@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/lib/mjs/controllers/Users/Users.js

@@ -11,21 +11,46 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Autoinject } from '@spinajs/di';
-import { BaseController, BasePath, Body, Get, Ok, Patch, Policy, Post, Query } from '@spinajs/http';
+import { AutoinjectService } from '@spinajs/configuration';
+import { BaseController, BasePath, Body, Del, Get, Ok, Param, Patch, Policy, Post, Query } from '@spinajs/http';
+import { InvalidArgument, ResourceDuplicated, ResourceNotFound } from '@spinajs/exceptions';
 import { SortOrder, SqlOperator } from '@spinajs/orm';
 import { Filter, FromModel, OrderDTO, PaginationDTO } from '@spinajs/orm-http';
-import { create, PasswordProvider, User } from '@spinajs/rbac';
-import { AuthorizedPolicy, Permission, Resource } from "@spinajs/rbac-http";
+import { create, deleteUser, PasswordProvider, User, USER_SECURITY_METADATA_KEYS, _user_update } from '@spinajs/rbac';
+import { AuthorizedPolicy, Permission, Resource, User as CurrentUser } from '@spinajs/rbac-http';
 import { Schema } from '@spinajs/validation';
-let UserDto = class UserDto {
+import { RoleGuard } from '../../interfaces.js';
+// Side effect only: registers DefaultRoleGuard under the RoleGuard base so
+// `rbac.admin.roleGuard.service` has something to resolve to. The type import
+// above is erased at compile time, and controllers are loaded by path rather
+// than through the package index, so without this the guard is missing in
+// exactly the deployments that never import the package themselves.
+import '../../services/RoleGuard.js';
+/**
+ * Columns a client may sort by.
+ *
+ * `OrderDTO.column` is a free-form string and reaches the query builder as an
+ * identifier. The compiler escapes it, so this is not an injection hole — but an
+ * unknown column produced a driver error and a 500 where the request was simply
+ * wrong. Whitelisting turns that into a 400 and keeps the sortable surface a
+ * deliberate decision rather than "whatever columns the table happens to have".
+ */
+const SORTABLE_COLUMNS = ['Uuid', 'Login', 'Email', 'Role', 'IsActive', 'CreatedAt', 'LastLoginAt', 'DeletedAt'];
+/**
+ * Upper bound on `pagination.limit`. An admin list endpoint with no ceiling is
+ * a table dump one query string away.
+ */
+const MAX_PAGE_SIZE = 100;
+const DEFAULT_PAGE_SIZE = 10;
+let CreateUserDto = class CreateUserDto {
     constructor(data) {
         Object.assign(this, data);
     }
 };
-UserDto = __decorate([
+CreateUserDto = __decorate([
     Schema({
         type: 'object',
-        $id: 'arrow.common.userDto',
+        $id: 'arrow.common.createUserDto',
         properties: {
             Login: { type: 'string', minLength: 3, maxLength: 32, description: 'Unique login name (3–32 characters)' },
             Email: { type: 'string', format: 'email', description: 'Unique email address' },
@@ -33,10 +58,6 @@ UserDto = __decorate([
             Metadata: {
                 type: 'object',
                 $id: 'arrow.common.userMetadata',
-                properties: {
-                    Key: { type: 'string', minLength: 1, maxLength: 64, description: 'Metadata key' },
-                    Value: { type: 'string', minLength: 0, maxLength: 256, description: 'Metadata value' },
-                },
                 additionalProperties: true,
                 description: 'Optional key-value metadata to attach to the user account',
             },
@@ -44,7 +65,37 @@ UserDto = __decorate([
         required: ['Login', 'Email', 'Role'],
     }),
     __metadata("design:paramtypes", [Object])
-], UserDto);
+], CreateUserDto);
+export { CreateUserDto };
+/**
+ * PATCH body. Separate from {@link CreateUserDto} because the two have opposite
+ * requirements: creation needs all three fields, an update needs none of them.
+ * Sharing one schema made every documented partial update fail validation with
+ * a 400 before the handler ever ran.
+ *
+ * Metadata is deliberately absent — it is managed through the dedicated
+ * `/user/:uuid/metadata` routes, which validate one entry at a time and can
+ * refuse the keys that decide account access.
