@absolutejs/auth 0.48.3 → 0.48.5

package/dist/routes/userStatus.d.ts

@@ -34,6 +34,7 @@ export declare const userStatus: <UserType>({ authSessionStore, statusRoute, onS
             response: {
                 400: "Cookies are missing";
                 200: {
+                    impersonator: import("..").Impersonator | undefined;
                     user: NonNullable<UserType> | null;
                 };
                 422: {

package/dist/session/access.d.ts

@@ -19,8 +19,10 @@ export declare const getStatusFromSource: <UserType>({ authSessionStore, session
         readonly message: "Cookies are missing";
     };
     user: null;
+    impersonator?: undefined;
 } | {
     error: null;
+    impersonator: import("..").Impersonator | undefined;
     user: NonNullable<UserType> | null;
 }>;
 export declare const loadSessionFromSource: <UserType>({ authSessionStore, session, userSessionId, removeExpired }: {

package/dist/session/impersonation.d.ts

@@ -13,7 +13,8 @@ export declare const endImpersonation: <UserType>({ authSessionStore, cookie, co
     restored: boolean;
 }>;
 export declare const isImpersonating: <UserType>(session: SessionData<UserType> | undefined) => boolean;
-export declare const startImpersonation: <UserType>({ authSessionStore, cookie, cookieSecure, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
+export declare const startImpersonation: <UserType>({ allowNested, authSessionStore, cookie, cookieSecure, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
+    allowNested?: boolean;
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
     cookieSecure?: boolean;
@@ -22,6 +23,7 @@ export declare const startImpersonation: <UserType>({ authSessionStore, cookie,
     impersonator: {
         actorEmail?: string;
         actorId: string;
+        readOnly?: boolean;
         reason: string;
     };
     inMemorySession: SessionRecord<UserType>;

package/dist/types.d.ts

@@ -39,10 +39,17 @@ export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
 /** Stamped on a session created via admin impersonation (`startImpersonation`). RFC 8693
  *  actor semantics: `actorId`/`actorEmail` are the admin acting as the user, `reason` is
  *  required and audited, `returnToSessionId` is the admin's own session to restore on exit.
- *  Surfaced by userStatus so your UI can show an "impersonating" banner. */
+ *  Surfaced by userStatus so your UI can show an "impersonating" banner.
+ *
+ *  `readOnly` is the RFC 8693 §6 "down-scope the delegated session" lever, surfaced for the
+ *  app to enforce: when true this is a GHOST/observe-only session — the app should reject
+ *  writes (and suppress side-effects) so an admin can watch a member's account without
+ *  disturbing them. The package only CARRIES the flag (it can't know your routes); enforce
+ *  it in your own request guard. Absent/false = full-access acting session. */
 export type Impersonator = {
     actorEmail?: string;
     actorId: string;
+    readOnly?: boolean;
     reason: string;
     returnToSessionId?: UserSessionId;
     startedAt: number;
@@ -177,7 +184,8 @@ export type OnRevocationError = (({ error, authProvider }: {
     authClient?: string;
     error: unknown;
 }) => void | Promise<void>) | undefined;
-export type OnStatus<UserType> = (({ user }: {
+export type OnStatus<UserType> = (({ impersonator, user }: {
+    impersonator?: Impersonator;
     user: UserType | null;
 }) => void | Promise<void>) | undefined;
 export type OnSignOut<UserType> = (({ authProvider, userSessionId, session }: {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.48.3",
+	"version": "0.48.5",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {