@spinajs/rbac-http-user 2.0.481 → 2.0.484

package/lib/cjs/controllers/UserMetadataController.js

@@ -20,6 +20,12 @@ const orm_http_1 = require("@spinajs/orm-http");
 const metadata_dto_js_1 = require("../dto/metadata-dto.js");
 const orm_1 = require("@spinajs/orm");
 const FilterableUserMetadata_js_1 = require("../models/FilterableUserMetadata.js");
+/**
+ * Fallback page size. A request without a `limit` used to reach `take(0)`,
+ * which the query builder rejects ( "take count should be a positive number" ),
+ * so plain listing requests failed instead of returning the first page.
+ */
+const DEFAULT_PAGE_SIZE = 10;
 /**
  * User metadata management.
  * Provides CRUD operations for key-value metadata entries attached to user accounts.
@@ -43,11 +49,12 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 404 User not found
      */
     async readUserMeta(user, pagination, order, filter) {
+        const limit = pagination?.limit || DEFAULT_PAGE_SIZE;
         return new http_1.Ok(FilterableUserMetadata_js_1.FilterableUserMetadata.select().where({
             user_id: user.Id
         }).filter(filter?.filters ?? [], filter?.op)
-            .take(pagination?.limit ?? 0)
-            .skip((pagination?.limit ?? 0) * (pagination?.page ?? 0))
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
             .order(order?.column ?? 'Id', order?.order ?? orm_1.SortOrder.DESC));
     }
     /**
@@ -114,10 +121,10 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 404 User or metadata entry not found
      */
     async deleteUserMetadata(user, meta) {
-        await rbac_1.UserMetadata.destroy().where({
-            Id: meta,
-            user_id: user.Id
-        });
+        // NOTE: destroy() refuses to build an unbounded DELETE, so the entry id
+        // goes in as the primary key and ownership is AND-ed on top of it —
+        // deleting by id alone would let any user id delete anybody's entry.
+        await rbac_1.UserMetadata.destroy(meta).andWhere('user_id', user.Id);
         return new http_1.Ok();
     }
     /**
@@ -144,10 +151,15 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — readOwn permission required
      */
-    async readMeta(pagination, order, filter) {
-        return new http_1.Ok(FilterableUserMetadata_js_1.FilterableUserMetadata.select().filter(filter?.filters ?? [], filter?.op)
-            .take(pagination?.limit ?? 0)
-            .skip((pagination?.limit ?? 0) * (pagination?.page ?? 0))
+    async readMeta(user, pagination, order, filter) {
+        // Explicit owner scoping: the rbac query middleware does not enforce
+        // ownership for the metadata model (queries resolve to the unsafe base
+        // model without an @OrmResource), so every own-route filters by the
+        // authenticated user's id directly.
+        const limit = pagination?.limit || DEFAULT_PAGE_SIZE;
+        return new http_1.Ok(FilterableUserMetadata_js_1.FilterableUserMetadata.select().where('user_id', user.Id).filter(filter?.filters ?? [], filter?.op)
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
             .order(order?.column ?? 'Id', order?.order ?? orm_1.SortOrder.DESC));
     }
     /**
@@ -160,9 +172,10 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 403 Forbidden — readOwn permission required
      * @response 404 Metadata key not found
      */
-    async getMeta(key) {
+    async getMeta(user, key) {
         return new http_1.Ok(rbac_1.UserMetadata.where({
             Key: key,
+            user_id: user.Id,
         }).firstOrFail());
     }
     /**
@@ -173,8 +186,12 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — updateOwn permission required
      */
-    async addMetadata(metadata) {
+    async addMetadata(user, metadata) {
+        // force ownership to the authenticated user — never trust a user_id
+        // supplied in the request body
+        metadata.user_id = user.Id;
         await metadata.insert(orm_1.InsertBehaviour.InsertOrUpdate);
+        return new http_1.Ok();
     }
     /**
      * Update own metadata entry