+ */
+let UpdateUserDto = class UpdateUserDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+UpdateUserDto = __decorate([
+    Schema({
+        type: 'object',
+        $id: 'arrow.common.updateUserDto',
+        properties: {
+            Login: { type: 'string', minLength: 3, maxLength: 32, description: 'Unique login name (3–32 characters)' },
+            Email: { type: 'string', format: 'email', description: 'Unique email address' },
+            Role: { type: 'string', minLength: 1, maxLength: 32, description: 'RBAC role to assign to the user' },
+        },
+        additionalProperties: false,
+    }),
+    __metadata("design:paramtypes", [Object])
+], UpdateUserDto);
+export { UpdateUserDto };
 /**
  * User model filter
  * We declare it here to not include orm-http in rbac module
@@ -81,15 +132,15 @@ const USER_FILTER = [
     },
     {
         column: 'Role',
-        operators: ['eq', 'neq']
+        operators: ['eq', 'neq'],
     },
     {
         column: 'user:niceName',
         operators: ['eq', 'neq', 'like', 'b-like', 'e-like'],
         query: (operator, value) => {
             return function () {
-                this.whereExist("Metadata", function () {
-                    this.where('Key', "user:niceName");
+                this.whereExist('Metadata', function () {
+                    this.where('Key', 'user:niceName');
                     // NOTE: `operator` is the filter operator coming from the request
                     // ( eq / neq / like ... ), NOT an SQL one. It has to be translated
                     // before it reaches the query builder, which only understands SQL
@@ -113,8 +164,8 @@ const USER_FILTER = [
                     }
                 });
             };
-        }
-    }
+        },
+    },
 ];
 /**
  * User account management (admin).
@@ -133,32 +184,40 @@ let Users = class Users extends BaseController {
      * user:niceName metadata (eq, neq, like).
      * @security cookieAuth
      * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of users per page (default: 10)
-     * @param order.column Column to sort by (default: CreatedAt)
+     * @param pagination.limit Number of users per page (default: 10, max: 100)
+     * @param order.column Column to sort by (default: CreatedAt). One of Uuid, Login, Email, Role, IsActive, CreatedAt, LastLoginAt, DeletedAt
      * @param order.order Sort direction: ASC or DESC (default: DESC)
      * @param include Relations to include — currently supports: Metadata
      * @returns {IUserData[]} Paginated list of user accounts, each with optional Metadata relation
+     * @response 400 Sort column is not sortable
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — readAny permission required on users resource
      */
     async list(pagination, order, include, filter) {
+        // ONE limit for both take and skip. They used to disagree — take fell back
+        // to 10 while skip fell back to 0 — so any request that sent a page but no
+        // limit silently got page 0 whatever it asked for.
+        const limit = Math.min(pagination?.limit || DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+        const column = this.sortColumn(order);
         const result = await User.select()
-            .leftJoin("Metadata", function () {
+            .leftJoin('Metadata', function () {
             // TODO: allow to inject custom meta props that need to be selected
             // eg. user:niceName, user:avatar etc.
             // this is used for filtering / sorting by custom meta props
             this.where('Key', 'user:niceName');
         }, function () {
-            this.select('Value', "user:niceName");
+            this.select('Value', 'user:niceName');
         })
             .populate(include ?? [])
-            .take(pagination?.limit ?? 10)
-            .skip((pagination?.limit ?? 0) * (pagination?.page ?? 0))
-            .order(order?.column ?? 'CreatedAt', order?.order ?? SortOrder.DESC)
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
+            .order(column, order?.order ?? SortOrder.DESC)
             .filter(filter?.filters ?? [], filter?.op, USER_FILTER);
-        const count = await User.query().filter(filter?.filters ?? [], filter?.op, USER_FILTER).selectCount();
+        const count = await User.query()
+            .filter(filter?.filters ?? [], filter?.op, USER_FILTER)
+            .selectCount();
         return new Ok(result.map((x) => x.dehydrateWithRelations({
-            dateTimeFormat: "iso"
+            dateTimeFormat: 'iso',
         })), {
             Headers: [
                 {
@@ -168,6 +227,19 @@ let Users = class Users extends BaseController {
             ],
         });
     }
+    /**
+     * List assignable roles (admin)
+     * Returns the roles the calling administrator is allowed to grant, as decided by the
+     * configured role guard — the system role and anything granting more than the caller
+     * holds are left out, so a UI cannot offer an operation the guard will refuse.
