@absolutejs/auth 0.48.4 → 0.48.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +4 -2
- package/dist/index.js.map +3 -3
- package/dist/session/impersonation.d.ts +2 -0
- package/dist/types.d.ts +15 -1
- package/package.json +1 -1
|
@@ -23,7 +23,9 @@ export declare const startImpersonation: <UserType>({ allowNested, authSessionSt
|
|
|
23
23
|
impersonator: {
|
|
24
24
|
actorEmail?: string;
|
|
25
25
|
actorId: string;
|
|
26
|
+
readOnly?: boolean;
|
|
26
27
|
reason: string;
|
|
28
|
+
suppressSideEffects?: boolean;
|
|
27
29
|
};
|
|
28
30
|
inMemorySession: SessionRecord<UserType>;
|
|
29
31
|
sessionDurationMs?: number;
|
package/dist/types.d.ts
CHANGED
|
@@ -39,13 +39,27 @@ export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
|
|
|
39
39
|
/** Stamped on a session created via admin impersonation (`startImpersonation`). RFC 8693
|
|
40
40
|
* actor semantics: `actorId`/`actorEmail` are the admin acting as the user, `reason` is
|
|
41
41
|
* required and audited, `returnToSessionId` is the admin's own session to restore on exit.
|
|
42
|
-
* Surfaced by userStatus so your UI can show an "impersonating" banner.
|
|
42
|
+
* Surfaced by userStatus so your UI can show an "impersonating" banner.
|
|
43
|
+
*
|
|
44
|
+
* `readOnly` is the RFC 8693 §6 "down-scope the delegated session" lever, surfaced for the
|
|
45
|
+
* app to enforce: when true this is a GHOST/observe-only session — the app should reject
|
|
46
|
+
* writes (and suppress side-effects) so an admin can watch a member's account without
|
|
47
|
+
* disturbing them. The package only CARRIES the flag (it can't know your routes); enforce
|
|
48
|
+
* it in your own request guard. Absent/false = full-access acting session. */
|
|
43
49
|
export type Impersonator = {
|
|
44
50
|
actorEmail?: string;
|
|
45
51
|
actorId: string;
|
|
52
|
+
readOnly?: boolean;
|
|
46
53
|
reason: string;
|
|
47
54
|
returnToSessionId?: UserSessionId;
|
|
48
55
|
startedAt: number;
|
|
56
|
+
/** Sandbox lever, surfaced for the app to enforce: when true, the app should
|
|
57
|
+
* suppress outbound side-effects (emails / SMS / push / notifications)
|
|
58
|
+
* triggered while acting as the member — so an admin can run a flow and watch
|
|
59
|
+
* the behavior WITHOUT the member or their partners being contacted. Like
|
|
60
|
+
* `readOnly`, the package only carries it; enforce it at your emitters.
|
|
61
|
+
* Independent of `readOnly` (a session can act AND suppress = "sandbox"). */
|
|
62
|
+
suppressSideEffects?: boolean;
|
|
49
63
|
};
|
|
50
64
|
export type SessionData<UserType> = {
|
|
51
65
|
/** Snapshot of your user, serialized into the session at login and handed to
|
package/package.json
CHANGED