@spinajs/rbac-http-user 2.0.481 → 2.0.484
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/actions/2fa.d.ts +6 -0
- package/lib/cjs/actions/2fa.d.ts.map +1 -1
- package/lib/cjs/actions/2fa.js +18 -4
- package/lib/cjs/actions/2fa.js.map +1 -1
- package/lib/cjs/controllers/ActiveRoleController.d.ts +1 -0
- package/lib/cjs/controllers/ActiveRoleController.d.ts.map +1 -1
- package/lib/cjs/controllers/ActiveRoleController.js +21 -2
- package/lib/cjs/controllers/ActiveRoleController.js.map +1 -1
- package/lib/cjs/controllers/LoginController.d.ts +1 -1
- package/lib/cjs/controllers/LoginController.d.ts.map +1 -1
- package/lib/cjs/controllers/LoginController.js +32 -24
- package/lib/cjs/controllers/LoginController.js.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts +7 -0
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.js +36 -5
- package/lib/cjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/cjs/controllers/UserController.d.ts.map +1 -1
- package/lib/cjs/controllers/UserController.js +5 -1
- package/lib/cjs/controllers/UserController.js.map +1 -1
- package/lib/cjs/controllers/UserMetadataController.d.ts +5 -5
- package/lib/cjs/controllers/UserMetadataController.d.ts.map +1 -1
- package/lib/cjs/controllers/UserMetadataController.js +59 -30
- package/lib/cjs/controllers/UserMetadataController.js.map +1 -1
- package/lib/cjs/models/FilterableUserMetadata.d.ts +1 -0
- package/lib/cjs/models/FilterableUserMetadata.d.ts.map +1 -1
- package/lib/cjs/models/FilterableUserMetadata.js +8 -1
- package/lib/cjs/models/FilterableUserMetadata.js.map +1 -1
- package/lib/mjs/actions/2fa.d.ts +6 -0
- package/lib/mjs/actions/2fa.d.ts.map +1 -1
- package/lib/mjs/actions/2fa.js +18 -4
- package/lib/mjs/actions/2fa.js.map +1 -1
- package/lib/mjs/controllers/ActiveRoleController.d.ts +1 -0
- package/lib/mjs/controllers/ActiveRoleController.d.ts.map +1 -1
- package/lib/mjs/controllers/ActiveRoleController.js +22 -3
- package/lib/mjs/controllers/ActiveRoleController.js.map +1 -1
- package/lib/mjs/controllers/LoginController.d.ts +1 -1
- package/lib/mjs/controllers/LoginController.d.ts.map +1 -1
- package/lib/mjs/controllers/LoginController.js +33 -25
- package/lib/mjs/controllers/LoginController.js.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts +7 -0
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.js +38 -7
- package/lib/mjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/mjs/controllers/UserController.d.ts.map +1 -1
- package/lib/mjs/controllers/UserController.js +5 -1
- package/lib/mjs/controllers/UserController.js.map +1 -1
- package/lib/mjs/controllers/UserMetadataController.d.ts +5 -5
- package/lib/mjs/controllers/UserMetadataController.d.ts.map +1 -1
- package/lib/mjs/controllers/UserMetadataController.js +60 -31
- package/lib/mjs/controllers/UserMetadataController.js.map +1 -1
- package/lib/mjs/models/FilterableUserMetadata.d.ts +1 -0
- package/lib/mjs/models/FilterableUserMetadata.d.ts.map +1 -1
- package/lib/mjs/models/FilterableUserMetadata.js +8 -1
- package/lib/mjs/models/FilterableUserMetadata.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +19 -20
package/lib/cjs/actions/2fa.d.ts
CHANGED
|
@@ -1,4 +1,10 @@
|
|
|
1
1
|
import { User } from '@spinajs/rbac';
|
|
2
|
+
/**
|
|
3
|
+
* NOTE for all three actions below: the event must be emitted for the USER, not
|
|
4
|
+
* for whatever the provider call returned ( `initialize()` returns the otpauth
|
|
5
|
+
* url ). `_user_ev` reads `Uuid` off its argument, so it is bound to `u`
|
|
6
|
+
* explicitly and the provider result is passed through untouched.
