@spinajs/rbac-http-token 2.0.521 → 2.0.522
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/actions.d.ts +11 -20
- package/lib/cjs/actions.d.ts.map +1 -1
- package/lib/cjs/actions.js +81 -90
- package/lib/cjs/actions.js.map +1 -1
- package/lib/cjs/controllers/AccessTokenController.d.ts +1 -1
- package/lib/cjs/controllers/AccessTokenController.js +3 -3
- package/lib/cjs/controllers/AccessTokenController.js.map +1 -1
- package/lib/cjs/exceptions.d.ts +33 -0
- package/lib/cjs/exceptions.d.ts.map +1 -0
- package/lib/cjs/exceptions.js +43 -0
- package/lib/cjs/exceptions.js.map +1 -0
- package/lib/cjs/index.d.ts +1 -0
- package/lib/cjs/index.d.ts.map +1 -1
- package/lib/cjs/index.js +1 -0
- package/lib/cjs/index.js.map +1 -1
- package/lib/cjs/middlewares.js +2 -2
- package/lib/cjs/middlewares.js.map +1 -1
- package/lib/mjs/actions.d.ts +11 -20
- package/lib/mjs/actions.d.ts.map +1 -1
- package/lib/mjs/actions.js +82 -92
- package/lib/mjs/actions.js.map +1 -1
- package/lib/mjs/controllers/AccessTokenController.d.ts +1 -1
- package/lib/mjs/controllers/AccessTokenController.js +4 -4
- package/lib/mjs/controllers/AccessTokenController.js.map +1 -1
- package/lib/mjs/exceptions.d.ts +33 -0
- package/lib/mjs/exceptions.d.ts.map +1 -0
- package/lib/mjs/exceptions.js +35 -0
- package/lib/mjs/exceptions.js.map +1 -0
- package/lib/mjs/index.d.ts +1 -0
- package/lib/mjs/index.d.ts.map +1 -1
- package/lib/mjs/index.js +1 -0
- package/lib/mjs/index.js.map +1 -1
- package/lib/mjs/middlewares.js +2 -2
- package/lib/mjs/middlewares.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +15 -15
package/lib/cjs/middlewares.js
CHANGED
|
@@ -14,7 +14,7 @@ const di_1 = require("@spinajs/di");
|
|
|
14
14
|
const configuration_1 = require("@spinajs/configuration");
|
|
15
15
|
const log_1 = require("@spinajs/log");
|
|
16
16
|
const http_1 = require("@spinajs/http");
|
|
17
|
-
const
|
|
17
|
+
const exceptions_js_1 = require("./exceptions.js");
|
|
18
18
|
const actions_js_1 = require("./actions.js");
|
|
19
19
|
require("./interfaces.js");
|
|
20
20
|
/**
|
|
@@ -89,7 +89,7 @@ let TokenAuthMiddleware = class TokenAuthMiddleware extends http_1.ServerMiddlew
|
|
|
89
89
|
// safe to write down - `validateToken` attaches it as `data.token` on
|
|
90
90
|
// every failure past the lookup. The presented plaintext is NEVER
|
|
91
91
|
// logged, here or anywhere else.
|
|
92
|
-
const data = err instanceof
|
|
92
|
+
const data = err instanceof exceptions_js_1.AccessTokenException ? err.data : undefined;
|
|
93
93
|
this.Log.warn(`Access token rejected: ${err.message}`, { Ip: req.ip, Token: data?.token });
|
|
94
94
|
return next();
|
|
95
95
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,wCAAsE;AACtE,
|
|
1
|
+
{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,wCAAsE;AACtE,mDAAuD;AAGvD,6CAAyD;AACzD,2BAAyB;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,uBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,oCAAoB,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC5G,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,wEAAwE;gBACxE,iEAAiE;gBACjE,oEAAoE;gBACpE,uEAAuE;gBACvE,0CAA0C;gBAC1C,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;gBAEhG,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,IAAA,uBAAU,EAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;;AAhIW;IADT,IAAA,YAAM,EAAC,iBAAiB,CAAC;8BACX,SAAG;gDAAC;AAGT;IADT,IAAA,sBAAM,EAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,IAAA,sBAAM,EAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;8BAR9B,mBAAmB;IAD/B,IAAA,eAAU,EAAC,uBAAgB,CAAC;;GAChB,mBAAmB,CAkI/B"}
|
package/lib/mjs/actions.d.ts
CHANGED
|
@@ -1,31 +1,22 @@
|
|
|
1
1
|
import { DateTime } from 'luxon';
|
|
2
2
|
import { User } from '@spinajs/rbac';
|
|
3
3
|
import { AccessToken } from './models/AccessToken.js';
|
|
4
|
-
/**
|
|
5
|
-
* Failure codes carried by every {@link ErrorCode} this module throws.
