@spinajs/rbac-http-token 2.0.507

package/lib/cjs/models/AccessToken.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessToken = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+const uuid_1 = require("uuid");
+const util_1 = require("@spinajs/util");
+/**
+ * Personal access token. Only the SHA-256 hash of the token is stored;
+ * the plaintext is returned once at creation and cannot be recovered.
+ */
+let AccessToken = class AccessToken extends orm_1.ModelBase {
+    constructor(data) {
+        super(data);
+        this.Uuid = (0, util_1._check_arg)((0, util_1._default)((0, uuid_1.v4)()))(this.Uuid, 'uuid');
+    }
+    /**
+     * True when the token carries an expiration in the past.
+     */
+    get IsExpired() {
+        return !!this.ExpiresAt && this.ExpiresAt <= luxon_1.DateTime.now();
+    }
+};
+exports.AccessToken = AccessToken;
+__decorate([
+    (0, orm_1.Primary)(),
+    (0, orm_1.Hidden)(),
+    __metadata("design:type", Number)
+], AccessToken.prototype, "Id", void 0);
+__decorate([
+    (0, orm_1.Hidden)(),
+    __metadata("design:type", String)
+], AccessToken.prototype, "Token", void 0);
+__decorate([
+    (0, orm_1.Set)(),
+    __metadata("design:type", Array)
+], AccessToken.prototype, "Roles", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AccessToken.prototype, "ExpiresAt", void 0);
+__decorate([
+    (0, orm_1.CreatedAt)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AccessToken.prototype, "CreatedAt", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AccessToken.prototype, "LastUsedAt", void 0);
+__decorate([
+    (0, orm_1.Hidden)(),
+    (0, orm_1.BelongsTo)('User'),
+    __metadata("design:type", orm_1.SingleRelation)
+], AccessToken.prototype, "User", void 0);
+__decorate([
+    (0, orm_1.Hidden)(),
+    __metadata("design:type", Number)
+], AccessToken.prototype, "user_id", void 0);
+exports.AccessToken = AccessToken = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('rbac_access_tokens'),
+    __metadata("design:paramtypes", [Object])
+], AccessToken);
+//# sourceMappingURL=AccessToken.js.map

package/lib/cjs/models/AccessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAwI;AAExI,iCAAiC;AACjC,+BAAoC;AACpC,wCAAqD;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,eAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IA8DD;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;;AA7DQ;IAFN,IAAA,aAAO,GAAE;IACT,IAAA,YAAM,GAAE;;uCACU;AAiBZ;IADN,IAAA,YAAM,GAAE;;0CACa;AAOf;IADN,IAAA,SAAG,GAAE;;0CACkB;AAWjB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;AAGrB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;8CAAC;AAQrB;IADN,IAAA,cAAE,GAAE;8BACe,gBAAQ;+CAAC;AAItB;IAFN,IAAA,YAAM,GAAE;IACR,IAAA,eAAS,EAAC,MAAM,CAAC;8BACJ,oBAAc;yCAAO;AAG5B;IADN,IAAA,YAAM,GAAE;;4CACe;sBAhEb,WAAW;IAFvB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,oBAAoB,CAAC;;GACf,WAAW,CAwEvB"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/policies/NoImpersonationPolicy.d.ts

@@ -0,0 +1,28 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Rejects requests made from an impersonated session.
+ *
+ * Impersonation is a *supervised, revocable* act: an administrator borrows a
+ * user's view of the application and the borrowing ends when the impersonation
+ * does. An access token is the opposite - a bearer credential that outlives the
+ * session that minted it, carries the victim's roles, and is invisible in the
+ * impersonator's own audit trail. Letting a credential-issuing route run while
+ * impersonating therefore turns a temporary, reversible grant into a permanent
+ * one that the account owner never consented to and cannot see.
+ *
+ * `RbacMiddleware` puts the impersonation TARGET in `req.storage.User` and the
+ * original administrator in `req.storage.Impersonator`
+ * ( `rbac-http/src/middlewares.ts` ), so every ownership and permission check
+ * downstream already reads as the victim - this policy is the only thing that
+ * can tell the two situations apart.
+ *
+ * Same reasoning as a password change demanding the CURRENT password: an
+ * operation that hands out lasting credentials has to be performed by the
+ * account owner, not on their behalf.
+ */
+export declare class NoImpersonationPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, _action: IRoute, _instance: IController): Promise<void>;
+}
+//# sourceMappingURL=NoImpersonationPolicy.d.ts.map

