@spinajs/rbac-http-user 2.0.486 → 2.0.487

package/lib/cjs/controllers/TwoFactorAuthController.d.ts

@@ -1,41 +1,42 @@
 import { TokenDto } from './../dto/token-dto.js';
 import { BaseController, Ok, ForbiddenResponse } from '@spinajs/http';
 import { ISession, SessionProvider, User as UserModel, AccessControl } from '@spinajs/rbac';
-import { QueueService } from '@spinajs/queue';
-import { IEnable2faResponse, IUserWithGrants } from "@spinajs/rbac-http";
+import { IEnable2faResponse, IUserWithGrants } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
- * Two-factor authentication (TOTP) management.
- * Enables, disables, and verifies TOTP-based two-factor authentication for users.
- * All routes are only available when 2FA is enabled in the system configuration.
- * The caller must be logged in but does NOT need to be fully authorized (2FA verified),
- * allowing these routes to be used during the 2FA verification step itself.
+ * Two-factor authentication during login.
+ *
+ * These routes serve the narrow window between a successful password check and
+ * full authorization: the session is `Logged` but not `Authorized` and carries
+ * the `TwoFactorAuth` marker. Both class policies must hold, so the window
+ * closes the moment verification succeeds.
+ *
+ * Managing a TOTP device outside that window — enrolling for the first time, or
+ * turning 2FA off — lives on {@link TwoFactorAuthUserController} under
+ * `/user/2fa`, where the caller is fully authorized. Notably there is no
+ * "disable" here on purpose: a session that has not yet proven possession of
+ * the second factor must not be able to remove it, which would reduce the whole
+ * scheme to the password alone.
+ *
  * @tags Two-Factor Authentication
  */
 export declare class TwoFactorAuthController extends BaseController {
-    protected Queue: QueueService;
     protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: any;
+    protected SessionCookies: SessionCookieFactory;
     protected AC: AccessControl;
     /**
-     * Enable two-factor authentication
-     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning URI
-     * to be scanned by an authenticator app. Throws if 2FA is already enabled for the user.
+     * Set up two-factor authentication during login
+     * Generates a TOTP secret for a user who must enrol before continuing — the state
+     * signalled by `TwoFactorInitRequired` at login when `rbac.twoFactorAuth.forceUser`
+     * is on. Returns the OTP provisioning URI to scan with an authenticator app; the
+     * caller then confirms with `POST /auth/2fa/verify`.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
      * @response 401 Unauthorized — valid session required
+     * @response 403 Session is not awaiting two-factor enrolment
      */
-    enable2fa(user: UserModel): Promise<Ok<IEnable2faResponse>>;
-    /**
-     * Disable two-factor authentication
-     * Removes the TOTP secret and disables 2FA for the authenticated user.
-     * Throws if 2FA is not currently enabled for the user.
-     * @security cookieAuth
-     * @response 200 Two-factor authentication disabled successfully
-     * @response 400 Two-factor authentication is not enabled for this user
-     * @response 401 Unauthorized — valid session required
-     */
-    disable2Fa(user: UserModel): Promise<Ok<any>>;
+    setup2fa(user: UserModel): Promise<Ok<IEnable2faResponse>>;
     /**
      * Verify TOTP token
      * Validates the provided TOTP token against the user's 2FA secret. On success, marks the session

package/lib/cjs/controllers/TwoFactorAuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAA0C,MAAM,eAAe,CAAC;AAO3K,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAgE5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhF"}
+{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAW/E;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAyC5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9E"}

