@camstack/server 1.2.594 → 1.2.595

package/dist/api/core/auth-sessions.procedures.js

@@ -1,32 +1,36 @@
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { DEVICE_REFRESH_REFUSAL_PREFIX } from '@camstack/types';
-import { userManagementInternal } from '../../auth/hub-sessions.js';
-import { SessionRefreshRefusedError, SessionUserGoneError, } from '../../auth/session-mint.js';
-import { adminProcedure, protectedProcedure, } from '../trpc/trpc.middleware.js';
-import { trpcUserError } from '../trpc/user-error.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshResultSchema = exports.LoginSessionSchema = void 0;
+exports.createSessionProcedures = createSessionProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const types_1 = require("@camstack/types");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const session_mint_js_1 = require("../../auth/session-mint.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const user_error_js_1 = require("../trpc/user-error.js");
 /** One login session as the UI lists it. */
-export const LoginSessionSchema = z.object({
-    id: z.string(),
-    userId: z.string(),
-    method: z.string(),
-    refreshable: z.boolean(),
-    createdAt: z.number(),
-    lastUsedAt: z.number(),
-    expiresAt: z.number(),
-    client: z.string().nullable(),
-    ip: z.string().nullable(),
+exports.LoginSessionSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    userId: zod_1.z.string(),
+    method: zod_1.z.string(),
+    refreshable: zod_1.z.boolean(),
+    createdAt: zod_1.z.number(),
+    lastUsedAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number(),
+    client: zod_1.z.string().nullable(),
+    ip: zod_1.z.string().nullable(),
     /** The session this request was made with. */
-    current: z.boolean(),
+    current: zod_1.z.boolean(),
 });
 /** What a refresh returns: a new access token and the rotated refresh token. */
-export const RefreshResultSchema = z.object({
-    token: z.string(),
-    refreshToken: z.string(),
-    expiresAt: z.number(),
-    sessionId: z.string(),
-    sessionExpiresAt: z.number(),
-    user: z.object({ id: z.string(), username: z.string(), isAdmin: z.boolean() }),
+exports.RefreshResultSchema = zod_1.z.object({
+    token: zod_1.z.string(),
+    refreshToken: zod_1.z.string(),
+    expiresAt: zod_1.z.number(),
+    sessionId: zod_1.z.string(),
+    sessionExpiresAt: zod_1.z.number(),
+    user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
 });
 /** Refresh refusals caused by the device credential behind the session, as wire reasons. */
 const DEVICE_REFRESH_REASONS = {
@@ -36,9 +40,9 @@ const DEVICE_REFRESH_REASONS = {
     'credential-unavailable': 'unavailable',
 };
 function requireSessions(registry) {
-    const internal = registry === null ? null : userManagementInternal(registry);
+    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
     if (internal === null) {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'PRECONDITION_FAILED',
             message: 'Login sessions are not available',
         });
@@ -48,10 +52,10 @@ function requireSessions(registry) {
 /** Real user sessions only — a scoped or share token has no login session to manage. */
 function assertLoginSession(user) {
     if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
-        throw trpcUserError('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }
-export function createSessionProcedures(deps) {
+function createSessionProcedures(deps) {
     const list = (userId, currentId) => {
         const sessions = requireSessions(deps.registry);
         const rows = userId === null ? sessions.listActive() : sessions.listForUser(userId);
@@ -76,8 +80,8 @@ export function createSessionProcedures(deps) {
          * the session. Any refusal is a 401: the client signs in again.
          */
         refreshSession: deps.credentialProcedure
-            .input(z.object({ refreshToken: z.string().min(1).max(512) }))
-            .output(RefreshResultSchema)
+            .input(zod_1.z.object({ refreshToken: zod_1.z.string().min(1).max(512) }))
+            .output(exports.RefreshResultSchema)
             .mutation(async ({ input }) => {
             try {
                 const minted = await deps.minter.refresh(input.refreshToken);
@@ -85,7 +89,7 @@ export function createSessionProcedures(deps) {
                     minted.sessionId === undefined ||
                     minted.expiresAt === undefined ||
                     minted.sessionExpiresAt === undefined) {
-                    throw new SessionRefreshRefusedError('unknown');
+                    throw new session_mint_js_1.SessionRefreshRefusedError('unknown');
                 }
                 return {
                     token: minted.token,
@@ -97,19 +101,19 @@ export function createSessionProcedures(deps) {
                 };
             }
             catch (error) {
-                if (error instanceof SessionRefreshRefusedError) {
+                if (error instanceof session_mint_js_1.SessionRefreshRefusedError) {
                     // A session opened by a device certificate says WHY, in a typed
                     // message the app switches on (`deviceRefusalFromMessage`).
