@spinajs/rbac-http-token 2.0.507

package/README.md

@@ -0,0 +1,152 @@
+# @spinajs/rbac-http-token
+
+Personal access tokens (PAT) for spinajs HTTP routes. Opaque `spt_...` tokens,
+stored hashed (SHA-256), assigned to users, with rbac role intersection and
+optional expiration.
+
+## Securing a route
+
+```ts
+import { BaseController, BasePath, Get, Policy } from '@spinajs/http';
+import { Permission, Resource } from '@spinajs/rbac-http';
+import { TokenPolicy } from '@spinajs/rbac-http-token';
+
+@BasePath('api')
+@Resource('my.resource')
+export class ApiController extends BaseController {
+  @Get('data')
+  @Permission(['readOwn']) // permission metadata + the RbacPolicy group
+  @Policy(TokenPolicy) // METHOD level, BELOW @Permission
+  public async data() { ... }
+}
+```
+
+The placement is load bearing (see the docblock on `src/policies/TokenPolicy.ts`):
+
+- `@Policy(TokenPolicy)` must sit at the **method** level. A class level
+  declaration lands in the CONTROLLER policy scope, and the controller scope is
+  ANDed with the route scope - it would then have to hold together with the
+  `RbacPolicy` group that `@Permission` pushes on the route, and `RbacPolicy`
+  demands an authorized session that a token request never has. Every token
+  request would 401. Method level puts it in the same scope as `@Permission`,
+  and groups within one scope are ORed: a token request satisfies the
+  `TokenPolicy` group, a session request satisfies the `RbacPolicy` one.
+- For the same reason it must not be passed as `@Permission`'s `also` argument -
+  `@Permission(['readOwn'], TokenPolicy)` bundles both into a single ANDed group.
+- Writing it **below** `@Permission` is deliberate: decorators apply bottom up,
+  so when no group holds, the reported rejection is this policy's 403
+  ("token role(s) ... do not have permission ...") instead of `RbacPolicy`'s
+  misleading "user not logged" 401.
+- Because the two route-scope groups are **ORed**, adding `@Policy(TokenPolicy)`
+  *widens* the route: it becomes reachable by a token holder whose effective
+  roles carry the grant **and** by a session holder whose active role carries
+  it, exactly as before. It is not a "tokens only" switch. Use
+  `NoTokenAuthPolicy` (below) for the opposite - a route sessions may use and
+  tokens may not.
+- The `@Permission` line stays required - `TokenPolicy` reads the same route
+  permission metadata, and a route without it silently inherits the
+  controller-level default `['readOwn']`.
+
+Clients authenticate with `Authorization: Bearer spt_...` (scheme name is
+case-insensitive) or the configured fallback header (`x-api-key` by default).
+
+## Token semantics
+
+- Effective roles at request time = token roles ∩ owner's current roles. Roles
+  are re-intersected on every request, so a role revoked on the user takes
+  effect immediately for all of their tokens.
+- A token whose effective role set becomes empty stops authenticating.
+- Permission checks run against the **whole** effective role set. A session has
+  an *active role* it can switch at runtime (`POST /auth/active-role`) and is
+  authorized by that one role; a token has no session and no way to switch, so
+  it would be stuck with whichever role happened to be first. Instead
+  `TokenAuthMiddleware` clears `req.storage.ActiveRole`, and every consumer
+  (`checkRoutePermission`, the orm rbac query middleware) falls back to
+  `User.Role` - already narrowed to the effective set.
+- Owner deactivated / banned / soft-deleted => all their tokens stop working.
+- `ExpiresAt` null/absent => token never expires.
+- Plaintext shown exactly once at creation; only its SHA-256 hash is stored, and
+  the hash itself is `@Hidden()` so it never reaches a response either.
+- Session-authenticated requests ignore tokens: `TokenAuthMiddleware` runs after
+  `RbacMiddleware` and bails out when a session is present, so a request never
+  mixes both.
+- Token-authenticated responses are sent with `Cache-Control: no-store`.
+- Tokens cannot manage tokens - the management API is guarded by
