@spinajs/rbac-http-user 2.0.480 → 2.0.482
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/controllers/ActiveRoleController.d.ts +1 -0
- package/lib/cjs/controllers/ActiveRoleController.d.ts.map +1 -1
- package/lib/cjs/controllers/ActiveRoleController.js +21 -2
- package/lib/cjs/controllers/ActiveRoleController.js.map +1 -1
- package/lib/cjs/controllers/LoginController.d.ts +1 -1
- package/lib/cjs/controllers/LoginController.d.ts.map +1 -1
- package/lib/cjs/controllers/LoginController.js +17 -23
- package/lib/cjs/controllers/LoginController.js.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts +7 -0
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.js +36 -5
- package/lib/cjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/cjs/controllers/UserController.d.ts.map +1 -1
- package/lib/cjs/controllers/UserController.js +5 -1
- package/lib/cjs/controllers/UserController.js.map +1 -1
- package/lib/cjs/controllers/UserMetadataController.d.ts +5 -5
- package/lib/cjs/controllers/UserMetadataController.d.ts.map +1 -1
- package/lib/cjs/controllers/UserMetadataController.js +44 -20
- package/lib/cjs/controllers/UserMetadataController.js.map +1 -1
- package/lib/mjs/controllers/ActiveRoleController.d.ts +1 -0
- package/lib/mjs/controllers/ActiveRoleController.d.ts.map +1 -1
- package/lib/mjs/controllers/ActiveRoleController.js +22 -3
- package/lib/mjs/controllers/ActiveRoleController.js.map +1 -1
- package/lib/mjs/controllers/LoginController.d.ts +1 -1
- package/lib/mjs/controllers/LoginController.d.ts.map +1 -1
- package/lib/mjs/controllers/LoginController.js +18 -24
- package/lib/mjs/controllers/LoginController.js.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts +7 -0
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.js +38 -7
- package/lib/mjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/mjs/controllers/UserController.d.ts.map +1 -1
- package/lib/mjs/controllers/UserController.js +5 -1
- package/lib/mjs/controllers/UserController.js.map +1 -1
- package/lib/mjs/controllers/UserMetadataController.d.ts +5 -5
- package/lib/mjs/controllers/UserMetadataController.d.ts.map +1 -1
- package/lib/mjs/controllers/UserMetadataController.js +45 -21
- package/lib/mjs/controllers/UserMetadataController.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +19 -20
|
@@ -16,6 +16,7 @@ export declare class ActiveRoleController extends BaseController {
|
|
|
16
16
|
protected PasswordProvider: PasswordProvider;
|
|
17
17
|
protected SessionProvider: SessionProvider;
|
|
18
18
|
protected RolesRequiringPassword: string[];
|
|
19
|
+
protected SessionCookieConfig: any;
|
|
19
20
|
/**
|
|
20
21
|
* Get active role
|
|
21
22
|
* Returns the currently active role for the session and the RBAC grants
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,
|
|
1
|
+
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
|
|
@@ -77,8 +77,23 @@ let ActiveRoleController = class ActiveRoleController extends http_1.BaseControl
|
|
|
77
77
|
}
|
|
78
78
|
}
|
|
79
79
|
session.Data.set('ActiveRole', payload.Role);
|
|
80
|
-
|
|
81
|
-
|
|
80
|
+
// Privilege elevation — regenerate the session id to defend against session
|
|
81
|
+
// fixation, and reset the ssid cookie to the new id.
|
|
82
|
+
const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
|
|
83
|
+
return new http_1.Ok(this.buildResponse(payload.Role), {
|
|
84
|
+
Coockies: [
|
|
85
|
+
{
|
|
86
|
+
Name: 'ssid',
|
|
87
|
+
Value: regenerated.SessionId,
|
|
88
|
+
Options: {
|
|
89
|
+
signed: true,
|
|
90
|
+
httpOnly: true,
|
|
91
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
|
|
92
|
+
...this.SessionCookieConfig,
|
|
93
|
+
},
|
|
94
|
+
},
|
|
95
|
+
],
|
|
96
|
+
});
|
|
82
97
|
}
|
|
83
98
|
buildResponse(activeRole) {
|
|
84
99
|
const grants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
|
|
@@ -109,6 +124,10 @@ __decorate([
|
|
|
109
124
|
(0, configuration_1.Config)('rbac.roleSwitch.requirePassword', { defaultValue: [] }),
|
|
110
125
|
__metadata("design:type", Array)
|
|
111
126
|
], ActiveRoleController.prototype, "RolesRequiringPassword", void 0);
|
|
127
|
+
__decorate([
|
|
128
|
+
(0, configuration_1.Config)('rbac.session.cookie', {}),
|
|
129
|
+
__metadata("design:type", Object)
|