                     const credentialReason = DEVICE_REFRESH_REASONS[error.reason];
-                    throw new TRPCError({
+                    throw new server_1.TRPCError({
                         code: 'UNAUTHORIZED',
                         message: credentialReason === undefined
                             ? 'Session expired — sign in again'
-                            : `${DEVICE_REFRESH_REFUSAL_PREFIX}${credentialReason}`,
+                            : `${types_1.DEVICE_REFRESH_REFUSAL_PREFIX}${credentialReason}`,
                     });
                 }
-                if (error instanceof SessionUserGoneError) {
-                    throw new TRPCError({
+                if (error instanceof session_mint_js_1.SessionUserGoneError) {
+                    throw new server_1.TRPCError({
                         code: 'UNAUTHORIZED',
                         message: 'Session expired — sign in again',
                     });
@@ -122,9 +126,9 @@ export function createSessionProcedures(deps) {
          * stop working at once). `everywhere: true` ends every session of the
          * user, and their pre-session tokens.
          */
-        logout: protectedProcedure
-            .input(z.object({ everywhere: z.boolean().optional() }).optional())
-            .output(z.object({ success: z.literal(true), revoked: z.number() }))
+        logout: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ everywhere: zod_1.z.boolean().optional() }).optional())
+            .output(zod_1.z.object({ success: zod_1.z.literal(true), revoked: zod_1.z.number() }))
             .mutation(async ({ ctx, input }) => {
             assertLoginSession(ctx.user);
             const sessions = requireSessions(deps.registry);
@@ -139,17 +143,17 @@ export function createSessionProcedures(deps) {
             return { success: true, revoked: revoked ? 1 : 0 };
         }),
         /** The caller's live sessions, newest first; `current` marks this one. */
-        listOwnSessions: protectedProcedure
-            .input(z.void())
-            .output(z.array(LoginSessionSchema))
+        listOwnSessions: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(exports.LoginSessionSchema))
             .query(({ ctx }) => {
             assertLoginSession(ctx.user);
             return list(ctx.user.id, ctx.user.sessionId);
         }),
         /** End one of the caller's own sessions (another device). */
-        revokeOwnSession: protectedProcedure
-            .input(z.object({ id: z.string().min(1) }))
-            .output(z.object({ success: z.boolean() }))
+        revokeOwnSession: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ ctx, input }) => {
             assertLoginSession(ctx.user);
             const sessions = requireSessions(deps.registry);
@@ -160,14 +164,14 @@ export function createSessionProcedures(deps) {
             return { success: await sessions.revoke(input.id, 'revoked-by-user') };
         }),
         /** ADMIN — live sessions of one user, or of everyone. */
-        listSessions: adminProcedure
-            .input(z.object({ userId: z.string().min(1).optional() }).optional())
-            .output(z.array(LoginSessionSchema))
+        listSessions: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ userId: zod_1.z.string().min(1).optional() }).optional())
+            .output(zod_1.z.array(exports.LoginSessionSchema))
             .query(({ ctx, input }) => list(input?.userId ?? null, ctx.user.sessionId)),
         /** ADMIN — end one session, or every session of a user. */
-        revokeSessions: adminProcedure
-            .input(z.union([z.object({ id: z.string().min(1) }), z.object({ userId: z.string().min(1) })]))
-            .output(z.object({ revoked: z.number() }))
+        revokeSessions: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.union([zod_1.z.object({ id: zod_1.z.string().min(1) }), zod_1.z.object({ userId: zod_1.z.string().min(1) })]))
+            .output(zod_1.z.object({ revoked: zod_1.z.number() }))
             .mutation(async ({ input }) => {
             const sessions = requireSessions(deps.registry);
             if ('id' in input) {