes */
|
||||
scopes: TOidcScope[];
|
||||
/** Expiration timestamp */
|
||||
expiresAt: number;
|
||||
/** Creation timestamp */
|
||||
issuedAt: number;
|
||||
/** Whether the token has been revoked */
|
||||
revoked: boolean;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* User consent record for an OAuth client
|
||||
*/
|
||||
export interface IUserConsent {
|
||||
id: string;
|
||||
data: {
|
||||
/** User who gave consent */
|
||||
userId: string;
|
||||
/** OAuth client ID */
|
||||
clientId: string;
|
||||
/** Scopes the user consented to */
|
||||
scopes: TOidcScope[];
|
||||
/** When consent was granted */
|
||||
grantedAt: number;
|
||||
/** When consent was last updated */
|
||||
updatedAt: number;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* OIDC Discovery Document (OpenID Provider Configuration)
|
||||
*/
|
||||
export interface IOidcDiscoveryDocument {
|
||||
issuer: string;
|
||||
authorization_endpoint: string;
|
||||
token_endpoint: string;
|
||||
userinfo_endpoint: string;
|
||||
jwks_uri: string;
|
||||
revocation_endpoint: string;
|
||||
scopes_supported: TOidcScope[];
|
||||
response_types_supported: string[];
|
||||
grant_types_supported: string[];
|
||||
subject_types_supported: string[];
|
||||
id_token_signing_alg_values_supported: string[];
|
||||
token_endpoint_auth_methods_supported: string[];
|
||||
code_challenge_methods_supported: string[];
|
||||
claims_supported: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* JSON Web Key Set (JWKS) response
|
||||
*/
|
||||
export interface IJwks {
|
||||
keys: IJwk[];
|
||||
}
|
||||
|
||||
/**
|
||||
* JSON Web Key (RSA public key)
|
||||
*/
|
||||
export interface IJwk {
|
||||
kty: 'RSA';
|
||||
use: 'sig';
|
||||
alg: 'RS256';
|
||||
kid: string;
|
||||
n: string; // RSA modulus (base64url encoded)
|
||||
e: string; // RSA exponent (base64url encoded)
|
||||
}
|
||||
|
||||
/**
|
||||
* ID Token claims (JWT payload)
|
||||
*/
|
||||
export interface IIdTokenClaims {
|
||||
/** Issuer (idp.global URL) */
|
||||
iss: string;
|
||||
/** Subject (user ID) */
|
||||
sub: string;
|
||||
/** Audience (client ID) */
|
||||
aud: string;
|
||||
/** Expiration time (Unix timestamp) */
|
||||
exp: number;
|
||||
/** Issued at (Unix timestamp) */
|
||||
iat: number;
|
||||
/** Authentication time (Unix timestamp) */
|
||||
auth_time?: number;
|
||||
/** Nonce (if provided in authorization request) */
|
||||
nonce?: string;
|
||||
/** Access token hash (for hybrid flows) */
|
||||
at_hash?: string;
|
||||
|
||||
// Profile scope claims
|
||||
name?: string;
|
||||
preferred_username?: string;
|
||||
picture?: string;
|
||||
|
||||
// Email scope claims
|
||||
email?: string;
|
||||
email_verified?: boolean;
|
||||
|
||||
// Custom claims for organizations scope
|
||||
organizations?: IOrganizationClaim[];
|
||||
|
||||
// Custom claims for roles scope
|
||||
roles?: string[];
|
||||
app_roles?: string[];
|
||||
app_permissions?: string[];
|
||||
app_scopes?: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Organization claim in ID token / userinfo
|
||||
*/
|
||||
export interface IOrganizationClaim {
|
||||
id: string;
|
||||
name: string;
|
||||
slug: string;
|
||||
roles: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* UserInfo endpoint response
|
||||
*/
|
||||
export interface IUserInfoResponse {
|
||||
/** Subject (user ID) - always included */
|
||||
sub: string;
|
