@spinajs/rbac-http-token 2.0.513 → 2.0.514

package/lib/cjs/index.js

@@ -18,11 +18,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // generator and the token authorization middleware ) the moment they are
 // loaded, so they must run even if a consumer imports nothing from them.
 require("./generator.js");
+require("./role-policy.js");
 require("./middlewares.js");
 __exportStar(require("./interfaces.js"), exports);
 __exportStar(require("./models/AccessToken.js"), exports);
 __exportStar(require("./migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js"), exports);
 __exportStar(require("./generator.js"), exports);
+__exportStar(require("./role-policy.js"), exports);
 __exportStar(require("./events/index.js"), exports);
 __exportStar(require("./actions.js"), exports);
 __exportStar(require("./middlewares.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,0BAAwB;AACxB,4BAA0B;AAE1B,kDAAgC;AAChC,0DAAwC;AACxC,2FAAyE;AACzE,iDAA+B;AAC/B,oDAAkC;AAClC,+CAA6B;AAC7B,mDAAiC;AACjC,4DAA0C;AAC1C,kEAAgD;AAChD,sEAAoD;AACpD,yEAAuD;AACvD,4DAA0C;AAC1C,uDAAqC;AACrC,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,+DAA6C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,0BAAwB;AACxB,4BAA0B;AAC1B,4BAA0B;AAE1B,kDAAgC;AAChC,0DAAwC;AACxC,2FAAyE;AACzE,iDAA+B;AAC/B,mDAAiC;AACjC,oDAAkC;AAClC,+CAA6B;AAC7B,mDAAiC;AACjC,4DAA0C;AAC1C,kEAAgD;AAChD,sEAAoD;AACpD,yEAAuD;AACvD,4DAA0C;AAC1C,uDAAqC;AACrC,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,+DAA6C"}

package/lib/cjs/interfaces.d.ts

@@ -1,3 +1,4 @@
+import type { User } from '@spinajs/rbac';
 export interface IGeneratedToken {
     /**
      * Full token as handed to the user, e.g. `spt_<base64url>`. Shown exactly once.
@@ -32,6 +33,46 @@ export interface ITokenAuthInfo {
      */
     Uuid: string;
 }
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+export declare abstract class AccessTokenRolePolicy {
+    /**
+     * Roles `owner` may carry on a token. Also the set every one of their
+     * existing tokens is re-intersected with on each authenticated request, so a
+     * role dropped from this answer stops authorising immediately.
+     *
+     * @param owner - at minimum a base `User` with `Metadata` populated; see the
+     *                class docblock above for why nothing more may be assumed.
+     */
+    abstract allowedRoles(owner: User): Promise<string[]>;
+}
 declare module '@spinajs/rbac' {
     interface IRbacAsyncStorage {
         /**

package/lib/cjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;OAOG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC9D;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/cjs/interfaces.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccessTokenGenerationProvider = void 0;
+exports.AccessTokenRolePolicy = exports.AccessTokenGenerationProvider = void 0;
 /**
  * Token generation algorithm. Replaceable via config
  * `rbac.token.generation.service` - same pattern as `rbac.password.service`.
@@ -8,4 +8,36 @@ exports.AccessTokenGenerationProvider = void 0;
 class AccessTokenGenerationProvider {
 }
 exports.AccessTokenGenerationProvider = AccessTokenGenerationProvider;
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+class AccessTokenRolePolicy {
+}
+exports.AccessTokenRolePolicy = AccessTokenRolePolicy;
 //# sourceMappingURL=interfaces.js.map

package/lib/cjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAsBA;;;GAGG;AACH;CAUC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAsBA;;;GAGG;AACH;CAUC;;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;CAUC"}

package/lib/cjs/role-policy.d.ts

@@ -0,0 +1,28 @@
+import { User } from '@spinajs/rbac';
+import { AccessTokenRolePolicy } from './interfaces.js';
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+export declare class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
+    allowedRoles(owner: User): Promise<string[]>;
+}
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+export declare function _role_excluded(role: string, patterns: string[]): boolean;
+//# sourceMappingURL=role-policy.d.ts.map

package/lib/cjs/role-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,qBAAqB;IACnD,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE"}

package/lib/cjs/role-policy.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnRolesTokenRolePolicy = void 0;
+exports._role_excluded = _role_excluded;
+const di_1 = require("@spinajs/di");
+const interfaces_js_1 = require("./interfaces.js");
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+let OwnRolesTokenRolePolicy = class OwnRolesTokenRolePolicy extends interfaces_js_1.AccessTokenRolePolicy {
+    async allowedRoles(owner) {
+        return [...owner.Role];
+    }
+};
+exports.OwnRolesTokenRolePolicy = OwnRolesTokenRolePolicy;
+exports.OwnRolesTokenRolePolicy = OwnRolesTokenRolePolicy = __decorate([
+    (0, di_1.Injectable)(interfaces_js_1.AccessTokenRolePolicy)
+], OwnRolesTokenRolePolicy);
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+function _role_excluded(role, patterns) {
+    return patterns.some((pattern) => {
+        if (pattern.endsWith('.*')) {
+            const prefix = pattern.slice(0, -1); // keeps the trailing dot
+            return role.startsWith(prefix);
+        }
+        return role === pattern;
+    });
+}
+//# sourceMappingURL=role-policy.js.map

