@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/README.md

@@ -1,11 +1,110 @@
-# `rbac-http`
+# `@spinajs/rbac-http-admin`
 
-> TODO: description
+Administrative HTTP API for user accounts: listing and editing users, roles, passwords, two-factor
+authentication, bans, login lockouts and live sessions.
 
-## Usage
+Every route sits behind `AuthorizedPolicy` plus a route-level `@Permission` on the `users` resource,
+so an application grants access with ordinary rbac grants:
 
+```js
+grants: {
+  admin: {
+    users: { 'create:any': ['*'], 'read:any': ['*'], 'update:any': ['*'], 'delete:any': ['*'] },
+  },
+}
 ```
-const rbacHttp = require('rbac-http');
 
-// TODO: DEMONSTRATE API
+## Routes
+
+| Method   | Path                                          | Permission  | What it does                                              |
+| -------- | --------------------------------------------- | ----------- | --------------------------------------------------------- |
+| `GET`    | `/users`                                      | `readAny`   | Paginated, filterable, sortable list. `X-Total-Count` header |
+| `GET`    | `/users/roles`                                | `readAny`   | Roles the caller is allowed to assign                     |
+| `GET`    | `/users/:uuid`                                | `readAny`   | One account                                               |
+| `GET`    | `/users/byLogin/:login`                       | `readAny`   | One account, addressed by login                           |
+| `POST`   | `/users`                                      | `createAny` | Create an account ( inactive, temporary password discarded ) |
+| `PATCH`  | `/users/:uuid`                                | `updateAny` | Partial update of login / email / role                    |
+| `DELETE` | `/users/:uuid`                                | `deleteAny` | Soft delete + session revocation                          |
+| `PATCH`  | `/users/:uuid/restore`                        | `deleteAny` | Clear `DeletedAt`                                         |
+| `PATCH`  | `/users/role/add/:login`                      | `updateAny` | Grant a role                                              |
+| `PATCH`  | `/users/role/revoke/:login`                   | `updateAny` | Revoke a role                                             |
+| `GET`    | `/users/profile/:login`                       | `readAny`   | Profile through the configured `UserProfileProvider`      |
+| `PATCH`  | `/users/security/changePassword/:uuid`        | `updateAny` | Set a password. Revokes every session of that user        |
+| `POST`   | `/users/security/password-reset-request/:uuid`| `updateAny` | Issue a reset token and emit `UserPasswordChangeRequest`  |
+| `POST`   | `/users/security/expire-password/:uuid`       | `deleteAny` | Expire the password ( deactivates the account )           |
+| `PATCH`  | `/users/security/reset2fa/:uuid`              | `updateAny` | Clear the TOTP secret                                     |
+| `POST`   | `/users/security/2fa/enable/:uuid`            | `updateAny` | Enrol 2FA, returns the enrolment url                      |
+| `POST`   | `/users/security/2fa/disable/:uuid`           | `updateAny` | Turn 2FA off                                              |
+| `POST`   | `/users/security/activate/:uuid`              | `updateAny` | Activate the account                                      |
+| `POST`   | `/users/security/deactivate/:uuid`            | `deleteAny` | Deactivate + revoke sessions                              |
+| `POST`   | `/users/security/ban/:uuid`                   | `deleteAny` | Ban for `duration` seconds + revoke sessions              |
+| `POST`   | `/users/security/unban/:uuid`                 | `updateAny` | Lift a ban                                                |
+| `POST`   | `/users/security/unlock/:uuid`                | `updateAny` | Clear a login-throttle lockout                            |
+| `GET`    | `/users/security/sessions/:uuid`              | `readAny`   | Live sessions, by opaque handle                           |
+| `DELETE` | `/users/security/sessions/:uuid/:handle`      | `updateAny` | Revoke one session                                        |
+| `DELETE` | `/users/security/sessions/:uuid`              | `updateAny` | Revoke every session of the user                          |
+
+User metadata is NOT managed here — `@spinajs/rbac-http-user` owns `/user/:uuid/metadata`, which
+validates one entry at a time.
+
+## Handing a new account to its owner
+
+`POST /users` creates the account **inactive** and throws the generated temporary password away, so a
+created account cannot be logged into yet. The intended flow is:
+
+1. `POST /users`
+2. `POST /users/security/password-reset-request/:uuid` — the application delivers the token by
+   hooking `UserPasswordChangeRequest`
+3. the user sets their own password through `POST /auth/password/reset`
+4. `POST /users/security/activate/:uuid`
+
+## Role guard
+
+Role changes are the one operation in this API that can grant MORE than the caller holds, so they run
+through a `RoleGuard` service first. Configure it under `rbac.admin.roleGuard`:
+
+```js
+rbac: {
+  admin: {
+    roleGuard: {
+      service: 'DefaultRoleGuard',
+
+      // reject role names not declared in rbac.grants / rbac.roles
+      requireKnownRole: true,
+      // rbac.systemRole is never assignable or revocable over HTTP
+      protectSystemRole: true,
+      // a role whose grants exceed the caller's cannot be handed out
+      preventEscalation: true,
+      // no self-deactivation, self-deletion, self-ban, self-demotion
+      preventSelfLockout: true,
+      // never empty a privileged role of its last active holder
+      preventLastPrivilegedRemoval: true,
+
+      // what counts as "privileged" for the two checks above
+      privilegedResource: 'users',
+      privilegedAction: 'update:any',
+    },
+  },
+}
 ```
+
+Replace the whole policy by registering your own class under the `RoleGuard` base and naming it in
+`service`:
+
+```ts
+@Injectable(RoleGuard)
+export class MyRoleGuard extends RoleGuard { /* ... */ }
+```
+
+## Breaking changes in this release
+
+- `activate`, `deactivate` and the forced logout moved off `GET`. They are now
+  `POST /users/security/activate/:uuid`, `POST /users/security/deactivate/:uuid` and
+  `DELETE /users/security/sessions/:uuid`.
+- `activate` now requires `updateAny` instead of `deleteAny`.
+- `GET /users/:uuid` and `GET /users/byLogin/:login` now require `readAny`. They previously required
+  nothing beyond a valid session — any authenticated account could read any other.
+- `PATCH /users/:uuid` no longer accepts `Metadata`, and its body is validated as a partial update
+  ( `Login`, `Email`, `Role` are all optional, unknown properties are rejected ).
+- Credential-bearing metadata ( password-reset token, 2FA secret, ban and lockout state ) is filtered
+  out of every dehydrated user, in this package and everywhere else.