+  `NoTokenAuthPolicy` (no self-replication).
+- Tokens cannot be minted or managed while impersonating another user -
+  `NoImpersonationPolicy` (also exported) rejects such requests with 403. An
+  impersonated session is supervised and revocable; a token it minted would
+  outlive it, carry the victim's roles, and be invisible to them.
+- A token always keeps at least one role - revoking the last one is refused
+  (400 / `E_TOKEN_ROLE_NOT_ALLOWED`). Delete the token to revoke it entirely.
+- A token can never carry a role its owner does not hold, at creation or grant.
+- `LastUsedAt` is stamped on use, throttled to one write per
+  `rbac.token.lastUsedUpdateInterval` seconds.
+
+## HTTP API (session auth required)
+
+All routes live under the `user.tokens` resource and operate on the caller's own
+tokens only - a foreign uuid simply reads as 404.
+
+| Route | Description |
+|---|---|
+| `GET user/tokens` | list own tokens |
+| `POST user/tokens` | create (`{ Name, Roles, ExpiresAt? }`), returns plaintext once |
+| `DELETE user/tokens/:uuid` | revoke (delete) a token |
+| `PUT user/tokens/:uuid/roles/:role` | grant role |
+| `DELETE user/tokens/:uuid/roles/:role` | revoke role |
+
+Responses: `400` for role refusals (role not held by the caller, last role
+revoke), `401` without a valid session, `403` when the request is
+token-authenticated or impersonated, `404` for a token the caller does not own.
+
+## CLI
+
+```
+rbac:token-create <userIdOrUuid> -n <name> -r <roles> [-e <iso>]
+rbac:token-delete <uuid>
+rbac:token-grant <uuid> <role>
+rbac:token-revoke <uuid> <role>
+rbac:token-delete-expired   # run cyclically from a worker
+```
+
+- `-r, --roles` is a comma separated list, and must be a subset of the owner's
+  roles.
+- `-e, --expires` takes an ISO instant. Omitting the flag entirely means the
+  token never expires; an empty or unparsable value is refused rather than
+  silently treated as "no expiration".
+- `rbac:token-create` prints the plaintext once - it cannot be retrieved later.
+- `rbac:token-delete-expired` is housekeeping only; expired tokens are already
+  refused at authentication time.
+
+## Configuration
+
+**A consuming app MUST import the package in its bootstrap** -
+`import '@spinajs/rbac-http-token';` - even when it uses nothing from it
+directly. The model, the migration and the auth middleware register themselves
+through decorators when their module is loaded, and the migration in particular
+is *not* found by filesystem scan (see the comment on `system.dirs` in
+`src/config/rbac-http-token.ts` and the note at the bottom of this file). Without
+that import the `rbac_access_tokens` table is never created.
+
+See `src/config/rbac-http-token.ts` - `rbac.token.*`:
+
+| Key | Default | Meaning |
+|---|---|---|
+| `rbac.token.generation.service` | `SecureRandomTokenProvider` | `AccessTokenGenerationProvider` implementation used to generate/hash tokens |
+| `rbac.token.prefix` | `spt_` | stable plaintext prefix, lets secret scanners recognise leaked tokens |
+| `rbac.token.length` | `32` | random bytes per token (32 = 256 bit entropy) |
+| `rbac.token.headerName` | `x-api-key` | fallback header checked when no `Authorization: Bearer` is present |
+| `rbac.token.lastUsedUpdateInterval` | `60` | seconds between `LastUsedAt` writes for a busy token |
+
+The package also ships `rbac.grants` for the `user.tokens` resource and queue
+routing that sends its events (`AccessTokenCreated`, `AccessTokenDeleted`,
+`AccessTokenRoleGranted`, `AccessTokenRoleRevoked`) to rbac's empty connection
+instead of the application's default broker.
+
+`system.dirs` ships `cli` and `controllers` only - those are found by filesystem
+scan. `migrations` is deliberately absent: a non-empty `system.dirs.migrations`
+makes the orm replace its build-layout defaults, which would switch off
+migration discovery in every consuming app. The initial migration carries
+`@Migration`, is exported from the package index, and is picked up from the DI
+registry instead.

