@spinajs/rbac-http-token 2.0.514 → 2.0.516

package/lib/cjs/models/AccessToken.d.ts

@@ -29,6 +29,12 @@ export declare class AccessToken extends ModelBase<AccessToken> {
      * intersection of this list with the owner's current roles.
      */
     Roles: string[];
+    /**
+     * The profile (a role name) this token is pinned to; null/undefined = legacy
+     * token, scoped by the union of its roles. Validated against
+     * `AccessTokenRolePolicy.allowedProfiles` at creation and on every request.
+     */
+    Profile?: string;
     /**
      * Absolute expiration. Null/absent = never expires.
      *

package/lib/cjs/models/AccessToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,SAAS,EAAgB,cAAc,EAAE,MAAM,cAAc,CAAC;AACxI,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;GAGG;AACH,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IACrD,YAAmB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAG7C;IAED;;OAEG;IAGI,EAAE,EAAG,MAAM,CAAC;IAEnB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAEI,KAAK,EAAG,MAAM,CAAC;IAEtB;;;OAGG;IAEI,KAAK,EAAG,MAAM,EAAE,CAAC;IAExB;;;;;;;OAOG;IAEI,SAAS,CAAC,EAAE,QAAQ,CAAC;IAGrB,SAAS,EAAG,QAAQ,CAAC;IAE5B;;;;OAIG;IAEI,UAAU,CAAC,EAAE,QAAQ,CAAC;IAItB,IAAI,EAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAG5B,OAAO,EAAG,MAAM,CAAC;IAExB;;OAEG;IACH,IAAW,SAAS,IAAI,OAAO,CAE9B;CACF"}
+{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,SAAS,EAAgB,cAAc,EAAE,MAAM,cAAc,CAAC;AACxI,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;GAGG;AACH,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IACrD,YAAmB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAG7C;IAED;;OAEG;IAGI,EAAE,EAAG,MAAM,CAAC;IAEnB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;OAEG;IACI,IAAI,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAEI,KAAK,EAAG,MAAM,CAAC;IAEtB;;;OAGG;IAEI,KAAK,EAAG,MAAM,EAAE,CAAC;IAExB;;;;OAIG;IACI,OAAO,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;OAOG;IAEI,SAAS,CAAC,EAAE,QAAQ,CAAC;IAGrB,SAAS,EAAG,QAAQ,CAAC;IAE5B;;;;OAIG;IAEI,UAAU,CAAC,EAAE,QAAQ,CAAC;IAItB,IAAI,EAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAG5B,OAAO,EAAG,MAAM,CAAC;IAExB;;OAEG;IACH,IAAW,SAAS,IAAI,OAAO,CAE9B;CACF"}

package/lib/cjs/models/AccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAwI;AAExI,iCAAiC;AACjC,+BAAoC;AACpC,wCAAqD;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,eAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IA8DD;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;;AA7DQ;IAFN,IAAA,aAAO,GAAE;IACT,IAAA,YAAM,GAAE;;uCACU;AAiBZ;IADN,IAAA,YAAM,GAAE;;0CACa;AAOf;IADN,IAAA,SAAG,GAAE;;0CACkB;AAWjB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;AAGrB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;8CAAC;AAQrB;IADN,IAAA,cAAE,GAAE;8BACe,gBAAQ;+CAAC;AAItB;IAFN,IAAA,YAAM,GAAE;IACR,IAAA,eAAS,EAAC,MAAM,CAAC;8BACJ,oBAAc;yCAAO;AAG5B;IADN,IAAA,YAAM,GAAE;;4CACe;sBAhEb,WAAW;IAFvB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,oBAAoB,CAAC;;GACf,WAAW,CAwEvB"}
+{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../../../src/models/AccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAwI;AAExI,iCAAiC;AACjC,+BAAoC;AACpC,wCAAqD;AAErD;;;GAGG;AAGI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,eAAsB;IACrD,YAAmB,IAA2B;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAqED;;OAEG;IACH,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;CACF,CAAA;;AApEQ;IAFN,IAAA,aAAO,GAAE;IACT,IAAA,YAAM,GAAE;;uCACU;AAiBZ;IADN,IAAA,YAAM,GAAE;;0CACa;AAOf;IADN,IAAA,SAAG,GAAE;;0CACkB;AAkBjB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;AAGrB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;8CAAC;AAQrB;IADN,IAAA,cAAE,GAAE;8BACe,gBAAQ;+CAAC;AAItB;IAFN,IAAA,YAAM,GAAE;IACR,IAAA,eAAS,EAAC,MAAM,CAAC;8BACJ,oBAAc;yCAAO;AAG5B;IADN,IAAA,YAAM,GAAE;;4CACe;sBAvEb,WAAW;IAFvB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,oBAAoB,CAAC;;GACf,WAAW,CA+EvB"}

