@spinajs/rbac-http-token 2.0.507

package/lib/mjs/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js

@@ -0,0 +1,35 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/* eslint-disable @typescript-eslint/no-unused-vars */
+import { OrmMigration, Migration } from '@spinajs/orm';
+let RbacHttpTokenInitial_2026_08_11_01_00_00 = class RbacHttpTokenInitial_2026_08_11_01_00_00 extends OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('rbac_access_tokens', (table) => {
+            table.int('Id').primaryKey().autoIncrement();
+            table.string('Uuid', 36).notNull();
+            table.string('Name', 128).notNull();
+            table.string('Token', 64).notNull();
+            table.string('Roles', 512).notNull();
+            table.dateTime('ExpiresAt');
+            table.dateTime('CreatedAt').notNull().default().dateTime();
+            table.dateTime('LastUsedAt');
+            table.int('user_id').notNull();
+            table.foreignKey('user_id').references('users', 'Id').cascade();
+        });
+        await connection.index().unique().table('rbac_access_tokens').name('access_token_hash_idx').columns(['Token']);
+        await connection.index().unique().table('rbac_access_tokens').name('access_token_uuid_idx').columns(['Uuid']);
+        await connection.index().table('rbac_access_tokens').name('access_token_user_idx').columns(['user_id']);
+        await connection.index().table('rbac_access_tokens').name('access_token_expires_idx').columns(['ExpiresAt']);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    async down(_connection) { }
+};
+RbacHttpTokenInitial_2026_08_11_01_00_00 = __decorate([
+    Migration('default')
+], RbacHttpTokenInitial_2026_08_11_01_00_00);
+export { RbacHttpTokenInitial_2026_08_11_01_00_00 };
+//# sourceMappingURL=RbacHttpTokenInitial_2026_08_11_01_00_00.js.map

package/lib/mjs/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenInitial_2026_08_11_01_00_00.js","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAa,SAAS,EAAE,MAAM,cAAc,CAAC;AAG3D,IAAM,wCAAwC,GAA9C,MAAM,wCAAyC,SAAQ,YAAY;IACjE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;YACpE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9G,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AAvBY,wCAAwC;IADpD,SAAS,CAAC,SAAS,CAAC;GACR,wCAAwC,CAuBpD"}

package/lib/mjs/models/AccessToken.d.ts

@@ -0,0 +1,55 @@
+import { ModelBase, SingleRelation } from '@spinajs/orm';
+import { User } from '@spinajs/rbac';
+import { DateTime } from 'luxon';
+/**
+ * Personal access token. Only the SHA-256 hash of the token is stored;
+ * the plaintext is returned once at creation and cannot be recovered.
+ */
+export declare class AccessToken extends ModelBase<AccessToken> {
+    constructor(data?: Partial<AccessToken>);
+    /**
+     * Internal row id, never leaves the process. Tokens are addressed by Uuid.
+     */
+    Id: number;
+    /**
+     * Public identifier used by the API and CLI.
+     */
+    Uuid: string;
+    /**
+     * Human readable label ("ci deploy key").
+     */
+    Name: string;
+    /**
+     * SHA-256 hex digest of the plaintext token. Hidden: even the hash is
+     * internal - leaking it invites offline correlation.
+     */
+    Token: string;
+    /**
+     * Roles allowed on this token. Effective roles at request time are the
+     * intersection of this list with the owner's current roles.
+     */
+    Roles: string[];
+    /**
+     * Absolute expiration. Null/absent = never expires.
+     *
+     * NOTE: declared optional rather than as a `DateTime | null` union - the
+     * `@DateTime()` decorator reads `design:type`, and a union is emitted as
+     * `Object`, which it rejects at decoration time. An optional property still
+     * emits `design:type = DateTime` while keeping the absence in the type.
+     */
+    ExpiresAt?: DateTime;
+    CreatedAt: DateTime;
+    /**
+     * Last successful authentication with this token. Updated throttled.
+     * Null/absent until the token is used for the first time - see the note on
+     * `ExpiresAt` for why this is optional rather than a nullable union.
+     */
+    LastUsedAt?: DateTime;
+    User: SingleRelation<User>;
+    user_id: number;
+    /**
+     * True when the token carries an expiration in the past.
+     */
+    get IsExpired(): boolean;
+}
+//# sourceMappingURL=AccessToken.d.ts.map

