@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/lib/cjs/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAEhB,+EAA+E;IAC/E,gBAAgB,EAAE,OAAO,CAAC;IAE1B,gFAAgF;IAChF,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,4BAA4B,EAAE,OAAO,CAAC;IAEtC;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,8BAAsB,SAAS;IAC7B;;;;;;OAMG;aACa,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtG;;OAEG;aACa,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3F;;OAEG;aACa,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE/G;;;;OAIG;aACa,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE;CACvD;AAED,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,QAAQ,GAAG,KAAK,CAAC"}

package/lib/cjs/interfaces.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGuard = void 0;
+/**
+ * Role and account-state guard for the admin API.
+ *
+ * The checks live here rather than in the controllers because the same rule has
+ * to hold on every path that can change what an account may do: granting a role,
+ * revoking one, rewriting the whole role list through `PATCH /users/:uuid`, and
+ * taking an account out of service. A rule implemented per-controller is a rule
+ * that will be missing from the next controller.
+ *
+ * All methods THROW on refusal ( `Forbidden` / `InvalidArgument`, which the http
+ * error map turns into 403 / 400 ) and return normally when the operation is
+ * allowed.
+ */
+class RoleGuard {
+}
+exports.RoleGuard = RoleGuard;
+//# sourceMappingURL=interfaces.js.map

package/lib/cjs/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAiDA;;;;;;;;;;;;GAYG;AACH,MAAsB,SAAS;CA0B9B;AA1BD,8BA0BC"}

package/lib/cjs/services/RoleGuard.d.ts

@@ -0,0 +1,96 @@
+import { Log } from '@spinajs/log';
+import { AccessControl, User } from '@spinajs/rbac';
+import { AccountDisableAction, IRoleGuardConfig, RoleGuard } from '../interfaces.js';
+/** A resolved grant map: resource -> action -> attribute list. */
+type GrantMap = {
+    [resource: string]: {
+        [action: string]: string[];
+    };
+};
+/**
+ * The shipped {@link RoleGuard}.
+ *
+ * Every check reads its switch from `rbac.admin.roleGuard`, so an application
+ * turns one off in configuration instead of replacing the whole service — and
+ * an application that needs a different rule entirely registers its own class
+ * under {@link RoleGuard} and names it in `rbac.admin.roleGuard.service`.
+ */
+export declare class DefaultRoleGuard extends RoleGuard {
+    protected Log: Log;
+    protected Options: IRoleGuardConfig;
+    protected SystemRole: string;
+    /**
+     * Declared roles, which is NOT the same set as the roles accesscontrol knows
+     * about: a role may be declared for assignment and carry no grants yet.
+     */
+    protected DeclaredRoles: Array<{
+        Name: string;
+    }>;
+    /**
+     * Resolved late, never cached in a field: the container entry is replaced
+     * whenever the rbac bootstrapper runs ( every test case does ), and a guard
+     * holding the stale instance would answer from grants nobody configured.
+     */
+    protected get AC(): AccessControl;
+    assertCanAssignRoles(actor: User, target: User | null, roles: string[]): Promise<void>;
+    assertCanRevokeRole(actor: User, target: User, role: string): Promise<void>;
+    assertCanDisableAccount(actor: User, target: User, action: AccountDisableAction): Promise<void>;
+    assignableRoles(actor: User): string[];
+    /**
+     * A missing actor is a programming error on a route that must be behind
+     * `AuthorizedPolicy` — refused rather than waved through, because every
+     * escalation check below is meaningless without one.
+     */
+    protected assertActor(actor: User): void;
+    protected assertKnownRole(role: string): void;
+    protected assertNotSystemRole(role: string, verb: string): void;
+    protected isSelf(actor: User, target: User): boolean;
+    /**
+     * Throws when `target` is the last account that can still act with `role`.
+     *
+     * Counts accounts that could actually log in — inactive and soft-deleted rows
+     * are not a way back into the installation.
+     */
+    protected assertNotLastHolder(role: string, action: string): Promise<void>;
+    /**
+     * Active accounts holding `role`.
+     *
+     * Counted in the database. This used to narrow with LIKE and finish the job in
+     * memory, because `withRole` compiled to `FIND_IN_SET` — MySQL only — and threw
+     * a driver error on SQLite, turning "is this the last administrator" into a 500
+     * on every deployment that is not MySQL. Set membership is a per-dialect
+     * statement now, so the scope answers everywhere and the workaround is gone.
+     */
+    protected countActiveHolders(role: string): Promise<number>;
+    protected isPrivileged(role: string): boolean;
+    protected rolesWithGrants(): string[];
+    protected allGrants(): GrantMap;
+    /** Grants of one role, with its `$extend` chain resolved. */
+    protected grantsOfRole(role: string): GrantMap;
+    /**
+     * The caller's ceiling: the union of every role they hold.
+     *
+     * Deliberately the union and not the session's active role — an administrator
+     * who can switch to a stronger role could otherwise be blocked from an
+     * operation they can perform by switching first, which teaches people to
+     * switch rather than to stay in the weaker role.
+     */
+    protected grantsOf(actor: User): GrantMap;
+    /**
+     * True when `holder` permits everything `wanted` does.
+     *
+     * Attributes are compared as sets, with `*` covering anything. Negated
+     * attributes ( `!Password` ) are treated as ordinary members: a holder that
+     * lists the same negation still covers, one that does not is reported as not
+     * covering. That errs towards refusing an assignment, which is the safe
+     * direction for a guard.
+     *
+     * `:any` covers the matching `:own`, exactly as accesscontrol resolves them at
+     * enforcement time. Without that an administrator holding `read:any` on users
+     * would be told they cannot hand out a role holding `read:own` — a role
+     * strictly weaker than their own.
+     */
+    protected covers(holder: GrantMap, wanted: GrantMap): boolean;
+}
+export {};
+//# sourceMappingURL=RoleGuard.d.ts.map

