@spinajs/rbac-http-user 2.0.486 → 2.0.487

package/lib/cjs/controllers/LoginController.js

@@ -22,6 +22,9 @@ const configuration_1 = require("@spinajs/configuration");
 const rbac_http_1 = require("@spinajs/rbac-http");
 const rbac_2 = require("@spinajs/rbac");
 const logout_js_1 = require("../logout.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
+const grants_js_1 = require("../services/grants.js");
+const Default2FaToken_js_1 = require("../2fa/Default2FaToken.js");
 /**
  * Authentication endpoints.
  * Handles user login, logout, and current-session inspection.
@@ -62,7 +65,8 @@ let LoginController = class LoginController extends http_1.BaseController {
             //              user is automatically authorized at login
             session.Data.set('Logged', true);
             session.UserId = user.Id;
-            if (this.TwoFactorAuthForceUser && !user.Metadata['2fa:enabled']) {
+            const twoFaEnabledForUser = Boolean(user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]);
+            if (this.TwoFactorAuthForceUser && !twoFaEnabledForUser) {
                 this._log.trace('User logged in, 2fa init required', {
                     Uuid: user.Uuid
                 });
@@ -70,7 +74,7 @@ let LoginController = class LoginController extends http_1.BaseController {
                 session.Data.set('TwoFactorAuth', true);
                 result = { TwoFactorInitRequired: true };
             }
-            else if (this.TwoFactorAuthEnabled && user.Metadata['2fa:enabled']) {
+            else if (this.TwoFactorAuthEnabled && twoFaEnabledForUser) {
                 this._log.trace('User logged in, 2fa required', {
                     Uuid: user.Uuid
                 });
@@ -80,40 +84,25 @@ let LoginController = class LoginController extends http_1.BaseController {
             }
             else {
                 session.Data.set('Authorized', true);
-                const grants = this.AC.getGrants();
-                const combinedGrants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, grants) : {};
-                // dehydrateWithRelations({ dateTimeFormat: 'iso' }) converts DateTime to ISO strings
-                // at runtime — the ORM types don't reflect the dateTimeFormat option in generics
-                result = {
-                    ...user.dehydrateWithRelations({ dateTimeFormat: "iso" }),
-                    Role: user.Role, // temp fix for role grants, as dehydrateWithRelations returns string of roles, not array
-                    ActiveRole: activeRole,
-                    Grants: combinedGrants,
-                };
+                this._log.trace('User logged in, no 2fa required', {
+                    Uuid: user.Uuid
+                });
+                result = (0, grants_js_1.buildUserWithGrants)(user, activeRole, this.AC);
             }
-            this._log.trace('User logged in, no 2fa required', {
-                Uuid: user.Uuid
-            });
             // save() schedules the session's initial expiration via the configured
             // strategy; the cookie maxAge is then derived from that real expiry (B1),
             // no longer the bogus `expiration * 1000` (~2 min) value.
             await this.SessionProvider.save(session);
-            const coockies = [
-                {
-                    Name: 'ssid',
-                    Value: session.SessionId,
-                    Options: {
-                        signed: true,
-                        httpOnly: true,
-                        // cookie lifetime tracks the session's real expiration
-                        maxAge: (0, rbac_1.sessionCookieMaxAge)(session),
-                        // any optional cookie options / override default ones
-                        ...this.SessionCookieConfig
-                    },
-                },
-            ];
+            this._log.info(`Session created`, {
+                // never the raw id — a log file must not be a bag of live credentials
+                Session: (0, rbac_1.hashSessionId)(session.SessionId),
+                User: user.Uuid,
+            });
             return new http_1.Ok(result, {
-                Coockies: coockies
+                Coockies: [this.SessionCookies.issue(session)],
+                // The response carries the session id in a Set-Cookie and the user's
