Abstract Class: BaseSecretRoute<T>

Defined in: src/routes/BaseSecretRoute.ts:53

Extends

• ModelRoute<T>

Extended by

• BaseSecretRouteMongo
• BaseSecretRouteSQL

Type Parameters

T

T extends Secret

Constructors

Constructor

new BaseSecretRoute<T>(): BaseSecretRoute<T>

Returns

BaseSecretRoute<T>

Inherited from

ModelRoute<T>.constructor

Properties

_objectFactory?

protected optional _objectFactory?: ObjectFactory

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:101

Inherited from

ModelRoute._objectFactory

---

aclUtils?

protected optional aclUtils?: ACLUtils

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:102

Inherited from

ModelRoute.aclUtils

---

config?

protected optional config?: any

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:104

The global application configuration.

Inherited from

ModelRoute.config

---

defaultACLUid

protected defaultACLUid: string

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:106

The unique identifier of the default ACL for the model type.

Inherited from

ModelRoute.defaultACLUid

---

fido2Config

protected fido2Config: PasskeyConfig

Defined in: src/routes/BaseSecretRoute.ts:75

The relying party configuration used for validating and generating FIDO2 hardware security key (WebAuthn) registration data. Kept separate from passkeyConfig since a hardware key deployment commonly wants a different authenticatorAttachment/residentKey policy — a hardware key is typically registered as a "cross-platform", non-discoverable credential tied to a known account, rather than a discoverable, possibly-synced passkey.

---

logger

protected logger: any

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:107

Inherited from

ModelRoute.logger

---

notificationUtils?

protected optional notificationUtils?: NotificationUtils

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:108

Inherited from

ModelRoute.notificationUtils

---

passkeyConfig

protected passkeyConfig: PasskeyConfig

Defined in: src/routes/BaseSecretRoute.ts:61

The relying party configuration used for validating and generating passkey (WebAuthn) registration data.

---

passwordConfig

protected passwordConfig: PasswordConfig

Defined in: src/routes/BaseSecretRoute.ts:99

The minimum required length for a new password secret's plaintext value.

---

regexSpecialChars

protected regexSpecialChars: RegExp

Defined in: src/routes/BaseSecretRoute.ts:55

---

repoUtils?

protected optional repoUtils?: RepoUtils<T>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:112

The repository utility class to use for common operations.

Inherited from

ModelRoute.repoUtils

---

repoUtilsClass

protected readonly repoUtilsClass: any = RepoUtils

Defined in: src/routes/BaseSecretRoute.ts:54

The class of the RepoUtils to use when instantiating the utility.

Overrides

ModelRoute.repoUtilsClass

---

totpConfig

protected totpConfig: TOTPConfig

Defined in: src/routes/BaseSecretRoute.ts:87

The issuer configuration used for validating and generating TOTP (RFC 6238) registration data.

---

trackChanges

protected trackChanges: number

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:117

The number of previous document versions to store in the database. A negative value indicates storing all versions, a value of 0 stores no versions.

Inherited from

ModelRoute.trackChanges

---

trustedProxies

protected trustedProxies: string[] = []

Defined in: src/routes/BaseSecretRoute.ts:102

---

trustedRoles

protected trustedRoles: string[]

Defined in: src/routes/BaseSecretRoute.ts:105

Overrides

ModelRoute.trustedRoles

Accessors

modelClass

Get Signature

get modelClass(): any

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:122

The class type of the model this route is associated with.

Returns

any

Inherited from

ModelRoute.modelClass

Methods

cleanData()

protected cleanData(obj): void

Defined in: src/routes/BaseSecretRoute.ts:132

Removes the data property from the secret(s) to protect sensitive information.

Parameters

obj

T | T[]

Returns

void

---

count()

count(params, query, res, user): Promise<any>

Defined in: src/routes/BaseSecretRoute.ts:147

Parameters

params

any

query

any

res

HttpResponse

user

JWTUser

Returns

Promise<any>

---

create()

create(obj, req, user): Promise<T | T[]>

Defined in: src/routes/BaseSecretRoute.ts:469

Parameters

obj

T | T[]

req

HttpRequest

user

JWTUser

Returns

Promise<T | T[]>

---

delete()

delete(id, version, purge, req, user): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:547

Parameters

id

string

version

string | undefined

purge

string | undefined

req

HttpRequest

user

JWTUser

Returns

Promise<void>

---

doBulkCreate()

protected doBulkCreate(objs, options): Promise<T[]>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:151

Attempts to store a collection of objects provided in options.req.body into the datasource. Upon success, sets the newly persisted object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the client.

Parameters

objs

Partial<T>[]

The object(s) to store in the database.

options

CreateRequestOptions

The options to process the request using.

Returns

Promise<T[]>

Inherited from

ModelRoute.doBulkCreate

---

doBulkUpdate()

protected doBulkUpdate(objs, options): Promise<T[]>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:203

Attempts to modify a collection of existing data model objects.

Parameters

objs

UpdateObject<T>[]

The object(s) to bulk update in the database.

options

UpdateRequestOptions<T>

The options to process the request using.