+     * @security cookieAuth
+     * @returns {string[]} Role names the caller may assign
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on users resource
+     */
+    async assignableRoles(actor) {
+        return new Ok(this.RoleGuard.assignableRoles(actor));
+    }
     /**
      * Get user by UUID (admin)
      * Retrieves a single user record by UUID. Supports optional inclusion of related Metadata.
@@ -202,16 +274,21 @@ let Users = class Users extends BaseController {
     }
     /**
      * Create user (admin)
-     * Creates a new user account with a system-generated temporary password.
-     * The temporary password is not returned — it should be delivered to the user via email or other channel.
+     * Creates a new user account with a system-generated temporary password. The account is
+     * created inactive and the temporary password is never returned — issue a reset link with
+     * `POST /users/security/password-reset-request/:user` and activate the account once the
+     * user has set their own password.
      * @security cookieAuth
      * @returns {IUserData} Created user account
-     * @response 400 Validation error — missing required fields or invalid format
+     * @response 400 Validation error — missing required fields, invalid format, unknown role or a protected metadata key
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — createAny permission required on users resource
+     * @response 403 Forbidden — createAny permission required, or the requested role grants more than the caller holds
      * @response 409 Login or email already in use
      */
-    async addUser(data) {
+    async addUser(actor, data) {
+        await this.RoleGuard.assertCanAssignRoles(actor, null, [data.Role]);
+        this.assertNoProtectedMetadata(data.Metadata);
+        await this.assertUnique(data.Login, data.Email);
         const temporaryPassword = this.PasswordProvider.generate();
         const { User: created } = await create(data.Email, data.Login, temporaryPassword, [data.Role], undefined, data.Metadata);
         // NOTE: create() returns { User, Password } where Password is the plaintext
@@ -222,57 +299,157 @@ let Users = class Users extends BaseController {
     /**
      * Update user (admin)
      * Partially updates a user account. All fields are optional — only provided fields are changed.
-     * Metadata is merged: existing keys are updated, new keys are added, unlisted keys are preserved.
+     * Metadata is NOT handled here; use the `/user/:uuid/metadata` routes.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 User updated successfully
-     * @response 400 Validation error — invalid field format
+     * @response 400 Validation error — invalid field format or unknown role
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role change is refused by the role guard
      * @response 404 User not found
      * @response 409 Login or email already in use by another account
      */
-    async updateUser(user, data) {
+    async updateUser(actor, user, data) {
+        if (data.Role) {
+            const next = [data.Role];
+            const added = next.filter((r) => !user.Role.includes(r));
+            const removed = user.Role.filter((r) => !next.includes(r));
+            // A role list REPLACEMENT is a grant and a revoke at the same time, and
+            // both halves have their own rules — dropping the caller's last privileged
+            // role through PATCH must fail exactly as `revoke` does.
+            await this.RoleGuard.assertCanAssignRoles(actor, user, added);
+            for (const role of removed) {
+                await this.RoleGuard.assertCanRevokeRole(actor, user, role);
+            }
+        }
+        if ((data.Login && data.Login !== user.Login) || (data.Email && data.Email !== user.Email)) {
+            await this.assertUnique(data.Login !== user.Login ? data.Login : undefined, data.Email !== user.Email ? data.Email : undefined, user.Id);
+        }
         user.Login = data.Login ?? user.Login;
         user.Email = data.Email ?? user.Email;
-        // TODO
-        // fix array assign 
         user.Role = data.Role ? [data.Role] : user.Role;
-        if (data.Metadata) {
-            for (const key in data.Metadata) {
-                user.Metadata[key] = data.Metadata[key];
-            }
-        }
         await user.update();
-        await user.Metadata.update();
         return new Ok();
     }
-};
-__decorate([
-    Autoinject(),
-    __metadata("design:type", PasswordProvider
     /**
-     * List users (admin)
-     * Returns a paginated, sortable, filterable list of all users. Supports optional inclusion
-     * of related Metadata. The total user count (matching current filters) is returned in the
-     * X-Total-Count response header.
