@spinajs/rbac-http-user 2.0.474 → 2.0.476

package/lib/cjs/dto/impersonate-dto.js

@@ -1,34 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ImpersonateDto = exports.ImpersonateDtoSchema = void 0;
-const validation_1 = require("@spinajs/validation");
-exports.ImpersonateDtoSchema = {
-    $schema: 'http://json-schema.org/draft-07/schema#',
-    title: 'Impersonate DTO',
-    type: 'object',
-    properties: {
-        TargetUuid: { type: 'string', format: 'uuid', description: 'UUID of the user to impersonate' },
-        Password: { type: 'string', maxLength: 32, description: 'Impersonator password (required when rbac.impersonation.requirePassword is true)' },
-    },
-    required: ['TargetUuid'],
-};
-let ImpersonateDto = class ImpersonateDto {
-    constructor(data) {
-        Object.assign(this, data);
-    }
-};
-exports.ImpersonateDto = ImpersonateDto;
-exports.ImpersonateDto = ImpersonateDto = __decorate([
-    (0, validation_1.Schema)(exports.ImpersonateDtoSchema),
-    __metadata("design:paramtypes", [Object])
-], ImpersonateDto);
-//# sourceMappingURL=impersonate-dto.js.map

package/lib/cjs/dto/impersonate-dto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonate-dto.js","sourceRoot":"","sources":["../../../src/dto/impersonate-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iCAAiC,EAAE;QAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE;KAC7I;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;CACzB,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAM,EAAC,4BAAoB,CAAC;;GAChB,cAAc,CAQ1B"}

package/lib/cjs/dto/switchRole-dto.d.ts

@@ -1,24 +0,0 @@
-export declare const SwitchRoleDtoSchema: {
-    $schema: string;
-    title: string;
-    type: string;
-    properties: {
-        Role: {
-            type: string;
-            minLength: number;
-            description: string;
-        };
-        Password: {
-            type: string;
-            maxLength: number;
-            description: string;
-        };
-    };
-    required: string[];
-};
-export declare class SwitchRoleDto {
-    Role: string;
-    Password?: string;
-    constructor(data: any);
-}
-//# sourceMappingURL=switchRole-dto.d.ts.map

package/lib/cjs/dto/switchRole-dto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"switchRole-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/switchRole-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;CAS/B,CAAC;AAEF,qBACa,aAAa;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,GAAG;CAGtB"}

package/lib/cjs/dto/switchRole-dto.js

@@ -1,34 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SwitchRoleDto = exports.SwitchRoleDtoSchema = void 0;
-const validation_1 = require("@spinajs/validation");
-exports.SwitchRoleDtoSchema = {
-    $schema: 'http://json-schema.org/draft-07/schema#',
-    title: 'Switch active role DTO',
-    type: 'object',
-    properties: {
-        Role: { type: 'string', minLength: 1, description: 'Role to activate. Must be one of the user\'s assigned roles.' },
-        Password: { type: 'string', maxLength: 32, description: 'User password. Required when activating roles listed in rbac.roleSwitch.requirePassword.' },
-    },
-    required: ['Role'],
-};
-let SwitchRoleDto = class SwitchRoleDto {
-    constructor(data) {
-        Object.assign(this, data);
-    }
-};
-exports.SwitchRoleDto = SwitchRoleDto;
-exports.SwitchRoleDto = SwitchRoleDto = __decorate([
-    (0, validation_1.Schema)(exports.SwitchRoleDtoSchema),
-    __metadata("design:paramtypes", [Object])
-], SwitchRoleDto);
-//# sourceMappingURL=switchRole-dto.js.map

package/lib/cjs/dto/switchRole-dto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"switchRole-dto.js","sourceRoot":"","sources":["../../../src/dto/switchRole-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,mBAAmB,GAAG;IACjC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,wBAAwB;IAC/B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE;QACnH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,0FAA0F,EAAE;KACrJ;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC;CACnB,CAAC;AAGK,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKxB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAM,EAAC,2BAAmB,CAAC;;GACf,aAAa,CAQzB"}