|
|
6
|
-
*
|
|
7
|
-
* Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
|
|
8
|
-
* `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
|
|
9
|
-
* from their package index. A downstream barrel that does
|
|
10
|
-
* `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
|
|
11
|
-
* would collide on the NAME while the members underneath carry different
|
|
12
|
-
* numeric values - the kind of clash that resolves silently in a barrel and
|
|
13
|
-
* makes an `err.code === E_CODES.X` comparison answer the wrong question.
|
|
14
|
-
*/
|
|
15
|
-
export declare enum E_TOKEN_CODES {
|
|
16
|
-
E_TOKEN_NOT_FOUND = 0,
|
|
17
|
-
E_TOKEN_EXPIRED = 1,
|
|
18
|
-
E_TOKEN_OWNER_INVALID = 2,
|
|
19
|
-
E_TOKEN_ROLE_NOT_ALLOWED = 3
|
|
20
|
-
}
|
|
21
4
|
/**
|
|
22
5
|
* Resolves an AccessToken from an instance or its uuid.
|
|
23
6
|
*/
|
|
24
|
-
export declare function
|
|
7
|
+
export declare function getToken(token: AccessToken | string): Promise<AccessToken>;
|
|
25
8
|
/**
|
|
26
9
|
* Resolves the owning user by instance, numeric id or uuid, with metadata
|
|
27
10
|
* populated ( needed for IsBanned checks downstream ).
|
|
28
11
|
*/
|
|
12
|
+
export declare function getOwner(user: User | number | string): Promise<User>;
|
|
13
|
+
/**
|
|
14
|
+
* Thunk form of {@link getToken}.
|
|
15
|
+
*/
|
|
16
|
+
export declare function _token(token: AccessToken | string): () => Promise<AccessToken>;
|
|
17
|
+
/**
|
|
18
|
+
* Thunk form of {@link getOwner}.
|
|
19
|
+
*/
|
|
29
20
|
export declare function _owner(user: User | number | string): () => Promise<User>;
|
|
30
21
|
/**
|
|
31
22
|
* Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
|
|
@@ -106,7 +97,7 @@ export declare function grantTokenRole(token: AccessToken | string, role: string
|
|
|
106
97
|
*
|
|
107
98
|
* @param token - {@link AccessToken} instance or its uuid
|
|
108
99
|
* @param role - role name to revoke
|
|
109
|
-
* @throws
|
|
100
|
+
* @throws AccessTokenRoleNotAllowed when `role` is the token's last role
|
|
110
101
|
*/
|
|
111
102
|
export declare function revokeTokenRole(token: AccessToken | string, role: string): Promise<AccessToken>;
|
|
112
103
|
export interface ITokenValidationResult {
|
|
@@ -123,7 +114,7 @@ export interface ITokenValidationResult {
|
|
|
123
114
|
*
|
|
124
115
|
* Checks, in order: token exists ( by hash ), token not expired, owner active /
|
|
125
116
|
* not soft-deleted / not banned, effective role intersection non-empty.
|
|
126
|
-
* Throws
|
|
117
|
+
* Throws {@link AccessTokenException} subclasses on every failure path.
|
|
127
118
|
*
|
|
128
119
|
* The owner checks are spelled out instead of reusing the `isActiveUser` query
|
|
129
120
|
* scope on purpose - a single "no such active user" result cannot say WHY, and
|
package/lib/mjs/actions.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD
|
|
1
|
+
{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhF;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1E;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAE9E;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BrM;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBrG;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyDtF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}
|
package/lib/mjs/actions.js
CHANGED
|
@@ -1,67 +1,49 @@
|
|
|
1
1
|
import _ from 'lodash';
|
|
2
2
|
import { DateTime } from 'luxon';
|
|
3
3
|
import { User } from '@spinajs/rbac';
|
|
4
|
-
import {
|
|
5
|
-
import {
|
|
6
|
-
import {
|
|
7
|
-
import {
|
|
4
|
+
import { _check_arg, _trim, _non_empty, _non_nil, _max_length } from '@spinajs/util';
|
|
5
|
+
import { service } from '@spinajs/configuration';
|
|
6
|
+
import { ev } from '@spinajs/queue';
|
|
7
|
+
import { AccessTokenExpired, AccessTokenNotFound, AccessTokenOwnerInvalid, AccessTokenRoleNotAllowed } from './exceptions.js';
|
|
8
8
|
import { DI } from '@spinajs/di';
|
|
9
9
|
import { AccessToken } from './models/AccessToken.js';
|
|
10
10
|
import { AccessTokenGenerationProvider, AccessTokenRolePolicy } from './interfaces.js';
|
|
11
11
|
import { AccessTokenCreated, AccessTokenDeleted, AccessTokenRoleGranted, AccessTokenRoleRevoked } from './events/index.js';
|
|
12
|
-
/**
|
|
13
|
-
* Failure codes carried by every {@link ErrorCode} this module throws.