+                // own data in the body. Neither may be written to any cache.
+                Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
             });
         }
         catch (err) {
@@ -145,6 +134,10 @@ let LoginController = class LoginController extends http_1.BaseController {
      * If an impersonation is active, the session is NOT destroyed — instead the
      * impersonation is ended and the original user resumes their session.
      * Requires the user to be logged in (session exists), but full authorization (2FA) is not required.
+     *
+     * POST, not GET: under `SameSite=Lax` a cookie rides a top-level cross-site
+     * GET, so a third-party page could log any visitor out simply by linking to
+     * this route.
      * @security cookieAuth
      * @response 401 No active session
      */
@@ -166,7 +159,10 @@ let LoginController = class LoginController extends http_1.BaseController {
         for (const handler of sorted) {
             const result = await handler.handle(ctx);
             if (result) {
-                return new http_1.Ok(result.Body ?? null, { Coockies: result.Cookies ?? [] });
+                return new http_1.Ok(result.Body ?? null, {
+                    Coockies: result.Cookies ?? [],
+                    Headers: result.Headers ?? [],
+                });
             }
         }
         // No handler claimed the request — should not happen as long as the
@@ -176,16 +172,18 @@ let LoginController = class LoginController extends http_1.BaseController {
     /**
      * Get current user
      * Returns the user object associated with the current session along with the
-     * currently active role. Roles the user may switch to are listed in Role.
+     * currently active role and whether the session has completed 2FA (when
+     * required). Roles the user may switch to are listed in Role.
      * Requires the user to be logged in (session exists), but full authorization (2FA) is not required.
      * @security cookieAuth
      * @returns {User} User data from the current session
      * @response 401 No active session
      */
-    async whoami(User, ActiveRole) {
+    async whoami(User, ActiveRole, session) {
         return new http_1.Ok({
             ...User.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
             ActiveRole: ActiveRole ?? User.Role?.[0],
+            Authorized: session.Data.get('Authorized') ?? true,
         });
     }
 };
@@ -215,9 +213,9 @@ __decorate([
     __metadata("design:type", Boolean)
 ], LoginController.prototype, "TwoFactorAuthForceUser", void 0);
 __decorate([
-    (0, configuration_1.Config)('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], LoginController.prototype, "SessionCookieConfig", void 0);
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], LoginController.prototype, "SessionCookies", void 0);
 __decorate([
     (0, di_1.Autoinject)(rbac_1.AccessControl),
     __metadata("design:type", rbac_1.AccessControl)
@@ -226,16 +224,16 @@ __decorate([
     (0, http_1.Post)(),
     (0, rbac_http_1.SkipModelPermission)(),
     __param(0, (0, rbac_http_1.User)()),
-    __param(1, (0, http_1.Cookie)(true)),
+    __param(1, (0, rbac_http_1.SessionId)()),
     __param(2, (0, http_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [rbac_2.User, String, userLogin_dto_js_1.UserLoginDto]),
     __metadata("design:returntype", Promise)
 ], LoginController.prototype, "login", null);
 __decorate([
-    (0, http_1.Get)(),
+    (0, http_1.Post)(),
     (0, http_1.Policy)(rbac_http_1.LoggedPolicy),
-    __param(0, (0, http_1.Cookie)(true)),
+    __param(0, (0, rbac_http_1.SessionId)()),
     __param(1, (0, rbac_http_1.Session)()),
     __param(2, (0, rbac_http_1.User)()),
     __metadata("design:type", Function),
@@ -247,8 +245,9 @@ __decorate([
     (0, http_1.Policy)(rbac_http_1.LoggedPolicy),
     __param(0, (0, rbac_http_1.User)()),
     __param(1, (0, rbac_http_1.FromSession)()),
+    __param(2, (0, rbac_http_1.Session)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [rbac_2.User, String]),
+    __metadata("design:paramtypes", [rbac_2.User, String, Object]),
     __metadata("design:returntype", Promise)
 ], LoginController.prototype, "whoami", null);
 exports.LoginController = LoginController = __decorate([