package/lib/cjs/actions.d.ts

@@ -0,0 +1,119 @@
+import { DateTime } from 'luxon';
+import { User } from '@spinajs/rbac';
+import { AccessToken } from './models/AccessToken.js';
+/**
+ * Failure codes carried by every {@link ErrorCode} this module throws.
+ *
+ * Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
+ * `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
+ * from their package index. A downstream barrel that does
+ * `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
+ * would collide on the NAME while the members underneath carry different
+ * numeric values - the kind of clash that resolves silently in a barrel and
+ * makes an `err.code === E_CODES.X` comparison answer the wrong question.
+ */
+export declare enum E_TOKEN_CODES {
+    E_TOKEN_NOT_FOUND = 0,
+    E_TOKEN_EXPIRED = 1,
+    E_TOKEN_OWNER_INVALID = 2,
+    E_TOKEN_ROLE_NOT_ALLOWED = 3
+}
+/**
+ * Resolves an AccessToken from an instance or its uuid.
+ */
+export declare function _token(token: AccessToken | string): () => Promise<AccessToken>;
+/**
+ * Resolves the owning user by instance, numeric id or uuid, with metadata
+ * populated ( needed for IsBanned checks downstream ).
+ */
+export declare function _owner(user: User | number | string): () => Promise<User>;
+/**
+ * Creates a new access token for a user.
+ *
+ * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
+ * null means the token never expires. The plaintext is returned once and
+ * never persisted - only its hash is stored.
+ *
+ * @param user - owner: {@link User} instance, numeric id or uuid
+ * @param name - human readable label
+ * @param roles - roles carried by the token, subset of the owner's roles
+ * @param expiresAt - absolute expiration, or null for a token that never expires
+ */
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+    Token: AccessToken;
+    Plaintext: string;
+}>;
+/**
+ * Permanently deletes ( revokes ) a token.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ */
+export declare function deleteToken(token: AccessToken | string): Promise<void>;
+/**
+ * Adds a role to a token. The role must be held by the token owner.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to grant
+ */
+export declare function grantTokenRole(token: AccessToken | string, role: string): Promise<AccessToken>;
+/**
+ * Removes a role from a token.
+ *
+ * Not symmetric with {@link grantTokenRole}: revoking only ever narrows what a
+ * token may do, so it needs no owner check.
+ *
+ * A token must always keep at least one role - revoking the last one is
+ * refused, and full revocation means deleting the token. Beyond being
+ * meaningless ( a role-less token authorises nothing ), an empty list is
+ * actively corrupting: `@Set()` columns round-trip through `SqlSetConverter`,
+ * which stores `[]` as `''` and reads `''` back as `['']`. That phantom empty
+ * role then survives every later grant, permanently.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to revoke
+ * @throws ErrorCode E_TOKEN_ROLE_NOT_ALLOWED when `role` is the token's last role
+ */
+export declare function revokeTokenRole(token: AccessToken | string, role: string): Promise<AccessToken>;
+export interface ITokenValidationResult {
+    User: User;
+    Token: AccessToken;
+    /**
+     * Token roles that the owner still holds. Permission checks run with these.
+     */
+    EffectiveRoles: string[];
+}
+/**
+ * Validates a presented plaintext token.
+ *
+ * Checks, in order: token exists ( by hash ), token not expired, owner active /
+ * not soft-deleted / not banned, effective role intersection non-empty.
+ * Throws ErrorCode with {@link E_TOKEN_CODES} on every failure path.
+ *
+ * The owner checks are spelled out instead of reusing the `isActiveUser` query
+ * scope on purpose - a single "no such active user" result cannot say WHY, and
+ * callers need to tell an expired token from a banned account.
+ *
+ * @param plaintext - token exactly as presented by the client
+ */
+export declare function validateToken(plaintext: string): Promise<ITokenValidationResult>;
+/**
+ * Deletes every token whose expiration has passed. Returns the deleted count.
+ *
+ * Intended for cyclic execution from a worker ( see `rbac:token-delete-expired` ).
+ * Expired tokens are already refused by {@link validateToken}, so this is
+ * housekeeping, not enforcement.
+ */
+export declare function deleteExpiredTokens(): Promise<number>;
+/**
+ * Updates `LastUsedAt`, throttled: writes only when the stamp is absent or
+ * older than `intervalSeconds`.
+ *
+ * Every authenticated request would otherwise write to the token row; the stamp
+ * only needs to be accurate enough to spot unused tokens. Callers may
+ * fire-and-forget.
+ *
+ * @param token - token to stamp
+ * @param intervalSeconds - minimum time between two writes
+ */
+export declare function touchToken(token: AccessToken, intervalSeconds: number): Promise<void>;
+//# sourceMappingURL=actions.d.ts.map

package/lib/cjs/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAUxE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/cjs/actions.js

