Class: BaseSecretRouteMongo
Defined in: src/routes/mongo/BaseSecretRouteMongo.ts:11
Extends
Constructors
Constructor
new BaseSecretRouteMongo():
BaseSecretRouteMongo
Returns
BaseSecretRouteMongo
Inherited from
Properties
_objectFactory?
protectedoptional_objectFactory?:ObjectFactory
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:101
Inherited from
BaseSecretRoute._objectFactory
aclUtils?
protectedoptionalaclUtils?:ACLUtils
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:102
Inherited from
config?
protectedoptionalconfig?:any
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:104
The global application configuration.
Inherited from
defaultACLUid
protecteddefaultACLUid:string
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:106
The unique identifier of the default ACL for the model type.
Inherited from
fido2Config
protectedfido2Config:PasskeyConfig
Defined in: src/routes/BaseSecretRoute.ts:75
The relying party configuration used for validating and generating FIDO2 hardware security key
(WebAuthn) registration data. Kept separate from passkeyConfig since a hardware key deployment
commonly wants a different authenticatorAttachment/residentKey policy — a hardware key is
typically registered as a "cross-platform", non-discoverable credential tied to a known
account, rather than a discoverable, possibly-synced passkey.
Inherited from
logger
protectedlogger:any
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:107
Inherited from
notificationUtils?
protectedoptionalnotificationUtils?:NotificationUtils
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:108
Inherited from
BaseSecretRoute.notificationUtils
passkeyConfig
protectedpasskeyConfig:PasskeyConfig
Defined in: src/routes/BaseSecretRoute.ts:61
The relying party configuration used for validating and generating passkey (WebAuthn) registration data.
Inherited from
passwordConfig
protectedpasswordConfig:PasswordConfig
Defined in: src/routes/BaseSecretRoute.ts:99
The minimum required length for a new password secret's plaintext value.
Inherited from
BaseSecretRoute.passwordConfig
regexSpecialChars
protectedregexSpecialChars:RegExp
Defined in: src/routes/BaseSecretRoute.ts:55
Inherited from
BaseSecretRoute.regexSpecialChars
repoUtils?
protectedoptionalrepoUtils?:RepoUtils<SecretMongo>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:112
The repository utility class to use for common operations.
Inherited from
repoUtilsClass
protectedreadonlyrepoUtilsClass:any=RepoUtils
Defined in: src/routes/BaseSecretRoute.ts:54
The class of the RepoUtils to use when instantiating the utility.
Inherited from
BaseSecretRoute.repoUtilsClass
totpConfig
protectedtotpConfig:TOTPConfig
Defined in: src/routes/BaseSecretRoute.ts:87
The issuer configuration used for validating and generating TOTP (RFC 6238) registration data.
Inherited from
trackChanges
protectedtrackChanges:number
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:117
The number of previous document versions to store in the database. A negative value indicates storing all
versions, a value of 0 stores no versions.
Inherited from
trustedProxies
protectedtrustedProxies:string[] =[]
Defined in: src/routes/BaseSecretRoute.ts:102
Inherited from
BaseSecretRoute.trustedProxies
trustedRoles
protectedtrustedRoles:string[]
Defined in: src/routes/BaseSecretRoute.ts:105
Inherited from
Accessors
modelClass
Get Signature
get modelClass():
any
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:122
The class type of the model this route is associated with.
Returns
any
Inherited from
Methods
cleanData()
protectedcleanData(obj):void
Defined in: src/routes/BaseSecretRoute.ts:132
Removes the data property from the secret(s) to protect sensitive information.
Parameters
obj
Returns
void
Inherited from
count()
count(
params,query,res,user):Promise<any>
Defined in: src/routes/BaseSecretRoute.ts:147
Parameters
params
any
query
any
res
HttpResponse
user
JWTUser
Returns
Promise<any>
Inherited from
create()
create(
obj,req,user):Promise<SecretMongo|SecretMongo[]>
Defined in: src/routes/BaseSecretRoute.ts:469
Parameters
obj
req
HttpRequest
user
JWTUser
Returns
Promise<SecretMongo | SecretMongo[]>
Inherited from
delete()
delete(
id,version,purge,req,user):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:547
Parameters
id
string
version
string | undefined
purge
string | undefined
req
HttpRequest
user
JWTUser
Returns
Promise<void>
Inherited from
doBulkCreate()
protecteddoBulkCreate(objs,options):Promise<SecretMongo[]>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:151
Attempts to store a collection of objects provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
objs
Partial<SecretMongo>[]
The object(s) to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretMongo[]>
Inherited from
doBulkUpdate()
protecteddoBulkUpdate(objs,options):Promise<SecretMongo[]>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:203
Attempts to modify a collection of existing data model objects.
Parameters
objs
UpdateObject<SecretMongo>[]
The object(s) to bulk update in the database.
options
UpdateRequestOptions<SecretMongo>
The options to process the request using.
Returns
Promise<SecretMongo[]>
Inherited from
doCount()
protecteddoCount(options):Promise<HttpResponse>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:133
Attempts to retrieve the number of data model objects matching the given set of criteria as specified in the
request query. Any results that have been found are set to the content-length header of the res argument.