|
|
7
|
+
*/
|
|
2
8
|
export declare function enableUser2Fa(identifier: number | string | User): Promise<unknown>;
|
|
3
9
|
export declare function disableUser2Fa(identifier: number | string | User): Promise<unknown>;
|
|
4
10
|
export declare function resetUser2Fa(identifier: number | string | User): Promise<unknown>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"2fa.d.ts","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAyD,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"2fa.d.ts","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAyD,MAAM,eAAe,CAAC;AAa5F;;;;;GAKG;AAEH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAYrE;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAWtE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAiBpE;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,oBA8B9E"}
|
package/lib/cjs/actions/2fa.js
CHANGED
|
@@ -13,20 +13,34 @@ const User2FaPassed_js_1 = require("../events/User2FaPassed.js");
|
|
|
13
13
|
const User2FaEnabled_js_1 = require("../events/User2FaEnabled.js");
|
|
14
14
|
const rbac_http_1 = require("@spinajs/rbac-http");
|
|
15
15
|
const User2FaReset_js_1 = require("../events/User2FaReset.js");
|
|
16
|
+
const User2FaDisabled_js_1 = require("../events/User2FaDisabled.js");
|
|
17
|
+
/**
|
|
18
|
+
* NOTE for all three actions below: the event must be emitted for the USER, not
|
|
19
|
+
* for whatever the provider call returned ( `initialize()` returns the otpauth
|
|
20
|
+
* url ). `_user_ev` reads `Uuid` off its argument, so it is bound to `u`
|
|
21
|
+
* explicitly and the provider result is passed through untouched.
|
|
22
|
+
*/
|
|
16
23
|
async function enableUser2Fa(identifier) {
|
|
17
24
|
return (0, util_1._chain)((0, rbac_1._user_unsafe)(identifier), (u) => {
|
|
18
|
-
return (0, util_1._chain)((0, configuration_1._service)('rbac.twoFactorAuth', rbac_http_1.TwoFactorAuthProvider), async (twoFa) => twoFa.initialize(u),
|
|
25
|
+
return (0, util_1._chain)((0, configuration_1._service)('rbac.twoFactorAuth', rbac_http_1.TwoFactorAuthProvider), async (twoFa) => twoFa.initialize(u),
|
|
26
|
+
// keeps the otpauth url as the result of the action
|
|
27
|
+
(0, util_1._tap)(async () => (0, rbac_1._user_ev)(User2FaEnabled_js_1.User2FaEnabled)(u)));
|
|
19
28
|
});
|
|
20
29
|
}
|
|
21
30
|
async function disableUser2Fa(identifier) {
|
|
22
31
|
return (0, util_1._chain)((0, rbac_1._user_unsafe)(identifier), (u) => {
|
|
23
|
-
return (0, util_1._chain)((0, configuration_1._service)('rbac.twoFactorAuth', rbac_http_1.TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), (
|
|
32
|
+
return (0, util_1._chain)((0, configuration_1._service)('rbac.twoFactorAuth', rbac_http_1.TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), () => (0, rbac_1._user_ev)(User2FaDisabled_js_1.User2FaDisabled)(u));
|
|
24
33
|
});
|
|
25
34
|
}
|
|
26
35
|
async function resetUser2Fa(identifier) {
|
|
27
36
|
return (0, util_1._chain)((0, rbac_1._user_unsafe)(identifier), (u) => {
|
|
28
|
-
|
|
29
|
-
|
|
37
|
+
// NOTE: this used to read
|
|
38
|
+
// return _chain( ... ), _tap(_user_ev(User2FaReset));
|
|
39
|
+
// The comma operator threw the disabling chain away un-awaited and
|
|
40
|
+
// returned the _tap function itself, so `await resetUser2Fa(user)`
|
|
41
|
+
// resolved before ( or without ) the secrets being cleared and the
|
|
42
|
+
// User2FaReset event was never emitted.
|
|
43
|
+
return (0, util_1._chain)((0, configuration_1._service)('rbac.twoFactorAuth', rbac_http_1.TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), () => (0, rbac_1._user_ev)(User2FaReset_js_1.User2FaReset)(u));
|
|
30
44
|
});
|
|
31
45
|
}
|
|
32
46