package/lib/cjs/handlers/DefaultLogoutHandler.d.ts

@@ -1,14 +0,0 @@
-import { SessionProvider } from '@spinajs/rbac';
-import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
-/**
- * Default logout handler: deletes the session and clears the ssid cookie.
- * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
- * the impersonation revert handler) before the session is destroyed.
- */
-export declare class DefaultLogoutHandler extends LogoutHandler {
-    Priority: number;
-    protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: Record<string, unknown>;
-    handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-}
-//# sourceMappingURL=DefaultLogoutHandler.d.ts.map

package/lib/cjs/handlers/DefaultLogoutHandler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,mBAAmB,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAuB5E"}

package/lib/cjs/handlers/DefaultLogoutHandler.js

@@ -1,61 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DefaultLogoutHandler = void 0;
-const di_1 = require("@spinajs/di");
-const configuration_1 = require("@spinajs/configuration");
-const rbac_1 = require("@spinajs/rbac");
-const logout_js_1 = require("../logout.js");
-/**
- * Default logout handler: deletes the session and clears the ssid cookie.
- * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
- * the impersonation revert handler) before the session is destroyed.
- */
-let DefaultLogoutHandler = class DefaultLogoutHandler extends logout_js_1.LogoutHandler {
-    constructor() {
-        super(...arguments);
-        this.Priority = 999;
-    }
-    async handle(context) {
-        if (!context.Ssid) {
-            // Nothing to delete; still return a result so the chain stops.
-            return { Body: null };
-        }
-        await this.SessionProvider.delete(context.Ssid);
-        return {
-            Body: null,
-            Cookies: [
-                {
-                    Name: 'ssid',
-                    Value: '',
-                    Options: {
-                        httpOnly: true,
-                        maxAge: 0,
-                        ...this.SessionCookieConfig,
-                    },
-                },
-            ],
-        };
-    }
-};
-exports.DefaultLogoutHandler = DefaultLogoutHandler;
-__decorate([
-    (0, configuration_1.AutoinjectService)('rbac.session'),
-    __metadata("design:type", rbac_1.SessionProvider)
-], DefaultLogoutHandler.prototype, "SessionProvider", void 0);
-__decorate([
-    (0, configuration_1.Config)('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], DefaultLogoutHandler.prototype, "SessionCookieConfig", void 0);
-exports.DefaultLogoutHandler = DefaultLogoutHandler = __decorate([
-    (0, di_1.Injectable)(logout_js_1.LogoutHandler)
-], DefaultLogoutHandler);
-//# sourceMappingURL=DefaultLogoutHandler.js.map

package/lib/cjs/handlers/DefaultLogoutHandler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAmE;AACnE,wCAAgD;AAChD,4CAA4E;AAE5E;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,yBAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IA+BxB,CAAC;IAvBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE;wBACP,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,CAAC;wBACT,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhCY,oDAAoB;AAIrB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACN,sBAAe;6DAAC;AAGlC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACsB;+BAP7C,oBAAoB;IADhC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,oBAAoB,CAgChC"}

package/lib/cjs/handlers/ImpersonationLogoutHandler.d.ts

@@ -1,18 +0,0 @@
-import { SessionProvider, User } from '@spinajs/rbac';
-import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
-/**
- * Logout handler that detects an active impersonation and reverts it instead
- * of destroying the session. Runs early (priority 10) so it short-circuits
- * the default session-deletion handler when applicable.
- */
-export declare class ImpersonationLogoutHandler extends LogoutHandler {
-    Priority: number;
-    protected SessionProvider: SessionProvider;
-    handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    protected emitEvent(original: User, target: User): Promise<void>;
-}
-//# sourceMappingURL=ImpersonationLogoutHandler.d.ts.map