||||
|
||||
// Profile scope
|
||||
name?: string;
|
||||
preferred_username?: string;
|
||||
picture?: string;
|
||||
|
||||
// Email scope
|
||||
email?: string;
|
||||
email_verified?: boolean;
|
||||
|
||||
// Organizations scope (custom)
|
||||
organizations?: IOrganizationClaim[];
|
||||
|
||||
// Roles scope (custom)
|
||||
roles?: string[];
|
||||
app_roles?: string[];
|
||||
app_permissions?: string[];
|
||||
app_scopes?: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Token endpoint response
|
||||
*/
|
||||
export interface ITokenResponse {
|
||||
access_token: string;
|
||||
token_type: 'Bearer';
|
||||
expires_in: number;
|
||||
refresh_token?: string;
|
||||
id_token?: string;
|
||||
scope: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Token endpoint error response
|
||||
*/
|
||||
export interface ITokenErrorResponse {
|
||||
error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
|
||||
error_description?: string;
|
||||
error_uri?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Authorization request parameters
|
||||
*/
|
||||
export interface IAuthorizationRequest {
|
||||
client_id: string;
|
||||
redirect_uri: string;
|
||||
response_type: 'code';
|
||||
scope: string;
|
||||
state: string;
|
||||
code_challenge?: string;
|
||||
code_challenge_method?: 'S256';
|
||||
nonce?: string;
|
||||
prompt?: 'none' | 'login' | 'consent';
|
||||
}
|
||||
|
||||
/**
|
||||
* Token request for authorization_code grant
|
||||
*/
|
||||
export interface ITokenRequestAuthCode {
|
||||
grant_type: 'authorization_code';
|
||||
code: string;
|
||||
redirect_uri: string;
|
||||
client_id: string;
|
||||
client_secret?: string;
|
||||
code_verifier?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Token request for refresh_token grant
|
||||
*/
|
||||
export interface ITokenRequestRefresh {
|
||||
grant_type: 'refresh_token';
|
||||
refresh_token: string;
|
||||
client_id: string;
|
||||
client_secret?: string;
|
||||
scope?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Union type for token requests
|
||||
*/
|
||||
export type ITokenRequest = ITokenRequestAuthCode | ITokenRequestRefresh;
|
||||
@@ -0,0 +1,14 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type IBillingPlan } from './billingplan.js';
|
||||
import { type IOrgRoleDefinition, type IRole } from './role.js';
|
||||
|
||||
export interface IOrganization {
|
||||
id: string;
|
||||
data: {
|
||||
name: string;
|
||||
slug: string;
|
||||
billingPlanId: string;
|
||||
roleIds: string[];
|
||||
roleDefinitions?: IOrgRoleDefinition[];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,316 @@
|
||||
export interface IPaddleCheckoutData<TPassthrough = null> {
|
||||
checkout: {
|
||||
created_at: string;
|
||||
completed: boolean;
|
||||
id: string;
|
||||
coupon: {
|
||||
coupon_code?: string;
|
||||
};
|
||||
passthrough?: TPassthrough;
|
||||
prices: {
|
||||
customer: {
|
||||
currency: string;
|
||||
unit: string;
|
||||
unit_tax: string;
|
||||
total: string;
|
||||
total_tax: string;
|
||||
items: Array<{
|
||||
checkout_product_id: number;
|
||||
product_id: number;
|
||||
name: string;
|
||||
custom_message: string;
|
||||
quantity: number;
|
||||
allow_quantity: false;
|
||||
icon_url: string;
|
||||
min_quantity: number;
|
||||
max_quantity: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
/**
|
||||
* factorised, not percentage, so looks like 0.19 for Germany.