-     * Filterable fields: Uuid (eq), Email (eq, like), Login (eq, like), CreatedAt, LastLoginAt,
-     * DeletedAt (eq, gte, lte, lt, gt, isnull, notnull), IsActive (eq), Role (eq, neq),
-     * user:niceName metadata (eq, neq, like).
+     * Delete user (admin)
+     * Soft-deletes the account (`DeletedAt` is stamped, the row is kept) and destroys every
+     * session it holds, so a deleted user stops acting immediately rather than when their
+     * cookie happens to expire.
      * @security cookieAuth
-     * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of users per page (default: 10)
-     * @param order.column Column to sort by (default: CreatedAt)
-     * @param order.order Sort direction: ASC or DESC (default: DESC)
-     * @param include Relations to include — currently supports: Metadata
-     * @returns {IUserData[]} Paginated list of user accounts, each with optional Metadata relation
+     * @param user User UUID path parameter
+     * @response 200 User deleted
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — readAny permission required on users resource
+     * @response 403 Forbidden — deleteAny permission required, or the deletion is refused by the role guard
+     * @response 404 User not found
+     */
+    async removeUser(actor, user) {
+        await this.RoleGuard.assertCanDisableAccount(actor, user, 'delete');
+        await deleteUser(user);
+        return new Ok();
+    }
+    /**
+     * Restore a deleted user (admin)
+     * Clears `DeletedAt` on a soft-deleted account. The account keeps its previous
+     * `IsActive` state — restoring is not activating.
+     * @security cookieAuth
+     * @param uuid User UUID path parameter
+     * @response 200 User restored
+     * @response 400 User is not deleted
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 404 User not found
+     */
+    async restoreUser(uuid) {
+        // Loaded by hand rather than through @FromModel: every model query filters
+        // soft-deleted rows out by default, so the one row this route exists for is
+        // exactly the row @FromModel can never find.
+        const user = await User.query().withDeleted().where('Uuid', uuid).first();
+        if (!user) {
+            throw new ResourceNotFound(`User ${uuid} not found`);
+        }
+        if (!user.DeletedAt) {
+            throw new InvalidArgument(`User ${uuid} is not deleted`);
+        }
+        await _user_update({ DeletedAt: null })(user);
+        return new Ok();
+    }
+    /**
+     * The requested sort column, or the default. Rejects anything outside
+     * {@link SORTABLE_COLUMNS}.
+     */
+    sortColumn(order) {
+        const column = order?.column;
+        if (!column) {
+            return 'CreatedAt';
+        }
+        if (!SORTABLE_COLUMNS.includes(column)) {
+            throw new InvalidArgument(`Cannot sort by '${column}'. Sortable columns are: ${SORTABLE_COLUMNS.join(', ')}`);
+        }
+        return column;
+    }
+    /**
+     * Refuses metadata keys that decide account access.
+     *
+     * `user:pwd_reset:token` is a bearer credential for the public reset endpoint
+     * and `user:2fa:*` is the second factor itself — writing either through a
+     * generic key-value merge hands out an account rather than annotating one.
+     * Ban and lockout keys are refused for the same reason bans have their own
+     * route: written directly they skip the event, the email and the session
+     * revocation that make a ban mean something.
+     */
+    assertNoProtectedMetadata(metadata) {
+        if (!metadata) {
+            return;
+        }
+        const offending = Object.keys(metadata).filter((key) => {
+            // A glob reaches the metadata relation's setter as a PATTERN and rewrites
+            // every matching entry, so `*` alone would overwrite the whole set —
+            // including the protected keys listed above.
+            if (key.includes('*') || key.includes('?')) {
+                return true;
+            }
+            return USER_SECURITY_METADATA_KEYS.includes(key);
+        });
+        if (offending.length > 0) {
+            throw new InvalidArgument(`Metadata keys cannot be set through this endpoint: ${offending.join(', ')}`);
+        }
+    }
+    /**
+     * Rejects a login / email already taken by another account.
+     *
+     * Soft-deleted rows are included on purpose: they still occupy the unique
+     * indexes, so ignoring them would trade this 409 for a driver error and a 500.