|
|
14
|
-
*
|
|
15
|
-
* Named `E_TOKEN_CODES` rather than the shorter `E_CODES` on purpose:
|
|
16
|
-
* `@spinajs/rbac` exports an enum called `E_CODES` too, and both are re-exported
|
|
17
|
-
* from their package index. A downstream barrel that does
|
|
18
|
-
* `export * from '@spinajs/rbac'; export * from '@spinajs/rbac-http-token';`
|
|
19
|
-
* would collide on the NAME while the members underneath carry different
|
|
20
|
-
* numeric values - the kind of clash that resolves silently in a barrel and
|
|
21
|
-
* makes an `err.code === E_CODES.X` comparison answer the wrong question.
|
|
22
|
-
*/
|
|
23
|
-
export var E_TOKEN_CODES;
|
|
24
|
-
(function (E_TOKEN_CODES) {
|
|
25
|
-
E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_NOT_FOUND"] = 0] = "E_TOKEN_NOT_FOUND";
|
|
26
|
-
E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_EXPIRED"] = 1] = "E_TOKEN_EXPIRED";
|
|
27
|
-
E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_OWNER_INVALID"] = 2] = "E_TOKEN_OWNER_INVALID";
|
|
28
|
-
E_TOKEN_CODES[E_TOKEN_CODES["E_TOKEN_ROLE_NOT_ALLOWED"] = 3] = "E_TOKEN_ROLE_NOT_ALLOWED";
|
|
29
|
-
})(E_TOKEN_CODES || (E_TOKEN_CODES = {}));
|
|
30
12
|
/**
|
|
31
13
|
* Resolves an AccessToken from an instance or its uuid.
|
|
32
14
|
*/
|
|
33
|
-
export function
|
|
15
|
+
export async function getToken(token) {
|
|
34
16
|
if (_.isString(token)) {
|
|
35
|
-
return
|
|
17
|
+
return AccessToken.where('Uuid', token).firstOrFail();
|
|
36
18
|
}
|
|
37
|
-
return
|
|
19
|
+
return token;
|
|
38
20
|
}
|
|
39
21
|
/**
|
|
40
22
|
* Resolves the owning user by instance, numeric id or uuid, with metadata
|
|
41
23
|
* populated ( needed for IsBanned checks downstream ).
|
|
42
24
|
*/
|
|
43
|
-
export function
|
|
25
|
+
export async function getOwner(user) {
|
|
44
26
|
if (_.isString(user)) {
|
|
45
27
|
// base User on purpose: token-auth infrastructure resolves the token OWNER before any request scope exists; must not be row-scoped by an application model override.
|
|
46
|
-
return
|
|
28
|
+
return User.where('Uuid', user).populate('Metadata').firstOrFail();
|
|
47
29
|
}
|
|
48
30
|
if (_.isNumber(user)) {
|
|
49
31
|
// base User on purpose: token-auth infrastructure resolves the token OWNER before any request scope exists; must not be row-scoped by an application model override.
|
|
50
|
-
return
|
|
32
|
+
return User.where('Id', user).populate('Metadata').firstOrFail();
|
|
51
33
|
}
|
|
52
|
-
return
|
|
34
|
+
return user;
|
|
53
35
|
}
|
|
54
36
|
/**
|
|
55
|
-
*
|
|
56
|
-
*
|
|
57
|
-
* @param event - constructor of the {@link AccessTokenEvent} subclass to emit
|
|
58
|
-
* @param args - additional arguments forwarded to the event constructor
|
|
37
|
+
* Thunk form of {@link getToken}.
|
|
59
38
|
*/
|
|
60
|
-
function
|
|
61
|
-
return
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
39
|
+
export function _token(token) {
|
|
40
|
+
return () => getToken(token);
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Thunk form of {@link getOwner}.
