@crombolo/auth 0.21.0 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/auth",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "OAuth2 authorization server, password hashing, cookies and member tickets for crombolo.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,8 +28,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.21.0",
-    "@crombolo/data": "0.21.0",
+    "@crombolo/core": "0.22.0",
+    "@crombolo/data": "0.22.0",
     "jose": "^6.2.12",
     "uqr": "^0.1.3"
   }

package/src/service.ts

@@ -355,13 +355,21 @@ export class AuthService {
     if (!token || token.revokedAt || token.expiresAt.getTime() < Date.now()) return undefined
     const session = await this.#store.findSession(token.sessionId)
     if (!session) return undefined
-    const user = await this.#store.findUserById(token.userId)
-    if (!user || user.isLockedOut || !user.isApproved) return undefined
+    const identity = await this.identityOf(token.userId)
+    return identity && { ...identity, sessionId: token.sessionId }
+  }
 
+  /**
+   * Who a user is and what they may do now, outside any session: for a
+   * credential that acts for them, such as a preview token. Undefined once they
+   * are locked out or not approved.
+   */
+  async identityOf(userId: number): Promise<Omit<ResolvedIdentity, 'sessionId'> | undefined> {
+    const user = await this.#store.findUserById(userId)
+    if (!user || user.isLockedOut || !user.isApproved) return undefined
     const authorization = await this.#store.loadAuthorization(user.id)
     return {
       user,
-      sessionId: token.sessionId,
       allowedSections: toSectionAliases(authorization.appAliases),
       groupKeys: authorization.groupKeys,
       isAdmin: authorization.isAdmin,