@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/lib/cjs/controllers/Users/Users.js

@@ -12,23 +12,49 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Users = void 0;
+exports.Users = exports.UpdateUserDto = exports.CreateUserDto = void 0;
 const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
 const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
 const orm_1 = require("@spinajs/orm");
 const orm_http_1 = require("@spinajs/orm-http");
 const rbac_1 = require("@spinajs/rbac");
 const rbac_http_1 = require("@spinajs/rbac-http");
 const validation_1 = require("@spinajs/validation");
-let UserDto = class UserDto {
+const interfaces_js_1 = require("../../interfaces.js");
+// Side effect only: registers DefaultRoleGuard under the RoleGuard base so
+// `rbac.admin.roleGuard.service` has something to resolve to. The type import
+// above is erased at compile time, and controllers are loaded by path rather
+// than through the package index, so without this the guard is missing in
+// exactly the deployments that never import the package themselves.
+require("../../services/RoleGuard.js");
+/**
+ * Columns a client may sort by.
+ *
+ * `OrderDTO.column` is a free-form string and reaches the query builder as an
+ * identifier. The compiler escapes it, so this is not an injection hole — but an
+ * unknown column produced a driver error and a 500 where the request was simply
+ * wrong. Whitelisting turns that into a 400 and keeps the sortable surface a
+ * deliberate decision rather than "whatever columns the table happens to have".
+ */
+const SORTABLE_COLUMNS = ['Uuid', 'Login', 'Email', 'Role', 'IsActive', 'CreatedAt', 'LastLoginAt', 'DeletedAt'];
+/**
+ * Upper bound on `pagination.limit`. An admin list endpoint with no ceiling is
+ * a table dump one query string away.
+ */
+const MAX_PAGE_SIZE = 100;
+const DEFAULT_PAGE_SIZE = 10;
+let CreateUserDto = class CreateUserDto {
     constructor(data) {
         Object.assign(this, data);
     }
 };
-UserDto = __decorate([
+exports.CreateUserDto = CreateUserDto;
+exports.CreateUserDto = CreateUserDto = __decorate([
     (0, validation_1.Schema)({
         type: 'object',
-        $id: 'arrow.common.userDto',
+        $id: 'arrow.common.createUserDto',
         properties: {
             Login: { type: 'string', minLength: 3, maxLength: 32, description: 'Unique login name (3–32 characters)' },
             Email: { type: 'string', format: 'email', description: 'Unique email address' },
@@ -36,10 +62,6 @@ UserDto = __decorate([
             Metadata: {
                 type: 'object',
                 $id: 'arrow.common.userMetadata',
-                properties: {
-                    Key: { type: 'string', minLength: 1, maxLength: 64, description: 'Metadata key' },
-                    Value: { type: 'string', minLength: 0, maxLength: 256, description: 'Metadata value' },
-                },
                 additionalProperties: true,
                 description: 'Optional key-value metadata to attach to the user account',
             },
@@ -47,7 +69,36 @@ UserDto = __decorate([
         required: ['Login', 'Email', 'Role'],
     }),
     __metadata("design:paramtypes", [Object])
-], UserDto);
+], CreateUserDto);
+/**
+ * PATCH body. Separate from {@link CreateUserDto} because the two have opposite
+ * requirements: creation needs all three fields, an update needs none of them.
+ * Sharing one schema made every documented partial update fail validation with
+ * a 400 before the handler ever ran.
+ *
+ * Metadata is deliberately absent — it is managed through the dedicated
+ * `/user/:uuid/metadata` routes, which validate one entry at a time and can
+ * refuse the keys that decide account access.
+ */
+let UpdateUserDto = class UpdateUserDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+exports.UpdateUserDto = UpdateUserDto;
+exports.UpdateUserDto = UpdateUserDto = __decorate([
+    (0, validation_1.Schema)({
+        type: 'object',
+        $id: 'arrow.common.updateUserDto',
+        properties: {
+            Login: { type: 'string', minLength: 3, maxLength: 32, description: 'Unique login name (3–32 characters)' },
+            Email: { type: 'string', format: 'email', description: 'Unique email address' },
+            Role: { type: 'string', minLength: 1, maxLength: 32, description: 'RBAC role to assign to the user' },
+        },
+        additionalProperties: false,
+    }),
+    __metadata("design:paramtypes", [Object])
+], UpdateUserDto);
 /**
  * User model filter
  * We declare it here to not include orm-http in rbac module
@@ -84,15 +135,15 @@ const USER_FILTER = [
     },
     {
         column: 'Role',
-        operators: ['eq', 'neq']
+        operators: ['eq', 'neq'],
     },
     {
         column: 'user:niceName',
         operators: ['eq', 'neq', 'like', 'b-like', 'e-like'],
         query: (operator, value) => {
             return function () {
-                this.whereExist("Metadata", function () {
-                    this.where('Key', "user:niceName");
+                this.whereExist('Metadata', function () {
+                    this.where('Key', 'user:niceName');
                     // NOTE: `operator` is the filter operator coming from the request
                     // ( eq / neq / like ... ), NOT an SQL one. It has to be translated
                     // before it reaches the query builder, which only understands SQL
@@ -116,8 +167,8 @@ const USER_FILTER = [
                     }
                 });
             };
-        }
-    }
+        },
+    },
 ];
 /**
  * User account management (admin).