package/lib/cjs/config/rbac-http-admin.d.ts

@@ -6,6 +6,31 @@ declare const rbacHttpAdmin: {
             views: string[];
         };
     };
+    rbac: {
+        admin: {
+            /**
+             * Guards applied to every admin operation that changes what an account may
+             * do. Defaults are the strict end — see IRoleGuardConfig for what each one
+             * refuses and why. Turn individual checks off here rather than replacing
+             * the service.
+             */
+            roleGuard: {
+                service: string;
+                requireKnownRole: boolean;
+                protectSystemRole: boolean;
+                preventEscalation: boolean;
+                preventSelfLockout: boolean;
+                preventLastPrivilegedRemoval: boolean;
+                /**
+                 * What makes a role "privileged" for the self-lockout and last-holder
+                 * checks. Action uses accesscontrol grant notation, exactly as written
+                 * in `rbac.grants`.
+                 */
+                privilegedResource: string;
+                privilegedAction: string;
+            };
+        };
+    };
 };
 export default rbacHttpAdmin;
 //# sourceMappingURL=rbac-http-admin.d.ts.map

package/lib/cjs/config/rbac-http-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-admin.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,aAAa;;;;;;;;CAQlB,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-admin.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,aAAa;;;;;;;;;;YAWb;;;;;eAKG;;;;;;;;gBAUD;;;;mBAIG;;;;;;CAMV,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/cjs/config/rbac-http-admin.js