package/lib/cjs/controllers/LoginController.js.map

@@ -1 +1 @@
-{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAA4G;AAC5G,wCAA8J;AAC9J,oDAAiE;AACjE,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAuK;AACvK,wCAAqC;AAErC,4CAA6D;AAG7D;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAgB,IAAY,EAAU,WAAyB;QAC5G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3E,qFAAqF;gBACrF,iFAAiF;gBACjF,MAAM,GAAG;oBACP,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;oBACzD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,yFAAyF;oBAC1G,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,cAAc;iBACO,CAAC;YAClC,CAAC;YAGD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,OAAO,CAAC,SAAS;oBACxB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI;wBAEd,uDAAuD;wBACvD,MAAM,EAAE,IAAA,0BAAmB,EAAC,OAAO,CAAC;wBAEpC,sDAAsD;wBACtD,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF,CAAC;YAEF,OAAO,IAAI,SAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,sBAAS,IAAI,GAAG,YAAY,4BAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAC,8BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAe,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,SAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB;QAE/E,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/NY,0CAAe;AAEhB;IADT,IAAA,eAAU,GAAE;8BACY,6BAAa;sDAAC;AAG7B;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;qDAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;wDAAC;AAKjC;IAHT,IAAA,sBAAM,EAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,IAAA,sBAAM,EAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;4DACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;2CAAC;AAcf;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,+BAAmB,GAAE;IACF,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAgB,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAzC,WAAI,UAAmD,+BAAY;;4CA4H7G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,aAAM,EAAC,IAAI,CAAC,CAAA;IAAgB,WAAA,IAAA,mBAAe,GAAE,CAAA;IAAqB,WAAA,IAAA,gBAAY,GAAE,CAAA;;qDAAO,WAAI;;6CA2B/G;AAaY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;;qCAApB,WAAI;;6CAM7C;0BA9NU,eAAe;IAD3B,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,eAAe,CA+N3B"}
+{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAAoG;AACpG,wCAAyI;AACzI,oDAAiE;AACjE,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAiK;AACjK,wCAAqC;AAErC,4CAA6D;AAC7D,qEAAqE;AACrE,qDAA4D;AAC5D,kEAAmE;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;gBAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,MAAM,GAAG,IAAA,+BAAmB,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAChC,sEAAsE;gBACtE,OAAO,EAAE,IAAA,oBAAa,EAAC,OAAO,CAAC,SAAS,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,SAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aACxD,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,sBAAS,IAAI,GAAG,YAAY,4BAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAC,8BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAc,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,SAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;oBAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB,EAAqB,OAAiB;QAErH,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzD,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;SACnD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAxNY,0CAAe;AAEhB;IADT,IAAA,eAAU,GAAE;8BACY,6BAAa;sDAAC;AAG7B;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;qDAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;wDAAC;AAKjC;IAHT,IAAA,sBAAM,EAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,IAAA,sBAAM,EAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;uDAAC;AAGrC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;2CAAC;AAcf;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,+BAAmB,GAAE;IACF,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAgB,WAAA,IAAA,qBAAS,GAAE,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAxC,WAAI,UAAkD,+BAAY;;4CA4G5G;AAiBY;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,qBAAS,GAAE,CAAA;IAAgB,WAAA,IAAA,mBAAe,GAAE,CAAA;IAAqB,WAAA,IAAA,gBAAY,GAAE,CAAA;;qDAAO,WAAI;;6CA8B9G;AAcY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;IAAsB,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAA3D,WAAI;;6CAO7C;0BAvNU,eAAe;IAD3B,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,eAAe,CAwN3B"}