@@ -136,32 +187,40 @@ let Users = class Users extends http_1.BaseController {
      * user:niceName metadata (eq, neq, like).
      * @security cookieAuth
      * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of users per page (default: 10)
-     * @param order.column Column to sort by (default: CreatedAt)
+     * @param pagination.limit Number of users per page (default: 10, max: 100)
+     * @param order.column Column to sort by (default: CreatedAt). One of Uuid, Login, Email, Role, IsActive, CreatedAt, LastLoginAt, DeletedAt
      * @param order.order Sort direction: ASC or DESC (default: DESC)
      * @param include Relations to include — currently supports: Metadata
      * @returns {IUserData[]} Paginated list of user accounts, each with optional Metadata relation
+     * @response 400 Sort column is not sortable
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — readAny permission required on users resource
      */
     async list(pagination, order, include, filter) {
+        // ONE limit for both take and skip. They used to disagree — take fell back
+        // to 10 while skip fell back to 0 — so any request that sent a page but no
+        // limit silently got page 0 whatever it asked for.
+        const limit = Math.min(pagination?.limit || DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+        const column = this.sortColumn(order);
         const result = await rbac_1.User.select()
-            .leftJoin("Metadata", function () {
+            .leftJoin('Metadata', function () {
             // TODO: allow to inject custom meta props that need to be selected
             // eg. user:niceName, user:avatar etc.
             // this is used for filtering / sorting by custom meta props
             this.where('Key', 'user:niceName');
         }, function () {
-            this.select('Value', "user:niceName");
+            this.select('Value', 'user:niceName');
         })
             .populate(include ?? [])
-            .take(pagination?.limit ?? 10)
-            .skip((pagination?.limit ?? 0) * (pagination?.page ?? 0))
-            .order(order?.column ?? 'CreatedAt', order?.order ?? orm_1.SortOrder.DESC)
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
+            .order(column, order?.order ?? orm_1.SortOrder.DESC)
             .filter(filter?.filters ?? [], filter?.op, USER_FILTER);
-        const count = await rbac_1.User.query().filter(filter?.filters ?? [], filter?.op, USER_FILTER).selectCount();
+        const count = await rbac_1.User.query()
+            .filter(filter?.filters ?? [], filter?.op, USER_FILTER)
+            .selectCount();
         return new http_1.Ok(result.map((x) => x.dehydrateWithRelations({
-            dateTimeFormat: "iso"
+            dateTimeFormat: 'iso',
         })), {
             Headers: [
                 {
@@ -171,6 +230,19 @@ let Users = class Users extends http_1.BaseController {
             ],
         });
     }
+    /**
+     * List assignable roles (admin)
+     * Returns the roles the calling administrator is allowed to grant, as decided by the
+     * configured role guard — the system role and anything granting more than the caller
+     * holds are left out, so a UI cannot offer an operation the guard will refuse.
+     * @security cookieAuth
+     * @returns {string[]} Role names the caller may assign
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on users resource
+     */
+    async assignableRoles(actor) {
+        return new http_1.Ok(this.RoleGuard.assignableRoles(actor));
+    }
     /**
      * Get user by UUID (admin)
      * Retrieves a single user record by UUID. Supports optional inclusion of related Metadata.
@@ -205,16 +277,21 @@ let Users = class Users extends http_1.BaseController {
     }
     /**
      * Create user (admin)
-     * Creates a new user account with a system-generated temporary password.
-     * The temporary password is not returned — it should be delivered to the user via email or other channel.
+     * Creates a new user account with a system-generated temporary password. The account is
+     * created inactive and the temporary password is never returned — issue a reset link with
+     * `POST /users/security/password-reset-request/:user` and activate the account once the
+     * user has set their own password.
