@spinajs/rbac-http-token 2.0.507

package/lib/mjs/actions.js

@@ -0,0 +1,242 @@
+import _ from 'lodash';
+import { DateTime } from 'luxon';
+import { User } from '@spinajs/rbac';
+import { _chain, _check_arg, _tap, _trim, _non_empty, _non_nil, _max_length } from '@spinajs/util';
+import { _service } from '@spinajs/configuration';
+import { _ev } from '@spinajs/queue';
+import { ErrorCode } from '@spinajs/exceptions';
+import { AccessToken } from './models/AccessToken.js';
+import { AccessTokenGenerationProvider } from './interfaces.js';
+import { AccessTokenCreated, AccessTokenDeleted, AccessTokenRoleGranted, AccessTokenRoleRevoked } from './events/index.js';
+/**
+ * Failure codes carried by every {@link ErrorCode} this module throws.
+ *
+ * Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
+ * `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
+ * from their package index. A downstream barrel that does
+ * `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
+ * would collide on the NAME while the members underneath carry different
+ * numeric values - the kind of clash that resolves silently in a barrel and
+ * makes an `err.code === E_CODES.X` comparison answer the wrong question.
+ */
+export var E_TOKEN_CODES;
+(function (E_TOKEN_CODES) {
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_NOT_FOUND"] = 0] = "E_TOKEN_NOT_FOUND";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_EXPIRED"] = 1] = "E_TOKEN_EXPIRED";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_OWNER_INVALID"] = 2] = "E_TOKEN_OWNER_INVALID";
+    E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_ROLE_NOT_ALLOWED"] = 3] = "E_TOKEN_ROLE_NOT_ALLOWED";
+})(E_TOKEN_CODES || (E_TOKEN_CODES = {}));
+/**
+ * Resolves an AccessToken from an instance or its uuid.
+ */
+export function _token(token) {
+    if (_.isString(token)) {
+        return () => AccessToken.where('Uuid', token).firstOrFail();
+    }
+    return () => Promise.resolve(token);
+}
+/**
+ * Resolves the owning user by instance, numeric id or uuid, with metadata
+ * populated ( needed for IsBanned checks downstream ).
+ */
+export function _owner(user) {
+    if (_.isString(user)) {
+        return () => User.where('Uuid', user).populate('Metadata').firstOrFail();
+    }
+    if (_.isNumber(user)) {
+        return () => User.where('Id', user).populate('Metadata').firstOrFail();
+    }
+    return () => Promise.resolve(user);
+}
+/**
+ * Emits a token-related event through the queue service and forwards the token.
+ *
+ * @param event - constructor of the {@link AccessTokenEvent} subclass to emit
+ * @param args - additional arguments forwarded to the event constructor
+ */
+function _token_ev(event, ...args) {
+    return async (t) => {
+        await _ev(new event(t, ...args))();
+        return t;
+    };
+}
+/**
+ * Ensures every role in `roles` is currently held by `owner`.
+ * A token must never carry a role its owner does not have.
+ */
+function _assert_roles_subset(owner, roles) {
+    const missing = roles.filter((r) => !owner.Role.includes(r));
+    if (missing.length !== 0) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner does not hold role(s): ${missing.join(', ')}`, { roles: missing });
+    }
+}
+/**
+ * Creates a new access token for a user.
+ *
+ * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
+ * null means the token never expires. The plaintext is returned once and
+ * never persisted - only its hash is stored.
+ *
+ * @param user - owner: {@link User} instance, numeric id or uuid
+ * @param name - human readable label
+ * @param roles - roles carried by the token, subset of the owner's roles
+ * @param expiresAt - absolute expiration, or null for a token that never expires
+ */
+export async function createToken(user, name, roles, expiresAt) {
+    name = _check_arg(_trim(), _non_empty(), _max_length(128))(name, 'name');
+    roles = _check_arg(_non_nil(), _non_empty())(roles, 'roles');
+    const generator = await _service('rbac.token.generation', AccessTokenGenerationProvider)();
+    const generated = await generator.generate();
+    return _chain(_owner(user), _tap(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+        const token = new AccessToken({
+            Name: name,
+            Token: generated.Hash,
+            Roles: _.uniq(roles),
+            // `ExpiresAt` is optional rather than nullable ( see the model ), so a
+            // "never expires" token leaves the property unset instead of holding null.
+            ExpiresAt: expiresAt ?? undefined,
+            user_id: u.Id,
+        });
+        await token.insert();
+        return token;
+    }, _token_ev(AccessTokenCreated), (t) => ({ Token: t, Plaintext: generated.Plaintext }));
+}
+/**
+ * Permanently deletes ( revokes ) a token.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ */
+export async function deleteToken(token) {
+    return _chain(_token(token), _tap((t) => t.destroy()), _token_ev(AccessTokenDeleted), () => undefined);
+}
+/**
+ * Adds a role to a token. The role must be held by the token owner.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to grant
+ */
+export async function grantTokenRole(token, role) {
+    role = _check_arg(_trim(), _non_empty())(role, 'role');
+    return _chain(_token(token), _tap(async (t) => {
+        const owner = await _owner(t.user_id)();
+        _assert_roles_subset(owner, [role]);
+        t.Roles = _.uniq([...t.Roles, role]);
+        await t.update();
+    }), _token_ev(AccessTokenRoleGranted, role));
+}
+/**
+ * Removes a role from a token.