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"2fa.js","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"2fa.js","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":";;AAoBA,sCAYC;AAED,wCAWC;AAED,oCAiBC;AAUD,0BA8BC;AAxGD,wCAA4F;AAC5F,wCAA6C;AAE7C,0DAAkD;AAClD,iCAAiC;AACjC,wCAAoH;AACpH,iEAA2D;AAC3D,mEAA6D;AAC7D,kDAA4D;AAC5D,+DAAyD;AACzD,qEAA+D;AAG/D;;;;;GAKG;AAEI,KAAK,UAAU,aAAa,CAAC,UAAkC;IAClE,OAAO,IAAA,aAAM,EACT,IAAA,mBAAY,EAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,IAAA,aAAM,EACT,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,iCAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3D,oDAAoD;QACpD,IAAA,WAAI,EAAC,KAAK,IAAI,EAAE,CAAC,IAAA,eAAQ,EAAC,kCAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,UAAkC;IACnE,OAAO,IAAA,aAAM,EACT,IAAA,mBAAY,EAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,IAAA,aAAM,EACT,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,iCAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EACxD,GAAG,EAAE,CAAC,IAAA,eAAQ,EAAC,oCAAe,CAAC,CAAC,CAAC,CAAC,CACrC,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,UAAkC;IACjE,OAAO,IAAA,aAAM,EACT,IAAA,mBAAY,EAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,0BAA0B;QAC1B,wDAAwD;QACxD,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,wCAAwC;QACxC,OAAO,IAAA,aAAM,EACT,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,iCAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EACxD,GAAG,EAAE,CAAC,IAAA,eAAQ,EAAC,8BAAY,CAAC,CAAC,CAAC,CAAC,CAClC,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,OAAO,CAAC,UAAkC,EAAE,KAAa;IAC3E,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,IAAA,aAAM,EACT,IAAA,mBAAY,EAAC,UAAU,CAAC,EACxB,IAAA,aAAM,EACF,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,IAAA,aAAM,EAAC,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,iCAAqB,CAAC,EAAE,IAAA,cAAO,EACxE,CAAC,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,EAC7D,GAAG,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,mBAAY,EAAC,EAAE,WAAW,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,IAAA,eAAQ,EAAC,gCAAa,CAAC,CAAC,EACvF,GAAG,EAAE;YACD,MAAM,IAAI,mBAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC,CACJ,CAAC,CAAA;IACN,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACb,OAAO,IAAA,aAAM,EACT,GAAG,EAAE,CAAC,CAAC;QAEP,6BAA6B;QAC7B,IAAA,eAAQ,EAAC,sBAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACD,MAAM,GAAG,CAAC;QACd,CAAC,CACJ,CAAC;IACN,CAAC,CACJ,CACJ,CAAC;AACN,CAAC"}
|
|
@@ -16,6 +16,7 @@ export declare class ActiveRoleController extends BaseController {
|
|
|
16
16
|
protected PasswordProvider: PasswordProvider;
|
|
17
17
|
protected SessionProvider: SessionProvider;
|
|
18
18
|
protected RolesRequiringPassword: string[];
|
|
19
|
+
protected SessionCookieConfig: any;
|
|
19
20
|
/**
|
|
20
21
|
* Get active role
|
|
21
22
|
* Returns the currently active role for the session and the RBAC grants
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,
|
|
1
|
+
{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
|
|
@@ -77,8 +77,23 @@ let ActiveRoleController = class ActiveRoleController extends http_1.BaseControl
|
|
|
77
77
|
}
|
|
78
78
|
}
|
|
79
79
|
session.Data.set('ActiveRole', payload.Role);
|
|
80
|
-
|
|
81
|
-
|
|
80
|
+
// Privilege elevation — regenerate the session id to defend against session
|
|
81
|
+
// fixation, and reset the ssid cookie to the new id.
|
|
82
|
+
const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
|
|
83
|
+
return new http_1.Ok(this.buildResponse(payload.Role), {
|
|
84
|
+
Coockies: [
|
|
85
|
+
{
|
|
86
|
+
Name: 'ssid',
|
|
87
|
+
Value: regenerated.SessionId,
|
|
88
|
+
Options: {
|
|
89
|
+
signed: true,
|
|
90
|
+
httpOnly: true,
|
|
91
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
|
|
92
|
+
...this.SessionCookieConfig,
|
|
93
|
+
},
|
|
94
|
+
},
|
|
95
|
+
],
|
|
96
|
+
});
|
|
82
97
|
}
|
|
83
98
|
buildResponse(activeRole) {
|
|
84
99
|
const grants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
|
|
@@ -109,6 +124,10 @@ __decorate([
|
|
|
109
124
|
(0, configuration_1.Config)('rbac.roleSwitch.requirePassword', { defaultValue: [] }),
|
|
110
125
|
__metadata("design:type", Array)
|
|
111
126
|
], ActiveRoleController.prototype, "RolesRequiringPassword", void 0);
|
|
127
|
+
__decorate([
|
|
128
|
+
(0, configuration_1.Config)('rbac.session.cookie', {}),
|
|
129
|
+
__metadata("design:type", Object)
|
|
130
|
+
], ActiveRoleController.prototype, "SessionCookieConfig", void 0);
|
|
112
131
|
__decorate([
|
|
113
132
|
(0, http_1.Get)('active-role'),
|
|
114
133
|
(0, http_1.Policy)(rbac_http_1.LoggedPolicy),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,
|
|
1
|
+