package/lib/mjs/models/AccessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,SAAS,EAAgB,cAAc,EAAE,MAAM,cAAc,CAAC;AACxI,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;GAGG;AACH,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IACrD,YAAmB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAG7C;IAED;;OAEG;IAGI,EAAE,EAAG,MAAM,CAAC;IAEnB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAEI,KAAK,EAAG,MAAM,CAAC;IAEtB;;;OAGG;IAEI,KAAK,EAAG,MAAM,EAAE,CAAC;IAExB;;;;;;;OAOG;IAEI,SAAS,CAAC,EAAE,QAAQ,CAAC;IAGrB,SAAS,EAAG,QAAQ,CAAC;IAE5B;;;;OAIG;IAEI,UAAU,CAAC,EAAE,QAAQ,CAAC;IAItB,IAAI,EAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAG5B,OAAO,EAAG,MAAM,CAAC;IAExB;;OAEG;IACH,IAAW,SAAS,IAAI,OAAO,CAE9B;CACF"}

package/lib/mjs/models/AccessToken.js

@@ -0,0 +1,70 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BelongsTo, Connection, CreatedAt, DateTime as DT, Hidden, Model, ModelBase, Primary, Set, SingleRelation } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+import { v4 as uuidv4 } from 'uuid';
+import { _check_arg, _default } from '@spinajs/util';
+/**
+ * Personal access token. Only the SHA-256 hash of the token is stored;
+ * the plaintext is returned once at creation and cannot be recovered.
+ */
+let AccessToken = class AccessToken extends ModelBase {
+    constructor(data) {
+        super(data);
+        this.Uuid = _check_arg(_default(uuidv4()))(this.Uuid, 'uuid');
+    }
+    /**
+     * True when the token carries an expiration in the past.
+     */
+    get IsExpired() {
+        return !!this.ExpiresAt && this.ExpiresAt <= DateTime.now();
+    }
+};
+__decorate([
+    Primary(),
+    Hidden(),
+    __metadata("design:type", Number)
+], AccessToken.prototype, "Id", void 0);
+__decorate([
+    Hidden(),
+    __metadata("design:type", String)
+], AccessToken.prototype, "Token", void 0);
+__decorate([
+    Set(),
+    __metadata("design:type", Array)
+], AccessToken.prototype, "Roles", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AccessToken.prototype, "ExpiresAt", void 0);
+__decorate([
+    CreatedAt(),
+    __metadata("design:type", DateTime)
+], AccessToken.prototype, "CreatedAt", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AccessToken.prototype, "LastUsedAt", void 0);
+__decorate([
+    Hidden(),
+    BelongsTo('User'),
+    __metadata("design:type", SingleRelation)
+], AccessToken.prototype, "User", void 0);
+__decorate([
+    Hidden(),
+    __metadata("design:type", Number)
+], AccessToken.prototype, "user_id", void 0);
+AccessToken = __decorate([
+    Connection('default'),
+    Model('rbac_access_tokens'),
+    __metadata("design:paramtypes", [Object])
+], AccessToken);
+export { AccessToken };
+//# sourceMappingURL=AccessToken.js.map

package/lib/mjs/models/AccessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,SAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IA8DD;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;AA7DQ;IAFN,OAAO,EAAE;IACT,MAAM,EAAE;;uCACU;AAiBZ;IADN,MAAM,EAAE;;0CACa;AAOf;IADN,GAAG,EAAE;;0CACkB;AAWjB;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AAGrB;IADN,SAAS,EAAE;8BACO,QAAQ;8CAAC;AAQrB;IADN,EAAE,EAAE;8BACe,QAAQ;+CAAC;AAItB;IAFN,MAAM,EAAE;IACR,SAAS,CAAC,MAAM,CAAC;8BACJ,cAAc;yCAAO;AAG5B;IADN,MAAM,EAAE;;4CACe;AAhEb,WAAW;IAFvB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,oBAAoB,CAAC;;GACf,WAAW,CAwEvB"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/policies/NoImpersonationPolicy.d.ts