@@ -187,12 +204,20 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 403 Forbidden — updateOwn permission required
      * @response 404 Metadata entry not found
      */
-    async updateMetadata(meta, data) {
+    async updateMetadata(user, meta, data) {
+        // The Key/Id lookup is grouped and AND-ed with an explicit ownership
+        // filter. Without the grouping the flat "Key = ? OR Id = ? AND user_id = ?"
+        // binds as "Key = ? OR (Id = ? AND user_id = ?)", letting any user update
+        // another user's metadata by its Key. Scoping by user_id explicitly (not
+        // relying on the query middleware, which does not fire for this model)
+        // keeps the update owner-bound.
         await rbac_1.UserMetadata.update({
             Key: data.Key,
             Value: data.Value,
             Type: data.Type
-        }).where("Key", meta).orWhere("Id", meta);
+        }).where(function () {
+            this.where("Key", meta).orWhere("Id", meta);
+        }).andWhere('user_id', user.Id);
         return new http_1.Ok();
     }
     /**
@@ -205,10 +230,8 @@ let UserMetadataController = class UserMetadataController extends http_1.BaseCon
      * @response 403 Forbidden — deleteOwn permission required
      * @response 404 Metadata entry not found
      */
-    async deleteMetadata(meta) {
-        await rbac_1.UserMetadata.destroy().where({
-            Id: meta
-        });
+    async deleteMetadata(user, meta) {
+        await rbac_1.UserMetadata.destroy(meta).andWhere('user_id', user.Id);
         return new http_1.Ok();
     }
 };
@@ -275,45 +298,51 @@ __decorate([
 __decorate([
     (0, http_1.Get)("metadata"),
     (0, rbac_http_1.Permission)(['readOwn']),
-    __param(0, (0, http_1.Query)()),
+    __param(0, (0, rbac_http_1.User)()),
     __param(1, (0, http_1.Query)()),
-    __param(2, (0, orm_http_1.Filter)(FilterableUserMetadata_js_1.FilterableUserMetadata)),
+    __param(2, (0, http_1.Query)()),
+    __param(3, (0, orm_http_1.Filter)(FilterableUserMetadata_js_1.FilterableUserMetadata)),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [orm_http_1.PaginationDTO,
+    __metadata("design:paramtypes", [rbac_1.User,
+        orm_http_1.PaginationDTO,
         orm_http_1.OrderDTO, Object]),
     __metadata("design:returntype", Promise)
 ], UserMetadataController.prototype, "readMeta", null);
 __decorate([
     (0, http_1.Get)("metadata/:key"),
     (0, rbac_http_1.Permission)(['readOwn']),
-    __param(0, (0, http_1.Param)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
     __metadata("design:returntype", Promise)
 ], UserMetadataController.prototype, "getMeta", null);
 __decorate([
     (0, http_1.Post)("metadata"),
     (0, rbac_http_1.Permission)(['updateOwn']),
-    __param(0, (0, orm_http_1.AsModel)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, orm_http_1.AsModel)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [rbac_1.UserMetadata]),
+    __metadata("design:paramtypes", [rbac_1.User, rbac_1.UserMetadata]),
     __metadata("design:returntype", Promise)
 ], UserMetadataController.prototype, "addMetadata", null);
 __decorate([
     (0, http_1.Patch)('metadata/:meta'),
     (0, rbac_http_1.Permission)(['updateOwn']),
-    __param(0, (0, http_1.Param)()),
-    __param(1, (0, http_1.Body)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
+    __param(2, (0, http_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, metadata_dto_js_1.UserMetadataDto]),
+    __metadata("design:paramtypes", [rbac_1.User, String, metadata_dto_js_1.UserMetadataDto]),
     __metadata("design:returntype", Promise)
 ], UserMetadataController.prototype, "updateMetadata", null);
 __decorate([
     (0, http_1.Del)('metadata/:meta'),
     (0, rbac_http_1.Permission)(['deleteOwn']),
-    __param(0, (0, http_1.Param)()),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Number]),
+    __metadata("design:paramtypes", [rbac_1.User, Number]),
     __metadata("design:returntype", Promise)
 ], UserMetadataController.prototype, "deleteMetadata", null);
 exports.UserMetadataController = UserMetadataController = __decorate([