      */
-    )
+    async assertUnique(login, email, exceptUserId) {
+        const clashes = [];
+        if (login) {
+            const found = await User.query().withDeleted().where('Login', login).first();
+            if (found && found.Id !== exceptUserId) {
+                clashes.push('Login');
+            }
+        }
+        if (email) {
+            const found = await User.query().withDeleted().where('Email', email).first();
+            if (found && found.Id !== exceptUserId) {
+                clashes.push('Email');
+            }
+        }
+        if (clashes.length > 0) {
+            throw new ResourceDuplicated(`${clashes.join(' and ')} already in use`);
+        }
+    }
+};
+__decorate([
+    Autoinject(),
+    __metadata("design:type", PasswordProvider)
 ], Users.prototype, "PasswordProvider", void 0);
 __decorate([
-    Get("/"),
+    AutoinjectService('rbac.admin.roleGuard'),
+    __metadata("design:type", RoleGuard)
+], Users.prototype, "RoleGuard", void 0);
+__decorate([
+    Get('/'),
     Permission(['readAny']),
     __param(0, Query()),
     __param(1, Query()),
@@ -290,8 +467,17 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "list", null);
 __decorate([
-    Get(":user"),
-    __param(0, FromModel({ queryField: "Uuid" })),
+    Get('roles'),
+    Permission(['readAny']),
+    __param(0, CurrentUser()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [User]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "assignableRoles", null);
+__decorate([
+    Get(':user'),
+    Permission(['readAny']),
+    __param(0, FromModel({ queryField: 'Uuid' })),
     __param(1, Query({
         type: 'array',
         items: {
@@ -304,8 +490,9 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "getSingleUser", null);
 __decorate([
-    Get("byLogin/:user"),
-    __param(0, FromModel({ queryField: "Login" })),
+    Get('byLogin/:user'),
+    Permission(['readAny']),
+    __param(0, FromModel({ queryField: 'Login' })),
     __param(1, Query({
         type: 'array',
         items: {
@@ -318,23 +505,41 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Users.prototype, "getByLogin", null);
 __decorate([
-    Post("/"),
+    Post('/'),
     Permission(['createAny']),
-    __param(0, Body()),
+    __param(0, CurrentUser()),
+    __param(1, Body()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserDto]),
+    __metadata("design:paramtypes", [User, CreateUserDto]),
     __metadata("design:returntype", Promise)
 ], Users.prototype, "addUser", null);
 __decorate([
-    Patch(":user"),
+    Patch(':user'),
     Permission(['updateAny']),
-    __param(0, FromModel({ queryField: "Uuid" })),
-    __param(1, Body()),
+    __param(0, CurrentUser()),
+    __param(1, FromModel({ queryField: 'Uuid', include: ['Metadata'] })),
+    __param(2, Body()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [User,
-        UserDto]),
+    __metadata("design:paramtypes", [User, User, UpdateUserDto]),
     __metadata("design:returntype", Promise)
 ], Users.prototype, "updateUser", null);
+__decorate([
+    Del(':user'),
+    Permission(['deleteAny']),
+    __param(0, CurrentUser()),
+    __param(1, FromModel({ queryField: 'Uuid', include: ['Metadata'] })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [User, User]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "removeUser", null);
+__decorate([
+    Patch(':uuid/restore'),
+    Permission(['deleteAny']),
+    __param(0, Param()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Users.prototype, "restoreUser", null);
 Users = __decorate([
     BasePath('users'),
     Policy(AuthorizedPolicy),

package/lib/mjs/controllers/Users/Users.js.map

@@ -1 +1 @@
-{"version":3,"file":"Users.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Users.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,MAAM,EAAuB,SAAS,EAAiC,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,IAoBM,OAAO,GApBb,MAoBM,OAAO;IAOX,YAAY,IAAsB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAVK,OAAO;IApBZ,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,2BAA2B;gBAChC,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACjF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE;iBACvF;gBACD,oBAAoB,EAAE,IAAI;gBAC1B,WAAW,EAAE,2DAA2D;aACzE;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;KACrC,CAAC;;GACI,OAAO,CAUZ;AAED;;;;GAIG;AACH,MAAM,WAAW,GAA0B;IACzC;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;KACjE;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACzB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACpD,KAAK,EAAE,CAAC,QAA6B,EAAE,KAAU,EAAE,EAAE;YACnD,OAAO;gBACL,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;oBAEnC,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,QAAQ,QAAQ,EAAE,CAAC;wBACjB,KAAK,IAAI;4BACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;4BAC1C,MAAM;wBACR,KAAK,KAAK;4BACR,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;4BAC3C,MAAM;wBACR,KAAK,MAAM;4BACT,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAA;4BACnD