{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,wCAAsJ;AAEtJ,oCAAyC;AACzC,0DAAmE;AACnE,kDAAsI;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAc;IAmBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;oBAC5B,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;wBACxC,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AA7GY,oDAAoB;AAErB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;gDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;0DAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;8DAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;6DAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACC;AAYtB;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IACO,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;uDAAU,iCAAa;;4DAoD/B;+BApGU,oBAAoB;IADhC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,oBAAoB,CA6GhC"}
|
|
@@ -15,7 +15,6 @@ export declare class LoginController extends BaseController {
|
|
|
15
15
|
protected Configuration: Configuration;
|
|
16
16
|
protected AuthProvider: AuthProvider;
|
|
17
17
|
protected SessionProvider: SessionProvider;
|
|
18
|
-
protected SessionExpirationTime: number;
|
|
19
18
|
protected TwoFactorAuthEnabled: boolean;
|
|
20
19
|
protected TwoFactorAuthForceUser: boolean;
|
|
21
20
|
protected SessionCookieConfig: any;
|
|
@@ -66,6 +65,7 @@ export declare class LoginController extends BaseController {
|
|
|
66
65
|
IsGuest: boolean;
|
|
67
66
|
IsBanned: boolean;
|
|
68
67
|
IsDirty: boolean;
|
|
68
|
+
Snapshot: import("@spinajs/orm").IModelSnapshot | null;
|
|
69
69
|
Metadata: Omit<import("@spinajs/orm").ModelDataWithRelationData<import("@spinajs/rbac").UserMetadataBase>, import("@spinajs/orm").ExcludedModelProperties>[];
|
|
70
70
|
PrimaryKeyValue: any;
|
|
71
71
|
}>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,
|
|
1
|
+
{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAA+D,MAAM,eAAe,CAAC;AAG9J,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA+E,cAAc,EAAwC,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAgB,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IA8H3J;;;;;;;;OAQG;IAGU,MAAM,CAAe,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IA6BhH;;;;;;;;OAQG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;CAOlF"}
|
|
@@ -16,6 +16,7 @@ exports.LoginController = void 0;
|
|
|
16
16
|
const userLogin_dto_js_1 = require("../dto/userLogin-dto.js");
|
|
17
17
|
const http_1 = require("@spinajs/http");
|
|
18
18
|
const rbac_1 = require("@spinajs/rbac");
|
|
19
|
+
const exceptions_1 = require("@spinajs/exceptions");
|
|
19
20
|
const di_1 = require("@spinajs/di");
|
|
20
21
|
const configuration_1 = require("@spinajs/configuration");
|
|
21
22
|
const rbac_http_1 = require("@spinajs/rbac-http");
|
|
@@ -47,21 +48,6 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
47
48
|
}
|
|
48
49
|
const user = await (0, rbac_1.login)(credentials.Email, credentials.Password);
|
|
49
50
|
const session = new rbac_1.UserSession();
|
|
50
|
-
const coockies = [
|
|
51
|
-
{
|
|
52
|
-
Name: 'ssid',
|
|
53
|
-
Value: session.SessionId,
|
|
54
|
-
Options: {
|
|
55
|
-
signed: true,
|
|
56
|
-
httpOnly: true,
|
|
57
|
-
// set expiration time in ms
|
|
58
|
-
maxAge: this.SessionExpirationTime * 1000,
|
|
59
|
-
// any optopnal cookie options
|
|
60
|
-
// or override default ones
|
|
61
|
-
...this.SessionCookieConfig
|
|
62
|
-
},
|
|
63
|
-
},
|
|
64
|
-
];
|
|
65
51
|
let result;
|
|
66
52
|
session.Data.set('User', user.Uuid);
|
|
67
53
|
// Default active role = first role from the user's role list.
|
|
@@ -76,8 +62,6 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
76
62
|
// user is automatically authorized at login
|
|
77
63
|
session.Data.set('Logged', true);
|
|
78
64
|
session.UserId = user.Id;
|
|
79
|
-
// set expiration time ( default val in config )
|
|
80
|
-
session.extend();
|
|
81
65
|
if (this.TwoFactorAuthForceUser && !user.Metadata['2fa:enabled']) {
|
|
82
66
|
this._log.trace('User logged in, 2fa init required', {
|
|
83
67
|
Uuid: user.Uuid
|
|
@@ -110,13 +94,43 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
110
94
|
this._log.trace('User logged in, no 2fa required', {
|
|
111
95
|
Uuid: user.Uuid
|
|
112
96
|
});
|
|
97
|
+
// save() schedules the session's initial expiration via the configured
|
|
98
|
+
// strategy; the cookie maxAge is then derived from that real expiry (B1),
|
|
99
|
+
// no longer the bogus `expiration * 1000` (~2 min) value.
