@spinajs/rbac-http-token 2.0.513 → 2.0.515

package/lib/mjs/controllers/AccessTokenController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AA5Jc;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAcY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AArHU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAwKjC"}
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe,EAAW,OAAgB;QACnE,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClG,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AAhMc;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;kDAEzC;AAcY;IAFZ,GAAG,CAAC,iBAAiB,CAAC;IACtB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;qDAE5C;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAkBY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAkBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AAhKU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAmNjC"}

package/lib/mjs/dto/create-token-dto.d.ts

@@ -17,6 +17,12 @@ export declare const CreateTokenDtoSchema: {
             minItems: number;
             description: string;
         };
+        Profile: {
+            type: string;
+            minLength: number;
+            maxLength: number;
+            description: string;
+        };
         ExpiresAt: {
             type: string[];
             format: string;
@@ -28,6 +34,7 @@ export declare const CreateTokenDtoSchema: {
 export declare class CreateTokenDto {
     Name: string;
     Roles: string[];
+    Profile?: string;
     ExpiresAt?: string | null;
     constructor(data: any);
 }

package/lib/mjs/dto/create-token-dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAC3E,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}
+{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAM3E,OAAO;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACpE,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}

package/lib/mjs/dto/create-token-dto.js

@@ -14,7 +14,13 @@ export const CreateTokenDtoSchema = {
     type: 'object',
     properties: {
         Name: { type: 'string', minLength: 1, maxLength: 128, description: 'Human readable token label' },
-        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of own roles' },
+        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of what the role policy allows' },
+        // `minLength: 1` is load bearing, not cosmetic: an empty string is falsy all
+        // the way down the actions layer, so `Profile: ''` would mint an UNPINNED
+        // token instead of a refused one - a silent widening of what the token may
+        // reach. Rejecting it here is what keeps "asked for a profile" and "pinned
+        // to a profile" the same statement.
+        Profile: { type: 'string', minLength: 1, maxLength: 128, description: 'Profile (root role) to pin the token to; omitted = legacy union-scoped token' },
         ExpiresAt: { type: ['string', 'null'], format: 'date-time', description: 'ISO expiration instant; null or omitted = never expires' },
     },
     required: ['Name', 'Roles'],

package/lib/mjs/dto/create-token-dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACxI,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}
+{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE;QAC1J,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,8EAA8E,EAAE;QACtJ,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAMzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AATY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAS1B"}

package/lib/mjs/index.d.ts

@@ -1,9 +1,12 @@
 import './generator.js';
+import './role-policy.js';
 import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
 export * from './generator.js';
+export * from './role-policy.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middlewares.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/index.js

@@ -2,11 +2,14 @@
 // generator and the token authorization middleware ) the moment they are
 // loaded, so they must run even if a consumer imports nothing from them.
 import './generator.js';
+import './role-policy.js';
 import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
 export * from './generator.js';
+export * from './role-policy.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middlewares.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -1,3 +1,4 @@
+import type { User } from '@spinajs/rbac';
 export interface IGeneratedToken {
     /**
      * Full token as handed to the user, e.g. `spt_<base64url>`. Shown exactly once.
@@ -31,6 +32,63 @@ export interface ITokenAuthInfo {
      * Uuid of the AccessToken row - safe to log; never the token itself.
      */
     Uuid: string;
+    /**
+     * The profile (a role name) this token is pinned to, when it carries one.
+     * Consumed by application row-scoping the way a session's ActiveRole is;
+     * permission checks do NOT read it - they stay on the narrowed User.Role.
+     */
+    Profile?: string;
+}
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+export declare abstract class AccessTokenRolePolicy {
+    /**
+     * Roles `owner` may carry on a token. Also the set every one of their
+     * existing tokens is re-intersected with on each authenticated request, so a
+     * role dropped from this answer stops authorising immediately.
+     *
+     * With `profile` set the answer is relative to that profile - an application
+     * policy may (and should) narrow it to roles the profile's own grants cover.
+     * The shipped default ignores the argument.
+     *
+     * @param owner - at minimum a base `User` with `Metadata` populated; see the
+     *                class docblock above for why nothing more may be assumed.
+     * @param profile - the profile the token is (or will be) pinned to
+     */
+    abstract allowedRoles(owner: User, profile?: string): Promise<string[]>;
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
+     */
+    allowedProfiles(_owner: User): Promise<string[]>;
 }
 declare module '@spinajs/rbac' {
     interface IRbacAsyncStorage {

package/lib/mjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;;;;;;OAYG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E;;;;OAIG;IACU,eAAe,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5D;CACF;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/mjs/interfaces.js