package/lib/cjs/controllers/UserMetadataController.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAgH;AAChH,wCAAgE;AAChE,kDAA4E;AAC5E,gDAAwG;AACxG,4DAAyD;AACzD,sCAA0D;AAC1D,mFAA6E;AAE7E;;;;;;GAMG;AAII,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,qBAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,YAAY,CACc,IAAe,EACzC,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACvC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;aAC5B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,WAAW,CACe,IAAe,EACzC,GAAW;QACpB,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CACW,IAAe,EACvC,QAAsB;QAEjC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CAOxB,IAAkB,EACc,KAAgB,EAC3C,IAAqB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAA;QAEF,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CACQ,IAAe,EACzC,IAAY;QACrB,MAAM,mBAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;YAC/B,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;QAEH,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACR,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aAClF,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;aAC5B,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAU,GAAW;QACrC,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;SACX,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAY,QAAsB;QACtD,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,IAAY,EAAU,IAAqB;QAC5E,MAAM,mBAAY,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1C,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAU,IAAY;QAC7C,MAAM,mBAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;YAC/B,EAAE,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;CACJ,CAAA;AA3PY,wDAAsB;AAkBlB;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAHU,WAAS;QAC5B,wBAAa;QAClB,mBAAQ;;0DAW5B;AAgBY;IAFZ,IAAA,UAAG,EAAC,qBAAqB,CAAC;IAC1B,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;yDAMrD;AAcY;IAFZ,IAAA,WAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAD+B,WAAS;QAC7B,mBAAY;;6DAKpC;AAgBY;IAFZ,IAAA,YAAK,EAAC,uBAAuB,CAAC;IAC9B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC;QACP,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC,CAAC;KACL,CAAC,CAAA;IACD,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAFE,mBAAY;QACqB,WAAS;QACrC,iCAAe;;gEAQhC;AAeY;IAFZ,IAAA,UAAG,EAAC,sBAAsB,CAAC;IAC3B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;gEAQrD;AA+BY;IAFZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAFT,wBAAa;QAClB,mBAAQ;;sDAS5B;AAcY;IAFZ,IAAA,UAAG,EAAC,eAAe,CAAC;IACpB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAA,YAAK,GAAE,CAAA;;;;qDAI5B;AAYY;IAFZ,IAAA,WAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAAW,mBAAY;;yDAEzD;AAeY;IAFZ,IAAA,YAAK,EAAC,gBAAgB,CAAC;IACvB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;6CAAO,iCAAe;;4DAQ/E;AAcY;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,YAAK,GAAE,CAAA;;;;4DAMnC;iCA1PQ,sBAAsB;IAHlC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,eAAe,CAAC;IACzB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,sBAAsB,CA2PlC"}
+{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAgH;AAChH,wCAAgE;AAChE,kDAAkF;AAClF,gDAAwG;AACxG,4DAAyD;AACzD,sCAA0D;AAC1D,mFAA6E;AAE7E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;GAMG;AAII,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,qBAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,YAAY,CACc,IAAe,EACzC,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,iBAAiB,CAAC;QAErD,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACvC,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,WAAW,CACe,IAAe,EACzC,GAAW;QACpB,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CACW,IAAe,EACvC,QAAsB;QAEjC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CAOxB,IAAkB,EACc,KAAgB,EAC3C,IAAqB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAA;QAEF,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CACQ,IAAe,EACzC,IAAY;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,mBAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACT,IAAe,EACd,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,iBAAiB,CAAC;QAErD,OAAO,IAAI,SAAE,CAAC,kDAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aAC5G,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAW,GAAW;QAC9D,OAAO,IAAI,SAAE,CAAC,mBAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAa,QAAsB;QAC/E,oEAAoE;QACpE,+BAA+B;QAC/B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY,EAAU,IAAqB;QACrG,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,mBAAY,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC,KAAK,CAAC;YACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY;QACtE,MAAM,mBAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;CACJ,CAAA;AA/QY,wDAAsB;AAkBlB;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAHU,WAAS;QAC5B,wBAAa;QAClB,mBAAQ;;0DAa5B;AAgBY;IAFZ,IAAA,UAAG,EAAC,qBAAqB,CAAC;IAC1B,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;yDAMrD;AAcY;IAFZ,IAAA,WAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAD+B,WAAS;QAC7B,mBAAY;;6DAKpC;AAgBY;IAFZ,IAAA,YAAK,EAAC,uBAAuB,CAAC;IAC9B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC;QACP,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC,CAAC;KACL,CAAC,CAAA;IACD,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAFE,mBAAY;QACqB,WAAS;QACrC,iCAAe;;gEAQhC;AAeY;IAFZ,IAAA,UAAG,EAAC,sBAAsB,CAAC;IAC3B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,IAAA,oBAAS,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAA,YAAK,GAAE,CAAA;;qCADiC,WAAS;;gEAQrD;AA+BY;IAFZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAA,gBAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAK,GAAE,CAAA;IACP,WAAA,IAAA,iBAAM,EAAC,kDAAsB,CAAC,CAAA;;qCAHjB,WAAS;QACD,wBAAa;QAClB,mBAAQ;;sDAe5B;AAcY;IAFZ,IAAA,UAAG,EAAC,eAAe,CAAC;IACpB,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;qDAK3C;AAYY;IAFZ,IAAA,WAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,kBAAO,GAAE,CAAA;;qCAArB,WAAS,EAAuB,mBAAY;;yDAMlF;AAeY;IAFZ,IAAA,YAAK,EAAC,gBAAgB,CAAC;IACvB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzC,WAAS,UAAuC,iCAAe;;4DAgBxG;AAcY;IAFZ,IAAA,UAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;4DAIlD;iCA9QQ,sBAAsB;IAHlC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,eAAe,CAAC;IACzB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,sBAAsB,CA+QlC"}