|
130
|
+
], ActiveRoleController.prototype, "SessionCookieConfig", void 0);
|
|
112
131
|
__decorate([
|
|
113
132
|
(0, http_1.Get)('active-role'),
|
|
114
133
|
(0, http_1.Policy)(rbac_http_1.LoggedPolicy),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,
|
|
1
|
+
{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,wCAAsJ;AAEtJ,oCAAyC;AACzC,0DAAmE;AACnE,kDAAsI;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAc;IAmBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;oBAC5B,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;wBACxC,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AA7GY,oDAAoB;AAErB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;gDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;0DAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;8DAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;6DAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACC;AAYtB;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IACO,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;uDAAU,iCAAa;;4DAoD/B;+BApGU,oBAAoB;IADhC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,oBAAoB,CA6GhC"}
|
|
@@ -15,7 +15,6 @@ export declare class LoginController extends BaseController {
|
|
|
15
15
|
protected Configuration: Configuration;
|
|
16
16
|
protected AuthProvider: AuthProvider;
|
|
17
17
|
protected SessionProvider: SessionProvider;
|
|
18
|
-
protected SessionExpirationTime: number;
|
|
19
18
|
protected TwoFactorAuthEnabled: boolean;
|
|
20
19
|
protected TwoFactorAuthForceUser: boolean;
|
|
21
20
|
protected SessionCookieConfig: any;
|
|
@@ -66,6 +65,7 @@ export declare class LoginController extends BaseController {
|
|
|
66
65
|
IsGuest: boolean;
|
|
67
66
|
IsBanned: boolean;
|
|
68
67
|
IsDirty: boolean;
|
|
68
|
+
Snapshot: import("@spinajs/orm").IModelSnapshot | null;
|
|
69
69
|
Metadata: Omit<import("@spinajs/orm").ModelDataWithRelationData<import("@spinajs/rbac").UserMetadataBase>, import("@spinajs/orm").ExcludedModelProperties>[];
|
|
70
70
|
PrimaryKeyValue: any;
|
|
71
71
|
}>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,
|
|
1
|
+
{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAAsC,MAAM,eAAe,CAAC;AAErI,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA+E,cAAc,EAAwC,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAgB,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IA8G3J;;;;;;;;OAQG;IAGU,MAAM,CAAe,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IA6BhH;;;;;;;;OAQG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;CAOlF"}
|
|
@@ -47,21 +47,6 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
47
47
|
}
|
|
48
48
|
const user = await (0, rbac_1.login)(credentials.Email, credentials.Password);
|
|
49
49
|
const session = new rbac_1.UserSession();
|
|
50
|
-
const coockies = [
|
|
51
|
-
{
|
|
52
|
-
Name: 'ssid',
|
|
53
|
-
Value: session.SessionId,
|
|
54
|
-
Options: {
|
|
55
|
-
signed: true,
|
|
56
|
-
httpOnly: true,
|
|
57
|
-
// set expiration time in ms
|
|
58
|
-
maxAge: this.SessionExpirationTime * 1000,
|
|
59
|
-
// any optopnal cookie options
|
|
60
|
-
// or override default ones
|
|
61
|
-
...this.SessionCookieConfig
|
|
62
|
-
},
|
|
63
|
-
},
|
|
64
|
-
];
|
|
65
50
|
let result;
|
|
66
51
|
session.Data.set('User', user.Uuid);
|
|
67
52
|
// Default active role = first role from the user's role list.
|
|
@@ -76,8 +61,6 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
76
61
|
// user is automatically authorized at login
|
|
77
62
|
session.Data.set('Logged', true);
|
|
78
63
|
session.UserId = user.Id;
|
|
79
|
-
// set expiration time ( default val in config )
|
|
80
|
-
session.extend();
|
|
81
64
|
if (this.TwoFactorAuthForceUser && !user.Metadata['2fa:enabled']) {
|
|
82
65
|
this._log.trace('User logged in, 2fa init required', {
|
|
83
66
|
Uuid: user.Uuid
|
|
@@ -110,7 +93,24 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
110
93
|
this._log.trace('User logged in, no 2fa required', {
|
|
111
94
|
Uuid: user.Uuid
|
|
112
95
|
});
|
|
96
|
+
// save() schedules the session's initial expiration via the configured
|
|
97
|
+
// strategy; the cookie maxAge is then derived from that real expiry (B1),
|
|
98
|
+
// no longer the bogus `expiration * 1000` (~2 min) value.