@@ -4,4 +4,43 @@
  */
 export class AccessTokenGenerationProvider {
 }
+/**
+ * Decides which roles a given owner may put on an access token.
+ *
+ * ONE method, FOUR call sites - `createToken`, `grantTokenRole`,
+ * `validateToken`, and the `GET user/tokens/roles` controller route (all
+ * through the shared `_allowed_roles` helper in `src/actions.ts`). That is
+ * deliberate: creation time and request time have to answer the same
+ * question, otherwise a role a user was allowed to pick could be one their
+ * token silently loses on the next request.
+ *
+ * `owner` is NOT hydrated the same way by every call site: `GET
+ * user/tokens/roles` and `createToken` (from `POST user/tokens`) are handed
+ * `req.storage.User` - the application's `User` subclass, with whatever
+ * request-pipeline hydration already ran - while `grantTokenRole` and
+ * `validateToken` are handed a base `User` with only `Metadata` populated
+ * ( `_owner()` / a direct `User.where(...)` lookup, deliberately unscoped by
+ * any application model override - see `_owner()`'s comments in
+ * `src/actions.ts` ). A correct implementation MUST NOT rely on anything
+ * beyond the base `User` model plus `Metadata` being present on `owner` -
+ * that is the only shape all four call sites agree on. Any
+ * application-specific field a policy reads may be populated on a
+ * session-authenticated call and absent on a token-authenticated one,
+ * answering the identical question two different ways.
+ *
+ * Replaceable via config `rbac.token.rolePolicy.service`, the same pattern
+ * `rbac.token.generation.service` uses for the token generator. The shipped
+ * default ( `OwnRolesTokenRolePolicy` ) answers with the owner's own roles,
+ * which is the behaviour this package had before the seam existed.
+ */
+export class AccessTokenRolePolicy {
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
+     */
+    async allowedProfiles(_owner) {
+        return [];
+    }
+}
 //# sourceMappingURL=interfaces.js.map

package/lib/mjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAgB,qBAAqB;IAgBzC;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,MAAY;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/lib/mjs/middlewares.d.ts

@@ -35,6 +35,11 @@ import './interfaces.js';
  * runs first and, on a session-less request, stamps the GUEST account's first
  * role into it, which would otherwise survive into the token's own request.
  *
+ * A token's profile is therefore published on `req.storage.TokenAuth.Profile`
+ * instead, for the application's row-scoping layer to read; it is deliberately
+ * NOT written to `ActiveRole`, so it scopes rows without narrowing what the
+ * token is authorized for.
+ *
  * Never throws: an invalid token leaves the request as guest and lets the
  * route's policy produce the rejection.
  */

package/lib/mjs/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAkD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAuD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}

package/lib/mjs/middlewares.js

@@ -51,6 +51,11 @@ const BEARER_SCHEME = /^bearer\s+/i;
  * runs first and, on a session-less request, stamps the GUEST account's first
  * role into it, which would otherwise survive into the token's own request.
  *
+ * A token's profile is therefore published on `req.storage.TokenAuth.Profile`
+ * instead, for the application's row-scoping layer to read; it is deliberately
+ * NOT written to `ActiveRole`, so it scopes rows without narrowing what the
+ * token is authorized for.
+ *
  * Never throws: an invalid token leaves the request as guest and lets the
  * route's policy produce the rejection.
  */
@@ -86,7 +91,12 @@ let TokenAuthMiddleware = class TokenAuthMiddleware extends ServerMiddleware {
                     return next();
                 }
                 req.storage.User = this.narrowRoles(result.User, result.EffectiveRoles);
-                req.storage.TokenAuth = { Uuid: result.Token.Uuid };
+                // `?? undefined` is not cosmetic: an unpinned token stores NULL and the
+                // orm reads it back as `null`, while `ITokenAuthInfo.Profile` is
+                // `string | undefined`. Passing the `null` through would make every
+                // `Profile === undefined` check downstream answer false on exactly the
+                // legacy tokens it is meant to recognise.
+                req.storage.TokenAuth = { Uuid: result.Token.Uuid, Profile: result.Token.Profile ?? undefined };
                 // CLEARED, not merely left alone - see the class docblock for why a
                 // token must carry no active role at all. `RbacMiddleware` has already
                 // run by now and, finding no session, wrote the GUEST user's first role