package/lib/cjs/controllers/PasswordResetController.d.ts

@@ -0,0 +1,54 @@
+import { BaseController, BadRequestResponse, Ok } from '@spinajs/http';
+import { PasswordResetConfirmDto, PasswordResetRequestDto } from '../dto/password-reset-dto.js';
+/** Reply shared by both reset routes — deliberately says nothing about the account. */
+export interface IPasswordResetAck {
+    Ok: true;
+}
+/**
+ * Password reset for users who cannot log in.
+ *
+ * Two public, unauthenticated steps: request a token, then redeem it. The token
+ * itself is issued into the user's metadata by `passwordChangeRequest` and
+ * delivered out of band (the `UserPasswordChangeRequest` event is what an app
+ * hooks to send the mail) — it is never returned over HTTP, so possession of
+ * the mailbox is what authorizes the reset.
+ *
+ * Neither route reveals whether an account exists. Both answer the same way for
+ * a known and an unknown address, which is the whole point of a reset endpoint
+ * that anybody may call: an attacker must not be able to farm valid addresses
+ * from it, and a failed redemption must not distinguish "no such user" from
+ * "wrong token".
+ *
+ * NOTE: these routes are unauthenticated and cheap to call in a loop. Put a
+ * rate limit in front of them at the edge — this package does not provide one.
+ *
+ * @tags Authentication
+ */
+export declare class PasswordResetController extends BaseController {
+    /**
+     * Request a password reset
+     * Issues a reset token for the account and emits `UserPasswordChangeRequest` so the
+     * application can deliver it. Always succeeds, whether or not the address is known.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement — never indicates whether the account exists
+     */
+    requestReset(payload: PasswordResetRequestDto): Promise<Ok<IPasswordResetAck>>;
+    /**
+     * Complete a password reset
+     * Redeems the token issued by `POST /auth/password/reset-request` and sets the new
+     * password. The token is single-use and expires after `rbac.password.passwordResetWaitTime`.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement of a successful reset
+     * @response 400 New passwords do not match, or the token is invalid or expired
+     */
+    confirmReset(payload: PasswordResetConfirmDto): Promise<Ok<IPasswordResetAck> | BadRequestResponse>;
+    /**
+     * Issue a reset token into the user's metadata and emit
+     * `UserPasswordChangeRequest`. Wraps the module-level action so tests can
+     * stub it without a database.
+     */
+    protected issueToken(email: string): Promise<unknown>;
+    /** Redeem a reset token. Wrapped for the same reason as {@link issueToken}. */
+    protected redeemToken(email: string, password: string, token: string): Promise<unknown>;
+}
+//# sourceMappingURL=PasswordResetController.d.ts.map

package/lib/cjs/controllers/PasswordResetController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetController.d.ts","sourceRoot":"","sources":["../../../src/controllers/PasswordResetController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,kBAAkB,EAAE,EAAE,EAAQ,MAAM,eAAe,CAAC;AAI7F,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEhG,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,uBAAwB,SAAQ,cAAc;IACzD;;;;;;OAMG;IAGU,YAAY,CAAS,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAcnG;;;;;;;OAOG;IAGU,YAAY,CAAS,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,kBAAkB,CAAC;IA+BxH;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD,+EAA+E;IAC/E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGxF"}