|
|
44
|
+
*/
|
|
45
|
+
export function _owner(user) {
|
|
46
|
+
return () => getOwner(user);
|
|
65
47
|
}
|
|
66
48
|
/**
|
|
67
49
|
* Roles the configured {@link AccessTokenRolePolicy} lets `owner` put on a
|
|
@@ -86,7 +68,7 @@ function _token_ev(event, ...args) {
|
|
|
86
68
|
* this filter, get offered by `GET user/tokens/roles`, and be mintable onto a token.
|
|
87
69
|
*/
|
|
88
70
|
export async function _allowed_roles(owner, profile) {
|
|
89
|
-
const policy = await
|
|
71
|
+
const policy = await service('rbac.token.rolePolicy', AccessTokenRolePolicy);
|
|
90
72
|
const allowed = await policy.allowedRoles(owner, profile);
|
|
91
73
|
const ac = DI.get('AccessControl');
|
|
92
74
|
const grants = ac.getGrants();
|
|
@@ -97,16 +79,16 @@ export async function _allowed_roles(owner, profile) {
|
|
|
97
79
|
* token to. Same live-resolution rationale as `_allowed_roles`.
|
|
98
80
|
*/
|
|
99
81
|
export async function _allowed_profiles(owner) {
|
|
100
|
-
const policy = await
|
|
82
|
+
const policy = await service('rbac.token.rolePolicy', AccessTokenRolePolicy);
|
|
101
83
|
return policy.allowedProfiles(owner);
|
|
102
84
|
}
|
|
103
85
|
/**
|
|
104
86
|
* Ensures `profile` is one the configured policy lets `owner` pin a token to.
|
|
105
87
|
*/
|
|
106
|
-
async function
|
|
88
|
+
async function assertProfile(owner, profile) {
|
|
107
89
|
const allowed = await _allowed_profiles(owner);
|
|
108
90
|
if (!allowed.includes(profile)) {
|
|
109
|
-
throw new
|
|
91
|
+
throw new AccessTokenRoleNotAllowed(`Owner may not pin a token to profile: ${profile}`, { roles: [profile] });
|
|
110
92
|
}
|
|
111
93
|
}
|
|
112
94
|
/**
|
|
@@ -118,11 +100,11 @@ async function _assert_profile(owner, profile) {
|
|
|
118
100
|
* With `profile` given the question is asked relative to that profile, which a
|
|
119
101
|
* policy may answer more narrowly than the owner-wide union.
|
|
120
102
|
*/
|
|
121
|
-
async function
|
|
103
|
+
async function assertRolesSubset(owner, roles, profile) {
|
|
122
104
|
const allowed = await _allowed_roles(owner, profile);
|
|
123
105
|
const missing = roles.filter((r) => !allowed.includes(r));
|
|
124
106
|
if (missing.length !== 0) {
|
|
125
|
-
throw new
|
|
107
|
+
throw new AccessTokenRoleNotAllowed(`Owner may not put role(s) on a token: ${missing.join(', ')}`, { roles: missing });
|
|
126
108
|
}
|
|
127
109
|
}
|
|
128
110
|
/**
|
|
@@ -146,27 +128,26 @@ async function _assert_roles_subset(owner, roles, profile) {
|
|
|
146
128
|
export async function createToken(user, name, roles, expiresAt, profile) {
|
|
147
129
|
name = _check_arg(_trim(), _non_empty(), _max_length(128))(name, 'name');
|
|
148
130
|
roles = _check_arg(_non_nil(), _non_empty())(roles, 'roles');
|
|
149
|
-
const generator = await
|
|
131
|
+
const generator = await service('rbac.token.generation', AccessTokenGenerationProvider);
|
|
150
132
|
const generated = await generator.generate();
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
}, _token_ev(AccessTokenCreated), (t) => ({ Token: t, Plaintext: generated.Plaintext }));
|
|
133
|
+
const owner = await getOwner(user);
|
|
134
|
+
if (profile) {
|
|
135
|
+
await assertProfile(owner, profile);
|
|
136
|
+
}
|
|
137
|
+
await assertRolesSubset(owner, roles, profile);
|
|
138
|
+
const token = new AccessToken({
|
|
139
|
+
Name: name,
|
|
140
|
+
Token: generated.Hash,
|
|
141
|
+
Roles: _.uniq(roles),
|
|
142
|
+
Profile: profile ?? undefined,
|
|
143
|
+
// `ExpiresAt` is optional rather than nullable ( see the model ), so a
|
|
144
|
+
// "never expires" token leaves the property unset instead of holding null.
