feat: add role-based authorization

apps/node/.env.example-aws-ec2

@@ -13,6 +13,9 @@ TWIN_HOST="0.0.0.0"
 # TWIN_HTTP_BODY_LIMITS=
 # TWIN_PUBLIC_ORIGIN="https://api.example.com:3000"
 # TWIN_FASTIFY_PLUGIN_TIMEOUT=30000
+## Web server type [fastify, hono, native]
+# TWIN_WEB_SERVER_TYPE="fastify"
+# TWIN_MIME_TYPE_PROCESSORS=
 
 # Global
 
@@ -32,9 +35,6 @@ TWIN_DEBUG=true
 ## Use this for custom extension variables, e.g. TWIN_MY_EXTENSION_SECRET.
 # TWIN_ENV_ALLOW_LIST=""
 
-## Enable the node having a unique ID, defaults to true.
-# TWIN_NODE_IDENTITY_ENABLED="true"
-
 ## Enable multi-tenant support, defaults to false.
 # TWIN_TENANT_ENABLED="true"
 
@@ -52,6 +52,9 @@ TWIN_STORAGE_FILE_ROOT="/home/ec2-user/twin-node/"
 ## The file name of the state file, if this file does not exist it will be created with the bootstrap process
 # TWIN_STATE_FILENAME="engine-state.json"
 
+## Comma separated list of native modules to initialise, defaults to node:buffer,node:crypto,node:zlib
+# TWIN_NATIVE_MODULES="node:buffer,node:crypto,node:zlib"
+
 #----------------------------- Connector Config -----------------------------#
 
 # AWS DynamoDB
@@ -162,6 +165,8 @@ TWIN_IOTA_NETWORK="testnet"
 TWIN_IOTA_COIN_TYPE="4218"
 # TWIN_IOTA_GAS_STATION_ENDPOINT=""
 # TWIN_IOTA_GAS_STATION_AUTH_TOKEN=""
+# TWIN_IOTA_GAS_BUDGET=""
+# TWIN_IOTA_GAS_RESERVATION_DURATION=""
 # TWIN_IOTA_IDENTITY_PACKAGE_ID=""
 
 # Hashicorp Vault Connector
@@ -251,6 +256,12 @@ TWIN_LOGGING_CONNECTOR="console,entity-storage"
 ## Number of rotated log files to retain, defaults to 5. Set to 0 to keep all rotated files.
 # TWIN_LOGGING_FILE_MAX_RETAINED_FILES="5"
 
+## OpenTelemetry runtime settings, used when TWIN_LOGGING_CONNECTOR includes "open-telemetry".
+# TWIN_OPEN_TELEMETRY_LOGGING_LOGGER_NAME="twin-logging"
+# TWIN_OPEN_TELEMETRY_LOGGING_LOGGER_VERSION="1.0.0"
+# TWIN_OPEN_TELEMETRY_LOGGING_PROMETHEUS_ENDPOINT=""
+# TWIN_OPEN_TELEMETRY_LOGGING_PROCESSOR="batch"
+
 # Vault Connector
 
 ## Vault Connector [entity-storage, hashicorp]
@@ -361,6 +372,32 @@ TWIN_TELEMETRY_CONNECTOR="entity-storage"
 # TWIN_OPEN_TELEMETRY_TRACING_ENDPOINT=""
 # TWIN_OPEN_TELEMETRY_TRACING_PROCESSOR="batch"
 
+# Authorization Connector
+
+## Authorization Connector [entity-storage, casbin]
+TWIN_AUTHORIZATION_CONNECTOR="entity-storage"
+
+## The model identifier to use for authorization, defaults to system.
+# TWIN_AUTHORIZATION_MODEL_ID="system"
+
+## Maximum number of cached authorisation check results.
+# TWIN_AUTHORIZATION_CHECK_CACHE_CAPACITY=""
+
+## Time-to-idle in milliseconds for cached authorisation check results.
+# TWIN_AUTHORIZATION_CHECK_CACHE_TTI_MS=""
+
+## Path to a JSON file containing the authorization model (policies and roleInheritances) to seed at startup.
+# TWIN_AUTHORIZATION_MODEL="@json:authorization-model.json"
+
+## How to combine the authorization model with route-derived policies: merge (default) or replace.
+# TWIN_AUTHORIZATION_MODEL_MODE="merge"
+
+# Casbin runtime settings, used when TWIN_AUTHORIZATION_CONNECTOR="casbin".
+# TWIN_CASBIN_ENDPOINT=""
+# TWIN_CASBIN_CLIENT_ID=""
+# TWIN_CASBIN_CLIENT_SECRET=""
+# TWIN_CASBIN_TIMEOUT_MS=""
+
 # Faucet Connector
 