package/lib/cjs/handlers/ImpersonationLogoutHandler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA0B,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAE/B,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0B3E;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}

package/lib/cjs/handlers/ImpersonationLogoutHandler.js

@@ -1,66 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ImpersonationLogoutHandler = void 0;
-const di_1 = require("@spinajs/di");
-const configuration_1 = require("@spinajs/configuration");
-const rbac_1 = require("@spinajs/rbac");
-const queue_1 = require("@spinajs/queue");
-const logout_js_1 = require("../logout.js");
-/**
- * Logout handler that detects an active impersonation and reverts it instead
- * of destroying the session. Runs early (priority 10) so it short-circuits
- * the default session-deletion handler when applicable.
- */
-let ImpersonationLogoutHandler = class ImpersonationLogoutHandler extends logout_js_1.LogoutHandler {
-    constructor() {
-        super(...arguments);
-        this.Priority = 10;
-    }
-    async handle(context) {
-        const session = context.Session;
-        if (!session)
-            return null;
-        const impersonatorUuid = session.Data.get('Impersonator');
-        if (!impersonatorUuid)
-            return null;
-        const original = await rbac_1.User.getByUuid(impersonatorUuid);
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
-        }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(original, context.User);
-        // Take ownership of the response: no cookie change — the original user's
-        // session continues.
-        return { Body: { ImpersonationEnded: true } };
-    }
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    emitEvent(original, target) {
-        return (0, queue_1._ev)(new rbac_1.UserImpersonationEnded(original, target))();
-    }
-};
-exports.ImpersonationLogoutHandler = ImpersonationLogoutHandler;
-__decorate([
-    (0, configuration_1.AutoinjectService)('rbac.session'),
-    __metadata("design:type", rbac_1.SessionProvider)
-], ImpersonationLogoutHandler.prototype, "SessionProvider", void 0);
-exports.ImpersonationLogoutHandler = ImpersonationLogoutHandler = __decorate([
-    (0, di_1.Injectable)(logout_js_1.LogoutHandler)
-], ImpersonationLogoutHandler);
-//# sourceMappingURL=ImpersonationLogoutHandler.js.map

package/lib/cjs/handlers/ImpersonationLogoutHandler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAA2D;AAC3D,wCAA8E;AAC9E,0CAAqC;AACrC,4CAA4E;AAE5E;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,yBAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAsCvB,CAAC;IAjCQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,WAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAExD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,yEAAyE;QACzE,qBAAqB;QACrB,OAAO,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,IAAA,WAAG,EAAC,IAAI,6BAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AAvCY,gEAA0B;AAI3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACN,sBAAe;mEAAC;qCAJjC,0BAA0B;IADtC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,0BAA0B,CAuCtC"}

package/lib/cjs/logout.d.ts

@@ -1,51 +0,0 @@
-import type { ISession, User } from '@spinajs/rbac';
-/**
- * Per-request context handed to each {@link LogoutHandler} during logout.
- * The session may be null when the caller has no active session — handlers
- * should treat that as a no-op.
- */
-export interface ILogoutContext {
-    /** Raw signed session cookie value (already unsigned by the framework) */
-    Ssid: string;
-    /** Restored session, or null when none is active */
-    Session: ISession | null;
-    /** Logged-in user as resolved by RbacMiddleware */
-    User: User;
-}
-/** Cookie operation a handler may attach to its response */
-export interface ILogoutCookie {
-    Name: string;
-    Value: string;
-    Options: Record<string, unknown>;
-}
-/** Response payload a handler returns when it takes ownership of the logout */
-export interface ILogoutResult {
-    /** Response body */
-    Body?: unknown;
-    /** Cookie operations to attach */
-    Cookies?: ILogoutCookie[];
-}
-/**
- * Pluggable logout step. Handlers are resolved via `DI.resolve(Array.ofType(LogoutHandler))`
- * by the logout controller and executed in ascending Priority order. The first
- * handler that returns a non-null result takes ownership of the response — the
- * chain stops there. Returning null defers to the next handler.
- *
- * Built-ins:
- *  - {@link ImpersonationLogoutHandler} (priority 10) — when an impersonation
- *    is active, revert it and keep the session alive.
- *  - {@link DefaultLogoutHandler} (priority 999) — destroy the session and
- *    clear the ssid cookie.
- *
- * Register custom handlers with @Injectable(LogoutHandler). Choose a Priority
- * lower than 999 to run before the default session destruction.
- */
-export declare abstract class LogoutHandler {
-    /**
-     * Lower runs first. Default 100. The default cleanup handler runs at 999;
-     * pick a value below that to run before it.
-     */
-    Priority: number;
-    abstract handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-}
-//# sourceMappingURL=logout.d.ts.map