package/lib/cjs/controllers/TwoFactorAuthController.js

@@ -21,54 +21,51 @@ const http_2 = require("@spinajs/http");
 const _2FaPolicy_js_1 = require("../policies/2FaPolicy.js");
 const configuration_1 = require("@spinajs/configuration");
 const di_1 = require("@spinajs/di");
-const queue_1 = require("@spinajs/queue");
 const rbac_http_2 = require("@spinajs/rbac-http");
-const _2fa_js_1 = require("./../actions/2fa.js");
-const _2fa_js_2 = require("../actions/2fa.js");
+const _2fa_js_1 = require("../actions/2fa.js");
 const exceptions_1 = require("@spinajs/exceptions");
+const Default2FaToken_js_1 = require("../2fa/Default2FaToken.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
+const grants_js_1 = require("../services/grants.js");
 /**
- * Two-factor authentication (TOTP) management.
- * Enables, disables, and verifies TOTP-based two-factor authentication for users.
- * All routes are only available when 2FA is enabled in the system configuration.
- * The caller must be logged in but does NOT need to be fully authorized (2FA verified),
- * allowing these routes to be used during the 2FA verification step itself.
+ * Two-factor authentication during login.
+ *
+ * These routes serve the narrow window between a successful password check and
+ * full authorization: the session is `Logged` but not `Authorized` and carries
+ * the `TwoFactorAuth` marker. Both class policies must hold, so the window
+ * closes the moment verification succeeds.
+ *
+ * Managing a TOTP device outside that window — enrolling for the first time, or
+ * turning 2FA off — lives on {@link TwoFactorAuthUserController} under
+ * `/user/2fa`, where the caller is fully authorized. Notably there is no
+ * "disable" here on purpose: a session that has not yet proven possession of
+ * the second factor must not be able to remove it, which would reduce the whole
+ * scheme to the password alone.
+ *
  * @tags Two-Factor Authentication
  */
 let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseController {
     /**
-     * Enable two-factor authentication
-     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning URI
-     * to be scanned by an authenticator app. Throws if 2FA is already enabled for the user.
+     * Set up two-factor authentication during login
+     * Generates a TOTP secret for a user who must enrol before continuing — the state
+     * signalled by `TwoFactorInitRequired` at login when `rbac.twoFactorAuth.forceUser`
+     * is on. Returns the OTP provisioning URI to scan with an authenticator app; the
+     * caller then confirms with `POST /auth/2fa/verify`.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
      * @response 401 Unauthorized — valid session required
+     * @response 403 Session is not awaiting two-factor enrolment
      */
-    async enable2fa(user) {
-        if (user.Metadata['2fa:enabled']) {
+    async setup2fa(user) {
+        if (user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
             throw new exceptions_1.InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
         }
-        const result = await (0, _2fa_js_2.enableUser2Fa)(user);
+        const result = await (0, _2fa_js_1.enableUser2Fa)(user);
         return new http_1.Ok({
-            otp: result
+            otp: result,
         });
     }
-    /**
-     * Disable two-factor authentication
-     * Removes the TOTP secret and disables 2FA for the authenticated user.
-     * Throws if 2FA is not currently enabled for the user.
-     * @security cookieAuth
-     * @response 200 Two-factor authentication disabled successfully
-     * @response 400 Two-factor authentication is not enabled for this user
-     * @response 401 Unauthorized — valid session required
-     */
-    async disable2Fa(user) {
-        if (!user.Metadata['2fa:enabled']) {
-            throw new exceptions_1.InvalidOperation(`User ${user.Uuid} already has 2fa disabled`);
-        }
-        await (0, _2fa_js_1.disableUser2Fa)(user);
-        return new http_1.Ok();
-    }
     /**
      * Verify TOTP token
      * Validates the provided TOTP token against the user's 2FA secret. On success, marks the session
@@ -89,41 +86,22 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
             // id to defend against session fixation and reset the ssid cookie.
             const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
             this._log.trace('User logged in, 2fa authorized', {
-                Uuid: logged.Uuid
+                Uuid: logged.Uuid,
             });
             // Mirror the login response shape: resolve grants for the session's
             // active role (falling back to the first role) and include ActiveRole,
             // instead of flattening every role with no ActiveRole reported.
-            const activeRole = session.Data.get('ActiveRole') ?? logged.Role?.[0];
-            const combinedGrants = activeRole ? (0, rbac_1._unwindGrants)(activeRole, this.AC.getGrants()) : {};
-            return new http_1.Ok({
-                ...logged.dehydrateWithRelations({
-                    dateTimeFormat: "iso"
-                }),
-                Role: logged.Role,
-                ActiveRole: activeRole,
-                Grants: combinedGrants,
-            }, {
-                Coockies: [
-                    {
-                        Name: 'ssid',
-                        Value: regenerated.SessionId,
-                        Options: {
-                            signed: true,
-                            httpOnly: true,
-                            maxAge: (0, rbac_1.sessionCookieMaxAge)(regenerated),
-                            ...this.SessionCookieConfig,
-                        },
-                    },
-                ],
+            const activeRole = (0, grants_js_1.activeRoleOf)(logged, session);
+            return new http_1.Ok((0, grants_js_1.buildUserWithGrants)(logged, activeRole, this.AC), {
+                Coockies: [this.SessionCookies.issue(regenerated)],
             });
         }
         catch (err) {
             if (err instanceof Error) {
-                this._log.error(err, "2fa verification failed");
+                this._log.error(err, '2fa verification failed');
             }
             else {
-                this._log.error("2fa verification failed", { error: err });
+                this._log.error('2fa verification failed', { error: err });
             }
             return new http_1.ForbiddenResponse({
                 error: {
@@ -143,36 +121,25 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
     }
 };
 exports.TwoFactorAuthController = TwoFactorAuthController;
-__decorate([
-    (0, di_1.Autoinject)(queue_1.QueueService),
-    __metadata("design:type", queue_1.QueueService)
-], TwoFactorAuthController.prototype, "Queue", void 0);
 __decorate([
     (0, configuration_1.AutoinjectService)('rbac.session'),
     __metadata("design:type", rbac_1.SessionProvider)
 ], TwoFactorAuthController.prototype, "SessionProvider", void 0);
 __decorate([
-    (0, configuration_1.Config)('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], TwoFactorAuthController.prototype, "SessionCookieConfig", void 0);
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], TwoFactorAuthController.prototype, "SessionCookies", void 0);
 __decorate([
     (0, di_1.Autoinject)(rbac_1.AccessControl),
     __metadata("design:type", rbac_1.AccessControl)
 ], TwoFactorAuthController.prototype, "AC", void 0);
 __decorate([
-    (0, http_1.Get)('2fa/enable'),
-    __param(0, (0, rbac_http_2.User)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [rbac_1.User]),
-    __metadata("design:returntype", Promise)
-], TwoFactorAuthController.prototype, "enable2fa", null);
-__decorate([
-    (0, http_1.Get)('2fa/disable'),
+    (0, http_1.Post)('2fa/setup'),
     __param(0, (0, rbac_http_2.User)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [rbac_1.User]),
     __metadata("design:returntype", Promise)
-], TwoFactorAuthController.prototype, "disable2Fa", null);
+], TwoFactorAuthController.prototype, "setup2fa", null);
 __decorate([
     (0, http_1.Post)('2fa/verify'),
     __param(0, (0, rbac_http_2.User)()),

