@spinajs/rbac-http-user 2.0.474 → 2.0.476

package/lib/mjs/controllers/ImpersonationController.js

@@ -1,274 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { ImpersonateDto } from '../dto/impersonate-dto.js';
-import { BaseController, BasePath, Post, Del, Body, Ok, Get, BadRequestResponse, Unauthorized, ForbiddenResponse, Conflict, NotFound, Policy } from '@spinajs/http';
-import { AccessControl, PasswordProvider, SessionProvider, User, UserImpersonationStarted, UserImpersonationEnded, _unwindGrants, canImpersonate, } from '@spinajs/rbac';
-import { Autoinject } from '@spinajs/di';
-import { AutoinjectService, Config } from '@spinajs/configuration';
-import { _ev } from '@spinajs/queue';
-import { DateTime } from 'luxon';
-import { LoggedPolicy, User as UserRouteArg, Session as SessionRouteArg, FromSession, } from '@spinajs/rbac-http';
-const IMPERSONATE_RESOURCE = 'user:impersonate';
-/**
- * Impersonation endpoints.
- *
- * A user holding `createAny` on the virtual resource `user:impersonate` can
- * temporarily act as another user. While impersonation is active, the session
- * carries both identities — `User` is the target, `Impersonator` is the
- * original. Permission checks therefore "see" the target by default; the
- * original is preserved only for audit and for ending the impersonation.
- *
- * @tags Authentication
- */
-let ImpersonationController = class ImpersonationController extends BaseController {
-    /**
-     * Get impersonation state
-     * Returns whether an impersonation is currently active for this session.
-     * @security cookieAuth
-     * @returns {IImpersonationState}
-     * @response 401 No active session
-     */
-    async getState(Impersonator, User, ImpersonationStartedAt) {
-        if (!Impersonator) {
-            return new Ok({ Active: false });
-        }
-        return new Ok({
-            Active: true,
-            ImpersonatorUuid: Impersonator,
-            TargetUuid: User,
-            StartedAt: ImpersonationStartedAt,
-        });
-    }
-    /**
-     * Start impersonation
-     * Begins impersonating the target user. The caller must have `createAny` on
-     * virtual resource `user:impersonate`. The target must not hold any role in
-     * `rbac.impersonation.protectedRoles` and must not have effective grants
-     * exceeding the caller's. If `rbac.impersonation.requirePassword` is true,
-     * the caller's password must be supplied and is verified.
-     * @security cookieAuth
-     * @returns {IImpersonationResponse}
-     * @response 400 Target equals caller or invalid payload
-     * @response 401 Password required or invalid
-     * @response 403 Caller lacks permission, target is protected, or escalation detected
-     * @response 404 Target user not found / inactive / banned / deleted
-     * @response 409 An impersonation is already in progress for this session
-     */
-    async start(caller, session, payload) {
-        if (session?.Data.get('Impersonator')) {
-            return new Conflict({
-                error: {
-                    code: 'E_IMPERSONATION_ACTIVE',
-                    message: 'An impersonation is already in progress. Stop the current one before starting another.',
-                },
-            });
-        }
-        if (caller.Uuid === payload.TargetUuid) {
-            return new BadRequestResponse({
-                error: { code: 'E_SELF_IMPERSONATION', message: 'Cannot impersonate yourself' },
-            });
-        }
-        // Permission to impersonate is itself an RBAC permission honoring ActiveRole.
-        const activeRole = session?.Data.get('ActiveRole') ?? caller.Role?.[0];
-        const roles = activeRole ? [activeRole] : caller.Role;
-        const allowed = this.AC.can(roles).createAny(IMPERSONATE_RESOURCE).granted;
-        if (!allowed) {
-            return new ForbiddenResponse({
-                error: { code: 'E_IMPERSONATE_FORBIDDEN', message: `Role(s) ${roles} cannot impersonate other users` },
-            });
-        }
-        const target = await this.loadTarget(payload.TargetUuid);
-        if (!target) {
-            return new NotFound({ error: { code: 'E_TARGET_NOT_FOUND', message: 'Target user not found' } });
-        }
-        if (!target.IsActive || target.IsBanned) {
-            return new NotFound({ error: { code: 'E_TARGET_UNAVAILABLE', message: 'Target user is not available' } });
-        }
-        const check = canImpersonate({
-            originalRoles: caller.Role,
-            targetRoles: target.Role,
-            protectedRoles: this.ProtectedRoles ?? [],
-            ac: this.AC,
-        });
-        if (!check.allowed) {
-            return new ForbiddenResponse({
-                error: {
-                    code: check.reason === 'PROTECTED_ROLE' ? 'E_TARGET_PROTECTED' : 'E_PRIVILEGE_ESCALATION',
-                    message: check.reason === 'PROTECTED_ROLE'
-                        ? `Target has a protected role (${check.detail}) and cannot be impersonated`
-                        : `Target has a privilege the impersonator lacks (${check.detail})`,
-                },
-            });
-        }
-        if (this.RequirePassword) {
-            if (!payload.Password) {
-                return new Unauthorized({
-                    error: { code: 'E_PASSWORD_REQUIRED', message: 'Password confirmation is required to start impersonation' },
-                });
-            }
-            const valid = await this.PasswordProvider.verify(caller.Password, payload.Password);
-            if (!valid) {
-                return new Unauthorized({ error: { code: 'E_PASSWORD_INVALID', message: 'Invalid password' } });
-            }
-        }
-        // Persist impersonation state. We keep the impersonator's previous
-        // ActiveRole so it can be restored on stop; effective ActiveRole becomes
-        // the target's first role.