package/lib/cjs/logout.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAEzB,mDAAmD;IACnD,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,aAAa;IACjC;;;OAGG;IACI,QAAQ,EAAE,MAAM,CAAO;aAEd,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAC/E"}

package/lib/cjs/logout.js

@@ -1,29 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LogoutHandler = void 0;
-/**
- * Pluggable logout step. Handlers are resolved via `DI.resolve(Array.ofType(LogoutHandler))`
- * by the logout controller and executed in ascending Priority order. The first
- * handler that returns a non-null result takes ownership of the response — the
- * chain stops there. Returning null defers to the next handler.
- *
- * Built-ins:
- *  - {@link ImpersonationLogoutHandler} (priority 10) — when an impersonation
- *    is active, revert it and keep the session alive.
- *  - {@link DefaultLogoutHandler} (priority 999) — destroy the session and
- *    clear the ssid cookie.
- *
- * Register custom handlers with @Injectable(LogoutHandler). Choose a Priority
- * lower than 999 to run before the default session destruction.
- */
-class LogoutHandler {
-    constructor() {
-        /**
-         * Lower runs first. Default 100. The default cleanup handler runs at 999;
-         * pick a value below that to run before it.
-         */
-        this.Priority = 100;
-    }
-}
-exports.LogoutHandler = LogoutHandler;
-//# sourceMappingURL=logout.js.map

package/lib/cjs/logout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":";;;AAkCA;;;;;;;;;;;;;;GAcG;AACH,MAAsB,aAAa;IAAnC;QACE;;;WAGG;QACI,aAAQ,GAAW,GAAG,CAAC;IAGhC,CAAC;CAAA;AARD,sCAQC"}

package/lib/mjs/controllers/ActiveRoleController.d.ts

@@ -1,41 +0,0 @@
-import { SwitchRoleDto } from '../dto/switchRole-dto.js';
-import { BaseController, Ok, BadRequestResponse, Unauthorized } from '@spinajs/http';
-import { AccessControl, AuthProvider, PasswordProvider, SessionProvider } from '@spinajs/rbac';
-import type { ISession, User } from '@spinajs/rbac';
-import { IActiveRoleResponse } from '@spinajs/rbac-http';
-/**
- * Active role endpoints.
- * Let users with multiple roles inspect and switch the currently active role.
- * The active role drives all request-bound permission checks; the user's full
- * role list remains available so they can switch back at any time.
- * @tags Authentication
- */
-export declare class ActiveRoleController extends BaseController {
-    protected AC: AccessControl;
-    protected AuthProvider: AuthProvider;
-    protected PasswordProvider: PasswordProvider;
-    protected SessionProvider: SessionProvider;
-    protected RolesRequiringPassword: string[];
-    /**
-     * Get active role
-     * Returns the currently active role for the session, all roles the user may switch to,
-     * and the RBAC grants resolved for the active role.
-     * @security cookieAuth
-     * @returns {IActiveRoleResponse}
-     * @response 401 No active session
-     */
-    getActiveRole(user: User, ActiveRole: string): Promise<Ok<IActiveRoleResponse>>;
-    /**
-     * Switch active role
-     * Switches the active role for the current session. The requested role must be one of
-     * the user's assigned roles. If the role is listed in `rbac.roleSwitch.requirePassword`,
-     * the user's password must also be provided and is re-verified.
-     * @security cookieAuth
-     * @returns {IActiveRoleResponse}
-     * @response 400 Requested role is not assigned to the user
-     * @response 401 Password verification required or failed
-     */
-    switchActiveRole(user: User, session: ISession, payload: SwitchRoleDto): Promise<Ok<IActiveRoleResponse> | BadRequestResponse | Unauthorized>;
-    protected buildResponse(user: User, activeRole: string): IActiveRoleResponse;
-}
-//# sourceMappingURL=ActiveRoleController.d.ts.map

