@spinajs/rbac-http-token 2.0.513 → 2.0.515

package/README.md

@@ -79,10 +79,62 @@ case-insensitive) or the configured fallback header (`x-api-key` by default).
   outlive it, carry the victim's roles, and be invisible to them.
 - A token always keeps at least one role - revoking the last one is refused
   (400 / `E_TOKEN_ROLE_NOT_ALLOWED`). Delete the token to revoke it entirely.
-- A token can never carry a role its owner does not hold, at creation or grant.
+- A token can never carry a role the configured policy disallows for its
+  owner, at creation or grant. The shipped default limits that to the owner's
+  own roles - see [Token role policy](#token-role-policy).
 - `LastUsedAt` is stamped on use, throttled to one write per
   `rbac.token.lastUsedUpdateInterval` seconds.
 
+## Token role policy
+
+`AccessTokenRolePolicy.allowedRoles(owner)` decides which roles an owner may
+put on a token. There is exactly one method, but FOUR call sites -
+`createToken`, `grantTokenRole`, `validateToken` and the `GET
+user/tokens/roles` controller route (all through the shared `_allowed_roles`
+helper in `src/actions.ts`) - share it deliberately: creation time and request
+time have to agree on the same answer, or a role a user was allowed to pick
+could be one their token silently loses (or gains) on the very next request.
+
+**`owner` is only guaranteed to be a base `User` with `Metadata` populated -
+nothing more.** `GET user/tokens/roles` and `createToken` (from `POST
+user/tokens`) are handed `req.storage.User`, the application's `User`
+subclass with whatever the request pipeline already hydrated onto it, while
+`grantTokenRole` and `validateToken` are handed a base `User` loaded
+independently of any application model override. A policy that reads a field
+an application added to its own `User` subclass will see it on a
+session-authenticated call and not on a token-authenticated one - implement
+against base `User` + `Metadata` only.
+
+The shipped default, `OwnRolesTokenRolePolicy`, answers with the owner's own
+`Role` array. That is the behaviour this package had before the seam existed,
+so an application that configures nothing sees no change.
+
+To scope tokens more narrowly than "everything the owner can do" - or to allow
+a token to carry a role that is not on the owner's `Role` list at all -
+implement `AccessTokenRolePolicy`, decorate the class with
+`@Injectable(AccessTokenRolePolicy)`, and name it in
+`rbac.token.rolePolicy.service`, the same pattern
+`rbac.token.generation.service` uses for the token generator.
+
+Because `validateToken` re-asks the policy on every authenticated request
+instead of trusting the roles stored on the token row, swapping in - or
+tightening - a policy takes effect immediately on every existing token: there
+is nothing to migrate or re-issue. `GET user/tokens/roles` exposes the same
+answer to a caller before they create a token, from the same policy
+`POST user/tokens` validates against, so a client is never offered a role that
+creation would then refuse.
+
+`rbac.token.excludedRoles` is a list of role-name patterns for a custom policy
+to consult - it is not read by anything shipped in this package, including the
+default policy. `_role_excluded(role, patterns)`, exported from
+`src/role-policy.ts`, implements the matching: a pattern is either an exact
+role name, or a name ending in `.*`, which matches that prefix and everything
+beneath it - `route.*` matches `route.home` and `route.admin.users`, but not
+`routes.read` (the dot is part of the boundary, so a pattern can never swallow
+an unrelated role that merely starts with the same letters). No other
+wildcard syntax is supported, on purpose - a full glob in a security list
+invites patterns nobody can reason about.
+
 ## HTTP API (session auth required)
 
 All routes live under the `user.tokens` resource and operate on the caller's own
@@ -90,15 +142,17 @@ tokens only - a foreign uuid simply reads as 404.
 
 | Route | Description |
 |---|---|
+| `GET user/tokens/roles` | roles the caller may put on a token |
 | `GET user/tokens` | list own tokens |
 | `POST user/tokens` | create (`{ Name, Roles, ExpiresAt? }`), returns plaintext once |
 | `DELETE user/tokens/:uuid` | revoke (delete) a token |
 | `PUT user/tokens/:uuid/roles/:role` | grant role |
 | `DELETE user/tokens/:uuid/roles/:role` | revoke role |
 
-Responses: `400` for role refusals (role not held by the caller, last role
-revoke), `401` without a valid session, `403` when the request is
-token-authenticated or impersonated, `404` for a token the caller does not own.