@@ -13,6 +13,31 @@ const rbacHttpAdmin = {
             views: [dir('views')],
         },
     },
+    rbac: {
+        admin: {
+            /**
+             * Guards applied to every admin operation that changes what an account may
+             * do. Defaults are the strict end — see IRoleGuardConfig for what each one
+             * refuses and why. Turn individual checks off here rather than replacing
+             * the service.
+             */
+            roleGuard: {
+                service: 'DefaultRoleGuard',
+                requireKnownRole: true,
+                protectSystemRole: true,
+                preventEscalation: true,
+                preventSelfLockout: true,
+                preventLastPrivilegedRemoval: true,
+                /**
+                 * What makes a role "privileged" for the self-lockout and last-holder
+                 * checks. Action uses accesscontrol grant notation, exactly as written
+                 * in `rbac.grants`.
+                 */
+                privilegedResource: 'users',
+                privilegedAction: 'update:any',
+            },
+        },
+    },
 };
 exports.default = rbacHttpAdmin;
 //# sourceMappingURL=rbac-http-admin.js.map

package/lib/cjs/config/rbac-http-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-admin.js","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5K,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACtB;KACF;CACF,CAAC;AAEF,kBAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-admin.js","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5K,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACtB;KACF;IAED,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;;;eAKG;YACH,SAAS,EAAE;gBACT,OAAO,EAAE,kBAAkB;gBAE3B,gBAAgB,EAAE,IAAI;gBACtB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,IAAI;gBACvB,kBAAkB,EAAE,IAAI;gBACxB,4BAA4B,EAAE,IAAI;gBAElC;;;;mBAIG;gBACH,kBAAkB,EAAE,OAAO;gBAC3B,gBAAgB,EAAE,YAAY;aAC/B;SACF;KACF;CACF,CAAC;AAEF,kBAAe,aAAa,CAAC"}

package/lib/cjs/controllers/Users/Profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAI3D;;;;GAIG;AACH,qBAGa,OAAQ,SAAQ,cAAc;IASvC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAE9C;;;;;;;;;;OAUG;IAGU,cAAc,CAAU,KAAK,EAAE,MAAM;CAGrD"}
+{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG3D;;;;GAIG;AACH,qBAGa,OAAQ,SAAQ,cAAc;IAOzC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAE9C;;;;;;;;;;OAUG;IAGU,cAAc,CAAU,KAAK,EAAE,MAAM;CAKnD"}

package/lib/cjs/controllers/Users/Profile.js

@@ -35,7 +35,9 @@ let Profile = class Profile extends http_1.BaseController {
      * @response 404 User not found
      */
     async getUserProfile(login) {
-        return new http_1.Ok(this.ProfileService.retrieve(login));
+        // NOTE: awaited. Handing the pending promise to `Ok` serialized as an
+        // empty object for every client that got JSON back.
+        return new http_1.Ok(await this.ProfileService.retrieve(login));
     }
 };
 exports.Profile = Profile;

package/lib/cjs/controllers/Users/Profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,0DAA2D;AAC3D,wCAAiF;AACjF,wCAA2D;AAC3D,kDAA4E;AAG5E;;;;GAIG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,qBAAc;IAWvC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,KAAa;QAC7C,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;CACJ,CAAA;AA3BY,0BAAO;AASN;IADT,IAAA,iCAAiB,EAAC,mBAAmB,CAAC;8BACb,0BAAmB;+CAAC;AAejC;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACK,WAAA,IAAA,YAAK,GAAE,CAAA;;;;6CAEnC;kBA1BQ,OAAO;IAHnB,IAAA,eAAQ,EAAC,eAAe,CAAC;IACzB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,OAAO,CA2BnB"}
+{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,0DAA2D;AAC3D,wCAAiF;AACjF,wCAA2D;AAC3D,kDAA4E;AAE5E;;;;GAIG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,qBAAc;IASzC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,KAAa;QAChD,sEAAsE;QACtE,oDAAoD;QACpD,OAAO,IAAI,SAAE,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AA3BY,0BAAO;AAOR;IADT,IAAA,iCAAiB,EAAC,mBAAmB,CAAC;8BACb,0BAAmB;+CAAC;AAejC;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACK,WAAA,IAAA,YAAK,GAAE,CAAA;;;;6CAInC;kBA1BU,OAAO;IAHnB,IAAA,eAAQ,EAAC,eAAe,CAAC;IACzB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,OAAO,CA2BnB"}