|
|
145
|
+
ExpiresAt: expiresAt ?? undefined,
|
|
146
|
+
user_id: owner.Id,
|
|
147
|
+
});
|
|
148
|
+
await token.insert();
|
|
149
|
+
await ev(new AccessTokenCreated(token));
|
|
150
|
+
return { Token: token, Plaintext: generated.Plaintext };
|
|
170
151
|
}
|
|
171
152
|
/**
|
|
172
153
|
* Permanently deletes ( revokes ) a token.
|
|
@@ -174,7 +155,9 @@ export async function createToken(user, name, roles, expiresAt, profile) {
|
|
|
174
155
|
* @param token - {@link AccessToken} instance or its uuid
|
|
175
156
|
*/
|
|
176
157
|
export async function deleteToken(token) {
|
|
177
|
-
|
|
158
|
+
const t = await getToken(token);
|
|
159
|
+
await t.destroy();
|
|
160
|
+
await ev(new AccessTokenDeleted(t));
|
|
178
161
|
}
|
|
179
162
|
/**
|
|
180
163
|
* Adds a role to a token. The role must be allowed for the token owner by the
|
|
@@ -185,12 +168,13 @@ export async function deleteToken(token) {
|
|
|
185
168
|
*/
|
|
186
169
|
export async function grantTokenRole(token, role) {
|
|
187
170
|
role = _check_arg(_trim(), _non_empty())(role, 'role');
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
171
|
+
const t = await getToken(token);
|
|
172
|
+
const owner = await getOwner(t.user_id);
|
|
173
|
+
await assertRolesSubset(owner, [role], t.Profile);
|
|
174
|
+
t.Roles = _.uniq([...t.Roles, role]);
|
|
175
|
+
await t.update();
|
|
176
|
+
await ev(new AccessTokenRoleGranted(t, role));
|
|
177
|
+
return t;
|
|
194
178
|
}
|
|
195
179
|
/**
|
|
196
180
|
* Removes a role from a token.
|
|
@@ -207,27 +191,33 @@ export async function grantTokenRole(token, role) {
|
|
|
207
191
|
*
|
|
208
192
|
* @param token - {@link AccessToken} instance or its uuid
|
|
209
193
|
* @param role - role name to revoke
|
|
210
|
-
* @throws
|
|
194
|
+
* @throws AccessTokenRoleNotAllowed when `role` is the token's last role
|
|
211
195
|
*/
|
|
212
196
|
export async function revokeTokenRole(token, role) {
|
|
213
197
|
role = _check_arg(_trim(), _non_empty())(role, 'role');
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
198
|
+
const t = await getToken(token);
|
|
199
|
+
const remaining = t.Roles.filter((r) => r !== role);
|
|
200
|
+
// a role the token never carried: nothing to revoke - no row write and no
|
|
201
|
+
// AccessTokenRoleRevoked event recording a revocation that never happened
|
|
202
|
+
if (remaining.length === t.Roles.length) {
|
|
203
|
+
return t;
|
|
204
|
+
}
|
|
205
|
+
// checked BEFORE mutating, so a refused revoke leaves the instance and
|
|
206
|
+
// the row exactly as they were
|
|
207
|
+
if (remaining.length === 0) {
|
|
208
|
+
throw new AccessTokenRoleNotAllowed('Cannot revoke the last role from a token - delete the token instead', { token: t.Uuid });
|
|
209
|
+
}
|
|
210
|
+
t.Roles = remaining;
|
|
211
|
+
await t.update();
|
|
212
|
+
await ev(new AccessTokenRoleRevoked(t, role));
|
|
213
|
+
return t;
|
|
224
214
|
}
|
|
225
215
|
/**
|
|
226
216
|
* Validates a presented plaintext token.
|
|
227
217
|
*
|
|
228
218
|
* Checks, in order: token exists ( by hash ), token not expired, owner active /
|
|
229
219
|
* not soft-deleted / not banned, effective role intersection non-empty.
|
|
230
|
-
* Throws
|
|
220
|
+
* Throws {@link AccessTokenException} subclasses on every failure path.