package/lib/mjs/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAEpD,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;AA3HW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;gDAAC;AAGT;IADT,MAAM,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,MAAM,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;AAR9B,mBAAmB;IAD/B,UAAU,CAAC,gBAAgB,CAAC;;GAChB,mBAAmB,CA6H/B"}
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,wEAAwE;gBACxE,iEAAiE;gBACjE,oEAAoE;gBACpE,uEAAuE;gBACvE,0CAA0C;gBAC1C,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;gBAEhG,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;AAhIW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;gDAAC;AAGT;IADT,MAAM,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,MAAM,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;AAR9B,mBAAmB;IAD/B,UAAU,CAAC,gBAAgB,CAAC;;GAChB,mBAAmB,CAkI/B"}

package/lib/mjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts

@@ -0,0 +1,6 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+export declare class RbacHttpTokenProfile_2026_08_21_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts.map

package/lib/mjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenProfile_2026_08_21_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAE5E,qBACa,wCAAyC,SAAQ,YAAY;IAC3D,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;CACF"}

package/lib/mjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js

@@ -0,0 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/* eslint-disable @typescript-eslint/no-unused-vars */
+import { OrmMigration, Migration, RawQuery } from '@spinajs/orm';
+let RbacHttpTokenProfile_2026_08_21_00_00_00 = class RbacHttpTokenProfile_2026_08_21_00_00_00 extends OrmMigration {
+    async up(connection) {
+        await connection.schema().raw(new RawQuery('ALTER TABLE rbac_access_tokens ADD COLUMN Profile VARCHAR(128) NULL'));
+    }
+    async down(connection) {
+        await connection.schema().raw(new RawQuery('ALTER TABLE rbac_access_tokens DROP COLUMN Profile'));
+    }
+};
+RbacHttpTokenProfile_2026_08_21_00_00_00 = __decorate([
+    Migration('default')
+], RbacHttpTokenProfile_2026_08_21_00_00_00);
+export { RbacHttpTokenProfile_2026_08_21_00_00_00 };
+//# sourceMappingURL=RbacHttpTokenProfile_2026_08_21_00_00_00.js.map

package/lib/mjs/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenProfile_2026_08_21_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAa,SAAS,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGrE,IAAM,wCAAwC,GAA9C,MAAM,wCAAyC,SAAQ,YAAY;IACjE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,qEAAqE,CAAC,CAAC,CAAC;IACrH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACpG,CAAC;CACF,CAAA;AARY,wCAAwC;IADpD,SAAS,CAAC,SAAS,CAAC;GACR,wCAAwC,CAQpD"}

package/lib/mjs/models/AccessToken.d.ts

@@ -29,6 +29,12 @@ export declare class AccessToken extends ModelBase<AccessToken> {
      * intersection of this list with the owner's current roles.
      */
     Roles: string[];
+    /**
+     * The profile (a role name) this token is pinned to; null/undefined = legacy
+     * token, scoped by the union of its roles. Validated against
+     * `AccessTokenRolePolicy.allowedProfiles` at creation and on every request.
+     */
+    Profile?: string;
     /**
      * Absolute expiration. Null/absent = never expires.
      *

package/lib/mjs/models/AccessToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,SAAS,EAAgB,cAAc,EAAE,MAAM,cAAc,CAAC;AACxI,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;GAGG;AACH,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IACrD,YAAmB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAG7C;IAED;;OAEG;IAGI,EAAE,EAAG,MAAM,CAAC;IAEnB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAEI,KAAK,EAAG,MAAM,CAAC;IAEtB;;;OAGG;IAEI,KAAK,EAAG,MAAM,EAAE,CAAC;IAExB;;;;;;;OAOG;IAEI,SAAS,CAAC,EAAE,QAAQ,CAAC;IAGrB,SAAS,EAAG,QAAQ,CAAC;IAE5B;;;;OAIG;IAEI,UAAU,CAAC,EAAE,QAAQ,CAAC;IAItB,IAAI,EAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAG5B,OAAO,EAAG,MAAM,CAAC;IAExB;;OAEG;IACH,IAAW,SAAS,IAAI,OAAO,CAE9B;CACF"}
+{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,SAAS,EAAgB,cAAc,EAAE,MAAM,cAAc,CAAC;AACxI,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;GAGG;AACH,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IACrD,YAAmB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAG7C;IAED;;OAEG;IAGI,EAAE,EAAG,MAAM,CAAC;IAEnB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAEI,KAAK,EAAG,MAAM,CAAC;IAEtB;;;OAGG;IAEI,KAAK,EAAG,MAAM,EAAE,CAAC;IAExB;;;;OAIG;IACI,OAAO,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;OAOG;IAEI,SAAS,CAAC,EAAE,QAAQ,CAAC;IAGrB,SAAS,EAAG,QAAQ,CAAC;IAE5B;;;;OAIG;IAEI,UAAU,CAAC,EAAE,QAAQ,CAAC;IAItB,IAAI,EAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAG5B,OAAO,EAAG,MAAM,CAAC;IAExB;;OAEG;IACH,IAAW,SAAS,IAAI,OAAO,CAE9B;CACF"}