package/lib/cjs/controllers/Users/Roles.d.ts

@@ -1,38 +1,45 @@
 import { BaseController, Ok } from '@spinajs/http';
-declare class RoleDto {
+import { User } from '@spinajs/rbac';
+import { RoleGuard } from '../../interfaces.js';
+import '../../services/RoleGuard.js';
+export declare class RoleDto {
     role: string;
     constructor(data: Partial<RoleDto>);
 }
 /**
  * User role management (admin).
  * Grants and revokes RBAC roles for user accounts.
+ *
+ * Both routes run the configured {@link RoleGuard} before touching anything: a
+ * role is the one thing in this API that can grant MORE than the caller has, so
+ * "may update users" is not by itself an answer to "may hand out this role".
  * @tags Admin Users
  */
 export declare class Roles extends BaseController {
+    protected RoleGuard: RoleGuard;
     /**
      * Grant role to user (admin)
      * Assigns the specified RBAC role to the user identified by login name.
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role granted successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role grants more than the caller holds
      * @response 404 User not found
      */
-    addRole(login: string, roleDto: RoleDto): Promise<Ok<any>>;
+    addRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
     /**
      * Revoke role from user (admin)
      * Removes the specified RBAC role from the user identified by login name.
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role revoked successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the revocation would lock the caller or the installation out
      * @response 404 User not found
      */
-    revokeRole(login: string, roleDto: RoleDto): Promise<Ok<any>>;
+    revokeRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
 }
-export {};
 //# sourceMappingURL=Roles.d.ts.map

package/lib/cjs/controllers/Users/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,EAAE,EAAwB,MAAM,eAAe,CAAC;AAMzF,cAQM,OAAO;IACF,IAAI,EAAE,MAAM,CAAC;gBAER,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;CAGrC;AAGD;;;;GAIG;AACH,qBAGa,KAAM,SAAQ,cAAc;IACrC;;;;;;;;;;OAUG;IAGU,OAAO,CAAU,KAAK,EAAE,MAAM,EAAU,OAAO,EAAE,OAAO;IAKrE;;;;;;;;;;OAUG;IAGU,UAAU,CAAU,KAAK,EAAE,MAAM,EAAU,OAAO,EAAE,OAAO;CAI3E"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAkB,EAAE,EAAiB,MAAM,eAAe,CAAC;AAElF,OAAO,EAAiB,IAAI,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,6BAA6B,CAAC;AAErC,qBAQa,OAAO;IACX,IAAI,EAAE,MAAM,CAAC;gBAER,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;CAGnC;AAED;;;;;;;;GAQG;AACH,qBAGa,KAAM,SAAQ,cAAc;IAEvC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;OAUG;IAGU,OAAO,CAAgB,KAAK,EAAE,IAAI,EAAkF,IAAI,EAAE,IAAI,EAAU,OAAO,EAAE,OAAO;IAOrK;;;;;;;;;;OAUG;IAGU,UAAU,CAAgB,KAAK,EAAE,IAAI,EAAkF,IAAI,EAAE,IAAI,EAAU,OAAO,EAAE,OAAO;CAMzK"}

