@spinajs/rbac-http-user 2.0.485 → 2.0.487

package/lib/cjs/config/rbac-http.d.ts

@@ -40,27 +40,12 @@ declare const rbacHttp: {
             forceUser: boolean;
             service: string;
         };
-        fingerprint: {
-            enabled: boolean;
-            maxDevices: number;
-            service: string;
-        };
-        session: {
-            cookie: {
-                sameSite: string;
-            };
-        };
         password: {
-            tokenTTL: number;
             /**
              * Block account after invalid login attempts
              */
             blockAfterAttempts: number;
         };
-        /**
-         * Should federated login be enabled ? eg. facebook
-         */
-        allowFederated: boolean;
     };
     http: {};
 };

package/lib/cjs/config/rbac-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;YAiBR;;eAEG;;YAGH;;eAEG;;;;;;;;;;;;;;;;;;;;;;;YAyBH;;eAEG;;;QAGL;;WAEG;;;;CAQN,CAAC;AAEF,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"rbac-http.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;YAiBR;;eAEG;;YAGH;;eAEG;;;;;;;;;;;;YAmBH;;eAEG;;;;;CASR,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/lib/cjs/config/rbac-http.js

@@ -39,28 +39,18 @@ const rbacHttp = {
             forceUser: false,
             service: 'Default2FaToken',
         },
-        fingerprint: {
-            enabled: false,
-            maxDevices: 3,
-            service: 'FingerprintJs',
-        },
-        session: {
-            cookie: {
-                sameSite: 'lax'
-            }
-        },
+        // NOTE: the session cookie ( `rbac.session.cookie` ) is configured by
+        // @spinajs/rbac and defaults to Secure + SameSite=Strict + HttpOnly. This
+        // package used to weaken it to SameSite=Lax here, which is what let a
+        // cross-site GET reach the logout route.
         password: {
-            // password reset token ttl in minutes
-            tokenTTL: 60,
+            // NOTE: the password reset token's lifetime is `rbac.password.passwordResetWaitTime`
+            // ( seconds, defined by @spinajs/rbac ) — this package does not restate it.
             /**
              * Block account after invalid login attempts
              */
             blockAfterAttempts: 3,
         },
-        /**
-         * Should federated login be enabled ? eg. facebook
-         */
-        allowFederated: false,
     },
     http: {
     // middlewares: [

package/lib/cjs/config/rbac-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http.js","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3K,CAAC;AAGD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAClB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,cAAc,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACvD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SACtD;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP;;eAEG;YACH,MAAM,EAAE,SAAS;YAEjB;;eAEG;YACH,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC;SACV;QACD,aAAa,EAAE;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB;SAC3B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,eAAe;SACzB;QACD,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK;aAChB;SACF;QACD,QAAQ,EAAE;YACR,sCAAsC;YACtC,QAAQ,EAAE,EAAE;YAEZ;;eAEG;YACH,kBAAkB,EAAE,CAAC;SACtB;QACD;;WAEG;QACH,cAAc,EAAE,KAAK;KACtB;IACD,IAAI,EAAE;IACJ,iBAAiB;IACjB,+CAA+C;IAC/C,KAAK;KACN;CACF,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"rbac-http.js","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3K,CAAC;AAGD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAClB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,cAAc,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACvD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SACtD;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP;;eAEG;YACH,MAAM,EAAE,SAAS;YAEjB;;eAEG;YACH,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC;SACV;QACD,aAAa,EAAE;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB;SAC3B;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,yCAAyC;QACzC,QAAQ,EAAE;YACR,qFAAqF;YACrF,4EAA4E;YAE5E;;eAEG;YACH,kBAAkB,EAAE,CAAC;SACtB;KACF;IACD,IAAI,EAAE;IACJ,iBAAiB;IACjB,+CAA+C;IAC/C,KAAK;KACN;CACF,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/lib/cjs/controllers/ActiveRoleController.d.ts