package/lib/cjs/models/FilterableUserMetadata.d.ts

@@ -1,6 +1,7 @@
 import { UserMetadata } from '@spinajs/rbac';
 export declare class FilterableUserMetadata extends UserMetadata {
     get Key(): string;
+    set Key(value: string);
     Type: 'number' | 'float' | 'string' | 'json' | 'boolean' | 'datetime';
 }
 //# sourceMappingURL=FilterableUserMetadata.d.ts.map

package/lib/cjs/models/FilterableUserMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FilterableUserMetadata.d.ts","sourceRoot":"","sources":["../../../src/models/FilterableUserMetadata.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,YAAY,EAAE,MAAM,eAAe,CAAC;AAG1D,qBAGa,sBAAuB,SAAQ,YAAY;IAEpD,IACW,GAAG,IAAI,MAAM,CAEvB;IAGM,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;CAEhF"}
+{"version":3,"file":"FilterableUserMetadata.d.ts","sourceRoot":"","sources":["../../../src/models/FilterableUserMetadata.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,YAAY,EAAE,MAAM,eAAe,CAAC;AAG1D,qBAGa,sBAAuB,SAAQ,YAAY;IAEpD,IACW,GAAG,IAAI,MAAM,CAEvB;IAMD,IAAW,GAAG,CAAC,KAAK,EAAE,MAAM,EAE3B;IAGM,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;CAEhF"}

package/lib/cjs/models/FilterableUserMetadata.js

@@ -17,12 +17,19 @@ let FilterableUserMetadata = class FilterableUserMetadata extends rbac_1.UserMet
     get Key() {
         return super.Key;
     }
+    // NOTE: overriding only the getter drops the setter MetadataModel defines
+    // for the same property — the accessor pair on this prototype shadows the
+    // inherited one. Hydration assigns `Key`, so every row read through this
+    // model died with "Cannot set property Key ... which has only a getter".
+    set Key(value) {
+        super.Key = value;
+    }
 };
 exports.FilterableUserMetadata = FilterableUserMetadata;
 __decorate([
     (0, orm_http_1.Filterable)(['eq', 'like', 'b-like', 'e-like']),
     __metadata("design:type", String),
-    __metadata("design:paramtypes", [])
+    __metadata("design:paramtypes", [String])
 ], FilterableUserMetadata.prototype, "Key", null);
 __decorate([
     (0, orm_http_1.Filterable)(['eq']),

package/lib/cjs/models/FilterableUserMetadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"FilterableUserMetadata.js","sourceRoot":"","sources":["../../../src/models/FilterableUserMetadata.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAiD;AAGjD,wCAA0D;AAC1D,gDAA+C;AAKxC,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,mBAAY;IAEpD,IACW,GAAG;QACV,OAAO,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;CAKJ,CAAA;AAVY,wDAAsB;AAE/B;IAAC,IAAA,qBAAU,EAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAC,QAAQ,CAAC,CAAC;;;iDAG7C;AAGM;IADN,IAAA,qBAAU,EAAC,CAAC,IAAI,CAAC,CAAC;;oDAC0D;iCARpE,sBAAsB;IAHlC,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,gBAAgB,CAAC;IACvB,IAAA,kBAAW,EAAC,eAAe,CAAC;GAChB,sBAAsB,CAUlC"}
+{"version":3,"file":"FilterableUserMetadata.js","sourceRoot":"","sources":["../../../src/models/FilterableUserMetadata.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAiD;AAGjD,wCAA0D;AAC1D,gDAA+C;AAKxC,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,mBAAY;IAEpD,IACW,GAAG;QACV,OAAO,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,IAAW,GAAG,CAAC,KAAa;QACxB,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;IACtB,CAAC;CAKJ,CAAA;AAlBY,wDAAsB;AAE/B;IAAC,IAAA,qBAAU,EAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAC,QAAQ,CAAC,CAAC;;;iDAG7C;AAWM;IADN,IAAA,qBAAU,EAAC,CAAC,IAAI,CAAC,CAAC;;oDAC0D;iCAhBpE,sBAAsB;IAHlC,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,gBAAgB,CAAC;IACvB,IAAA,kBAAW,EAAC,eAAe,CAAC;GAChB,sBAAsB,CAkBlC"}

package/lib/mjs/actions/2fa.d.ts

@@ -1,4 +1,10 @@
 import { User } from '@spinajs/rbac';
+/**
+ * NOTE for all three actions below: the event must be emitted for the USER, not
+ * for whatever the provider call returned ( `initialize()` returns the otpauth
+ * url ). `_user_ev` reads `Uuid` off its argument, so it is bound to `u`
+ * explicitly and the provider result is passed through untouched.
+ */
 export declare function enableUser2Fa(identifier: number | string | User): Promise<unknown>;
 export declare function disableUser2Fa(identifier: number | string | User): Promise<unknown>;
 export declare function resetUser2Fa(identifier: number | string | User): Promise<unknown>;

package/lib/mjs/actions/2fa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"2fa.d.ts","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAyD,MAAM,eAAe,CAAC;AAY5F,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAOrE;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAOtE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAUpE;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,oBA8B9E"}
+{"version":3,"file":"2fa.d.ts","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAyD,MAAM,eAAe,CAAC;AAa5F;;;;;GAKG;AAEH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAYrE;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAWtE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAiBpE;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,oBA8B9E"}

package/lib/mjs/actions/2fa.js

@@ -7,20 +7,34 @@ import { User2FaPassed } from '../events/User2FaPassed.js';
 import { User2FaEnabled } from '../events/User2FaEnabled.js';
 import { TwoFactorAuthProvider, } from '@spinajs/rbac-http';
 import { User2FaReset } from '../events/User2FaReset.js';
+import { User2FaDisabled } from '../events/User2FaDisabled.js';
+/**
+ * NOTE for all three actions below: the event must be emitted for the USER, not
+ * for whatever the provider call returned ( `initialize()` returns the otpauth
+ * url ). `_user_ev` reads `Uuid` off its argument, so it is bound to `u`
+ * explicitly and the provider result is passed through untouched.
+ */
 export async function enableUser2Fa(identifier) {
     return _chain(_user_unsafe(identifier), (u) => {
-        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), async (twoFa) => twoFa.initialize(u), _tap(_user_ev(User2FaEnabled)));
+        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), async (twoFa) => twoFa.initialize(u), 
+        // keeps the otpauth url as the result of the action
+        _tap(async () => _user_ev(User2FaEnabled)(u)));
     });
 }
 export async function disableUser2Fa(identifier) {
     return _chain(_user_unsafe(identifier), (u) => {
-        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), _tap(_user_ev(User2FaEnabled)));
+        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), () => _user_ev(User2FaDisabled)(u));
     });
 }
 export async function resetUser2Fa(identifier) {
     return _chain(_user_unsafe(identifier), (u) => {
-        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), _tap(async (twoFa) => twoFa.disable(u))),
-            _tap(_user_ev(User2FaReset));
+        // NOTE: this used to read
+        //   return _chain( ... ), _tap(_user_ev(User2FaReset));
+        // The comma operator threw the disabling chain away un-awaited and
+        // returned the _tap function itself, so `await resetUser2Fa(user)`
+        // resolved before ( or without ) the secrets being cleared and the
+        // User2FaReset event was never emitted.
+        return _chain(_service('rbac.twoFactorAuth', TwoFactorAuthProvider), async (twoFa) => twoFa.disable(u), () => _user_ev(User2FaReset)(u));
     });
 }
 /**

package/lib/mjs/actions/2fa.js.map

@@ -1 +1 @@
-{"version":3,"file":"2fa.js","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAmB,KAAK,EAAQ,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkC;IAClE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACtK,CAAC,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkC;IACnE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACnK,CAAC,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkC;IACjE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAC/D,IAAI,CAAC,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACjE;YACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CACJ,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAkC,EAAE,KAAa;IAC3E,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,MAAM,CACF,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,OAAO,CACxE,CAAC,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,EAC7D,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,EACvF,GAAG,EAAE;YACD,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC,CACJ,CAAC,CAAA;IACN,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACb,OAAO,MAAM,CACT,GAAG,EAAE,CAAC,CAAC;QAEP,6BAA6B;QAC7B,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACD,MAAM,GAAG,CAAC;QACd,CAAC,CACJ,CAAC;IACN,CAAC,CACJ,CACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"2fa.js","sourceRoot":"","sources":["../../../src/actions/2fa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAmB,KAAK,EAAQ,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D;;;;;GAKG;AAEH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkC;IAClE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CACT,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3D,oDAAoD;QACpD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkC;IACnE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CACT,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CACrC,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkC;IACjE,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,CAAC,CAAO,EAAE,EAAE;QACR,0BAA0B;QAC1B,wDAAwD;QACxD,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,wCAAwC;QACxC,OAAO,MAAM,CACT,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EACrD,KAAK,EAAE,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAClC,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAkC,EAAE,KAAa;IAC3E,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,MAAM,CACT,YAAY,CAAC,UAAU,CAAC,EACxB,MAAM,CACF,CAAC,CAAO,EAAE,EAAE;QACR,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,OAAO,CACxE,CAAC,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,EAC7D,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,EACvF,GAAG,EAAE;YACD,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC,CACJ,CAAC,CAAA;IACN,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACb,OAAO,MAAM,CACT,GAAG,EAAE,CAAC,CAAC;QAEP,6BAA6B;QAC7B,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACD,MAAM,GAAG,CAAC;QACd,CAAC,CACJ,CAAC;IACN,CAAC,CACJ,CACJ,CAAC;AACN,CAAC"}

package/lib/mjs/controllers/ActiveRoleController.d.ts

@@ -16,6 +16,7 @@ export declare class ActiveRoleController extends BaseController {
     protected PasswordProvider: PasswordProvider;
     protected SessionProvider: SessionProvider;
     protected RolesRequiringPassword: string[];
+    protected SessionCookieConfig: any;
     /**
      * Get active role
      * Returns the currently active role for the session and the RBAC grants

package/lib/mjs/controllers/ActiveRoleController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC9G,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAE3C;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqCvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
+{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}

package/lib/mjs/controllers/ActiveRoleController.js

@@ -12,7 +12,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { SwitchRoleDto } from '../dto/switchRole-dto.js';
 import { BaseController, BasePath, Post, Body, Ok, Get, BadRequestResponse, Unauthorized, Policy } from '@spinajs/http';
-import { AccessControl, AuthProvider, PasswordProvider, SessionProvider, _unwindGrants } from '@spinajs/rbac';
+import { AccessControl, AuthProvider, PasswordProvider, SessionProvider, _unwindGrants, regenerateSession, sessionCookieMaxAge } from '@spinajs/rbac';
 import { Autoinject } from '@spinajs/di';
 import { AutoinjectService, Config } from '@spinajs/configuration';
 import { LoggedPolicy, User as UserRouteArg, Session as SessionRouteArg, FromSession } from '@spinajs/rbac-http';
@@ -74,8 +74,23 @@ let ActiveRoleController = class ActiveRoleController extends BaseController {
             }
         }
         session.Data.set('ActiveRole', payload.Role);
-        await this.SessionProvider.save(session);
-        return new Ok(this.buildResponse(payload.Role));
+        // Privilege elevation — regenerate the session id to defend against session
+        // fixation, and reset the ssid cookie to the new id.
+        const regenerated = await regenerateSession(this.SessionProvider, session);
+        return new Ok(this.buildResponse(payload.Role), {
+            Coockies: [
+                {
+                    Name: 'ssid',
+                    Value: regenerated.SessionId,
+                    Options: {
+                        signed: true,
+                        httpOnly: true,
+                        maxAge: sessionCookieMaxAge(regenerated),
+                        ...this.SessionCookieConfig,
+                    },
+                },
+            ],
+        });
     }
     buildResponse(activeRole) {
         const grants = activeRole ? _unwindGrants(activeRole, this.AC.getGrants()) : {};
@@ -105,6 +120,10 @@ __decorate([
     Config('rbac.roleSwitch.requirePassword', { defaultValue: [] }),
     __metadata("design:type", Array)
 ], ActiveRoleController.prototype, "RolesRequiringPassword", void 0);
+__decorate([
+    Config('rbac.session.cookie', {}),
+    __metadata("design:type", Object)
+], ActiveRoleController.prototype, "SessionCookieConfig", void 0);
 __decorate([
     Get('active-role'),
     Policy(LoggedPolicy),

package/lib/mjs/controllers/ActiveRoleController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,WAAW,EAAuB,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,cAAc;IAgBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AAxFW;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;gDAAC;AAGlB;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;0DAAC;AAG3B;IADT,iBAAiB,CAAC,eAAe,CAAC;8BACP,gBAAgB;8DAAC;AAGnC;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;6DAAC;AAGjC;IADT,MAAM,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAY9B;IAFZ,GAAG,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,YAAY,CAAC;IACO,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAI,CAAC,aAAa,CAAC;IACnB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,YAAY,EAAE,CAAA;IACd,WAAA,eAAe,EAAE,CAAA;IACjB,WAAA,IAAI,EAAE,CAAA;;uDAAU,aAAa;;4DAoC/B;AAjFU,oBAAoB;IADhC,QAAQ,CAAC,MAAM,CAAC;GACJ,oBAAoB,CA0FhC"}
+{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEtJ,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,WAAW,EAAuB,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,cAAc;IAmBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,YAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;oBAC5B,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC;wBACxC,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AA3GW;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;gDAAC;AAGlB;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;0DAAC;AAG3B;IADT,iBAAiB,CAAC,eAAe,CAAC;8BACP,gBAAgB;8DAAC;AAGnC;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;6DAAC;AAGjC;IADT,MAAM,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAGjC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACC;AAYtB;IAFZ,GAAG,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,YAAY,CAAC;IACO,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAI,CAAC,aAAa,CAAC;IACnB,MAAM,CAAC,YAAY,CAAC;IAElB,WAAA,YAAY,EAAE,CAAA;IACd,WAAA,eAAe,EAAE,CAAA;IACjB,WAAA,IAAI,EAAE,CAAA;;uDAAU,aAAa;;4DAoD/B;AApGU,oBAAoB;IADhC,QAAQ,CAAC,MAAM,CAAC;GACJ,oBAAoB,CA6GhC"}

package/lib/mjs/controllers/LoginController.d.ts

@@ -15,7 +15,6 @@ export declare class LoginController extends BaseController {
     protected Configuration: Configuration;
     protected AuthProvider: AuthProvider;
     protected SessionProvider: SessionProvider;
-    protected SessionExpirationTime: number;
     protected TwoFactorAuthEnabled: boolean;
     protected TwoFactorAuthForceUser: boolean;
     protected SessionCookieConfig: any;
@@ -66,6 +65,7 @@ export declare class LoginController extends BaseController {
         IsGuest: boolean;
         IsBanned: boolean;
         IsDirty: boolean;
+        Snapshot: import("@spinajs/orm").IModelSnapshot | null;
         Metadata: Omit<import("@spinajs/orm").ModelDataWithRelationData<import("@spinajs/rbac").UserMetadataBase>, import("@spinajs/orm").ExcludedModelProperties>[];
         PrimaryKeyValue: any;
     }>>;

package/lib/mjs/controllers/LoginController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAAiB,MAAM,eAAe,CAAC;AAEhH,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA+E,cAAc,EAAwC,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAKxC,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAgB,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IAgH3J;;;;;;;;OAQG;IAGU,MAAM,CAAe,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IA6BhH;;;;;;;;OAQG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;CAOlF"}
+{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAA+D,MAAM,eAAe,CAAC;AAG9J,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA+E,cAAc,EAAwC,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAgB,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IA8H3J;;;;;;;;OAQG;IAGU,MAAM,CAAe,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IA6BhH;;;;;;;;OAQG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;CAOlF"}

package/lib/mjs/controllers/LoginController.js

@@ -12,7 +12,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { UserLoginDto } from '../dto/userLogin-dto.js';
 import { BaseController, BasePath, Post, Body, Ok, Get, Cookie, Unauthorized, Policy } from '@spinajs/http';
-import { AuthProvider, SessionProvider, login, UserSession, AccessControl, _unwindGrants } from '@spinajs/rbac';
+import { AuthProvider, SessionProvider, login, UserSession, AccessControl, _unwindGrants, sessionCookieMaxAge, AthenticationErrorCodes } from '@spinajs/rbac';
+import { ErrorCode, InvalidArgument } from '@spinajs/exceptions';
 import { Autoinject, DI } from '@spinajs/di';
 import { AutoinjectService, Config, Configuration } from '@spinajs/configuration';
 import { LoggedPolicy, User as UserRouteArg, Session as SessionRouteArg, FromSession, SkipModelPermission } from '@spinajs/rbac-http';
@@ -44,21 +45,6 @@ let LoginController = class LoginController extends BaseController {
             }
             const user = await login(credentials.Email, credentials.Password);
             const session = new UserSession();
-            const coockies = [
-                {
-                    Name: 'ssid',
-                    Value: session.SessionId,
-                    Options: {
-                        signed: true,
-                        httpOnly: true,
-                        // set expiration time in ms
-                        maxAge: this.SessionExpirationTime * 1000,
-                        // any optopnal cookie options
-                        // or override default ones
-                        ...this.SessionCookieConfig
-                    },
-                },
-            ];
             let result;
             session.Data.set('User', user.Uuid);
             // Default active role = first role from the user's role list.
@@ -73,8 +59,6 @@ let LoginController = class LoginController extends BaseController {
             //              user is automatically authorized at login
             session.Data.set('Logged', true);
             session.UserId = user.Id;
-            // set expiration time ( default val in config )
-            session.extend();
             if (this.TwoFactorAuthForceUser && !user.Metadata['2fa:enabled']) {
                 this._log.trace('User logged in, 2fa init required', {
                     Uuid: user.Uuid
@@ -107,13 +91,43 @@ let LoginController = class LoginController extends BaseController {
             this._log.trace('User logged in, no 2fa required', {
                 Uuid: user.Uuid
             });
+            // save() schedules the session's initial expiration via the configured
+            // strategy; the cookie maxAge is then derived from that real expiry (B1),
+            // no longer the bogus `expiration * 1000` (~2 min) value.
             await this.SessionProvider.save(session);
+            const coockies = [
+                {
+                    Name: 'ssid',
+                    Value: session.SessionId,
+                    Options: {
+                        signed: true,
+                        httpOnly: true,
+                        // cookie lifetime tracks the session's real expiration
+                        maxAge: sessionCookieMaxAge(session),
+                        // any optional cookie options / override default ones
+                        ...this.SessionCookieConfig
+                    },
+                },
+            ];
             return new Ok(result, {
                 Coockies: coockies
             });
         }
         catch (err) {
-            this._log.error(err);
+            // Only real authentication failures map to 401. ErrorCode comes from the
+            // AuthProvider ( bad credentials / banned / inactive ), InvalidArgument
+            // from the `_check_arg` guards ( empty or malformed email / password ).
+            // Anything else — db down, session store failure, misconfiguration — was
+            // previously masked as "login or password incorrect", hiding real
+            // outages behind a 401. Those are rethrown so the http error handler
+            // maps them to a 500 and logs the full stack.
+            const isAuthFailure = err instanceof ErrorCode || err instanceof InvalidArgument;
+            if (!isAuthFailure) {
+                this._log.error(err, `Login failed unexpectedly for ${credentials?.Email}`);
+                throw err;
+            }
+            const reason = err instanceof ErrorCode ? AthenticationErrorCodes[err.code] ?? err.code : 'E_INVALID_ARGUMENT';
+            this._log.warn(err, `Login failed for ${credentials?.Email}: ${reason}`);
             return new Unauthorized({
                 error: {
                     code: 'E_AUTH_FAILED',
@@ -184,12 +198,6 @@ __decorate([
     AutoinjectService('rbac.session'),
     __metadata("design:type", SessionProvider)
 ], LoginController.prototype, "SessionProvider", void 0);
-__decorate([
-    Config('rbac.session.expiration', {
-        defaultValue: 120,
-    }),
-    __metadata("design:type", Number)
-], LoginController.prototype, "SessionExpirationTime", void 0);
 __decorate([
     Config('rbac.twoFactorAuth.enabled', {
         defaultValue: false,

package/lib/mjs/controllers/LoginController.js.map

@@ -1 +1 @@
-{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAG7D;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IAgCjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAgB,IAAY,EAAU,WAAyB;QAC5G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,OAAO,CAAC,SAAS;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBAEd,4BAA4B;wBAC5B,MAAM,EAAE,IAAI,CAAC,qBAAqB,GAAG,IAAI;wBAEzC,8BAA8B;wBAC9B,2BAA2B;wBAC3B,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF,CAAC;YACF,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,gDAAgD;YAChD,OAAO,CAAC,MAAM,EAAE,CAAC;YAIjB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3E,qFAAqF;gBACrF,iFAAiF;gBACjF,MAAM,GAAG;oBACP,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,yFAAyF;oBAC1G,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,cAAc;iBACO,CAAC;YAClC,CAAC;YAGD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErB,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAe,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB;QAE/E,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AApNW;IADT,UAAU,EAAE;8BACY,aAAa;sDAAC;AAG7B;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;qDAAC;AAG3B;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;wDAAC;AAKjC;IAHT,MAAM,CAAC,yBAAyB,EAAE;QACjC,YAAY,EAAE,GAAG;KAClB,CAAC;;8DACsC;AAK9B;IAHT,MAAM,CAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,MAAM,CAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;4DACC;AAGzB;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;2CAAC;AAcf;IAFZ,IAAI,EAAE;IACN,mBAAmB,EAAE;IACF,WAAA,YAAY,EAAE,CAAA;IAAgB,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAzC,IAAI,UAAmD,YAAY;;4CA8G7G;AAaY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,eAAe,EAAE,CAAA;IAAqB,WAAA,YAAY,EAAE,CAAA;;qDAAO,IAAI;;6CA2B/G;AAaY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;;qCAApB,IAAI;;6CAM7C;AArNU,eAAe;IAD3B,QAAQ,CAAC,MAAM,CAAC;GACJ,eAAe,CAsN3B"}
+{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC9J,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAG7D;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAgB,IAAY,EAAU,WAAyB;QAC5G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3E,qFAAqF;gBACrF,iFAAiF;gBACjF,MAAM,GAAG;oBACP,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,yFAAyF;oBAC1G,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,cAAc;iBACO,CAAC;YAClC,CAAC;YAGD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,OAAO,CAAC,SAAS;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBAEd,uDAAuD;wBACvD,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC;wBAEpC,sDAAsD;wBACtD,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF,CAAC;YAEF,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,eAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAe,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB;QAE/E,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7NW;IADT,UAAU,EAAE;8BACY,aAAa;sDAAC;AAG7B;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;qDAAC;AAG3B;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;wDAAC;AAKjC;IAHT,MAAM,CAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,MAAM,CAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;4DACC;AAGzB;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;2CAAC;AAcf;IAFZ,IAAI,EAAE;IACN,mBAAmB,EAAE;IACF,WAAA,YAAY,EAAE,CAAA;IAAgB,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAzC,IAAI,UAAmD,YAAY;;4CA4H7G;AAaY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,eAAe,EAAE,CAAA;IAAqB,WAAA,YAAY,EAAE,CAAA;;qDAAO,IAAI;;6CA2B/G;AAaY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;;qCAApB,IAAI;;6CAM7C;AA9NU,eAAe;IAD3B,QAAQ,CAAC,MAAM,CAAC;GACJ,eAAe,CA+N3B"}

package/lib/mjs/controllers/TwoFactorAuthController.d.ts

@@ -14,6 +14,7 @@ import { IEnable2faResponse, IUserWithGrants } from "@spinajs/rbac-http";
 export declare class TwoFactorAuthController extends BaseController {
     protected Queue: QueueService;
     protected SessionProvider: SessionProvider;
+    protected SessionCookieConfig: any;
     protected AC: AccessControl;
     /**
      * Enable two-factor authentication
@@ -45,5 +46,11 @@ export declare class TwoFactorAuthController extends BaseController {
      * @response 401 Unauthorized — valid session required
      */
     verifyToken(logged: UserModel, token: TokenDto, session: ISession): Promise<Ok<IUserWithGrants> | ForbiddenResponse>;
+    /**
+     * Verifies the supplied TOTP token against the user's 2FA secret. Wraps the
+     * module-level `auth2Fa` action in a protected method so tests can stub the
+     * verification without a TOTP/DB setup.
+     */
+    protected verifyTwoFactorToken(user: UserModel, token: string): Promise<void>;
 }
 //# sourceMappingURL=TwoFactorAuthController.d.ts.map

package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnI,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;CA4C/J"}
+{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAA0C,MAAM,eAAe,CAAC;AAO3K,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAgE5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhF"}