@spinajs/rbac-http-token 2.0.507

package/lib/cjs/cli/DeleteExpiredTokens.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteExpiredTokens = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const actions_js_1 = require("../actions.js");
+/**
+ * Intended for cyclic execution from a worker process
+ * ( eg. cron / task scheduler ) to keep the token table clean.
+ */
+let DeleteExpiredTokens = class DeleteExpiredTokens extends cli_1.CliCommand {
+    async execute() {
+        try {
+            const count = await (0, actions_js_1.deleteExpiredTokens)();
+            this.Log.success(`Deleted ${count} expired token(s)`);
+        }
+        catch (e) {
+            this.Log.error(`Error while deleting expired tokens: ${e.message}`);
+        }
+    }
+};
+exports.DeleteExpiredTokens = DeleteExpiredTokens;
+__decorate([
+    (0, log_1.Logger)('rbac-http-token'),
+    __metadata("design:type", log_1.Log)
+], DeleteExpiredTokens.prototype, "Log", void 0);
+exports.DeleteExpiredTokens = DeleteExpiredTokens = __decorate([
+    (0, cli_1.Command)('rbac:token-delete-expired', 'Deletes all expired access tokens')
+], DeleteExpiredTokens);
+//# sourceMappingURL=DeleteExpiredTokens.js.map

package/lib/cjs/cli/DeleteExpiredTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteExpiredTokens.js","sourceRoot":"","sources":["../../../src/cli/DeleteExpiredTokens.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAAmD;AAEnD,8CAAoD;AAEpD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAU;IAI1C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAmB,GAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,mBAAmB,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAyC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;CACF,CAAA;;AAVW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;gDAAC;8BAFR,mBAAmB;IAD/B,IAAA,aAAO,EAAC,2BAA2B,EAAE,mCAAmC,CAAC;GAC7D,mBAAmB,CAY/B"}

package/lib/cjs/cli/DeleteToken.d.ts

@@ -0,0 +1,7 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class DeleteToken extends CliCommand {
+    protected Log: Log;
+    execute(uuid: string): Promise<void>;
+}
+//# sourceMappingURL=DeleteToken.d.ts.map

package/lib/cjs/cli/DeleteToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteToken.d.ts","sourceRoot":"","sources":["../../../src/cli/DeleteToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAEa,WAAY,SAAQ,UAAU;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhD;CACF"}

package/lib/cjs/cli/DeleteToken.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteToken = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const actions_js_1 = require("../actions.js");
+let DeleteToken = class DeleteToken extends cli_1.CliCommand {
+    async execute(uuid) {
+        try {
+            await (0, actions_js_1.deleteToken)(uuid);
+            this.Log.success(`Token ${uuid} deleted`);
+        }
+        catch (e) {
+            this.Log.error(`Error while deleting token ${uuid}: ${e.message}`);
+        }
+    }
+};
+exports.DeleteToken = DeleteToken;
+__decorate([
+    (0, log_1.Logger)('rbac-http-token'),
+    __metadata("design:type", log_1.Log)
+], DeleteToken.prototype, "Log", void 0);
+exports.DeleteToken = DeleteToken = __decorate([
+    (0, cli_1.Command)('rbac:token-delete', 'Deletes ( revokes ) an access token'),
+    (0, cli_1.Argument)('uuid', true, 'token uuid')
+], DeleteToken);
+//# sourceMappingURL=DeleteToken.js.map

package/lib/cjs/cli/DeleteToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteToken.js","sourceRoot":"","sources":["../../../src/cli/DeleteToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAA6D;AAE7D,8CAA4C;AAIrC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,gBAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,IAAY;QAC/B,IAAI,CAAC;YACH,MAAM,IAAA,wBAAW,EAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;CACF,CAAA;;AAVW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;wCAAC;sBAFR,WAAW;IAFvB,IAAA,aAAO,EAAC,mBAAmB,EAAE,qCAAqC,CAAC;IACnE,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;GACxB,WAAW,CAYvB"}

