@spinajs/rbac-http-user 2.0.486 → 2.0.487

package/lib/cjs/dto/password-reset-dto.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetConfirmDto = exports.PasswordResetConfirmDtoSchema = exports.PasswordResetRequestDto = exports.PasswordResetRequestDtoSchema = void 0;
+const validation_1 = require("@spinajs/validation");
+exports.PasswordResetRequestDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Password reset request DTO',
+    type: 'object',
+    properties: {
+        Email: { type: 'string', format: 'email', description: 'Email address of the account to reset' },
+    },
+    required: ['Email'],
+};
+/** Payload starting a password reset — identifies the account by email. */
+let PasswordResetRequestDto = class PasswordResetRequestDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+exports.PasswordResetRequestDto = PasswordResetRequestDto;
+exports.PasswordResetRequestDto = PasswordResetRequestDto = __decorate([
+    (0, validation_1.Schema)(exports.PasswordResetRequestDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], PasswordResetRequestDto);
+exports.PasswordResetConfirmDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Password reset confirmation DTO',
+    type: 'object',
+    properties: {
+        Email: { type: 'string', format: 'email', description: 'Email address the reset token was issued for' },
+        Token: { type: 'string', maxLength: 64, minLength: 1, description: 'Reset token delivered to the user' },
+        Password: { type: 'string', maxLength: 32, minLength: 6, description: 'New password (6–32 characters)' },
+        ConfirmPassword: { type: 'string', maxLength: 32, minLength: 6, description: 'Must match Password' },
+    },
+    required: ['Email', 'Token', 'Password', 'ConfirmPassword'],
+};
+/** Payload completing a password reset with the issued token. */
+let PasswordResetConfirmDto = class PasswordResetConfirmDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+exports.PasswordResetConfirmDto = PasswordResetConfirmDto;
+exports.PasswordResetConfirmDto = PasswordResetConfirmDto = __decorate([
+    (0, validation_1.Schema)(exports.PasswordResetConfirmDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], PasswordResetConfirmDto);
+//# sourceMappingURL=password-reset-dto.js.map

package/lib/cjs/dto/password-reset-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-dto.js","sourceRoot":"","sources":["../../../src/dto/password-reset-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,6BAA6B,GAAG;IAC3C,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,4BAA4B;IACnC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,uCAAuC,EAAE;KACjG;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,2EAA2E;AAEpE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGlC,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AANY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAM,EAAC,qCAA6B,CAAC;;GACzB,uBAAuB,CAMnC;AAEY,QAAA,6BAA6B,GAAG;IAC3C,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,iCAAiC;IACxC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,8CAA8C,EAAE;QACvG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACxG,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE;QACxG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACrG;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAC;CAC5D,CAAC;AAEF,iEAAiE;AAE1D,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IASlC,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAZY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAM,EAAC,qCAA6B,CAAC;;GACzB,uBAAuB,CAYnC"}

package/lib/cjs/handlers/DefaultLogoutHandler.d.ts

@@ -1,5 +1,7 @@
 import { SessionProvider } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
 import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Default logout handler: deletes the session and clears the ssid cookie.
  * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
@@ -7,8 +9,9 @@ import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
  */
 export declare class DefaultLogoutHandler extends LogoutHandler {
     Priority: number;
+    protected Log: Log;
     protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: Record<string, unknown>;
+    protected SessionCookies: SessionCookieFactory;
     handle(context: ILogoutContext): Promise<ILogoutResult | null>;
 }
 //# sourceMappingURL=DefaultLogoutHandler.d.ts.map

package/lib/cjs/handlers/DefaultLogoutHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,mBAAmB,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAuB5E"}
+{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,cAAc,EAAG,oBAAoB,CAAC;IAEnC,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAyB5E"}