      * @security cookieAuth
      * @returns {IUserData} Created user account
-     * @response 400 Validation error — missing required fields or invalid format
+     * @response 400 Validation error — missing required fields, invalid format, unknown role or a protected metadata key
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — createAny permission required on users resource
+     * @response 403 Forbidden — createAny permission required, or the requested role grants more than the caller holds
      * @response 409 Login or email already in use
      */
-    async addUser(data) {
+    async addUser(actor, data) {
+        await this.RoleGuard.assertCanAssignRoles(actor, null, [data.Role]);
+        this.assertNoProtectedMetadata(data.Metadata);
+        await this.assertUnique(data.Login, data.Email);
         const temporaryPassword = this.PasswordProvider.generate();
         const { User: created } = await (0, rbac_1.create)(data.Email, data.Login, temporaryPassword, [data.Role], undefined, data.Metadata);
         // NOTE: create() returns { User, Password } where Password is the plaintext
@@ -225,58 +302,158 @@ let Users = class Users extends http_1.BaseController {
     /**
      * Update user (admin)
      * Partially updates a user account. All fields are optional — only provided fields are changed.
-     * Metadata is merged: existing keys are updated, new keys are added, unlisted keys are preserved.
+     * Metadata is NOT handled here; use the `/user/:uuid/metadata` routes.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 User updated successfully
-     * @response 400 Validation error — invalid field format
+     * @response 400 Validation error — invalid field format or unknown role
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role change is refused by the role guard
      * @response 404 User not found
      * @response 409 Login or email already in use by another account
      */
-    async updateUser(user, data) {
+    async updateUser(actor, user, data) {
+        if (data.Role) {
+            const next = [data.Role];
+            const added = next.filter((r) => !user.Role.includes(r));
+            const removed = user.Role.filter((r) => !next.includes(r));
+            // A role list REPLACEMENT is a grant and a revoke at the same time, and
+            // both halves have their own rules — dropping the caller's last privileged
+            // role through PATCH must fail exactly as `revoke` does.
+            await this.RoleGuard.assertCanAssignRoles(actor, user, added);
+            for (const role of removed) {
+                await this.RoleGuard.assertCanRevokeRole(actor, user, role);
+            }
+        }
+        if ((data.Login && data.Login !== user.Login) || (data.Email && data.Email !== user.Email)) {
+            await this.assertUnique(data.Login !== user.Login ? data.Login : undefined, data.Email !== user.Email ? data.Email : undefined, user.Id);
+        }
         user.Login = data.Login ?? user.Login;
         user.Email = data.Email ?? user.Email;
-        // TODO
-        // fix array assign 
         user.Role = data.Role ? [data.Role] : user.Role;
-        if (data.Metadata) {
-            for (const key in data.Metadata) {
-                user.Metadata[key] = data.Metadata[key];
-            }
-        }
         await user.update();
-        await user.Metadata.update();
         return new http_1.Ok();
     }
-};
-exports.Users = Users;
-__decorate([
-    (0, di_1.Autoinject)(),
-    __metadata("design:type", rbac_1.PasswordProvider
     /**
-     * List users (admin)
-     * Returns a paginated, sortable, filterable list of all users. Supports optional inclusion
-     * of related Metadata. The total user count (matching current filters) is returned in the
-     * X-Total-Count response header.
-     * Filterable fields: Uuid (eq), Email (eq, like), Login (eq, like), CreatedAt, LastLoginAt,
-     * DeletedAt (eq, gte, lte, lt, gt, isnull, notnull), IsActive (eq), Role (eq, neq),
-     * user:niceName metadata (eq, neq, like).
+     * Delete user (admin)
+     * Soft-deletes the account (`DeletedAt` is stamped, the row is kept) and destroys every
+     * session it holds, so a deleted user stops acting immediately rather than when their
+     * cookie happens to expire.
      * @security cookieAuth
-     * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of users per page (default: 10)
-     * @param order.column Column to sort by (default: CreatedAt)
-     * @param order.order Sort direction: ASC or DESC (default: DESC)
-     * @param include Relations to include — currently supports: Metadata
-     * @returns {IUserData[]} Paginated list of user accounts, each with optional Metadata relation
+     * @param user User UUID path parameter
+     * @response 200 User deleted
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — readAny permission required on users resource
+     * @response 403 Forbidden — deleteAny permission required, or the deletion is refused by the role guard
+     * @response 404 User not found
+     */
+    async removeUser(actor, user) {
+        await this.RoleGuard.assertCanDisableAccount(actor, user, 'delete');
+        await (0, rbac_1.deleteUser)(user);
+        return new http_1.Ok();
+    }
+    /**
+     * Restore a deleted user (admin)
+     * Clears `DeletedAt` on a soft-deleted account. The account keeps its previous
+     * `IsActive` state — restoring is not activating.