|
||||
*/
|
||||
tax_rate: number;
|
||||
recurring: {
|
||||
period: string;
|
||||
interval: number;
|
||||
trial_days: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
};
|
||||
}>;
|
||||
};
|
||||
vendor: {
|
||||
currency: string;
|
||||
unit: string;
|
||||
unit_tax: string;
|
||||
total: string;
|
||||
total_tax: string;
|
||||
items: [
|
||||
{
|
||||
checkout_product_id: number;
|
||||
product_id: number;
|
||||
name: string;
|
||||
custom_message: string;
|
||||
quantity: number;
|
||||
allow_quantity: false;
|
||||
icon_url: string;
|
||||
min_quantity: number;
|
||||
max_quantity: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
recurring: {
|
||||
period: string;
|
||||
interval: number;
|
||||
trial_days: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
redirect_url: null;
|
||||
test_variant: 'newCheckout';
|
||||
recurring_prices: {
|
||||
customer: {
|
||||
currency: string;
|
||||
unit: string;
|
||||
unit_tax: string;
|
||||
total: string;
|
||||
total_tax: string;
|
||||
items: [
|
||||
{
|
||||
checkout_product_id: number;
|
||||
product_id: number;
|
||||
name: string;
|
||||
custom_message: string;
|
||||
quantity: number;
|
||||
allow_quantity: false;
|
||||
icon_url: string;
|
||||
min_quantity: number;
|
||||
max_quantity: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
recurring: {
|
||||
period: string;
|
||||
interval: number;
|
||||
trial_days: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
interval: {
|
||||
length: number;
|
||||
type: string;
|
||||
};
|
||||
vendor: {
|
||||
currency: string;
|
||||
unit: string;
|
||||
unit_tax: string;
|
||||
total: string;
|
||||
total_tax: string;
|
||||
items: [
|
||||
{
|
||||
checkout_product_id: number;
|
||||
product_id: number;
|
||||
name: string;
|
||||
custom_message: string;
|
||||
quantity: number;
|
||||
allow_quantity: false;
|
||||
icon_url: string;
|
||||
min_quantity: number;
|
||||
max_quantity: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
recurring: {
|
||||
period: string;
|
||||
interval: number;
|
||||
trial_days: number;
|
||||
currency: string;
|
||||
unit_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
line_price: {
|
||||
net: number;
|
||||
gross: number;
|
||||
net_discount: number;
|
||||
gross_discount: number;
|
||||
net_after_discount: number;
|
||||
gross_after_discount: number;
|
||||
tax: number;
|
||||
tax_after_discount: number;
|
||||
};
|
||||
discounts: [];
|
||||
tax_rate: number;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
product: {
|
||||
quantity: number;
|
||||
id: number;
|
||||
name: string;
|
||||
};
|
||||
user: {
|
||||
id: string;
|
||||
email: string;
|
||||
country: string;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
import type { IPassportCapabilities } from './passportdevice.js';
|
||||
|
||||
export type TPassportChallengeType =
|
||||
| 'device_enrollment'
|
||||
| 'authentication'
|
||||
| 'step_up'
|
||||
| 'physical_access';
|
||||
|
||||
export type TPassportChallengeStatus = 'pending' | 'approved' | 'expired' | 'rejected';
|
||||
|
||||
export type TPassportChallengeDeliveryStatus = 'pending' | 'sent' | 'failed' | 'seen';
|
||||
|
||||
export type TPassportSignatureFormat = 'raw' | 'der';
|
||||
|
||||
export interface IPassportLocationEvidence {
|
||||
latitude: number;
|
||||
longitude: number;
|
||||
accuracyMeters: number;
|
||||
capturedAt: number;
|
||||
}
|
||||
|
||||
export interface IPassportNfcEvidence {
|
||||
tagId?: string;
|
||||
readerId?: string;
|
||||
}
|
||||
|
||||
export interface IPassportLocationPolicy {
|
||||
mode: 'geofence';
|
||||
label?: string;
|
||||
latitude: number;
|
||||
longitude: number;
|
||||
radiusMeters: number;
|
||||
maxAccuracyMeters?: number;
|
||||
}
|
||||
|
||||
export interface IPassportChallenge {
|
||||
id: string;
|
||||
data: {
|
||||
userId: string;
|
||||
deviceId?: string | null;
|
||||
type: TPassportChallengeType;
|
||||
status: TPassportChallengeStatus;
|
||||
tokenHash?: string | null;
|
||||
challenge: string;
|
||||
metadata: {
|
||||
originHost?: string;
|
||||
audience?: string;
|
||||
notificationTitle?: string;
|
||||
deviceLabel?: string;
|
||||