|
|
113
100
|
await this.SessionProvider.save(session);
|
|
101
|
+
const coockies = [
|
|
102
|
+
{
|
|
103
|
+
Name: 'ssid',
|
|
104
|
+
Value: session.SessionId,
|
|
105
|
+
Options: {
|
|
106
|
+
signed: true,
|
|
107
|
+
httpOnly: true,
|
|
108
|
+
// cookie lifetime tracks the session's real expiration
|
|
109
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(session),
|
|
110
|
+
// any optional cookie options / override default ones
|
|
111
|
+
...this.SessionCookieConfig
|
|
112
|
+
},
|
|
113
|
+
},
|
|
114
|
+
];
|
|
114
115
|
return new http_1.Ok(result, {
|
|
115
116
|
Coockies: coockies
|
|
116
117
|
});
|
|
117
118
|
}
|
|
118
119
|
catch (err) {
|
|
119
|
-
|
|
120
|
+
// Only real authentication failures map to 401. ErrorCode comes from the
|
|
121
|
+
// AuthProvider ( bad credentials / banned / inactive ), InvalidArgument
|
|
122
|
+
// from the `_check_arg` guards ( empty or malformed email / password ).
|
|
123
|
+
// Anything else — db down, session store failure, misconfiguration — was
|
|
124
|
+
// previously masked as "login or password incorrect", hiding real
|
|
125
|
+
// outages behind a 401. Those are rethrown so the http error handler
|
|
126
|
+
// maps them to a 500 and logs the full stack.
|
|
127
|
+
const isAuthFailure = err instanceof exceptions_1.ErrorCode || err instanceof exceptions_1.InvalidArgument;
|
|
128
|
+
if (!isAuthFailure) {
|
|
129
|
+
this._log.error(err, `Login failed unexpectedly for ${credentials?.Email}`);
|
|
130
|
+
throw err;
|
|
131
|
+
}
|
|
132
|
+
const reason = err instanceof exceptions_1.ErrorCode ? rbac_1.AthenticationErrorCodes[err.code] ?? err.code : 'E_INVALID_ARGUMENT';
|
|
133
|
+
this._log.warn(err, `Login failed for ${credentials?.Email}: ${reason}`);
|
|
120
134
|
return new http_1.Unauthorized({
|
|
121
135
|
error: {
|
|
122
136
|
code: 'E_AUTH_FAILED',
|
|
@@ -188,12 +202,6 @@ __decorate([
|
|
|
188
202
|
(0, configuration_1.AutoinjectService)('rbac.session'),
|
|
189
203
|
__metadata("design:type", rbac_1.SessionProvider)
|
|
190
204
|
], LoginController.prototype, "SessionProvider", void 0);
|
|
191
|
-
__decorate([
|
|
192
|
-
(0, configuration_1.Config)('rbac.session.expiration', {
|
|
193
|
-
defaultValue: 120,
|
|
194
|
-
}),
|
|
195
|
-
__metadata("design:type", Number)
|
|
196
|
-
], LoginController.prototype, "SessionExpirationTime", void 0);
|
|
197
205
|
__decorate([
|
|
198
206
|
(0, configuration_1.Config)('rbac.twoFactorAuth.enabled', {
|
|
199
207
|
defaultValue: false,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAA4G;AAC5G,
|
|
1
|
+
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAA4G;AAC5G,wCAA8J;AAC9J,oDAAiE;AACjE,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAuK;AACvK,wCAAqC;AAErC,4CAA6D;AAG7D;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAgB,IAAY,EAAU,WAAyB;QAC5G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3E,qFAAqF;gBACrF,iFAAiF;gBACjF,MAAM,GAAG;oBACP,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,yFAAyF;oBAC1G,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,cAAc;iBACO,CAAC;YAClC,CAAC;YAGD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,OAAO,CAAC,SAAS;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBAEd,uDAAuD;wBACvD,MAAM,EAAE,IAAA,0BAAmB,EAAC,OAAO,CAAC;wBAEpC,sDAAsD;wBACtD,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF,CAAC;YAEF,OAAO,IAAI,SAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,sBAAS,IAAI,GAAG,YAAY,4BAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAC,8BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAe,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,SAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB;QAE/E,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/NY,0CAAe;AAEhB;IADT,IAAA,eAAU,GAAE;8BACY,6BAAa;sDAAC;AAG7B;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;qDAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;wDAAC;AAKjC;IAHT,IAAA,sBAAM,EAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,IAAA,sBAAM,EAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;4DACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;2CAAC;AAcf;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,+BAAmB,GAAE;IACF,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAgB,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzC,WAAI,UAAmD,+BAAY;;4CA4H7G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,mBAAe,GAAE,CAAA;IAAqB,WAAA,IAAA,gBAAY,GAAE,CAAA;;qDAAO,WAAI;;6CA2B/G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;qCAApB,WAAI;;6CAM7C;0BA9NU,eAAe;IAD3B,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,eAAe,CA+N3B"}
|
|
@@ -14,6 +14,7 @@ import { IEnable2faResponse, IUserWithGrants } from "@spinajs/rbac-http";
|
|
|
14
14
|
export declare class TwoFactorAuthController extends BaseController {
|
|
15
15
|
protected Queue: QueueService;
|
|
16
16
|
protected SessionProvider: SessionProvider;
|
|
17
|
+
protected SessionCookieConfig: any;
|
|
17
18
|
protected AC: AccessControl;
|
|
18
19
|
/**
|
|
19
20
|
* Enable two-factor authentication
|
|
@@ -45,5 +46,11 @@ export declare class TwoFactorAuthController extends BaseController {
|
|
|
45
46
|
* @response 401 Unauthorized — valid session required
|
|
46
47
|
*/
|
|
47
48
|
verifyToken(logged: UserModel, token: TokenDto, session: ISession): Promise<Ok<IUserWithGrants> | ForbiddenResponse>;
|
|
49
|
+
/**
|
|
50
|
+
* Verifies the supplied TOTP token against the user's 2FA secret. Wraps the
|
|
51
|
+
* module-level `auth2Fa` action in a protected method so tests can stub the
|
|
52
|
+
* verification without a TOTP/DB setup.