@@ -3,6 +3,7 @@ import { BaseController, Ok, BadRequestResponse, Unauthorized } from '@spinajs/h
 import { AccessControl, AuthProvider, PasswordProvider, SessionProvider } from '@spinajs/rbac';
 import type { ISession, User } from '@spinajs/rbac';
 import { IActiveRoleResponse } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Active role endpoints.
  * Let users with multiple roles inspect and switch the currently active role.
@@ -16,7 +17,7 @@ export declare class ActiveRoleController extends BaseController {
     protected PasswordProvider: PasswordProvider;
     protected SessionProvider: SessionProvider;
     protected RolesRequiringPassword: string[];
-    protected SessionCookieConfig: any;
+    protected SessionCookies: SessionCookieFactory;
     /**
      * Get active role
      * Returns the currently active role for the session and the RBAC grants

package/lib/cjs/controllers/ActiveRoleController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
+{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IA0CvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAMjE"}

package/lib/cjs/controllers/ActiveRoleController.js

@@ -19,6 +19,8 @@ const rbac_1 = require("@spinajs/rbac");
 const di_1 = require("@spinajs/di");
 const configuration_1 = require("@spinajs/configuration");
 const rbac_http_1 = require("@spinajs/rbac-http");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
+const grants_js_1 = require("../services/grants.js");
 /**
  * Active role endpoints.
  * Let users with multiple roles inspect and switch the currently active role.
@@ -81,25 +83,13 @@ let ActiveRoleController = class ActiveRoleController extends http_1.BaseControl
         // fixation, and reset the ssid cookie to the new id.
         const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
         return new http_1.Ok(this.buildResponse(payload.Role), {
-            Coockies: [
-                {
-                    Name: 'ssid',
-                    Value: regenerated.SessionId,
-                    Options: {
-                        signed: true,
-                        httpOnly: true,
-                        maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
-                        ...this.SessionCookieConfig,
-                    },
-                },
-            ],
+            Coockies: [this.SessionCookies.issue(regenerated)],
         });
     }
     buildResponse(activeRole) {
-        const grants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
         return {
             ActiveRole: activeRole,
-            Grants: grants,
+            Grants: (0, grants_js_1.grantsFor)(this.AC, activeRole),
         };
     }
 };
@@ -125,9 +115,9 @@ __decorate([
     __metadata("design:type", Array)
 ], ActiveRoleController.prototype, "RolesRequiringPassword", void 0);
 __decorate([
-    (0, configuration_1.Config)('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], ActiveRoleController.prototype, "SessionCookieConfig", void 0);
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], ActiveRoleController.prototype, "SessionCookies", void 0);
 __decorate([
     (0, http_1.Get)('active-role'),
     (0, http_1.Policy)(rbac_http_1.LoggedPolicy),

package/lib/cjs/controllers/ActiveRoleController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,wCAAsJ;AAEtJ,oCAAyC;AACzC,0DAAmE;AACnE,kDAAsI;AAEtI;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAc;IAmBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;oBAC5B,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;wBACxC,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AA7GY,oDAAoB;AAErB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;gDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;0DAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;8DAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;6DAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACC;AAYtB;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IACO,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;uDAAU,iCAAa;;4DAoD/B;+BApGU,oBAAoB;IADhC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,oBAAoB,CA6GhC"}
+{"version":3,"file":"ActiveRoleController.js","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gEAAyD;AACzD,wCAAwH;AACxH,wCAAkH;AAElH,oCAAyC;AACzC,0DAAmE;AACnE,kDAAsI;AACtI,qEAAqE;AACrE,qDAAkD;AAElD;;;;;;GAMG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAc;IAmBtD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,aAAa,CAAiB,IAAU,EAAiB,UAAkB;QACtF,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,gBAAgB,CACX,IAAU,EACP,OAAiB,EAC5B,OAAsB;QAE9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,2BAA2B;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,0CAA0C,OAAO,CAAC,IAAI,GAAG;qBACnE;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kBAAkB;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAES,aAAa,CAAC,UAAkB;QACxC,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,IAAA,qBAAS,EAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SACvC,CAAC;IACJ,CAAC;CACF,CAAA;AAjGY,oDAAoB;AAErB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;gDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;0DAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;8DAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;6DAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,EAAc,EAAE,CAAC;;oEACjC;AAGjC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;4DAAC;AAYlC;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IACO,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;yDAEpE;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;uDAAU,iCAAa;;4DAyC/B;+BAzFU,oBAAoB;IADhC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,oBAAoB,CAiGhC"}