package/lib/cjs/handlers/DefaultLogoutHandler.js

@@ -13,7 +13,9 @@ exports.DefaultLogoutHandler = void 0;
 const di_1 = require("@spinajs/di");
 const configuration_1 = require("@spinajs/configuration");
 const rbac_1 = require("@spinajs/rbac");
+const log_1 = require("@spinajs/log");
 const logout_js_1 = require("../logout.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
 /**
  * Default logout handler: deletes the session and clears the ssid cookie.
  * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
@@ -30,31 +32,36 @@ let DefaultLogoutHandler = class DefaultLogoutHandler extends logout_js_1.Logout
             return { Body: null };
         }
         await this.SessionProvider.delete(context.Ssid);
+        this.Log.info(`Session destroyed by logout`, {
+            Session: (0, rbac_1.hashSessionId)(context.Ssid),
+            User: context.User?.Uuid,
+        });
         return {
             Body: null,
-            Cookies: [
-                {
-                    Name: 'ssid',
-                    Value: '',
-                    Options: {
-                        httpOnly: true,
-                        maxAge: 0,
-                        ...this.SessionCookieConfig,
-                    },
-                },
+            Cookies: [this.SessionCookies.clear()],
+            Headers: [
+                // Drop everything this origin left in the browser, not just the cookie:
+                // a cached authenticated page is still readable after logout on a
+                // shared machine, and `max-age=0` on the cookie does nothing about it.
+                { Name: 'Clear-Site-Data', Value: '"cache", "cookies", "storage"' },
+                { Name: 'Cache-Control', Value: 'no-store' },
             ],
         };
     }
 };
 exports.DefaultLogoutHandler = DefaultLogoutHandler;
+__decorate([
+    (0, log_1.Logger)('rbac-session'),
+    __metadata("design:type", log_1.Log)
+], DefaultLogoutHandler.prototype, "Log", void 0);
 __decorate([
     (0, configuration_1.AutoinjectService)('rbac.session'),
     __metadata("design:type", rbac_1.SessionProvider)
 ], DefaultLogoutHandler.prototype, "SessionProvider", void 0);
 __decorate([
-    (0, configuration_1.Config)('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], DefaultLogoutHandler.prototype, "SessionCookieConfig", void 0);
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], DefaultLogoutHandler.prototype, "SessionCookies", void 0);
 exports.DefaultLogoutHandler = DefaultLogoutHandler = __decorate([
     (0, di_1.Injectable)(logout_js_1.LogoutHandler)
 ], DefaultLogoutHandler);

package/lib/cjs/handlers/DefaultLogoutHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAmE;AACnE,wCAAgD;AAChD,4CAA4E;AAE5E;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,yBAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IA+BxB,CAAC;IAvBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE;wBACP,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,CAAC;wBACT,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhCY,oDAAoB;AAIrB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACN,sBAAe;6DAAC;AAGlC;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACsB;+BAP7C,oBAAoB;IADhC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,oBAAoB,CAgChC"}
+{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,0DAA2D;AAC3D,wCAA+D;AAC/D,sCAA2C;AAC3C,4CAA4E;AAC5E,qEAAqE;AAErE;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,yBAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IAoCxB,CAAC;IAzBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC3C,OAAO,EAAE,IAAA,oBAAa,EAAC,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACtC,OAAO,EAAE;gBACP,wEAAwE;gBACxE,kEAAkE;gBAClE,uEAAuE;gBACvE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,+BAA+B,EAAE;gBACnE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AArCY,oDAAoB;AAIrB;IADT,IAAA,YAAM,EAAC,cAAc,CAAC;8BACP,SAAG;iDAAC;AAGV;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACN,sBAAe;6DAAC;AAGlC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACN,wCAAoB;4DAAC;+BAVrC,oBAAoB;IADhC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,oBAAoB,CAqChC"}