|
|
113
99
|
await this.SessionProvider.save(session);
|
|
100
|
+
const coockies = [
|
|
101
|
+
{
|
|
102
|
+
Name: 'ssid',
|
|
103
|
+
Value: session.SessionId,
|
|
104
|
+
Options: {
|
|
105
|
+
signed: true,
|
|
106
|
+
httpOnly: true,
|
|
107
|
+
// cookie lifetime tracks the session's real expiration
|
|
108
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(session),
|
|
109
|
+
// any optional cookie options / override default ones
|
|
110
|
+
...this.SessionCookieConfig
|
|
111
|
+
},
|
|
112
|
+
},
|
|
113
|
+
];
|
|
114
114
|
return new http_1.Ok(result, {
|
|
115
115
|
Coockies: coockies
|
|
116
116
|
});
|
|
@@ -188,12 +188,6 @@ __decorate([
|
|
|
188
188
|
(0, configuration_1.AutoinjectService)('rbac.session'),
|
|
189
189
|
__metadata("design:type", rbac_1.SessionProvider)
|
|
190
190
|
], LoginController.prototype, "SessionProvider", void 0);
|
|
191
|
-
__decorate([
|
|
192
|
-
(0, configuration_1.Config)('rbac.session.expiration', {
|
|
193
|
-
defaultValue: 120,
|
|
194
|
-
}),
|
|
195
|
-
__metadata("design:type", Number)
|
|
196
|
-
], LoginController.prototype, "SessionExpirationTime", void 0);
|
|
197
191
|
__decorate([
|
|
198
192
|
(0, configuration_1.Config)('rbac.twoFactorAuth.enabled', {
|
|
199
193
|
defaultValue: false,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAA4G;AAC5G,
|
|
1
|
+
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAA4G;AAC5G,wCAAqI;AACrI,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAuK;AACvK,wCAAqC;AAErC,4CAA6D;AAG7D;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAgB,IAAY,EAAU,WAAyB;QAC5G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3E,qFAAqF;gBACrF,iFAAiF;gBACjF,MAAM,GAAG;oBACP,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,yFAAyF;oBAC1G,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,cAAc;iBACO,CAAC;YAClC,CAAC;YAGD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,OAAO,CAAC,SAAS;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBAEd,uDAAuD;wBACvD,MAAM,EAAE,IAAA,0BAAmB,EAAC,OAAO,CAAC;wBAEpC,sDAAsD;wBACtD,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF,CAAC;YAEF,OAAO,IAAI,SAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErB,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAe,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,SAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB;QAE/E,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/MY,0CAAe;AAEhB;IADT,IAAA,eAAU,GAAE;8BACY,6BAAa;sDAAC;AAG7B;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;qDAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;wDAAC;AAKjC;IAHT,IAAA,sBAAM,EAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,IAAA,sBAAM,EAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;4DACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;2CAAC;AAcf;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,+BAAmB,GAAE;IACF,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAgB,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzC,WAAI,UAAmD,+BAAY;;4CA4G7G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,mBAAe,GAAE,CAAA;IAAqB,WAAA,IAAA,gBAAY,GAAE,CAAA;;qDAAO,WAAI;;6CA2B/G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;qCAApB,WAAI;;6CAM7C;0BA9MU,eAAe;IAD3B,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,eAAe,CA+M3B"}
|
|
@@ -14,6 +14,7 @@ import { IEnable2faResponse, IUserWithGrants } from "@spinajs/rbac-http";
|
|
|
14
14
|
export declare class TwoFactorAuthController extends BaseController {
|
|
15
15
|
protected Queue: QueueService;
|
|
16
16
|
protected SessionProvider: SessionProvider;
|
|
17
|
+
protected SessionCookieConfig: any;
|
|
17
18
|
protected AC: AccessControl;
|
|
18
19
|
/**
|
|
19
20
|
* Enable two-factor authentication
|
|
@@ -45,5 +46,11 @@ export declare class TwoFactorAuthController extends BaseController {
|
|
|
45
46
|
* @response 401 Unauthorized — valid session required
|
|
46
47
|
*/
|
|
47
48
|
verifyToken(logged: UserModel, token: TokenDto, session: ISession): Promise<Ok<IUserWithGrants> | ForbiddenResponse>;
|
|
49
|
+
/**
|
|
50
|
+
* Verifies the supplied TOTP token against the user's 2FA secret. Wraps the
|
|
51
|
+
* module-level `auth2Fa` action in a protected method so tests can stub the
|
|
52
|
+
* verification without a TOTP/DB setup.
|
|
53
|
+
*/
|
|
54
|
+
protected verifyTwoFactorToken(user: UserModel, token: string): Promise<void>;
|
|
48
55
|
}
|
|
49
56
|
//# sourceMappingURL=TwoFactorAuthController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAA0C,MAAM,eAAe,CAAC;AAO3K,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAgE5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhF"}
|
|
@@ -80,23 +80,42 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
80
80
|
*/
|
|
81
81
|
async verifyToken(logged, token, session) {
|
|
82
82
|
try {
|
|
83
|
-
await
|
|
83
|
+
await this.verifyTwoFactorToken(logged, token.Token);
|
|
84
84
|
// 2fa complete, mark as authorized
|
|
85
85
|
// fron now on user is considered authorized
|
|
86
86
|
session.Data.set('Authorized', true);
|
|
87
87
|
session.Data.delete('TwoFactorAuth');
|
|
88
|
-
|
|
88
|
+
// Privilege elevation (login -> authorized) — regenerate the session
|
|
89
|
+
// id to defend against session fixation and reset the ssid cookie.
|
|
90
|
+
const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
|
|
89
91
|
this._log.trace('User logged in, 2fa authorized', {
|
|
90
92
|
Uuid: logged.Uuid
|
|
91
93
|
});
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
94
|
+
// Mirror the login response shape: resolve grants for the session's
|
|
95
|
+
// active role (falling back to the first role) and include ActiveRole,
|
|
96
|
+
// instead of flattening every role with no ActiveRole reported.