package/lib/cjs/controllers/TwoFactorAuthController.js.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAA2F;AAC3F,wCAA2K;AAC3K,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAA6E;AAC7E,oCAAyC;AACzC,0CAA8C;AAE9C,kDAAoG;AACpG,iDAA8D;AAC9D,+CAAkD;AAClD,oDAAuD;AAEvD;;;;;;;GAOG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAavD;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE1C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,SAAE,CAAC;YACV,GAAG,EAAE,MAAgB;SACxB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAA,wBAAc,EAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,SAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QAErG,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;YAGH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAExF,OAAO,IAAI,SAAE,CAAC;gBACV,GAAG,MAAM,CAAC,sBAAsB,CAAC;oBAC7B,cAAc,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,cAAc;aACK,EAAE;gBAC7B,QAAQ,EAAE;oBACN;wBACI,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,WAAW,CAAC,SAAS;wBAC5B,OAAO,EAAE;4BACL,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,WAAW,CAAC;4BACxC,GAAG,IAAI,CAAC,mBAAmB;yBAC9B;qBACJ;iBACJ;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YAET,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,wBAAiB,CAAC;gBACzB,KAAK,EAAE;oBACH,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC9B;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QACzD,OAAO,IAAA,iBAAO,EAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAxIY,0DAAuB;AAEtB;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACR,oBAAY;sDAAC;AAGpB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;oEACC;AAGzB;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAYf;IADZ,IAAA,UAAG,EAAC,YAAY,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;wDAU7C;AAYY;IADZ,IAAA,UAAG,EAAC,aAAa,CAAC;IACM,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;yDAO9C;AAYY;IADZ,IAAA,WAAI,EAAC,YAAY,CAAC;IACO,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAqB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAO,GAAE,CAAA;;qCAA9C,WAAS,EAAiB,uBAAQ;;0DA8D1E;kCA9HQ,uBAAuB;IAHnC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,kCAAkB,CAAC;IAC1B,IAAA,aAAM,EAAC,+BAAmB,CAAC;GACf,uBAAuB,CAwInC"}
+{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAAsF;AACtF,wCAA+G;AAC/G,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAA2D;AAC3D,oCAAyC;AACzC,kDAAoG;AACpG,+CAA2D;AAC3D,oDAAuD;AACvD,kEAAmE;AACnE,qEAAqE;AACrE,qDAA0E;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAUzD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,SAAE,CAAC,IAAA,+BAAmB,EAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,IAAA,iBAAO,EAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;CACF,CAAA;AA7FY,0DAAuB;AAExB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;+DAAC;AAGrC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAef;IADZ,IAAA,WAAI,EAAC,WAAW,CAAC;IACK,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;uDAS5C;AAYY;IADZ,IAAA,WAAI,EAAC,YAAY,CAAC;IACO,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAqB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAO,GAAE,CAAA;;qCAA9C,WAAS,EAAiB,uBAAQ;;0DAuC1E;kCAnFU,uBAAuB;IAHnC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,kCAAkB,CAAC;IAC1B,IAAA,aAAM,EAAC,+BAAmB,CAAC;GACf,uBAAuB,CA6FnC"}