|
|
53
|
+
*/
|
|
54
|
+
protected verifyTwoFactorToken(user: UserModel, token: string): Promise<void>;
|
|
48
55
|
}
|
|
49
56
|
//# sourceMappingURL=TwoFactorAuthController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAA0C,MAAM,eAAe,CAAC;AAO3K,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAgE5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhF"}
|
|
@@ -80,23 +80,42 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
80
80
|
*/
|
|
81
81
|
async verifyToken(logged, token, session) {
|
|
82
82
|
try {
|
|
83
|
-
await
|
|
83
|
+
await this.verifyTwoFactorToken(logged, token.Token);
|
|
84
84
|
// 2fa complete, mark as authorized
|
|
85
85
|
// fron now on user is considered authorized
|
|
86
86
|
session.Data.set('Authorized', true);
|
|
87
87
|
session.Data.delete('TwoFactorAuth');
|
|
88
|
-
|
|
88
|
+
// Privilege elevation (login -> authorized) — regenerate the session
|
|
89
|
+
// id to defend against session fixation and reset the ssid cookie.
|
|
90
|
+
const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
|
|
89
91
|
this._log.trace('User logged in, 2fa authorized', {
|
|
90
92
|
Uuid: logged.Uuid
|
|
91
93
|
});
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
94
|
+
// Mirror the login response shape: resolve grants for the session's
|
|
95
|
+
// active role (falling back to the first role) and include ActiveRole,
|
|
96
|
+
// instead of flattening every role with no ActiveRole reported.
|
|
97
|
+
const activeRole = session.Data.get('ActiveRole') ?? logged.Role?.[0];
|
|
98
|
+
const combinedGrants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
|
|
95
99
|
return new http_1.Ok({
|
|
96
100
|
...logged.dehydrateWithRelations({
|
|
97
101
|
dateTimeFormat: "iso"
|
|
98
102
|
}),
|
|
103
|
+
Role: logged.Role,
|
|
104
|
+
ActiveRole: activeRole,
|
|
99
105
|
Grants: combinedGrants,
|
|
106
|
+
}, {
|
|
107
|
+
Coockies: [
|
|
108
|
+
{
|
|
109
|
+
Name: 'ssid',
|
|
110
|
+
Value: regenerated.SessionId,
|
|
111
|
+
Options: {
|
|
112
|
+
signed: true,
|
|
113
|
+
httpOnly: true,
|
|
114
|
+
maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
|
|
115
|
+
...this.SessionCookieConfig,
|
|
116
|
+
},
|
|
117
|
+
},
|
|
118
|
+
],
|
|
100
119
|
});
|
|
101
120
|
}
|
|
102
121
|
catch (err) {
|
|
@@ -114,6 +133,14 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
114
133
|
});
|
|
115
134
|
}
|
|
116
135
|
}
|
|
136
|
+
/**
|
|
137
|
+
* Verifies the supplied TOTP token against the user's 2FA secret. Wraps the
|
|
138
|
+
* module-level `auth2Fa` action in a protected method so tests can stub the
|
|
139
|
+
* verification without a TOTP/DB setup.