@@ -0,0 +1,28 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Rejects requests made from an impersonated session.
+ *
+ * Impersonation is a *supervised, revocable* act: an administrator borrows a
+ * user's view of the application and the borrowing ends when the impersonation
+ * does. An access token is the opposite - a bearer credential that outlives the
+ * session that minted it, carries the victim's roles, and is invisible in the
+ * impersonator's own audit trail. Letting a credential-issuing route run while
+ * impersonating therefore turns a temporary, reversible grant into a permanent
+ * one that the account owner never consented to and cannot see.
+ *
+ * `RbacMiddleware` puts the impersonation TARGET in `req.storage.User` and the
+ * original administrator in `req.storage.Impersonator`
+ * ( `rbac-http/src/middlewares.ts` ), so every ownership and permission check
+ * downstream already reads as the victim - this policy is the only thing that
+ * can tell the two situations apart.
+ *
+ * Same reasoning as a password change demanding the CURRENT password: an
+ * operation that hands out lasting credentials has to be performed by the
+ * account owner, not on their behalf.
+ */
+export declare class NoImpersonationPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, _action: IRoute, _instance: IController): Promise<void>;
+}
+//# sourceMappingURL=NoImpersonationPolicy.d.ts.map

package/lib/mjs/policies/NoImpersonationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoImpersonationPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/NoImpersonationPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQrF,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IAC5C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;CACF"}

package/lib/mjs/policies/NoImpersonationPolicy.js

@@ -0,0 +1,41 @@
+import { BasePolicy } from '@spinajs/http';
+import { Forbidden } from '@spinajs/exceptions';
+// Same side-effect import both siblings carry. `req.storage.Impersonator` comes
+// from `@spinajs/rbac-http`'s augmentation of `IActionLocalStoregeContext`,
+// which this package's `interfaces.ts` pulls into the program ( type-only ).
+// Without it the field only type-checks when something ELSE in the compilation
+// happened to drag that augmentation in - fine today, silently broken the day
+// this file is compiled on its own.
+import '../interfaces.js';
+/**
+ * Rejects requests made from an impersonated session.
+ *
+ * Impersonation is a *supervised, revocable* act: an administrator borrows a
+ * user's view of the application and the borrowing ends when the impersonation
+ * does. An access token is the opposite - a bearer credential that outlives the
+ * session that minted it, carries the victim's roles, and is invisible in the
+ * impersonator's own audit trail. Letting a credential-issuing route run while
+ * impersonating therefore turns a temporary, reversible grant into a permanent
+ * one that the account owner never consented to and cannot see.
+ *
+ * `RbacMiddleware` puts the impersonation TARGET in `req.storage.User` and the
+ * original administrator in `req.storage.Impersonator`
+ * ( `rbac-http/src/middlewares.ts` ), so every ownership and permission check
+ * downstream already reads as the victim - this policy is the only thing that
+ * can tell the two situations apart.
+ *
+ * Same reasoning as a password change demanding the CURRENT password: an
+ * operation that hands out lasting credentials has to be performed by the
+ * account owner, not on their behalf.
+ */
+export class NoImpersonationPolicy extends BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, _action, _instance) {
+        if (req.storage?.Impersonator) {
+            throw new Forbidden('this route cannot be used while impersonating another user');
+        }
+    }
+}
+//# sourceMappingURL=NoImpersonationPolicy.js.map

package/lib/mjs/policies/NoImpersonationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoImpersonationPolicy.js","sourceRoot":"","sources":["../../../src/policies/NoImpersonationPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4C,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,oCAAoC;AACpC,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC5C,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,OAAe,EAAE,SAAsB;QACzE,IAAI,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF"}

package/lib/mjs/policies/NoTokenAuthPolicy.d.ts

@@ -0,0 +1,12 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Rejects requests authenticated with an access token. Applied to the token
+ * management API so a token can never be used to mint or manage tokens
+ * ( no self-replication ). Session-authenticated requests pass through.
+ */
+export declare class NoTokenAuthPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, _action: IRoute, _instance: IController): Promise<void>;
+}
+//# sourceMappingURL=NoTokenAuthPolicy.d.ts.map