package/lib/cjs/controllers/TwoFactorAuthUserController.d.ts

@@ -0,0 +1,98 @@
+import { BaseController, Ok, Unauthorized } from '@spinajs/http';
+import { PasswordProvider, SessionProvider, User as UserModel } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import { IEnable2faResponse } from '@spinajs/rbac-http';
+import { ConfirmPasswordDto } from '../dto/confirm-password-dto.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
+/** Whether the authenticated user currently has a TOTP device enrolled. */
+export interface ITwoFactorStatus {
+    Enabled: boolean;
+}
+/**
+ * Self-service two-factor authentication.
+ *
+ * Enrolling and unenrolling a TOTP device for one's own account, from a fully
+ * authorized session. These operations were previously only reachable from the
+ * login-time 2FA window, whose policies (`TwoFacRouteEnabled` +
+ * `NotAuthorizedPolicy`) exclude an authorized session by construction — so a
+ * normal logged-in user could neither enrol nor unenrol, and the only ways in
+ * were the CLI command or an administrator's 2FA reset.
+ *
+ * Both mutations re-verify the account password. A stolen session cookie must
+ * not be enough to attach an attacker-controlled authenticator or to strip the
+ * second factor off the account.
+ *
+ * @tags Two-Factor Authentication
+ */
+export declare class TwoFactorAuthUserController extends BaseController {
+    protected PasswordProvider: PasswordProvider;
+    protected SessionProvider: SessionProvider;
+    protected SessionCookies: SessionCookieFactory;
+    /**
+     * Get own two-factor status
+     * Reports whether the authenticated user currently has a TOTP device enrolled.
+     * @security cookieAuth
+     * @returns {ITwoFactorStatus} Current enrolment state
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — insufficient permissions
+     */
+    status(user: UserModel): Promise<Ok<ITwoFactorStatus>>;
+    /**
+     * Enable own two-factor authentication
+     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
+     * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 Two-factor authentication is already enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    enable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
+    /**
+     * Disable own two-factor authentication
+     * Removes the TOTP secret and disables 2FA for the authenticated user.
+     * Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication disabled successfully
+     * @response 400 Two-factor authentication is not enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    disable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok | Unauthorized>;
+    /**
+     * Rotates the session id after the account's authentication requirements
+     * changed, and returns the response options carrying the new cookie.
+     *
+     * Attaching or removing a second factor changes what the session is worth. A
+     * session id that was observed before the change must not keep working after
+     * it.
+     *
+     * @param session - the caller's current session
+     */
+    protected rotate(session: ISession): Promise<{
+        Headers: {
+            Name: string;
+            Value: string;
+        }[];
+        Coockies?: undefined;
+    } | {
+        Coockies: import("../services/SessionCookies.js").ISessionCookie[];
+        Headers: {
+            Name: string;
+            Value: string;
+        }[];
+    }>;
+    /**
+     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
+     * the module-level action so tests can stub it without a TOTP/DB setup.
+     */
+    protected enrol(user: UserModel): Promise<unknown>;
+    /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
+    protected unenrol(user: UserModel): Promise<unknown>;
+    /**
+     * Re-verify the account password. Returns `true` on success, or the
+     * Unauthorized response to hand back to the caller.
+     */
+    protected confirmPassword(user: UserModel, password: string): Promise<true | Unauthorized>;
+}
+//# sourceMappingURL=TwoFactorAuthUserController.d.ts.map