@@ -0,0 +1,257 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E_TOKEN_CODES = void 0;
+exports._token = _token;
+exports._owner = _owner;
+exports.createToken = createToken;
+exports.deleteToken = deleteToken;
+exports.grantTokenRole = grantTokenRole;
+exports.revokeTokenRole = revokeTokenRole;
+exports.validateToken = validateToken;
+exports.deleteExpiredTokens = deleteExpiredTokens;
+exports.touchToken = touchToken;
+const lodash_1 = __importDefault(require("lodash"));
+const luxon_1 = require("luxon");
+const rbac_1 = require("@spinajs/rbac");
+const util_1 = require("@spinajs/util");
+const configuration_1 = require("@spinajs/configuration");
+const queue_1 = require("@spinajs/queue");
+const exceptions_1 = require("@spinajs/exceptions");
+const AccessToken_js_1 = require("./models/AccessToken.js");
+const interfaces_js_1 = require("./interfaces.js");
+const index_js_1 = require("./events/index.js");
+/**
+ * Failure codes carried by every {@link ErrorCode} this module throws.
+ *
+ * Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
+ * `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
+ * from their package index. A downstream barrel that does
+ * `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
+ * would collide on the NAME while the members underneath carry different
+ * numeric values - the kind of clash that resolves silently in a barrel and
+ * makes an `err.code === E_CODES.X` comparison answer the wrong question.
+ */
+var E_TOKEN_CODES;
+(function (E_TOKEN_CODES) {
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_NOT_FOUND"] = 0] = "E_TOKEN_NOT_FOUND";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_EXPIRED"] = 1] = "E_TOKEN_EXPIRED";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_OWNER_INVALID"] = 2] = "E_TOKEN_OWNER_INVALID";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_ROLE_NOT_ALLOWED"] = 3] = "E_TOKEN_ROLE_NOT_ALLOWED";
+})(E_TOKEN_CODES || (exports.E_TOKEN_CODES = E_TOKEN_CODES = {}));
+/**
+ * Resolves an AccessToken from an instance or its uuid.
+ */
+function _token(token) {
+    if (lodash_1.default.isString(token)) {
+        return () => AccessToken_js_1.AccessToken.where('Uuid', token).firstOrFail();
+    }
+    return () => Promise.resolve(token);
+}
+/**
+ * Resolves the owning user by instance, numeric id or uuid, with metadata
+ * populated ( needed for IsBanned checks downstream ).
+ */
+function _owner(user) {
+    if (lodash_1.default.isString(user)) {
+        return () => rbac_1.User.where('Uuid', user).populate('Metadata').firstOrFail();
+    }
+    if (lodash_1.default.isNumber(user)) {
+        return () => rbac_1.User.where('Id', user).populate('Metadata').firstOrFail();
+    }
+    return () => Promise.resolve(user);
+}
+/**
+ * Emits a token-related event through the queue service and forwards the token.
+ *
+ * @param event - constructor of the {@link AccessTokenEvent} subclass to emit
+ * @param args - additional arguments forwarded to the event constructor
+ */
+function _token_ev(event, ...args) {
+    return async (t) => {
+        await (0, queue_1._ev)(new event(t, ...args))();
+        return t;
+    };
+}
+/**
+ * Ensures every role in `roles` is currently held by `owner`.
+ * A token must never carry a role its owner does not have.
+ */
+function _assert_roles_subset(owner, roles) {
+    const missing = roles.filter((r) => !owner.Role.includes(r));
+    if (missing.length !== 0) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner does not hold role(s): ${missing.join(', ')}`, { roles: missing });
+    }
+}
+/**
+ * Creates a new access token for a user.
+ *
+ * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
+ * null means the token never expires. The plaintext is returned once and
+ * never persisted - only its hash is stored.
+ *
+ * @param user - owner: {@link User} instance, numeric id or uuid
+ * @param name - human readable label
+ * @param roles - roles carried by the token, subset of the owner's roles
+ * @param expiresAt - absolute expiration, or null for a token that never expires
+ */
+async function createToken(user, name, roles, expiresAt) {
+    name = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)(), (0, util_1._max_length)(128))(name, 'name');
+    roles = (0, util_1._check_arg)((0, util_1._non_nil)(), (0, util_1._non_empty)())(roles, 'roles');
+    const generator = await (0, configuration_1._service)('rbac.token.generation', interfaces_js_1.AccessTokenGenerationProvider)();
+    const generated = await generator.generate();
+    return (0, util_1._chain)(_owner(user), (0, util_1._tap)(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+        const token = new AccessToken_js_1.AccessToken({
+            Name: name,
+            Token: generated.Hash,
+            Roles: lodash_1.default.uniq(roles),
+            // `ExpiresAt` is optional rather than nullable ( see the model ), so a
+            // "never expires" token leaves the property unset instead of holding null.
+            ExpiresAt: expiresAt ?? undefined,
+            user_id: u.Id,
+        });
+        await token.insert();
+        return token;
+    }, _token_ev(index_js_1.AccessTokenCreated), (t) => ({ Token: t, Plaintext: generated.Plaintext }));
+}
+/**
+ * Permanently deletes ( revokes ) a token.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ */
+async function deleteToken(token) {
+    return (0, util_1._chain)(_token(token), (0, util_1._tap)((t) => t.destroy()), _token_ev(index_js_1.AccessTokenDeleted), () => undefined);
+}
+/**
+ * Adds a role to a token. The role must be held by the token owner.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to grant
+ */
+async function grantTokenRole(token, role) {
+    role = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(role, 'role');
+    return (0, util_1._chain)(_token(token), (0, util_1._tap)(async (t) => {
+        const owner = await _owner(t.user_id)();