+ *
+ * Not symmetric with {@link grantTokenRole}: revoking only ever narrows what a
+ * token may do, so it needs no owner check.
+ *
+ * A token must always keep at least one role - revoking the last one is
+ * refused, and full revocation means deleting the token. Beyond being
+ * meaningless ( a role-less token authorises nothing ), an empty list is
+ * actively corrupting: `@Set()` columns round-trip through `SqlSetConverter`,
+ * which stores `[]` as `''` and reads `''` back as `['']`. That phantom empty
+ * role then survives every later grant, permanently.
+ *
+ * @param token - {@link AccessToken} instance or its uuid
+ * @param role - role name to revoke
+ * @throws ErrorCode E_TOKEN_ROLE_NOT_ALLOWED when `role` is the token's last role
+ */
+export async function revokeTokenRole(token, role) {
+    role = _check_arg(_trim(), _non_empty())(role, 'role');
+    return _chain(_token(token), _tap(async (t) => {
+        const remaining = t.Roles.filter((r) => r !== role);
+        // checked BEFORE mutating, so a refused revoke leaves the instance and
+        // the row exactly as they were
+        if (remaining.length === 0) {
+            throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Cannot revoke the last role from a token - delete the token instead', { token: t.Uuid });
+        }
+        t.Roles = remaining;
+        await t.update();
+    }), _token_ev(AccessTokenRoleRevoked, role));
+}
+/**
+ * Validates a presented plaintext token.
+ *
+ * Checks, in order: token exists ( by hash ), token not expired, owner active /
+ * not soft-deleted / not banned, effective role intersection non-empty.
+ * Throws ErrorCode with {@link E_TOKEN_CODES} on every failure path.
+ *
+ * The owner checks are spelled out instead of reusing the `isActiveUser` query
+ * scope on purpose - a single "no such active user" result cannot say WHY, and
+ * callers need to tell an expired token from a banned account.
+ *
+ * @param plaintext - token exactly as presented by the client
+ */
+export async function validateToken(plaintext) {
+    // Degenerate input is a failed authentication like any other, so it has to
+    // leave through the same door. `_check_arg(_trim(), _non_empty())` would
+    // throw a raw InvalidArgument here - and a bare TypeError for nil, since
+    // `_non_empty` dereferences `.length` - breaking the "always an ErrorCode"
+    // contract this function is called under. Reported as E_TOKEN_NOT_FOUND with
+    // the unknown-token message on purpose: a caller must not learn WHY.
+    if (!_.isString(plaintext) || plaintext.trim().length === 0) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_NOT_FOUND, 'Access token not found');
+    }
+    plaintext = plaintext.trim();
+    const generator = await _service('rbac.token.generation', AccessTokenGenerationProvider)();
+    const hash = generator.hash(plaintext);
+    const token = await AccessToken.where('Token', hash).first();
+    if (!token) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_NOT_FOUND, 'Access token not found');
+    }
+    if (token.IsExpired) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_EXPIRED, 'Access token expired', { token: token.Uuid });
+    }
+    // Metadata carries the ban flag, so it must be populated - without it
+    // `IsBanned` silently answers false and every banned owner authenticates.
+    const owner = await User.where('Id', token.user_id).populate('Metadata').first();
+    // `DeletedAt` is defence in depth: the orm's soft-delete scope already appends
+    // `DeletedAt IS NULL` to User selects, so a deleted owner arrives as undefined.
+    if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
+    }
+    // roles are re-intersected on every request rather than trusted from the row:
+    // a role revoked on the user must take effect immediately, without having to
+    // hunt down every token that still carries it
+    const effective = token.Roles.filter((r) => owner.Role.includes(r));
+    if (effective.length === 0) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });
+    }
+    return { User: owner, Token: token, EffectiveRoles: effective };
+}
+/**
+ * Deletes every token whose expiration has passed. Returns the deleted count.
+ *
+ * Intended for cyclic execution from a worker ( see `rbac:token-delete-expired` ).
+ * Expired tokens are already refused by {@link validateToken}, so this is
+ * housekeeping, not enforcement.
+ */
+export async function deleteExpiredTokens() {
+    // `whereNotNull` is not redundant next to `<=`: a null expiry means "never
+    // expires", and null comparisons must not sweep those rows away.
+    const expired = await AccessToken.where('ExpiresAt', '<=', DateTime.now()).whereNotNull('ExpiresAt');
+    for (const t of expired) {
+        await t.destroy();
+    }
+    return expired.length;
+}
+/**
+ * Updates `LastUsedAt`, throttled: writes only when the stamp is absent or
+ * older than `intervalSeconds`.
+ *
+ * Every authenticated request would otherwise write to the token row; the stamp
+ * only needs to be accurate enough to spot unused tokens. Callers may
+ * fire-and-forget.
+ *
+ * @param token - token to stamp
+ * @param intervalSeconds - minimum time between two writes
+ */
+export async function touchToken(token, intervalSeconds) {
+    const now = DateTime.now();
+    if (token.LastUsedAt && token.LastUsedAt > now.minus({ seconds: intervalSeconds })) {
+        return;
+    }
+    token.LastUsedAt = now;
+    await token.update();
+}
+//# sourceMappingURL=actions.js.map