package/lib/cjs/cli/GrantTokenRole.d.ts

@@ -0,0 +1,7 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class GrantTokenRole extends CliCommand {
+    protected Log: Log;
+    execute(uuid: string, role: string): Promise<void>;
+}
+//# sourceMappingURL=GrantTokenRole.d.ts.map

package/lib/cjs/cli/GrantTokenRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantTokenRole.d.ts","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAGa,cAAe,SAAQ,UAAU;IAE5C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;CACF"}

package/lib/cjs/cli/GrantTokenRole.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantTokenRole = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const actions_js_1 = require("../actions.js");
+let GrantTokenRole = class GrantTokenRole extends cli_1.CliCommand {
+    async execute(uuid, role) {
+        try {
+            await (0, actions_js_1.grantTokenRole)(uuid, role);
+            this.Log.success(`Role ${role} granted to token ${uuid}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while granting role ${role} to token ${uuid}: ${e.message}`);
+        }
+    }
+};
+exports.GrantTokenRole = GrantTokenRole;
+__decorate([
+    (0, log_1.Logger)('rbac-http-token'),
+    __metadata("design:type", log_1.Log)
+], GrantTokenRole.prototype, "Log", void 0);
+exports.GrantTokenRole = GrantTokenRole = __decorate([
+    (0, cli_1.Command)('rbac:token-grant', 'Grants a role to an access token'),
+    (0, cli_1.Argument)('uuid', true, 'token uuid'),
+    (0, cli_1.Argument)('role', true, 'role to grant, must be held by token owner')
+], GrantTokenRole);
+//# sourceMappingURL=GrantTokenRole.js.map

package/lib/cjs/cli/GrantTokenRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAA6D;AAE7D,8CAA+C;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,IAAA,2BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;;AAVW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;2CAAC;yBAFR,cAAc;IAH1B,IAAA,aAAO,EAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;GACxD,cAAc,CAY1B"}

package/lib/cjs/cli/RevokeTokenRole.d.ts

@@ -0,0 +1,12 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class RevokeTokenRole extends CliCommand {
+    protected Log: Log;
+    /**
+     * Refusals arrive as thrown errors ( eg. revoking a token's last role ) and
+     * are reported on the error channel like any other failure - the row is left
+     * exactly as it was.
+     */
+    execute(uuid: string, role: string): Promise<void>;
+}
+//# sourceMappingURL=RevokeTokenRole.d.ts.map

package/lib/cjs/cli/RevokeTokenRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeTokenRole.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeTokenRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAGa,eAAgB,SAAQ,UAAU;IAE7C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB;;;;OAIG;IACU,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;CACF"}

package/lib/cjs/cli/RevokeTokenRole.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevokeTokenRole = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const actions_js_1 = require("../actions.js");
+let RevokeTokenRole = class RevokeTokenRole extends cli_1.CliCommand {
+    /**
+     * Refusals arrive as thrown errors ( eg. revoking a token's last role ) and
+     * are reported on the error channel like any other failure - the row is left
+     * exactly as it was.
+     */
+    async execute(uuid, role) {
+        try {
+            await (0, actions_js_1.revokeTokenRole)(uuid, role);
+            this.Log.success(`Role ${role} revoked from token ${uuid}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while revoking role ${role} from token ${uuid}: ${e.message}`);
+        }
+    }
+};
+exports.RevokeTokenRole = RevokeTokenRole;
+__decorate([
+    (0, log_1.Logger)('rbac-http-token'),
+    __metadata("design:type", log_1.Log)
+], RevokeTokenRole.prototype, "Log", void 0);
+exports.RevokeTokenRole = RevokeTokenRole = __decorate([
+    (0, cli_1.Command)('rbac:token-revoke', 'Revokes a role from an access token'),
+    (0, cli_1.Argument)('uuid', true, 'token uuid'),
+    (0, cli_1.Argument)('role', true, 'role to revoke')
+], RevokeTokenRole);
+//# sourceMappingURL=RevokeTokenRole.js.map

