@spinajs/rbac-http-token 2.0.512 → 2.0.514

package/lib/mjs/controllers/AccessTokenController.js

@@ -16,7 +16,7 @@ import { Permission, Resource, User } from '@spinajs/rbac-http';
 import { ErrorCode } from '@spinajs/exceptions';
 import { DateTime } from 'luxon';
 import { AccessToken } from '../models/AccessToken.js';
-import { E_TOKEN_CODES, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
+import { E_TOKEN_CODES, _allowed_roles, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
 import { CreateTokenDto } from '../dto/create-token-dto.js';
 import { NoTokenAuthPolicy } from '../policies/NoTokenAuthPolicy.js';
 import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
@@ -57,6 +57,19 @@ import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
  * @tags AccessTokens
  */
 let AccessTokenController = class AccessTokenController extends BaseController {
+    /**
+     * Roles that may be put on a new token
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates against, so a client can never be offered a
+     * role the create call would then refuse.
+     * @security cookieAuth
+     * @response 200 Roles the caller may put on a token
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async roles(user) {
+        return new Ok({ Roles: await _allowed_roles(user) });
+    }
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -73,10 +86,11 @@ let AccessTokenController = class AccessTokenController extends BaseController {
     /**
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
-     * Roles must be a subset of the caller's own roles.
+     * Roles must be a subset of what the configured AccessTokenRolePolicy allows
+     * the caller - the same set `GET user/tokens/roles` reports.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not held by the caller
+     * @response 400 Requested roles are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
@@ -109,13 +123,14 @@ let AccessTokenController = class AccessTokenController extends BaseController {
     }
     /**
      * Grant a role to an own token
-     * The role must be held by the caller - a token can never carry more than its
-     * owner does.
+     * The role must be allowed for the caller by the configured
+     * AccessTokenRolePolicy - a token can never carry more than the policy
+     * permits its owner.
      * @security cookieAuth
      * @param uuid Public identifier of the token
      * @param role Role name to grant
      * @response 200 Updated token
-     * @response 400 Role is not held by the caller
+     * @response 400 Role is not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      * @response 404 No such token for this user
@@ -206,6 +221,14 @@ let AccessTokenController = class AccessTokenController extends BaseController {
         throw err;
     }
 };
+__decorate([
+    Get('tokens/roles'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "roles", null);
 __decorate([
     Get('tokens'),
     Permission(['readOwn']),

package/lib/mjs/controllers/AccessTokenController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AA5Jc;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAcY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AArHU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAwKjC"}
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe;QACxC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AA7Kc;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;kDAEzC;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAeY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAkBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AAvIU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CA0LjC"}

package/lib/mjs/index.d.ts

@@ -1,9 +1,11 @@
 import './generator.js';
+import './role-policy.js';
 import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
 export * from './generator.js';
+export * from './role-policy.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middlewares.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/index.js

@@ -2,11 +2,13 @@
 // generator and the token authorization middleware ) the moment they are
 // loaded, so they must run even if a consumer imports nothing from them.
 import './generator.js';
+import './role-policy.js';
 import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
 export * from './generator.js';
+export * from './role-policy.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middlewares.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -1,3 +1,4 @@
+import type { User } from '@spinajs/rbac';
 export interface IGeneratedToken {
     /**
      * Full token as handed to the user, e.g. `spt_<base64url>`. Shown exactly once.
@@ -32,6 +33,46 @@ export interface ITokenAuthInfo {
      */
     Uuid: string;
 }
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+export declare abstract class AccessTokenRolePolicy {
+    /**
+     * Roles `owner` may carry on a token. Also the set every one of their
+     * existing tokens is re-intersected with on each authenticated request, so a
+     * role dropped from this answer stops authorising immediately.
+     *
+     * @param owner - at minimum a base `User` with `Metadata` populated; see the
+     *                class docblock above for why nothing more may be assumed.
+     */
+    abstract allowedRoles(owner: User): Promise<string[]>;
+}
 declare module '@spinajs/rbac' {
     interface IRbacAsyncStorage {
         /**

package/lib/mjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;OAOG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC9D;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/mjs/interfaces.js

@@ -4,4 +4,35 @@
  */
 export class AccessTokenGenerationProvider {
 }
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+export class AccessTokenRolePolicy {
+}
 //# sourceMappingURL=interfaces.js.map

package/lib/mjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAgB,qBAAqB;CAU1C"}

package/lib/mjs/role-policy.d.ts

@@ -0,0 +1,28 @@
+import { User } from '@spinajs/rbac';
+import { AccessTokenRolePolicy } from './interfaces.js';
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+export declare class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
+    allowedRoles(owner: User): Promise<string[]>;
+}
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+export declare function _role_excluded(role: string, patterns: string[]): boolean;
+//# sourceMappingURL=role-policy.d.ts.map

package/lib/mjs/role-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,qBAAqB;IACnD,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE"}

package/lib/mjs/role-policy.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { AccessTokenRolePolicy } from './interfaces.js';
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+let OwnRolesTokenRolePolicy = class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
+    async allowedRoles(owner) {
+        return [...owner.Role];
+    }
+};
+OwnRolesTokenRolePolicy = __decorate([
+    Injectable(AccessTokenRolePolicy)
+], OwnRolesTokenRolePolicy);
+export { OwnRolesTokenRolePolicy };
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+export function _role_excluded(role, patterns) {
+    return patterns.some((pattern) => {
+        if (pattern.endsWith('.*')) {
+            const prefix = pattern.slice(0, -1); // keeps the trailing dot
+            return role.startsWith(prefix);
+        }
+        return role === pattern;
+    });
+}
+//# sourceMappingURL=role-policy.js.map

package/lib/mjs/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAqB;IACzD,KAAK,CAAC,YAAY,CAAC,KAAW;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF,CAAA;AAJY,uBAAuB;IADnC,UAAU,CAAC,qBAAqB,CAAC;GACrB,uBAAuB,CAInC;;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}