-        const startedAt = DateTime.now().toISO();
-        const previousActiveRole = session.Data.get('ActiveRole');
-        session.Data.set('Impersonator', caller.Uuid);
-        session.Data.set('User', target.Uuid);
-        session.Data.set('ImpersonationStartedAt', startedAt);
-        if (previousActiveRole !== undefined) {
-            session.Data.set('OriginalActiveRole', previousActiveRole);
-        }
-        const targetActiveRole = target.Role?.[0];
-        if (targetActiveRole) {
-            session.Data.set('ActiveRole', targetActiveRole);
-        }
-        await this.SessionProvider.save(session);
-        await this.emitEvent(new UserImpersonationStarted(caller, target));
-        return new Ok(this.buildResponse(target, caller, targetActiveRole, startedAt));
-    }
-    /**
-     * Stop impersonation
-     * Restores the original user's session and returns their login-style payload.
-     * @security cookieAuth
-     * @returns {IUserWithGrants}
-     * @response 400 No impersonation is currently active
-     */
-    async stop(target, session) {
-        const impersonatorUuid = session?.Data.get('Impersonator');
-        if (!impersonatorUuid) {
-            return new BadRequestResponse({
-                error: { code: 'E_NO_IMPERSONATION', message: 'No impersonation is currently in progress' },
-            });
-        }
-        const original = await this.loadOriginal(impersonatorUuid);
-        if (!original) {
-            // Stale session referencing a deleted impersonator — destroy the
-            // impersonation block to recover but report an error so the caller
-            // can re-authenticate.
-            session.Data.delete('Impersonator');
-            session.Data.delete('ImpersonationStartedAt');
-            session.Data.delete('OriginalActiveRole');
-            await this.SessionProvider.save(session);
-            return new BadRequestResponse({
-                error: { code: 'E_IMPERSONATOR_GONE', message: 'Original user no longer exists' },
-            });
-        }
-        // Restore the original session state.
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
-        }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(new UserImpersonationEnded(original, target));
-        const grants = restoredActiveRole ? _unwindGrants(restoredActiveRole, this.AC.getGrants()) : {};
-        return new Ok({
-            ...original.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
-            ActiveRole: restoredActiveRole,
-            Grants: grants,
-        });
-    }
-    /**
-     * Emit an impersonation lifecycle event. Wrapped in a protected method so
-     * tests can intercept without stubbing module-level ESM bindings.
-     */
-    emitEvent(event) {
-        return _ev(event)();
-    }
-    /**
-     * Load the impersonation target (with Metadata so IsBanned works). Extracted
-     * as a protected method so tests can stub it without setting up a database.
-     */
-    loadTarget(uuid) {
-        return User.query().whereUuid(uuid).populate('Metadata').notDeleted().first();
-    }
-    /**
-     * Load the original (impersonator) user. Extracted for the same reason as
-     * loadTarget — keeps the controller easy to test in isolation.
-     */
-    loadOriginal(uuid) {
-        return User.getByUuid(uuid);
-    }
-    buildResponse(target, impersonator, activeRole, startedAt) {
-        const grants = activeRole ? _unwindGrants(activeRole, this.AC.getGrants()) : {};
-        return {
-            User: target.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
-            Impersonator: impersonator.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
-            ActiveRole: activeRole,
-            AvailableRoles: target.Role ?? [],
-            Grants: grants,
-            StartedAt: startedAt,
-        };
-    }
-};
-__decorate([
-    Autoinject(AccessControl),
-    __metadata("design:type", AccessControl)
-], ImpersonationController.prototype, "AC", void 0);
-__decorate([
-    AutoinjectService('rbac.password'),
-    __metadata("design:type", PasswordProvider)
-], ImpersonationController.prototype, "PasswordProvider", void 0);
-__decorate([
-    AutoinjectService('rbac.session'),
-    __metadata("design:type", SessionProvider)
-], ImpersonationController.prototype, "SessionProvider", void 0);
-__decorate([
-    Config('rbac.impersonation.requirePassword', { defaultValue: true }),
-    __metadata("design:type", Boolean)
-], ImpersonationController.prototype, "RequirePassword", void 0);
-__decorate([
-    Config('rbac.impersonation.protectedRoles', { defaultValue: ['system'] }),
-    __metadata("design:type", Array)
-], ImpersonationController.prototype, "ProtectedRoles", void 0);
-__decorate([
-    Get('impersonate'),
-    Policy(LoggedPolicy),
-    __param(0, FromSession()),
-    __param(1, FromSession()),
-    __param(2, FromSession()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, String]),
-    __metadata("design:returntype", Promise)
-], ImpersonationController.prototype, "getState", null);
-__decorate([
-    Post('impersonate'),
-    Policy(LoggedPolicy),
-    __param(0, UserRouteArg()),
-    __param(1, SessionRouteArg()),
-    __param(2, Body()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [User, Object, ImpersonateDto]),
-    __metadata("design:returntype", Promise)
-], ImpersonationController.prototype, "start", null);
-__decorate([
-    Del('impersonate'),
-    Policy(LoggedPolicy),
-    __param(0, UserRouteArg()),
-    __param(1, SessionRouteArg()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [User, Object]),
-    __metadata("design:returntype", Promise)
-], ImpersonationController.prototype, "stop", null);
-ImpersonationController = __decorate([
-    BasePath('auth')
-], ImpersonationController);
-export { ImpersonationController };
-//# sourceMappingURL=ImpersonationController.js.map