package/lib/cjs/services/RoleGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleGuard.d.ts","sourceRoot":"","sources":["../../../src/services/RoleGuard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAiC,MAAM,eAAe,CAAC;AAGnF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAErF,kEAAkE;AAClE,KAAK,QAAQ,GAAG;IAAE,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,qBACa,gBAAiB,SAAQ,SAAS;IAE7C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAGpC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IAEH,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEjD;;;;OAIG;IACH,SAAS,KAAK,EAAE,IAAI,aAAa,CAEhC;IAEY,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BtF,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B3E,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBrG,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE;IAa7C;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI;IAMxC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAY7C,SAAS,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAM/D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO;IAUpD;;;;;OAKG;cACa,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhF;;;;;;;;OAQG;cACa,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO7C,SAAS,CAAC,eAAe,IAAI,MAAM,EAAE;IASrC,SAAS,CAAC,SAAS,IAAI,QAAQ;IAQ/B,6DAA6D;IAC7D,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ;IAI9C;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ;IAKzC;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO;CA2B9D"}

package/lib/cjs/services/RoleGuard.js

@@ -0,0 +1,258 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultRoleGuard = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+const exceptions_1 = require("@spinajs/exceptions");
+const rbac_1 = require("@spinajs/rbac");
+const lodash_1 = __importDefault(require("lodash"));
+const interfaces_js_1 = require("../interfaces.js");
+/**
+ * The shipped {@link RoleGuard}.
+ *
+ * Every check reads its switch from `rbac.admin.roleGuard`, so an application
+ * turns one off in configuration instead of replacing the whole service — and
+ * an application that needs a different rule entirely registers its own class
+ * under {@link RoleGuard} and names it in `rbac.admin.roleGuard.service`.
+ */
+let DefaultRoleGuard = class DefaultRoleGuard extends interfaces_js_1.RoleGuard {
+    /**
+     * Resolved late, never cached in a field: the container entry is replaced
+     * whenever the rbac bootstrapper runs ( every test case does ), and a guard
+     * holding the stale instance would answer from grants nobody configured.
+     */
+    get AC() {
+        return di_1.DI.get('AccessControl');
+    }
+    async assertCanAssignRoles(actor, target, roles) {
+        const wanted = lodash_1.default.uniq((roles ?? []).map((r) => String(r ?? '').trim()).filter((r) => r.length > 0));
+        if (wanted.length === 0) {
+            return;
+        }
+        this.assertActor(actor);
+        for (const role of wanted) {
+            this.assertKnownRole(role);
+            this.assertNotSystemRole(role, 'assigned');
+            if (this.Options?.preventEscalation !== false && !this.covers(this.grantsOf(actor), this.grantsOfRole(role))) {
+                throw new exceptions_1.Forbidden(`Role '${role}' grants more than the caller holds and cannot be assigned`);
+            }
+        }
+        // The guard passed — the assignment itself is the caller's next step. Logged
+        // with the actor because the rbac events carry the TARGET only, so this line
+        // is the one record of who handed out which role.
+        this.Log.info(`Role assignment allowed`, {
+            Actor: actor?.Uuid,
+            Target: target?.Uuid ?? null,
+            Roles: wanted,
+        });
+    }
+    async assertCanRevokeRole(actor, target, role) {
+        const wanted = String(role ?? '').trim();
+        if (wanted.length === 0) {
+            throw new exceptions_1.InvalidArgument('role cannot be empty');
+        }
+        this.assertActor(actor);
+        this.assertKnownRole(wanted);
+        this.assertNotSystemRole(wanted, 'revoked');