package/lib/cjs/controllers/TwoFactorAuthUserController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAuB,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAA0D,MAAM,oBAAoB,CAAC;AAGlI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAIa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAI3E;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;IAoB5K;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC;IAczJ;;;;;;;;;OASG;cACa,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;;IAaxC;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpD;;;OAGG;cACa,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;CAajG"}

package/lib/cjs/controllers/TwoFactorAuthUserController.js

@@ -0,0 +1,195 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorAuthUserController = void 0;
+const http_1 = require("@spinajs/http");
+const rbac_1 = require("@spinajs/rbac");
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const rbac_http_1 = require("@spinajs/rbac-http");
+const exceptions_1 = require("@spinajs/exceptions");
+const _2FaPolicy_js_1 = require("../policies/2FaPolicy.js");
+const confirm_password_dto_js_1 = require("../dto/confirm-password-dto.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
+const _2fa_js_1 = require("../actions/2fa.js");
+const Default2FaToken_js_1 = require("../2fa/Default2FaToken.js");
+/**
+ * Self-service two-factor authentication.
+ *
+ * Enrolling and unenrolling a TOTP device for one's own account, from a fully
+ * authorized session. These operations were previously only reachable from the
+ * login-time 2FA window, whose policies (`TwoFacRouteEnabled` +
+ * `NotAuthorizedPolicy`) exclude an authorized session by construction — so a
+ * normal logged-in user could neither enrol nor unenrol, and the only ways in
+ * were the CLI command or an administrator's 2FA reset.
+ *
+ * Both mutations re-verify the account password. A stolen session cookie must
+ * not be enough to attach an attacker-controlled authenticator or to strip the
+ * second factor off the account.
+ *
+ * @tags Two-Factor Authentication
+ */
+let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http_1.BaseController {
+    /**
+     * Get own two-factor status
+     * Reports whether the authenticated user currently has a TOTP device enrolled.
+     * @security cookieAuth
+     * @returns {ITwoFactorStatus} Current enrolment state
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async status(user) {
+        return new http_1.Ok({ Enabled: Boolean(user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) });
+    }
+    /**
+     * Enable own two-factor authentication
+     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
+     * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 Two-factor authentication is already enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async enable(user, confirmation, session) {
+        if (user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
+            throw new exceptions_1.InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
+        }
+        const confirmed = await this.confirmPassword(user, confirmation.Password);
+        if (confirmed !== true) {
+            return confirmed;
+        }
+        // NOTE: enrolment takes effect immediately — the secret is stored and
+        // `2fa:enabled` is set before the user has proven they scanned it. That is
+        // the same contract the login-time setup route follows, and it is what the
+        // login check reads. A user who never scans the returned URI locks
+        // themselves out and needs an administrator 2FA reset to recover.
+        const result = await this.enrol(user);
+        return new http_1.Ok({ otp: result }, await this.rotate(session));
+    }
+    /**
+     * Disable own two-factor authentication
+     * Removes the TOTP secret and disables 2FA for the authenticated user.
+     * Requires the account password to be re-entered.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication disabled successfully
+     * @response 400 Two-factor authentication is not enabled for this user
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async disable(user, confirmation, session) {
+        if (!user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
+            throw new exceptions_1.InvalidOperation(`User ${user.Uuid} already has 2fa disabled`);
+        }
+        const confirmed = await this.confirmPassword(user, confirmation.Password);
+        if (confirmed !== true) {
+            return confirmed;
+        }
+        await this.unenrol(user);
+        return new http_1.Ok(null, await this.rotate(session));
+    }
+    /**
+     * Rotates the session id after the account's authentication requirements
+     * changed, and returns the response options carrying the new cookie.
+     *
+     * Attaching or removing a second factor changes what the session is worth. A
+     * session id that was observed before the change must not keep working after
+     * it.
+     *