package/lib/mjs/controllers/ActiveRoleController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC9G,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAE3C;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqCvE,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAQ7E"}

package/lib/mjs/controllers/ActiveRoleController.js

@@ -1,132 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { SwitchRoleDto } from '../dto/switchRole-dto.js';
-import { BaseController, BasePath, Post, Body, Ok, Get, BadRequestResponse, Unauthorized, Policy } from '@spinajs/http';
-import { AccessControl, AuthProvider, PasswordProvider, SessionProvider, _unwindGrants } from '@spinajs/rbac';
-import { Autoinject } from '@spinajs/di';
-import { AutoinjectService, Config } from '@spinajs/configuration';
-import { LoggedPolicy, User as UserRouteArg, Session as SessionRouteArg, FromSession } from '@spinajs/rbac-http';
-/**
- * Active role endpoints.
- * Let users with multiple roles inspect and switch the currently active role.
- * The active role drives all request-bound permission checks; the user's full
- * role list remains available so they can switch back at any time.
- * @tags Authentication
- */
-let ActiveRoleController = class ActiveRoleController extends BaseController {
-    /**
-     * Get active role
-     * Returns the currently active role for the session, all roles the user may switch to,
-     * and the RBAC grants resolved for the active role.
-     * @security cookieAuth
-     * @returns {IActiveRoleResponse}
-     * @response 401 No active session
-     */
-    async getActiveRole(user, ActiveRole) {
-        return new Ok(this.buildResponse(user, ActiveRole ?? user.Role?.[0]));
-    }
-    /**
-     * Switch active role
-     * Switches the active role for the current session. The requested role must be one of
-     * the user's assigned roles. If the role is listed in `rbac.roleSwitch.requirePassword`,
-     * the user's password must also be provided and is re-verified.
-     * @security cookieAuth
-     * @returns {IActiveRoleResponse}
-     * @response 400 Requested role is not assigned to the user
-     * @response 401 Password verification required or failed
-     */
-    async switchActiveRole(user, session, payload) {
-        if (!user.Role?.includes(payload.Role)) {
-            return new BadRequestResponse({
-                error: {
-                    code: 'E_ROLE_NOT_ASSIGNED',
-                    message: `Role '${payload.Role}' is not assigned to user`,
-                },
-            });
-        }
-        if (this.RolesRequiringPassword?.includes(payload.Role)) {
-            if (!payload.Password) {
-                return new Unauthorized({
-                    error: {
-                        code: 'E_PASSWORD_REQUIRED',
-                        message: `Password is required to activate role '${payload.Role}'`,
-                    },
-                });
-            }
-            const valid = await this.PasswordProvider.verify(user.Password, payload.Password);
-            if (!valid) {
-                return new Unauthorized({
-                    error: {
-                        code: 'E_PASSWORD_INVALID',
-                        message: 'Invalid password',
-                    },
-                });
-            }
-        }
-        session.Data.set('ActiveRole', payload.Role);
-        await this.SessionProvider.save(session);
-        return new Ok(this.buildResponse(user, payload.Role));
-    }
-    buildResponse(user, activeRole) {
-        const grants = activeRole ? _unwindGrants(activeRole, this.AC.getGrants()) : {};
-        return {
-            ActiveRole: activeRole,
-            AvailableRoles: user.Role ?? [],
-            Grants: grants,
-        };
-    }
-};
-__decorate([
-    Autoinject(AccessControl),
-    __metadata("design:type", AccessControl)
-], ActiveRoleController.prototype, "AC", void 0);
-__decorate([
-    AutoinjectService('rbac.auth'),
-    __metadata("design:type", AuthProvider)
-], ActiveRoleController.prototype, "AuthProvider", void 0);
-__decorate([
-    AutoinjectService('rbac.password'),
-    __metadata("design:type", PasswordProvider)
-], ActiveRoleController.prototype, "PasswordProvider", void 0);
-__decorate([
-    AutoinjectService('rbac.session'),
-    __metadata("design:type", SessionProvider)
-], ActiveRoleController.prototype, "SessionProvider", void 0);
-__decorate([
-    Config('rbac.roleSwitch.requirePassword', { defaultValue: [] }),
-    __metadata("design:type", Array)
-], ActiveRoleController.prototype, "RolesRequiringPassword", void 0);
-__decorate([
-    Get('active-role'),
-    Policy(LoggedPolicy),
-    __param(0, UserRouteArg()),
-    __param(1, FromSession()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Function, String]),
-    __metadata("design:returntype", Promise)
-], ActiveRoleController.prototype, "getActiveRole", null);
-__decorate([
-    Post('active-role'),
-    Policy(LoggedPolicy),
-    __param(0, UserRouteArg()),
-    __param(1, SessionRouteArg()),
-    __param(2, Body()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Function, Object, SwitchRoleDto]),
-    __metadata("design:returntype", Promise)
-], ActiveRoleController.prototype, "switchActiveRole", null);
-ActiveRoleController = __decorate([
-    BasePath('auth')
-], ActiveRoleController);
-export { ActiveRoleController };
-//# sourceMappingURL=ActiveRoleController.js.map