|
|
231
221
|
*
|
|
232
222
|
* The owner checks are spelled out instead of reusing the `isActiveUser` query
|
|
233
223
|
* scope on purpose - a single "no such active user" result cannot say WHY, and
|
|
@@ -239,21 +229,21 @@ export async function validateToken(plaintext) {
|
|
|
239
229
|
// Degenerate input is a failed authentication like any other, so it has to
|
|
240
230
|
// leave through the same door. `_check_arg(_trim(), _non_empty())` would
|
|
241
231
|
// throw a raw InvalidArgument here - and a bare TypeError for nil, since
|
|
242
|
-
// `_non_empty` dereferences `.length` - breaking the "always an
|
|
243
|
-
// contract this function is called under. Reported as
|
|
232
|
+
// `_non_empty` dereferences `.length` - breaking the "always an AccessTokenException"
|
|
233
|
+
// contract this function is called under. Reported as AccessTokenNotFound with
|
|
244
234
|
// the unknown-token message on purpose: a caller must not learn WHY.
|
|
245
235
|
if (!_.isString(plaintext) || plaintext.trim().length === 0) {
|
|
246
|
-
throw new
|
|
236
|
+
throw new AccessTokenNotFound('Access token not found');
|
|
247
237
|
}
|
|
248
238
|
plaintext = plaintext.trim();
|
|
249
|
-
const generator = await
|
|
239
|
+
const generator = await service('rbac.token.generation', AccessTokenGenerationProvider);
|
|
250
240
|
const hash = generator.hash(plaintext);
|
|
251
241
|
const token = await AccessToken.where('Token', hash).first();
|
|
252
242
|
if (!token) {
|
|
253
|
-
throw new
|
|
243
|
+
throw new AccessTokenNotFound('Access token not found');
|
|
254
244
|
}
|
|
255
245
|
if (token.IsExpired) {
|
|
256
|
-
throw new
|
|
246
|
+
throw new AccessTokenExpired('Access token expired', { token: token.Uuid });
|
|
257
247
|
}
|
|
258
248
|
// Metadata carries the ban flag, so it must be populated - without it
|
|
259
249
|
// `IsBanned` silently answers false and every banned owner authenticates.
|
|
@@ -262,7 +252,7 @@ export async function validateToken(plaintext) {
|
|
|
262
252
|
// `DeletedAt` is defence in depth: the orm's soft-delete scope already appends
|
|
263
253
|
// `DeletedAt IS NULL` to User selects, so a deleted owner arrives as undefined.
|
|
264
254
|
if (!owner || !owner.IsActive || owner.DeletedAt || owner.IsBanned) {
|
|
265
|
-
throw new
|
|
255
|
+
throw new AccessTokenOwnerInvalid('Access token owner is not allowed to authenticate', { token: token.Uuid });
|
|
266
256
|
}
|
|
267
257
|
// a profile token whose owner no longer passes the profile policy (role
|
|
268
258
|
// revoked, policy tightened) authorises nothing - same immediacy rule as
|
|
@@ -270,7 +260,7 @@ export async function validateToken(plaintext) {
|
|
|
270
260
|
if (token.Profile) {
|
|
271
261
|
const profiles = await _allowed_profiles(owner);
|
|
272
262
|
if (!profiles.includes(token.Profile)) {
|
|
273
|
-
throw new
|
|
263
|
+
throw new AccessTokenRoleNotAllowed('Access token profile is no longer allowed for its owner', { token: token.Uuid });
|
|
274
264
|
}
|
|
275
265
|
}
|
|
276
266
|
// roles are re-checked against the policy on every request rather than
|
|
@@ -280,7 +270,7 @@ export async function validateToken(plaintext) {
|
|
|
280
270
|
const allowed = await _allowed_roles(owner, token.Profile);
|
|
281
271
|
const effective = token.Roles.filter((r) => allowed.includes(r));
|
|
282
272
|
if (effective.length === 0) {
|
|
283
|
-
throw new
|
|
273
|
+
throw new AccessTokenRoleNotAllowed('Access token has no effective roles', { token: token.Uuid });
|
|
284
274
|
}
|
|
285
275
|
return { User: owner, Token: token, EffectiveRoles: effective };
|
|
286
276
|
}
|
package/lib/mjs/actions.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC9H,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3H;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAA2B;IACxD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA4B;IACzD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qKAAqK;QACrK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAA2B;IAChD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,IAA4B;IACjD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAW,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAW;IACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAwB,uBAAuB,EAAE,qBAAqB,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,KAAW,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAyB,CAAC,yCAAyC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAW,EAAE,KAAe,EAAE,OAAgB;IAC7E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,IAAY,EAAE,KAAe,EAAE,SAAgC,EAAE,OAAgB;IAC/I,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;IACvH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;QAC5B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,uEAAuE;QACvE,2EAA2E;QAC3E,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,OAAO,EAAE,KAAK,CAAC,EAAE;KAClB,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IAErB,MAAM,EAAE,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAExC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2B;IAC3D,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IAClB,MAAM,EAAE,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B,EAAE,IAAY;IAC5E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAElD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAEjB,MAAM,EAAE,CAAC,IAAI,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IAC7E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,uEAAuE;IACvE,+BAA+B;IAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CAAC,qEAAqE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;IACpB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAEjB,MAAM,EAAE,CAAC,IAAI,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9C,OAAO,CAAC,CAAC;AACX,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,sFAAsF;IACtF,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAgC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qKAAqK;IACrK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,iCAAiC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,yBAAyB,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAErG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,eAAuB;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}
|
|
@@ -162,7 +162,7 @@ export declare class AccessTokenController extends BaseController {
|
|
|
162
162
|
/**
|
|
163
163
|
* Turns the actions layer's role refusals into a 400.
