@absolutejs/auth 0.48.3 → 0.48.5

package/dist/index.js

@@ -3148,6 +3148,7 @@ var getStatusFromSource = async ({
   }
   return {
     error: null,
+    impersonator: userSession?.impersonator,
     user: userSession?.user ?? null
   };
 };
@@ -8827,7 +8828,7 @@ var userStatus = ({
   statusRoute = "/oauth2/status",
   onStatus
 }) => new Elysia28().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
-  const { user, error } = await getStatusFromSource({
+  const { user, impersonator, error } = await getStatusFromSource({
     authSessionStore,
     session,
     user_session_id
@@ -8836,11 +8837,11 @@ var userStatus = ({
     return status(error.code, error.message);
   }
   try {
-    await onStatus?.({ user });
+    await onStatus?.({ impersonator, user });
   } catch (err) {
     return err instanceof Error ? status("Internal Server Error", `Error: ${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Unknown Error: ${String(err)}`);
   }
-  return { user };
+  return { impersonator, user };
 }, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/scim/routes.ts
@@ -22365,6 +22366,18 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
+var restoreCookieTo = (cookie, target, cookieSecure) => {
+  if (target === undefined) {
+    cookie.remove();
+    return;
+  }
+  cookie.set({
+    httpOnly: true,
+    sameSite: "lax",
+    secure: resolveCookieSecure(cookieSecure),
+    value: target
+  });
+};
 var endImpersonation = async ({
   authSessionStore,
   cookie,
@@ -22382,6 +22395,8 @@ var endImpersonation = async ({
     userSessionId: currentId
   });
   const impersonator = current?.impersonator;
+  if (impersonator === undefined)
+    return { restored: false };
   if (authSessionStore)
     await authSessionStore.removeSession(currentId);
   else
@@ -22411,6 +22426,7 @@ var endImpersonation = async ({
 };
 var isImpersonating = (session) => session?.impersonator !== undefined;
 var startImpersonation = async ({
+  allowNested = false,
   authSessionStore,
   cookie,
   cookieSecure,
@@ -22421,11 +22437,24 @@ var startImpersonation = async ({
   sessionDurationMs = DEFAULT_IMPERSONATION_TTL_MS,
   user
 }) => {
+  const callerSessionId = cookie.value;
+  if (!allowNested && callerSessionId !== undefined) {
+    const caller = await loadSessionFromSource({
+      authSessionStore,
+      removeExpired: false,
+      session: inMemorySession,
+      userSessionId: callerSessionId
+    });
+    if (isImpersonating(caller)) {
+      throw new Error("startImpersonation: caller session is already impersonating; nested impersonation is disabled (pass allowNested to override)");
+    }
+  }
   const stamp = {
     actorEmail: impersonator.actorEmail,
     actorId: impersonator.actorId,
+    readOnly: impersonator.readOnly,
     reason: impersonator.reason,
-    returnToSessionId: cookie.value,
+    returnToSessionId: callerSessionId,
     startedAt: Date.now()
   };
   const sessionId = await promoteToSession({
@@ -22437,12 +22466,21 @@ var startImpersonation = async ({
     sessionDurationMs,
     user
   });
-  await emit?.({
-    at: Date.now(),
-    metadata: { actorId: stamp.actorId, reason: stamp.reason },
-    type: "impersonation_started",
-    userId: getUserId?.(user)
-  });
+  try {
+    await emit?.({
+      at: Date.now(),
+      metadata: { actorId: stamp.actorId, reason: stamp.reason },
+      type: "impersonation_started",
+      userId: getUserId?.(user)
+    });
+  } catch (auditError) {
+    if (authSessionStore)
+      await authSessionStore.removeSession(sessionId);
+    else
+      delete inMemorySession[sessionId];
+    restoreCookieTo(cookie, stamp.returnToSessionId, cookieSecure);
+    throw auditError;
+  }
   return sessionId;
 };
 // src/session/anonymous.ts
@@ -27586,5 +27624,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=DCFE29575482C4FF64756E2164756E21
+//# debugId=4AE8923415556A3664756E2164756E21
 //# sourceMappingURL=index.js.map