+     * @security cookieAuth
+     * @param uuid User UUID path parameter
+     * @response 200 User restored
+     * @response 400 User is not deleted
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 404 User not found
+     */
+    async restoreUser(uuid) {
+        // Loaded by hand rather than through @FromModel: every model query filters
+        // soft-deleted rows out by default, so the one row this route exists for is
+        // exactly the row @FromModel can never find.
+        const user = await rbac_1.User.query().withDeleted().where('Uuid', uuid).first();
+        if (!user) {
+            throw new exceptions_1.ResourceNotFound(`User ${uuid} not found`);
+        }
+        if (!user.DeletedAt) {
+            throw new exceptions_1.InvalidArgument(`User ${uuid} is not deleted`);
+        }
+        await (0, rbac_1._user_update)({ DeletedAt: null })(user);
+        return new http_1.Ok();
+    }
+    /**
+     * The requested sort column, or the default. Rejects anything outside
+     * {@link SORTABLE_COLUMNS}.
+     */
+    sortColumn(order) {
+        const column = order?.column;
+        if (!column) {
+            return 'CreatedAt';
+        }
+        if (!SORTABLE_COLUMNS.includes(column)) {
+            throw new exceptions_1.InvalidArgument(`Cannot sort by '${column}'. Sortable columns are: ${SORTABLE_COLUMNS.join(', ')}`);
+        }
+        return column;
+    }
+    /**
+     * Refuses metadata keys that decide account access.
+     *
+     * `user:pwd_reset:token` is a bearer credential for the public reset endpoint
+     * and `user:2fa:*` is the second factor itself — writing either through a
+     * generic key-value merge hands out an account rather than annotating one.
+     * Ban and lockout keys are refused for the same reason bans have their own
+     * route: written directly they skip the event, the email and the session
+     * revocation that make a ban mean something.
+     */
+    assertNoProtectedMetadata(metadata) {
+        if (!metadata) {
+            return;
+        }
+        const offending = Object.keys(metadata).filter((key) => {
+            // A glob reaches the metadata relation's setter as a PATTERN and rewrites
+            // every matching entry, so `*` alone would overwrite the whole set —
+            // including the protected keys listed above.
+            if (key.includes('*') || key.includes('?')) {
+                return true;
+            }
+            return rbac_1.USER_SECURITY_METADATA_KEYS.includes(key);
+        });
+        if (offending.length > 0) {
+            throw new exceptions_1.InvalidArgument(`Metadata keys cannot be set through this endpoint: ${offending.join(', ')}`);
+        }
+    }
+    /**
+     * Rejects a login / email already taken by another account.
+     *
+     * Soft-deleted rows are included on purpose: they still occupy the unique
+     * indexes, so ignoring them would trade this 409 for a driver error and a 500.