|
|
164
164
|
*
|
|
165
|
-
* `
|
|
165
|
+
* `AccessTokenRoleNotAllowed` has no entry in the http error map, so an uncaught one leaves as
|
|
166
166
|
* a 500 - and "you asked for a role you do not have" / "a token must keep one
|
|
167
167
|
* role" are the caller's mistakes, not the server's. Anything else is rethrown
|
|
168
168
|
* untouched so a genuine failure still reaches the error handler.
|
|
@@ -13,10 +13,10 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
|
13
13
|
import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put, Query } from '@spinajs/http';
|
|
14
14
|
import { User as UserModel } from '@spinajs/rbac';
|
|
15
15
|
import { Permission, Resource, User } from '@spinajs/rbac-http';
|
|
16
|
-
import {
|
|
16
|
+
import { AccessTokenRoleNotAllowed } from '../exceptions.js';
|
|
17
17
|
import { DateTime } from 'luxon';
|
|
18
18
|
import { AccessToken } from '../models/AccessToken.js';
|
|
19
|
-
import {
|
|
19
|
+
import { _allowed_profiles, _allowed_roles, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
|
|
20
20
|
import { CreateTokenDto } from '../dto/create-token-dto.js';
|
|
21
21
|
import { NoTokenAuthPolicy } from '../policies/NoTokenAuthPolicy.js';
|
|
22
22
|
import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
|
|
@@ -231,13 +231,13 @@ let AccessTokenController = class AccessTokenController extends BaseController {
|
|
|
231
231
|
/**
|
|
232
232
|
* Turns the actions layer's role refusals into a 400.
|
|
233
233
|
*
|
|
234
|
-
* `
|
|
234
|
+
* `AccessTokenRoleNotAllowed` has no entry in the http error map, so an uncaught one leaves as
|
|
235
235
|
* a 500 - and "you asked for a role you do not have" / "a token must keep one
|
|
236
236
|
* role" are the caller's mistakes, not the server's. Anything else is rethrown
|
|
237
237
|
* untouched so a genuine failure still reaches the error handler.
|
|
238
238
|
*/
|
|
239
239
|
roleError(err) {
|
|
240
|
-
if (err instanceof
|
|
240
|
+
if (err instanceof AccessTokenRoleNotAllowed) {
|
|
241
241
|
return new BadRequestResponse({ error: { code: 'E_TOKEN_ROLE_NOT_ALLOWED', message: err.message } });
|
|
242
242
|
}
|
|
243
243
|
throw err;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5I,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;;;;;;;;OAeG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe,EAAW,OAAgB;QACnE,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3F,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClG,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AAhMc;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;kDAEzC;AAcY;IAFZ,GAAG,CAAC,iBAAiB,CAAC;IACtB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;qDAE5C;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAkBY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAkBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AAhKU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAmNjC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
import { Exception } from '@spinajs/exceptions';
|
|
2
|
+
/**
|
|
3
|
+
* Base class for access token failures. `data` carries a transport-agnostic
|
|
4
|
+
* payload ( token uuid, refused roles ) that middleware / controllers log or
|
|
5
|
+
* translate into responses. Named AccessToken* so the classes stay distinct
|
|
6
|
+
* from the password-reset TokenExpired / TokenInvalid in `@spinajs/rbac` -
|
|
7
|
+
* the http error map is keyed by constructor name.