package/lib/mjs/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAW,EAAE,KAAe;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/mjs/cli/CreateToken.d.ts

@@ -0,0 +1,13 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+interface ICreateTokenOptions {
+    name: string;
+    roles: string;
+    expires?: string;
+}
+export declare class CreateToken extends CliCommand {
+    protected Log: Log;
+    execute(userIdOrUuid: string, options: ICreateTokenOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=CreateToken.d.ts.map

package/lib/mjs/cli/CreateToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateToken.d.ts","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AAKrE,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAKa,WAAY,SAAQ,UAAU;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtF;CACF"}

package/lib/mjs/cli/CreateToken.js

@@ -0,0 +1,53 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { Argument, CliCommand, Command, Option } from '@spinajs/cli';
+import { DateTime } from 'luxon';
+import { createToken } from '../actions.js';
+let CreateToken = class CreateToken extends CliCommand {
+    async execute(userIdOrUuid, options) {
+        try {
+            // Nil means the flag was not given at all - a token that never expires.
+            // Anything else, empty string included, is a value the user meant to be a
+            // date and must be validated: a truthiness check here would quietly turn
+            // `--expires ""` into an infinite token.
+            const expiresAt = options.expires === undefined || options.expires === null ? null : DateTime.fromISO(options.expires);
+            if (expiresAt && !expiresAt.isValid) {
+                this.Log.error(`Invalid --expires value: ${options.expires}`);
+                return;
+            }
+            const roles = options.roles
+                .split(',')
+                .map((r) => r.trim())
+                .filter((r) => r.length > 0);
+            const owner = /^\d+$/.test(userIdOrUuid) ? parseInt(userIdOrUuid, 10) : userIdOrUuid;
+            const { Token, Plaintext } = await createToken(owner, options.name, roles, expiresAt);
+            this.Log.success(`Token created: ${Token.Uuid}`);
+            // The single moment the plaintext exists outside the caller's hands.
+            this.Log.success(`Token ( copy now, it will not be shown again ): ${Plaintext}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while creating token: ${e.message}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], CreateToken.prototype, "Log", void 0);
+CreateToken = __decorate([
+    Command('rbac:token-create', 'Creates an access token for a user'),
+    Argument('userIdOrUuid', true, 'numeric id or uuid of the owner'),
+    Option('-n, --name <name>', true, 'token label'),
+    Option('-r, --roles <roles>', true, 'token roles, comma separated, must be subset of owner roles'),
+    Option('-e, --expires <expires>', false, 'ISO expiration instant; omit for a token that never expires')
+], CreateToken);
+export { CreateToken };
+//# sourceMappingURL=CreateToken.js.map

package/lib/mjs/cli/CreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IALvB,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC;IAClG,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}

package/lib/mjs/cli/DeleteExpiredTokens.d.ts

@@ -0,0 +1,11 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+/**
+ * Intended for cyclic execution from a worker process
+ * ( eg. cron / task scheduler ) to keep the token table clean.
+ */
+export declare class DeleteExpiredTokens extends CliCommand {
+    protected Log: Log;
+    execute(): Promise<void>;
+}
+//# sourceMappingURL=DeleteExpiredTokens.d.ts.map