requireLocation: boolean;
|
||||
requireNfc: boolean;
|
||||
locationPolicy?: IPassportLocationPolicy;
|
||||
requestedCapabilities?: Partial<IPassportCapabilities>;
|
||||
};
|
||||
evidence?: {
|
||||
signatureFormat?: TPassportSignatureFormat;
|
||||
location?: IPassportLocationEvidence;
|
||||
locationEvaluation?: {
|
||||
matched: boolean;
|
||||
distanceMeters?: number;
|
||||
accuracyAccepted?: boolean;
|
||||
evaluatedAt: number;
|
||||
reason?: string;
|
||||
};
|
||||
nfc?: IPassportNfcEvidence;
|
||||
};
|
||||
notification?: {
|
||||
hintId: string;
|
||||
status: TPassportChallengeDeliveryStatus;
|
||||
attemptCount: number;
|
||||
createdAt: number;
|
||||
deliveredAt?: number | null;
|
||||
seenAt?: number | null;
|
||||
lastError?: string | null;
|
||||
};
|
||||
createdAt: number;
|
||||
expiresAt: number;
|
||||
completedAt?: number | null;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
export type TPassportDevicePlatform =
|
||||
| 'ios'
|
||||
| 'ipados'
|
||||
| 'macos'
|
||||
| 'watchos'
|
||||
| 'android'
|
||||
| 'web'
|
||||
| 'unknown';
|
||||
|
||||
export type TPassportDeviceStatus = 'active' | 'revoked';
|
||||
|
||||
export type TPassportPushProvider = 'apns';
|
||||
|
||||
export type TPassportPushEnvironment = 'development' | 'production';
|
||||
|
||||
export interface IPassportCapabilities {
|
||||
gps: boolean;
|
||||
nfc: boolean;
|
||||
push: boolean;
|
||||
}
|
||||
|
||||
export interface IPassportDevice {
|
||||
id: string;
|
||||
data: {
|
||||
userId: string;
|
||||
label: string;
|
||||
platform: TPassportDevicePlatform;
|
||||
status: TPassportDeviceStatus;
|
||||
publicKeyAlgorithm: 'p256';
|
||||
publicKeyX963Base64: string;
|
||||
capabilities: IPassportCapabilities;
|
||||
pushRegistration?: {
|
||||
provider: TPassportPushProvider;
|
||||
token: string;
|
||||
topic: string;
|
||||
environment: TPassportPushEnvironment;
|
||||
registeredAt: number;
|
||||
lastDeliveredAt?: number;
|
||||
lastError?: string;
|
||||
};
|
||||
appVersion?: string;
|
||||
createdAt: number;
|
||||
lastSeenAt?: number;
|
||||
lastChallengeAt?: number;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
export interface IPassportNonce {
|
||||
id: string;
|
||||
data: {
|
||||
deviceId: string;
|
||||
nonceHash: string;
|
||||
createdAt: number;
|
||||
expiresAt: number;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type IRole } from './role.js';
|
||||
|
||||
export interface ISubOrgProperty {
|
||||
name: string;
|
||||
domain: string;
|
||||
roles: IRole[];
|
||||
/**
|
||||
* contains the ids of all the apps that show the property
|
||||
*/
|
||||
attributedAppIds: string[];
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
export type TRegistrationSessionStatus =
|
||||
| 'announced'
|
||||
| 'emailValidated'
|
||||
| 'mobileVerified'
|
||||
| 'registered'
|
||||
| 'failed';
|
||||
|
||||
export interface IRegistrationSession {
|
||||
id: string;
|
||||
data: {
|
||||
emailAddress: string;
|
||||
hashedEmailToken: string;
|
||||
smsCodeHash?: string | null;
|
||||
smsvalidationCounter: number;
|
||||
status: TRegistrationSessionStatus;
|
||||
validUntil: number;
|
||||
createdAt: number;
|
||||
collectedData: {
|
||||
userData: {
|
||||
username?: string | null;
|
||||
connectedOrgs: string[];
|
||||
email?: string | null;
|
||||
name?: string | null;
|
||||
status?: 'new' | 'active' | 'deleted' | 'suspended' | null;
|
||||
mobileNumber?: string | null;
|
||||
password?: string | null;
|
||||
passwordHash?: string | null;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
|
||||
/** Standard role types available in all organizations */
|
||||
export type TStandardRole = 'owner' | 'admin' | 'editor' | 'guest' | 'viewer' | 'outlaw';
|
||||
|
||||
export interface IOrgRoleDefinition {
|
||||
key: string;
|
||||
name: string;
|
||||
description?: string;
|
||||
createdAt: number;
|
||||
updatedAt: number;
|
||||
}
|
||||
|
||||
export interface IAppRoleMapping {
|
||||
orgRoleKey: string;
|
||||
appRoles: string[];
|
||||
permissions: string[];
|
||||
scopes: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* A role describes a user's permissions within an organization.