package/lib/cjs/cli/RevokeTokenRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeTokenRole.js","sourceRoot":"","sources":["../../../src/cli/RevokeTokenRole.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAA6D;AAE7D,8CAAgD;AAKzC,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,gBAAU;IAI7C;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,IAAA,4BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,eAAe,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;CACF,CAAA;;AAfW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;4CAAC;0BAFR,eAAe;IAH3B,IAAA,aAAO,EAAC,mBAAmB,EAAE,qCAAqC,CAAC;IACnE,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC;GAC5B,eAAe,CAiB3B"}

package/lib/cjs/config/rbac-http-token.d.ts

@@ -0,0 +1,71 @@
+declare const rbacHttpToken: {
+    system: {
+        dirs: {
+            cli: string[];
+            controllers: string[];
+        };
+    };
+    queue: {
+        routing: {
+            AccessTokenCreated: {
+                connection: string;
+            };
+            AccessTokenDeleted: {
+                connection: string;
+            };
+            AccessTokenRoleGranted: {
+                connection: string;
+            };
+            AccessTokenRoleRevoked: {
+                connection: string;
+            };
+        };
+    };
+    rbac: {
+        token: {
+            /**
+             * Token generation algorithm. Swap for your own implementation of
+             * AccessTokenGenerationProvider registered under this name.
+             */
+            generation: {
+                service: string;
+            };
+            /**
+             * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
+             */
+            prefix: string;
+            /**
+             * Random bytes per token ( 32 = 256 bit entropy ).
+             */
+            length: number;
+            /**
+             * Fallback header checked when no `Authorization: Bearer` is present.
+             */
+            headerName: string;
+            /**
+             * Seconds between LastUsedAt writes for a busy token.
+             */
+            lastUsedUpdateInterval: number;
+        };
+        grants: {
+            user: {
+                'user.tokens': {
+                    'create:own': string[];
+                    'read:own': string[];
+                    'update:own': string[];
+                    'delete:own': string[];
+                };
+            };
+            'admin.users': {
+                'user.tokens': {
+                    'create:any': string[];
+                    'read:any': string[];
+                    'update:any': string[];
+                    'delete:any': string[];
+                };
+            };
+        };
+    };
+};
+export default rbacHttpToken;
+//# sourceMappingURL=rbac-http-token.d.ts.map

package/lib/cjs/config/rbac-http-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}