package/lib/cjs/policies/NoImpersonationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoImpersonationPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/NoImpersonationPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQrF,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IAC5C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;CACF"}

package/lib/cjs/policies/NoImpersonationPolicy.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoImpersonationPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+// Same side-effect import both siblings carry. `req.storage.Impersonator` comes
+// from `@spinajs/rbac-http`'s augmentation of `IActionLocalStoregeContext`,
+// which this package's `interfaces.ts` pulls into the program ( type-only ).
+// Without it the field only type-checks when something ELSE in the compilation
+// happened to drag that augmentation in - fine today, silently broken the day
+// this file is compiled on its own.
+require("../interfaces.js");
+/**
+ * Rejects requests made from an impersonated session.
+ *
+ * Impersonation is a *supervised, revocable* act: an administrator borrows a
+ * user's view of the application and the borrowing ends when the impersonation
+ * does. An access token is the opposite - a bearer credential that outlives the
+ * session that minted it, carries the victim's roles, and is invisible in the
+ * impersonator's own audit trail. Letting a credential-issuing route run while
+ * impersonating therefore turns a temporary, reversible grant into a permanent
+ * one that the account owner never consented to and cannot see.
+ *
+ * `RbacMiddleware` puts the impersonation TARGET in `req.storage.User` and the
+ * original administrator in `req.storage.Impersonator`
+ * ( `rbac-http/src/middlewares.ts` ), so every ownership and permission check
+ * downstream already reads as the victim - this policy is the only thing that
+ * can tell the two situations apart.
+ *
+ * Same reasoning as a password change demanding the CURRENT password: an
+ * operation that hands out lasting credentials has to be performed by the
+ * account owner, not on their behalf.
+ */
+class NoImpersonationPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, _action, _instance) {
+        if (req.storage?.Impersonator) {
+            throw new exceptions_1.Forbidden('this route cannot be used while impersonating another user');
+        }
+    }
+}
+exports.NoImpersonationPolicy = NoImpersonationPolicy;
+//# sourceMappingURL=NoImpersonationPolicy.js.map

package/lib/cjs/policies/NoImpersonationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoImpersonationPolicy.js","sourceRoot":"","sources":["../../../src/policies/NoImpersonationPolicy.ts"],"names":[],"mappings":";;;AAAA,wCAAqF;AACrF,oDAAgD;AAChD,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,oCAAoC;AACpC,4BAA0B;AAE1B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,2BAAmC,SAAQ,iBAAU;IAC5C,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,OAAe,EAAE,SAAsB;QACzE,IAAI,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,sBAAS,CAAC,4DAA4D,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF"}

package/lib/cjs/policies/NoTokenAuthPolicy.d.ts

@@ -0,0 +1,12 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Rejects requests authenticated with an access token. Applied to the token
+ * management API so a token can never be used to mint or manage tokens
+ * ( no self-replication ). Session-authenticated requests pass through.
+ */
+export declare class NoTokenAuthPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, _action: IRoute, _instance: IController): Promise<void>;
+}
+//# sourceMappingURL=NoTokenAuthPolicy.d.ts.map

package/lib/cjs/policies/NoTokenAuthPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoTokenAuthPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/NoTokenAuthPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IACxC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;CACF"}

package/lib/cjs/policies/NoTokenAuthPolicy.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoTokenAuthPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+// Brings the `req.storage.TokenAuth` module augmentation into the program.
+require("../interfaces.js");
+/**
+ * Rejects requests authenticated with an access token. Applied to the token
+ * management API so a token can never be used to mint or manage tokens
+ * ( no self-replication ). Session-authenticated requests pass through.
+ */
+class NoTokenAuthPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, _action, _instance) {
+        if (req.storage?.TokenAuth) {
+            throw new exceptions_1.Forbidden('access tokens cannot be used on this route');
+        }
+    }
+}
+exports.NoTokenAuthPolicy = NoTokenAuthPolicy;
+//# sourceMappingURL=NoTokenAuthPolicy.js.map

