@spinajs/rbac-http-user 2.0.485 → 2.0.487

package/lib/mjs/controllers/TwoFactorAuthController.js

@@ -11,61 +11,58 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { TokenDto } from './../dto/token-dto.js';
-import { BaseController, BasePath, Ok, Post, Get, ForbiddenResponse } from '@spinajs/http';
-import { SessionProvider, User as UserModel, _unwindGrants, AccessControl, regenerateSession, sessionCookieMaxAge } from '@spinajs/rbac';
-import { Session } from "@spinajs/rbac-http";
+import { BaseController, BasePath, Ok, Post, ForbiddenResponse } from '@spinajs/http';
+import { SessionProvider, User as UserModel, AccessControl, regenerateSession } from '@spinajs/rbac';
+import { Session } from '@spinajs/rbac-http';
 import { Body, Policy } from '@spinajs/http';
 import { TwoFacRouteEnabled } from '../policies/2FaPolicy.js';
-import { AutoinjectService, Config } from '@spinajs/configuration';
+import { AutoinjectService } from '@spinajs/configuration';
 import { Autoinject } from '@spinajs/di';
-import { QueueService } from '@spinajs/queue';
-import { User, NotAuthorizedPolicy } from "@spinajs/rbac-http";
-import { auth2Fa, disableUser2Fa } from "./../actions/2fa.js";
-import { enableUser2Fa } from "../actions/2fa.js";
+import { User, NotAuthorizedPolicy } from '@spinajs/rbac-http';
+import { auth2Fa, enableUser2Fa } from '../actions/2fa.js';
 import { InvalidOperation } from '@spinajs/exceptions';
+import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
+import { activeRoleOf, buildUserWithGrants } from '../services/grants.js';
 /**
- * Two-factor authentication (TOTP) management.
- * Enables, disables, and verifies TOTP-based two-factor authentication for users.
- * All routes are only available when 2FA is enabled in the system configuration.
- * The caller must be logged in but does NOT need to be fully authorized (2FA verified),
- * allowing these routes to be used during the 2FA verification step itself.
+ * Two-factor authentication during login.
+ *
+ * These routes serve the narrow window between a successful password check and
+ * full authorization: the session is `Logged` but not `Authorized` and carries
+ * the `TwoFactorAuth` marker. Both class policies must hold, so the window
+ * closes the moment verification succeeds.
+ *
+ * Managing a TOTP device outside that window — enrolling for the first time, or
+ * turning 2FA off — lives on {@link TwoFactorAuthUserController} under
+ * `/user/2fa`, where the caller is fully authorized. Notably there is no
+ * "disable" here on purpose: a session that has not yet proven possession of
+ * the second factor must not be able to remove it, which would reduce the whole
+ * scheme to the password alone.
+ *
  * @tags Two-Factor Authentication
  */
 let TwoFactorAuthController = class TwoFactorAuthController extends BaseController {
     /**
-     * Enable two-factor authentication
-     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning URI
-     * to be scanned by an authenticator app. Throws if 2FA is already enabled for the user.
+     * Set up two-factor authentication during login
+     * Generates a TOTP secret for a user who must enrol before continuing — the state
+     * signalled by `TwoFactorInitRequired` at login when `rbac.twoFactorAuth.forceUser`
+     * is on. Returns the OTP provisioning URI to scan with an authenticator app; the
+     * caller then confirms with `POST /auth/2fa/verify`.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
      * @response 401 Unauthorized — valid session required
+     * @response 403 Session is not awaiting two-factor enrolment
      */
-    async enable2fa(user) {
-        if (user.Metadata['2fa:enabled']) {
+    async setup2fa(user) {
+        if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
             throw new InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
         }
         const result = await enableUser2Fa(user);
         return new Ok({
-            otp: result
+            otp: result,
         });
     }
-    /**
-     * Disable two-factor authentication
-     * Removes the TOTP secret and disables 2FA for the authenticated user.
-     * Throws if 2FA is not currently enabled for the user.
-     * @security cookieAuth
-     * @response 200 Two-factor authentication disabled successfully