+Responses: `400` for role refusals (role not allowed for the caller by the
+configured role policy, last role revoke), `401` without a valid session,
+`403` when the request is token-authenticated or impersonated, `404` for a
+token the caller does not own.
 
 ## CLI
 
@@ -110,8 +164,8 @@ rbac:token-revoke <uuid> <role>
 rbac:token-delete-expired   # run cyclically from a worker
 ```
 
-- `-r, --roles` is a comma separated list, and must be a subset of the owner's
-  roles.
+- `-r, --roles` is a comma separated list, and must be allowed for the owner
+  by the configured role policy (see [Token role policy](#token-role-policy)).
 - `-e, --expires` takes an ISO instant. Omitting the flag entirely means the
   token never expires; an empty or unparsable value is refused rather than
   silently treated as "no expiration".
@@ -134,6 +188,8 @@ See `src/config/rbac-http-token.ts` - `rbac.token.*`:
 | Key | Default | Meaning |
 |---|---|---|
 | `rbac.token.generation.service` | `SecureRandomTokenProvider` | `AccessTokenGenerationProvider` implementation used to generate/hash tokens |
+| `rbac.token.rolePolicy.service` | `OwnRolesTokenRolePolicy` | `AccessTokenRolePolicy` implementation that decides which roles an owner may put on a token (see [Token role policy](#token-role-policy)) |
+| `rbac.token.excludedRoles` | `[]` | role-name patterns (exact, or `prefix.*`) for a custom policy to consult - not read by the shipped default |
 | `rbac.token.prefix` | `spt_` | stable plaintext prefix, lets secret scanners recognise leaked tokens |
 | `rbac.token.length` | `32` | random bytes per token (32 = 256 bit entropy) |
 | `rbac.token.headerName` | `x-api-key` | fallback header checked when no `Authorization: Bearer` is present |

package/lib/cjs/actions.d.ts

@@ -27,19 +27,53 @@ export declare function _token(token: AccessToken | string): () => Promise<Acces
  * populated ( needed for IsBanned checks downstream ).
  */
 export declare function _owner(user: User | number | string): () => Promise<User>;
+/**
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+export declare function _allowed_roles(owner: User, profile?: string): Promise<string[]>;
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export declare function _allowed_profiles(owner: User): Promise<string[]>;
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null, profile?: string): Promise<{
     Token: AccessToken;
     Plaintext: string;
 }>;
@@ -50,7 +84,8 @@ export declare function createToken(user: User | number | string, name: string,
  */
 export declare function deleteToken(token: AccessToken | string): Promise<void>;
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -78,7 +113,8 @@ export interface ITokenValidationResult {
     User: User;
     Token: AccessToken;
     /**
-     * Token roles that the owner still holds. Permission checks run with these.
+     * Token roles the configured {@link AccessTokenRolePolicy} still allows for
+     * the owner. Permission checks run with these.
      */
     EffectiveRoles: string[];
 }

package/lib/cjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC/L;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyDtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/cjs/actions.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.E_TOKEN_CODES = void 0;
 exports._token = _token;
 exports._owner = _owner;
+exports._allowed_roles = _allowed_roles;
+exports._allowed_profiles = _allowed_profiles;
 exports.createToken = createToken;
 exports.deleteToken = deleteToken;
 exports.grantTokenRole = grantTokenRole;
@@ -20,6 +22,7 @@ const util_1 = require("@spinajs/util");
 const configuration_1 = require("@spinajs/configuration");
 const queue_1 = require("@spinajs/queue");
 const exceptions_1 = require("@spinajs/exceptions");
+const di_1 = require("@spinajs/di");
 const AccessToken_js_1 = require("./models/AccessToken.js");
 const interfaces_js_1 = require("./interfaces.js");
 const index_js_1 = require("./events/index.js");
@@ -78,37 +81,101 @@ function _token_ev(event, ...args) {
     };
 }
 /**
- * Ensures every role in `roles` is currently held by `owner`.
- * A token must never carry a role its owner does not have.
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+async function _allowed_roles(owner, profile) {
+    const policy = await (0, configuration_1._service)('rbac.token.rolePolicy', interfaces_js_1.AccessTokenRolePolicy)();
+    const allowed = await policy.allowedRoles(owner, profile);
+    const ac = di_1.DI.get('AccessControl');
+    const grants = ac.getGrants();
+    return allowed.filter((r) => Object.hasOwn(grants, r));
+}
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+async function _allowed_profiles(owner) {
+    const policy = await (0, configuration_1._service)('rbac.token.rolePolicy', interfaces_js_1.AccessTokenRolePolicy)();
+    return policy.allowedProfiles(owner);
+}
+/**
+ * Ensures `profile` is one the configured policy lets `owner` pin a token to.
  */
-function _assert_roles_subset(owner, roles) {
-    const missing = roles.filter((r) => !owner.Role.includes(r));
+async function _assert_profile(owner, profile) {
+    const allowed = await _allowed_profiles(owner);
+    if (!allowed.includes(profile)) {
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not pin a token to profile: ${profile}`, { roles: [profile] });
+    }
+}
+/**
+ * Ensures every role in `roles` is one the configured policy allows for
+ * `owner`. Deliberately not "one the owner literally holds" - a policy may
+ * permit roles beyond the owner's own `Role` list, or withhold ones on it;
+ * that flexibility is the entire point of the policy seam.
+ *
+ * With `profile` given the question is asked relative to that profile, which a
+ * policy may answer more narrowly than the owner-wide union.
+ */
+async function _assert_roles_subset(owner, roles, profile) {
+    const allowed = await _allowed_roles(owner, profile);
+    const missing = roles.filter((r) => !allowed.includes(r));
     if (missing.length !== 0) {
-        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner does not hold role(s): ${missing.join(', ')}`, { roles: missing });
+        throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
     }
 }
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-async function createToken(user, name, roles, expiresAt) {
+async function createToken(user, name, roles, expiresAt, profile) {
     name = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)(), (0, util_1._max_length)(128))(name, 'name');
     roles = (0, util_1._check_arg)((0, util_1._non_nil)(), (0, util_1._non_empty)())(roles, 'roles');
     const generator = await (0, configuration_1._service)('rbac.token.generation', interfaces_js_1.AccessTokenGenerationProvider)();
     const generated = await generator.generate();
-    return (0, util_1._chain)(_owner(user), (0, util_1._tap)(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+    return (0, util_1._chain)(_owner(user), (0, util_1._tap)(async (u) => {
+        if (profile) {
+            await _assert_profile(u, profile);
+        }
+        await _assert_roles_subset(u, roles, profile);
+    }), async (u) => {
         const token = new AccessToken_js_1.AccessToken({
             Name: name,
             Token: generated.Hash,
             Roles: lodash_1.default.uniq(roles),
+            Profile: profile ?? undefined,
             // `ExpiresAt` is optional rather than nullable ( see the model ), so a
             // "never expires" token leaves the property unset instead of holding null.
             ExpiresAt: expiresAt ?? undefined,
@@ -127,7 +194,8 @@ async function deleteToken(token) {
     return (0, util_1._chain)(_token(token), (0, util_1._tap)((t) => t.destroy()), _token_ev(index_js_1.AccessTokenDeleted), () => undefined);
 }
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -136,7 +204,7 @@ async function grantTokenRole(token, role) {
     role = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(role, 'role');
     return (0, util_1._chain)(_token(token), (0, util_1._tap)(async (t) => {
         const owner = await _owner(t.user_id)();
-        _assert_roles_subset(owner, [role]);
+        await _assert_roles_subset(owner, [role], t.Profile);
         t.Roles = lodash_1.default.uniq([...t.Roles, role]);
         await t.update();
     }), _token_ev(index_js_1.AccessTokenRoleGranted, role));
@@ -213,10 +281,21 @@ async function validateToken(plaintext) {
     if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
         throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
     }
-    // roles are re-intersected on every request rather than trusted from the row:
-    // a role revoked on the user must take effect immediately, without having to
+    // a profile token whose owner no longer passes the profile policy (role
+    // revoked, policy tightened) authorises nothing - same immediacy rule as
+    // the role re-intersection below
+    if (token.Profile) {
+        const profiles = await _allowed_profiles(owner);
+        if (!profiles.includes(token.Profile)) {
+            throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token profile is no longer allowed for its owner', { token: token.Uuid });
+        }
+    }
+    // roles are re-checked against the policy on every request rather than
+    // trusted from the row: a role the owner loses - or one an application's
+    // policy stops allowing - must take effect immediately, without having to
     // hunt down every token that still carries it
-    const effective = token.Roles.filter((r) => owner.Role.includes(r));
+    const allowed = await _allowed_roles(owner, token.Profile);
+    const effective = token.Roles.filter((r) => allowed.includes(r));
     if (effective.length === 0) {
         throw new exceptions_1.ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });
     }

package/lib/cjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAuB;AACvB,iCAAiC;AACjC,wCAAqC;AACrC,wCAAmG;AACnG,0DAAkD;AAClD,0CAAqC;AACrC,oDAAgD;AAGhD,4DAAsD;AACtD,mDAAgE;AAChE,gDAA6I;AAE7I;;;;;;;;;;GAUG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,aAAb,aAAa,GAAb,aAAa,QAKxB;AAED;;GAEG;AACH,gBAAuB,KAA2B;IAChD,IAAI,gBAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,4BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,gBAAuB,IAA4B;IACjD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAW,EAAE,KAAe;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,sBAAsB,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,4BAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,gBAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,6BAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,sBAAsB,KAA2B;IAC3D,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,6BAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,yBAAyB,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,0BAA0B,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;GAYG;AACI,KAAK,wBAAwB,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,gBAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACI,KAAK;IACV,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,qBAAqB,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,oDAAuB;AACvB,iCAAiC;AAEjC,wCAAqC;AACrC,wCAAmG;AACnG,0DAAkD;AAClD,0CAAqC;AACrC,oDAAgD;AAChD,oCAA8C;AAE9C,4DAAsD;AACtD,mDAAuF;AACvF,gDAA6I;AAE7I;;;;;;;;;;GAUG;AACH,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,aAAb,aAAa,GAAb,aAAa,QAKxB;AAED;;GAEG;AACH,gBAAuB,KAA2B;IAChD,IAAI,gBAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,4BAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,gBAAuB,IAA4B;IACjD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,yBAAyB,KAAW,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAQ,EAAwB,uBAAuB,EAAE,qCAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACI,KAAK,4BAA4B,KAAW;IACjD,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAQ,EAAwB,uBAAuB,EAAE,qCAAqB,CAAC,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,KAAW,EAAE,OAAe;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe,EAAE,OAAgB;IAChF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,sBAAsB,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B,EAAE,OAAgB;IACzI,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,EACF,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,4BAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,gBAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,6BAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,sBAAsB,KAA2B;IAC3D,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,6BAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,yBAAyB,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAErD,CAAC,CAAC,KAAK,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,0BAA0B,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAA,WAAI,EAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,iCAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACI,KAAK,wBAAwB,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,gBAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAgC,uBAAuB,EAAE,6CAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,WAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACI,KAAK;IACV,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,qBAAqB,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/cjs/cli/CreateToken.js

@@ -50,7 +50,7 @@ exports.CreateToken = CreateToken = __decorate([
     (0, cli_1.Command)('rbac:token-create', 'Creates an access token for a user'),
     (0, cli_1.Argument)('userIdOrUuid', true, 'numeric id or uuid of the owner'),
     (0, cli_1.Option)('-n, --name <name>', true, 'token label'),
-    (0, cli_1.Option)('-r, --roles <roles>', true, 'token roles, comma separated, must be subset of owner roles'),
+    (0, cli_1.Option)('-r, --roles <roles>', true, 'token roles, comma separated, must be allowed for the owner by the configured role policy'),
     (0, cli_1.Option)('-e, --expires <expires>', false, 'ISO expiration instant; omit for a token that never expires')
 ], CreateToken);
 //# sourceMappingURL=CreateToken.js.map

package/lib/cjs/cli/CreateToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAAqE;AACrE,iCAAiC;AAEjC,8CAA4C;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,gBAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;wCAAC;sBAFR,WAAW;IALvB,IAAA,aAAO,EAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,IAAA,cAAQ,EAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,IAAA,YAAM,EAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,IAAA,YAAM,EAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC;IAClG,IAAA,YAAM,EAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}
+{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAAqE;AACrE,iCAAiC;AAEjC,8CAA4C;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,gBAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;wCAAC;sBAFR,WAAW;IALvB,IAAA,aAAO,EAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,IAAA,cAAQ,EAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,IAAA,YAAM,EAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,IAAA,YAAM,EAAC,qBAAqB,EAAE,IAAI,EAAE,2FAA2F,CAAC;IAChI,IAAA,YAAM,EAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}

package/lib/cjs/cli/GrantTokenRole.js

@@ -32,6 +32,6 @@ __decorate([
 exports.GrantTokenRole = GrantTokenRole = __decorate([
     (0, cli_1.Command)('rbac:token-grant', 'Grants a role to an access token'),
     (0, cli_1.Argument)('uuid', true, 'token uuid'),
-    (0, cli_1.Argument)('role', true, 'role to grant, must be held by token owner')
+    (0, cli_1.Argument)('role', true, 'role to grant, must be allowed for the token owner by the configured role policy')
 ], GrantTokenRole);
 //# sourceMappingURL=GrantTokenRole.js.map

package/lib/cjs/cli/GrantTokenRole.js.map

@@ -1 +1 @@
-{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAA6D;AAE7D,8CAA+C;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,IAAA,2BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;;AAVW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;2CAAC;yBAFR,cAAc;IAH1B,IAAA,aAAO,EAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;GACxD,cAAc,CAY1B"}
+{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAA6D;AAE7D,8CAA+C;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,IAAA,2BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;;AAVW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;2CAAC;yBAFR,cAAc;IAH1B,IAAA,aAAO,EAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,IAAA,cAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,kFAAkF,CAAC;GAC9F,cAAc,CAY1B"}

package/lib/cjs/config/rbac-http-token.d.ts

@@ -30,6 +30,23 @@ declare const rbacHttpToken: {
             generation: {
                 service: string;
             };
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: string;
+            };
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: string[];
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/cjs/config/rbac-http-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}
+{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;;;;;;eAQG;YACH,aAAa,EAAQ,MAAM,EAAE;YAE7B;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}

package/lib/cjs/config/rbac-http-token.js

@@ -57,6 +57,23 @@ const rbacHttpToken = {
             generation: {
                 service: 'SecureRandomTokenProvider',
             },
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: 'OwnRolesTokenRolePolicy',
+            },
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: [],
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/cjs/config/rbac-http-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;kBAEa,aAAa"}
+{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;aACnC;YAED;;;;;;;;eAQG;YACH,aAAa,EAAE,EAAc;YAE7B;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;kBAEa,aAAa"}

package/lib/cjs/controllers/AccessTokenController.d.ts

@@ -39,6 +39,34 @@ import { CreateTokenDto } from '../dto/create-token-dto.js';
  * @tags AccessTokens
  */
 export declare class AccessTokenController extends BaseController {
+    /**
+     * Roles that may be put on a new token
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates against, so a client can never be offered a
+     * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
+     * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
+     * @response 200 Roles the caller may put on a token
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    roles(user: UserModel, profile?: string): Promise<Ok<unknown>>;
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    profiles(user: UserModel): Promise<Ok<unknown>>;
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -52,10 +80,14 @@ export declare class AccessTokenController extends BaseController {
     /**
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
-     * Roles must be a subset of the caller's own roles.
+     * Roles must be a subset of what the configured AccessTokenRolePolicy allows
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not held by the caller
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
@@ -72,13 +104,14 @@ export declare class AccessTokenController extends BaseController {
     delete(user: UserModel, uuid: string): Promise<Ok | NotFound>;
     /**
      * Grant a role to an own token
-     * The role must be held by the caller - a token can never carry more than its
-     * owner does.
+     * The role must be allowed for the caller by the configured
+     * AccessTokenRolePolicy - a token can never carry more than the policy
+     * permits its owner.
      * @security cookieAuth
      * @param uuid Public identifier of the token
      * @param role Role name to grant
      * @response 200 Updated token
-     * @response 400 Role is not held by the caller
+     * @response 400 Role is not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      * @response 404 No such token for this user

package/lib/cjs/controllers/AccessTokenController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;OAYG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAAmC,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAW,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAE3F;IAED;;;;;;;;;OASG;IAGU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEnE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;;;;OAaG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}