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAA;4BAClD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAA;4BAClD,MAAM;oBAEV,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAA;QACH,CAAC;KACF;CACF,CAAC;AAEF;;;;;GAKG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,cAAc;IAKvC;;;;;;;;;;;;;;;;;OAiBG;IAGU,AAAN,KAAK,CAAC,IAAI,CACN,UAA0B,EAC1B,KAAgB,EAQzB,OAAkB,EAElB,MAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC/B,QAAQ,CAAC,UAAU,EAAE;YAEpB,mEAAmE;YACnE,sCAAsC;YACtC,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAErC,CAAC,EAAE;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;QACvC,CAAC,CAAC;aACD,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;aACvB,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;aAC7B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,WAAW,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC;aACnE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAGtG,OAAO,IAAI,EAAE,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;YACzC,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC,EACH;YACE,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,aAAa,CAAoC,IAAU,EAOxE,OAAkB;QAChB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAqC,IAAU,EAOtE,OAAkB;QAChB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CACV,IAAa;QAGrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzH,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAGD;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CACc,IAAU,EACrC,IAAa;QAGrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAEtC,OAAO;QACP,oBAAoB;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAEhD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7B,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;CAGF,CAAA;AA7LW;IADT,UAAU,EAAE;8BACe,gBAAgB;IAE5C;;;;;;;;;;;;;;;;;OAiBG;;+CAnByC;AAsB/B;IAFZ,GAAG,CAAC,GAAG,CAAC;IACR,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,CAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;IAED,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;;qCAVE,aAAa;QAClB,QAAQ;;iCA6C1B;AAcY;IADZ,GAAG,CAAC,OAAO,CAAC;IACe,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAAc,WAAA,KAAK,CAAC;QAC/E,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCANkE,IAAI;;0CAWvE;AAcY;IADZ,GAAG,CAAC,eAAe,CAAC;IACI,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAAc,WAAA,KAAK,CAAC;QAC7E,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCANgE,IAAI;;uCAWrE;AAgBY;IAFZ,IAAI,CAAC,GAAG,CAAC;IACT,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAEvB,WAAA,IAAI,EAAE,CAAA;;qCAAO,OAAO;;oCAUtB;AAkBY;IAFZ,KAAK,CAAC,OAAO,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAEvB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAI,EAAE,CAAA;;qCADkC,IAAI;QAC/B,OAAO;;uCAoBtB;AA7LU,KAAK;IAHjB,QAAQ,CAAC,OAAO,CAAC;IACjB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,KAAK,CAgMjB"}
+{"version":3,"file":"Users.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Users.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,MAAM,EAAuB,SAAS,EAAiC,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,OAAO,6BAA6B,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAEjH;;;GAGG;AACH,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAkBtB,IAAM,aAAa,GAAnB,MAAM,aAAa;IAOxB,YAAY,IAA4B;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAVY,aAAa;IAhBzB,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,4BAA4B;QACjC,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,2BAA2B;gBAChC,oBAAoB,EAAE,IAAI;gBAC1B,WAAW,EAAE,2DAA2D;aACzE;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;KACrC,CAAC;;GACW,aAAa,CAUzB;;AAED;;;;;;;;;GASG;AAWI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKxB,YAAY,IAA4B;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,aAAa;IAVzB,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,4BAA4B;QACjC,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE;YAC1G,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;SACtG;QACD,oBAAoB,EAAE,KAAK;KAC5B,CAAC;;GACW,aAAa,CAQzB;;AAED;;;;GAIG;AACH,MAAM,WAAW,GAA0B;IACzC;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;KAC5C;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;KACjE;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,CAAC,IAAI,CAAC;KAClB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KACzB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACpD,KAAK,EAAE,CAAC,QAA6B,EAAE,KAAU,EAAE,EAAE;YACnD,OAAO;gBACL,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;oBAEnC,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,QAAQ,QAAQ,EAAE,CAAC;wBACjB,KAAK,IAAI;4BACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;4BAC3C,MAAM;wBACR,KAAK,KAAK;4BACR,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;4BAC5C,MAAM;wBACR,KAAK,MAAM;4BACT,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC;4BACpD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;4BACnD,MAAM;wBACR,KAAK,QAAQ;4BACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;4BACnD,MAAM;oBACV,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;;;GAKG