package/lib/mjs/controllers/ActiveRoleController.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,WAAW,EAAuB,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,cAAc;IAgBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAES,aAAa,CAAC,IAAU,EAAE,UAAkB;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,cAAc,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YAC/B,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AAzFW;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;gDAAC;AAGlB;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;0DAAC;AAG3B;IADT,iBAAiB,CAAC,eAAe,CAAC;8BACP,gBAAgB;8DAAC;AAGnC;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;6DAAC;AAGjC;IADT,MAAM,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAY9B;IAFZ,GAAG,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,YAAY,CAAC;IACO,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAI,CAAC,aAAa,CAAC;IACnB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,YAAY,EAAE,CAAA;IACd,WAAA,eAAe,EAAE,CAAA;IACjB,WAAA,IAAI,EAAE,CAAA;;uDAAU,aAAa;;4DAoC/B;AAjFU,oBAAoB;IADhC,QAAQ,CAAC,MAAM,CAAC;GACJ,oBAAoB,CA2FhC"}

package/lib/mjs/controllers/ImpersonationController.d.ts

@@ -1,72 +0,0 @@
-import { ImpersonateDto } from '../dto/impersonate-dto.js';
-import { BaseController, Ok, BadRequestResponse, Unauthorized, ForbiddenResponse, Conflict, NotFound } from '@spinajs/http';
-import { AccessControl, PasswordProvider, SessionProvider, User, UserImpersonationStarted, UserImpersonationEnded } from '@spinajs/rbac';
-import type { ISession } from '@spinajs/rbac';
-import { IImpersonationResponse, IImpersonationState, IUserWithGrants } from '@spinajs/rbac-http';
-/**
- * Impersonation endpoints.
- *
- * A user holding `createAny` on the virtual resource `user:impersonate` can
- * temporarily act as another user. While impersonation is active, the session
- * carries both identities — `User` is the target, `Impersonator` is the
- * original. Permission checks therefore "see" the target by default; the
- * original is preserved only for audit and for ending the impersonation.
- *
- * @tags Authentication
- */
-export declare class ImpersonationController extends BaseController {
-    protected AC: AccessControl;
-    protected PasswordProvider: PasswordProvider;
-    protected SessionProvider: SessionProvider;
-    protected RequirePassword: boolean;
-    protected ProtectedRoles: string[];
-    /**
-     * Get impersonation state
-     * Returns whether an impersonation is currently active for this session.
-     * @security cookieAuth
-     * @returns {IImpersonationState}
-     * @response 401 No active session
-     */
-    getState(Impersonator: string, User: string, ImpersonationStartedAt: string): Promise<Ok<IImpersonationState>>;
-    /**
-     * Start impersonation
-     * Begins impersonating the target user. The caller must have `createAny` on
-     * virtual resource `user:impersonate`. The target must not hold any role in
-     * `rbac.impersonation.protectedRoles` and must not have effective grants
-     * exceeding the caller's. If `rbac.impersonation.requirePassword` is true,
-     * the caller's password must be supplied and is verified.