|
|
97
|
+
const activeRole = session.Data.get('ActiveRole') ?? logged.Role?.[0];
|
|
98
|
+
const combinedGrants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
|
|
95
99
|
return new http_1.Ok({
|
|
96
100
|
...logged.dehydrateWithRelations({
|
|
97
101
|
dateTimeFormat: "iso"
|
|
98
102
|
}),
|
|
103
|
+
Role: logged.Role,
|
|
104
|
+
ActiveRole: activeRole,
|
|
99
105
|
Grants: combinedGrants,
|
|
106
|
+
}, {
|
|
107
|
+
Coockies: [
|
|
108
|
+
{
|
|
109
|
+
Name: 'ssid',
|
|
110
|
+
Value: regenerated.SessionId,
|
|
111
|
+
Options: {
|
|
112
|
+
signed: true,
|
|
113
|
+
httpOnly: true,
|
|
114
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
|
|
115
|
+
...this.SessionCookieConfig,
|
|
116
|
+
},
|
|
117
|
+
},
|
|
118
|
+
],
|
|
100
119
|
});
|
|
101
120
|
}
|
|
102
121
|
catch (err) {
|
|
@@ -114,6 +133,14 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
114
133
|
});
|
|
115
134
|
}
|
|
116
135
|
}
|
|
136
|
+
/**
|
|
137
|
+
* Verifies the supplied TOTP token against the user's 2FA secret. Wraps the
|
|
138
|
+
* module-level `auth2Fa` action in a protected method so tests can stub the
|
|
139
|
+
* verification without a TOTP/DB setup.
|
|
140
|
+
*/
|
|
141
|
+
verifyTwoFactorToken(user, token) {
|
|
142
|
+
return (0, _2fa_js_1.auth2Fa)(user, token);
|
|
143
|
+
}
|
|
117
144
|
};
|
|
118
145
|
exports.TwoFactorAuthController = TwoFactorAuthController;
|
|
119
146
|
__decorate([
|
|
@@ -124,6 +151,10 @@ __decorate([
|
|
|
124
151
|
(0, configuration_1.AutoinjectService)('rbac.session'),
|
|
125
152
|
__metadata("design:type", rbac_1.SessionProvider)
|
|
126
153
|
], TwoFactorAuthController.prototype, "SessionProvider", void 0);
|
|
154
|
+
__decorate([
|
|
155
|
+
(0, configuration_1.Config)('rbac.session.cookie', {}),
|
|
156
|
+
__metadata("design:type", Object)
|
|
157
|
+
], TwoFactorAuthController.prototype, "SessionCookieConfig", void 0);
|
|
127
158
|
__decorate([
|
|
128
159
|
(0, di_1.Autoinject)(rbac_1.AccessControl),
|
|
129
160
|
__metadata("design:type", rbac_1.AccessControl)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAA2F;AAC3F,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAA2F;AAC3F,wCAA2K;AAC3K,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAA6E;AAC7E,oCAAyC;AACzC,0CAA8C;AAE9C,kDAAoG;AACpG,iDAA8D;AAC9D,+CAAkD;AAClD,oDAAuD;AAEvD;;;;;;;GAOG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAavD;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE1C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,SAAE,CAAC;YACV,GAAG,EAAE,MAAgB;SACxB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAA,wBAAc,EAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QAErG,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;YAGH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAExF,OAAO,IAAI,SAAE,CAAC;gBACV,GAAG,MAAM,CAAC,sBAAsB,CAAC;oBAC7B,cAAc,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,cAAc;aACK,EAAE;gBAC7B,QAAQ,EAAE;oBACN;wBACI,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;wBAC5B,OAAO,EAAE;4BACL,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;4BACxC,GAAG,IAAI,CAAC,mBAAmB;yBAC9B;qBACJ;iBACJ;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YAET,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,wBAAiB,CAAC;gBACzB,KAAK,EAAE;oBACH,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC9B;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QACzD,OAAO,IAAA,iBAAO,EAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAxIY,0DAAuB;AAEtB;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACR,oBAAY;sDAAC;AAGpB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;oEACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAYf;IADZ,IAAA,UAAG,EAAC,YAAY,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;wDAU7C;AAYY;IADZ,IAAA,UAAG,EAAC,aAAa,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;yDAO9C;AAYY;IADZ,IAAA,WAAI,EAAC,YAAY,CAAC;IACO,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAqB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAO,GAAE,CAAA;;qCAA9C,WAAS,EAAiB,uBAAQ;;0DA8D1E;kCA9HQ,uBAAuB;IAHnC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,kCAAkB,CAAC;IAC1B,IAAA,aAAM,EAAC,+BAAmB,CAAC;GACf,uBAAuB,CAwInC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;
|
|
1
|
+
{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;IAqBpE;;;;;;;;OAQG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAUxE;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW;CAkB3E"}
|
|
@@ -80,7 +80,11 @@ let UserController = class UserController extends http_1.BaseController {
|
|
|
80
80
|
if (sId) {
|
|
81
81
|
const session = await this.SessionProvider.restore(sId);
|
|
82
82
|
if (session) {
|
|
83
|
-
|
|
83
|
+
// Session stores the user UUID (see LoginController) — RbacUserFactory
|
|
84
|
+
// resolves the user from it on each request. Storing a dehydrated object
|
|
85
|
+
// here would break that lookup and log the user out on the next request.