+        if (!this.isPrivileged(wanted)) {
+            return;
+        }
+        // Taking a privileged role off YOUR OWN account through the admin API is
+        // almost always a mistake and is never recoverable through the same API —
+        // the request that would put the role back needs the role.
+        if (this.Options?.preventSelfLockout !== false && this.isSelf(actor, target)) {
+            throw new exceptions_1.Forbidden(`Cannot revoke your own '${wanted}' role`);
+        }
+        if (this.Options?.preventLastPrivilegedRemoval !== false && target?.Role?.includes(wanted)) {
+            await this.assertNotLastHolder(wanted, `revoke '${wanted}'`);
+        }
+    }
+    async assertCanDisableAccount(actor, target, action) {
+        this.assertActor(actor);
+        if (this.Options?.preventSelfLockout !== false && this.isSelf(actor, target)) {
+            throw new exceptions_1.Forbidden(`Cannot ${action} your own account`);
+        }
+        if (this.Options?.preventLastPrivilegedRemoval === false) {
+            return;
+        }
+        for (const role of target?.Role ?? []) {
+            if (this.isPrivileged(role)) {
+                await this.assertNotLastHolder(role, action);
+            }
+        }
+    }
+    assignableRoles(actor) {
+        const all = lodash_1.default.uniq([...(this.DeclaredRoles ?? []).map((r) => r?.Name).filter(Boolean), ...this.rolesWithGrants()]);
+        const withoutSystem = this.Options?.protectSystemRole === false ? all : all.filter((r) => r !== this.SystemRole);
+        if (this.Options?.preventEscalation === false) {
+            return withoutSystem;
+        }
+        const actorGrants = this.grantsOf(actor);
+        return withoutSystem.filter((r) => this.covers(actorGrants, this.grantsOfRole(r)));
+    }
+    /**
+     * A missing actor is a programming error on a route that must be behind
+     * `AuthorizedPolicy` — refused rather than waved through, because every
+     * escalation check below is meaningless without one.
+     */
+    assertActor(actor) {
+        if (!actor) {
+            throw new exceptions_1.Forbidden('Role changes require an authenticated caller');
+        }
+    }
+    assertKnownRole(role) {
+        if (this.Options?.requireKnownRole === false) {
+            return;
+        }
+        const known = lodash_1.default.uniq([...(this.DeclaredRoles ?? []).map((r) => r?.Name).filter(Boolean), ...this.rolesWithGrants(), this.SystemRole]);
+        if (!known.includes(role)) {
+            throw new exceptions_1.InvalidArgument(`Role '${role}' is not declared in rbac configuration`);
+        }
+    }
+    assertNotSystemRole(role, verb) {
+        if (this.Options?.protectSystemRole !== false && role === this.SystemRole) {
+            throw new exceptions_1.Forbidden(`The system role cannot be ${verb} through the API`);
+        }
+    }
+    isSelf(actor, target) {
+        if (!actor || !target) {
+            return false;
+        }
+        // Uuid first: an actor resolved from a session and a target loaded by route
+        // parameter are two different model instances of the same row.
+        return (actor.Uuid && actor.Uuid === target.Uuid) || (!!actor.Id && actor.Id === target.Id);
+    }
+    /**
+     * Throws when `target` is the last account that can still act with `role`.
+     *
+     * Counts accounts that could actually log in — inactive and soft-deleted rows
+     * are not a way back into the installation.
+     */
+    async assertNotLastHolder(role, action) {
+        const holders = await this.countActiveHolders(role);
+        // The target itself is one of them ( it is active and holds the role ), so
+        // one holder means the operation empties the role.
+        if (holders <= 1) {
+            throw new exceptions_1.Forbidden(`Cannot ${action}: it would leave no active account holding '${role}'`);
+        }
+    }
+    /**
+     * Active accounts holding `role`.
+     *
+     * Counted in the database. This used to narrow with LIKE and finish the job in
+     * memory, because `withRole` compiled to `FIND_IN_SET` — MySQL only — and threw