      */
-    )
+    async assertUnique(login, email, exceptUserId) {
+        const clashes = [];
+        if (login) {
+            const found = await rbac_1.User.query().withDeleted().where('Login', login).first();
+            if (found && found.Id !== exceptUserId) {
+                clashes.push('Login');
+            }
+        }
+        if (email) {
+            const found = await rbac_1.User.query().withDeleted().where('Email', email).first();
+            if (found && found.Id !== exceptUserId) {
+                clashes.push('Email');
+            }
+        }
+        if (clashes.length > 0) {
+            throw new exceptions_1.ResourceDuplicated(`${clashes.join(' and ')} already in use`);
+        }
+    }
+};
+exports.Users = Users;
+__decorate([
+    (0, di_1.Autoinject)(),
+    __metadata("design:type", rbac_1.PasswordProvider)
 ], Users.prototype, "PasswordProvider", void 0);
 __decorate([
-    (0, http_1.Get)("/"),
+    (0, configuration_1.AutoinjectService)('rbac.admin.roleGuard'),
+    __metadata("design:type", interfaces_js_1.RoleGuard)
+], Users.prototype, "RoleGuard", void 0);
+__decorate([
+    (0, http_1.Get)('/'),
     (0, rbac_http_1.Permission)(['readAny']),
     __param(0, (0, http_1.Query)()),
     __param(1, (0, http_1.Query)()),
@@ -294,8 +471,17 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "list", null);
 __decorate([
-    (0, http_1.Get)(":user"),
-    __param(0, (0, orm_http_1.FromModel)({ queryField: "Uuid" })),
+    (0, http_1.Get)('roles'),
+    (0, rbac_http_1.Permission)(['readAny']),
+    __param(0, (0, rbac_http_1.User)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "assignableRoles", null);
+__decorate([
+    (0, http_1.Get)(':user'),
+    (0, rbac_http_1.Permission)(['readAny']),
+    __param(0, (0, orm_http_1.FromModel)({ queryField: 'Uuid' })),
     __param(1, (0, http_1.Query)({
         type: 'array',
         items: {
@@ -308,8 +494,9 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "getSingleUser", null);
 __decorate([
-    (0, http_1.Get)("byLogin/:user"),
-    __param(0, (0, orm_http_1.FromModel)({ queryField: "Login" })),
+    (0, http_1.Get)('byLogin/:user'),
+    (0, rbac_http_1.Permission)(['readAny']),
+    __param(0, (0, orm_http_1.FromModel)({ queryField: 'Login' })),
     __param(1, (0, http_1.Query)({
         type: 'array',
         items: {
@@ -322,23 +509,41 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "getByLogin", null);
 __decorate([
-    (0, http_1.Post)("/"),
+    (0, http_1.Post)('/'),
     (0, rbac_http_1.Permission)(['createAny']),
-    __param(0, (0, http_1.Body)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserDto]),
+    __metadata("design:paramtypes", [rbac_1.User, CreateUserDto]),
     __metadata("design:returntype", Promise)
 ], Users.prototype, "addUser", null);
 __decorate([
-    (0, http_1.Patch)(":user"),
+    (0, http_1.Patch)(':user'),
     (0, rbac_http_1.Permission)(['updateAny']),
-    __param(0, (0, orm_http_1.FromModel)({ queryField: "Uuid" })),
-    __param(1, (0, http_1.Body)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, orm_http_1.FromModel)({ queryField: 'Uuid', include: ['Metadata'] })),
+    __param(2, (0, http_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [rbac_1.User,
-        UserDto]),
+    __metadata("design:paramtypes", [rbac_1.User, rbac_1.User, UpdateUserDto]),
     __metadata("design:returntype", Promise)
 ], Users.prototype, "updateUser", null);
+__decorate([
+    (0, http_1.Del)(':user'),
+    (0, rbac_http_1.Permission)(['deleteAny']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, orm_http_1.FromModel)({ queryField: 'Uuid', include: ['Metadata'] })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, rbac_1.User]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "removeUser", null);
+__decorate([
+    (0, http_1.Patch)(':uuid/restore'),
+    (0, rbac_http_1.Permission)(['deleteAny']),
+    __param(0, (0, http_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "restoreUser", null);
 exports.Users = Users = __decorate([
     (0, http_1.BasePath)('users'),
     (0, http_1.Policy)(rbac_http_1.AuthorizedPolicy),

package/lib/cjs/controllers/Users/Users.js.map

@@ -1 +1 @@
-{"version":3,"file":"Users.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Users.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAAyC;AACzC,wCAAoG;AACpG,sCAAsD;AACtD,gDAAmI;AACnI,wCAA+D;AAC/D,kDAA4E;AAC5E,oDAA6C;AAE7C,IAoBM,OAAO,GApBb,MAoBM,OAAO;IAOX,YAAY,IAAsB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAVK,OAAO;IApBZ,IAAA,mBAAM,EAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,2BAA2B;gBAChC,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACjF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE;iBACvF;gBACD,oBAAoB,EAAE,IAAI;gBAC1B,WAAW,EAAE,2DAA2D;aACzE;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;KACrC,CAAC;;GACI,OAAO,CAUZ;AAED;;;;GAIG;AACH,MAAM,WAAW,GAA0B;IACzC;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;KACjE;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACzB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACpD,KAAK,EAAE,CAAC,QAA6B,EAAE,KAAU,EAAE,EAAE;YACnD,OAAO;gBACL,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;oBAEnC,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,QAAQ,QAAQ,EAAE,CAAC;wBACjB,KAAK,IAAI;4BACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;4BAC1C,MAAM;wBACR,KAAK,KAAK;4BACR,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