package/lib/cjs/controllers/PasswordResetController.js

@@ -0,0 +1,129 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetController = void 0;
+const http_1 = require("@spinajs/http");
+const rbac_1 = require("@spinajs/rbac");
+const exceptions_1 = require("@spinajs/exceptions");
+const rbac_http_1 = require("@spinajs/rbac-http");
+const password_reset_dto_js_1 = require("../dto/password-reset-dto.js");
+/**
+ * Password reset for users who cannot log in.
+ *
+ * Two public, unauthenticated steps: request a token, then redeem it. The token
+ * itself is issued into the user's metadata by `passwordChangeRequest` and
+ * delivered out of band (the `UserPasswordChangeRequest` event is what an app
+ * hooks to send the mail) — it is never returned over HTTP, so possession of
+ * the mailbox is what authorizes the reset.
+ *
+ * Neither route reveals whether an account exists. Both answer the same way for
+ * a known and an unknown address, which is the whole point of a reset endpoint
+ * that anybody may call: an attacker must not be able to farm valid addresses
+ * from it, and a failed redemption must not distinguish "no such user" from
+ * "wrong token".
+ *
+ * NOTE: these routes are unauthenticated and cheap to call in a loop. Put a
+ * rate limit in front of them at the edge — this package does not provide one.
+ *
+ * @tags Authentication
+ */
+let PasswordResetController = class PasswordResetController extends http_1.BaseController {
+    /**
+     * Request a password reset
+     * Issues a reset token for the account and emits `UserPasswordChangeRequest` so the
+     * application can deliver it. Always succeeds, whether or not the address is known.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement — never indicates whether the account exists
+     */
+    async requestReset(payload) {
+        try {
+            await this.issueToken(payload.Email);
+        }
+        catch (err) {
+            // Swallowed on purpose. An unknown address, a deleted account or a
+            // banned one must produce exactly the response a valid address does —
+            // otherwise this route becomes an account enumeration oracle. Real
+            // faults ( mail queue, database ) are logged for operators.
+            this._log.warn(err, `Password reset request could not be processed for ${payload.Email}`);
+        }
+        return new http_1.Ok({ Ok: true });
+    }
+    /**
+     * Complete a password reset
+     * Redeems the token issued by `POST /auth/password/reset-request` and sets the new
+     * password. The token is single-use and expires after `rbac.password.passwordResetWaitTime`.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement of a successful reset
+     * @response 400 New passwords do not match, or the token is invalid or expired
+     */
+    async confirmReset(payload) {
+        if (payload.Password !== payload.ConfirmPassword) {
+            throw new exceptions_1.InvalidArgument('password does not match');
+        }
+        try {
+            await this.redeemToken(payload.Email, payload.Password, payload.Token);
+        }
+        catch (err) {
+            // One opaque failure for every rejection reason: unknown account, wrong
+            // token, expired token. Distinguishing them would tell a caller which
+            // addresses exist and let them probe tokens by the error they get back.
+            const isRedemptionFailure = err instanceof exceptions_1.ErrorCode || err instanceof exceptions_1.InvalidArgument;
+            if (!isRedemptionFailure) {
+                this._log.error(err, `Password reset failed unexpectedly for ${payload.Email}`);
+                throw err;
+            }
+            this._log.warn(err, `Password reset rejected for ${payload.Email}`);
+            return new http_1.BadRequestResponse({
+                error: {
+                    code: 'E_RESET_TOKEN_INVALID',
+                    message: 'Password reset token is invalid or has expired',
+                },
+            });
+        }
+        return new http_1.Ok({ Ok: true });
+    }
+    /**
+     * Issue a reset token into the user's metadata and emit
+     * `UserPasswordChangeRequest`. Wraps the module-level action so tests can
+     * stub it without a database.
+     */
+    issueToken(email) {
+        return (0, rbac_1.passwordChangeRequest)(email);
+    }
+    /** Redeem a reset token. Wrapped for the same reason as {@link issueToken}. */
+    redeemToken(email, password, token) {
+        return (0, rbac_1.confirmPasswordReset)(email, password, token);
+    }
+};
+exports.PasswordResetController = PasswordResetController;
+__decorate([
+    (0, http_1.Post)('password/reset-request'),
+    (0, rbac_http_1.SkipModelPermission)(),
+    __param(0, (0, http_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_reset_dto_js_1.PasswordResetRequestDto]),
+    __metadata("design:returntype", Promise)
+], PasswordResetController.prototype, "requestReset", null);
+__decorate([
+    (0, http_1.Post)('password/reset'),
+    (0, rbac_http_1.SkipModelPermission)(),
+    __param(0, (0, http_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_reset_dto_js_1.PasswordResetConfirmDto]),
+    __metadata("design:returntype", Promise)
+], PasswordResetController.prototype, "confirmReset", null);
+exports.PasswordResetController = PasswordResetController = __decorate([
+    (0, http_1.BasePath)('auth')
+], PasswordResetController);
+//# sourceMappingURL=PasswordResetController.js.map

package/lib/cjs/controllers/PasswordResetController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetController.js","sourceRoot":"","sources":["../../../src/controllers/PasswordResetController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAA6F;AAC7F,wCAA4E;AAC5E,oDAAiE;AACjE,kDAAyD;AACzD,wEAAgG;AAOhG;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IACzD;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,OAAgC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,qDAAqD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAuB,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,OAAgC;QAChE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,4BAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,mBAAmB,GAAG,GAAG,YAAY,sBAAS,IAAI,GAAG,YAAY,4BAAe,CAAC;YAEvF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,0CAA0C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,+BAA+B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAE7E,OAAO,IAAI,yBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,gDAAgD;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAuB,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,KAAa;QAChC,OAAO,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,+EAA+E;IACrE,WAAW,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAClE,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA9EY,0DAAuB;AAUrB;IAFZ,IAAA,WAAI,EAAC,wBAAwB,CAAC;IAC9B,IAAA,+BAAmB,GAAE;IACK,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAU,+CAAuB;;2DAYjE;AAYY;IAFZ,IAAA,WAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,+BAAmB,GAAE;IACK,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAU,+CAAuB;;2DA6BjE;kCA/DU,uBAAuB;IADnC,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,uBAAuB,CA8EnC"}