+     * @param session - the caller's current session
+     */
+    async rotate(session) {
+        if (!session) {
+            return { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] };
+        }
+        const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
+        return {
+            Coockies: [this.SessionCookies.issue(regenerated)],
+            Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+        };
+    }
+    /**
+     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
+     * the module-level action so tests can stub it without a TOTP/DB setup.
+     */
+    enrol(user) {
+        return (0, _2fa_js_1.enableUser2Fa)(user);
+    }
+    /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
+    unenrol(user) {
+        return (0, _2fa_js_1.disableUser2Fa)(user);
+    }
+    /**
+     * Re-verify the account password. Returns `true` on success, or the
+     * Unauthorized response to hand back to the caller.
+     */
+    async confirmPassword(user, password) {
+        const valid = await this.PasswordProvider.verify(user.Password, password);
+        if (!valid) {
+            this._log.warn(`2fa change rejected for ${user.Uuid}: password confirmation failed`);
+            return new http_1.Unauthorized({
+                error: { code: 'E_PASSWORD_INVALID', message: 'Invalid password' },
+            });
+        }
+        return true;
+    }
+};
+exports.TwoFactorAuthUserController = TwoFactorAuthUserController;
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.password'),
+    __metadata("design:type", rbac_1.PasswordProvider)
+], TwoFactorAuthUserController.prototype, "PasswordProvider", void 0);
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.session'),
+    __metadata("design:type", rbac_1.SessionProvider)
+], TwoFactorAuthUserController.prototype, "SessionProvider", void 0);
+__decorate([
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], TwoFactorAuthUserController.prototype, "SessionCookies", void 0);
+__decorate([
+    (0, http_1.Get)('2fa'),
+    (0, rbac_http_1.Permission)(['readOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "status", null);
+__decorate([
+    (0, http_1.Post)('2fa/enable'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Body)()),
+    __param(2, (0, rbac_http_1.Session)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, confirm_password_dto_js_1.ConfirmPasswordDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "enable", null);
+__decorate([
+    (0, http_1.Post)('2fa/disable'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Body)()),
+    __param(2, (0, rbac_http_1.Session)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, confirm_password_dto_js_1.ConfirmPasswordDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "disable", null);
+exports.TwoFactorAuthUserController = TwoFactorAuthUserController = __decorate([
+    (0, http_1.BasePath)('user'),
+    (0, rbac_http_1.Resource)('user'),
+    (0, http_1.Policy)(rbac_http_1.AuthorizedPolicy),
+    (0, http_1.Policy)(_2FaPolicy_js_1.TwoFactorAuthEnabled)
+], TwoFactorAuthUserController);
+//# sourceMappingURL=TwoFactorAuthUserController.js.map

package/lib/cjs/controllers/TwoFactorAuthUserController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorAuthUserController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAoG;AACpG,wCAAwG;AAExG,oCAAyC;AACzC,0DAA2D;AAC3D,kDAAkI;AAClI,oDAAuD;AACvD,4DAAgE;AAChE,4EAAoE;AACpE,qEAAqE;AACrE,+CAAkE;AAClE,kEAAmE;AAOnE;;;;;;;;;;;;;;;GAeG;AAKI,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,qBAAc;IAU7D;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe;QACzC,OAAO,IAAI,SAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QACzH,IAAI,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,SAAE,CAAC,EAAE,GAAG,EAAE,MAAgB,EAAE,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QAC1H,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,6BAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,SAAE,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,MAAM,CAAC,OAAiB;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO;YACL,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IACjE,OAAO,CAAC,IAAe;QAC/B,OAAO,IAAA,wBAAc,EAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAAC,IAAe,EAAE,QAAgB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAC;YAErF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvIY,kEAA2B;AAE5B;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;qEAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;oEAAC;AAGjC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;mEAAC;AAYlC;IAFZ,IAAA,UAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACH,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;yDAE1C;AAcY;IAFZ,IAAA,WAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAvE,WAAS,EAAwB,4CAAkB;;yDAkBpF;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAvE,WAAS,EAAwB,4CAAkB;;0DAYrF;sCAhFU,2BAA2B;IAJvC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,4BAAgB,CAAC;IACxB,IAAA,aAAM,EAAC,oCAAoB,CAAC;GAChB,2BAA2B,CAuIvC"}