package/lib/mjs/controllers/ImpersonationController.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationController.js","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpK,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,IAAI,EACJ,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,IAAI,IAAI,YAAY,EACpB,OAAO,IAAI,eAAe,EAC1B,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAE5B,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD;;;;;;;;;;GAUG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAgBzD;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACJ,YAAoB,EACpB,IAAY,EACZ,sBAA8B;QAE7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,YAAY;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAGU,AAAN,KAAK,CAAC,KAAK,CACA,MAAY,EACT,OAAiB,EAC5B,OAAuB;QAI/B,IAAI,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,QAAQ,CAAC;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,wFAAwF;iBAClG;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,6BAA6B,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,MAAM,UAAU,GAAI,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,MAAM,OAAO,GAAI,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,WAAW,KAAK,iCAAiC,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC;YAC3B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;YACzC,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB;oBACzF,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB;wBACxC,CAAC,CAAC,gCAAgC,KAAK,CAAC,MAAM,8BAA8B;wBAC5E,CAAC,CAAC,kDAAkD,KAAK,CAAC,MAAM,GAAG;iBACtE;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,0DAA0D,EAAE;iBAC5G,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAG,CAAC;QAC1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;QAEhF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,IAAI,CACC,MAAY,EACT,OAAiB;QAEpC,MAAM,gBAAgB,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QACjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2CAA2C,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iEAAiE;YACjE,mEAAmE;YACnE,uBAAuB;YACvB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,EAAE,CAAC;YACZ,GAAI,QAAQ,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAS;YACtE,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE,MAAM;SACI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,KAAwD;QAC1E,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAA+B,CAAC;IAC7G,CAAC;IAED;;;OAGG;IACO,YAAY,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAA8B,CAAC;IAC3D,CAAC;IAES,aAAa,CAAC,MAAY,EAAE,YAAkB,EAAE,UAAkB,EAAE,SAAiB;QAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACrE,YAAY,EAAE,YAAY,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACnF,UAAU,EAAE,UAAU;YACtB,cAAc,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;CACF,CAAA;AA/OW;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAGlB;IADT,iBAAiB,CAAC,eAAe,CAAC;8BACP,gBAAgB;iEAAC;AAGnC;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,MAAM,CAAC,oCAAoC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;gEAClC;AAGzB;IADT,MAAM,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAa,EAAE,CAAC;;+DACnD;AAWtB;IAFZ,GAAG,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,WAAW,EAAE,CAAA;IACb,WAAA,WAAW,EAAE,CAAA;IACb,WAAA,WAAW,EAAE,CAAA;;;;uDAWf;AAmBY;IAFZ,IAAI,CAAC,aAAa,CAAC;IACnB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,YAAY,EAAE,CAAA;IACd,WAAA,eAAe,EAAE,CAAA;IACjB,WAAA,IAAI,EAAE,CAAA;;qCAFiB,IAAI,UAEX,cAAc;;oDAuFhC;AAWY;IAFZ,GAAG,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,YAAY,EAAE,CAAA;IACd,WAAA,eAAe,EAAE,CAAA;;qCADM,IAAI;;mDA4C7B;AA5MU,uBAAuB;IADnC,QAAQ,CAAC,MAAM,CAAC;GACJ,uBAAuB,CAiPnC"}