+     * a driver error on SQLite, turning "is this the last administrator" into a 500
+     * on every deployment that is not MySQL. Set membership is a per-dialect
+     * statement now, so the scope answers everywhere and the workaround is gone.
+     */
+    async countActiveHolders(role) {
+        return rbac_1.User.query().isActiveUser().withRole([role]).selectCount();
+    }
+    isPrivileged(role) {
+        const resource = this.Options?.privilegedResource ?? 'users';
+        const action = this.Options?.privilegedAction ?? 'update:any';
+        return Boolean(this.grantsOfRole(role)?.[resource]?.[action]);
+    }
+    rolesWithGrants() {
+        try {
+            return this.AC?.getRoles() ?? [];
+        }
+        catch {
+            // accesscontrol throws when no grants were ever set
+            return [];
+        }
+    }
+    allGrants() {
+        try {
+            return (this.AC?.getGrants() ?? {});
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Grants of one role, with its `$extend` chain resolved. */
+    grantsOfRole(role) {
+        return (0, rbac_1._unwindGrants)(role, this.allGrants());
+    }
+    /**
+     * The caller's ceiling: the union of every role they hold.
+     *
+     * Deliberately the union and not the session's active role — an administrator
+     * who can switch to a stronger role could otherwise be blocked from an
+     * operation they can perform by switching first, which teaches people to
+     * switch rather than to stay in the weaker role.
+     */
+    grantsOf(actor) {
+        const grants = this.allGrants();
+        return (0, rbac_1._combineGrants)(...(actor?.Role ?? []).map((r) => (0, rbac_1._unwindGrants)(r, grants)));
+    }
+    /**
+     * True when `holder` permits everything `wanted` does.
+     *
+     * Attributes are compared as sets, with `*` covering anything. Negated
+     * attributes ( `!Password` ) are treated as ordinary members: a holder that
+     * lists the same negation still covers, one that does not is reported as not
+     * covering. That errs towards refusing an assignment, which is the safe
+     * direction for a guard.
+     *
+     * `:any` covers the matching `:own`, exactly as accesscontrol resolves them at
+     * enforcement time. Without that an administrator holding `read:any` on users
+     * would be told they cannot hand out a role holding `read:own` — a role
+     * strictly weaker than their own.
+     */
+    covers(holder, wanted) {
+        for (const [resource, actions] of Object.entries(wanted ?? {})) {
+            const held = holder?.[resource];
+            if (!held) {
+                return false;
+            }
+            for (const [action, attributes] of Object.entries(actions ?? {})) {
+                const heldAttributes = held[action] ?? (action.endsWith(':own') ? held[action.replace(/:own$/, ':any')] : undefined);
+                if (!heldAttributes) {
+                    return false;
+                }
+                if (heldAttributes.includes('*')) {
+                    continue;
+                }
+                if ((attributes ?? []).some((a) => !heldAttributes.includes(a))) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+};
+exports.DefaultRoleGuard = DefaultRoleGuard;
+__decorate([
+    (0, log_1.Logger)('rbac-admin'),
+    __metadata("design:type", log_1.Log)
+], DefaultRoleGuard.prototype, "Log", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.admin.roleGuard'),
+    __metadata("design:type", Object)
+], DefaultRoleGuard.prototype, "Options", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.systemRole', { defaultValue: 'system' }),
+    __metadata("design:type", String)
+], DefaultRoleGuard.prototype, "SystemRole", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.roles', { defaultValue: [] }),
+    __metadata("design:type", Array)
+], DefaultRoleGuard.prototype, "DeclaredRoles", void 0);
+exports.DefaultRoleGuard = DefaultRoleGuard = __decorate([
+    (0, di_1.Injectable)(interfaces_js_1.RoleGuard)
+], DefaultRoleGuard);
+//# sourceMappingURL=RoleGuard.js.map