;4BAC3C,MAAM;wBACR,KAAK,MAAM;4BACT,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAA;4BACnD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAA;4BAClD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAA;4BAClD,MAAM;oBAEV,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAA;QACH,CAAC;KACF;CACF,CAAC;AAEF;;;;;GAKG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,qBAAc;IAKvC;;;;;;;;;;;;;;;;;OAiBG;IAGU,AAAN,KAAK,CAAC,IAAI,CACN,UAA0B,EAC1B,KAAgB,EAQzB,OAAkB,EAElB,MAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,WAAI,CAAC,MAAM,EAAE;aAC/B,QAAQ,CAAC,UAAU,EAAE;YAEpB,mEAAmE;YACnE,sCAAsC;YACtC,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAErC,CAAC,EAAE;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;QACvC,CAAC,CAAC;aACD,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;aACvB,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;aAC7B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,WAAW,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC;aACnE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAGtG,OAAO,IAAI,SAAE,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;YACzC,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC,EACH;YACE,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,aAAa,CAAoC,IAAU,EAOxE,OAAkB;QAChB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAqC,IAAU,EAOtE,OAAkB;QAChB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CACV,IAAa;QAGrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzH,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,OAAO,IAAI,SAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAGD;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CACc,IAAU,EACrC,IAAa;QAGrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAEtC,OAAO;QACP,oBAAoB;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAEhD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7B,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;CAGF,CAAA;AAhMY,sBAAK;AAGN;IADT,IAAA,eAAU,GAAE;8BACe,uBAAgB;IAE5C;;;;;;;;;;;;;;;;;OAiBG;;+CAnByC;AAsB/B;IAFZ,IAAA,UAAG,EAAC,GAAG,CAAC;IACR,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,EAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;IAED,WAAA,IAAA,iBAAM,EAAC,WAAW,CAAC,CAAA;;qCAVE,wBAAa;QAClB,mBAAQ;;iCA6C1B;AAcY;IADZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACe,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAAc,WAAA,IAAA,YAAK,EAAC;QAC/E,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCANkE,WAAI;;0CAWvE;AAcY;IADZ,IAAA,UAAG,EAAC,eAAe,CAAC;IACI,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAAc,WAAA,IAAA,YAAK,EAAC;QAC7E,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCANgE,WAAI;;uCAWrE;AAgBY;IAFZ,IAAA,WAAI,EAAC,GAAG,CAAC;IACT,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAEvB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAO,OAAO;;oCAUtB;AAkBY;IAFZ,IAAA,YAAK,EAAC,OAAO,CAAC;IACd,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAEvB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,WAAI,GAAE,CAAA;;qCADkC,WAAI;QAC/B,OAAO;;uCAoBtB;gBA7LU,KAAK;IAHjB,IAAA,eAAQ,EAAC,OAAO,CAAC;IACjB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,KAAK,CAgMjB"}
+{"version":3,"file":"Users.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Users.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAA2D;AAC3D,wCAAgH;AAChH,oDAA4F;AAC5F,sCAAsD;AACtD,gDAAmI;AACnI,wCAAsH;AACtH,kDAAiG;AACjG,oDAA6C;AAE7C,uDAAgD;AAEhD,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,uCAAqC;AAErC;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAEjH;;;GAGG;AACH,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAkBtB,IAAM,aAAa,GAAnB,MAAM,aAAa;IAOxB,YAAY,IAA4B;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAVY,sCAAa;wBAAb,aAAa;IAhBzB,IAAA,mBAAM,EAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,4BAA4B;QACjC,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,2BAA2B;gBAChC,oBAAoB,EAAE,IAAI;gBAC1B,WAAW,EAAE,2DAA2D;aACzE;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;KACrC,CAAC;;GACW,aAAa,CAUzB;AAED;;;;;;;;;GASG;AAWI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKxB,YAAY,IAA4B;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IAVzB,IAAA,mBAAM,EAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,4BAA4B;QACjC,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;SACtG;QACD,oBAAoB,EAAE,KAAK;KAC5B,CAAC;;GACW,aAAa,CAQzB;AAED;;;;GAIG;AACH,MAAM,WAAW,GAA0B;IACzC;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;KACjE;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACzB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACpD,KAAK,EAAE,CAAC,QAA6B,EAAE,KAAU,EAAE,EAAE;YACnD,OAAO;gBACL,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;oBAEnC,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,QAAQ,QAAQ,EAAE,CAAC;wBACjB,KAAK,IAAI;4BACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;4BAC3C,MAAM;wBACR,KAAK,KAAK;4BACR,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;4BAC5C,MAAM;wBACR,KAAK,MAAM;4BACT,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC;4BACpD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;4BACnD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAW,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;4BACnD,MAAM;oBACV,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;;GAKG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,qBAAc;IAOvC;;;;;;;;;;;;;;;;;;OAkBG;IAGU,AAAN,KAAK,CAAC,IAAI,CACN,UAA0B,EAC1B,KAAgB,EAQzB,OAAkB,EAElB,MAAuB;QAEvB,2EAA2E;QAC3