package/lib/mjs/cli/DeleteExpiredTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteExpiredTokens.d.ts","sourceRoot":"","sources":["../../../src/cli/DeleteExpiredTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAW,MAAM,cAAc,CAAC;AAInD;;;GAGG;AACH,qBACa,mBAAoB,SAAQ,UAAU;IAEjD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAOpC;CACF"}

package/lib/mjs/cli/DeleteExpiredTokens.js

@@ -0,0 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { CliCommand, Command } from '@spinajs/cli';
+import { deleteExpiredTokens } from '../actions.js';
+/**
+ * Intended for cyclic execution from a worker process
+ * ( eg. cron / task scheduler ) to keep the token table clean.
+ */
+let DeleteExpiredTokens = class DeleteExpiredTokens extends CliCommand {
+    async execute() {
+        try {
+            const count = await deleteExpiredTokens();
+            this.Log.success(`Deleted ${count} expired token(s)`);
+        }
+        catch (e) {
+            this.Log.error(`Error while deleting expired tokens: ${e.message}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], DeleteExpiredTokens.prototype, "Log", void 0);
+DeleteExpiredTokens = __decorate([
+    Command('rbac:token-delete-expired', 'Deletes all expired access tokens')
+], DeleteExpiredTokens);
+export { DeleteExpiredTokens };
+//# sourceMappingURL=DeleteExpiredTokens.js.map

package/lib/mjs/cli/DeleteExpiredTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteExpiredTokens.js","sourceRoot":"","sources":["../../../src/cli/DeleteExpiredTokens.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,UAAU;IAI1C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,mBAAmB,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAyC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;gDAAC;AAFR,mBAAmB;IAD/B,OAAO,CAAC,2BAA2B,EAAE,mCAAmC,CAAC;GAC7D,mBAAmB,CAY/B"}

package/lib/mjs/cli/DeleteToken.d.ts

@@ -0,0 +1,7 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class DeleteToken extends CliCommand {
+    protected Log: Log;
+    execute(uuid: string): Promise<void>;
+}
+//# sourceMappingURL=DeleteToken.d.ts.map

package/lib/mjs/cli/DeleteToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteToken.d.ts","sourceRoot":"","sources":["../../../src/cli/DeleteToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAEa,WAAY,SAAQ,UAAU;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhD;CACF"}

package/lib/mjs/cli/DeleteToken.js

@@ -0,0 +1,33 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { deleteToken } from '../actions.js';
+let DeleteToken = class DeleteToken extends CliCommand {
+    async execute(uuid) {
+        try {
+            await deleteToken(uuid);
+            this.Log.success(`Token ${uuid} deleted`);
+        }
+        catch (e) {
+            this.Log.error(`Error while deleting token ${uuid}: ${e.message}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], DeleteToken.prototype, "Log", void 0);
+DeleteToken = __decorate([
+    Command('rbac:token-delete', 'Deletes ( revokes ) an access token'),
+    Argument('uuid', true, 'token uuid')
+], DeleteToken);
+export { DeleteToken };
+//# sourceMappingURL=DeleteToken.js.map

package/lib/mjs/cli/DeleteToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteToken.js","sourceRoot":"","sources":["../../../src/cli/DeleteToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAIrC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,IAAY;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IAFvB,OAAO,CAAC,mBAAmB,EAAE,qCAAqC,CAAC;IACnE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;GACxB,WAAW,CAYvB"}

package/lib/mjs/cli/GrantTokenRole.d.ts

@@ -0,0 +1,7 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class GrantTokenRole extends CliCommand {
+    protected Log: Log;
+    execute(uuid: string, role: string): Promise<void>;
+}
+//# sourceMappingURL=GrantTokenRole.d.ts.map

package/lib/mjs/cli/GrantTokenRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantTokenRole.d.ts","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAGa,cAAe,SAAQ,UAAU;IAE5C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;CACF"}

package/lib/mjs/cli/GrantTokenRole.js

@@ -0,0 +1,34 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { grantTokenRole } from '../actions.js';
+let GrantTokenRole = class GrantTokenRole extends CliCommand {
+    async execute(uuid, role) {
+        try {
+            await grantTokenRole(uuid, role);
+            this.Log.success(`Role ${role} granted to token ${uuid}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while granting role ${role} to token ${uuid}: ${e.message}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], GrantTokenRole.prototype, "Log", void 0);
+GrantTokenRole = __decorate([
+    Command('rbac:token-grant', 'Grants a role to an access token'),
+    Argument('uuid', true, 'token uuid'),
+    Argument('role', true, 'role to grant, must be held by token owner')
+], GrantTokenRole);
+export { GrantTokenRole };
+//# sourceMappingURL=GrantTokenRole.js.map