package/lib/cjs/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,oCAAyC;AAGzC,mDAAwD;AAExD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qCAAqB;IACzD,KAAK,CAAC,YAAY,CAAC,KAAW;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF,CAAA;;kCAJY,uBAAuB;IADnC,IAAA,eAAU,EAAC,qCAAqB,CAAC;GACrB,uBAAuB,CAInC;AAED;;;;;;;;;;;;GAYG;AACH,wBAA+B,IAAY,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/mjs/actions.d.ts

@@ -27,16 +27,42 @@ export declare function _token(token: AccessToken | string): () => Promise<Acces
  * populated ( needed for IsBanned checks downstream ).
  */
 export declare function _owner(user: User | number | string): () => Promise<User>;
+/**
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+export declare function _allowed_roles(owner: User): Promise<string[]>;
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
  */
 export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
@@ -50,7 +76,8 @@ export declare function createToken(user: User | number | string, name: string,
  */
 export declare function deleteToken(token: AccessToken | string): Promise<void>;
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -78,7 +105,8 @@ export interface ITokenValidationResult {
     User: User;
     Token: AccessToken;
     /**
-     * Token roles that the owner still holds. Permission checks run with these.
+     * Token roles the configured {@link AccessTokenRolePolicy} still allows for
+     * the owner. Permission checks run with these.
      */
     EffectiveRoles: string[];
 }

package/lib/mjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnE;AAiBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/mjs/actions.js

@@ -5,8 +5,9 @@ import { _chain, _check_arg, _tap, _trim, _non_empty, _non_nil, _max_length } fr
 import { _service } from '@spinajs/configuration';
 import { _ev } from '@spinajs/queue';
 import { ErrorCode } from '@spinajs/exceptions';
+import { DI } from '@spinajs/di';
 import { AccessToken } from './models/AccessToken.js';
-import { AccessTokenGenerationProvider } from './interfaces.js';
+import { AccessTokenGenerationProvider, AccessTokenRolePolicy } from './interfaces.js';
 import { AccessTokenCreated, AccessTokenDeleted, AccessTokenRoleGranted, AccessTokenRoleRevoked } from './events/index.js';
 /**
  * Failure codes carried by every {@link ErrorCode} this module throws.
@@ -63,25 +64,60 @@ function _token_ev(event, ...args) {
     };
 }
 /**
- * Ensures every role in `roles` is currently held by `owner`.
- * A token must never carry a role its owner does not have.
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+export async function _allowed_roles(owner) {
+    const policy = await _service('rbac.token.rolePolicy', AccessTokenRolePolicy)();
+    const allowed = await policy.allowedRoles(owner);
+    const ac = DI.get('AccessControl');
+    const grants = ac.getGrants();
+    return allowed.filter((r) => Object.hasOwn(grants, r));
+}
+/**
+ * Ensures every role in `roles` is one the configured policy allows for
+ * `owner`. Deliberately not "one the owner literally holds" - a policy may
+ * permit roles beyond the owner's own `Role` list, or withhold ones on it;
+ * that flexibility is the entire point of the policy seam.
  */
-function _assert_roles_subset(owner, roles) {
-    const missing = roles.filter((r) => !owner.Role.includes(r));
+async function _assert_roles_subset(owner, roles) {
+    const allowed = await _allowed_roles(owner);
+    const missing = roles.filter((r) => !allowed.includes(r));
     if (missing.length !== 0) {
-        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner does not hold role(s): ${missing.join(', ')}`, { roles: missing });
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
     }
 }
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
  */
 export async function createToken(user, name, roles, expiresAt) {
@@ -112,7 +148,8 @@ export async function deleteToken(token) {
     return _chain(_token(token), _tap((t) => t.destroy()), _token_ev(AccessTokenDeleted), () => undefined);
 }
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -121,7 +158,7 @@ export async function grantTokenRole(token, role) {
     role = _check_arg(_trim(), _non_empty())(role, 'role');
     return _chain(_token(token), _tap(async (t) => {
         const owner = await _owner(t.user_id)();
-        _assert_roles_subset(owner, [role]);
+        await _assert_roles_subset(owner, [role]);
         t.Roles = _.uniq([...t.Roles, role]);
         await t.update();
     }), _token_ev(AccessTokenRoleGranted, role));
@@ -198,10 +235,12 @@ export async function validateToken(plaintext) {
     if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
     }
-    // roles are re-intersected on every request rather than trusted from the row:
-    // a role revoked on the user must take effect immediately, without having to
+    // roles are re-checked against the policy on every request rather than
+    // trusted from the row: a role the owner loses - or one an application's
+    // policy stops allowing - must take effect immediately, without having to
     // hunt down every token that still carries it
-    const effective = token.Roles.filter((r) => owner.Role.includes(r));
+    const allowed = await _allowed_roles(owner);
+    const effective = token.Roles.filter((r) => allowed.includes(r));
     if (effective.length === 0) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });
     }

package/lib/mjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAW,EAAE,KAAe;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAW;IAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe;IAC9D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAE1C,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/mjs/cli/CreateToken.js