package/lib/cjs/role-policy.d.ts

@@ -9,7 +9,7 @@ import { AccessTokenRolePolicy } from './interfaces.js';
  * registering its own implementation under `rbac.token.rolePolicy.service`.
  */
 export declare class OwnRolesTokenRolePolicy extends AccessTokenRolePolicy {
-    allowedRoles(owner: User): Promise<string[]>;
+    allowedRoles(owner: User, _profile?: string): Promise<string[]>;
 }
 /**
  * Whether `role` matches any entry of `patterns`.

package/lib/cjs/role-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,qBAAqB;IACnD,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExD;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE"}
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,qBAAqB;IACnD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE"}

package/lib/cjs/role-policy.js

@@ -19,7 +19,7 @@ const interfaces_js_1 = require("./interfaces.js");
  * registering its own implementation under `rbac.token.rolePolicy.service`.
  */
 let OwnRolesTokenRolePolicy = class OwnRolesTokenRolePolicy extends interfaces_js_1.AccessTokenRolePolicy {
-    async allowedRoles(owner) {
+    async allowedRoles(owner, _profile) {
         return [...owner.Role];
     }
 };

package/lib/cjs/role-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,oCAAyC;AAGzC,mDAAwD;AAExD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qCAAqB;IACzD,KAAK,CAAC,YAAY,CAAC,KAAW;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF,CAAA;;kCAJY,uBAAuB;IADnC,IAAA,eAAU,EAAC,qCAAqB,CAAC;GACrB,uBAAuB,CAInC;AAED;;;;;;;;;;;;GAYG;AACH,wBAA+B,IAAY,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../src/role-policy.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,oCAAyC;AAGzC,mDAAwD;AAExD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qCAAqB;IACzD,KAAK,CAAC,YAAY,CAAC,KAAW,EAAE,QAAiB;QACtD,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF,CAAA;;kCAJY,uBAAuB;IADnC,IAAA,eAAU,EAAC,qCAAqB,CAAC;GACrB,uBAAuB,CAInC;AAED;;;;;;;;;;;;GAYG;AACH,wBAA+B,IAAY,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;YAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/mjs/actions.d.ts

@@ -49,7 +49,12 @@ export declare function _owner(user: User | number | string): () => Promise<User
  * that name was ever registered. A policy returning `'constructor'` would otherwise survive
  * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
  */
-export declare function _allowed_roles(owner: User): Promise<string[]>;
+export declare function _allowed_roles(owner: User, profile?: string): Promise<string[]>;
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export declare function _allowed_profiles(owner: User): Promise<string[]>;
 /**
  * Creates a new access token for a user.
  *
@@ -64,8 +69,11 @@ export declare function _allowed_roles(owner: User): Promise<string[]>;
  * @param roles - roles carried by the token, subset of what the configured
  *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null): Promise<{
+export declare function createToken(user: User | number | string, name: string, roles: string[], expiresAt: DateTime | null, profile?: string): Promise<{
     Token: AccessToken;
     Plaintext: string;
 }>;

package/lib/mjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnE;AAiBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+CtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACvB,iBAAiB,IAAA;IACjB,eAAe,IAAA;IACf,qBAAqB,IAAA;IACrB,wBAAwB,IAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAM9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYxE;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC/L;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyDtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/lib/mjs/actions.js