package/lib/cjs/services/RoleGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleGuard.js","sourceRoot":"","sources":["../../../src/services/RoleGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAA6C;AAC7C,0DAAgD;AAChD,sCAA2C;AAC3C,oDAAiE;AACjE,wCAAmF;AACnF,oDAAuB;AAEvB,oDAAqF;AAKrF;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,yBAAS;IAiB7C;;;;OAIG;IACH,IAAc,EAAE;QACd,OAAO,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,KAAW,EAAE,MAAmB,EAAE,KAAe;QACjF,MAAM,MAAM,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAExB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7G,MAAM,IAAI,sBAAS,CAAC,SAAS,IAAI,4DAA4D,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACvC,KAAK,EAAE,KAAK,EAAE,IAAI;YAClB,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAC5B,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAW,EAAE,MAAY,EAAE,IAAY;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAe,CAAC,sBAAsB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,sBAAS,CAAC,2BAA2B,MAAM,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,4BAA4B,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,KAAW,EAAE,MAAY,EAAE,MAA4B;QAC1F,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,sBAAS,CAAC,UAAU,MAAM,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,4BAA4B,KAAK,KAAK,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,KAAW;QAChC,MAAM,GAAG,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAEnH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjH,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,KAAW;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,sBAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAES,eAAe,CAAC,IAAY;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEtI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAe,CAAC,SAAS,IAAI,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAES,mBAAmB,CAAC,IAAY,EAAE,IAAY;QACtD,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAS,CAAC,6BAA6B,IAAI,kBAAkB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAES,MAAM,CAAC,KAAW,EAAE,MAAY;QACxC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4EAA4E;QAC5E,+DAA+D;QAC/D,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,MAAc;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAS,CAAC,UAAU,MAAM,+CAA+C,IAAI,GAAG,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACO,KAAK,CAAC,kBAAkB,CAAC,IAAY;QAC7C,OAAO,WAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IAES,YAAY,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,IAAI,YAAY,CAAC;QAE9D,OAAO,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAES,eAAe;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAES,SAAS;QACjB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAwB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,6DAA6D;IACnD,YAAY,CAAC,IAAY;QACjC,OAAO,IAAA,oBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAS,CAAa,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACO,QAAQ,CAAC,KAAW;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,IAAA,qBAAc,EAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,CAAC,EAAE,MAAa,CAAC,CAAC,CAAa,CAAC;IACxG,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,MAAM,CAAC,MAAgB,EAAE,MAAgB;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAEhC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YAED,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAErH,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvQY,4CAAgB;AAEjB;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;6CAAC;AAGT;IADT,IAAA,sBAAM,EAAC,sBAAsB,CAAC;;iDACK;AAG1B;IADT,IAAA,sBAAM,EAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;;oDACzB;AAOnB;IADT,IAAA,sBAAM,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,EAA6B,EAAE,CAAC;8BAC7C,KAAK;uDAAmB;2BAftC,gBAAgB;IAD5B,IAAA,eAAU,EAAC,yBAAS,CAAC;GACT,gBAAgB,CAuQ5B"}