-     * @response 400 Two-factor authentication is not enabled for this user
-     * @response 401 Unauthorized — valid session required
-     */
-    async disable2Fa(user) {
-        if (!user.Metadata['2fa:enabled']) {
-            throw new InvalidOperation(`User ${user.Uuid} already has 2fa disabled`);
-        }
-        await disableUser2Fa(user);
-        return new Ok();
-    }
     /**
      * Verify TOTP token
      * Validates the provided TOTP token against the user's 2FA secret. On success, marks the session
@@ -86,41 +83,22 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
             // id to defend against session fixation and reset the ssid cookie.
             const regenerated = await regenerateSession(this.SessionProvider, session);
             this._log.trace('User logged in, 2fa authorized', {
-                Uuid: logged.Uuid
+                Uuid: logged.Uuid,
             });
             // Mirror the login response shape: resolve grants for the session's
             // active role (falling back to the first role) and include ActiveRole,
             // instead of flattening every role with no ActiveRole reported.
-            const activeRole = session.Data.get('ActiveRole') ?? logged.Role?.[0];
-            const combinedGrants = activeRole ? _unwindGrants(activeRole, this.AC.getGrants()) : {};
-            return new Ok({
-                ...logged.dehydrateWithRelations({
-                    dateTimeFormat: "iso"
-                }),
-                Role: logged.Role,
-                ActiveRole: activeRole,
-                Grants: combinedGrants,
-            }, {
-                Coockies: [
-                    {
-                        Name: 'ssid',
-                        Value: regenerated.SessionId,
-                        Options: {
-                            signed: true,
-                            httpOnly: true,
-                            maxAge: sessionCookieMaxAge(regenerated),
-                            ...this.SessionCookieConfig,
-                        },
-                    },
-                ],
+            const activeRole = activeRoleOf(logged, session);
+            return new Ok(buildUserWithGrants(logged, activeRole, this.AC), {
+                Coockies: [this.SessionCookies.issue(regenerated)],
             });
         }
         catch (err) {
             if (err instanceof Error) {
-                this._log.error(err, "2fa verification failed");
+                this._log.error(err, '2fa verification failed');
             }
             else {
-                this._log.error("2fa verification failed", { error: err });
+                this._log.error('2fa verification failed', { error: err });
             }
             return new ForbiddenResponse({
                 error: {
@@ -139,36 +117,25 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
         return auth2Fa(user, token);
     }
 };
-__decorate([
-    Autoinject(QueueService),
-    __metadata("design:type", QueueService)
-], TwoFactorAuthController.prototype, "Queue", void 0);
 __decorate([
     AutoinjectService('rbac.session'),
     __metadata("design:type", SessionProvider)
 ], TwoFactorAuthController.prototype, "SessionProvider", void 0);
 __decorate([
-    Config('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], TwoFactorAuthController.prototype, "SessionCookieConfig", void 0);
+    Autoinject(SessionCookieFactory),
+    __metadata("design:type", SessionCookieFactory)
+], TwoFactorAuthController.prototype, "SessionCookies", void 0);
 __decorate([
     Autoinject(AccessControl),
     __metadata("design:type", AccessControl)
 ], TwoFactorAuthController.prototype, "AC", void 0);
 __decorate([
-    Get('2fa/enable'),
-    __param(0, User()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserModel]),
-    __metadata("design:returntype", Promise)
-], TwoFactorAuthController.prototype, "enable2fa", null);
-__decorate([
-    Get('2fa/disable'),
+    Post('2fa/setup'),
     __param(0, User()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [UserModel]),
     __metadata("design:returntype", Promise)
-], TwoFactorAuthController.prototype, "disable2Fa", null);
+], TwoFactorAuthController.prototype, "setup2fa", null);
 __decorate([
     Post('2fa/verify'),
     __param(0, User()),