package/lib/cjs/policies/NoTokenAuthPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoTokenAuthPolicy.js","sourceRoot":"","sources":["../../../src/policies/NoTokenAuthPolicy.ts"],"names":[],"mappings":";;;AAAA,wCAAqF;AACrF,oDAAgD;AAChD,2EAA2E;AAC3E,4BAA0B;AAE1B;;;;GAIG;AACH,uBAA+B,SAAQ,iBAAU;IACxC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,OAAe,EAAE,SAAsB;QACzE,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}

package/lib/cjs/policies/TokenPolicy.d.ts

@@ -0,0 +1,49 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Route requires authentication with an access token AND the token's
+ * effective roles must satisfy the route's @Resource/@Permission grants.
+ *
+ * Mirrors RbacPolicy's grant enforcement, but for token-authenticated
+ * requests ( which carry no session ).
+ *
+ * WIRING - do NOT pass this policy to @Permission's `also` parameter:
+ *
+ *   @Permission(['readOwn'], TokenPolicy)   // BROKEN - always 401
+ *
+ * `@Permission` unconditionally bundles RbacPolicy together with every `also`
+ * policy into the SAME policy group ( rbac-http/src/decorators.ts ), and
+ * policies inside one group are combined with AND. RbacPolicy demands an
+ * authorized session, which a token-authenticated request never has, so the
+ * pair can never both pass and the route is permanently unreachable by token.
+ *
+ * Declare it as its OWN group at the ROUTE scope instead - groups of ONE scope
+ * are ORed, so a token request satisfies the TokenPolicy group while a session
+ * request satisfies the RbacPolicy group:
+ *
+ *   @Get('data')
+ *   @Permission(['readOwn'])      // the permission metadata + RbacPolicy group
+ *   @Policy(TokenPolicy)          // METHOD level - a second route scope group
+ *
+ * The placement is not free-standing: a CLASS level `@Policy(TokenPolicy)` goes
+ * to the CONTROLLER scope, and the two scopes are ANDed - it would then have to
+ * hold TOGETHER with the route's RbacPolicy group, which is exactly the broken
+ * combination above. Only a method level declaration lands in the same scope as
+ * `@Permission` and gets ORed with it.
+ *
+ * Writing `@Policy(TokenPolicy)` BELOW `@Permission` is deliberate too.
+ * Decorators apply bottom up, so this one is pushed first, and when no group
+ * holds `createPolicyGate` reports the first rejection in declaration order: a
+ * token that authenticated but lacks the grant then gets this policy's 403
+ * instead of RbacPolicy's misleading "user not logged" 401.
+ *
+ * The `@Permission` line is still required even with `@Policy(TokenPolicy)`:
+ * this policy reads the same route permission metadata, and a route without it
+ * silently inherits the controller-level default `['readOwn']` rather than
+ * failing loudly.
+ */
+export declare class TokenPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
+}
+//# sourceMappingURL=TokenPolicy.d.ts.map

package/lib/cjs/policies/TokenPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/TokenPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAMlG,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,WAAY,SAAQ,UAAU;IAClC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxF;CACF"}