package/lib/mjs/dto/impersonate-dto.d.ts

@@ -1,24 +0,0 @@
-export declare const ImpersonateDtoSchema: {
-    $schema: string;
-    title: string;
-    type: string;
-    properties: {
-        TargetUuid: {
-            type: string;
-            format: string;
-            description: string;
-        };
-        Password: {
-            type: string;
-            maxLength: number;
-            description: string;
-        };
-    };
-    required: string[];
-};
-export declare class ImpersonateDto {
-    TargetUuid: string;
-    Password?: string;
-    constructor(data: any);
-}
-//# sourceMappingURL=impersonate-dto.d.ts.map

package/lib/mjs/dto/impersonate-dto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonate-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/impersonate-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;CAShC,CAAC;AAEF,qBACa,cAAc;IAClB,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,GAAG;CAGtB"}

package/lib/mjs/dto/impersonate-dto.js

@@ -1,31 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Schema } from '@spinajs/validation';
-export const ImpersonateDtoSchema = {
-    $schema: 'http://json-schema.org/draft-07/schema#',
-    title: 'Impersonate DTO',
-    type: 'object',
-    properties: {
-        TargetUuid: { type: 'string', format: 'uuid', description: 'UUID of the user to impersonate' },
-        Password: { type: 'string', maxLength: 32, description: 'Impersonator password (required when rbac.impersonation.requirePassword is true)' },
-    },
-    required: ['TargetUuid'],
-};
-let ImpersonateDto = class ImpersonateDto {
-    constructor(data) {
-        Object.assign(this, data);
-    }
-};
-ImpersonateDto = __decorate([
-    Schema(ImpersonateDtoSchema),
-    __metadata("design:paramtypes", [Object])
-], ImpersonateDto);
-export { ImpersonateDto };
-//# sourceMappingURL=impersonate-dto.js.map

package/lib/mjs/dto/impersonate-dto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonate-dto.js","sourceRoot":"","sources":["../../../src/dto/impersonate-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iCAAiC,EAAE;QAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE;KAC7I;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;CACzB,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}

package/lib/mjs/dto/switchRole-dto.d.ts

@@ -1,24 +0,0 @@
-export declare const SwitchRoleDtoSchema: {
-    $schema: string;
-    title: string;
-    type: string;
-    properties: {
-        Role: {
-            type: string;
-            minLength: number;
-            description: string;
-        };
-        Password: {
-            type: string;
-            maxLength: number;
-            description: string;
-        };
-    };
-    required: string[];
-};
-export declare class SwitchRoleDto {
-    Role: string;
-    Password?: string;
-    constructor(data: any);
-}
-//# sourceMappingURL=switchRole-dto.d.ts.map

package/lib/mjs/dto/switchRole-dto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"switchRole-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/switchRole-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;CAS/B,CAAC;AAEF,qBACa,aAAa;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,GAAG;CAGtB"}