@@ -85,21 +85,41 @@ function _token_ev(event, ...args) {
  * that name was ever registered. A policy returning `'constructor'` would otherwise survive
  * this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
  */
-export async function _allowed_roles(owner) {
+export async function _allowed_roles(owner, profile) {
     const policy = await _service('rbac.token.rolePolicy', AccessTokenRolePolicy)();
-    const allowed = await policy.allowedRoles(owner);
+    const allowed = await policy.allowedRoles(owner, profile);
     const ac = DI.get('AccessControl');
     const grants = ac.getGrants();
     return allowed.filter((r) => Object.hasOwn(grants, r));
 }
+/**
+ * Profiles the configured {@link AccessTokenRolePolicy} lets `owner` pin a
+ * token to. Same live-resolution rationale as `_allowed_roles`.
+ */
+export async function _allowed_profiles(owner) {
+    const policy = await _service('rbac.token.rolePolicy', AccessTokenRolePolicy)();
+    return policy.allowedProfiles(owner);
+}
+/**
+ * Ensures `profile` is one the configured policy lets `owner` pin a token to.
+ */
+async function _assert_profile(owner, profile) {
+    const allowed = await _allowed_profiles(owner);
+    if (!allowed.includes(profile)) {
+        throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not pin a token to profile: ${profile}`, { roles: [profile] });
+    }
+}
 /**
  * Ensures every role in `roles` is one the configured policy allows for
  * `owner`. Deliberately not "one the owner literally holds" - a policy may
  * permit roles beyond the owner's own `Role` list, or withhold ones on it;
  * that flexibility is the entire point of the policy seam.
+ *
+ * With `profile` given the question is asked relative to that profile, which a
+ * policy may answer more narrowly than the owner-wide union.
  */
-async function _assert_roles_subset(owner, roles) {
-    const allowed = await _allowed_roles(owner);
+async function _assert_roles_subset(owner, roles, profile) {
+    const allowed = await _allowed_roles(owner, profile);
     const missing = roles.filter((r) => !allowed.includes(r));
     if (missing.length !== 0) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, `Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
@@ -119,17 +139,26 @@ async function _assert_roles_subset(owner, roles) {
  * @param roles - roles carried by the token, subset of what the configured
  *                {@link AccessTokenRolePolicy} allows the owner
  * @param expiresAt - absolute expiration, or null for a token that never expires
+ * @param profile - role the token is pinned to, from what the configured
+ *                  {@link AccessTokenRolePolicy} offers the owner; omitted
+ *                  leaves the token unpinned ( legacy behaviour )
  */
-export async function createToken(user, name, roles, expiresAt) {
+export async function createToken(user, name, roles, expiresAt, profile) {
     name = _check_arg(_trim(), _non_empty(), _max_length(128))(name, 'name');
     roles = _check_arg(_non_nil(), _non_empty())(roles, 'roles');
     const generator = await _service('rbac.token.generation', AccessTokenGenerationProvider)();
     const generated = await generator.generate();
-    return _chain(_owner(user), _tap(async (u) => _assert_roles_subset(u, roles)), async (u) => {
+    return _chain(_owner(user), _tap(async (u) => {
+        if (profile) {
+            await _assert_profile(u, profile);
+        }
+        await _assert_roles_subset(u, roles, profile);
+    }), async (u) => {
         const token = new AccessToken({
             Name: name,
             Token: generated.Hash,
             Roles: _.uniq(roles),
+            Profile: profile ?? undefined,
             // `ExpiresAt` is optional rather than nullable ( see the model ), so a
             // "never expires" token leaves the property unset instead of holding null.
             ExpiresAt: expiresAt ?? undefined,
@@ -158,7 +187,7 @@ export async function grantTokenRole(token, role) {
     role = _check_arg(_trim(), _non_empty())(role, 'role');
     return _chain(_token(token), _tap(async (t) => {
         const owner = await _owner(t.user_id)();
-        await _assert_roles_subset(owner, [role]);
+        await _assert_roles_subset(owner, [role], t.Profile);
         t.Roles = _.uniq([...t.Roles, role]);
         await t.update();
     }), _token_ev(AccessTokenRoleGranted, role));
@@ -235,11 +264,20 @@ export async function validateToken(plaintext) {
     if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_OWNER_INVALID, 'Access token owner is not allowed to authenticate', { token: token.Uuid });
     }
+    // a profile token whose owner no longer passes the profile policy (role
+    // revoked, policy tightened) authorises nothing - same immediacy rule as
+    // the role re-intersection below
+    if (token.Profile) {
+        const profiles = await _allowed_profiles(owner);
+        if (!profiles.includes(token.Profile)) {
+            throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token profile is no longer allowed for its owner', { token: token.Uuid });
+        }
+    }
     // roles are re-checked against the policy on every request rather than
     // trusted from the row: a role the owner loses - or one an application's
     // policy stops allowing - must take effect immediately, without having to
     // hunt down every token that still carries it
-    const allowed = await _allowed_roles(owner);
+    const allowed = await _allowed_roles(owner, token.Profile);
     const effective = token.Roles.filter((r) => allowed.includes(r));
     if (effective.length === 0) {
         throw new ErrorCode(E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED, 'Access token has no effective roles', { token: token.Uuid });