+        _assert_roles_subset(owner, [role]);
+        t.Roles = lodash_1.default.uniq([...t.Roles, role]);
+        await t.update();
+    }), _token_ev(index_js_1.AccessTokenRoleGranted, role));
+}
+/**
+ * Removes a role from a token.
+ *
+ * Not symmetric with {@link grantTokenRole}: revoking only ever narrows what a
+ * token may do, so it needs no owner check.
+ *
+ * A token must always keep at least one role - revoking the last one is
+ * refused, and full revocation means deleting the token. Beyond being
+ * meaningless ( a role-less token authorises nothing ), an empty list is
+ * actively corrupting: `@Set()` columns round-trip through `SqlSetConverter`,
+ * which stores `[]` as `''` and reads `''` back as `['']`. That phantom empty
+ * role then survives every later grant, permanently.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to revoke
+ * @throws ErrorCode E_TOKEN_ROLE_NOT_ALLOWED when `role` is the token's last role
+ */
+async function revokeTokenRole(token, role) {
+    role = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(role, 'role');
+    return (0, util_1._chain)(_token(token), (0, util_1._tap)(async (t) => {
+        const remaining = t.Roles.filter((r) => r !== role);
+        // checked BEFORE mutating, so a refused revoke leaves the instance and
+        // the row exactly as they were
+        if (remaining.length === 0) {
+            throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Cannot revoke the last role from a token - delete the token instead', { token: t.Uuid });
+        }
+        t.Roles = remaining;
+        await t.update();
+    }), _token_ev(index_js_1.AccessTokenRoleRevoked, role));
+}
+/**
+ * Validates a presented plaintext token.
+ *
+ * Checks, in order: token exists ( by hash ), token not expired, owner active /
+ * not soft-deleted / not banned, effective role intersection non-empty.
+ * Throws ErrorCode with {@link E_TOKEN_CODES} on every failure path.
+ *
+ * The owner checks are spelled out instead of reusing the `isActiveUser` query
+ * scope on purpose - a single "no such active user" result cannot say WHY, and
+ * callers need to tell an expired token from a banned account.
+ *
+ * @param plaintext - token exactly as presented by the client
+ */
+async function validateToken(plaintext) {
+    // Degenerate input is a failed authentication like any other, so it has to
+    // leave through the same door. `_check_arg(_trim(), _non_empty())` would
+    // throw a raw InvalidArgument here - and a bare TypeError for nil, since
+    // `_non_empty` dereferences `.length` - breaking the "always an ErrorCode"
+    // contract this function is called under. Reported as E_TOKEN_NOT_FOUND with
+    // the unknown-token message on purpose: a caller must not learn WHY.
+    if (!lodash_1.default.isString(plaintext) || plaintext.trim().length === 0) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_NOT_FOUND, 'Access token not found');
+    }
+    plaintext = plaintext.trim();
+    const generator = await (0, configuration_1._service)('rbac.token.generation', interfaces_js_1.AccessTokenGenerationProvider)();
+    const hash = generator.hash(plaintext);
+    const token = await AccessToken_js_1.AccessToken.where('Token', hash).first();
+    if (!token) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_NOT_FOUND, 'Access token not found');
+    }
+    if (token.IsExpired) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_EXPIRED, 'Access token expired', { token: token.Uuid });
+    }
+    // Metadata carries the ban flag, so it must be populated - without it
+    // `IsBanned` silently answers false and every banned owner authenticates.
+    const owner = await rbac_1.User.where('Id', token.user_id).populate('Metadata').first();
+    // `DeletedAt` is defence in depth: the orm's soft-delete scope already appends
+    // `DeletedAt IS NULL` to User selects, so a deleted owner arrives as undefined.
+    if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
+    }
+    // roles are re-intersected on every request rather than trusted from the row:
+    // a role revoked on the user must take effect immediately, without having to
+    // hunt down every token that still carries it
+    const effective = token.Roles.filter((r) => owner.Role.includes(r));
+    if (effective.length === 0) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });
+    }
+    return { User: owner, Token: token, EffectiveRoles: effective };
+}
+/**
+ * Deletes every token whose expiration has passed. Returns the deleted count.
+ *
+ * Intended for cyclic execution from a worker ( see `rbac:token-delete-expired` ).
+ * Expired tokens are already refused by {@link validateToken}, so this is
+ * housekeeping, not enforcement.
+ */
+async function deleteExpiredTokens() {
+    // `whereNotNull` is not redundant next to `<=`: a null expiry means "never
+    // expires", and null comparisons must not sweep those rows away.
+    const expired = await AccessToken_js_1.AccessToken.where('ExpiresAt', '<=', luxon_1.DateTime.now()).whereNotNull('ExpiresAt');
+    for (const t of expired) {
+        await t.destroy();
+    }
+    return expired.length;
+}
+/**
+ * Updates `LastUsedAt`, throttled: writes only when the stamp is absent or
+ * older than `intervalSeconds`.
+ *
+ * Every authenticated request would otherwise write to the token row; the stamp
+ * only needs to be accurate enough to spot unused tokens. Callers may
+ * fire-and-forget.
+ *
+ * @param token - token to stamp
+ * @param intervalSeconds - minimum time between two writes
+ */
+async function touchToken(token, intervalSeconds) {
+    const now = luxon_1.DateTime.now();
+    if (token.LastUsedAt && token.LastUsedAt > now.minus({ seconds: intervalSeconds })) {
+        return;
+    }
+    token.LastUsedAt = now;
+    await token.update();
+}
+//# sourceMappingURL=actions.js.map