package/lib/mjs/dto/switchRole-dto.js

@@ -1,31 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Schema } from '@spinajs/validation';
-export const SwitchRoleDtoSchema = {
-    $schema: 'http://json-schema.org/draft-07/schema#',
-    title: 'Switch active role DTO',
-    type: 'object',
-    properties: {
-        Role: { type: 'string', minLength: 1, description: 'Role to activate. Must be one of the user\'s assigned roles.' },
-        Password: { type: 'string', maxLength: 32, description: 'User password. Required when activating roles listed in rbac.roleSwitch.requirePassword.' },
-    },
-    required: ['Role'],
-};
-let SwitchRoleDto = class SwitchRoleDto {
-    constructor(data) {
-        Object.assign(this, data);
-    }
-};
-SwitchRoleDto = __decorate([
-    Schema(SwitchRoleDtoSchema),
-    __metadata("design:paramtypes", [Object])
-], SwitchRoleDto);
-export { SwitchRoleDto };
-//# sourceMappingURL=switchRole-dto.js.map

package/lib/mjs/dto/switchRole-dto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"switchRole-dto.js","sourceRoot":"","sources":["../../../src/dto/switchRole-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,wBAAwB;IAC/B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE;QACnH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,0FAA0F,EAAE;KACrJ;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC;CACnB,CAAC;AAGK,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKxB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,aAAa;IADzB,MAAM,CAAC,mBAAmB,CAAC;;GACf,aAAa,CAQzB"}

package/lib/mjs/handlers/DefaultLogoutHandler.d.ts

@@ -1,14 +0,0 @@
-import { SessionProvider } from '@spinajs/rbac';
-import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
-/**
- * Default logout handler: deletes the session and clears the ssid cookie.
- * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
- * the impersonation revert handler) before the session is destroyed.
- */
-export declare class DefaultLogoutHandler extends LogoutHandler {
-    Priority: number;
-    protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: Record<string, unknown>;
-    handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-}
-//# sourceMappingURL=DefaultLogoutHandler.d.ts.map

package/lib/mjs/handlers/DefaultLogoutHandler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,mBAAmB,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAuB5E"}

package/lib/mjs/handlers/DefaultLogoutHandler.js

@@ -1,58 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Injectable } from '@spinajs/di';
-import { AutoinjectService, Config } from '@spinajs/configuration';
-import { SessionProvider } from '@spinajs/rbac';
-import { LogoutHandler } from '../logout.js';
-/**
- * Default logout handler: deletes the session and clears the ssid cookie.
- * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
- * the impersonation revert handler) before the session is destroyed.
- */
-let DefaultLogoutHandler = class DefaultLogoutHandler extends LogoutHandler {
-    constructor() {
-        super(...arguments);
-        this.Priority = 999;
-    }
-    async handle(context) {
-        if (!context.Ssid) {
-            // Nothing to delete; still return a result so the chain stops.
-            return { Body: null };
-        }
-        await this.SessionProvider.delete(context.Ssid);
-        return {
-            Body: null,
-            Cookies: [
-                {
-                    Name: 'ssid',
-                    Value: '',
-                    Options: {
-                        httpOnly: true,
-                        maxAge: 0,
-                        ...this.SessionCookieConfig,
-                    },
-                },
-            ],
-        };
-    }
-};
-__decorate([
-    AutoinjectService('rbac.session'),
-    __metadata("design:type", SessionProvider)
-], DefaultLogoutHandler.prototype, "SessionProvider", void 0);
-__decorate([
-    Config('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], DefaultLogoutHandler.prototype, "SessionCookieConfig", void 0);
-DefaultLogoutHandler = __decorate([
-    Injectable(LogoutHandler)
-], DefaultLogoutHandler);
-export { DefaultLogoutHandler };
-//# sourceMappingURL=DefaultLogoutHandler.js.map

package/lib/mjs/handlers/DefaultLogoutHandler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,aAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IA+BxB,CAAC;IAvBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE;wBACP,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,CAAC;wBACT,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA5BW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACN,eAAe;6DAAC;AAGlC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACsB;AAP7C,oBAAoB;IADhC,UAAU,CAAC,aAAa,CAAC;GACb,oBAAoB,CAgChC"}

package/lib/mjs/handlers/ImpersonationLogoutHandler.d.ts

@@ -1,18 +0,0 @@
-import { SessionProvider, User } from '@spinajs/rbac';
-import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
-/**
- * Logout handler that detects an active impersonation and reverts it instead
- * of destroying the session. Runs early (priority 10) so it short-circuits
- * the default session-deletion handler when applicable.
- */
-export declare class ImpersonationLogoutHandler extends LogoutHandler {
-    Priority: number;
-    protected SessionProvider: SessionProvider;
-    handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    protected emitEvent(original: User, target: User): Promise<void>;
-}
-//# sourceMappingURL=ImpersonationLogoutHandler.d.ts.map