|
|
86
|
+
session.Data.set('User', user.Uuid);
|
|
87
|
+
await this.SessionProvider.save(session);
|
|
84
88
|
}
|
|
85
89
|
}
|
|
86
90
|
return new http_1.Ok(user.dehydrate());
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAAqD;AACrD,wCAAkJ;AAClJ,wCAA+F;AAC/F,oDAAsD;AACtD,oCAAyC;AACzC,0DAAgD;AAChD,qDAAuC;AAEvC,kDAA8F;AAC9F,wCAAgD;AAIhD;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qBAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAY,IAAY;QAClE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,+BAA+B;QAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAAqD;AACrD,wCAAkJ;AAClJ,wCAA+F;AAC/F,oDAAsD;AACtD,oCAAyC;AACzC,0DAAgD;AAChD,qDAAuC;AAEvC,kDAA8F;AAC9F,wCAAgD;AAIhD;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qBAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAY,IAAY;QAClE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,+BAA+B;QAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,oBAAa,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;QAExD,OAAO,IAAI,SAAE,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAGD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAU,GAAgB;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAGD,OAAO,IAAI,SAAE,CACX,IAAA,aAAM,EACJ,IAAI,EACJ,IAAA,cAAO,EACL,IAAA,oBAAa,EAAC,GAAG,CAAC,WAAW,CAAC,EAC9B,IAAA,qBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE;YACH,MAAM,IAAI,4BAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC,CAAC,CACL,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA/FY,wCAAc;AAEf;IADT,IAAA,eAAU,GAAE;8BACe,uBAAgB;wDAAC;AAGnC;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;AAGjC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;0CAAC;AAaf;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,aAAM,GAAE,CAAA;;qCAApB,WAAS;;6CAmB3C;AAaY;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;+CAO7C;AAcY;IAFZ,IAAA,YAAK,EAAC,UAAU,CAAC;IACjB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAlB,WAAS,EAAe,6BAAW;;iDAiBzE;yBA9FU,cAAc;IAH1B,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,cAAc,CA+F1B"}
|
|
@@ -98,7 +98,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
98
98
|
* @response 401 Unauthorized — valid session required
|
|
99
99
|
* @response 403 Forbidden — readOwn permission required
|
|
100
100
|
*/
|
|
101
|
-
readMeta(pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): Promise<Ok<import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope>>;
|
|
101
|
+
readMeta(user: UserModel, pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): Promise<Ok<import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope>>;
|
|
102
102
|
/**
|
|
103
103
|
* Get own metadata entry by key
|
|
104
104
|
* Retrieves a single metadata entry by key for the authenticated user.
|
|
@@ -109,7 +109,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
109
109
|
* @response 403 Forbidden — readOwn permission required
|
|
110
110
|
* @response 404 Metadata key not found
|
|
111
111
|
*/
|
|
112
|
-
getMeta(key: string): Promise<Ok<UserMetadata>>;
|
|
112
|
+
getMeta(user: UserModel, key: string): Promise<Ok<UserMetadata>>;
|
|
113
113
|
/**
|
|
114
114
|
* Add or update own metadata
|
|
115
115
|
* Inserts a new metadata entry for the authenticated user, or updates it if the key already exists.
|
|
@@ -118,7 +118,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
118
118
|
* @response 401 Unauthorized — valid session required
|
|
119
119
|
* @response 403 Forbidden — updateOwn permission required
|
|
120
120
|
*/
|
|
121
|
-
addMetadata(metadata: UserMetadata): Promise<
|
|
121
|
+
addMetadata(user: UserModel, metadata: UserMetadata): Promise<Ok<any>>;
|
|
122
122
|
/**
|
|
123
123
|
* Update own metadata entry
|
|
124
124
|
* Updates Key, Value, and Type of an existing metadata entry identified by Id or Key.
|
|
@@ -130,7 +130,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
130
130
|
* @response 403 Forbidden — updateOwn permission required
|
|
131
131
|
* @response 404 Metadata entry not found
|
|
132
132
|
*/
|
|
133
|
-
updateMetadata(meta: string, data: UserMetadataDto): Promise<Ok<any>>;
|
|
133
|
+
updateMetadata(user: UserModel, meta: string, data: UserMetadataDto): Promise<Ok<any>>;
|
|
134
134
|
/**
|
|
135
135
|
* Delete own metadata entry
|
|
136
136
|
* Permanently removes a metadata entry by Id from the authenticated user's metadata.
