@absolutejs/auth 0.48.4 → 0.48.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +2 -1
- package/dist/index.js.map +3 -3
- package/dist/session/impersonation.d.ts +1 -0
- package/dist/types.d.ts +8 -1
- package/package.json +1 -1
package/dist/types.d.ts
CHANGED
|
@@ -39,10 +39,17 @@ export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
|
|
|
39
39
|
/** Stamped on a session created via admin impersonation (`startImpersonation`). RFC 8693
|
|
40
40
|
* actor semantics: `actorId`/`actorEmail` are the admin acting as the user, `reason` is
|
|
41
41
|
* required and audited, `returnToSessionId` is the admin's own session to restore on exit.
|
|
42
|
-
* Surfaced by userStatus so your UI can show an "impersonating" banner.
|
|
42
|
+
* Surfaced by userStatus so your UI can show an "impersonating" banner.
|
|
43
|
+
*
|
|
44
|
+
* `readOnly` is the RFC 8693 §6 "down-scope the delegated session" lever, surfaced for the
|
|
45
|
+
* app to enforce: when true this is a GHOST/observe-only session — the app should reject
|
|
46
|
+
* writes (and suppress side-effects) so an admin can watch a member's account without
|
|
47
|
+
* disturbing them. The package only CARRIES the flag (it can't know your routes); enforce
|
|
48
|
+
* it in your own request guard. Absent/false = full-access acting session. */
|
|
43
49
|
export type Impersonator = {
|
|
44
50
|
actorEmail?: string;
|
|
45
51
|
actorId: string;
|
|
52
|
+
readOnly?: boolean;
|
|
46
53
|
reason: string;
|
|
47
54
|
returnToSessionId?: UserSessionId;
|
|
48
55
|
startedAt: number;
|
package/package.json
CHANGED