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,cAAc;IAOvC;;;;;;;;;;;;;;;;;;OAkBG;IAGU,AAAN,KAAK,CAAC,IAAI,CACN,UAA0B,EAC1B,KAAgB,EAQzB,OAAkB,EAElB,MAAuB;QAEvB,2EAA2E;QAC3E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC/B,QAAQ,CACP,UAAU,EACV;YACE,mEAAmE;YACnE,sCAAsC;YACtC,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACrC,CAAC,EACD;YACE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,CAAC,CACF;aACA,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC;aAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC;aACtD,WAAW,EAAE,CAAC;QAEjB,OAAO,IAAI,EAAE,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,sBAAsB,CAAC;YACvB,cAAc,EAAE,KAAK;SACtB,CAAC,CACH,EACD;YACE,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CAAgB,KAAW;QACrD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,aAAa,CACW,IAAU,EAQ7C,OAAkB;QAElB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CACe,IAAU,EAQ9C,OAAkB;QAElB,sEAAsE;QACtE,OAAO,CAAC;QACR,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAgB,KAAW,EAAU,IAAmB;QAC1E,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzH,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAA4D,IAAU,EAAU,IAAmB;QACnJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3D,wEAAwE;YACxE,2EAA2E;YAC3E,yDAAyD;YACzD,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE9D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAEhD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEpB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAA4D,IAAU;QACtH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAU,IAAY;QAC5C,2EAA2E;QAC3E,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAE1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,IAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAErD,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,KAAgB;QACnC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,mBAAmB,MAAM,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACO,yBAAyB,CAAC,QAAiC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACrD,0EAA0E;YAC1E,qEAAqE;YACrE,6CAA6C;YAC7C,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,2BAA2B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,sDAAsD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,KAAc,EAAE,YAAqB;QAChF,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF,CAAA;AA3WW;IADT,UAAU,EAAE;8BACe,gBAAgB;+CAAC;AAGnC;IADT,iBAAiB,CAAC,sBAAsB,CAAC;8BACrB,SAAS;wCAAC;AAuBlB;IAFZ,GAAG,CAAC,GAAG,CAAC;IACR,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,CAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;IAED,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;;qCAVE,aAAa;QAClB,QAAQ;;iCAwD1B;AAcY;IAFZ,GAAG,CAAC,OAAO,CAAC;IACZ,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACM,WAAA,WAAW,EAAE,CAAA;;qCAAQ,IAAI;;4CAEtD;AAeY;IAFZ,GAAG,CAAC,OAAO,CAAC;IACZ,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,CAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCAPuC,IAAI;;0CAa9C;AAeY;IAFZ,GAAG,CAAC,eAAe,CAAC;IACpB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClC,WAAA,KAAK,CAAC;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC,CAAA;;qCAPwC,IAAI;;uCAa/C;AAiBY;IAFZ,IAAI,CAAC,GAAG,CAAC;IACT,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,WAAW,EAAE,CAAA;IAAe,WAAA,IAAI,EAAE,CAAA;;qCAAb,IAAI,EAAgB,aAAa;;oCAY3E;AAiBY;IAFZ,KAAK,CAAC,OAAO,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,WAAW,EAAE,CAAA;IAAe,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAI,EAAE,CAAA;;qCAAnF,IAAI,EAAkE,IAAI,EAAgB,aAAa;;uCA2BpJ;AAgBY;IAFZ,GAAG,CAAC,OAAO,CAAC;IACZ,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,WAAW,EAAE,CAAA;IAAe,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;;qCAA/D,IAAI,EAAkE,IAAI;;uCAKvH;AAgBY;IAFZ,KAAK,CAAC,eAAe,CAAC;IACtB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,KAAK,EAAE,CAAA;;;;wCAiBhC;AA/RU,KAAK;IAHjB,QAAQ,CAAC,OAAO,CAAC;IACjB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,KAAK,CA6WjB"}

package/lib/mjs/index.d.ts

@@ -1,2 +1,7 @@
-export * from "./controllers/Users/Users.js";
+export * from './interfaces.js';
+export * from './services/RoleGuard.js';
+export * from './controllers/Users/Users.js';
+export * from './controllers/Users/Roles.js';
+export * from './controllers/Users/Security.js';
+export * from './controllers/Users/Profile.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AAExC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC"}

package/lib/mjs/index.js

@@ -1,2 +1,7 @@
-export * from "./controllers/Users/Users.js";
+export * from './interfaces.js';
+export * from './services/RoleGuard.js';
+export * from './controllers/Users/Users.js';
+export * from './controllers/Users/Roles.js';
+export * from './controllers/Users/Security.js';
+export * from './controllers/Users/Profile.js';
 //# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AAExC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -0,0 +1,81 @@
+import { User } from '@spinajs/rbac';
+/**
+ * What an administrator is allowed to do to roles and to accounts, read from
+ * `rbac.admin.roleGuard`.