package/lib/mjs/cli/GrantTokenRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;2CAAC;AAFR,cAAc;IAH1B,OAAO,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;GACxD,cAAc,CAY1B"}

package/lib/mjs/cli/RevokeTokenRole.d.ts

@@ -0,0 +1,12 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+export declare class RevokeTokenRole extends CliCommand {
+    protected Log: Log;
+    /**
+     * Refusals arrive as thrown errors ( eg. revoking a token's last role ) and
+     * are reported on the error channel like any other failure - the row is left
+     * exactly as it was.
+     */
+    execute(uuid: string, role: string): Promise<void>;
+}
+//# sourceMappingURL=RevokeTokenRole.d.ts.map

package/lib/mjs/cli/RevokeTokenRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeTokenRole.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeTokenRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAI7D,qBAGa,eAAgB,SAAQ,UAAU;IAE7C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB;;;;OAIG;IACU,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;CACF"}

package/lib/mjs/cli/RevokeTokenRole.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { revokeTokenRole } from '../actions.js';
+let RevokeTokenRole = class RevokeTokenRole extends CliCommand {
+    /**
+     * Refusals arrive as thrown errors ( eg. revoking a token's last role ) and
+     * are reported on the error channel like any other failure - the row is left
+     * exactly as it was.
+     */
+    async execute(uuid, role) {
+        try {
+            await revokeTokenRole(uuid, role);
+            this.Log.success(`Role ${role} revoked from token ${uuid}`);
+        }
+        catch (e) {
+            this.Log.error(`Error while revoking role ${role} from token ${uuid}: ${e.message}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], RevokeTokenRole.prototype, "Log", void 0);
+RevokeTokenRole = __decorate([
+    Command('rbac:token-revoke', 'Revokes a role from an access token'),
+    Argument('uuid', true, 'token uuid'),
+    Argument('role', true, 'role to revoke')
+], RevokeTokenRole);
+export { RevokeTokenRole };
+//# sourceMappingURL=RevokeTokenRole.js.map

package/lib/mjs/cli/RevokeTokenRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeTokenRole.js","sourceRoot":"","sources":["../../../src/cli/RevokeTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKzC,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,UAAU;IAI7C;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,eAAe,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;CACF,CAAA;AAfW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;4CAAC;AAFR,eAAe;IAH3B,OAAO,CAAC,mBAAmB,EAAE,qCAAqC,CAAC;IACnE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC;GAC5B,eAAe,CAiB3B"}

package/lib/mjs/config/rbac-http-token.d.ts

@@ -0,0 +1,71 @@
+declare const rbacHttpToken: {
+    system: {
+        dirs: {
+            cli: string[];
+            controllers: string[];
+        };
+    };
+    queue: {
+        routing: {
+            AccessTokenCreated: {
+                connection: string;
+            };
+            AccessTokenDeleted: {
+                connection: string;
+            };
+            AccessTokenRoleGranted: {
+                connection: string;
+            };
+            AccessTokenRoleRevoked: {
+                connection: string;
+            };
+        };
+    };
+    rbac: {
+        token: {
+            /**
+             * Token generation algorithm. Swap for your own implementation of
+             * AccessTokenGenerationProvider registered under this name.
+             */
+            generation: {
+                service: string;
+            };
+            /**
+             * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
+             */
+            prefix: string;
+            /**
+             * Random bytes per token ( 32 = 256 bit entropy ).
+             */
+            length: number;
+            /**
+             * Fallback header checked when no `Authorization: Bearer` is present.
+             */
+            headerName: string;
+            /**
+             * Seconds between LastUsedAt writes for a busy token.
+             */
+            lastUsedUpdateInterval: number;
+        };
+        grants: {
+            user: {
+                'user.tokens': {
+                    'create:own': string[];
+                    'read:own': string[];
+                    'update:own': string[];
+                    'delete:own': string[];
+                };
+            };
+            'admin.users': {
+                'user.tokens': {
+                    'create:any': string[];
+                    'read:any': string[];
+                    'update:any': string[];
+                    'delete:any': string[];
+                };
+            };
+        };
+    };
+};
+export default rbacHttpToken;
+//# sourceMappingURL=rbac-http-token.d.ts.map

package/lib/mjs/config/rbac-http-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}