package/lib/cjs/controllers/ImpersonationController.d.ts

@@ -1,8 +1,10 @@
 import { ImpersonateDto } from '../dto/impersonate-dto.js';
 import { BaseController, Ok, BadRequestResponse, Unauthorized, ForbiddenResponse, Conflict, NotFound } from '@spinajs/http';
-import { AccessControl, PasswordProvider, SessionProvider, User, UserImpersonationStarted, UserImpersonationEnded } from '@spinajs/rbac';
+import { AccessControl, PasswordProvider, User, UserImpersonationStarted } from '@spinajs/rbac';
 import type { ISession } from '@spinajs/rbac';
 import { IImpersonationResponse, IImpersonationState, IUserWithGrants } from '@spinajs/rbac-http';
+import { ImpersonationService } from '../services/ImpersonationService.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Impersonation endpoints.
  *
@@ -17,7 +19,8 @@ import { IImpersonationResponse, IImpersonationState, IUserWithGrants } from '@s
 export declare class ImpersonationController extends BaseController {
     protected AC: AccessControl;
     protected PasswordProvider: PasswordProvider;
-    protected SessionProvider: SessionProvider;
+    protected Impersonation: ImpersonationService;
+    protected SessionCookies: SessionCookieFactory;
     protected RequirePassword: boolean;
     protected ProtectedRoles: string[];
     /**
@@ -56,17 +59,12 @@ export declare class ImpersonationController extends BaseController {
      * Emit an impersonation lifecycle event. Wrapped in a protected method so
      * tests can intercept without stubbing module-level ESM bindings.
      */
-    protected emitEvent(event: UserImpersonationStarted | UserImpersonationEnded): Promise<void>;
+    protected emitEvent(event: UserImpersonationStarted): Promise<void>;
     /**
      * Load the impersonation target (with Metadata so IsBanned works). Extracted
      * as a protected method so tests can stub it without setting up a database.
      */
     protected loadTarget(uuid: string): Promise<User | undefined>;
-    /**
-     * Load the original (impersonator) user. Extracted for the same reason as
-     * loadTarget — keeps the controller easy to test in isolation.
-     */
-    protected loadOriginal(uuid: string): Promise<User | undefined>;
-    protected buildResponse(target: User, impersonator: User, activeRole: string, startedAt: string): IImpersonationResponse;
+    protected buildResponse(target: User, impersonator: User, activeRole: string | undefined, startedAt: string): IImpersonationResponse;
 }
 //# sourceMappingURL=ImpersonationController.d.ts.map

package/lib/cjs/controllers/ImpersonationController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAA6B,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAU,MAAM,eAAe,CAAC;AACpK,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,IAAI,EACJ,wBAAwB,EACxB,sBAAsB,EAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAKL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAI5B;;;;;;;;;;GAUG;AACH,qBACa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC;IAGnC,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEnC;;;;;;OAMG;IAGU,QAAQ,CACJ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,sBAAsB,EAAE,MAAM,GAC5C,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAYnC;;;;;;;;;;;;;;OAcG;IAGU,KAAK,CACA,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,cAAc,GAC9B,OAAO,CACR,EAAE,CAAC,sBAAsB,CAAC,GAAG,kBAAkB,GAAG,YAAY,GAAG,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CACzG;IAsFD;;;;;;OAMG;IAGU,IAAI,CACC,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,GACnC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;IA4CpD;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5F;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI7D;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI/D,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,sBAAsB;CAUzH"}
+{"version":3,"file":"ImpersonationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAA6B,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAU,MAAM,eAAe,CAAC;AACpK,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,wBAAwB,EAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAKL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE;;;;;;;;;;GAUG;AACH,qBACa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAG9C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC;IAGnC,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEnC;;;;;;OAMG;IAGU,QAAQ,CACJ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,sBAAsB,EAAE,MAAM,GAC5C,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAYnC;;;;;;;;;;;;;;OAcG;IAGU,KAAK,CACA,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,cAAc,GAC9B,OAAO,CACR,EAAE,CAAC,sBAAsB,CAAC,GAAG,kBAAkB,GAAG,YAAY,GAAG,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CACzG;IA+ED;;;;;;OAMG;IAGU,IAAI,CACC,MAAM,EAAE,IAAI,EACT,OAAO,EAAE,QAAQ,GACnC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;IAwBpD;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI7D,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,IAAI,EACZ,YAAY,EAAE,IAAI,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,GAChB,sBAAsB;CAS1B"}