package/lib/cjs/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAuB;AACvB,iCAAiC;AACjC,wCAAqC;AACrC,wCAAmG;AACnG,0DAAkD;AAClD,0CAAqC;AACrC,oDAAgD;AAGhD,4DAAsD;AACtD,mDAAgE;AAChE,gDAA6I;AAE7I;;;;;;;;;;GAUG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,aAAb,aAAa,GAAb,aAAa,QAKxB;AAED;;GAEG;AACH,gBAAuB,KAA2B;IAChD,IAAI,gBAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,4BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,gBAAuB,IAA4B;IACjD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAW,EAAE,KAAe;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,sBAAsB,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,4BAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,gBAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,6BAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,sBAAsB,KAA2B;IAC3D,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,6BAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,yBAAyB,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,0BAA0B,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;GAYG;AACI,KAAK,wBAAwB,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,gBAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACI,KAAK;IACV,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,qBAAqB,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/cjs/cli/CreateToken.d.ts

@@ -0,0 +1,13 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+interface ICreateTokenOptions {
+    name: string;
+    roles: string;
+    expires?: string;
+}
+export declare class CreateToken extends CliCommand {
+    protected Log: Log;
+    execute(userIdOrUuid: string, options: ICreateTokenOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=CreateToken.d.ts.map