|
|
140
|
+
*/
|
|
141
|
+
verifyTwoFactorToken(user, token) {
|
|
142
|
+
return (0, _2fa_js_1.auth2Fa)(user, token);
|
|
143
|
+
}
|
|
117
144
|
};
|
|
118
145
|
exports.TwoFactorAuthController = TwoFactorAuthController;
|
|
119
146
|
__decorate([
|
|
@@ -124,6 +151,10 @@ __decorate([
|
|
|
124
151
|
(0, configuration_1.AutoinjectService)('rbac.session'),
|
|
125
152
|
__metadata("design:type", rbac_1.SessionProvider)
|
|
126
153
|
], TwoFactorAuthController.prototype, "SessionProvider", void 0);
|
|
154
|
+
__decorate([
|
|
155
|
+
(0, configuration_1.Config)('rbac.session.cookie', {}),
|
|
156
|
+
__metadata("design:type", Object)
|
|
157
|
+
], TwoFactorAuthController.prototype, "SessionCookieConfig", void 0);
|
|
127
158
|
__decorate([
|
|
128
159
|
(0, di_1.Autoinject)(rbac_1.AccessControl),
|
|
129
160
|
__metadata("design:type", rbac_1.AccessControl)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAA2F;AAC3F,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAA2F;AAC3F,wCAA2K;AAC3K,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAA6E;AAC7E,oCAAyC;AACzC,0CAA8C;AAE9C,kDAAoG;AACpG,iDAA8D;AAC9D,+CAAkD;AAClD,oDAAuD;AAEvD;;;;;;;GAOG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAavD;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE1C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,SAAE,CAAC;YACV,GAAG,EAAE,MAAgB;SACxB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAA,wBAAc,EAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QAErG,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;YAGH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAExF,OAAO,IAAI,SAAE,CAAC;gBACV,GAAG,MAAM,CAAC,sBAAsB,CAAC;oBAC7B,cAAc,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,cAAc;aACK,EAAE;gBAC7B,QAAQ,EAAE;oBACN;wBACI,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;wBAC5B,OAAO,EAAE;4BACL,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;4BACxC,GAAG,IAAI,CAAC,mBAAmB;yBAC9B;qBACJ;iBACJ;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YAET,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,wBAAiB,CAAC;gBACzB,KAAK,EAAE;oBACH,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC9B;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QACzD,OAAO,IAAA,iBAAO,EAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAxIY,0DAAuB;AAEtB;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACR,oBAAY;sDAAC;AAGpB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;oEACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAYf;IADZ,IAAA,UAAG,EAAC,YAAY,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;wDAU7C;AAYY;IADZ,IAAA,UAAG,EAAC,aAAa,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;yDAO9C;AAYY;IADZ,IAAA,WAAI,EAAC,YAAY,CAAC;IACO,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAqB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAO,GAAE,CAAA;;qCAA9C,WAAS,EAAiB,uBAAQ;;0DA8D1E;kCA9HQ,uBAAuB;IAHnC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,kCAAkB,CAAC;IAC1B,IAAA,aAAM,EAAC,+BAAmB,CAAC;GACf,uBAAuB,CAwInC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;
|
|
1
|
+
{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;IAqBpE;;;;;;;;OAQG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAUxE;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW;CAkB3E"}
|
|
@@ -80,7 +80,11 @@ let UserController = class UserController extends http_1.BaseController {
|
|
|
80
80
|
if (sId) {
|
|
81
81
|
const session = await this.SessionProvider.restore(sId);
|
|
82
82
|
if (session) {
|
|
83
|
-
|
|
83
|
+
// Session stores the user UUID (see LoginController) — RbacUserFactory
|
|
84
|
+
// resolves the user from it on each request. Storing a dehydrated object
|
|
85
|
+
// here would break that lookup and log the user out on the next request.
|
|
86
|
+
session.Data.set('User', user.Uuid);
|
|
87
|
+
await this.SessionProvider.save(session);
|
|
84
88
|
}
|
|
85
89
|
}
|
|
86
90
|
return new http_1.Ok(user.dehydrate());
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAAqD;AACrD,wCAAkJ;AAClJ,wCAA+F;AAC/F,oDAAsD;AACtD,oCAAyC;AACzC,0DAAgD;AAChD,qDAAuC;AAEvC,kDAA8F;AAC9F,wCAAgD;AAIhD;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qBAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAY,IAAY;QAClE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,+BAA+B;QAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAAqD;AACrD,wCAAkJ;AAClJ,wCAA+F;AAC/F,oDAAsD;AACtD,oCAAyC;AACzC,0DAAgD;AAChD,qDAAuC;AAEvC,kDAA8F;AAC9F,wCAAgD;AAIhD;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qBAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAY,IAAY;QAClE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,+BAA+B;QAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,oBAAa,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;QAExD,OAAO,IAAI,SAAE,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAGD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAU,GAAgB;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAGD,OAAO,IAAI,SAAE,CACX,IAAA,aAAM,EACJ,IAAI,EACJ,IAAA,cAAO,EACL,IAAA,oBAAa,EAAC,GAAG,CAAC,WAAW,CAAC,EAC9B,IAAA,qBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE;YACH,MAAM,IAAI,4BAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC,CAAC,CACL,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA/FY,wCAAc;AAEf;IADT,IAAA,eAAU,GAAE;8BACe,uBAAgB;wDAAC;AAGnC;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;AAGjC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;0CAAC;AAaf;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,aAAM,GAAE,CAAA;;qCAApB,WAAS;;6CAmB3C;AAaY;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;+CAO7C;AAcY;IAFZ,IAAA,YAAK,EAAC,UAAU,CAAC;IACjB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAlB,WAAS,EAAe,6BAAW;;iDAiBzE;yBA9FU,cAAc;IAH1B,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,cAAc,CA+F1B"}
|
|
@@ -98,7 +98,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
98
98
|
* @response 401 Unauthorized — valid session required
|
|
99
99
|
* @response 403 Forbidden — readOwn permission required
|
|
100
100
|
*/
|
|
101
|
-
readMeta(pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): Promise<Ok<import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope>>;
|
|
101
|
+
readMeta(user: UserModel, pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): Promise<Ok<import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope>>;
|
|
102
102
|
/**
|
|
103
103
|
* Get own metadata entry by key
|
|
104
104
|
* Retrieves a single metadata entry by key for the authenticated user.