package/lib/cjs/controllers/SessionsController.d.ts

@@ -0,0 +1,65 @@
+import { BaseController, NotFound, Ok } from '@spinajs/http';
+import { SessionProvider, User as UserModel } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
+/** One live session of the calling user. */
+export interface IUserSessionEntry {
+    /**
+     * Opaque, stable handle for the session. Deliberately NOT the session id:
+     * listing your own sessions must not hand out working credentials for them,
+     * because the response ( and anything that caches or logs it ) would then be
+     * as good as the cookies themselves.
+     */
+    Handle: string;
+    /** ISO instant the session was opened */
+    Created: string;
+    /** ISO instant the session expires, or null when it never does */
+    Expires: string | null;
+    /** True for the session making this request */
+    Current: boolean;
+}
+/**
+ * Active sessions of the calling user — "where am I logged in", plus the means
+ * to end any of them.
+ *
+ * OWASP asks for exactly this: the user should be able to see concurrent
+ * sessions and terminate them remotely, which is how a person who suspects a
+ * stolen cookie gets rid of it without an administrator.
+ *
+ * @tags User
+ */
+export declare class SessionsController extends BaseController {
+    protected Log: Log;
+    protected SessionProvider: SessionProvider;
+    /**
+     * List own sessions
+     * Returns every live session of the authenticated user, newest first, with the
+     * one making the request flagged.
+     * @security cookieAuth
+     * @returns {IUserSessionEntry[]} Live sessions of the calling user
+     * @response 401 Unauthorized — valid session required
+     */
+    list(user: UserModel, ssid: string): Promise<Ok<IUserSessionEntry[]>>;
+    /**
+     * Revoke one session
+     * Ends the session identified by its handle. Revoking the current session is
+     * allowed and logs the caller out.
+     * @security cookieAuth
+     * @param handle Session handle as returned by `GET /user/sessions`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 404 No such session for this user
+     */
+    revoke(user: UserModel, handle: string): Promise<Ok | NotFound>;
+    /**
+     * Revoke every other session
+     * Ends all sessions of the user except the one making the request — the
+     * "log out everywhere else" action after a suspected compromise.
+     * @security cookieAuth
+     * @response 200 Other sessions revoked
+     * @response 401 Unauthorized — valid session required
+     */
+    revokeOthers(user: UserModel, ssid: string): Promise<Ok>;
+    protected toEntry(session: ISession, currentHandle: string | null): IUserSessionEntry;
+}
+//# sourceMappingURL=SessionsController.d.ts.map

package/lib/cjs/controllers/SessionsController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/SessionsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,QAAQ,EAAE,EAAE,EAAiB,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAiB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAG3C,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAEhB,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,qBAGa,kBAAmB,SAAQ,cAAc;IAEpD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C;;;;;;;OAOG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAW1G;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC;IAkB7F;;;;;;;OAOG;IAGU,YAAY,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAkB7F,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB;CAUtF"}