package/lib/mjs/models/AccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,SAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IA8DD;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;AA7DQ;IAFN,OAAO,EAAE;IACT,MAAM,EAAE;;uCACU;AAiBZ;IADN,MAAM,EAAE;;0CACa;AAOf;IADN,GAAG,EAAE;;0CACkB;AAWjB;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AAGrB;IADN,SAAS,EAAE;8BACO,QAAQ;8CAAC;AAQrB;IADN,EAAE,EAAE;8BACe,QAAQ;+CAAC;AAItB;IAFN,MAAM,EAAE;IACR,SAAS,CAAC,MAAM,CAAC;8BACJ,cAAc;yCAAO;AAG5B;IADN,MAAM,EAAE;;4CACe;AAhEb,WAAW;IAFvB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,oBAAoB,CAAC;;GACf,WAAW,CAwEvB"}
+{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,SAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAqED;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;AApEQ;IAFN,OAAO,EAAE;IACT,MAAM,EAAE;;uCACU;AAiBZ;IADN,MAAM,EAAE;;0CACa;AAOf;IADN,GAAG,EAAE;;0CACkB;AAkBjB;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AAGrB;IADN,SAAS,EAAE;8BACO,QAAQ;8CAAC;AAQrB;IADN,EAAE,EAAE;8BACe,QAAQ;+CAAC;AAItB;IAFN,MAAM,EAAE;IACR,SAAS,CAAC,MAAM,CAAC;8BACJ,cAAc;yCAAO;AAG5B;IADN,MAAM,EAAE;;4CACe;AAvEb,WAAW;IAFvB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,oBAAoB,CAAC;;GACf,WAAW,CA+EvB"}

package/lib/mjs/role-policy.d.ts

@@ -0,0 +1,28 @@
+import { User } from '@spinajs/rbac';
+import { AccessTokenRolePolicy } from './interfaces.js';
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+export declare class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
+    allowedRoles(owner: User, _profile?: string): Promise<string[]>;
+}
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+export declare function _role_excluded(role: string, patterns: string[]): boolean;
+//# sourceMappingURL=role-policy.d.ts.map

package/lib/mjs/role-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,qBAAqB;IACnD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE"}

package/lib/mjs/role-policy.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { AccessTokenRolePolicy } from './interfaces.js';
+/**
+ * The behaviour this package shipped before the policy seam: a token may carry
+ * only roles its owner literally holds in `users.Role`.
+ *
+ * Safe by construction and needs no access-control lookup, which is why it
+ * stays the default - an application that wants finer scopes opts in by
+ * registering its own implementation under `rbac.token.rolePolicy.service`.
+ */
+let OwnRolesTokenRolePolicy = class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
+    async allowedRoles(owner, _profile) {
+        return [...owner.Role];
+    }
+};
+OwnRolesTokenRolePolicy = __decorate([
+    Injectable(AccessTokenRolePolicy)
+], OwnRolesTokenRolePolicy);
+export { OwnRolesTokenRolePolicy };
+/**
+ * Whether `role` matches any entry of `patterns`.
+ *
+ * A pattern is either an exact role name, or a name ending in `.*` which
+ * matches that prefix and everything beneath it - `route.*` covers `route.home`
+ * and `route.admin.users`, but not `routes.read`: the dot is part of the
+ * boundary, so a pattern can never swallow an unrelated role that merely starts
+ * with the same letters. No other wildcard syntax, on purpose - a full glob in
+ * a security list invites patterns nobody can reason about.
+ *
+ * @param role - role name to test
+ * @param patterns - exclusion patterns, typically from `rbac.token.excludedRoles`
+ */
+export function _role_excluded(role, patterns) {
+    return patterns.some((pattern) => {
+        if (pattern.endsWith('.*')) {
+            const prefix = pattern.slice(0, -1); // keeps the trailing dot
+            return role.startsWith(prefix);
+        }
+        return role === pattern;
+    });
+}
+//# sourceMappingURL=role-policy.js.map

package/lib/mjs/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAqB;IACzD,KAAK,CAAC,YAAY,CAAC,KAAW,EAAE,QAAiB;QACtD,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF,CAAA;AAJY,uBAAuB;IADnC,UAAU,CAAC,qBAAqB,CAAC;GACrB,uBAAuB,CAInC;;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}