Parameters
options
FindRequestOptions
The options to process the request using.
Returns
Promise<HttpResponse>
Inherited from
doCreate()
protecteddoCreate(obj,options):Promise<SecretMongo|SecretMongo[]>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:160
Attempts to store one or more objects provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
obj
Partial<SecretMongo> | Partial<SecretMongo>[]
The object(s) to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretMongo | SecretMongo[]>
Inherited from
doCreateObject()
protecteddoCreateObject(obj,options):Promise<SecretMongo>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:142
Attempts to store an object provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
obj
Partial<T>
The object to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretMongo>
Inherited from
BaseSecretRoute.doCreateObject
doDelete()
protecteddoDelete(id,options):Promise<void>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:168
Attempts to delete an existing data model object with a given unique identifier encoded by the URI parameter
id.
Parameters
id
string
The unique identifier of the object to delete.
options
DeleteRequestOptions
The options to process the request using.
Returns
Promise<void>
Inherited from
doExists()
protecteddoExists(id,options):Promise<any>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:175
Attempts to determine if an existing object with the given unique identifier exists.
Parameters
id
string
The unique identifier of the object to verify exists.
options
FindRequestOptions
The options to process the request using.
Returns
Promise<any>
Inherited from
doFind()
protecteddoFind(options):Promise<SecretMongo[]>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:183
Attempts to retrieve all data model objects matching the given set of criteria as specified in the request
query. Any results that have been found are set to the result property of the res argument. result is
never null.
Parameters
options
FindRequestOptions
The options to process the request using.
Returns
Promise<SecretMongo[]>
Inherited from
doFindById()
protecteddoFindById(id,options):Promise<SecretMongo|null>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:189
Attempts to retrieve a single data model object as identified by the id parameter in the URI.
Parameters
id
string
options
FindRequestOptions
The options to process the request using.
Returns
Promise<SecretMongo | null>
Inherited from
doTruncate()
protecteddoTruncate(options):Promise<void>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:196
Attempts to remove all entries of the data model type from the datasource matching the given parameters and query.
Parameters
options
TruncateRequestOptions
The options to process the request using.
Returns
Promise<void>
Inherited from
doUpdate()
protecteddoUpdate(id,obj,options):Promise<SecretMongo>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:210
Attempts to modify an existing data model object as identified by the id parameter in the URI.
Parameters
id
string
obj
UpdateObject<SecretMongo>
The object to update in the database
options
UpdateRequestOptions<SecretMongo>
The options to process the request using.
Returns
Promise<SecretMongo>
Inherited from
doUpdateProperty()
protecteddoUpdateProperty(id,propertyName,value,options):Promise<SecretMongo>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:221
Attempts to modify a single property of an existing data model object as identified by the id parameter in the URI.
Note that this effectively bypasses optimistic locking and can cause unexpected data overwrites. Use with care.
Parameters
id
string
The unique identifier of the object to update.
propertyName
string
The name of the property to update.
value
any
The value of the property to set.
options
UpdateRequestOptions<SecretMongo>
The options to process the request using.
Returns
Promise<SecretMongo>
Inherited from
BaseSecretRoute.doUpdateProperty
enforceOwnership()
protectedenforceOwnership(obj,user?):void
Defined in: src/routes/BaseSecretRoute.ts:118
Ensures the userUid of a secret being created belongs to the authenticated caller, defaulting it to
their own uid when unset. Prevents any authenticated user from self-service registering a password,
passkey, FIDO2 key, or TOTP secret on another user's account. Callers with one of trustedRoles (e.g.
an administrator provisioning an account) are exempt.
Parameters
obj
Partial<T>
user?
JWTUser
Returns
void
Inherited from
BaseSecretRoute.enforceOwnership
exists()
exists(
id,query,res,user):Promise<any>
Defined in: src/routes/BaseSecretRoute.ts:578
Parameters
id
string
query
any
res
HttpResponse
user
JWTUser
Returns
Promise<any>
Inherited from
fido2RegistrationOptions()
fido2RegistrationOptions(
req,user):Promise<any>
Defined in: src/routes/BaseSecretRoute.ts:450
Parameters
req
HttpRequest
user
JWTUser
Returns
Promise<any>
Inherited from
BaseSecretRoute.fido2RegistrationOptions
find()
find(
params,query,user):Promise<SecretMongo[]>
Defined in: src/routes/BaseSecretRoute.ts:603
Secret's class-level ACL intentionally does NOT grant LIST to .* — per-record ACL narrowing in
RepoUtils.find() falls back to the parent (class-level) ACL when a specific record has no direct
grant for the caller, so a class-level .*: LIST wildcard would make every record's per-record check
pass for every caller via that fallback, leaking every user's secrets to every other user. Instead,
self-service "list my own secrets" is handled here directly: scope the query to the caller's own
userUid (discarding any client-supplied userUid filter, which would otherwise let a caller probe
another user's secrets) and bypass ACL entirely with ignoreACL for that already-scoped lookup — the
same pattern already used internally by beginWebAuthnRegistration() above. A trusted role keeps the
normal, unscoped behavior.