|
||||
* Users can have multiple roles (e.g., ['owner', 'billing-admin']).
|
||||
*/
|
||||
export interface IRole {
|
||||
id: string;
|
||||
data: {
|
||||
userId: string;
|
||||
organizationId: string;
|
||||
/** Array of roles - supports standard roles and custom role names */
|
||||
roles: string[];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type IRole } from './role.js';
|
||||
|
||||
export interface IUser {
|
||||
id: string;
|
||||
data: {
|
||||
name: string;
|
||||
username: string;
|
||||
email: string;
|
||||
|
||||
/**
|
||||
* mobile number used for verification
|
||||
*/
|
||||
mobileNumber?: string;
|
||||
/**
|
||||
* only used during initial password setting
|
||||
*/
|
||||
password?: string;
|
||||
/**
|
||||
* used for validation of passwords
|
||||
*/
|
||||
passwordHash?: string;
|
||||
status: 'new' | 'active' | 'deleted' | 'suspended';
|
||||
/**
|
||||
* a quick ref for which organizations might have roles for this user
|
||||
* speeds up lookup
|
||||
*/
|
||||
connectedOrgs: string[];
|
||||
/**
|
||||
* Platform-level admin flag
|
||||
* Users with this flag can access the global admin panel
|
||||
* to manage global apps, view platform stats, etc.
|
||||
*/
|
||||
isGlobalAdmin?: boolean;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
|
||||
/**
|
||||
* A UserInvitation represents an invitation to join an organization.
|
||||
* Key characteristics:
|
||||
* - Unique by email (multiple orgs can share the same invitation)
|
||||
* - Converts to real User on registration or folds into existing user
|
||||
* - Auto-expires after 90 days
|
||||
*/
|
||||
export interface IUserInvitation {
|
||||
id: string;
|
||||
data: {
|
||||
/** The invited email address - unique key for sharing across orgs */
|
||||
email: string;
|
||||
|
||||
/** Secure token for invitation link validation */
|
||||
token: string;
|
||||
|
||||
/** Current status of the invitation */
|
||||
status: 'pending' | 'accepted' | 'expired' | 'cancelled';
|
||||
|
||||
/** When the invitation was first created */
|
||||
createdAt: number;
|
||||
|
||||
/** When the invitation expires (createdAt + 90 days) */
|
||||
expiresAt: number;
|
||||
|
||||
/**
|
||||
* Organizations that have invited this email.
|
||||
* Multiple orgs can link to the same invitation.
|
||||
*/
|
||||
organizationRefs: IOrganizationInvitationRef[];
|
||||
|
||||
/** When the invitation was accepted (user registered/folded) */
|
||||
acceptedAt?: number;
|
||||
|
||||
/** The User ID after conversion (when accepted) */
|
||||
convertedToUserId?: string;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Represents one organization's invitation to the user.
|
||||
* Stored as part of IUserInvitation.organizationRefs array.
|
||||
*/
|
||||
export interface IOrganizationInvitationRef {
|
||||
/** The organization that sent this invitation */
|
||||
organizationId: string;
|
||||
|
||||
/** The user who sent the invitation */
|
||||
invitedByUserId: string;
|
||||
|
||||
/** When this org invited the user */
|
||||
invitedAt: number;
|
||||
|
||||
/** Roles to assign when the invitation is accepted */
|
||||
roles: string[];
|
||||
}
|
||||
Reference in New Issue
Block a user