Returns

Promise<T[]>

Inherited from

ModelRoute.doBulkUpdate

---

doCount()

protected doCount(options): Promise<HttpResponse>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:133

Attempts to retrieve the number of data model objects matching the given set of criteria as specified in the request query. Any results that have been found are set to the content-length header of the res argument.

Parameters

options

FindRequestOptions

The options to process the request using.

Returns

Promise<HttpResponse>

Inherited from

ModelRoute.doCount

---

doCreate()

protected doCreate(obj, options): Promise<T | T[]>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:160

Attempts to store one or more objects provided in options.req.body into the datasource. Upon success, sets the newly persisted object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the client.

Parameters

obj

Partial<T> | Partial<T>[]

The object(s) to store in the database.

options

CreateRequestOptions

The options to process the request using.

Returns

Promise<T | T[]>

Inherited from

ModelRoute.doCreate

---

doCreateObject()

protected doCreateObject(obj, options): Promise<T>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:142

Attempts to store an object provided in options.req.body into the datasource. Upon success, sets the newly persisted object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the client.

Parameters

obj

Partial<T>

The object to store in the database.

options

CreateRequestOptions

The options to process the request using.

Returns

Promise<T>

Inherited from

ModelRoute.doCreateObject

---

doDelete()

protected doDelete(id, options): Promise<void>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:168

Attempts to delete an existing data model object with a given unique identifier encoded by the URI parameter id.

Parameters

id

string

The unique identifier of the object to delete.

options

DeleteRequestOptions

The options to process the request using.

Returns

Promise<void>

Inherited from

ModelRoute.doDelete

---

doExists()

protected doExists(id, options): Promise<any>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:175

Attempts to determine if an existing object with the given unique identifier exists.

Parameters

id

string

The unique identifier of the object to verify exists.

options

FindRequestOptions

The options to process the request using.

Returns

Promise<any>

Inherited from

ModelRoute.doExists

---

doFind()

protected doFind(options): Promise<T[]>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:183

Attempts to retrieve all data model objects matching the given set of criteria as specified in the request query. Any results that have been found are set to the result property of the res argument. result is never null.

Parameters

options

FindRequestOptions

The options to process the request using.

Returns

Promise<T[]>

Inherited from

ModelRoute.doFind

---

doFindById()

protected doFindById(id, options): Promise<T | null>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:189

Attempts to retrieve a single data model object as identified by the id parameter in the URI.

Parameters

id

string

options

FindRequestOptions

The options to process the request using.

Returns

Promise<T | null>

Inherited from

ModelRoute.doFindById

---

doTruncate()

protected doTruncate(options): Promise<void>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:196

Attempts to remove all entries of the data model type from the datasource matching the given parameters and query.

Parameters

options

TruncateRequestOptions

The options to process the request using.

Returns

Promise<void>

Inherited from

ModelRoute.doTruncate

---

doUpdate()

protected doUpdate(id, obj, options): Promise<T>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:210

Attempts to modify an existing data model object as identified by the id parameter in the URI.

Parameters

id

string

obj

UpdateObject<T>

The object to update in the database

options

UpdateRequestOptions<T>

The options to process the request using.

Returns

Promise<T>

Inherited from

ModelRoute.doUpdate

---

doUpdateProperty()

protected doUpdateProperty(id, propertyName, value, options): Promise<T>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:221

Attempts to modify a single property of an existing data model object as identified by the id parameter in the URI.

Note that this effectively bypasses optimistic locking and can cause unexpected data overwrites. Use with care.

Parameters

id

string

The unique identifier of the object to update.

propertyName

string

The name of the property to update.

value

any

The value of the property to set.

options

UpdateRequestOptions<T>

The options to process the request using.

Returns

Promise<T>

Inherited from

ModelRoute.doUpdateProperty

---

enforceOwnership()

protected enforceOwnership(obj, user?): void

Defined in: src/routes/BaseSecretRoute.ts:118

Ensures the userUid of a secret being created belongs to the authenticated caller, defaulting it to their own uid when unset. Prevents any authenticated user from self-service registering a password, passkey, FIDO2 key, or TOTP secret on another user's account. Callers with one of trustedRoles (e.g. an administrator provisioning an account) are exempt.

Parameters

obj

Partial<T>

user?

JWTUser

Returns

void

---

exists()

exists(id, query, res, user): Promise<any>

Defined in: src/routes/BaseSecretRoute.ts:578

Parameters

id

string

query

any

res

HttpResponse

user

JWTUser

Returns

Promise<any>

---

fido2RegistrationOptions()

fido2RegistrationOptions(req, user): Promise<any>

Defined in: src/routes/BaseSecretRoute.ts:450

Parameters

req

HttpRequest

user

JWTUser

Returns

Promise<any>

---

find()

find(params, query, user): Promise<T[]>

Defined in: src/routes/BaseSecretRoute.ts:603

Secret's class-level ACL intentionally does NOT grant LIST to .* — per-record ACL narrowing in RepoUtils.find() falls back to the parent (class-level) ACL when a specific record has no direct grant for the caller, so a class-level .*: LIST wildcard would make every record's per-record check pass for every caller via that fallback, leaking every user's secrets to every other user. Instead, self-service "list my own secrets" is handled here directly: scope the query to the caller's own userUid (discarding any client-supplied userUid filter, which would otherwise let a caller probe another user's secrets) and bypass ACL entirely with ignoreACL for that already-scoped lookup — the same pattern already used internally by beginWebAuthnRegistration() above. A trusted role keeps the normal, unscoped behavior.