@@ -46,7 +46,7 @@ CreateToken = __decorate([
     Command('rbac:token-create', 'Creates an access token for a user'),
     Argument('userIdOrUuid', true, 'numeric id or uuid of the owner'),
     Option('-n, --name <name>', true, 'token label'),
-    Option('-r, --roles <roles>', true, 'token roles, comma separated, must be subset of owner roles'),
+    Option('-r, --roles <roles>', true, 'token roles, comma separated, must be allowed for the owner by the configured role policy'),
     Option('-e, --expires <expires>', false, 'ISO expiration instant; omit for a token that never expires')
 ], CreateToken);
 export { CreateToken };

package/lib/mjs/cli/CreateToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IALvB,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC;IAClG,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}
+{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IALvB,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,2FAA2F,CAAC;IAChI,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}

package/lib/mjs/cli/GrantTokenRole.js

@@ -28,7 +28,7 @@ __decorate([
 GrantTokenRole = __decorate([
     Command('rbac:token-grant', 'Grants a role to an access token'),
     Argument('uuid', true, 'token uuid'),
-    Argument('role', true, 'role to grant, must be held by token owner')
+    Argument('role', true, 'role to grant, must be allowed for the token owner by the configured role policy')
 ], GrantTokenRole);
 export { GrantTokenRole };
 //# sourceMappingURL=GrantTokenRole.js.map

package/lib/mjs/cli/GrantTokenRole.js.map

@@ -1 +1 @@
-{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;2CAAC;AAFR,cAAc;IAH1B,OAAO,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;GACxD,cAAc,CAY1B"}
+{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;2CAAC;AAFR,cAAc;IAH1B,OAAO,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,kFAAkF,CAAC;GAC9F,cAAc,CAY1B"}

package/lib/mjs/config/rbac-http-token.d.ts

@@ -30,6 +30,23 @@ declare const rbacHttpToken: {
             generation: {
                 service: string;
             };
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: string;
+            };
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: string[];
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/mjs/config/rbac-http-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}
+{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;;;;;;eAQG;YACH,aAAa,EAAQ,MAAM,EAAE;YAE7B;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}

package/lib/mjs/config/rbac-http-token.js

@@ -55,6 +55,23 @@ const rbacHttpToken = {
             generation: {
                 service: 'SecureRandomTokenProvider',
             },
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: 'OwnRolesTokenRolePolicy',
+            },
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: [],
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/mjs/config/rbac-http-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;aACnC;YAED;;;;;;;;eAQG;YACH,aAAa,EAAE,EAAc;YAE7B;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/mjs/controllers/AccessTokenController.d.ts

@@ -39,6 +39,17 @@ import { CreateTokenDto } from '../dto/create-token-dto.js';
  * @tags AccessTokens
  */
 export declare class AccessTokenController extends BaseController {
+    /**
+     * Roles that may be put on a new token
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates against, so a client can never be offered a
+     * role the create call would then refuse.
+     * @security cookieAuth
+     * @response 200 Roles the caller may put on a token
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    roles(user: UserModel): Promise<Ok<unknown>>;
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -52,10 +63,11 @@ export declare class AccessTokenController extends BaseController {
     /**
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
-     * Roles must be a subset of the caller's own roles.
+     * Roles must be a subset of what the configured AccessTokenRolePolicy allows
+     * the caller - the same set `GET user/tokens/roles` reports.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not held by the caller
+     * @response 400 Requested roles are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
@@ -72,13 +84,14 @@ export declare class AccessTokenController extends BaseController {
     delete(user: UserModel, uuid: string): Promise<Ok | NotFound>;
     /**
      * Grant a role to an own token
-     * The role must be held by the caller - a token can never carry more than its
-     * owner does.
+     * The role must be allowed for the caller by the configured
+     * AccessTokenRolePolicy - a token can never carry more than the policy
+     * permits its owner.
      * @security cookieAuth
      * @param uuid Public identifier of the token
      * @param role Role name to grant
      * @response 200 Updated token
-     * @response 400 Role is not held by the caller
+     * @response 400 Role is not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      * @response 404 No such token for this user

package/lib/mjs/controllers/AccessTokenController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;OAYG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;OASG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEhE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;OAUG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}