Parameters
params
any
query
any
user
JWTUser
Returns
Promise<SecretMongo[]>
Inherited from
findById()
findById(
id,query,user):Promise<SecretMongo|null>
Defined in: src/routes/BaseSecretRoute.ts:626
Parameters
id
string
query
any
user
JWTUser
Returns
Promise<SecretMongo | null>
Inherited from
getPasswordConfig()
getPasswordConfig():
Promise<any>
Defined in: src/routes/BaseSecretRoute.ts:436
Returns
Promise<any>
Inherited from
BaseSecretRoute.getPasswordConfig
passkeyRegistrationOptions()
passkeyRegistrationOptions(
req,user):Promise<any>
Defined in: src/routes/BaseSecretRoute.ts:424
Parameters
req
HttpRequest
user
JWTUser
Returns
Promise<any>
Inherited from
BaseSecretRoute.passkeyRegistrationOptions
truncate()
truncate(
params,query,user):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:640
Parameters
params
any
query
any
user
JWTUser
Returns
Promise<void>
Inherited from
update()
update(
id,obj,req,user):Promise<SecretMongo>
Defined in: src/routes/BaseSecretRoute.ts:715
Parameters
id
string
obj
UpdateObject<SecretMongo>
req
HttpRequest
user
JWTUser
Returns
Promise<SecretMongo>
Inherited from
validate()
validate(
objs,options?):Promise<void>
Defined in: node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:225
Calls repoUtils.validate() to validate the object(s) provided.
Parameters
objs
Partial<SecretMongo> | Partial<SecretMongo>[]
options?
CreateRequestOptions | UpdateRequestOptions<SecretMongo>
Returns
Promise<void>
Inherited from
validateCreate()
protectedvalidateCreate(obj,req,user?):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:156
Parameters
obj
Partial<T>
req
HttpRequest
user?
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateCreate
validateRecoveryCodesCreate()
protectedvalidateRecoveryCodesCreate(obj,req):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:365
Generates a fresh batch of MFA recovery/backup codes for the account, discarding any client-supplied
data entirely - unlike a TOTP secret, there's no legitimate reason for a caller to bring their own
codes here; accepting caller-chosen values would let an attacker who can currently write to this
secret pre-plant known codes for later use. Only each code's argon2 hash is persisted (see
RecoveryCodesSecret); the plaintext is stashed on req so sanitizeSecretForResponse() can return
it to the caller exactly once, in the create() response - it can never be retrieved again after
that, since it's never written to the datastore.
Parameters
obj
Partial<T>
The secret being created.
req
HttpRequest
The source HTTP request, used to stash the plaintext codes for the create() response only.
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateRecoveryCodesCreate
validateTOTPCreate()
protectedvalidateTOTPCreate(obj):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:326
Validates (or generates) the secret for a new totp secret per RFC 6238/RFC 4226.
The client may either bring their own Base32-encoded secret (e.g. one generated on a
different server for migration purposes) or, more commonly, omit data entirely and have one
generated here. Either way, the secret's token parameters (digits/period/algorithm) are
captured onto the stored TOTPSecret alongside it, rather than left to always defer to
totpConfig, so verification keeps working for this secret even if the configured defaults
change later.
Parameters
obj
Partial<T>
The secret being created. If data is a string, it's used as the caller-supplied
secret; otherwise a new one is generated.
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateTOTPCreate
validateUpdate()
protectedvalidateUpdate(obj,existing,user):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:644
Parameters
obj
UpdateObject<SecretMongo>
existing
user
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateUpdate
validateWebAuthnCreate()
protectedvalidateWebAuthnCreate(obj,req,config):Promise<void>
Defined in: src/routes/BaseSecretRoute.ts:263
Verifies a client-submitted WebAuthn RegistrationResponseJSON (as produced by
navigator.credentials.create() using the options from generatePasskeyRegistrationOptions()) against
the challenge stored in the session, and replaces obj.data with the resulting StoredPasskeyCredential.
Shared by both passkey and fido2 secrets — the two differ only in relying party configuration
(see passkeyConfig/fido2Config) and which SecretType they're persisted under, not in the
underlying WebAuthn ceremony.
Per the WebAuthn registration ceremony (https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential),
the credential ID must be unique across all accounts known to this relying party. Rather than duplicate that
check here, the credential ID is used directly as this secret's own uid so that ModelRoute's existing
create-time identifier check rejects the request should the ID already be registered to any account. This
also lets a login ceremony, which only has the credential ID to go on, look the secret up directly by its
primary key (see BaseAuthPasskeyRoute/BaseAuthFIDO2Route's getCredentialById/updateCredentialCounter).
Parameters
obj
Partial<T>
The secret being created. Its data property must be a RegistrationResponseJSON.
req
HttpRequest
The source HTTP request, used to retrieve the challenge stored in the session by a prior call to
generatePasskeyRegistrationOptions().
config
The relying party configuration to verify the response against.
Returns
Promise<void>