Skip to content

feat: add reauthentication OTP contract & account security permissions #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Lambdius merged 1 commit into from
Oct 29, 2026
Merged

feat: add reauthentication OTP contract & account security permissions #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"description": "Shared Kafka/gRPC contracts and common enums between MonadIAM services",
"author": "Daniil Egorov (https://github.com/Lambdius)",
"license": "UNLICENSED",
"version": "3.1.5",
"version": "3.1.6",
"types": "dist/index.d.ts",
"main": "dist/index.js",
"exports": {
Expand Down
22 changes: 22 additions & 0 deletions src/datasets/demo/access-control/permission.dataset.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2617,6 +2617,28 @@ const dataset = [
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000003-0002-4000-8000-200000000006",
code: "account.deactivate",
name: "Deactivate Own Account",
description: "Voluntarily deactivate the current account.",
realm_id: "00000001-0000-4000-8000-100000000001",
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000003-0003-4000-8000-200000000003",
code: "reauthentication.confirm_otp",
name: "Confirm Reauthentication by Email",
description: "Confirm reauthentication using a verified email when no password or second factor is configured.",
realm_id: "00000001-0000-4000-8000-100000000001",
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
];

export const Permissions = {
Expand Down
92 changes: 92 additions & 0 deletions src/datasets/demo/access-control/role-permission-assignment.dataset.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21614,6 +21614,50 @@ const dataset = [
updated_at: null,
version: 1,
},
{
id: "00000004-0005-4000-8000-100000000003",
role_id: "00000002-0000-4000-8000-100000000002",
permission_id: "00000003-0003-4000-8000-200000000003",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.REALM,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0005-4000-8000-100000000004",
role_id: "00000002-0000-4000-8000-100000000002",
permission_id: "00000003-0002-4000-8000-200000000006",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.REALM,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0015-4000-8000-200000000003",
role_id: "00000002-0000-4000-8000-100000000003",
permission_id: "00000003-0003-4000-8000-200000000003",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.GLOBAL,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0014-4000-8000-200000000006",
role_id: "00000002-0000-4000-8000-100000000003",
permission_id: "00000003-0002-4000-8000-200000000006",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.GLOBAL,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
];

const redis = [
Expand Down Expand Up @@ -44910,6 +44954,54 @@ const redis = [
updated_at: null,
version: 1,
},
{
id: "00000004-0005-4000-8000-100000000003",
role_id: "00000002-0000-4000-8000-100000000002",
permission_id: "00000003-0003-4000-8000-200000000003",
permission_realm_id: "00000001-0000-4000-8000-100000000001",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.REALM,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0005-4000-8000-100000000004",
role_id: "00000002-0000-4000-8000-100000000002",
permission_id: "00000003-0002-4000-8000-200000000006",
permission_realm_id: "00000001-0000-4000-8000-100000000001",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.REALM,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0015-4000-8000-200000000003",
role_id: "00000002-0000-4000-8000-100000000003",
permission_id: "00000003-0003-4000-8000-200000000003",
permission_realm_id: "00000001-0000-4000-8000-100000000001",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.GLOBAL,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
{
id: "00000004-0014-4000-8000-200000000006",
role_id: "00000002-0000-4000-8000-100000000003",
permission_id: "00000003-0002-4000-8000-200000000006",
permission_realm_id: "00000001-0000-4000-8000-100000000001",
realm_id: "00000001-0000-4000-8000-100000000001",
scope: AssignmentScope.GLOBAL,
is_system_managed: true,
is_revoked: false,
created_at: new Date("2026-01-01T00:00:00.000Z"),
version: 1,
},
];

export const RolePermissionAssignments = {
Expand Down
12 changes: 12 additions & 0 deletions src/datasets/system/access-control/permission.dataset.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,6 +450,12 @@ const dataset = [
"Restore Account",
"Restore a suspended account.",
),
entry(
"00000003-0002-4000-8000-200000000006",
PermissionCode.ACCOUNT_DEACTIVATE,
"Deactivate Own Account",
"Voluntarily deactivate the current account.",
),

// Reauthentication
entry(
Expand All @@ -464,6 +470,12 @@ const dataset = [
"Confirm Reauthentication by Second Factor",
"Confirm reauthentication using a second factor.",
),
entry(
"00000003-0003-4000-8000-200000000003",
PermissionCode.REAUTHENTICATION_CONFIRM_OTP,
"Confirm Reauthentication by Email",
"Confirm reauthentication using a verified email when no password or second factor is configured.",
),

// Identifier
entry(
Expand Down
7 changes: 7 additions & 0 deletions src/datasets/system/access-control/role-permission-assignment.dataset.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,9 +103,11 @@ const ACCOUNT_READ_COMMON = "00000003-0002-4000-8000-200000000002";
const ACCOUNT_READ_ABSOLUTE = "00000003-0002-4000-8000-200000000003";
const ACCOUNT_SUSPEND = "00000003-0002-4000-8000-200000000004";
const ACCOUNT_RESTORE = "00000003-0002-4000-8000-200000000005";
const ACCOUNT_DEACTIVATE = "00000003-0002-4000-8000-200000000006";

const REAUTHENTICATION_CONFIRM_PASSWORD = "00000003-0003-4000-8000-200000000001";
const REAUTHENTICATION_CONFIRM_SECOND_FACTOR = "00000003-0003-4000-8000-200000000002";
const REAUTHENTICATION_CONFIRM_OTP = "00000003-0003-4000-8000-200000000003";