 ## Faucet Connector [entity-storage, iota]
@@ -421,12 +458,9 @@ TWIN_IDENTITY_CONNECTOR="iota"
 TWIN_IDENTITY_PROFILE_CONNECTOR="entity-storage"
 
 ## Comma separated list of public and private profile properties which can only be added, changed or removed
-## by callers with one of the admin scopes. Defaults to none.
+## by callers with escalated privilege. Defaults to none.
 # TWIN_IDENTITY_PROFILE_SELF_UPDATE_DENIED_PROPERTIES=""
 
-## Comma separated list of scopes which allow the self update denied properties to be modified, any one is sufficient.
-# TWIN_IDENTITY_PROFILE_ADMIN_SCOPES="user-admin,global-admin"
-
 # Immutable Proof
 
 ## The assertion method from the identity to use in immutable proof operations
@@ -487,6 +521,12 @@ TWIN_AUTH_PROCESSOR_TYPE="entity-storage"
 ## The HTTP header name used to pass the API key on requests, defaults to x-api-key.
 # TWIN_AUTH_API_KEY_HEADER="x-api-key"
 
+## The minimum password length for new password validation, defaults to 15.
+# TWIN_AUTH_MIN_PASSWORD_LENGTH="15"
+
+## The maximum password length for new password validation, defaults to 128.
+# TWIN_AUTH_MAX_PASSWORD_LENGTH="128"
+
 # Messaging
 
 ## Email protocol connectors, comma-separated [pop3, imap, gmail, outlook], configured by adding mailboxes
@@ -697,6 +737,9 @@ TWIN_DOCUMENT_MANAGEMENT_ENABLED="true"
 ## The maximum dispatches of a background task attempt before it is failed as interrupted, defaults to 3, -1 for no limit.
 # TWIN_BACKGROUND_TASK_MAX_DISPATCH_COUNT=3
 
+## Enable the task scheduler regardless of which other components are active, defaults to false.
+# TWIN_TASK_SCHEDULER_ENABLED="false"
+
 ## Automation
 
 ## The type of automation action to perform, e.g. fetch
@@ -747,6 +790,21 @@ TWIN_DOCUMENT_MANAGEMENT_ENABLED="true"
 ## Comma separated list of modules to load as extensions
 # TWIN_EXTENSIONS=""
 
+## Root cache directory for extension modules, defaults to .tmp
+# TWIN_EXTENSIONS_CACHE_DIRECTORY=".tmp"
+
+## Cache time-to-live in hours for extensions loaded over https, defaults to 24
+# TWIN_EXTENSIONS_CACHE_TTL_HOURS="24"
+
+## Clear the extension cache on startup, defaults to false
+# TWIN_EXTENSIONS_CLEAR_CACHE="false"
+
+## Force a refresh of cached extensions, defaults to false
+# TWIN_EXTENSIONS_FORCE_REFRESH="false"
+
+## Maximum download size in MB for extensions loaded over https, defaults to 10
+# TWIN_EXTENSIONS_MAX_SIZE_MB="10"
+
 # REST Paths - Use the component name e.g. for logging or dataspaceControlPlane, dataspaceDataPlane
 # TWIN_REST_PATH_LOGGING="/foo-logging"
 # TWIN_REST_PATH_DATASPACE_CONTROL_PLANE="/foo-dataspace"

apps/node/.env.example-bootstrap-dev

@@ -38,3 +38,6 @@ TWIN_ADMIN_USER_NAME="admin@node"
 
 # Password for Node admin login, defaults to randomly generated, check logs for the generated password
 TWIN_ADMIN_USER_PASSWORD="yM5?NgPPAio+TmWx"
+
+# Comma separated list of roles for the Node admin user, defaults to global-admin,user-admin,identity-admin,identity-profile-admin,devops (plus tenant-admin when multi-tenant is enabled)
+# TWIN_ADMIN_USER_ROLES=""

apps/node/.env.example-federated-catalogue

@@ -47,6 +47,9 @@ TWIN_HOST="0.0.0.0"
 # TWIN_HTTP_BODY_LIMITS=
 # TWIN_PUBLIC_ORIGIN="https://api.example.com:3000"
 # TWIN_FASTIFY_PLUGIN_TIMEOUT=30000
+## Web server type [fastify, hono, native]
+# TWIN_WEB_SERVER_TYPE="fastify"
+# TWIN_MIME_TYPE_PROCESSORS=
 
 # Global
 
@@ -66,9 +69,6 @@ TWIN_DEBUG=true
 ## Use this for custom extension variables, e.g. TWIN_MY_EXTENSION_SECRET.
 # TWIN_ENV_ALLOW_LIST=""
 
-## Enable the node having a unique ID, defaults to true.
-# TWIN_NODE_IDENTITY_ENABLED="true"
-
 ## Enable multi-tenant support, defaults to false.
 # TWIN_TENANT_ENABLED="true"
 