package/lib/mjs/controllers/TwoFactorAuthController.js.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAA0B,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC3K,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAY,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAuC,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAavD;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE1C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,EAAE,CAAC;YACV,GAAG,EAAE,MAAgB;SACxB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QAErG,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;YAGH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAExF,OAAO,IAAI,EAAE,CAAC;gBACV,GAAG,MAAM,CAAC,sBAAsB,CAAC;oBAC7B,cAAc,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,cAAc;aACK,EAAE;gBAC7B,QAAQ,EAAE;oBACN;wBACI,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;wBAC5B,OAAO,EAAE;4BACL,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC;4BACxC,GAAG,IAAI,CAAC,mBAAmB;yBAC9B;qBACJ;iBACJ;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YAET,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,iBAAiB,CAAC;gBACzB,KAAK,EAAE;oBACH,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC9B;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QACzD,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAtIa;IADT,UAAU,CAAC,YAAY,CAAC;8BACR,YAAY;sDAAC;AAGpB;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;oEACC;AAGzB;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAYf;IADZ,GAAG,CAAC,YAAY,CAAC;IACM,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;wDAU7C;AAYY;IADZ,GAAG,CAAC,aAAa,CAAC;IACM,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;yDAO9C;AAYY;IADZ,IAAI,CAAC,YAAY,CAAC;IACO,WAAA,IAAI,EAAE,CAAA;IAAqB,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAA9C,SAAS,EAAiB,QAAQ;;0DA8D1E;AA9HQ,uBAAuB;IAHnC,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,kBAAkB,CAAC;IAC1B,MAAM,CAAC,mBAAmB,CAAC;GACf,uBAAuB,CAwInC"}
+{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAuC,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAUzD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;CACF,CAAA;AA3FW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;+DAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAef;IADZ,IAAI,CAAC,WAAW,CAAC;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;uDAS5C;AAYY;IADZ,IAAI,CAAC,YAAY,CAAC;IACO,WAAA,IAAI,EAAE,CAAA;IAAqB,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAA9C,SAAS,EAAiB,QAAQ;;0DAuC1E;AAnFU,uBAAuB;IAHnC,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,kBAAkB,CAAC;IAC1B,MAAM,CAAC,mBAAmB,CAAC;GACf,uBAAuB,CA6FnC"}