package/lib/mjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAW;IAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe;IAC9D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B;IACvH,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EACvD,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAE1C,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,2EAAiB,CAAA;IACjB,uEAAe,CAAA;IACf,mFAAqB,CAAA;IACrB,yFAAwB,CAAA;AAC1B,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAoC,EAAE,GAAG,IAAW;IACrE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAW,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAW;IACjD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACvG,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,KAAW,EAAE,OAAe;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAW,EAAE,KAAe,EAAE,OAAgB;IAChF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAA0B,EAAE,OAAgB;IACzI,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,OAAO,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,EACF,KAAK,EAAE,CAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,uEAAuE;YACvE,2EAA2E;YAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,OAAO,EAAE,CAAC,CAAC,EAAE;SACd,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,EACD,SAAS,CAAC,kBAAkB,CAAC,EAC7B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EACrC,SAAS,CAAC,kBAAkB,CAAC,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAErD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,MAAM,CAAC,KAAK,CAAC,EACb,IAAI,CAAC,KAAK,EAAE,CAAc,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,EACF,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,qBAAqB,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,wBAAwB,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/lib/mjs/controllers/AccessTokenController.d.ts

@@ -44,12 +44,29 @@ export declare class AccessTokenController extends BaseController {
      * Answers from the configured AccessTokenRolePolicy - the same source
      * `POST user/tokens` validates against, so a client can never be offered a
      * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
      * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
      * @response 200 Roles the caller may put on a token
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
-    roles(user: UserModel): Promise<Ok<unknown>>;
+    roles(user: UserModel, profile?: string): Promise<Ok<unknown>>;
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    profiles(user: UserModel): Promise<Ok<unknown>>;
     /**
      * List own access tokens
      * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
@@ -64,10 +81,13 @@ export declare class AccessTokenController extends BaseController {
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
      * Roles must be a subset of what the configured AccessTokenRolePolicy allows
-     * the caller - the same set `GET user/tokens/roles` reports.
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not allowed for the caller by the configured role policy
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */

package/lib/mjs/controllers/AccessTokenController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;OASG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEhE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;OAUG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAAmC,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAW,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAE3F;IAED;;;;;;;;;OASG;IAGU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAEnE;IAED;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;;;;;OAaG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;;OAaG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}