package/lib/cjs/controllers/Users/Roles.js

@@ -12,17 +12,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Roles = void 0;
+exports.Roles = exports.RoleDto = void 0;
+const configuration_1 = require("@spinajs/configuration");
 const http_1 = require("@spinajs/http");
+const orm_http_1 = require("@spinajs/orm-http");
 const rbac_1 = require("@spinajs/rbac");
 const rbac_http_1 = require("@spinajs/rbac-http");
 const validation_1 = require("@spinajs/validation");
+const interfaces_js_1 = require("../../interfaces.js");
+// Side effect only — see the note in Users.ts.
+require("../../services/RoleGuard.js");
 let RoleDto = class RoleDto {
     constructor(data) {
         Object.assign(this, data);
     }
 };
-RoleDto = __decorate([
+exports.RoleDto = RoleDto;
+exports.RoleDto = RoleDto = __decorate([
     (0, validation_1.Schema)({
         type: 'object',
         $id: 'arrow.common.roleDTO',
@@ -36,6 +42,10 @@ RoleDto = __decorate([
 /**
  * User role management (admin).
  * Grants and revokes RBAC roles for user accounts.
+ *
+ * Both routes run the configured {@link RoleGuard} before touching anything: a
+ * role is the one thing in this API that can grant MORE than the caller has, so
+ * "may update users" is not by itself an answer to "may hand out this role".
  * @tags Admin Users
  */
 let Roles = class Roles extends http_1.BaseController {
@@ -45,13 +55,14 @@ let Roles = class Roles extends http_1.BaseController {
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role granted successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role grants more than the caller holds
      * @response 404 User not found
      */
-    async addRole(login, roleDto) {
-        await (0, rbac_1.grant)(login, roleDto.role);
+    async addRole(actor, user, roleDto) {
+        await this.RoleGuard.assertCanAssignRoles(actor, user, [roleDto.role]);
+        await (0, rbac_1.grant)(user, roleDto.role);
         return new http_1.Ok();
     }
     /**
@@ -60,33 +71,40 @@ let Roles = class Roles extends http_1.BaseController {
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role revoked successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the revocation would lock the caller or the installation out
      * @response 404 User not found
      */
-    async revokeRole(login, roleDto) {
-        await (0, rbac_1.revoke)(login, roleDto.role);
+    async revokeRole(actor, user, roleDto) {
+        await this.RoleGuard.assertCanRevokeRole(actor, user, roleDto.role);
+        await (0, rbac_1.revoke)(user, roleDto.role);
         return new http_1.Ok();
     }
 };
 exports.Roles = Roles;
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.admin.roleGuard'),
+    __metadata("design:type", interfaces_js_1.RoleGuard)
+], Roles.prototype, "RoleGuard", void 0);
 __decorate([
     (0, http_1.Patch)('add/:login'),
     (0, rbac_http_1.Permission)(['updateAny']),
-    __param(0, (0, http_1.Param)()),
-    __param(1, (0, http_1.Body)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, orm_http_1.FromModel)({ queryField: 'Login', paramField: 'login', include: ['Metadata'] })),
+    __param(2, (0, http_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, RoleDto]),
+    __metadata("design:paramtypes", [rbac_1.User, rbac_1.User, RoleDto]),
     __metadata("design:returntype", Promise)
 ], Roles.prototype, "addRole", null);
 __decorate([
     (0, http_1.Patch)('revoke/:login'),
     (0, rbac_http_1.Permission)(['updateAny']),
-    __param(0, (0, http_1.Param)()),
-    __param(1, (0, http_1.Body)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, orm_http_1.FromModel)({ queryField: 'Login', paramField: 'login', include: ['Metadata'] })),
+    __param(2, (0, http_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, RoleDto]),
+    __metadata("design:paramtypes", [rbac_1.User, rbac_1.User, RoleDto]),
     __metadata("design:returntype", Promise)
 ], Roles.prototype, "revokeRole", null);
 exports.Roles = Roles = __decorate([