package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts

@@ -0,0 +1,98 @@
+import { BaseController, Ok, Unauthorized } from '@spinajs/http';
+import { PasswordProvider, SessionProvider, User as UserModel } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import { IEnable2faResponse } from '@spinajs/rbac-http';
+import { ConfirmPasswordDto } from '../dto/confirm-password-dto.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
+/** Whether the authenticated user currently has a TOTP device enrolled. */
+export interface ITwoFactorStatus {
+    Enabled: boolean;
+}
+/**
+ * Self-service two-factor authentication.
+ *
+ * Enrolling and unenrolling a TOTP device for one's own account, from a fully
+ * authorized session. These operations were previously only reachable from the
+ * login-time 2FA window, whose policies (`TwoFacRouteEnabled` +
+ * `NotAuthorizedPolicy`) exclude an authorized session by construction — so a
+ * normal logged-in user could neither enrol nor unenrol, and the only ways in
+ * were the CLI command or an administrator's 2FA reset.
+ *
+ * Both mutations re-verify the account password. A stolen session cookie must
+ * not be enough to attach an attacker-controlled authenticator or to strip the
+ * second factor off the account.
+ *
+ * @tags Two-Factor Authentication
+ */
+export declare class TwoFactorAuthUserController extends BaseController {
+    protected PasswordProvider: PasswordProvider;
+    protected SessionProvider: SessionProvider;
+    protected SessionCookies: SessionCookieFactory;
+    /**
+     * Get own two-factor status
+     * Reports whether the authenticated user currently has a TOTP device enrolled.
+     * @security cookieAuth
+     * @returns {ITwoFactorStatus} Current enrolment state
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — insufficient permissions
+     */
+    status(user: UserModel): Promise<Ok<ITwoFactorStatus>>;
+    /**
+     * Enable own two-factor authentication
+     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
+     * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 Two-factor authentication is already enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    enable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
+    /**
+     * Disable own two-factor authentication
+     * Removes the TOTP secret and disables 2FA for the authenticated user.
+     * Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication disabled successfully
+     * @response 400 Two-factor authentication is not enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    disable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok | Unauthorized>;
+    /**
+     * Rotates the session id after the account's authentication requirements
+     * changed, and returns the response options carrying the new cookie.
+     *
+     * Attaching or removing a second factor changes what the session is worth. A
+     * session id that was observed before the change must not keep working after
+     * it.
+     *
+     * @param session - the caller's current session
+     */
+    protected rotate(session: ISession): Promise<{
+        Headers: {
+            Name: string;
+            Value: string;
+        }[];
+        Coockies?: undefined;
+    } | {
+        Coockies: import("../services/SessionCookies.js").ISessionCookie[];
+        Headers: {
+            Name: string;
+            Value: string;
+        }[];
+    }>;
+    /**
+     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
+     * the module-level action so tests can stub it without a TOTP/DB setup.
+     */
+    protected enrol(user: UserModel): Promise<unknown>;
+    /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
+    protected unenrol(user: UserModel): Promise<unknown>;
+    /**
+     * Re-verify the account password. Returns `true` on success, or the
+     * Unauthorized response to hand back to the caller.
+     */
+    protected confirmPassword(user: UserModel, password: string): Promise<true | Unauthorized>;
+}
+//# sourceMappingURL=TwoFactorAuthUserController.d.ts.map

package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAuB,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAA0D,MAAM,oBAAoB,CAAC;AAGlI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAIa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAI3E;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;IAoB5K;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC;IAczJ;;;;;;;;;OASG;cACa,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;;IAaxC;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpD;;;OAGG;cACa,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;CAajG"}

package/lib/mjs/controllers/TwoFactorAuthUserController.js

@@ -0,0 +1,192 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BaseController, BasePath, Body, Get, Ok, Policy, Post, Unauthorized } from '@spinajs/http';
+import { PasswordProvider, SessionProvider, User as UserModel, regenerateSession } from '@spinajs/rbac';
+import { Autoinject } from '@spinajs/di';
+import { AutoinjectService } from '@spinajs/configuration';
+import { AuthorizedPolicy, Permission, Resource, Session as SessionRouteArg, User } from '@spinajs/rbac-http';
+import { InvalidOperation } from '@spinajs/exceptions';
+import { TwoFactorAuthEnabled } from '../policies/2FaPolicy.js';
+import { ConfirmPasswordDto } from '../dto/confirm-password-dto.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
+import { disableUser2Fa, enableUser2Fa } from '../actions/2fa.js';
+import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
+/**
+ * Self-service two-factor authentication.
+ *
+ * Enrolling and unenrolling a TOTP device for one's own account, from a fully
+ * authorized session. These operations were previously only reachable from the
+ * login-time 2FA window, whose policies (`TwoFacRouteEnabled` +
+ * `NotAuthorizedPolicy`) exclude an authorized session by construction — so a
+ * normal logged-in user could neither enrol nor unenrol, and the only ways in
+ * were the CLI command or an administrator's 2FA reset.
+ *
+ * Both mutations re-verify the account password. A stolen session cookie must
+ * not be enough to attach an attacker-controlled authenticator or to strip the
+ * second factor off the account.
+ *
+ * @tags Two-Factor Authentication
+ */
+let TwoFactorAuthUserController = class TwoFactorAuthUserController extends BaseController {
+    /**
+     * Get own two-factor status
+     * Reports whether the authenticated user currently has a TOTP device enrolled.
+     * @security cookieAuth
+     * @returns {ITwoFactorStatus} Current enrolment state
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async status(user) {
+        return new Ok({ Enabled: Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) });
+    }
+    /**
+     * Enable own two-factor authentication
+     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
+     * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 Two-factor authentication is already enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async enable(user, confirmation, session) {
+        if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
+            throw new InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
+        }
+        const confirmed = await this.confirmPassword(user, confirmation.Password);
+        if (confirmed !== true) {
+            return confirmed;
+        }
+        // NOTE: enrolment takes effect immediately — the secret is stored and
+        // `2fa:enabled` is set before the user has proven they scanned it. That is
+        // the same contract the login-time setup route follows, and it is what the
+        // login check reads. A user who never scans the returned URI locks
+        // themselves out and needs an administrator 2FA reset to recover.
+        const result = await this.enrol(user);
+        return new Ok({ otp: result }, await this.rotate(session));
+    }
+    /**
+     * Disable own two-factor authentication
+     * Removes the TOTP secret and disables 2FA for the authenticated user.
+     * Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication disabled successfully
+     * @response 400 Two-factor authentication is not enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async disable(user, confirmation, session) {
+        if (!user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
+            throw new InvalidOperation(`User ${user.Uuid} already has 2fa disabled`);
+        }
+        const confirmed = await this.confirmPassword(user, confirmation.Password);
+        if (confirmed !== true) {
+            return confirmed;
+        }
+        await this.unenrol(user);
+        return new Ok(null, await this.rotate(session));
+    }
+    /**
+     * Rotates the session id after the account's authentication requirements
+     * changed, and returns the response options carrying the new cookie.
+     *
+     * Attaching or removing a second factor changes what the session is worth. A
+     * session id that was observed before the change must not keep working after
+     * it.
+     *
+     * @param session - the caller's current session
+     */
+    async rotate(session) {
+        if (!session) {
+            return { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] };
+        }
+        const regenerated = await regenerateSession(this.SessionProvider, session);
+        return {
+            Coockies: [this.SessionCookies.issue(regenerated)],
+            Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+        };
+    }
+    /**
+     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
+     * the module-level action so tests can stub it without a TOTP/DB setup.
+     */
+    enrol(user) {
+        return enableUser2Fa(user);
+    }
+    /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
+    unenrol(user) {
+        return disableUser2Fa(user);
+    }
+    /**
+     * Re-verify the account password. Returns `true` on success, or the
+     * Unauthorized response to hand back to the caller.
+     */
+    async confirmPassword(user, password) {
+        const valid = await this.PasswordProvider.verify(user.Password, password);
+        if (!valid) {
+            this._log.warn(`2fa change rejected for ${user.Uuid}: password confirmation failed`);
+            return new Unauthorized({
+                error: { code: 'E_PASSWORD_INVALID', message: 'Invalid password' },
+            });
+        }
+        return true;
+    }
+};
+__decorate([
+    AutoinjectService('rbac.password'),
+    __metadata("design:type", PasswordProvider)
+], TwoFactorAuthUserController.prototype, "PasswordProvider", void 0);
+__decorate([
+    AutoinjectService('rbac.session'),
+    __metadata("design:type", SessionProvider)
+], TwoFactorAuthUserController.prototype, "SessionProvider", void 0);
+__decorate([
+    Autoinject(SessionCookieFactory),
+    __metadata("design:type", SessionCookieFactory)
+], TwoFactorAuthUserController.prototype, "SessionCookies", void 0);
+__decorate([
+    Get('2fa'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "status", null);
+__decorate([
+    Post('2fa/enable'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Body()),
+    __param(2, SessionRouteArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, ConfirmPasswordDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "enable", null);
+__decorate([
+    Post('2fa/disable'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Body()),
+    __param(2, SessionRouteArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, ConfirmPasswordDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "disable", null);
+TwoFactorAuthUserController = __decorate([
+    BasePath('user'),
+    Resource('user'),
+    Policy(AuthorizedPolicy),
+    Policy(TwoFactorAuthEnabled)
+], TwoFactorAuthUserController);
+export { TwoFactorAuthUserController };
+//# sourceMappingURL=TwoFactorAuthUserController.js.map

package/lib/mjs/controllers/TwoFactorAuthUserController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorAuthUserController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAExG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAsB,UAAU,EAAE,QAAQ,EAAE,OAAO,IAAI,eAAe,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAOnE;;;;;;;;;;;;;;;GAeG;AAKI,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,cAAc;IAU7D;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe;QACzC,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QACzH,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAgB,EAAE,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QAC1H,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,MAAM,CAAC,OAAiB;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO;YACL,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IACjE,OAAO,CAAC,IAAe;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAAC,IAAe,EAAE,QAAgB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAC;YAErF,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArIW;IADT,iBAAiB,CAAC,eAAe,CAAC;8BACP,gBAAgB;qEAAC;AAGnC;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;oEAAC;AAGjC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;mEAAC;AAYlC;IAFZ,GAAG,CAAC,KAAK,CAAC;IACV,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACH,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;yDAE1C;AAcY;IAFZ,IAAI,CAAC,YAAY,CAAC;IAClB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;IAAoC,WAAA,eAAe,EAAE,CAAA;;qCAAvE,SAAS,EAAwB,kBAAkB;;yDAkBpF;AAcY;IAFZ,IAAI,CAAC,aAAa,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;IAAoC,WAAA,eAAe,EAAE,CAAA;;qCAAvE,SAAS,EAAwB,kBAAkB;;0DAYrF;AAhFU,2BAA2B;IAJvC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,gBAAgB,CAAC;IACxB,MAAM,CAAC,oBAAoB,CAAC;GAChB,2BAA2B,CAuIvC"}

package/lib/mjs/controllers/UserController.d.ts

@@ -1,7 +1,9 @@
 import { PasswordDto } from '../dto/password-dto.js';
 import { User as UserModel, PasswordProvider, SessionProvider, AccessControl } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
 import { BaseController, Ok } from '@spinajs/http';
 import { IGrantsMap } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Current user profile management.
  * Allows an authenticated user to read and modify their own account — refresh profile data,
@@ -10,9 +12,9 @@ import { IGrantsMap } from '@spinajs/rbac-http';
  */
 export declare class UserController extends BaseController {
     protected PasswordProvider: PasswordProvider;
-    protected CoockieSecret: string;
     protected SessionProvider: SessionProvider;
     protected AC: AccessControl;
+    protected SessionCookies: SessionCookieFactory;
     /**
      * Refresh current user profile
      * Reloads the authenticated user's record from the database (including metadata) and
@@ -22,17 +24,18 @@ export declare class UserController extends BaseController {
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    refresh(user: UserModel, ssid: string): Promise<Ok<import("@spinajs/orm").ModelData<UserModel>>>;
+    refresh(user: UserModel, ssid: string): Promise<Ok<import("@spinajs/orm").ModelDataWithRelationData<UserModel>>>;
     /**
      * Get current user grants
-     * Returns the flattened RBAC grants for the authenticated user, combining all roles
-     * the user is assigned to into a single permission map keyed by resource.
+     * Returns the flattened RBAC grants in effect for the authenticated user — those of
+     * the session's active role, resolved through its inheritance chain. Switching the
+     * active role (`POST /auth/active-role`) changes what this returns.
      * @security cookieAuth
-     * @returns {IGrantsMap} Combined RBAC grants map: resource → action → permission descriptor
+     * @returns {IGrantsMap} RBAC grants map for the active role: resource → action → permission descriptor
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    getGrants(user: UserModel): Promise<Ok<IGrantsMap>>;
+    getGrants(user: UserModel, session: ISession): Promise<Ok<IGrantsMap>>;
     /**
      * Change own password
      * Changes the authenticated user's password. Requires the current (old) password for verification.
@@ -42,6 +45,6 @@ export declare class UserController extends BaseController {
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    newPassword(user: UserModel, pwd: PasswordDto): Promise<Ok<unknown>>;
+    newPassword(user: UserModel, pwd: PasswordDto, session: ISession): Promise<Ok<null>>;
 }
 //# sourceMappingURL=UserController.d.ts.map

package/lib/mjs/controllers/UserController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;IAqBpE;;;;;;;;OAQG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAUxE;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW;CAkB3E"}
+{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAA8C,aAAa,EAAE,MAAM,eAAe,CAAC;AAChJ,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAuB,MAAM,eAAe,CAAC;AAIvF,OAAO,EAAgD,UAAU,EAAyD,MAAM,oBAAoB,CAAC;AAGrJ,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM;IA0B1E;;;;;;;;;OASG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAS9G;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW,EAAqB,OAAO,EAAE,QAAQ;CAwCjH"}