|
|
@@ -141,6 +141,6 @@ export declare class UserMetadataController extends BaseController {
|
|
|
141
141
|
* @response 403 Forbidden — deleteOwn permission required
|
|
142
142
|
* @response 404 Metadata entry not found
|
|
143
143
|
*/
|
|
144
|
-
deleteMetadata(meta: number): Promise<Ok<any>>;
|
|
144
|
+
deleteMetadata(user: UserModel, meta: number): Promise<Ok<any>>;
|
|
145
145
|
}
|
|
146
146
|
//# sourceMappingURL=UserMetadataController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAGa,sBAAuB,SAAQ,cAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,YAAY,CACc,IAAI,EAAE,SAAS,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAY3B;;;;;;;;;;OAUG;IAGU,WAAW,CACe,IAAI,EAAE,SAAS,EACzC,GAAG,EAAE,MAAM;IAOxB;;;;;;;;;OASG;IAGU,eAAe,CACW,IAAI,EAAE,SAAS,EACvC,QAAQ,EAAE,YAAY;IAOrC;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAOxB,IAAI,EAAE,YAAY,EACc,KAAK,EAAE,SAAS,EAC3C,IAAI,EAAE,eAAe;IAUjC;;;;;;;;;;OAUG;IAGU,kBAAkB,CACQ,IAAI,EAAE,SAAS,EACzC,IAAI,EAAE,MAAM;IASzB;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,QAAQ,
|
|
1
|
+
{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAGa,sBAAuB,SAAQ,cAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,YAAY,CACc,IAAI,EAAE,SAAS,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAY3B;;;;;;;;;;OAUG;IAGU,WAAW,CACe,IAAI,EAAE,SAAS,EACzC,GAAG,EAAE,MAAM;IAOxB;;;;;;;;;OASG;IAGU,eAAe,CACW,IAAI,EAAE,SAAS,EACvC,QAAQ,EAAE,YAAY;IAOrC;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAOxB,IAAI,EAAE,YAAY,EACc,KAAK,EAAE,SAAS,EAC3C,IAAI,EAAE,eAAe;IAUjC;;;;;;;;;;OAUG;IAGU,kBAAkB,CACQ,IAAI,EAAE,SAAS,EACzC,IAAI,EAAE,MAAM;IASzB;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,QAAQ,CACT,IAAI,EAAE,SAAS,EACd,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAa3B;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAW,GAAG,EAAE,MAAM;IAOlE;;;;;;;OAOG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAa,QAAQ,EAAE,YAAY;IAQnF;;;;;;;;;;OAUG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,eAAe;IAkBzG;;;;;;;;;OASG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM;CAQ7E"}
|
|
@@ -144,8 +144,12 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
|
|
|
144
144
|
* @response 401 Unauthorized — valid session required
|
|
145
145
|
* @response 403 Forbidden — readOwn permission required
|
|
146
146
|
*/
|
|
147
|
-
async readMeta(pagination, order, filter) {
|
|
148
|
-
|
|
147
|
+
async readMeta(user, pagination, order, filter) {
|
|
148
|
+
// Explicit owner scoping: the rbac query middleware does not enforce
|
|
149
|
+
// ownership for the metadata model (queries resolve to the unsafe base
|
|
150
|
+
// model without an @OrmResource), so every own-route filters by the
|
|
151
|
+
// authenticated user's id directly.
|
|
152
|
+
return new http_1.Ok(FilterableUserMetadata_js_1.FilterableUserMetadata.select().where('user_id', user.Id).filter(filter?.filters ?? [], filter?.op)
|
|
149
153
|
.take(pagination?.limit ?? 0)
|
|
150
154
|
.skip((pagination?.limit ?? 0) * (pagination?.page ?? 0))
|
|
151
155
|
.order(order?.column ?? 'Id', order?.order ?? orm_1.SortOrder.DESC));
|
|
@@ -160,9 +164,10 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
|
|
|
160
164
|
* @response 403 Forbidden — readOwn permission required
|
|
161
165
|
* @response 404 Metadata key not found
|
|
162
166
|
*/
|
|
163
|
-
async getMeta(key) {
|
|
167
|
+
async getMeta(user, key) {
|
|
164
168
|
return new http_1.Ok(rbac_1.UserMetadata.where({
|
|
165
169
|
Key: key,
|
|
170
|
+
user_id: user.Id,
|
|
166
171
|
}).firstOrFail());
|
|
167
172
|
}
|
|
168
173
|
/**
|
|
@@ -173,8 +178,12 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
|
|
|
173
178
|
* @response 401 Unauthorized — valid session required
|
|
174
179
|
* @response 403 Forbidden — updateOwn permission required
|
|
175
180
|
*/
|
|
176
|
-
async addMetadata(metadata) {
|
|
181
|
+
async addMetadata(user, metadata) {
|
|
182
|
+
// force ownership to the authenticated user — never trust a user_id
|
|
183
|
+
// supplied in the request body
|
|
184
|
+
metadata.user_id = user.Id;
|
|
177
185
|
await metadata.insert(orm_1.InsertBehaviour.InsertOrUpdate);
|
|
186
|
+
return new http_1.Ok();
|
|
178
187
|
}
|
|
179
188
|
/**
|
|
180
189
|
* Update own metadata entry
|
|
@@ -187,12 +196,20 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
|
|
|
187
196
|
* @response 403 Forbidden — updateOwn permission required
|
|
188
197
|
* @response 404 Metadata entry not found
|
|
189
198
|
*/
|
|
190
|
-
async updateMetadata(meta, data) {
|
|
199
|
+
async updateMetadata(user, meta, data) {
|
|
200
|
+
// The Key/Id lookup is grouped and AND-ed with an explicit ownership
|
|
201
|
+
// filter. Without the grouping the flat "Key = ? OR Id = ? AND user_id = ?"