package/lib/mjs/handlers/ImpersonationLogoutHandler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA0B,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAE/B,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0B3E;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}

package/lib/mjs/handlers/ImpersonationLogoutHandler.js

@@ -1,63 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Injectable } from '@spinajs/di';
-import { AutoinjectService } from '@spinajs/configuration';
-import { SessionProvider, User, UserImpersonationEnded } from '@spinajs/rbac';
-import { _ev } from '@spinajs/queue';
-import { LogoutHandler } from '../logout.js';
-/**
- * Logout handler that detects an active impersonation and reverts it instead
- * of destroying the session. Runs early (priority 10) so it short-circuits
- * the default session-deletion handler when applicable.
- */
-let ImpersonationLogoutHandler = class ImpersonationLogoutHandler extends LogoutHandler {
-    constructor() {
-        super(...arguments);
-        this.Priority = 10;
-    }
-    async handle(context) {
-        const session = context.Session;
-        if (!session)
-            return null;
-        const impersonatorUuid = session.Data.get('Impersonator');
-        if (!impersonatorUuid)
-            return null;
-        const original = await User.getByUuid(impersonatorUuid);
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
-        }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(original, context.User);
-        // Take ownership of the response: no cookie change — the original user's
-        // session continues.
-        return { Body: { ImpersonationEnded: true } };
-    }
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    emitEvent(original, target) {
-        return _ev(new UserImpersonationEnded(original, target))();
-    }
-};
-__decorate([
-    AutoinjectService('rbac.session'),
-    __metadata("design:type", SessionProvider)
-], ImpersonationLogoutHandler.prototype, "SessionProvider", void 0);
-ImpersonationLogoutHandler = __decorate([
-    Injectable(LogoutHandler)
-], ImpersonationLogoutHandler);
-export { ImpersonationLogoutHandler };
-//# sourceMappingURL=ImpersonationLogoutHandler.js.map

package/lib/mjs/handlers/ImpersonationLogoutHandler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,aAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAsCvB,CAAC;IAjCQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAExD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,yEAAyE;QACzE,qBAAqB;QACrB,OAAO,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,GAAG,CAAC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AAnCW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACN,eAAe;mEAAC;AAJjC,0BAA0B;IADtC,UAAU,CAAC,aAAa,CAAC;GACb,0BAA0B,CAuCtC"}

package/lib/mjs/logout.d.ts

@@ -1,51 +0,0 @@
-import type { ISession, User } from '@spinajs/rbac';
-/**
- * Per-request context handed to each {@link LogoutHandler} during logout.
- * The session may be null when the caller has no active session — handlers
- * should treat that as a no-op.
- */
-export interface ILogoutContext {
-    /** Raw signed session cookie value (already unsigned by the framework) */
-    Ssid: string;
-    /** Restored session, or null when none is active */
-    Session: ISession | null;
-    /** Logged-in user as resolved by RbacMiddleware */
-    User: User;
-}
-/** Cookie operation a handler may attach to its response */
-export interface ILogoutCookie {
-    Name: string;
-    Value: string;
-    Options: Record<string, unknown>;
-}
-/** Response payload a handler returns when it takes ownership of the logout */
-export interface ILogoutResult {
-    /** Response body */
-    Body?: unknown;
-    /** Cookie operations to attach */
-    Cookies?: ILogoutCookie[];
-}
-/**
- * Pluggable logout step. Handlers are resolved via `DI.resolve(Array.ofType(LogoutHandler))`
- * by the logout controller and executed in ascending Priority order. The first
- * handler that returns a non-null result takes ownership of the response — the
- * chain stops there. Returning null defers to the next handler.
- *
- * Built-ins:
- *  - {@link ImpersonationLogoutHandler} (priority 10) — when an impersonation
- *    is active, revert it and keep the session alive.
- *  - {@link DefaultLogoutHandler} (priority 999) — destroy the session and
- *    clear the ssid cookie.
- *
- * Register custom handlers with @Injectable(LogoutHandler). Choose a Priority
- * lower than 999 to run before the default session destruction.
- */
-export declare abstract class LogoutHandler {
-    /**
-     * Lower runs first. Default 100. The default cleanup handler runs at 999;
-     * pick a value below that to run before it.
-     */
-    Priority: number;
-    abstract handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-}
-//# sourceMappingURL=logout.d.ts.map