package/lib/cjs/controllers/UserController.d.ts

@@ -1,7 +1,9 @@
 import { PasswordDto } from '../dto/password-dto.js';
 import { User as UserModel, PasswordProvider, SessionProvider, AccessControl } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
 import { BaseController, Ok } from '@spinajs/http';
 import { IGrantsMap } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Current user profile management.
  * Allows an authenticated user to read and modify their own account — refresh profile data,
@@ -10,9 +12,9 @@ import { IGrantsMap } from '@spinajs/rbac-http';
  */
 export declare class UserController extends BaseController {
     protected PasswordProvider: PasswordProvider;
-    protected CoockieSecret: string;
     protected SessionProvider: SessionProvider;
     protected AC: AccessControl;
+    protected SessionCookies: SessionCookieFactory;
     /**
      * Refresh current user profile
      * Reloads the authenticated user's record from the database (including metadata) and
@@ -22,17 +24,18 @@ export declare class UserController extends BaseController {
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    refresh(user: UserModel, ssid: string): Promise<Ok<import("@spinajs/orm").ModelData<UserModel>>>;
+    refresh(user: UserModel, ssid: string): Promise<Ok<import("@spinajs/orm").ModelDataWithRelationData<UserModel>>>;
     /**
      * Get current user grants
-     * Returns the flattened RBAC grants for the authenticated user, combining all roles
-     * the user is assigned to into a single permission map keyed by resource.
+     * Returns the flattened RBAC grants in effect for the authenticated user — those of
+     * the session's active role, resolved through its inheritance chain. Switching the
+     * active role (`POST /auth/active-role`) changes what this returns.
      * @security cookieAuth
-     * @returns {IGrantsMap} Combined RBAC grants map: resource → action → permission descriptor
+     * @returns {IGrantsMap} RBAC grants map for the active role: resource → action → permission descriptor
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    getGrants(user: UserModel): Promise<Ok<IGrantsMap>>;
+    getGrants(user: UserModel, session: ISession): Promise<Ok<IGrantsMap>>;
     /**
      * Change own password
      * Changes the authenticated user's password. Requires the current (old) password for verification.
@@ -42,6 +45,6 @@ export declare class UserController extends BaseController {
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    newPassword(user: UserModel, pwd: PasswordDto): Promise<Ok<unknown>>;
+    newPassword(user: UserModel, pwd: PasswordDto, session: ISession): Promise<Ok<null>>;
 }
 //# sourceMappingURL=UserController.d.ts.map

package/lib/cjs/controllers/UserController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAgD,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAiB,EAAE,EAA+B,MAAM,eAAe,CAAC;AAM/F,OAAO,EAAgD,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK9F;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAY,IAAI,EAAE,MAAM;IAqBpE;;;;;;;;OAQG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAUxE;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW;CAkB3E"}
+{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAA8C,aAAa,EAAE,MAAM,eAAe,CAAC;AAChJ,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAuB,MAAM,eAAe,CAAC;AAIvF,OAAO,EAAgD,UAAU,EAAyD,MAAM,oBAAoB,CAAC;AAGrJ,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE;;;;;GAKG;AACH,qBAGa,cAAe,SAAQ,cAAc;IAEhD,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;;OAQG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM;IA0B1E;;;;;;;;;OASG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAS9G;;;;;;;;OAQG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,WAAW,EAAqB,OAAO,EAAE,QAAQ;CAwCjH"}