package/lib/mjs/config/rbac-http-admin.d.ts

@@ -6,6 +6,31 @@ declare const rbacHttpAdmin: {
             views: string[];
         };
     };
+    rbac: {
+        admin: {
+            /**
+             * Guards applied to every admin operation that changes what an account may
+             * do. Defaults are the strict end — see IRoleGuardConfig for what each one
+             * refuses and why. Turn individual checks off here rather than replacing
+             * the service.
+             */
+            roleGuard: {
+                service: string;
+                requireKnownRole: boolean;
+                protectSystemRole: boolean;
+                preventEscalation: boolean;
+                preventSelfLockout: boolean;
+                preventLastPrivilegedRemoval: boolean;
+                /**
+                 * What makes a role "privileged" for the self-lockout and last-holder
+                 * checks. Action uses accesscontrol grant notation, exactly as written
+                 * in `rbac.grants`.
+                 */
+                privilegedResource: string;
+                privilegedAction: string;
+            };
+        };
+    };
 };
 export default rbacHttpAdmin;
 //# sourceMappingURL=rbac-http-admin.d.ts.map

package/lib/mjs/config/rbac-http-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-admin.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,aAAa;;;;;;;;CAQlB,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-admin.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,aAAa;;;;;;;;;;YAWb;;;;;eAKG;;;;;;;;gBAUD;;;;mBAIG;;;;;;CAMV,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/mjs/config/rbac-http-admin.js

@@ -11,6 +11,31 @@ const rbacHttpAdmin = {
             views: [dir('views')],
         },
     },
+    rbac: {
+        admin: {
+            /**
+             * Guards applied to every admin operation that changes what an account may
+             * do. Defaults are the strict end — see IRoleGuardConfig for what each one
+             * refuses and why. Turn individual checks off here rather than replacing
+             * the service.
+             */
+            roleGuard: {
+                service: 'DefaultRoleGuard',
+                requireKnownRole: true,
+                protectSystemRole: true,
+                preventEscalation: true,
+                preventSelfLockout: true,
+                preventLastPrivilegedRemoval: true,
+                /**
+                 * What makes a role "privileged" for the self-lockout and last-holder
+                 * checks. Action uses accesscontrol grant notation, exactly as written
+                 * in `rbac.grants`.
+                 */
+                privilegedResource: 'users',
+                privilegedAction: 'update:any',
+            },
+        },
+    },
 };
 export default rbacHttpAdmin;
 //# sourceMappingURL=rbac-http-admin.js.map

package/lib/mjs/config/rbac-http-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-admin.js","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5K,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACtB;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-admin.js","sourceRoot":"","sources":["../../../src/config/rbac-http-admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5K,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACtB;KACF;IAED,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;;;eAKG;YACH,SAAS,EAAE;gBACT,OAAO,EAAE,kBAAkB;gBAE3B,gBAAgB,EAAE,IAAI;gBACtB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,IAAI;gBACvB,kBAAkB,EAAE,IAAI;gBACxB,4BAA4B,EAAE,IAAI;gBAElC;;;;mBAIG;gBACH,kBAAkB,EAAE,OAAO;gBAC3B,gBAAgB,EAAE,YAAY;aAC/B;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/mjs/controllers/Users/Profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAI3D;;;;GAIG;AACH,qBAGa,OAAQ,SAAQ,cAAc;IASvC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAE9C;;;;;;;;;;OAUG;IAGU,cAAc,CAAU,KAAK,EAAE,MAAM;CAGrD"}
+{"version":3,"file":"Profile.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG3D;;;;GAIG;AACH,qBAGa,OAAQ,SAAQ,cAAc;IAOzC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAE9C;;;;;;;;;;OAUG;IAGU,cAAc,CAAU,KAAK,EAAE,MAAM;CAKnD"}

package/lib/mjs/controllers/Users/Profile.js

@@ -13,7 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { AutoinjectService } from '@spinajs/configuration';
 import { BaseController, BasePath, Get, Ok, Param, Policy } from '@spinajs/http';
 import { UserProfileProvider } from '@spinajs/rbac';
-import { AuthorizedPolicy, Permission, Resource } from "@spinajs/rbac-http";
+import { AuthorizedPolicy, Permission, Resource } from '@spinajs/rbac-http';
 /**
  * User profile management (admin).
  * Provides administrative access to user profile data via the configured UserProfileProvider.
@@ -32,7 +32,9 @@ let Profile = class Profile extends BaseController {
      * @response 404 User not found
      */
     async getUserProfile(login) {
-        return new Ok(this.ProfileService.retrieve(login));
+        // NOTE: awaited. Handing the pending promise to `Ok` serialized as an
+        // empty object for every client that got JSON back.
+        return new Ok(await this.ProfileService.retrieve(login));
     }
 };
 __decorate([