-     * @security cookieAuth
-     * @returns {IImpersonationResponse}
-     * @response 400 Target equals caller or invalid payload
-     * @response 401 Password required or invalid
-     * @response 403 Caller lacks permission, target is protected, or escalation detected
-     * @response 404 Target user not found / inactive / banned / deleted
-     * @response 409 An impersonation is already in progress for this session
-     */
-    start(caller: User, session: ISession, payload: ImpersonateDto): Promise<Ok<IImpersonationResponse> | BadRequestResponse | Unauthorized | ForbiddenResponse | NotFound | Conflict>;
-    /**
-     * Stop impersonation
-     * Restores the original user's session and returns their login-style payload.
-     * @security cookieAuth
-     * @returns {IUserWithGrants}
-     * @response 400 No impersonation is currently active
-     */
-    stop(target: User, session: ISession): Promise<Ok<IUserWithGrants> | BadRequestResponse>;
-    /**
-     * Emit an impersonation lifecycle event. Wrapped in a protected method so
-     * tests can intercept without stubbing module-level ESM bindings.
-     */
-    protected emitEvent(event: UserImpersonationStarted | UserImpersonationEnded): Promise<void>;
-    /**
-     * Load the impersonation target (with Metadata so IsBanned works). Extracted
-     * as a protected method so tests can stub it without setting up a database.
-     */
-    protected loadTarget(uuid: string): Promise<User | undefined>;
-    /**
-     * Load the original (impersonator) user. Extracted for the same reason as
-     * loadTarget — keeps the controller easy to test in isolation.
-     */
-    protected loadOriginal(uuid: string): Promise<User | undefined>;
-    protected buildResponse(target: User, impersonator: User, activeRole: string, startedAt: string): IImpersonationResponse;
-}
-//# sourceMappingURL=ImpersonationController.d.ts.map

package/lib/mjs/controllers/ImpersonationController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAA6B,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAU,MAAM,eAAe,CAAC;AACpK,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,IAAI,EACJ,wBAAwB,EACxB,sBAAsB,EAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAKL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAI5B;;;;;;;;;;GAUG;AACH,qBACa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC;IAGnC,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEnC;;;;;;OAMG;IAGU,QAAQ,CACJ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,sBAAsB,EAAE,MAAM,GAC5C,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAYnC;;;;;;;;;;;;;;OAcG;IAGU,KAAK,CACA,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,cAAc,GAC9B,OAAO,CACR,EAAE,CAAC,sBAAsB,CAAC,GAAG,kBAAkB,GAAG,YAAY,GAAG,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CACzG;IAsFD;;;;;;OAMG;IAGU,IAAI,CACC,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,GACnC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;IA4CpD;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5F;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI7D;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI/D,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,sBAAsB;CAWzH"}