package/lib/cjs/controllers/SessionsController.js

@@ -0,0 +1,143 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionsController = void 0;
+const http_1 = require("@spinajs/http");
+const rbac_1 = require("@spinajs/rbac");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+const rbac_http_1 = require("@spinajs/rbac-http");
+/**
+ * Active sessions of the calling user — "where am I logged in", plus the means
+ * to end any of them.
+ *
+ * OWASP asks for exactly this: the user should be able to see concurrent
+ * sessions and terminate them remotely, which is how a person who suspects a
+ * stolen cookie gets rid of it without an administrator.
+ *
+ * @tags User
+ */
+let SessionsController = class SessionsController extends http_1.BaseController {
+    /**
+     * List own sessions
+     * Returns every live session of the authenticated user, newest first, with the
+     * one making the request flagged.
+     * @security cookieAuth
+     * @returns {IUserSessionEntry[]} Live sessions of the calling user
+     * @response 401 Unauthorized — valid session required
+     */
+    async list(user, ssid) {
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        const current = ssid ? (0, rbac_1.hashSessionId)(ssid) : null;
+        const entries = sessions
+            .map((s) => this.toEntry(s, current))
+            .sort((a, b) => (a.Created < b.Created ? 1 : -1));
+        return new http_1.Ok(entries);
+    }
+    /**
+     * Revoke one session
+     * Ends the session identified by its handle. Revoking the current session is
+     * allowed and logs the caller out.
+     * @security cookieAuth
+     * @param handle Session handle as returned by `GET /user/sessions`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 404 No such session for this user
+     */
+    async revoke(user, handle) {
+        // Resolved through the user's OWN session list, so a handle belonging to
+        // somebody else's session simply is not found here — the route cannot be
+        // used to end a stranger's session even if its handle leaks.
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        const match = sessions.find((s) => (0, rbac_1.hashSessionId)(s.SessionId) === handle);
+        if (!match) {
+            return new http_1.NotFound({ error: { code: 'E_SESSION_NOT_FOUND', message: 'No such session' } });
+        }
+        await this.SessionProvider.delete(match.SessionId);
+        this.Log.info(`Session revoked by its owner`, { Session: handle, User: user.Uuid });
+        return new http_1.Ok(null, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+    }
+    /**
+     * Revoke every other session
+     * Ends all sessions of the user except the one making the request — the
+     * "log out everywhere else" action after a suspected compromise.
+     * @security cookieAuth
+     * @response 200 Other sessions revoked
+     * @response 401 Unauthorized — valid session required
+     */
+    async revokeOthers(user, ssid) {
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        let revoked = 0;
+        for (const session of sessions) {
+            if (session.SessionId === ssid) {
+                continue;
+            }
+            await this.SessionProvider.delete(session.SessionId);
+            revoked++;
+        }
+        this.Log.info(`Revoked ${revoked} other session(s)`, { User: user.Uuid });
+        return new http_1.Ok({ Revoked: revoked }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+    }
+    toEntry(session, currentHandle) {
+        const handle = (0, rbac_1.hashSessionId)(session.SessionId);
+        return {
+            Handle: handle,
+            Created: session.Creation?.toISO() ?? '',
+            Expires: session.Expiration?.toISO() ?? null,
+            Current: handle === currentHandle,
+        };
+    }
+};
+exports.SessionsController = SessionsController;
+__decorate([
+    (0, log_1.Logger)('rbac-session'),
+    __metadata("design:type", log_1.Log)
+], SessionsController.prototype, "Log", void 0);
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.session'),
+    __metadata("design:type", rbac_1.SessionProvider)
+], SessionsController.prototype, "SessionProvider", void 0);
+__decorate([
+    (0, http_1.Get)('sessions'),
+    (0, rbac_http_1.Permission)(['readOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, rbac_http_1.SessionId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "list", null);
+__decorate([
+    (0, http_1.Del)('sessions/:handle'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "revoke", null);
+__decorate([
+    (0, http_1.Del)('sessions'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, rbac_http_1.SessionId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "revokeOthers", null);
+exports.SessionsController = SessionsController = __decorate([
+    (0, http_1.BasePath)('user'),
+    (0, rbac_http_1.Resource)('user'),
+    (0, http_1.Policy)(rbac_http_1.AuthorizedPolicy)
+], SessionsController);
+//# sourceMappingURL=SessionsController.js.map

package/lib/cjs/controllers/SessionsController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionsController.js","sourceRoot":"","sources":["../../../src/controllers/SessionsController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAgG;AAChG,wCAAkF;AAElF,0DAA2D;AAC3D,sCAA2C;AAC3C,kDAA6G;AAsB7G;;;;;;;;;GASG;AAII,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,qBAAc;IAOpD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe,EAAkB,IAAY;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAElD,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,OAAO,IAAI,SAAE,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,MAAc;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpF,OAAO,IAAI,SAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,IAAe,EAAkB,IAAY;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,OAAO,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,OAAO,IAAI,SAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAES,OAAO,CAAC,OAAiB,EAAE,aAA4B;QAC/D,MAAM,MAAM,GAAG,IAAA,oBAAa,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;YACxC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,IAAI;YAC5C,OAAO,EAAE,MAAM,KAAK,aAAa;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAhGY,gDAAkB;AAEnB;IADT,IAAA,YAAM,EAAC,cAAc,CAAC;8BACR,SAAG;+CAAC;AAGT;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;2DAAC;AAY9B;IAFZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,qBAAY,GAAE,CAAA;;qCAA1B,WAAS;;8CASxC;AAcY;IAFZ,IAAA,UAAG,EAAC,kBAAkB,CAAC;IACvB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;gDAgB1C;AAYY;IAFZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACC,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,qBAAY,GAAE,CAAA;;qCAA1B,WAAS;;sDAgBhD;6BApFU,kBAAkB;IAH9B,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,kBAAkB,CAgG9B"}