package/lib/cjs/policies/TokenPolicy.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+const rbac_http_1 = require("@spinajs/rbac-http");
+// Brings the `req.storage.TokenAuth` module augmentation into the program.
+// Same side-effect import the middleware uses; without it this file compiles
+// on its own against an un-augmented IActionLocalStoregeContext.
+require("../interfaces.js");
+/**
+ * Route requires authentication with an access token AND the token's
+ * effective roles must satisfy the route's @Resource/@Permission grants.
+ *
+ * Mirrors RbacPolicy's grant enforcement, but for token-authenticated
+ * requests ( which carry no session ).
+ *
+ * WIRING - do NOT pass this policy to @Permission's `also` parameter:
+ *
+ *   @Permission(['readOwn'], TokenPolicy)   // BROKEN - always 401
+ *
+ * `@Permission` unconditionally bundles RbacPolicy together with every `also`
+ * policy into the SAME policy group ( rbac-http/src/decorators.ts ), and
+ * policies inside one group are combined with AND. RbacPolicy demands an
+ * authorized session, which a token-authenticated request never has, so the
+ * pair can never both pass and the route is permanently unreachable by token.
+ *
+ * Declare it as its OWN group at the ROUTE scope instead - groups of ONE scope
+ * are ORed, so a token request satisfies the TokenPolicy group while a session
+ * request satisfies the RbacPolicy group:
+ *
+ *   @Get('data')
+ *   @Permission(['readOwn'])      // the permission metadata + RbacPolicy group
+ *   @Policy(TokenPolicy)          // METHOD level - a second route scope group
+ *
+ * The placement is not free-standing: a CLASS level `@Policy(TokenPolicy)` goes
+ * to the CONTROLLER scope, and the two scopes are ANDed - it would then have to
+ * hold TOGETHER with the route's RbacPolicy group, which is exactly the broken
+ * combination above. Only a method level declaration lands in the same scope as
+ * `@Permission` and gets ORed with it.
+ *
+ * Writing `@Policy(TokenPolicy)` BELOW `@Permission` is deliberate too.
+ * Decorators apply bottom up, so this one is pushed first, and when no group
+ * holds `createPolicyGate` reports the first rejection in declaration order: a
+ * token that authenticated but lacks the grant then gets this policy's 403
+ * instead of RbacPolicy's misleading "user not logged" 401.
+ *
+ * The `@Permission` line is still required even with `@Policy(TokenPolicy)`:
+ * this policy reads the same route permission metadata, and a route without it
+ * silently inherits the controller-level default `['readOwn']` rather than
+ * failing loudly.
+ */
+class TokenPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, action, instance) {
+        if (!req.storage || !req.storage.TokenAuth || !req.storage.User) {
+            throw new exceptions_1.AuthenticationFailed('access token required');
+        }
+        const descriptor = Reflect.getMetadata(rbac_http_1.ACL_CONTROLLER_DESCRIPTOR, instance);
+        // Guard BEFORE dereferencing `.Routes`: a route decorated with this policy
+        // but no @Resource/@Permission must produce the descriptive server error,
+        // not a raw TypeError 500.
+        if (!descriptor || !descriptor.Permission || descriptor.Permission.length === 0) {
+            throw new http_1.ServerError('no route permission or resources assigned');
+        }
+        let permission = descriptor.Permission ?? [];
+        if (descriptor.Routes.has(String(action.Method))) {
+            permission = descriptor.Routes.get(String(action.Method)).Permission ?? [];
+        }
+        if (!permission.some((p) => (0, rbac_http_1.checkRoutePermission)(req, descriptor.Resource, p)?.granted)) {
+            const effective = req.storage.ActiveRole ?? req.storage.User.Role;
+            throw new exceptions_1.Forbidden(`token role(s) ${effective} do not have permission ${permission} for resource ${descriptor.Resource}`);
+        }
+    }
+}
+exports.TokenPolicy = TokenPolicy;
+//# sourceMappingURL=TokenPolicy.js.map

package/lib/cjs/policies/TokenPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenPolicy.js","sourceRoot":"","sources":["../../../src/policies/TokenPolicy.ts"],"names":[],"mappings":";;;AAAA,wCAAkG;AAClG,oDAAsE;AACtE,kDAAsG;AACtG,2EAA2E;AAC3E,6EAA6E;AAC7E,iEAAiE;AACjE,4BAA0B;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,iBAAyB,SAAQ,iBAAU;IAClC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChE,MAAM,IAAI,iCAAoB,CAAC,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,qCAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,2EAA2E;QAC3E,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gCAAoB,EAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,sBAAS,CAAC,iBAAiB,SAAS,2BAA2B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;CACF"}