package/lib/mjs/controllers/AccessTokenController.js

@@ -10,13 +10,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put } from '@spinajs/http';
+import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put, Query } from '@spinajs/http';
 import { User as UserModel } from '@spinajs/rbac';
 import { Permission, Resource, User } from '@spinajs/rbac-http';
 import { ErrorCode } from '@spinajs/exceptions';
 import { DateTime } from 'luxon';
 import { AccessToken } from '../models/AccessToken.js';
-import { E_TOKEN_CODES, _allowed_roles, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
+import { E_TOKEN_CODES, _allowed_profiles, _allowed_roles, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
 import { CreateTokenDto } from '../dto/create-token-dto.js';
 import { NoTokenAuthPolicy } from '../policies/NoTokenAuthPolicy.js';
 import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
@@ -62,13 +62,32 @@ let AccessTokenController = class AccessTokenController extends BaseController {
      * Answers from the configured AccessTokenRolePolicy - the same source
      * `POST user/tokens` validates against, so a client can never be offered a
      * role the create call would then refuse.
+     *
+     * With `profile` given the answer is relative to that profile, which a policy
+     * may narrow below the owner-wide union - the picker must ask with the profile
+     * the user has selected, or it will keep offering roles the pinned create call
+     * then refuses. Without the param the answer is what this route always gave.
      * @security cookieAuth
+     * @param profile Optional profile ( root role ) the roles are asked for
      * @response 200 Roles the caller may put on a token
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
-    async roles(user) {
-        return new Ok({ Roles: await _allowed_roles(user) });
+    async roles(user, profile) {
+        return new Ok({ Roles: await _allowed_roles(user, profile) });
+    }
+    /**
+     * Profiles the caller may pin a new token to
+     * Answers from the configured AccessTokenRolePolicy - the same source
+     * `POST user/tokens` validates `Profile` against. Empty for applications that
+     * did not opt into profile tokens: the shipped default policy offers none.
+     * @security cookieAuth
+     * @response 200 Profiles the caller may pin a token to
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async profiles(user) {
+        return new Ok({ Profiles: await _allowed_profiles(user) });
     }
     /**
      * List own access tokens
@@ -87,17 +106,20 @@ let AccessTokenController = class AccessTokenController extends BaseController {
      * Create an access token
      * The plaintext appears in this response only and cannot be retrieved again.
      * Roles must be a subset of what the configured AccessTokenRolePolicy allows
-     * the caller - the same set `GET user/tokens/roles` reports.
+     * the caller - the same set `GET user/tokens/roles` reports. An optional
+     * `Profile` pins the token to one of the profiles `GET user/tokens/profiles`
+     * reports, and narrows the role check to that profile; omitted, the token is
+     * scoped by the union of its roles as before.
      * @security cookieAuth
      * @response 200 Token created, `Plaintext` returned once
-     * @response 400 Requested roles are not allowed for the caller by the configured role policy
+     * @response 400 Requested roles or profile are not allowed for the caller by the configured role policy
      * @response 401 Unauthorized - valid session required
      * @response 403 Forbidden - access tokens cannot be used on this route
      */
     async create(user, dto) {
         const expiresAt = dto.ExpiresAt ? DateTime.fromISO(dto.ExpiresAt) : null;
         try {
-            const { Token, Plaintext } = await createToken(user, dto.Name, dto.Roles, expiresAt);
+            const { Token, Plaintext } = await createToken(user, dto.Name, dto.Roles, expiresAt, dto.Profile);
             return new Ok({ Token: this.toWire(Token), Plaintext }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
         }
         catch (err) {
@@ -225,10 +247,19 @@ __decorate([
     Get('tokens/roles'),
     Permission(['readOwn']),
     __param(0, User()),
+    __param(1, Query()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:paramtypes", [UserModel, String]),
     __metadata("design:returntype", Promise)
 ], AccessTokenController.prototype, "roles", null);
+__decorate([
+    Get('tokens/profiles'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "profiles", null);
 __decorate([
     Get('tokens'),
     Permission(['readOwn']),

package/lib/mjs/controllers/AccessTokenController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe;QACxC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AA7Kc;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;kDAEzC;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAeY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAkBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AAvIU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CA0LjC"}
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe,EAAW,OAAgB;QACnE,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClG,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AAhMc;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;kDAEzC;AAcY;IAFZ,GAAG,CAAC,iBAAiB,CAAC;IACtB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;qDAE5C;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAkBY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAkBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AAhKU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAmNjC"}

package/lib/mjs/dto/create-token-dto.d.ts

@@ -17,6 +17,12 @@ export declare const CreateTokenDtoSchema: {
             minItems: number;
             description: string;
         };
+        Profile: {
+            type: string;
+            minLength: number;
+            maxLength: number;
+            description: string;
+        };
         ExpiresAt: {
             type: string[];
             format: string;
@@ -28,6 +34,7 @@ export declare const CreateTokenDtoSchema: {
 export declare class CreateTokenDto {
     Name: string;
     Roles: string[];
+    Profile?: string;
     ExpiresAt?: string | null;
     constructor(data: any);
 }

package/lib/mjs/dto/create-token-dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAC3E,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}
+{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAM3E,OAAO;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACpE,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}