|
|
202
|
+
// binds as "Key = ? OR (Id = ? AND user_id = ?)", letting any user update
|
|
203
|
+
// another user's metadata by its Key. Scoping by user_id explicitly (not
|
|
204
|
+
// relying on the query middleware, which does not fire for this model)
|
|
205
|
+
// keeps the update owner-bound.
|
|
191
206
|
await rbac_1.UserMetadata.update({
|
|
192
207
|
Key: data.Key,
|
|
193
208
|
Value: data.Value,
|
|
194
209
|
Type: data.Type
|
|
195
|
-
}).where(
|
|
210
|
+
}).where(function () {
|
|
211
|
+
this.where("Key", meta).orWhere("Id", meta);
|
|
212
|
+
}).andWhere('user_id', user.Id);
|
|
196
213
|
return new http_1.Ok();
|
|
197
214
|
}
|
|
198
215
|
/**
|
|
@@ -205,9 +222,10 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
|
|
|
205
222
|
* @response 403 Forbidden — deleteOwn permission required
|
|
206
223
|
* @response 404 Metadata entry not found
|
|
207
224
|
*/
|
|
208
|
-
async deleteMetadata(meta) {
|
|
225
|
+
async deleteMetadata(user, meta) {
|
|
209
226
|
await rbac_1.UserMetadata.destroy().where({
|
|
210
|
-
Id: meta
|
|
227
|
+
Id: meta,
|
|
228
|
+
user_id: user.Id,
|
|
211
229
|
});
|
|
212
230
|
return new http_1.Ok();
|
|
213
231
|
}
|
|
@@ -275,45 +293,51 @@ __decorate([
|
|
|
275
293
|
__decorate([
|
|
276
294
|
(0, http_1.Get)("metadata"),
|
|
277
295
|
(0, rbac_http_1.Permission)(['readOwn']),
|
|
278
|
-
__param(0, (0,
|
|
296
|
+
__param(0, (0, rbac_http_1.User)()),
|
|
279
297
|
__param(1, (0, http_1.Query)()),
|
|
280
|
-
__param(2, (0,
|
|
298
|
+
__param(2, (0, http_1.Query)()),
|
|
299
|
+
__param(3, (0, orm_http_1.Filter)(FilterableUserMetadata_js_1.FilterableUserMetadata)),
|
|
281
300
|
__metadata("design:type", Function),
|
|
282
|
-
__metadata("design:paramtypes", [
|
|
301
|
+
__metadata("design:paramtypes", [rbac_1.User,
|
|
302
|
+
orm_http_1.PaginationDTO,
|
|
283
303
|
orm_http_1.OrderDTO, Object]),
|
|
284
304
|
__metadata("design:returntype", Promise)
|
|
285
305
|
], UserMetadataController.prototype, "readMeta", null);
|
|
286
306
|
__decorate([
|
|
287
307
|
(0, http_1.Get)("metadata/:key"),
|
|
288
308
|
(0, rbac_http_1.Permission)(['readOwn']),
|
|
289
|
-
__param(0, (0,
|
|
309
|
+
__param(0, (0, rbac_http_1.User)()),
|
|
310
|
+
__param(1, (0, http_1.Param)()),
|
|
290
311
|
__metadata("design:type", Function),
|
|
291
|
-
__metadata("design:paramtypes", [String]),
|
|
312
|
+
__metadata("design:paramtypes", [rbac_1.User, String]),
|
|
292
313
|
__metadata("design:returntype", Promise)
|
|
293
314
|
], UserMetadataController.prototype, "getMeta", null);
|
|
294
315
|
__decorate([
|
|
295
316
|
(0, http_1.Post)("metadata"),
|
|
296
317
|
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
297
|
-
__param(0, (0,
|
|
318
|
+
__param(0, (0, rbac_http_1.User)()),
|
|
319
|
+
__param(1, (0, orm_http_1.AsModel)()),
|
|
298
320
|
__metadata("design:type", Function),
|
|
299
|
-
__metadata("design:paramtypes", [rbac_1.UserMetadata]),
|
|
321
|
+
__metadata("design:paramtypes", [rbac_1.User, rbac_1.UserMetadata]),
|
|
300
322
|
__metadata("design:returntype", Promise)
|
|
301
323
|
], UserMetadataController.prototype, "addMetadata", null);