package/lib/cjs/config/rbac-http-token.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'rbac-http-token', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'rbac-http-token', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+const rbacHttpToken = {
+    system: {
+        dirs: {
+            // CLI commands and controllers are found by a filesystem scan
+            // ( `@ListFromFiles` ), so without these entries the shipped commands and
+            // the AccessToken controller are unreachable in a consuming app.
+            cli: [...dir('cli')],
+            controllers: [...dir('controllers')],
+            // `migrations` is DELIBERATELY not shipped here, and neither is `models`.
+            //
+            // Package configs merge into an app's config by ARRAY CONCAT, and
+            // `FilesystemMigrationSource` treats a non-empty `system.dirs.migrations`
+            // as "the operator configured the scan set": it then REPLACES the build
+            // layout defaults instead of adding to them, and turns a failed `.js`
+            // import from a warning into a throw ( `orm/src/migration-sources.ts`,
+            // and the docblock on `orm/src/config/orm.ts` which ships the key empty
+            // for exactly this reason ). A single line here would therefore silently
+            // switch off migration discovery in every application that installs this
+            // package. `RbacHttpTokenInitial_...` needs no scan anyway - it carries
+            // `@Migration`, is exported from the package index, and is picked up from
+            // the DI registry by `DiRegistryMigrationSource`. `@spinajs/rbac` ships
+            // `cli` only for the same reason.
+            //
+            // Nothing in the framework reads `system.dirs.models` - models register
+            // themselves through the `@Model` decorator when their file is imported.
+        },
+    },
+    queue: {
+        // All events emitted by this package go to the black hole connection
+        // declared by @spinajs/rbac ( `rbac-user-empty-queue` ). Without the
+        // routing they would fall back to the application's DEFAULT connection -
+        // a real broker - and every token operation would publish to it.
+        routing: {
+            AccessTokenCreated: { connection: 'rbac-user-empty-queue' },
+            AccessTokenDeleted: { connection: 'rbac-user-empty-queue' },
+            AccessTokenRoleGranted: { connection: 'rbac-user-empty-queue' },
+            AccessTokenRoleRevoked: { connection: 'rbac-user-empty-queue' },
+        },
+    },
+    rbac: {
+        token: {
+            /**
+             * Token generation algorithm. Swap for your own implementation of
+             * AccessTokenGenerationProvider registered under this name.
+             */
+            generation: {
+                service: 'SecureRandomTokenProvider',
+            },
+            /**
+             * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
+             */
+            prefix: 'spt_',
+            /**
+             * Random bytes per token ( 32 = 256 bit entropy ).
+             */
+            length: 32,
+            /**
+             * Fallback header checked when no `Authorization: Bearer` is present.
+             */
+            headerName: 'x-api-key',
+            /**
+             * Seconds between LastUsedAt writes for a busy token.
+             */
+            lastUsedUpdateInterval: 60,
+        },
+        grants: {
+            user: {
+                'user.tokens': { 'create:own': ['*'], 'read:own': ['*'], 'update:own': ['*'], 'delete:own': ['*'] },
+            },
+            // RESERVED - nothing shipped in this package enforces or consumes these.
+            //
+            // `AccessTokenController` is self-service by construction: every one of
+            // its routes declares an `*Own` permission and additionally constrains
+            // its query by the caller's id ( `own()` ), so an `*:any` grant changes
+            // nothing about what that controller lets through. The entry is here so
+            // the role's grant map is complete ahead of an admin-scope controller -
+            // "list / revoke the tokens of any user" is the obvious next addition -
+            // and so an application that writes such a controller itself finds the
+            // grants already declared under the resource name it must use.
+            'admin.users': {
+                'user.tokens': { 'create:any': ['*'], 'read:any': ['*'], 'update:any': ['*'], 'delete:any': ['*'] },
+            },
+        },
+    },
+};
+exports.default = rbacHttpToken;
+//# sourceMappingURL=rbac-http-token.js.map

package/lib/cjs/config/rbac-http-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;kBAEa,aAAa"}