@@ -86,6 +86,9 @@ TWIN_STORAGE_FILE_ROOT="../../.local-data/twin-node-federated-catalogue/"
 ## The file name of the state file, if this file does not exist it will be created with the bootstrap process
 # TWIN_STATE_FILENAME="engine-state.json"
 
+## Comma separated list of native modules to initialise, defaults to node:buffer,node:crypto,node:zlib
+# TWIN_NATIVE_MODULES="node:buffer,node:crypto,node:zlib"
+
 #----------------------------- Connector Config -----------------------------#
 
 # AWS DynamoDB
@@ -196,6 +199,8 @@ TWIN_STORAGE_FILE_ROOT="../../.local-data/twin-node-federated-catalogue/"
 # TWIN_IOTA_COIN_TYPE="4218"
 # TWIN_IOTA_GAS_STATION_ENDPOINT=""
 # TWIN_IOTA_GAS_STATION_AUTH_TOKEN=""
+# TWIN_IOTA_GAS_BUDGET=""
+# TWIN_IOTA_GAS_RESERVATION_DURATION=""
 # TWIN_IOTA_IDENTITY_PACKAGE_ID=""
 
 # Hashicorp Vault Connector
@@ -273,6 +278,25 @@ TWIN_LOGGING_CONNECTOR="console,entity-storage"
 ## Maximum entries deleted per retention cleanup batch (entity-storage logging), defaults to 1000.
 # TWIN_LOGGING_RETENTION_BATCH_SIZE="1000"
 
+## File logging connector settings (only used when TWIN_LOGGING_CONNECTOR includes "file")
+## Directory to write log files into. Required when using the file logging connector.
+# TWIN_LOGGING_FILE_DIRECTORY="./logs"
+
+## Log filename, defaults to "app.log".
+# TWIN_LOGGING_FILE_FILENAME="app.log"
+
+## Maximum log file size in bytes before rotation, defaults to 10485760 (10 MB). Set to 0 to disable rotation.
+# TWIN_LOGGING_FILE_MAX_FILE_SIZE_BYTES="10485760"
+
+## Number of rotated log files to retain, defaults to 5. Set to 0 to keep all rotated files.
+# TWIN_LOGGING_FILE_MAX_RETAINED_FILES="5"
+
+## OpenTelemetry runtime settings, used when TWIN_LOGGING_CONNECTOR includes "open-telemetry".
+# TWIN_OPEN_TELEMETRY_LOGGING_LOGGER_NAME="twin-logging"
+# TWIN_OPEN_TELEMETRY_LOGGING_LOGGER_VERSION="1.0.0"
+# TWIN_OPEN_TELEMETRY_LOGGING_PROMETHEUS_ENDPOINT=""
+# TWIN_OPEN_TELEMETRY_LOGGING_PROCESSOR="batch"
+
 # Vault Connector
 
 ## Vault Connector [entity-storage, hashicorp]
@@ -383,6 +407,32 @@ TWIN_TELEMETRY_CONNECTOR="entity-storage"
 # TWIN_OPEN_TELEMETRY_TRACING_ENDPOINT=""
 # TWIN_OPEN_TELEMETRY_TRACING_PROCESSOR="batch"
 
+# Authorization Connector
+
+## Authorization Connector [entity-storage, casbin]
+TWIN_AUTHORIZATION_CONNECTOR="entity-storage"
+
+## The model identifier to use for authorization, defaults to system.
+# TWIN_AUTHORIZATION_MODEL_ID="system"
+
+## Maximum number of cached authorisation check results.
+# TWIN_AUTHORIZATION_CHECK_CACHE_CAPACITY=""
+
+## Time-to-idle in milliseconds for cached authorisation check results.
+# TWIN_AUTHORIZATION_CHECK_CACHE_TTI_MS=""
+
+## Path to a JSON file containing the authorization model (policies and roleInheritances) to seed at startup.
+# TWIN_AUTHORIZATION_MODEL="@json:authorization-model.json"
+
+## How to combine the authorization model with route-derived policies: merge (default) or replace.
+# TWIN_AUTHORIZATION_MODEL_MODE="merge"
+
+# Casbin runtime settings, used when TWIN_AUTHORIZATION_CONNECTOR="casbin".
+# TWIN_CASBIN_ENDPOINT=""
+# TWIN_CASBIN_CLIENT_ID=""
+# TWIN_CASBIN_CLIENT_SECRET=""
+# TWIN_CASBIN_TIMEOUT_MS=""
+
 # Faucet Connector
 # Not applicable for a standalone catalogue node.
 
