Skip to main content

Abstract Class: BaseAccountRoute<U, A, P, S>

Defined in: auth/src/routes/BaseAccountRoute.ts:32

Provides a single set of routes for working with a user's account data in aggregate.

Extended by​

Type Parameters​

U​

U extends User

A​

A extends Alias

P​

P extends Profile

S​

S extends Secret

Constructors​

Constructor​

new BaseAccountRoute<U, A, P, S>(): BaseAccountRoute<U, A, P, S>

Returns​

BaseAccountRoute<U, A, P, S>

Properties​

aliasClass​

abstract protected aliasClass: any

Defined in: auth/src/routes/BaseAccountRoute.ts:33

aliasRepo?​

protected optional aliasRepo?: RepoUtils<A>

Defined in: auth/src/routes/BaseAccountRoute.ts:65

auditLogUtils?​

protected optional auditLogUtils?: AuditLogUtils

Defined in: auth/src/routes/BaseAccountRoute.ts:60

defaultScopes​

protected defaultScopes: string[] = []

Defined in: auth/src/routes/BaseAccountRoute.ts:42

jwtConfig?​

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseAccountRoute.ts:45

logger​

protected logger: any

Defined in: auth/src/routes/BaseAccountRoute.ts:51

messagingUtils?​

protected optional messagingUtils?: MessagingUtils

Defined in: auth/src/routes/BaseAccountRoute.ts:54

profileClass​

abstract protected profileClass: any

Defined in: auth/src/routes/BaseAccountRoute.ts:34

profileRepo?​

protected optional profileRepo?: RepoUtils<P>

Defined in: auth/src/routes/BaseAccountRoute.ts:66

rateLimiter?​

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseAccountRoute.ts:63

secretClass​

abstract protected secretClass: any

Defined in: auth/src/routes/BaseAccountRoute.ts:35

secretRepo?​

protected optional secretRepo?: RepoUtils<S>

Defined in: auth/src/routes/BaseAccountRoute.ts:67

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: auth/src/routes/BaseAccountRoute.ts:57

trustedProxies​

protected trustedProxies: string[] = []

Defined in: auth/src/routes/BaseAccountRoute.ts:71

trustedRoles​

protected trustedRoles: string[]

Defined in: auth/src/routes/BaseAccountRoute.ts:48

userClass​

abstract protected userClass: any

Defined in: auth/src/routes/BaseAccountRoute.ts:36

userRepo?​

protected optional userRepo?: RepoUtils<U>

Defined in: auth/src/routes/BaseAccountRoute.ts:68

Methods​

cleanSecretData()​

protected cleanSecretData(obj): void

Defined in: auth/src/routes/BaseAccountRoute.ts:111

Removes the data property from the secret(s) to protect sensitive information.

Parameters​

obj​

S | S[]

Returns​

void

delete()​

delete(id, req, user): Promise<any>

Defined in: auth/src/routes/BaseAccountRoute.ts:123

Parameters​

id​

string

req​

HttpRequest

user​

JWTUser

Returns​

Promise<any>

get()​

get(id, user): Promise<any>

Defined in: auth/src/routes/BaseAccountRoute.ts:167

Parameters​

id​

string

user​

JWTUser

Returns​

Promise<any>

initialize()​

protected initialize(): Promise<void>

Defined in: auth/src/routes/BaseAccountRoute.ts:74

Returns​

Promise<void>

resolveOwnedUid()​

protected resolveOwnedUid(id, user): string

Defined in: auth/src/routes/BaseAccountRoute.ts:263

Resolves id (handling the "me" keyword) and verifies the caller either owns the targeted account (targetUid === user.uid) or holds a trusted role. Throws 403 otherwise.

Parameters​

id​

string

user​

JWTUser

Returns​

string

revokeSessions()​

revokeSessions(id, req, user): Promise<void>

Defined in: auth/src/routes/BaseAccountRoute.ts:221

Immediately revokes every outstanding refresh token for the account (self-service, or any account's if the caller holds a trusted role) — the standard "log out everywhere" action, e.g. after a suspected account compromise.

This does NOT invalidate an already-issued access token, which remains valid until its own natural (short) expiry regardless of this call — true immediate access-token revocation would require a persistent revocation check on every single request, which the underlying JWT verification (@rapidrest/service-core's JWTStrategy, an external package this library doesn't control) doesn't support; it does a stateless signature/expiry check only, with no per-request datastore lookup. What this does reliably stop going forward is BaseAuthRefreshRoute minting any new access token from a refresh token issued before this call — see the iat check there. This includes the caller's own current session: there is no "everywhere but here" variant, matching the equivalent behavior in most other systems that offer this action.

Parameters​

id​

string

req​

HttpRequest

user​

JWTUser

Returns​

Promise<void>