package/lib/cjs/controllers/ImpersonationController.js

@@ -21,6 +21,9 @@ const configuration_1 = require("@spinajs/configuration");
 const queue_1 = require("@spinajs/queue");
 const luxon_1 = require("luxon");
 const rbac_http_1 = require("@spinajs/rbac-http");
+const ImpersonationService_js_1 = require("../services/ImpersonationService.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
+const grants_js_1 = require("../services/grants.js");
 const IMPERSONATE_RESOURCE = 'user:impersonate';
 /**
  * Impersonation endpoints.
@@ -68,7 +71,7 @@ let ImpersonationController = class ImpersonationController extends http_1.BaseC
      * @response 409 An impersonation is already in progress for this session
      */
     async start(caller, session, payload) {
-        if (session?.Data.get('Impersonator')) {
+        if (this.Impersonation.isActive(session)) {
             return new http_1.Conflict({
                 error: {
                     code: 'E_IMPERSONATION_ACTIVE',
@@ -124,24 +127,18 @@ let ImpersonationController = class ImpersonationController extends http_1.BaseC
                 return new http_1.Unauthorized({ error: { code: 'E_PASSWORD_INVALID', message: 'Invalid password' } });
             }
         }
-        // Persist impersonation state. We keep the impersonator's previous
-        // ActiveRole so it can be restored on stop; effective ActiveRole becomes
-        // the target's first role.
+        // Persist impersonation state. The service keeps the impersonator's
+        // previous ActiveRole so it can be restored on stop; effective ActiveRole
+        // becomes the target's first role.
         const startedAt = luxon_1.DateTime.now().toISO();
-        const previousActiveRole = session.Data.get('ActiveRole');
-        session.Data.set('Impersonator', caller.Uuid);
-        session.Data.set('User', target.Uuid);
-        session.Data.set('ImpersonationStartedAt', startedAt);
-        if (previousActiveRole !== undefined) {
-            session.Data.set('OriginalActiveRole', previousActiveRole);
-        }
-        const targetActiveRole = target.Role?.[0];
-        if (targetActiveRole) {
-            session.Data.set('ActiveRole', targetActiveRole);
-        }
-        await this.SessionProvider.save(session);
+        const { Session: regenerated, ActiveRole: targetActiveRole } = await this.Impersonation.start(session, caller, target, startedAt);
         await this.emitEvent(new rbac_1.UserImpersonationStarted(caller, target));
-        return new http_1.Ok(this.buildResponse(target, caller, targetActiveRole, startedAt));
+        // The session id changed with the identity — hand the client the new one or
+        // its next request arrives with a session that no longer exists.
+        return new http_1.Ok(this.buildResponse(target, caller, targetActiveRole, startedAt), {
+            Coockies: [this.SessionCookies.issue(regenerated)],
+            Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+        });
     }
     /**
      * Stop impersonation
@@ -151,41 +148,23 @@ let ImpersonationController = class ImpersonationController extends http_1.BaseC
      * @response 400 No impersonation is currently active
      */
     async stop(target, session) {
-        const impersonatorUuid = session?.Data.get('Impersonator');
-        if (!impersonatorUuid) {
+        const result = await this.Impersonation.revert(session, target);
+        if (result.Status === 'not-impersonating') {
             return new http_1.BadRequestResponse({
                 error: { code: 'E_NO_IMPERSONATION', message: 'No impersonation is currently in progress' },
             });
         }
-        const original = await this.loadOriginal(impersonatorUuid);
-        if (!original) {
-            // Stale session referencing a deleted impersonator — destroy the
-            // impersonation block to recover but report an error so the caller
-            // can re-authenticate.
-            session.Data.delete('Impersonator');
-            session.Data.delete('ImpersonationStartedAt');
-            session.Data.delete('OriginalActiveRole');
-            await this.SessionProvider.save(session);
+        if (result.Status === 'impersonator-gone') {
+            // Stale session referencing a deleted impersonator. The service already
+            // cleared the impersonation block to recover; report an error so the
+            // caller can re-authenticate.
             return new http_1.BadRequestResponse({
                 error: { code: 'E_IMPERSONATOR_GONE', message: 'Original user no longer exists' },
             });
         }
-        // Restore the original session state.
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
-        }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(new rbac_1.UserImpersonationEnded(original, target));
-        const grants = restoredActiveRole ? (0, rbac_1._unwindGrants)(restoredActiveRole, this.AC.getGrants()) : {};
-        return new http_1.Ok({
-            ...original.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
-            ActiveRole: restoredActiveRole,
-            Grants: grants,
+        return new http_1.Ok((0, grants_js_1.buildUserWithGrants)(result.Original, result.ActiveRole, this.AC), {
+            Coockies: [this.SessionCookies.issue(result.Session)],
+            Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
         });
     }
     /**
@@ -202,20 +181,12 @@ let ImpersonationController = class ImpersonationController extends http_1.BaseC
     loadTarget(uuid) {
         return rbac_1.User.query().whereUuid(uuid).populate('Metadata').notDeleted().first();
     }
-    /**
-     * Load the original (impersonator) user. Extracted for the same reason as
-     * loadTarget — keeps the controller easy to test in isolation.
-     */
-    loadOriginal(uuid) {
-        return rbac_1.User.getByUuid(uuid);
-    }
     buildResponse(target, impersonator, activeRole, startedAt) {
-        const grants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
         return {
             User: target.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
             Impersonator: impersonator.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
             ActiveRole: activeRole,
-            Grants: grants,
+            Grants: (0, grants_js_1.grantsFor)(this.AC, activeRole),
             StartedAt: startedAt,
         };
     }
@@ -230,9 +201,13 @@ __decorate([
     __metadata("design:type", rbac_1.PasswordProvider)
 ], ImpersonationController.prototype, "PasswordProvider", void 0);
 __decorate([
-    (0, configuration_1.AutoinjectService)('rbac.session'),
-    __metadata("design:type", rbac_1.SessionProvider)
-], ImpersonationController.prototype, "SessionProvider", void 0);
+    (0, di_1.Autoinject)(ImpersonationService_js_1.ImpersonationService),
+    __metadata("design:type", ImpersonationService_js_1.ImpersonationService)
+], ImpersonationController.prototype, "Impersonation", void 0);
+__decorate([
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], ImpersonationController.prototype, "SessionCookies", void 0);
 __decorate([
     (0, configuration_1.Config)('rbac.impersonation.requirePassword', { defaultValue: true }),
     __metadata("design:type", Boolean)

package/lib/cjs/controllers/ImpersonationController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationController.js","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,kEAA2D;AAC3D,wCAAoK;AACpK,wCASuB;AAEvB,oCAAyC;AACzC,0DAAmE;AACnE,0CAAqC;AACrC,iCAAiC;AACjC,kDAQ4B;AAE5B,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD;;;;;;;;;;GAUG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAgBzD;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACJ,YAAoB,EACpB,IAAY,EACZ,sBAA8B;QAE7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,SAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,SAAE,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,YAAY;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAGU,AAAN,KAAK,CAAC,KAAK,CACA,MAAY,EACT,OAAiB,EAC5B,OAAuB;QAI/B,IAAI,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,eAAQ,CAAC;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,wFAAwF;iBAClG;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,6BAA6B,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,MAAM,UAAU,GAAI,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,MAAM,OAAO,GAAI,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,WAAW,KAAK,iCAAiC,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC;YAC3B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;YACzC,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB;oBACzF,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB;wBACxC,CAAC,CAAC,gCAAgC,KAAK,CAAC,MAAM,8BAA8B;wBAC5E,CAAC,CAAC,kDAAkD,KAAK,CAAC,MAAM,GAAG;iBACtE;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,0DAA0D,EAAE;iBAC5G,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,SAAS,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAG,CAAC;QAC1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;QAEhF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,+BAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,IAAI,CACC,MAAY,EACT,OAAiB;QAEpC,MAAM,gBAAgB,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QACjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2CAA2C,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iEAAiE;YACjE,mEAAmE;YACnE,uBAAuB;YACvB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,SAAE,CAAC;YACZ,GAAI,QAAQ,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAS;YACtE,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE,MAAM;SACI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,KAAwD;QAC1E,OAAO,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,IAAY;QAC/B,OAAO,WAAI,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAA+B,CAAC;IAC7G,CAAC;IAED;;;OAGG;IACO,YAAY,CAAC,IAAY;QACjC,OAAO,WAAI,CAAC,SAAS,CAAC,IAAI,CAA8B,CAAC;IAC3D,CAAC;IAES,aAAa,CAAC,MAAY,EAAE,YAAkB,EAAE,UAAkB,EAAE,SAAiB;QAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACrE,YAAY,EAAE,YAAY,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACnF,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;CACF,CAAA;AAhPY,0DAAuB;AAExB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;iEAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,oCAAoC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;gEAClC;AAGzB;IADT,IAAA,sBAAM,EAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAa,EAAE,CAAC;;+DACnD;AAWtB;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,uBAAW,GAAE,CAAA;IACb,WAAA,IAAA,uBAAW,GAAE,CAAA;IACb,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;uDAWf;AAmBY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAFiB,WAAI,UAEX,mCAAc;;oDAuFhC;AAWY;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCADM,WAAI;;mDA4C7B;kCA5MU,uBAAuB;IADnC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,uBAAuB,CAgPnC"}
+{"version":3,"file":"ImpersonationController.js","sourceRoot":"","sources":["../../../src/controllers/ImpersonationController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,kEAA2D;AAC3D,wCAAoK;AACpK,wCAMuB;AAEvB,oCAAyC;AACzC,0DAAmE;AACnE,0CAAqC;AACrC,iCAAiC;AACjC,kDAQ4B;AAC5B,iFAA2E;AAC3E,qEAAqE;AACrE,qDAAuE;AAEvE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD;;;;;;;;;;GAUG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAmBzD;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACJ,YAAoB,EACpB,IAAY,EACZ,sBAA8B;QAE7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,SAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,SAAE,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,YAAY;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAGU,AAAN,KAAK,CAAC,KAAK,CACA,MAAY,EACT,OAAiB,EAC5B,OAAuB;QAI/B,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,eAAQ,CAAC;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,wFAAwF;iBAClG;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,6BAA6B,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,MAAM,UAAU,GAAI,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,MAAM,OAAO,GAAI,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,WAAW,KAAK,iCAAiC,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC;YAC3B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;YACzC,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB;oBACzF,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB;wBACxC,CAAC,CAAC,gCAAgC,KAAK,CAAC,MAAM,8BAA8B;wBAC5E,CAAC,CAAC,kDAAkD,KAAK,CAAC,MAAM,GAAG;iBACtE;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,mBAAY,CAAC;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,0DAA0D,EAAE;iBAC5G,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,mBAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,SAAS,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAG,CAAC;QAC1C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAElI,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,+BAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE,4EAA4E;QAC5E,iEAAiE;QACjE,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE;YAC7E,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,IAAI,CACC,MAAY,EACT,OAAiB;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC1C,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2CAA2C,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC1C,wEAAwE;YACxE,qEAAqE;YACrE,8BAA8B;YAC9B,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;YAC9E,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,KAA+B;QACjD,OAAO,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,IAAY;QAC/B,OAAO,WAAI,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAA+B,CAAC;IAC7G,CAAC;IAES,aAAa,CACrB,MAAY,EACZ,YAAkB,EAClB,UAA8B,EAC9B,SAAiB;QAEjB,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACrE,YAAY,EAAE,YAAY,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAQ;YACnF,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,IAAA,qBAAS,EAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACtC,SAAS,EAAE,SAAS;SACK,CAAC;IAC9B,CAAC;CACF,CAAA;AApNY,0DAAuB;AAExB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAGlB;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;iEAAC;AAGnC;IADT,IAAA,eAAU,EAAC,8CAAoB,CAAC;8BACR,8CAAoB;8DAAC;AAGpC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;+DAAC;AAGrC;IADT,IAAA,sBAAM,EAAC,oCAAoC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;gEAClC;AAGzB;IADT,IAAA,sBAAM,EAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAa,EAAE,CAAC;;+DACnD;AAWtB;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,uBAAW,GAAE,CAAA;IACb,WAAA,IAAA,uBAAW,GAAE,CAAA;IACb,WAAA,IAAA,uBAAW,GAAE,CAAA;;;;uDAWf;AAmBY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;IACjB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAFiB,WAAI,UAEX,mCAAc;;oDAgFhC;AAWY;IAFZ,IAAA,UAAG,EAAC,aAAa,CAAC;IAClB,IAAA,aAAM,EAAC,wBAAY,CAAC;IAElB,WAAA,IAAA,gBAAY,GAAE,CAAA;IACd,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCADM,WAAI;;mDAwB7B;kCApLU,uBAAuB;IADnC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,uBAAuB,CAoNnC"}

package/lib/cjs/controllers/LoginController.d.ts

@@ -5,6 +5,7 @@ import { Configuration } from '@spinajs/configuration';
 import { ILoginResponse } from '@spinajs/rbac-http';
 import { User } from '@spinajs/rbac';
 import type { ISession } from '@spinajs/rbac';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Authentication endpoints.
  * Handles user login, logout, and current-session inspection.
@@ -17,7 +18,7 @@ export declare class LoginController extends BaseController {
     protected SessionProvider: SessionProvider;
     protected TwoFactorAuthEnabled: boolean;
     protected TwoFactorAuthForceUser: boolean;
-    protected SessionCookieConfig: any;
+    protected SessionCookies: SessionCookieFactory;
     protected AC: AccessControl;
     /**
      * Login
@@ -36,6 +37,10 @@ export declare class LoginController extends BaseController {
      * If an impersonation is active, the session is NOT destroyed — instead the
      * impersonation is ended and the original user resumes their session.
      * Requires the user to be logged in (session exists), but full authorization (2FA) is not required.
+     *
+     * POST, not GET: under `SameSite=Lax` a cookie rides a top-level cross-site
+     * GET, so a third-party page could log any visitor out simply by linking to
+     * this route.
      * @security cookieAuth
      * @response 401 No active session
      */
@@ -43,18 +48,20 @@ export declare class LoginController extends BaseController {
     /**
      * Get current user
      * Returns the user object associated with the current session along with the
-     * currently active role. Roles the user may switch to are listed in Role.
+     * currently active role and whether the session has completed 2FA (when
+     * required). Roles the user may switch to are listed in Role.
      * Requires the user to be logged in (session exists), but full authorization (2FA) is not required.
      * @security cookieAuth
      * @returns {User} User data from the current session
      * @response 401 No active session
      */
-    whoami(User: User, ActiveRole: string): Promise<Ok<{
+    whoami(User: User, ActiveRole: string, session: ISession): Promise<Ok<{
         ActiveRole: string;
-        Id: number;
-        Uuid: string;
+        Authorized: {};
         Email: string;
         Password: string;
+        Id: number;
+        Uuid: string;
         Login: string;
         Role: string[];
         CreatedAt: import("luxon").DateTime;

package/lib/cjs/controllers/LoginController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAe,YAAY,EAAU,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAA+D,MAAM,eAAe,CAAC;AAG9J,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA+E,cAAc,EAAwC,MAAM,oBAAoB,CAAC;AACvK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAgB,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IA8H3J;;;;;;;;OAQG;IAGU,MAAM,CAAe,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IA6BhH;;;;;;;;OAQG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;CAOlF"}
+{"version":3,"file":"LoginController.d.ts","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,YAAY,EAAU,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAsB,aAAa,EAA0C,MAAM,eAAe,CAAC;AAGzI,OAAO,EAA6B,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAA0F,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AACjK,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,cAAc;IAEjD,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IAGvC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAK3C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;IAMxC,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAG1C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;OASG;IAGU,KAAK,CAAiB,MAAM,EAAE,IAAI,EAAe,IAAI,EAAE,MAAM,EAAU,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IA8G1J;;;;;;;;;;;;OAYG;IAGU,MAAM,CAAc,IAAI,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ,EAAkB,IAAI,EAAE,IAAI;IAgC/G;;;;;;;;;OASG;IAGU,MAAM,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,EAAqB,OAAO,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;CAQxH"}