|
|
@@ -109,7 +109,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
109
109
|
* @response 403 Forbidden — readOwn permission required
|
|
110
110
|
* @response 404 Metadata key not found
|
|
111
111
|
*/
|
|
112
|
-
getMeta(key: string): Promise<Ok<UserMetadata>>;
|
|
112
|
+
getMeta(user: UserModel, key: string): Promise<Ok<UserMetadata>>;
|
|
113
113
|
/**
|
|
114
114
|
* Add or update own metadata
|
|
115
115
|
* Inserts a new metadata entry for the authenticated user, or updates it if the key already exists.
|
|
@@ -118,7 +118,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
118
118
|
* @response 401 Unauthorized — valid session required
|
|
119
119
|
* @response 403 Forbidden — updateOwn permission required
|
|
120
120
|
*/
|
|
121
|
-
addMetadata(metadata: UserMetadata): Promise<
|
|
121
|
+
addMetadata(user: UserModel, metadata: UserMetadata): Promise<Ok<any>>;
|
|
122
122
|
/**
|
|
123
123
|
* Update own metadata entry
|
|
124
124
|
* Updates Key, Value, and Type of an existing metadata entry identified by Id or Key.
|
|
@@ -130,7 +130,7 @@ export declare class UserMetadataController extends BaseController {
|
|
|
130
130
|
* @response 403 Forbidden — updateOwn permission required
|
|
131
131
|
* @response 404 Metadata entry not found
|
|
132
132
|
*/
|
|
133
|
-
updateMetadata(meta: string, data: UserMetadataDto): Promise<Ok<any>>;
|
|
133
|
+
updateMetadata(user: UserModel, meta: string, data: UserMetadataDto): Promise<Ok<any>>;
|
|
134
134
|
/**
|
|
135
135
|
* Delete own metadata entry
|
|
136
136
|
* Permanently removes a metadata entry by Id from the authenticated user's metadata.
|
|
@@ -141,6 +141,6 @@ export declare class UserMetadataController extends BaseController {
|
|
|
141
141
|
* @response 403 Forbidden — deleteOwn permission required
|
|
142
142
|
* @response 404 Metadata entry not found
|
|
143
143
|
*/
|
|
144
|
-
deleteMetadata(meta: number): Promise<Ok<any>>;
|
|
144
|
+
deleteMetadata(user: UserModel, meta: number): Promise<Ok<any>>;
|
|
145
145
|
}
|
|
146
146
|
//# sourceMappingURL=UserMetadataController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;
|
|
1
|
+
{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAS7E;;;;;;GAMG;AACH,qBAGa,sBAAuB,SAAQ,cAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,YAAY,CACc,IAAI,EAAE,SAAS,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAc3B;;;;;;;;;;OAUG;IAGU,WAAW,CACe,IAAI,EAAE,SAAS,EACzC,GAAG,EAAE,MAAM;IAOxB;;;;;;;;;OASG;IAGU,eAAe,CACW,IAAI,EAAE,SAAS,EACvC,QAAQ,EAAE,YAAY;IAOrC;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAOxB,IAAI,EAAE,YAAY,EACc,KAAK,EAAE,SAAS,EAC3C,IAAI,EAAE,eAAe;IAUjC;;;;;;;;;;OAUG;IAGU,kBAAkB,CACQ,IAAI,EAAE,SAAS,EACzC,IAAI,EAAE,MAAM;IASzB;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,QAAQ,CACT,IAAI,EAAE,SAAS,EACd,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAe3B;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAW,GAAG,EAAE,MAAM;IAOlE;;;;;;;OAOG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAa,QAAQ,EAAE,YAAY;IAQnF;;;;;;;;;;OAUG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,eAAe;IAkBzG;;;;;;;;;OASG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM;CAK7E"}
|