@absolutejs/auth 0.27.0-beta.1 → 0.27.0-beta.3

package/dist/mfa/rotation.d.ts

@@ -0,0 +1,17 @@
+import type { MFAStore } from './types';
+export type MfaKeyRotationResult = {
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+};
+export declare const rotateMfaEncryptionKey: ({ mfaStore, newKey, oldKey }: {
+    mfaStore: MFAStore;
+    newKey: string;
+    oldKey: string;
+}) => Promise<{
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+}>;

package/dist/mfa/types.d.ts

@@ -10,6 +10,7 @@ export type MfaEnrollment = {
 };
 export type MFAStore = {
     getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
+    listEnrollments: () => Promise<MfaEnrollment[]>;
     removeEnrollment: (userId: string) => Promise<void>;
     saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
 };

package/dist/session/impersonation.d.ts

@@ -0,0 +1,29 @@
+import type { Cookie } from 'elysia';
+import type { AuditEvent } from '../audit/types';
+import type { SessionData, SessionRecord, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+type Emit = (event: AuditEvent) => Promise<void> | void;
+export declare const endImpersonation: <UserType>({ authSessionStore, cookie, emit, inMemorySession }: {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    emit?: Emit;
+    inMemorySession: SessionRecord<UserType>;
+}) => Promise<{
+    restored: boolean;
+}>;
+export declare const isImpersonating: <UserType>(session: SessionData<UserType> | undefined) => boolean;
+export declare const startImpersonation: <UserType>({ authSessionStore, cookie, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    emit?: Emit;
+    getUserId?: (user: UserType) => string;
+    impersonator: {
+        actorEmail?: string;
+        actorId: string;
+        reason: string;
+    };
+    inMemorySession: SessionRecord<UserType>;
+    sessionDurationMs?: number;
+    user: UserType;
+}) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export {};

package/dist/session/promote.d.ts

@@ -11,10 +11,11 @@ export declare const persistWhen: (shouldPersist: boolean, persist: () => Promis
 type PromoteToSessionProps<UserType> = {
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
+    impersonator?: SessionData<UserType>['impersonator'];
     inMemorySession: SessionRecord<UserType>;
     samlLogout?: SessionData<UserType>['samlLogout'];
     sessionDurationMs: number;
     user: UserType;
 };
-export declare const promoteToSession: <UserType>({ authSessionStore, cookie, inMemorySession, samlLogout, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export declare const promoteToSession: <UserType>({ authSessionStore, cookie, impersonator, inMemorySession, samlLogout, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
 export {};

package/dist/types.d.ts

@@ -34,6 +34,17 @@ export type OAuth2ConfigurationOptions = {
     [Provider in ProviderOption]?: OAuth2ProviderConfiguration<Provider>;
 };
 export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
+/** Stamped on a session created via admin impersonation (`startImpersonation`). RFC 8693
+ *  actor semantics: `actorId`/`actorEmail` are the admin acting as the user, `reason` is
+ *  required and audited, `returnToSessionId` is the admin's own session to restore on exit.
+ *  Surfaced by userStatus so your UI can show an "impersonating" banner. */
+export type Impersonator = {
+    actorEmail?: string;
+    actorId: string;
+    reason: string;
+    returnToSessionId?: UserSessionId;
+    startedAt: number;
+};
 export type SessionData<UserType> = {
     user: UserType;
     /** OAuth provider access token. Optional: credential / SSO sessions are not backed
@@ -53,6 +64,8 @@ export type SessionData<UserType> = {
         nameId: string;
         sessionIndex?: string;
     };
+    /** Present only when this session was created via admin impersonation. */
+    impersonator?: Impersonator;
 };
 export type SessionRecord<UserType> = Record<UserSessionId, SessionData<UserType>>;
 export type UnregisteredSessionData = {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.27.0-beta.1",
+	"version": "0.27.0-beta.3",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {