@spinajs/rbac-http-token 2.0.513 → 2.0.515

package/lib/mjs/actions.d.ts

@@ -27,19 +27,53 @@ export declare function _token(token: AccessToken | string): () => Promise<Acces
  * populated ( needed for IsBanned checks downstream ).
  */
 export declare function _owner(user: User | number | string): () => Promise<User>;
+/**
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+export declare function _allowed_roles(owner: User, profile?: string): Promise<string[]>;
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export declare function _allowed_profiles(owner: User): Promise<string[]>;
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null, profile?: string): Promise<{
     Token: AccessToken;
     Plaintext: string;
 }>;
@@ -50,7 +84,8 @@ export declare function createToken(user: User | number | string, name: string,
  */
 export declare function deleteToken(token: AccessToken | string): Promise<void>;
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -78,7 +113,8 @@ export interface ITokenValidationResult {
     User: User;
     Token: AccessToken;
     /**
-     * Token roles that the owner still holds. Permission checks run with these.
+     * Token roles the configured {@link AccessTokenRolePolicy} still allows for
+     * the owner. Permission checks run with these.
      */
     EffectiveRoles: string[];
 }

package/lib/mjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC/L;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyDtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/mjs/actions.js

@@ -5,8 +5,9 @@ import { _chain, _check_arg, _tap, _trim, _non_empty, _non_nil, _max_length } fr
 import { _service } from '@spinajs/configuration';
 import { _ev } from '@spinajs/queue';
 import { ErrorCode } from '@spinajs/exceptions';
+import { DI } from '@spinajs/di';
 import { AccessToken } from './models/AccessToken.js';
-import { AccessTokenGenerationProvider } from './interfaces.js';
+import { AccessTokenGenerationProvider, AccessTokenRolePolicy } from './interfaces.js';
 import { AccessTokenCreated, AccessTokenDeleted, AccessTokenRoleGranted, AccessTokenRoleRevoked } from './events/index.js';
 /**
  * Failure codes carried by every {@link ErrorCode} this module throws.
@@ -63,37 +64,101 @@ function _token_ev(event, ...args) {
     };
 }
 /**
- * Ensures every role in `roles` is currently held by `owner`.
- * A token must never carry a role its owner does not have.
+ * Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
+ * token. Resolved per call rather than cached, so a policy that answers from
+ * live state ( the owner's current roles, the application's grants ) is not
+ * frozen at boot.
+ *
+ * Filters the policy's answer down to role names `accesscontrol` actually
+ * knows about ( i.e. present in `ac.getGrants()` ). A policy is arbitrary
+ * application code and may return a typo'd or stale role name; without this
+ * filter such a name would be offered by `GET user/tokens/roles`, accepted by
+ * `createToken`/`grantTokenRole` onto a token, and then make every request
+ * that token authenticates 500 - `checkRoutePermission` calls
+ * `ac.can(roles)[permission](resource)`, and `accesscontrol` throws
+ * `AccessControlError` for a role absent from its grants map. A role that
+ * grants nothing must never be offered or authorised in the first place.
+ *
+ * Filters with `Object.hasOwn`, not `Boolean(grants[r])`: `getGrants()` returns a plain
+ * object, so `grants['constructor']`, `['toString']`, `['valueOf']`, `['hasOwnProperty']`
+ * and `['__proto__']` all resolve truthy through the prototype chain even though no role by
+ * that name was ever registered. A policy returning `'constructor'` would otherwise survive
+ * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
+ */
+export async function _allowed_roles(owner, profile) {
+    const policy = await _service('rbac.token.rolePolicy', AccessTokenRolePolicy)();
+    const allowed = await policy.allowedRoles(owner, profile);
+    const ac = DI.get('AccessControl');
+    const grants = ac.getGrants();
+    return allowed.filter((r) => Object.hasOwn(grants, r));
+}
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export async function _allowed_profiles(owner) {
+    const policy = await _service('rbac.token.rolePolicy', AccessTokenRolePolicy)();
+    return policy.allowedProfiles(owner);
+}
+/**
+ * Ensures `profile` is one the configured policy lets `owner` pin a token to.
  */
-function _assert_roles_subset(owner, roles) {
-    const missing = roles.filter((r) => !owner.Role.includes(r));
+async function _assert_profile(owner, profile) {
+    const allowed = await _allowed_profiles(owner);
+    if (!allowed.includes(profile)) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not pin a token to profile: ${profile}`, { roles: [profile] });
+    }
+}
+/**
+ * Ensures every role in `roles` is one the configured policy allows for
+ * `owner`. Deliberately not "one the owner literally holds" - a policy may
+ * permit roles beyond the owner's own `Role` list, or withhold ones on it;
+ * that flexibility is the entire point of the policy seam.
+ *
+ * With `profile` given the question is asked relative to that profile, which a
+ * policy may answer more narrowly than the owner-wide union.
+ */
+async function _assert_roles_subset(owner, roles, profile) {
+    const allowed = await _allowed_roles(owner, profile);
+    const missing = roles.filter((r) => !allowed.includes(r));
     if (missing.length !== 0) {
-        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner does not hold role(s): ${missing.join(', ')}`, { roles: missing });
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
     }
 }
 /**
  * Creates a new access token for a user.
  *
- * Roles must be a non-empty subset of the owner's current roles. `expiresAt`
- * null means the token never expires. The plaintext is returned once and
- * never persisted - only its hash is stored.
+ * Roles must be a non-empty subset of the roles the configured
+ * {@link AccessTokenRolePolicy} allows the owner to carry ( see
+ * `_allowed_roles` above - not necessarily the owner's literal `Role` list ).
+ * `expiresAt` null means the token never expires. The plaintext is returned
+ * once and never persisted - only its hash is stored.
  *
  * @param user - owner: {@link User} instance, numeric id or uuid
  * @param name - human readable label
- * @param roles - roles carried by the token, subset of the owner's roles
+ * @param roles - roles carried by the token, subset of what the configured
+ *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export async function createToken(user, name, roles, expiresAt) {
+export async function createToken(user, name, roles, expiresAt, profile) {
     name = _check_arg(_trim(), _non_empty(), _max_length(128))(name, 'name');
     roles = _check_arg(_non_nil(), _non_empty())(roles, 'roles');
     const generator = await _service('rbac.token.generation', AccessTokenGenerationProvider)();
     const generated = await generator.generate();
-    return _chain(_owner(user), _tap(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+    return _chain(_owner(user), _tap(async (u) => {
+        if (profile) {
+            await _assert_profile(u, profile);
+        }
+        await _assert_roles_subset(u, roles, profile);
+    }), async (u) => {
         const token = new AccessToken({
             Name: name,
             Token: generated.Hash,
             Roles: _.uniq(roles),
+            Profile: profile ?? undefined,
             // `ExpiresAt` is optional rather than nullable ( see the model ), so a
             // "never expires" token leaves the property unset instead of holding null.
             ExpiresAt: expiresAt ?? undefined,
@@ -112,7 +177,8 @@ export async function deleteToken(token) {
     return _chain(_token(token), _tap((t) => t.destroy()), _token_ev(AccessTokenDeleted), () => undefined);
 }
 /**
- * Adds a role to a token. The role must be held by the token owner.
+ * Adds a role to a token. The role must be allowed for the token owner by the
+ * configured {@link AccessTokenRolePolicy}.
  *
  * @param token - {@link AccessToken} instance or its uuid
  * @param role - role name to grant
@@ -121,7 +187,7 @@ export async function grantTokenRole(token, role) {
     role = _check_arg(_trim(), _non_empty())(role, 'role');
     return _chain(_token(token), _tap(async (t) => {
         const owner = await _owner(t.user_id)();
-        _assert_roles_subset(owner, [role]);
+        await _assert_roles_subset(owner, [role], t.Profile);
         t.Roles = _.uniq([...t.Roles, role]);
         await t.update();
     }), _token_ev(AccessTokenRoleGranted, role));
@@ -198,10 +264,21 @@ export async function validateToken(plaintext) {
     if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
     }
-    // roles are re-intersected on every request rather than trusted from the row:
-    // a role revoked on the user must take effect immediately, without having to
+    // a profile token whose owner no longer passes the profile policy (role
+    // revoked, policy tightened) authorises nothing - same immediacy rule as
+    // the role re-intersection below
+    if (token.Profile) {
+        const profiles = await _allowed_profiles(owner);
+        if (!profiles.includes(token.Profile)) {
+            throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token profile is no longer allowed for its owner', { token: token.Uuid });
+        }
+    }
+    // roles are re-checked against the policy on every request rather than
+    // trusted from the row: a role the owner loses - or one an application's
+    // policy stops allowing - must take effect immediately, without having to
     // hunt down every token that still carries it
-    const effective = token.Roles.filter((r) => owner.Role.includes(r));
+    const allowed = await _allowed_roles(owner, token.Profile);
+    const effective = token.Roles.filter((r) => allowed.includes(r));
     if (effective.length === 0) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });
     }

package/lib/mjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAW,EAAE,KAAe;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAW,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAW;IACjD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,KAAW,EAAE,OAAe;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe,EAAE,OAAgB;IAChF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B,EAAE,OAAgB;IACzI,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,EACF,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAErD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/mjs/cli/CreateToken.js

@@ -46,7 +46,7 @@ CreateToken = __decorate([
     Command('rbac:token-create', 'Creates an access token for a user'),
     Argument('userIdOrUuid', true, 'numeric id or uuid of the owner'),
     Option('-n, --name <name>', true, 'token label'),
-    Option('-r, --roles <roles>', true, 'token roles, comma separated, must be subset of owner roles'),
+    Option('-r, --roles <roles>', true, 'token roles, comma separated, must be allowed for the owner by the configured role policy'),
     Option('-e, --expires <expires>', false, 'ISO expiration instant; omit for a token that never expires')
 ], CreateToken);
 export { CreateToken };

package/lib/mjs/cli/CreateToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IALvB,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC;IAClG,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}
+{"version":3,"file":"CreateToken.js","sourceRoot":"","sources":["../../../src/cli/CreateToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAarC,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,UAAU;IAIlC,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,OAA4B;QACrE,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvH,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAEtF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;wCAAC;AAFR,WAAW;IALvB,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,iCAAiC,CAAC;IACjE,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,2FAA2F,CAAC;IAChI,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,CAAC;GAC3F,WAAW,CA+BvB"}

package/lib/mjs/cli/GrantTokenRole.js

@@ -28,7 +28,7 @@ __decorate([
 GrantTokenRole = __decorate([
     Command('rbac:token-grant', 'Grants a role to an access token'),
     Argument('uuid', true, 'token uuid'),
-    Argument('role', true, 'role to grant, must be held by token owner')
+    Argument('role', true, 'role to grant, must be allowed for the token owner by the configured role policy')
 ], GrantTokenRole);
 export { GrantTokenRole };
 //# sourceMappingURL=GrantTokenRole.js.map

package/lib/mjs/cli/GrantTokenRole.js.map

@@ -1 +1 @@
-{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;2CAAC;AAFR,cAAc;IAH1B,OAAO,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;GACxD,cAAc,CAY1B"}
+{"version":3,"file":"GrantTokenRole.js","sourceRoot":"","sources":["../../../src/cli/GrantTokenRole.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKxC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;IAIrC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,IAAI,aAAa,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;2CAAC;AAFR,cAAc;IAH1B,OAAO,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,kFAAkF,CAAC;GAC9F,cAAc,CAY1B"}

package/lib/mjs/config/rbac-http-token.d.ts

@@ -30,6 +30,23 @@ declare const rbacHttpToken: {
             generation: {
                 service: string;
             };
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: string;
+            };
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: string[];
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/mjs/config/rbac-http-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}
+{"version":3,"file":"rbac-http-token.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,aAAa;IACjB,MAAM;QACJ,IAAI;YAIF,GAAG;YACH,WAAW;;;IAqBf,KAAK;QAKH,OAAO;YACL,kBAAkB;gBAAI,UAAU;;YAChC,kBAAkB;gBAAI,UAAU;;YAChC,sBAAsB;gBAAI,UAAU;;YACpC,sBAAsB;gBAAI,UAAU;;;;IAGxC,IAAI;QACF,KAAK;YACH;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;eAGG;YACH,UAAU;gBACR,OAAO;;YAGT;;;;;;;;eAQG;YACH,aAAa,EAAQ,MAAM,EAAE;YAE7B;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,MAAM;YAEN;;eAEG;YACH,UAAU;YAEV;;eAEG;YACH,sBAAsB;;QAExB,MAAM;YACJ,IAAI;gBACF,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;YAa5F,aAAa;gBACX,aAAa;oBAAI,YAAY;oBAAS,UAAU;oBAAS,YAAY;oBAAS,YAAY;;;;;CAIjG,CAAC;eAEa,aAAa"}

package/lib/mjs/config/rbac-http-token.js

@@ -55,6 +55,23 @@ const rbacHttpToken = {
             generation: {
                 service: 'SecureRandomTokenProvider',
             },
+            /**
+             * Decides which roles an owner may put on a token. Swap for your own
+             * implementation of AccessTokenRolePolicy registered under this name.
+             */
+            rolePolicy: {
+                service: 'OwnRolesTokenRolePolicy',
+            },
+            /**
+             * Role name patterns for a custom AccessTokenRolePolicy to consult - not
+             * read by anything shipped in this package, including the default
+             * `OwnRolesTokenRolePolicy`. An exact name, or a name ending in `.*`
+             * matching that prefix and everything under it; matching is implemented
+             * by `_role_excluded(role, patterns)` in `src/role-policy.ts`. Empty by
+             * default: this package has no opinion about which of an application's
+             * roles are meaningful to an API caller.
+             */
+            excludedRoles: [],
             /**
              * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
              */

package/lib/mjs/config/rbac-http-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;aACnC;YAED;;;;;;;;eAQG;YACH,aAAa,EAAE,EAAc;YAE7B;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/mjs/controllers/AccessTokenController.d.ts

@@ -39,6 +39,34 @@ import { CreateTokenDto } from '../dto/create-token-dto.js';
  * @tags AccessTokens
  */
 export declare class AccessTokenController extends BaseController {
+    /**
+     * Roles that may be put on a new token
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates against, so a client can never be offered a
+     * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
+     * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
+     * @response 200 Roles the caller may put on a token
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    roles(user: UserModel, profile?: string): Promise<Ok<unknown>>;
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    profiles(user: UserModel): Promise<Ok<unknown>>;
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -52,10 +80,14 @@ export declare class AccessTokenController extends BaseController {
     /**
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
-     * Roles must be a subset of the caller's own roles.
+     * Roles must be a subset of what the configured AccessTokenRolePolicy allows
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not held by the caller
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
@@ -72,13 +104,14 @@ export declare class AccessTokenController extends BaseController {
     delete(user: UserModel, uuid: string): Promise<Ok | NotFound>;
     /**
      * Grant a role to an own token
-     * The role must be held by the caller - a token can never carry more than its
-     * owner does.
+     * The role must be allowed for the caller by the configured
+     * AccessTokenRolePolicy - a token can never carry more than the policy
+     * permits its owner.
      * @security cookieAuth
      * @param uuid Public identifier of the token
      * @param role Role name to grant
      * @response 200 Updated token
-     * @response 400 Role is not held by the caller
+     * @response 400 Role is not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      * @response 404 No such token for this user

package/lib/mjs/controllers/AccessTokenController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;OAYG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAAmC,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAW,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAE3F;IAED;;;;;;;;;OASG;IAGU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEnE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;;;;OAaG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}

package/lib/mjs/controllers/AccessTokenController.js

@@ -10,13 +10,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put } from '@spinajs/http';
+import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put, Query } from '@spinajs/http';
 import { User as UserModel } from '@spinajs/rbac';
 import { Permission, Resource, User } from '@spinajs/rbac-http';
 import { ErrorCode } from '@spinajs/exceptions';
 import { DateTime } from 'luxon';
 import { AccessToken } from '../models/AccessToken.js';
-import { E_TOKEN_CODES, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
+import { E_TOKEN_CODES, _allowed_profiles, _allowed_roles, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
 import { CreateTokenDto } from '../dto/create-token-dto.js';
 import { NoTokenAuthPolicy } from '../policies/NoTokenAuthPolicy.js';
 import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
@@ -57,6 +57,38 @@ import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
  * @tags AccessTokens
  */
 let AccessTokenController = class AccessTokenController extends BaseController {
+    /**
+     * Roles that may be put on a new token
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates against, so a client can never be offered a
+     * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
+     * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
+     * @response 200 Roles the caller may put on a token
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async roles(user, profile) {
+        return new Ok({ Roles: await _allowed_roles(user, profile) });
+    }
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async profiles(user) {
+        return new Ok({ Profiles: await _allowed_profiles(user) });
+    }
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -73,17 +105,21 @@ let AccessTokenController = class AccessTokenController extends BaseController {
     /**
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
-     * Roles must be a subset of the caller's own roles.
+     * Roles must be a subset of what the configured AccessTokenRolePolicy allows
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not held by the caller
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
     async create(user, dto) {
         const expiresAt = dto.ExpiresAt ? DateTime.fromISO(dto.ExpiresAt) : null;
         try {
-            const { Token, Plaintext } = await createToken(user, dto.Name, dto.Roles, expiresAt);
+            const { Token, Plaintext } = await createToken(user, dto.Name, dto.Roles, expiresAt, dto.Profile);
             return new Ok({ Token: this.toWire(Token), Plaintext }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
         }
         catch (err) {
@@ -109,13 +145,14 @@ let AccessTokenController = class AccessTokenController extends BaseController {
     }
     /**
      * Grant a role to an own token
-     * The role must be held by the caller - a token can never carry more than its
-     * owner does.
+     * The role must be allowed for the caller by the configured
+     * AccessTokenRolePolicy - a token can never carry more than the policy
+     * permits its owner.
      * @security cookieAuth
      * @param uuid Public identifier of the token
      * @param role Role name to grant
      * @response 200 Updated token
-     * @response 400 Role is not held by the caller
+     * @response 400 Role is not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      * @response 404 No such token for this user
@@ -206,6 +243,23 @@ let AccessTokenController = class AccessTokenController extends BaseController {
         throw err;
     }
 };
+__decorate([
+    Get('tokens/roles'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __param(1, Query()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "roles", null);
+__decorate([
+    Get('tokens/profiles'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "profiles", null);
 __decorate([
     Get('tokens'),
     Permission(['readOwn']),