|
|
8
|
+
*/
|
|
9
|
+
export declare class AccessTokenException extends Exception {
|
|
10
|
+
data?: unknown;
|
|
11
|
+
constructor(message?: string, data?: unknown, inner?: Error | unknown);
|
|
12
|
+
}
|
|
13
|
+
/**
|
|
14
|
+
* Thrown when no access token matches the presented value.
|
|
15
|
+
*/
|
|
16
|
+
export declare class AccessTokenNotFound extends AccessTokenException {
|
|
17
|
+
}
|
|
18
|
+
/**
|
|
19
|
+
* Thrown when the access token has expired.
|
|
20
|
+
*/
|
|
21
|
+
export declare class AccessTokenExpired extends AccessTokenException {
|
|
22
|
+
}
|
|
23
|
+
/**
|
|
24
|
+
* Thrown when the token owner may no longer authenticate ( banned / inactive / deleted ).
|
|
25
|
+
*/
|
|
26
|
+
export declare class AccessTokenOwnerInvalid extends AccessTokenException {
|
|
27
|
+
}
|
|
28
|
+
/**
|
|
29
|
+
* Thrown when a role / profile may not be pinned to or revoked from a token.
|
|
30
|
+
*/
|
|
31
|
+
export declare class AccessTokenRoleNotAllowed extends AccessTokenException {
|
|
32
|
+
}
|
|
33
|
+
//# sourceMappingURL=exceptions.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;IACZ,IAAI,CAAC,EAAE,OAAO;IAAnD,YAAY,OAAO,CAAC,EAAE,MAAM,EAAS,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,EAE3E;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,oBAAoB;CAAG;AAEhE;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,oBAAoB;CAAG;AAE/D;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;CAAG;AAEpE;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,oBAAoB;CAAG"}
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
import { Exception } from '@spinajs/exceptions';
|
|
2
|
+
/**
|
|
3
|
+
* Base class for access token failures. `data` carries a transport-agnostic
|
|
4
|
+
* payload ( token uuid, refused roles ) that middleware / controllers log or
|
|
5
|
+
* translate into responses. Named AccessToken* so the classes stay distinct
|
|
6
|
+
* from the password-reset TokenExpired / TokenInvalid in `@spinajs/rbac` -
|
|
7
|
+
* the http error map is keyed by constructor name.
|
|
8
|
+
*/
|
|
9
|
+
export class AccessTokenException extends Exception {
|
|
10
|
+
constructor(message, data, inner) {
|
|
11
|
+
super(message, inner);
|
|
12
|
+
this.data = data;
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
/**
|
|
16
|
+
* Thrown when no access token matches the presented value.
|
|
17
|
+
*/
|
|
18
|
+
export class AccessTokenNotFound extends AccessTokenException {
|
|
19
|
+
}
|
|
20
|
+
/**
|
|
21
|
+
* Thrown when the access token has expired.
|
|
22
|
+
*/
|
|
23
|
+
export class AccessTokenExpired extends AccessTokenException {
|
|
24
|
+
}
|
|
25
|
+
/**
|
|
26
|
+
* Thrown when the token owner may no longer authenticate ( banned / inactive / deleted ).
|
|
27
|
+
*/
|
|
28
|
+
export class AccessTokenOwnerInvalid extends AccessTokenException {
|
|
29
|
+
}
|
|
30
|
+
/**
|
|
31
|
+
* Thrown when a role / profile may not be pinned to or revoked from a token.
|
|
32
|
+
*/
|
|
33
|
+
export class AccessTokenRoleNotAllowed extends AccessTokenException {
|
|
34
|
+
}
|
|
35
|
+
//# sourceMappingURL=exceptions.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,OAAgB,EAAS,IAAc,EAAE,KAAuB;QAC1E,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBADa,IAAI;IAEzC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,oBAAoB;CAAG;AAEhE;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,oBAAoB;CAAG;AAE/D;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,oBAAoB;CAAG;AAEpE;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,oBAAoB;CAAG"}
|
package/lib/mjs/index.d.ts
CHANGED
|
@@ -2,6 +2,7 @@ import './generator.js';
|
|
|
2
2
|
import './role-policy.js';
|
|
3
3
|
import './middlewares.js';
|
|
4
4
|
export * from './interfaces.js';
|
|
5
|
+
export * from './exceptions.js';
|
|
5
6
|
export * from './models/AccessToken.js';
|
|
6
7
|
export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
|
|
7
8
|
export * from './migrations/RbacHttpTokenProfile_2026_08_21_00_00_00.js';
|
package/lib/mjs/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}
|