E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,WAAI,CAAC,MAAM,EAAE;aAC/B,QAAQ,CACP,UAAU,EACV;YACE,mEAAmE;YACnE,sCAAsC;YACtC,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACrC,CAAC,EACD;YACE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,CAAC,CACF;aACA,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC;aAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,EAAE;aAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC;aACtD,WAAW,EAAE,CAAC;QAEjB,OAAO,IAAI,SAAE,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,sBAAsB,CAAC;YACvB,cAAc,EAAE,KAAK;SACtB,CAAC,CACH,EACD;YACE,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CAAgB,KAAW;QACrD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,aAAa,CACW,IAAU,EAQ7C,OAAkB;QAElB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CACe,IAAU,EAQ9C,OAAkB;QAElB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAgB,KAAW,EAAU,IAAmB;QAC1E,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzH,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,OAAO,IAAI,SAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAA4D,IAAU,EAAU,IAAmB;QACnJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3D,wEAAwE;YACxE,2EAA2E;YAC3E,yDAAyD;YACzD,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE9D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAEhD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEpB,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAA4D,IAAU;QACtH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,IAAA,iBAAU,EAAC,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAU,IAAY;QAC5C,2EAA2E;QAC3E,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,WAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAE1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAe,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAA,mBAAY,EAAC,EAAE,SAAS,EAAE,IAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAErD,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,KAAgB;QACnC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAe,CAAC,mBAAmB,MAAM,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACO,yBAAyB,CAAC,QAAiC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACrD,0EAA0E;YAC1E,qEAAqE;YACrE,6CAA6C;YAC7C,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,kCAA2B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,4BAAe,CAAC,sDAAsD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,KAAc,EAAE,YAAqB;QAChF,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,+BAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF,CAAA;AA7WY,sBAAK;AAEN;IADT,IAAA,eAAU,GAAE;8BACe,uBAAgB;+CAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,sBAAsB,CAAC;8BACrB,yBAAS;wCAAC;AAuBlB;IAFZ,IAAA,UAAG,EAAC,GAAG,CAAC;IACR,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,EAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;IAED,WAAA,IAAA,iBAAM,EAAC,WAAW,CAAC,CAAA;;qCAVE,wBAAa;QAClB,mBAAQ;;iCAwD1B;AAcY;IAFZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACM,WAAA,IAAA,gBAAW,GAAE,CAAA;;qCAAQ,WAAI;;4CAEtD;AAeY;IAFZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,EAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCAPuC,WAAI;;0CAa9C;AAeY;IAFZ,IAAA,UAAG,EAAC,eAAe,CAAC;IACpB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClC,WAAA,IAAA,YAAK,EAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCAPwC,WAAI;;uCAa/C;AAiBY;IAFZ,IAAA,WAAI,EAAC,GAAG,CAAC;IACT,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAA,gBAAW,GAAE,CAAA;IAAe,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAb,WAAI,EAAgB,aAAa;;oCAY3E;AAiBY;IAFZ,IAAA,YAAK,EAAC,OAAO,CAAC;IACd,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAW,GAAE,CAAA;IAAe,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAnF,WAAI,EAAkE,WAAI,EAAgB,aAAa;;uCA2BpJ;AAgBY;IAFZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAW,GAAE,CAAA;IAAe,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;;qCAA/D,WAAI,EAAkE,WAAI;;uCAKvH;AAgBY;IAFZ,IAAA,YAAK,EAAC,eAAe,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,YAAK,GAAE,CAAA;;;;wCAiBhC;gBA/RU,KAAK;IAHjB,IAAA,eAAQ,EAAC,OAAO,CAAC;IACjB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,oBAAQ,EAAC,OAAO,CAAC;GACL,KAAK,CA6WjB"}

package/lib/cjs/index.d.ts

@@ -1,2 +1,7 @@
-export * from "./controllers/Users/Users.js";
+export * from './interfaces.js';
+export * from './services/RoleGuard.js';
+export * from './controllers/Users/Users.js';
+export * from './controllers/Users/Roles.js';
+export * from './controllers/Users/Security.js';
+export * from './controllers/Users/Profile.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AAExC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC"}

package/lib/cjs/index.js

@@ -14,5 +14,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./interfaces.js"), exports);
+__exportStar(require("./services/RoleGuard.js"), exports);
 __exportStar(require("./controllers/Users/Users.js"), exports);
+__exportStar(require("./controllers/Users/Roles.js"), exports);
+__exportStar(require("./controllers/Users/Security.js"), exports);
+__exportStar(require("./controllers/Users/Profile.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+DAA6C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,0DAAwC;AAExC,+DAA6C;AAC7C,+DAA6C;AAC7C,kEAAgD;AAChD,iEAA+C"}

package/lib/cjs/interfaces.d.ts

@@ -0,0 +1,81 @@
+import { User } from '@spinajs/rbac';
+/**
+ * What an administrator is allowed to do to roles and to accounts, read from
+ * `rbac.admin.roleGuard`.