package/lib/cjs/controllers/AccessTokenController.d.ts

@@ -0,0 +1,139 @@
+import { BadRequestResponse, BaseController, NotFound, Ok } from '@spinajs/http';
+import { User as UserModel } from '@spinajs/rbac';
+import { AccessToken } from '../models/AccessToken.js';
+import { CreateTokenDto } from '../dto/create-token-dto.js';
+/**
+ * Self-service management of own access tokens.
+ *
+ * SELF-service in the strict sense: the caller must be the account owner,
+ * present in person. Two ways of acting *as* somebody are refused outright -
+ * an access token ( which must never mint another token ) and an impersonated
+ * session ( which must never mint a credential that outlives it ). Every query
+ * is additionally constrained by the calling user's id, so a foreign uuid is
+ * simply not found.
+ *
+ * WIRING - the decorator layout below is load bearing. The two guards share ONE
+ * `@Policy([...])` group so they are ANDed; splitting them into two `@Policy()`
+ * calls would OR them and each would become optional. And do NOT add a class
+ * level `@Policy(RbacPolicy)` alongside:
+ *
+ * `@spinajs/http` combines policies at three levels ( see `createPolicyGate` in
+ * `http/src/route-builder.ts` ): AND inside one `@Policy()` group, OR between
+ * the groups declared at one scope, AND between the controller scope and the
+ * route scope. `@Permission()` already pushes `RbacPolicy` as a group on the
+ * ROUTE ( `rbac-http/src/decorators.ts` ), so:
+ *
+ *   - controller scope holds exactly ONE group,
+ *     `[NoTokenAuthPolicy, NoImpersonationPolicy]`. A lone group cannot be ORed
+ *     away, so both are a hard requirement of EVERY route on this controller,
+ *     including any route added later.
+ *   - route scope holds `[RbacPolicy]` from `@Permission`, which demands an
+ *     authorized session AND the declared grant.
+ *
+ * Adding `@Policy(RbacPolicy)` at class level would make the controller scope
+ * `[NoTokenAuthPolicy, NoImpersonationPolicy] OR [RbacPolicy]`, and satisfying
+ * `RbacPolicy` alone would then discharge the whole scope - both invariants
+ * would rest on nothing but RbacPolicy's own session check, which does not look
+ * at impersonation at all.
+ *
+ * @tags AccessTokens
+ */
+export declare class AccessTokenController extends BaseController {
+    /**
+     * List own access tokens
+     * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
+     * dehydrated rows carry the uuid, label, roles and timestamps only.
+     * @security cookieAuth
+     * @response 200 Own tokens
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    list(user: UserModel): Promise<Ok<unknown>>;
+    /**
+     * Create an access token
+     * The plaintext appears in this response only and cannot be retrieved again.
+     * Roles must be a subset of the caller's own roles.
+     * @security cookieAuth
+     * @response 200 Token created, `Plaintext` returned once
+     * @response 400 Requested roles are not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    create(user: UserModel, dto: CreateTokenDto): Promise<Ok<unknown> | BadRequestResponse>;
+    /**
+     * Delete ( revoke ) an own token
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @response 200 Token deleted
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    delete(user: UserModel, uuid: string): Promise<Ok | NotFound>;
+    /**
+     * Grant a role to an own token
+     * The role must be held by the caller - a token can never carry more than its
+     * owner does.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to grant
+     * @response 200 Updated token
+     * @response 400 Role is not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    grantRole(user: UserModel, uuid: string, role: string): Promise<Ok<unknown> | NotFound | BadRequestResponse>;
+    /**
+     * Revoke a role from an own token
+     * A token must keep at least one role; dropping the last one is refused with
+     * 400 - deleting the token is the way to revoke it entirely.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to revoke
+     * @response 200 Updated token
+     * @response 400 Cannot revoke the token's last role
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    revokeRole(user: UserModel, uuid: string, role: string): Promise<Ok<unknown> | NotFound | BadRequestResponse>;
+    /**
+     * Resolves a token by uuid WITHIN the caller's own tokens - the ownership
+     * boundary of this whole controller.
+     */
+    protected own(user: UserModel, uuid: string): Promise<AccessToken | undefined>;
+    /**
+     * Wire shape of one token: the dehydrated row, with timestamps as ISO
+     * instants and `Roles` put back as a real array.
+     *
+     * `dehydrate()` runs every column through its converter's `toDB` direction -
+     * the STORAGE encoding, which is not the API contract in two places:
+     *
+     *   - `dateTimeFormat: 'iso'` is what turns `CreatedAt` / `ExpiresAt` /
+     *     `LastUsedAt` into offset-carrying ISO strings. Without it the sql
+     *     converter emits its driver format ( `"2026-08-11 10:00:00"` ), which
+     *     names no offset at all, so a client has to guess the zone. Every other
+     *     user-bearing response in the repo dehydrates with this option - see
+     *     `rbac-http-user/src/controllers/UserController.ts` - and a plain
+     *     `toJSON()` is exactly `dehydrate()` with the option missing.
+     *   - `@Set()`'s converter joins the role list into `"user,admin"`. Left
+     *     alone, `Roles` reaches clients as a string that only looks like a list,
+     *     which no generated client parses back.
+     *
+     * `@Hidden()` columns ( `Token`, `Id` ) are dropped by `dehydrate` itself and
+     * `user_id` is skipped as the `User` relation's foreign key, so the hash still
+     * never leaves here.
+     */
+    protected toWire(token: AccessToken): Record<string, unknown>;
+    /**
+     * Turns the actions layer's role refusals into a 400.
+     *
+     * `ErrorCode` has no entry in the http error map, so an uncaught one leaves as
+     * a 500 - and "you asked for a role you do not have" / "a token must keep one
+     * role" are the caller's mistakes, not the server's. Anything else is rethrown
+     * untouched so a genuine failure still reaches the error handler.
+     */
+    protected roleError(err: unknown): BadRequestResponse;
+}
+//# sourceMappingURL=AccessTokenController.d.ts.map

package/lib/cjs/controllers/AccessTokenController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;OAYG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}