|
|
302
324
|
__decorate([
|
|
303
325
|
(0, http_1.Patch)('metadata/:meta'),
|
|
304
326
|
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
305
|
-
__param(0, (0,
|
|
306
|
-
__param(1, (0, http_1.
|
|
327
|
+
__param(0, (0, rbac_http_1.User)()),
|
|
328
|
+
__param(1, (0, http_1.Param)()),
|
|
329
|
+
__param(2, (0, http_1.Body)()),
|
|
307
330
|
__metadata("design:type", Function),
|
|
308
|
-
__metadata("design:paramtypes", [String, metadata_dto_js_1.UserMetadataDto]),
|
|
331
|
+
__metadata("design:paramtypes", [rbac_1.User, String, metadata_dto_js_1.UserMetadataDto]),
|
|
309
332
|
__metadata("design:returntype", Promise)
|
|
310
333
|
], UserMetadataController.prototype, "updateMetadata", null);
|
|
311
334
|
__decorate([
|
|
312
335
|
(0, http_1.Del)('metadata/:meta'),
|
|
313
336
|
(0, rbac_http_1.Permission)(['deleteOwn']),
|
|
314
|
-
__param(0, (0,
|
|
337
|
+
__param(0, (0, rbac_http_1.User)()),
|
|
338
|
+
__param(1, (0, http_1.Param)()),
|
|
315
339
|
__metadata("design:type", Function),
|
|
316
|
-
__metadata("design:paramtypes", [Number]),
|
|
340
|
+
__metadata("design:paramtypes", [rbac_1.User, Number]),
|
|
317
341
|
__metadata("design:returntype", Promise)
|
|
318
342
|
], UserMetadataController.prototype, "deleteMetadata", null);
|
|
319
343
|
exports.UserMetadataController = UserMetadataController = __decorate([
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAgH;AAChH,wCAAgE;AAChE,
|
|
1
|
+
{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAgH;AAChH,wCAAgE;AAChE,kDAAkF;AAClF,gDAAwG;AACxG,4DAAyD;AACzD,sCAA0D;AAC1D,mFAA6E;AAE7E;;;;;;GAMG;AAII,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,qBAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,YAAY,CACc,IAAe,EACzC,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACvC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;aAC5B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,WAAW,CACe,IAAe,EACzC,GAAW;QACpB,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CACW,IAAe,EACvC,QAAsB;QAEjC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CAOxB,IAAkB,EACc,KAAgB,EAC3C,IAAqB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAA;QAEF,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CACQ,IAAe,EACzC,IAAY;QACrB,MAAM,mBAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;YAC/B,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;QAEH,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACT,IAAe,EACd,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oCAAoC;QACpC,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aAC5G,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;aAC5B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAW,GAAW;QAC9D,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAa,QAAsB;QAC/E,oEAAoE;QACpE,+BAA+B;QAC/B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY,EAAU,IAAqB;QACrG,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,mBAAY,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC,KAAK,CAAC;YACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY;QACtE,MAAM,mBAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;YAC/B,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;QAEH,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;CACJ,CAAA;AA9QY,wDAAsB;AAkBlB;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAHU,WAAS;QAC5B,wBAAa;QAClB,mBAAQ;;0DAW5B;AAgBY;IAFZ,IAAA,UAAG,EAAC,qBAAqB,CAAC;IAC1B,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;yDAMrD;AAcY;IAFZ,IAAA,WAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAD+B,WAAS;QAC7B,mBAAY;;6DAKpC;AAgBY;IAFZ,IAAA,YAAK,EAAC,uBAAuB,CAAC;IAC9B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC;QACP,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC,CAAC;KACL,CAAC,CAAA;IACD,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAFE,mBAAY;QACqB,WAAS;QACrC,iCAAe;;gEAQhC;AAeY;IAFZ,IAAA,UAAG,EAAC,sBAAsB,CAAC;IAC3B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;gEAQrD;AA+BY;IAFZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,gBAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAHjB,WAAS;QACD,wBAAa;QAClB,mBAAQ;;sDAa5B;AAcY;IAFZ,IAAA,UAAG,EAAC,eAAe,CAAC;IACpB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;qDAK3C;AAYY;IAFZ,IAAA,WAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAArB,WAAS,EAAuB,mBAAY;;yDAMlF;AAeY;IAFZ,IAAA,YAAK,EAAC,gBAAgB,CAAC;IACvB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzC,WAAS,UAAuC,iCAAe;;4DAgBxG;AAcY;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;4DAOlD;iCA7QQ,sBAAsB;IAHlC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,eAAe,CAAC;IACzB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,sBAAsB,CA8QlC"}
|
|
@@ -16,6 +16,7 @@ export declare class ActiveRoleController extends BaseController {
|
|
|
16
16
|
protected PasswordProvider: PasswordProvider;
|
|
17
17
|
protected SessionProvider: SessionProvider;
|
|
18
18
|
protected RolesRequiringPassword: string[];
|
|
19
|
+
protected SessionCookieConfig: any;
|
|
19
20
|
/**
|
|
20
21
|
* Get active role
|
|
21
22
|
* Returns the currently active role for the session and the RBAC grants
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,
|
|
1
|
+
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
|