package/lib/cjs/controllers/Users/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAyF;AACzF,wCAAqD;AACrD,kDAA4E;AAC5E,oDAA6C;AAG7C,IAQM,OAAO,GARb,MAQM,OAAO;IAGT,YAAY,IAAsB;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;CACJ,CAAA;AANK,OAAO;IARZ,IAAA,mBAAM,EAAC;QACJ,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;SAC1G;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACrB,CAAC;;GACI,OAAO,CAMZ;AAGD;;;;GAIG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,qBAAc;IACrC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAU,KAAa,EAAU,OAAgB;QACjE,MAAM,IAAA,YAAK,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,SAAE,EAAE,CAAA;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAU,KAAa,EAAU,OAAgB;QACpE,MAAM,IAAA,aAAM,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,SAAE,EAAE,CAAA;IACnB,CAAC;CACJ,CAAA;AApCY,sBAAK;AAcD;IAFZ,IAAA,YAAK,EAAC,YAAY,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAA,YAAK,GAAE,CAAA;IAAiB,WAAA,IAAA,WAAI,GAAE,CAAA;;6CAAU,OAAO;;oCAGpE;AAeY;IAFZ,IAAA,YAAK,EAAC,eAAe,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,YAAK,GAAE,CAAA;IAAiB,WAAA,IAAA,WAAI,GAAE,CAAA;;6CAAU,OAAO;;uCAGvE;gBAnCQ,KAAK;IAHjB,IAAA,eAAQ,EAAC,YAAY,CAAC;IACtB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,KAAK,CAoCjB"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,0DAA2D;AAC3D,wCAAkF;AAClF,gDAA8C;AAC9C,wCAAoD;AACpD,kDAAiG;AACjG,oDAA6C;AAE7C,uDAAgD;AAEhD,+CAA+C;AAC/C,uCAAqC;AAU9B,IAAM,OAAO,GAAb,MAAM,OAAO;IAGlB,YAAY,IAAsB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AANY,0BAAO;kBAAP,OAAO;IARnB,IAAA,mBAAM,EAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;SACxG;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB,CAAC;;GACW,OAAO,CAMnB;AAED;;;;;;;;GAQG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,qBAAc;IAIvC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAgB,KAAW,EAAkF,IAAU,EAAU,OAAgB;QACnK,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,IAAA,YAAK,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAAkF,IAAU,EAAU,OAAgB;QACtK,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAA,aAAM,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjC,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA3CY,sBAAK;AAEN;IADT,IAAA,iCAAiB,EAAC,sBAAsB,CAAC;8BACrB,yBAAS;wCAAC;AAelB;IAFZ,IAAA,YAAK,EAAC,YAAY,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAA,gBAAW,GAAE,CAAA;IAAe,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzG,WAAI,EAAwF,WAAI,EAAmB,OAAO;;oCAKpK;AAeY;IAFZ,IAAA,YAAK,EAAC,eAAe,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAW,GAAE,CAAA;IAAe,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzG,WAAI,EAAwF,WAAI,EAAmB,OAAO;;uCAKvK;gBA1CU,KAAK;IAHjB,IAAA,eAAQ,EAAC,YAAY,CAAC;IACtB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,KAAK,CA2CjB"}