const IDENTIFIER_READ_PERSONAL = "00000003-0004-4000-8000-200000000001";
const IDENTIFIER_READ_ABSOLUTE = "00000003-0004-4000-8000-200000000002";
Expand Down Expand Up @@ -257,6 +259,9 @@ const dataset = [
entry("00000004-0004-4000-8000-100000000002", SYSTEM_USER_ROLE_ID, MEMBERSHIP_HISTORY_READ_PERSONAL),
entry("00000004-0004-4000-8000-100000000003", SYSTEM_USER_ROLE_ID, MEMBERSHIP_LEAVE),

entry("00000004-0005-4000-8000-100000000003", SYSTEM_USER_ROLE_ID, REAUTHENTICATION_CONFIRM_OTP),
entry("00000004-0005-4000-8000-100000000004", SYSTEM_USER_ROLE_ID, ACCOUNT_DEACTIVATE),

entry("00000004-0005-4000-8000-100000000001", SYSTEM_USER_ROLE_ID, REAUTHENTICATION_CONFIRM_PASSWORD),
entry("00000004-0005-4000-8000-100000000002", SYSTEM_USER_ROLE_ID, REAUTHENTICATION_CONFIRM_SECOND_FACTOR),

Expand Down Expand Up @@ -400,9 +405,11 @@ const dataset = [
entry("00000004-0014-4000-8000-200000000003", ADMINISTRATOR_ROLE_ID, ACCOUNT_READ_ABSOLUTE, AssignmentScope.GLOBAL),
entry("00000004-0014-4000-8000-200000000004", ADMINISTRATOR_ROLE_ID, ACCOUNT_SUSPEND, AssignmentScope.GLOBAL),
entry("00000004-0014-4000-8000-200000000005", ADMINISTRATOR_ROLE_ID, ACCOUNT_RESTORE, AssignmentScope.GLOBAL),
entry("00000004-0014-4000-8000-200000000006", ADMINISTRATOR_ROLE_ID, ACCOUNT_DEACTIVATE, AssignmentScope.GLOBAL),

entry("00000004-0015-4000-8000-200000000001", ADMINISTRATOR_ROLE_ID, REAUTHENTICATION_CONFIRM_PASSWORD, AssignmentScope.GLOBAL),
entry("00000004-0015-4000-8000-200000000002", ADMINISTRATOR_ROLE_ID, REAUTHENTICATION_CONFIRM_SECOND_FACTOR, AssignmentScope.GLOBAL),
entry("00000004-0015-4000-8000-200000000003", ADMINISTRATOR_ROLE_ID, REAUTHENTICATION_CONFIRM_OTP, AssignmentScope.GLOBAL),

entry("00000004-0016-4000-8000-200000000001", ADMINISTRATOR_ROLE_ID, IDENTIFIER_READ_PERSONAL, AssignmentScope.GLOBAL),
entry("00000004-0016-4000-8000-200000000002", ADMINISTRATOR_ROLE_ID, IDENTIFIER_READ_ABSOLUTE, AssignmentScope.GLOBAL),
Expand Down
3 changes: 3 additions & 0 deletions src/enums.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,7 @@ export enum MessageTemplate {
// identity: OTP delivery
IDENTIFIER_VERIFICATION_OTP = "IDENTIFIER_VERIFICATION_OTP",
ACCOUNT_VERIFICATION_OTP = "ACCOUNT_VERIFICATION_OTP",
REAUTHENTICATION_OTP = "REAUTHENTICATION_OTP",
RESET_PASSWORD_OTP = "RESET_PASSWORD_OTP",
LOGIN_OTP = "LOGIN_OTP",

Expand Down Expand Up @@ -341,9 +342,11 @@ export enum PermissionCode {
ACCOUNT_READ_ABSOLUTE = "account.read_absolute",
ACCOUNT_SUSPEND = "account.suspend",
ACCOUNT_RESTORE = "account.restore",
ACCOUNT_DEACTIVATE = "account.deactivate",

REAUTHENTICATION_CONFIRM_PASSWORD = "reauthentication.confirm_password",
REAUTHENTICATION_CONFIRM_SECOND_FACTOR = "reauthentication.confirm_second_factor",
REAUTHENTICATION_CONFIRM_OTP = "reauthentication.confirm_otp",

IDENTIFIER_READ_PERSONAL = "identifier.read_personal",
IDENTIFIER_READ_ABSOLUTE = "identifier.read_absolute",
Expand Down
2 changes: 2 additions & 0 deletions src/kafka/notification.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@
"ACCOUNT_VERIFICATION_OTP",
"RESET_PASSWORD_OTP",
"LOGIN_OTP",
"REAUTHENTICATION_OTP",
"ASSIGNMENT_GRANTED",
"ASSIGNMENT_REVOKED",
"REALM_EXCLUDED",
Expand Down Expand Up @@ -256,6 +257,7 @@
"ACCOUNT_VERIFICATION_OTP",
"RESET_PASSWORD_OTP",
"LOGIN_OTP",
"REAUTHENTICATION_OTP",
"ASSIGNMENT_GRANTED",
"ASSIGNMENT_REVOKED",
"REALM_EXCLUDED",
Expand Down
Loading