package/lib/mjs/policies/NoTokenAuthPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoTokenAuthPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/NoTokenAuthPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IACxC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;CACF"}

package/lib/mjs/policies/NoTokenAuthPolicy.js

@@ -0,0 +1,20 @@
+import { BasePolicy } from '@spinajs/http';
+import { Forbidden } from '@spinajs/exceptions';
+// Brings the `req.storage.TokenAuth` module augmentation into the program.
+import '../interfaces.js';
+/**
+ * Rejects requests authenticated with an access token. Applied to the token
+ * management API so a token can never be used to mint or manage tokens
+ * ( no self-replication ). Session-authenticated requests pass through.
+ */
+export class NoTokenAuthPolicy extends BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, _action, _instance) {
+        if (req.storage?.TokenAuth) {
+            throw new Forbidden('access tokens cannot be used on this route');
+        }
+    }
+}
+//# sourceMappingURL=NoTokenAuthPolicy.js.map

package/lib/mjs/policies/NoTokenAuthPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoTokenAuthPolicy.js","sourceRoot":"","sources":["../../../src/policies/NoTokenAuthPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4C,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,2EAA2E;AAC3E,OAAO,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IACxC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,OAAe,EAAE,SAAsB;QACzE,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}

package/lib/mjs/policies/TokenPolicy.d.ts

@@ -0,0 +1,49 @@
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import '../interfaces.js';
+/**
+ * Route requires authentication with an access token AND the token's
+ * effective roles must satisfy the route's @Resource/@Permission grants.
+ *
+ * Mirrors RbacPolicy's grant enforcement, but for token-authenticated
+ * requests ( which carry no session ).
+ *
+ * WIRING - do NOT pass this policy to @Permission's `also` parameter:
+ *
+ *   @Permission(['readOwn'], TokenPolicy)   // BROKEN - always 401
+ *
+ * `@Permission` unconditionally bundles RbacPolicy together with every `also`
+ * policy into the SAME policy group ( rbac-http/src/decorators.ts ), and
+ * policies inside one group are combined with AND. RbacPolicy demands an
+ * authorized session, which a token-authenticated request never has, so the
+ * pair can never both pass and the route is permanently unreachable by token.
+ *
+ * Declare it as its OWN group at the ROUTE scope instead - groups of ONE scope
+ * are ORed, so a token request satisfies the TokenPolicy group while a session
+ * request satisfies the RbacPolicy group:
+ *
+ *   @Get('data')
+ *   @Permission(['readOwn'])      // the permission metadata + RbacPolicy group
+ *   @Policy(TokenPolicy)          // METHOD level - a second route scope group
+ *
+ * The placement is not free-standing: a CLASS level `@Policy(TokenPolicy)` goes
+ * to the CONTROLLER scope, and the two scopes are ANDed - it would then have to
+ * hold TOGETHER with the route's RbacPolicy group, which is exactly the broken
+ * combination above. Only a method level declaration lands in the same scope as
+ * `@Permission` and gets ORed with it.
+ *
+ * Writing `@Policy(TokenPolicy)` BELOW `@Permission` is deliberate too.
+ * Decorators apply bottom up, so this one is pushed first, and when no group
+ * holds `createPolicyGate` reports the first rejection in declaration order: a
+ * token that authenticated but lacks the grant then gets this policy's 403
+ * instead of RbacPolicy's misleading "user not logged" 401.
+ *
+ * The `@Permission` line is still required even with `@Policy(TokenPolicy)`:
+ * this policy reads the same route permission metadata, and a route without it
+ * silently inherits the controller-level default `['readOwn']` rather than
+ * failing loudly.
+ */
+export declare class TokenPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
+}
+//# sourceMappingURL=TokenPolicy.d.ts.map

package/lib/mjs/policies/TokenPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/TokenPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAMlG,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,WAAY,SAAQ,UAAU;IAClC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAEjE;IAEY,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxF;CACF"}