@@ -447,12 +497,9 @@ TWIN_IDENTITY_CONNECTOR="entity-storage"
 TWIN_IDENTITY_PROFILE_CONNECTOR="entity-storage"
 
 ## Comma separated list of public and private profile properties which can only be added, changed or removed
-## by callers with one of the admin scopes. Defaults to none.
+## by callers with escalated privilege. Defaults to none.
 # TWIN_IDENTITY_PROFILE_SELF_UPDATE_DENIED_PROPERTIES=""
 
-## Comma separated list of scopes which allow the self update denied properties to be modified, any one is sufficient.
-# TWIN_IDENTITY_PROFILE_ADMIN_SCOPES="user-admin,global-admin"
-
 # Immutable Proof
 # Not applicable for a standalone catalogue node.
 
@@ -515,6 +562,12 @@ TWIN_AUTH_PROCESSOR_TYPE="entity-storage"
 ## The HTTP header name used to pass the API key on requests, defaults to x-api-key.
 # TWIN_AUTH_API_KEY_HEADER="x-api-key"
 
+## The minimum password length for new password validation, defaults to 15.
+# TWIN_AUTH_MIN_PASSWORD_LENGTH="15"
+
+## The maximum password length for new password validation, defaults to 128.
+# TWIN_AUTH_MAX_PASSWORD_LENGTH="128"
+
 # Messaging
 # Not applicable for a standalone catalogue node.
 
@@ -649,6 +702,9 @@ TWIN_FEDERATED_CATALOGUE_FILTERS="filter-by-metadata"
 ## Required for PULL or PUSH transfers.
 # TWIN_DATASPACE_DATA_PLANE_PATH="dataspace"
 
+## Whether the provider immediately starts a transfer once it has been requested. Defaults to false.
+# TWIN_DATASPACE_AUTO_START_TRANSFERS="false"
+
 ## TTL in milliseconds for caching dataspace agreements in the control plane service.
 # TWIN_DATASPACE_AGREEMENT_CACHE_TTL=""
 
@@ -676,6 +732,15 @@ TWIN_FEDERATED_CATALOGUE_FILTERS="filter-by-metadata"
 ## Interval in milliseconds between orphaned push subscription cleanup scans.
 # TWIN_DATASPACE_PUSH_SUBSCRIPTION_CLEANUP_INTERVAL=""
 
+## How long in seconds a negotiation may sit without progress before it times out.
+# TWIN_DATASPACE_STALLED_NEGOTIATION_TIMEOUT="30"
+
+## How long in seconds a consumer transfer may sit in REQUESTED before it times out.
+# TWIN_DATASPACE_STALLED_TRANSFER_TIMEOUT="30"
+
+## How long in seconds COMPLETED/TERMINATED transfer records are kept before removal, -1 keeps them forever.
+# TWIN_DATASPACE_RETAIN_TERMINAL_TRANSFERS_FOR="2592000"
+
 ## How long in seconds a provider transfer may remain idle before the idle policy marks it as stalled.
 # TWIN_DATASPACE_PROVIDER_TRANSFER_IDLE_TIMEOUT="30"
 
@@ -722,6 +787,9 @@ TWIN_FEDERATED_CATALOGUE_FILTERS="filter-by-metadata"
 ## The maximum dispatches of a background task attempt before it is failed as interrupted, defaults to 3, -1 for no limit.
 # TWIN_BACKGROUND_TASK_MAX_DISPATCH_COUNT=3
 
+## Enable the task scheduler regardless of which other components are active, defaults to false.
+# TWIN_TASK_SCHEDULER_ENABLED="false"
+
 ## Automation
 # Not applicable for a standalone catalogue node.
 
@@ -773,6 +841,21 @@ TWIN_FEDERATED_CATALOGUE_MUTEX_TIMEOUT="30000"
 ## Comma separated list of modules to load as extensions
 # TWIN_EXTENSIONS=""
 
+## Root cache directory for extension modules, defaults to .tmp
+# TWIN_EXTENSIONS_CACHE_DIRECTORY=".tmp"
+
+## Cache time-to-live in hours for extensions loaded over https, defaults to 24
+# TWIN_EXTENSIONS_CACHE_TTL_HOURS="24"
+
+## Clear the extension cache on startup, defaults to false
+# TWIN_EXTENSIONS_CLEAR_CACHE="false"
+
+## Force a refresh of cached extensions, defaults to false
+# TWIN_EXTENSIONS_FORCE_REFRESH="false"
+
+## Maximum download size in MB for extensions loaded over https, defaults to 10
+# TWIN_EXTENSIONS_MAX_SIZE_MB="10"
+
 # REST Paths - Use the component name e.g. for logging or dataspaceControlPlane, dataspaceDataPlane
 # TWIN_REST_PATH_LOGGING="/foo-logging"
 # TWIN_REST_PATH_DATASPACE_CONTROL_PLANE="/foo-dataspace"