Parameters

params

any

query

any

user

JWTUser

Returns

Promise<T[]>

---

findById()

findById(id, query, user): Promise<T | null>

Defined in: src/routes/BaseSecretRoute.ts:626

Parameters

id

string

query

any

user

JWTUser

Returns

Promise<T | null>

---

getPasswordConfig()

getPasswordConfig(): Promise<any>

Defined in: src/routes/BaseSecretRoute.ts:436

Returns

Promise<any>

---

passkeyRegistrationOptions()

passkeyRegistrationOptions(req, user): Promise<any>

Defined in: src/routes/BaseSecretRoute.ts:424

Parameters

req

HttpRequest

user

JWTUser

Returns

Promise<any>

---

truncate()

truncate(params, query, user): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:640

Parameters

params

any

query

any

user

JWTUser

Returns

Promise<void>

---

update()

update(id, obj, req, user): Promise<T>

Defined in: src/routes/BaseSecretRoute.ts:715

Parameters

id

string

obj

UpdateObject<T>

req

HttpRequest

user

JWTUser

Returns

Promise<T>

---

validate()

validate(objs, options?): Promise<void>

Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:225

Calls repoUtils.validate() to validate the object(s) provided.

Parameters

objs

Partial<T> | Partial<T>[]

options?

CreateRequestOptions | UpdateRequestOptions<T>

Returns

Promise<void>

Inherited from

ModelRoute.validate

---

validateCreate()

protected validateCreate(obj, req, user?): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:156

Parameters

obj

Partial<T>

req

HttpRequest

user?

JWTUser

Returns

Promise<void>

---

validateRecoveryCodesCreate()

protected validateRecoveryCodesCreate(obj, req): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:365

Generates a fresh batch of MFA recovery/backup codes for the account, discarding any client-supplied data entirely - unlike a TOTP secret, there's no legitimate reason for a caller to bring their own codes here; accepting caller-chosen values would let an attacker who can currently write to this secret pre-plant known codes for later use. Only each code's argon2 hash is persisted (see RecoveryCodesSecret); the plaintext is stashed on req so sanitizeSecretForResponse() can return it to the caller exactly once, in the create() response - it can never be retrieved again after that, since it's never written to the datastore.

Parameters

obj

Partial<T>

The secret being created.

req

HttpRequest

The source HTTP request, used to stash the plaintext codes for the create() response only.

Returns

Promise<void>

---

validateTOTPCreate()

protected validateTOTPCreate(obj): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:326

Validates (or generates) the secret for a new totp secret per RFC 6238/RFC 4226.

The client may either bring their own Base32-encoded secret (e.g. one generated on a different server for migration purposes) or, more commonly, omit data entirely and have one generated here. Either way, the secret's token parameters (digits/period/algorithm) are captured onto the stored TOTPSecret alongside it, rather than left to always defer to totpConfig, so verification keeps working for this secret even if the configured defaults change later.

Parameters

obj

Partial<T>

The secret being created. If data is a string, it's used as the caller-supplied secret; otherwise a new one is generated.

Returns

Promise<void>

---

validateUpdate()

protected validateUpdate(obj, existing, user): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:644

Parameters

obj

UpdateObject<T>

existing

T

user

JWTUser

Returns

Promise<void>

---

validateWebAuthnCreate()

protected validateWebAuthnCreate(obj, req, config): Promise<void>

Defined in: src/routes/BaseSecretRoute.ts:263

Verifies a client-submitted WebAuthn RegistrationResponseJSON (as produced by navigator.credentials.create() using the options from generatePasskeyRegistrationOptions()) against the challenge stored in the session, and replaces obj.data with the resulting StoredPasskeyCredential.

Shared by both passkey and fido2 secrets — the two differ only in relying party configuration (see passkeyConfig/fido2Config) and which SecretType they're persisted under, not in the underlying WebAuthn ceremony.

Per the WebAuthn registration ceremony (https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential), the credential ID must be unique across all accounts known to this relying party. Rather than duplicate that check here, the credential ID is used directly as this secret's own uid so that ModelRoute's existing create-time identifier check rejects the request should the ID already be registered to any account. This also lets a login ceremony, which only has the credential ID to go on, look the secret up directly by its primary key (see BaseAuthPasskeyRoute/BaseAuthFIDO2Route's getCredentialById/updateCredentialCounter).

Parameters

obj

Partial<T>

The secret being created. Its data property must be a RegistrationResponseJSON.

req

HttpRequest

The source HTTP request, used to retrieve the challenge stored in the session by a prior call to generatePasskeyRegistrationOptions().

config

PasskeyConfig

The relying party configuration to verify the response against.

Returns

Promise<void>