+ *
+ * Every check is switchable because the right answer is deployment-specific: a
+ * single-tenant back office with two trusted operators wants none of this, a
+ * multi-tenant one wants all of it. The shipped defaults are the strict end —
+ * an application that needs less has to say so explicitly.
+ */
+export interface IRoleGuardConfig {
+    /** Registered name of the {@link RoleGuard} implementation to use. */
+    service: string;
+    /** Reject role names that are not declared in `rbac.grants` / `rbac.roles`. */
+    requireKnownRole: boolean;
+    /** Refuse to grant or revoke `rbac.systemRole` over HTTP, whoever is asking. */
+    protectSystemRole: boolean;
+    /**
+     * Refuse to grant a role whose resolved grants are not a subset of the
+     * caller's own. Without this, `updateAny` on `users` is a path to every other
+     * permission in the system — an administrator simply grants themselves more.
+     */
+    preventEscalation: boolean;
+    /**
+     * Refuse operations that would strip the CALLER of their own privileged role
+     * or of their own account ( self-deactivation, self-deletion, self-ban ).
+     */
+    preventSelfLockout: boolean;
+    /**
+     * Refuse operations that would leave zero usable accounts holding a
+     * privileged role — the "locked out of your own installation" case.
+     */
+    preventLastPrivilegedRemoval: boolean;
+    /**
+     * Resource + action that make a role "privileged" for the two guards above.
+     * Action is written in accesscontrol grant notation, as it appears in
+     * `rbac.grants` ( `update:any`, not `updateAny` ).
+     */
+    privilegedResource: string;
+    privilegedAction: string;
+}
+/**
+ * Role and account-state guard for the admin API.
+ *
+ * The checks live here rather than in the controllers because the same rule has
+ * to hold on every path that can change what an account may do: granting a role,
+ * revoking one, rewriting the whole role list through `PATCH /users/:uuid`, and
+ * taking an account out of service. A rule implemented per-controller is a rule
+ * that will be missing from the next controller.
+ *
+ * All methods THROW on refusal ( `Forbidden` / `InvalidArgument`, which the http
+ * error map turns into 403 / 400 ) and return normally when the operation is
+ * allowed.
+ */
+export declare abstract class RoleGuard {
+    /**
+     * May `actor` put `roles` on `target`?
+     *
+     * @param actor - the authenticated administrator making the request
+     * @param target - the account being changed, or null when it does not exist yet ( creation )
+     * @param roles - roles that would be assigned
+     */
+    abstract assertCanAssignRoles(actor: User, target: User | null, roles: string[]): Promise<void>;
+    /**
+     * May `actor` take `role` away from `target`?
+     */
+    abstract assertCanRevokeRole(actor: User, target: User, role: string): Promise<void>;
+    /**
+     * May `actor` take `target` out of service ( deactivate / delete / ban )?
+     */
+    abstract assertCanDisableAccount(actor: User, target: User, action: AccountDisableAction): Promise<void>;
+    /**
+     * Roles `actor` is allowed to hand out, for populating an admin UI. Returning
+     * this rather than the full role list keeps the UI from offering an operation
+     * the guard will refuse.
+     */
+    abstract assignableRoles(actor: User): string[];
+}
+/** Operations that end an account's ability to act. */
+export type AccountDisableAction = 'deactivate' | 'delete' | 'ban';
+//# sourceMappingURL=interfaces.d.ts.map