package/lib/cjs/cli/CreateToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateToken.d.ts","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AAKrE,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAKa,WAAY,SAAQ,UAAU;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtF;CACF"}

package/lib/cjs/cli/CreateToken.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateToken = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const luxon_1 = require("luxon");
+const actions_js_1 = require("../actions.js");
+let CreateToken = class CreateToken extends cli_1.CliCommand {
+    async execute(userIdOrUuid, options) {
+        try {
+            // Nil means the flag was not given at all - a token that never expires.
+            // Anything else, empty string included, is a value the user meant to be a
+            // date and must be validated: a truthiness check here would quietly turn
+            // `--expires ""` into an infinite token.
+            const expiresAt = options.expires === undefined || options.expires === null ? null : luxon_1.DateTime.fromISO(options.expires);
+            if (expiresAt && !expiresAt.isValid) {
+                this.Log.error(`Invalid --expires value: ${options.expires}`);
+                return;
+            }
+            const roles = options.roles
+                .split(',')
+                .map((r) => r.trim())
+                .filter((r) => r.length > 0);
+            const owner = /^\d+$/.test(userIdOrUuid) ? parseInt(userIdOrUuid, 10) : userIdOrUuid;
+            const { Token, Plaintext } = await (0, actions_js_1.createToken)(owner, options.name, roles, expiresAt);
+            this.Log.success(`Token created: ${Token.Uuid}`);
+            // The single moment the plaintext exists outside the caller's hands.
+            this.Log.success(`Token ( copy now, it will not be shown again ): ${Plaintext}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while creating token: ${e.message}`);
+        }
+    }
+};
+exports.CreateToken = CreateToken;
+__decorate([
+    (0, log_1.Logger)('rbac-http-token'),
+    __metadata("design:type", log_1.Log)
+], CreateToken.prototype, "Log", void 0);
+exports.CreateToken = CreateToken = __decorate([
+    (0, cli_1.Command)('rbac:token-create', 'Creates an access token for a user'),
+    (0, cli_1.Argument)('userIdOrUuid', true, 'numeric id or uuid of the owner'),
+    (0, cli_1.Option)('-n, --name <name>', true, 'token label'),
+    (0, cli_1.Option)('-r, --roles <roles>', true, 'token roles, comma separated, must be subset of owner roles'),
+    (0, cli_1.Option)('-e, --expires <expires>', false, 'ISO expiration instant; omit for a token that never expires')
+], CreateToken);
+//# sourceMappingURL=CreateToken.js.map

package/lib/cjs/cli/CreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAAqE;AACrE,iCAAiC;AAEjC,8CAA4C;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,gBAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;wCAAC;sBAFR,WAAW;IALvB,IAAA,aAAO,EAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,IAAA,cAAQ,EAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,IAAA,YAAM,EAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,IAAA,YAAM,EAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC;IAClG,IAAA,YAAM,EAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}

package/lib/cjs/cli/DeleteExpiredTokens.d.ts

@@ -0,0 +1,11 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+/**
+ * Intended for cyclic execution from a worker process
+ * ( eg. cron / task scheduler ) to keep the token table clean.
+ */
+export declare class DeleteExpiredTokens extends CliCommand {
+    protected Log: Log;
+    execute(): Promise<void>;
+}
+//# sourceMappingURL=DeleteExpiredTokens.d.ts.map

package/lib/cjs/cli/DeleteExpiredTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteExpiredTokens.d.ts","sourceRoot":"","sources":["../../../src/cli/DeleteExpiredTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAW,MAAM,cAAc,CAAC;AAInD;;;GAGG;AACH,qBACa,mBAAoB,SAAQ,UAAU;IAEjD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAOpC;CACF"}