package/lib/mjs/actions.d.ts

@@ -0,0 +1,119 @@
+import { DateTime } from 'luxon';
+import { User } from '@spinajs/rbac';
+import { AccessToken } from './models/AccessToken.js';
+/**
+ * Failure codes carried by every {@link ErrorCode} this module throws.
+ *
+ * Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
+ * `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
+ * from their package index. A downstream barrel that does
+ * `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
+ * would collide on the NAME while the members underneath carry different
+ * numeric values - the kind of clash that resolves silently in a barrel and
+ * makes an `err.code === E_CODES.X` comparison answer the wrong question.
+ */
+export declare enum E_TOKEN_CODES {
+    E_TOKEN_NOT_FOUND = 0,
+    E_TOKEN_EXPIRED = 1,
+    E_TOKEN_OWNER_INVALID = 2,
+    E_TOKEN_ROLE_NOT_ALLOWED = 3
+}
+/**
+ * Resolves an AccessToken from an instance or its uuid.
+ */
+export declare function _token(token: AccessToken | string): () => Promise<AccessToken>;
+/**
+ * Resolves the owning user by instance, numeric id or uuid, with metadata
+ * populated ( needed for IsBanned checks downstream ).
+ */
+export declare function _owner(user: User | number | string): () => Promise<User>;
+/**
+ * Creates a new access token for a user.
+ *
+ * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
+ * null means the token never expires. The plaintext is returned once and
+ * never persisted - only its hash is stored.
+ *
+ * @param user - owner: {@link User} instance, numeric id or uuid
+ * @param name - human readable label
+ * @param roles - roles carried by the token, subset of the owner's roles
+ * @param expiresAt - absolute expiration, or null for a token that never expires
+ */
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+    Token: AccessToken;
+    Plaintext: string;
+}>;
+/**
+ * Permanently deletes ( revokes ) a token.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ */
+export declare function deleteToken(token: AccessToken | string): Promise<void>;
+/**
+ * Adds a role to a token. The role must be held by the token owner.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to grant
+ */
+export declare function grantTokenRole(token: AccessToken | string, role: string): Promise<AccessToken>;
+/**
+ * Removes a role from a token.
+ *
+ * Not symmetric with {@link grantTokenRole}: revoking only ever narrows what a
+ * token may do, so it needs no owner check.
+ *
+ * A token must always keep at least one role - revoking the last one is
+ * refused, and full revocation means deleting the token. Beyond being
+ * meaningless ( a role-less token authorises nothing ), an empty list is
+ * actively corrupting: `@Set()` columns round-trip through `SqlSetConverter`,
+ * which stores `[]` as `''` and reads `''` back as `['']`. That phantom empty
+ * role then survives every later grant, permanently.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to revoke
+ * @throws ErrorCode E_TOKEN_ROLE_NOT_ALLOWED when `role` is the token's last role
+ */
+export declare function revokeTokenRole(token: AccessToken | string, role: string): Promise<AccessToken>;
+export interface ITokenValidationResult {
+    User: User;
+    Token: AccessToken;
+    /**
+     * Token roles that the owner still holds. Permission checks run with these.
+     */
+    EffectiveRoles: string[];
+}
+/**
+ * Validates a presented plaintext token.
+ *
+ * Checks, in order: token exists ( by hash ), token not expired, owner active /
+ * not soft-deleted / not banned, effective role intersection non-empty.
+ * Throws ErrorCode with {@link E_TOKEN_CODES} on every failure path.
+ *
+ * The owner checks are spelled out instead of reusing the `isActiveUser` query
+ * scope on purpose - a single "no such active user" result cannot say WHY, and
+ * callers need to tell an expired token from a banned account.
+ *
+ * @param plaintext - token exactly as presented by the client
+ */
+export declare function validateToken(plaintext: string): Promise<ITokenValidationResult>;
+/**
+ * Deletes every token whose expiration has passed. Returns the deleted count.
+ *
+ * Intended for cyclic execution from a worker ( see `rbac:token-delete-expired` ).
+ * Expired tokens are already refused by {@link validateToken}, so this is
+ * housekeeping, not enforcement.
+ */
+export declare function deleteExpiredTokens(): Promise<number>;
+/**
+ * Updates `LastUsedAt`, throttled: writes only when the stamp is absent or
+ * older than `intervalSeconds`.
+ *
+ * Every authenticated request would otherwise write to the token row; the stamp
+ * only needs to be accurate enough to spot unused tokens. Callers may
+ * fire-and-forget.
+ *
+ * @param token - token to stamp
+ * @param intervalSeconds - minimum time between two writes
+ */
+export declare function touchToken(token: AccessToken, intervalSeconds: number): Promise<void>;
+//# sourceMappingURL=actions.d.ts.map

package/lib/mjs/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAUxE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}