package/lib/mjs/policies/TokenPolicy.js

@@ -0,0 +1,75 @@
+import { BasePolicy, ServerError } from '@spinajs/http';
+import { AuthenticationFailed, Forbidden } from '@spinajs/exceptions';
+import { ACL_CONTROLLER_DESCRIPTOR, checkRoutePermission } from '@spinajs/rbac-http';
+// Brings the `req.storage.TokenAuth` module augmentation into the program.
+// Same side-effect import the middleware uses; without it this file compiles
+// on its own against an un-augmented IActionLocalStoregeContext.
+import '../interfaces.js';
+/**
+ * Route requires authentication with an access token AND the token's
+ * effective roles must satisfy the route's @Resource/@Permission grants.
+ *
+ * Mirrors RbacPolicy's grant enforcement, but for token-authenticated
+ * requests ( which carry no session ).
+ *
+ * WIRING - do NOT pass this policy to @Permission's `also` parameter:
+ *
+ *   @Permission(['readOwn'], TokenPolicy)   // BROKEN - always 401
+ *
+ * `@Permission` unconditionally bundles RbacPolicy together with every `also`
+ * policy into the SAME policy group ( rbac-http/src/decorators.ts ), and
+ * policies inside one group are combined with AND. RbacPolicy demands an
+ * authorized session, which a token-authenticated request never has, so the
+ * pair can never both pass and the route is permanently unreachable by token.
+ *
+ * Declare it as its OWN group at the ROUTE scope instead - groups of ONE scope
+ * are ORed, so a token request satisfies the TokenPolicy group while a session
+ * request satisfies the RbacPolicy group:
+ *
+ *   @Get('data')
+ *   @Permission(['readOwn'])      // the permission metadata + RbacPolicy group
+ *   @Policy(TokenPolicy)          // METHOD level - a second route scope group
+ *
+ * The placement is not free-standing: a CLASS level `@Policy(TokenPolicy)` goes
+ * to the CONTROLLER scope, and the two scopes are ANDed - it would then have to
+ * hold TOGETHER with the route's RbacPolicy group, which is exactly the broken
+ * combination above. Only a method level declaration lands in the same scope as
+ * `@Permission` and gets ORed with it.
+ *
+ * Writing `@Policy(TokenPolicy)` BELOW `@Permission` is deliberate too.
+ * Decorators apply bottom up, so this one is pushed first, and when no group
+ * holds `createPolicyGate` reports the first rejection in declaration order: a
+ * token that authenticated but lacks the grant then gets this policy's 403
+ * instead of RbacPolicy's misleading "user not logged" 401.
+ *
+ * The `@Permission` line is still required even with `@Policy(TokenPolicy)`:
+ * this policy reads the same route permission metadata, and a route without it
+ * silently inherits the controller-level default `['readOwn']` rather than
+ * failing loudly.
+ */
+export class TokenPolicy extends BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req, action, instance) {
+        if (!req.storage || !req.storage.TokenAuth || !req.storage.User) {
+            throw new AuthenticationFailed('access token required');
+        }
+        const descriptor = Reflect.getMetadata(ACL_CONTROLLER_DESCRIPTOR, instance);
+        // Guard BEFORE dereferencing `.Routes`: a route decorated with this policy
+        // but no @Resource/@Permission must produce the descriptive server error,
+        // not a raw TypeError 500.
+        if (!descriptor || !descriptor.Permission || descriptor.Permission.length === 0) {
+            throw new ServerError('no route permission or resources assigned');
+        }
+        let permission = descriptor.Permission ?? [];
+        if (descriptor.Routes.has(String(action.Method))) {
+            permission = descriptor.Routes.get(String(action.Method)).Permission ?? [];
+        }
+        if (!permission.some((p) => checkRoutePermission(req, descriptor.Resource, p)?.granted)) {
+            const effective = req.storage.ActiveRole ?? req.storage.User.Role;
+            throw new Forbidden(`token role(s) ${effective} do not have permission ${permission} for resource ${descriptor.Resource}`);
+        }
+    }
+}
+//# sourceMappingURL=TokenPolicy.js.map

package/lib/mjs/policies/TokenPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenPolicy.js","sourceRoot":"","sources":["../../../src/policies/TokenPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAmB,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACtG,2EAA2E;AAC3E,6EAA6E;AAC7E,iEAAiE;AACjE,OAAO,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,OAAO,WAAY,SAAQ,UAAU;IAClC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,2EAA2E;QAC3E,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,iBAAiB,SAAS,2BAA2B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;CACF"}