package/lib/cjs/controllers/Users/Security.d.ts

@@ -1,22 +1,51 @@
-import { BaseController, Ok } from '@spinajs/http';
+import { BaseController, NotFound, Ok } from '@spinajs/http';
 import { SessionProvider, User } from '@spinajs/rbac';
-declare class ChangePasswordDto {
+import type { ISession } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
+import { RoleGuard } from '../../interfaces.js';
+import '../../services/RoleGuard.js';
+export declare class ChangePasswordDto {
     password: string;
     confirmPassword: string;
     constructor(data: any);
 }
+export declare class BanUserDto {
+    reason?: string;
+    duration?: number;
+    constructor(data: Partial<BanUserDto>);
+}
+/** One live session of a user, as reported to an administrator. */
+export interface IAdminSessionEntry {
+    /**
+     * Opaque handle for the session, NOT the session id — the id is a working
+     * credential and an admin listing must not hand out the means to
+     * impersonate the accounts it lists.
+     */
+    Handle: string;
+    /** ISO instant the session was opened */
+    Created: string;
+    /** ISO instant the session expires, or null when it never does */
+    Expires: string | null;
+}
 /**
  * User account security management (admin).
- * Administrative controls for user account security: password changes, 2FA reset,
- * account activation/deactivation, and forced session logout.
+ * Administrative controls for user account security: passwords, 2FA, account
+ * activation, bans, login lockouts and live sessions.
+ *
+ * Every route that takes an account out of service goes through the configured
+ * {@link RoleGuard} first — an administrator must not be able to lock themselves,
+ * or the installation, out through this API.
  * @tags Admin Users
  */
 export declare class Security extends BaseController {
+    protected Log: Log;
     protected SessionProvider: SessionProvider;
+    protected RoleGuard: RoleGuard;
     /**
      * Change user password (admin)
      * Sets a new password for the specified user. Both password and confirmPassword must match.
-     * Minimum length is 8 characters.
+     * Minimum length is 8 characters. Every session of that user is destroyed — the credential
+     * they were opened with no longer exists.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 Password changed successfully
@@ -26,6 +55,31 @@ export declare class Security extends BaseController {
      * @response 404 User not found
      */
     changeUserPassword(user: User, dto: ChangePasswordDto): Promise<Ok<any>>;
+    /**
+     * Send a password reset link (admin)
+     * Issues a single-use reset token into the user's metadata and emits
+     * `UserPasswordChangeRequest` so the application can deliver it. The token itself is never
+     * returned. This is how a freshly created account is handed over to its owner — the
+     * temporary password generated at creation is deliberately discarded.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Reset token issued
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    requestPasswordReset(user: User): Promise<Ok<any>>;
+    /**
+     * Expire a user password (admin)
+     * Marks the password as expired, which deactivates the account until a new one is set.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Password expired
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
+     * @response 404 User not found
+     */
+    expireUserPassword(actor: User, user: User): Promise<Ok<any>>;
     /**
      * Reset user two-factor authentication (admin)
      * Clears the TOTP secret and disables 2FA for the specified user.
@@ -38,17 +92,42 @@ export declare class Security extends BaseController {
      * @response 404 User not found
      */
     reset2faToken(user: User): Promise<Ok<any>>;
+    /**
+     * Enable two-factor authentication for a user (admin)
+     * Initializes a TOTP secret for the account. Returns whatever the configured
+     * two-factor provider produces for enrolment (an otpauth url for the default provider) —
+     * deliver it to the user over a channel you trust.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 2FA enabled
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    enable2Fa(user: User): Promise<Ok<unknown>>;
+    /**
+     * Disable two-factor authentication for a user (admin)
+     * Removes the TOTP secret and turns the second factor off for the account.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 2FA disabled
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    disable2Fa(user: User): Promise<Ok<any>>;
     /**
      * Deactivate user account (admin)
-     * Marks the user account as inactive, preventing login without deleting the record.
+     * Marks the user account as inactive and destroys its sessions, preventing login without
+     * deleting the record.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 Account deactivated successfully
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
      * @response 404 User not found
      */
-    deactivateUser(user: User): Promise<Ok<any>>;
+    deactivateUser(actor: User, user: User): Promise<Ok<any>>;
     /**
      * Activate user account (admin)
      * Marks a previously deactivated user account as active, restoring login access.
@@ -56,10 +135,71 @@ export declare class Security extends BaseController {
      * @param user User UUID path parameter
      * @response 200 Account activated successfully
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required on users resource
      * @response 404 User not found
      */
     activateUser(user: User): Promise<Ok<any>>;
+    /**
+     * Ban a user (admin)
+     * Bans the account for `duration` seconds (24h when omitted), records the reason, and
+     * destroys every session it holds.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Account banned
+     * @response 400 Account is already banned
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
+     * @response 404 User not found
+     */
+    banUser(actor: User, user: User, dto: BanUserDto): Promise<Ok<any>>;
+    /**
+     * Unban a user (admin)
+     * Clears the ban metadata from the account.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Account unbanned
+     * @response 400 Account is not banned
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    unbanUser(user: User): Promise<Ok<any>>;
+    /**
+     * Clear a login lockout (admin)
+     * Removes the failed-attempt counter and the lockout window opened by the login throttle,
+     * letting the user try again immediately. Without this the only remedy is waiting out
+     * `rbac.password.lockoutTime`.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Lockout cleared
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    unlockUser(user: User): Promise<Ok<any>>;
+    /**
+     * List sessions of a user (admin)
+     * Returns every live session of the account, newest first, identified by an opaque handle.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @returns {IAdminSessionEntry[]} Live sessions of the user
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on users resource
+     * @response 404 User not found
+     */
+    listSessions(user: User): Promise<Ok<IAdminSessionEntry[]>>;
+    /**
+     * Revoke one session of a user (admin)
+     * Ends a single session, addressed by the handle returned from the listing.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @param handle Session handle as returned by `GET /users/security/sessions/:user`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 No such session for this user
+     */
+    revokeSession(user: User, handle: string): Promise<Ok | NotFound>;
     /**
      * Force logout user (admin)
      * Invalidates all active sessions for the specified user, immediately ending any current logins.
@@ -70,7 +210,7 @@ export declare class Security extends BaseController {
      * @response 403 Forbidden — updateAny permission required on users resource
      * @response 404 User not found
      */
-    logoutUser(user: User): Promise<Ok<any>>;
+    logoutUser(user: User): Promise<Ok<null>>;
+    protected toEntry(session: ISession): IAdminSessionEntry;
 }
-export {};
 //# sourceMappingURL=Security.d.ts.map