+ *
+ * Every check is switchable because the right answer is deployment-specific: a
+ * single-tenant back office with two trusted operators wants none of this, a
+ * multi-tenant one wants all of it. The shipped defaults are the strict end —
+ * an application that needs less has to say so explicitly.
+ */
+export interface IRoleGuardConfig {
+    /** Registered name of the {@link RoleGuard} implementation to use. */
+    service: string;
+    /** Reject role names that are not declared in `rbac.grants` / `rbac.roles`. */
+    requireKnownRole: boolean;
+    /** Refuse to grant or revoke `rbac.systemRole` over HTTP, whoever is asking. */
+    protectSystemRole: boolean;
+    /**
+     * Refuse to grant a role whose resolved grants are not a subset of the
+     * caller's own. Without this, `updateAny` on `users` is a path to every other
+     * permission in the system — an administrator simply grants themselves more.
+     */
+    preventEscalation: boolean;
+    /**
+     * Refuse operations that would strip the CALLER of their own privileged role
+     * or of their own account ( self-deactivation, self-deletion, self-ban ).
+     */
+    preventSelfLockout: boolean;
+    /**
+     * Refuse operations that would leave zero usable accounts holding a
+     * privileged role — the "locked out of your own installation" case.
+     */
+    preventLastPrivilegedRemoval: boolean;
+    /**
+     * Resource + action that make a role "privileged" for the two guards above.
+     * Action is written in accesscontrol grant notation, as it appears in
+     * `rbac.grants` ( `update:any`, not `updateAny` ).
+     */
+    privilegedResource: string;
+    privilegedAction: string;
+}
+/**
+ * Role and account-state guard for the admin API.
+ *
+ * The checks live here rather than in the controllers because the same rule has
+ * to hold on every path that can change what an account may do: granting a role,
+ * revoking one, rewriting the whole role list through `PATCH /users/:uuid`, and
+ * taking an account out of service. A rule implemented per-controller is a rule
+ * that will be missing from the next controller.
+ *
+ * All methods THROW on refusal ( `Forbidden` / `InvalidArgument`, which the http
+ * error map turns into 403 / 400 ) and return normally when the operation is
+ * allowed.
+ */
+export declare abstract class RoleGuard {
+    /**
+     * May `actor` put `roles` on `target`?
+     *
+     * @param actor - the authenticated administrator making the request
+     * @param target - the account being changed, or null when it does not exist yet ( creation )
+     * @param roles - roles that would be assigned
+     */
+    abstract assertCanAssignRoles(actor: User, target: User | null, roles: string[]): Promise<void>;
+    /**
+     * May `actor` take `role` away from `target`?
+     */
+    abstract assertCanRevokeRole(actor: User, target: User, role: string): Promise<void>;
+    /**
+     * May `actor` take `target` out of service ( deactivate / delete / ban )?
+     */
+    abstract assertCanDisableAccount(actor: User, target: User, action: AccountDisableAction): Promise<void>;
+    /**
+     * Roles `actor` is allowed to hand out, for populating an admin UI. Returning
+     * this rather than the full role list keeps the UI from offering an operation
+     * the guard will refuse.
+     */
+    abstract assignableRoles(actor: User): string[];
+}
+/** Operations that end an account's ability to act. */
+export type AccountDisableAction = 'deactivate' | 'delete' | 'ban';
+//# sourceMappingURL=interfaces.d.ts.map