package/lib/mjs/dto/create-token-dto.js

@@ -14,7 +14,13 @@ export const CreateTokenDtoSchema = {
     type: 'object',
     properties: {
         Name: { type: 'string', minLength: 1, maxLength: 128, description: 'Human readable token label' },
-        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of own roles' },
+        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of what the role policy allows' },
+        // `minLength: 1` is load bearing, not cosmetic: an empty string is falsy all
+        // the way down the actions layer, so `Profile: ''` would mint an UNPINNED
+        // token instead of a refused one - a silent widening of what the token may
+        // reach. Rejecting it here is what keeps "asked for a profile" and "pinned
+        // to a profile" the same statement.
+        Profile: { type: 'string', minLength: 1, maxLength: 128, description: 'Profile (root role) to pin the token to; omitted = legacy union-scoped token' },
         ExpiresAt: { type: ['string', 'null'], format: 'date-time', description: 'ISO expiration instant; null or omitted = never expires' },
     },
     required: ['Name', 'Roles'],

package/lib/mjs/dto/create-token-dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACxI,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}
+{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE;QAC1J,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,8EAA8E,EAAE;QACtJ,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAMzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AATY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAS1B"}

package/lib/mjs/index.d.ts

@@ -4,6 +4,7 @@ import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
 export * from './generator.js';
 export * from './role-policy.js';
 export * from './events/index.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/index.js

@@ -7,6 +7,7 @@ import './middlewares.js';
 export * from './interfaces.js';
 export * from './models/AccessToken.js';
 export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
 export * from './generator.js';
 export * from './role-policy.js';
 export * from './events/index.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -32,6 +32,12 @@ export interface ITokenAuthInfo {
      * Uuid of the AccessToken row - safe to log; never the token itself.
      */
     Uuid: string;
+    /**
+     * The profile (a role name) this token is pinned to, when it carries one.
+     * Consumed by application row-scoping the way a session's ActiveRole is;
+     * permission checks do NOT read it - they stay on the narrowed User.Role.
+     */
+    Profile?: string;
 }
 /**
  * Decides which roles a given owner may put on an access token.
@@ -68,10 +74,21 @@ export declare abstract class AccessTokenRolePolicy {
      * existing tokens is re-intersected with on each authenticated request, so a
      * role dropped from this answer stops authorising immediately.
      *
+     * With `profile` set the answer is relative to that profile - an application
+     * policy may (and should) narrow it to roles the profile's own grants cover.
+     * The shipped default ignores the argument.
+     *
      * @param owner - at minimum a base `User` with `Metadata` populated; see the
      *                class docblock above for why nothing more may be assumed.
+     * @param profile - the profile the token is (or will be) pinned to
+     */
+    abstract allowedRoles(owner: User, profile?: string): Promise<string[]>;
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
      */
-    abstract allowedRoles(owner: User): Promise<string[]>;
+    allowedProfiles(_owner: User): Promise<string[]>;
 }
 declare module '@spinajs/rbac' {
     interface IRbacAsyncStorage {

package/lib/mjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;OAOG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC9D;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAO1C,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,8BAAsB,qBAAqB;IACzC;;;;;;;;;;;;OAYG;IACH,SAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E;;;;OAIG;IACU,eAAe,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5D;CACF;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/mjs/interfaces.js

@@ -34,5 +34,13 @@ export class AccessTokenGenerationProvider {
  * which is the behaviour this package had before the seam existed.
  */
 export class AccessTokenRolePolicy {
+    /**
+     * Profiles `owner` may pin a token to. A profile plays the row-scoping part
+     * a session's ActiveRole plays - see `ITokenAuthInfo.Profile`. Default: none;
+     * an application that wants profile tokens overrides this in its policy.
+     */
+    async allowedProfiles(_owner) {
+        return [];
+    }
 }
 //# sourceMappingURL=interfaces.js.map

package/lib/mjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAgB,qBAAqB;CAU1C"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAgB,qBAAqB;IAgBzC;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,MAAY;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/lib/mjs/middlewares.d.ts

@@ -35,6 +35,11 @@ import './interfaces.js';
  * runs first and, on a session-less request, stamps the GUEST account's first
  * role into it, which would otherwise survive into the token's own request.
  *
+ * A token's profile is therefore published on `req.storage.TokenAuth.Profile`
+ * instead, for the application's row-scoping layer to read; it is deliberately
+ * NOT written to `ActiveRole`, so it scopes rows without narrowing what the
+ * token is authorized for.
+ *
  * Never throws: an invalid token leaves the request as guest and lets the
  * route's policy produce the rejection.
  */

package/lib/mjs/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAkD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAuD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}