package/lib/cjs/controllers/Users/Security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAuB,EAAE,EAAiB,MAAM,eAAe,CAAC;AAEvF,OAAO,EAA+C,eAAe,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAMnG,cAwBM,iBAAiB;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;gBAEnB,IAAI,EAAE,GAAG;CAGxB;AAGD;;;;;GAKG;AACH,qBAGa,QAAS,SAAQ,cAAc;IAGxC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAAoC,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,iBAAiB;IAK7G;;;;;;;;;;OAUG;IAGU,aAAa,CAAoC,IAAI,EAAE,IAAI;IAKxE;;;;;;;;;OASG;IAGU,cAAc,CAAoC,IAAI,EAAE,IAAI;IAKzE;;;;;;;;;OASG;IAGU,YAAY,CAAoC,IAAI,EAAE,IAAI;IAKvE;;;;;;;;;OASG;IAGU,UAAU,CAAoC,IAAI,EAAE,IAAI;CAIxE"}
+{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA8B,MAAM,eAAe,CAAC;AACnH,OAAO,EAAmG,eAAe,EAAS,IAAI,EAAwB,MAAM,eAAe,CAAC;AACpL,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,6BAA6B,CAAC;AAErC,qBAwBa,iBAAiB;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;gBAEnB,IAAI,EAAE,GAAG;CAGtB;AAED,qBAQa,UAAU;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;CAGtC;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAEhB,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,qBAGa,QAAS,SAAQ,cAAc;IAE1C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;;OAYG;IAGU,kBAAkB,CAA2D,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,iBAAiB;IAKpI;;;;;;;;;;;;OAYG;IAGU,oBAAoB,CAA2D,IAAI,EAAE,IAAI;IAKtG;;;;;;;;;OASG;IAGU,kBAAkB,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI;IAShI;;;;;;;;;;OAUG;IAGU,aAAa,CAA2D,IAAI,EAAE,IAAI;IAK/F;;;;;;;;;;;OAWG;IAGU,SAAS,CAA2D,IAAI,EAAE,IAAI;IAI3F;;;;;;;;;OASG;IAGU,UAAU,CAA2D,IAAI,EAAE,IAAI;IAK5F;;;;;;;;;;OAUG;IAGU,cAAc,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI;IAO5H;;;;;;;;;OASG;IAGU,YAAY,CAA2D,IAAI,EAAE,IAAI;IAK9F;;;;;;;;;;;OAWG;IAGU,OAAO,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,UAAU;IAO9I;;;;;;;;;;OAUG;IAGU,SAAS,CAA2D,IAAI,EAAE,IAAI;IAK3F;;;;;;;;;;;OAWG;IAGU,UAAU,CAA2D,IAAI,EAAE,IAAI;IAS5F;;;;;;;;;OASG;IAGU,YAAY,CAAoC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAQ3G;;;;;;;;;;OAUG;IAGU,aAAa,CAAoC,IAAI,EAAE,IAAI,EAAW,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC;IAiB1H;;;;;;;;;OASG;IAGU,UAAU,CAAoC,IAAI,EAAE,IAAI;IAQrE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB;CAOzD"}