package/lib/mjs/controllers/Users/Profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;GAIG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,cAAc;IAWvC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,KAAa;QAC7C,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;CACJ,CAAA;AAlBa;IADT,iBAAiB,CAAC,mBAAmB,CAAC;8BACb,mBAAmB;+CAAC;AAejC;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACK,WAAA,KAAK,EAAE,CAAA;;;;6CAEnC;AA1BQ,OAAO;IAHnB,QAAQ,CAAC,eAAe,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,OAAO,CA2BnB"}
+{"version":3,"file":"Profile.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Profile.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAS,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE5E;;;;GAIG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,cAAc;IASzC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,KAAa;QAChD,sEAAsE;QACtE,oDAAoD;QACpD,OAAO,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AApBW;IADT,iBAAiB,CAAC,mBAAmB,CAAC;8BACb,mBAAmB;+CAAC;AAejC;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACK,WAAA,KAAK,EAAE,CAAA;;;;6CAInC;AA1BU,OAAO;IAHnB,QAAQ,CAAC,eAAe,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,OAAO,CA2BnB"}

package/lib/mjs/controllers/Users/Roles.d.ts

@@ -1,38 +1,45 @@
 import { BaseController, Ok } from '@spinajs/http';
-declare class RoleDto {
+import { User } from '@spinajs/rbac';
+import { RoleGuard } from '../../interfaces.js';
+import '../../services/RoleGuard.js';
+export declare class RoleDto {
     role: string;
     constructor(data: Partial<RoleDto>);
 }
 /**
  * User role management (admin).
  * Grants and revokes RBAC roles for user accounts.
+ *
+ * Both routes run the configured {@link RoleGuard} before touching anything: a
+ * role is the one thing in this API that can grant MORE than the caller has, so
+ * "may update users" is not by itself an answer to "may hand out this role".
  * @tags Admin Users
  */
 export declare class Roles extends BaseController {
+    protected RoleGuard: RoleGuard;
     /**
      * Grant role to user (admin)
      * Assigns the specified RBAC role to the user identified by login name.
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role granted successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role grants more than the caller holds
      * @response 404 User not found
      */
-    addRole(login: string, roleDto: RoleDto): Promise<Ok<any>>;
+    addRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
     /**
      * Revoke role from user (admin)
      * Removes the specified RBAC role from the user identified by login name.
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role revoked successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the revocation would lock the caller or the installation out
      * @response 404 User not found
      */
-    revokeRole(login: string, roleDto: RoleDto): Promise<Ok<any>>;
+    revokeRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
 }
-export {};
 //# sourceMappingURL=Roles.d.ts.map

package/lib/mjs/controllers/Users/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,EAAE,EAAwB,MAAM,eAAe,CAAC;AAMzF,cAQM,OAAO;IACF,IAAI,EAAE,MAAM,CAAC;gBAER,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;CAGrC;AAGD;;;;GAIG;AACH,qBAGa,KAAM,SAAQ,cAAc;IACrC;;;;;;;;;;OAUG;IAGU,OAAO,CAAU,KAAK,EAAE,MAAM,EAAU,OAAO,EAAE,OAAO;IAKrE;;;;;;;;;;OAUG;IAGU,UAAU,CAAU,KAAK,EAAE,MAAM,EAAU,OAAO,EAAE,OAAO;CAI3E"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAkB,EAAE,EAAiB,MAAM,eAAe,CAAC;AAElF,OAAO,EAAiB,IAAI,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,6BAA6B,CAAC;AAErC,qBAQa,OAAO;IACX,IAAI,EAAE,MAAM,CAAC;gBAER,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;CAGnC;AAED;;;;;;;;GAQG;AACH,qBAGa,KAAM,SAAQ,cAAc;IAEvC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;OAUG;IAGU,OAAO,CAAgB,KAAK,EAAE,IAAI,EAAkF,IAAI,EAAE,IAAI,EAAU,OAAO,EAAE,OAAO;IAOrK;;;;;;;;;;OAUG;IAGU,UAAU,CAAgB,KAAK,EAAE,IAAI,EAAkF,IAAI,EAAE,IAAI,EAAU,OAAO,EAAE,OAAO;CAMzK"}