package/lib/cjs/handlers/ImpersonationLogoutHandler.d.ts

@@ -1,5 +1,6 @@
-import { SessionProvider, User } from '@spinajs/rbac';
 import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
+import { ImpersonationService } from '../services/ImpersonationService.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Logout handler that detects an active impersonation and reverts it instead
  * of destroying the session. Runs early (priority 10) so it short-circuits
@@ -7,12 +8,8 @@ import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
  */
 export declare class ImpersonationLogoutHandler extends LogoutHandler {
     Priority: number;
-    protected SessionProvider: SessionProvider;
+    protected Impersonation: ImpersonationService;
+    protected SessionCookies: SessionCookieFactory;
     handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    protected emitEvent(original: User, target: User): Promise<void>;
 }
 //# sourceMappingURL=ImpersonationLogoutHandler.d.ts.map

package/lib/cjs/handlers/ImpersonationLogoutHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA0B,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAE/B,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0B3E;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}
+{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAG9C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAElC,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CA6B5E"}

package/lib/cjs/handlers/ImpersonationLogoutHandler.js

@@ -11,10 +11,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ImpersonationLogoutHandler = void 0;
 const di_1 = require("@spinajs/di");
-const configuration_1 = require("@spinajs/configuration");
-const rbac_1 = require("@spinajs/rbac");
-const queue_1 = require("@spinajs/queue");
 const logout_js_1 = require("../logout.js");
+const ImpersonationService_js_1 = require("../services/ImpersonationService.js");
+const SessionCookies_js_1 = require("../services/SessionCookies.js");
 /**
  * Logout handler that detects an active impersonation and reverts it instead
  * of destroying the session. Runs early (priority 10) so it short-circuits
@@ -26,40 +25,40 @@ let ImpersonationLogoutHandler = class ImpersonationLogoutHandler extends logout
         this.Priority = 10;
     }
     async handle(context) {
-        const session = context.Session;
-        if (!session)
+        if (!this.Impersonation.isActive(context.Session)) {
             return null;
-        const impersonatorUuid = session.Data.get('Impersonator');
-        if (!impersonatorUuid)
-            return null;
-        const original = await rbac_1.User.getByUuid(impersonatorUuid);
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
         }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(original, context.User);
-        // Take ownership of the response: no cookie change — the original user's
-        // session continues.
-        return { Body: { ImpersonationEnded: true } };
-    }
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    emitEvent(original, target) {
-        return (0, queue_1._ev)(new rbac_1.UserImpersonationEnded(original, target))();
+        const result = await this.Impersonation.revert(context.Session, context.User);
+        switch (result.Status) {
+            case 'reverted':
+                // Take ownership of the response: the original user's session
+                // continues, under the new id the revert rotated it to.
+                return {
+                    Body: { ImpersonationEnded: true },
+                    Cookies: [this.SessionCookies.issue(result.Session)],
+                    Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+                };
+            case 'impersonator-gone':
+                // The impersonator's account disappeared mid-impersonation. The stale
+                // block has been cleared, but there is no identity left to hand the
+                // session back to — defer to the default handler so the session is
+                // destroyed and the caller is logged out properly. Reverting used to
+                // dereference the missing user here and answer a logout with a 500.
+                return null;
+            default:
+                return null;
+        }
     }
 };
 exports.ImpersonationLogoutHandler = ImpersonationLogoutHandler;
 __decorate([
-    (0, configuration_1.AutoinjectService)('rbac.session'),
-    __metadata("design:type", rbac_1.SessionProvider)
-], ImpersonationLogoutHandler.prototype, "SessionProvider", void 0);
+    (0, di_1.Autoinject)(ImpersonationService_js_1.ImpersonationService),
+    __metadata("design:type", ImpersonationService_js_1.ImpersonationService)
+], ImpersonationLogoutHandler.prototype, "Impersonation", void 0);
+__decorate([
+    (0, di_1.Autoinject)(SessionCookies_js_1.SessionCookieFactory),
+    __metadata("design:type", SessionCookies_js_1.SessionCookieFactory)
+], ImpersonationLogoutHandler.prototype, "SessionCookies", void 0);
 exports.ImpersonationLogoutHandler = ImpersonationLogoutHandler = __decorate([
     (0, di_1.Injectable)(logout_js_1.LogoutHandler)
 ], ImpersonationLogoutHandler);

package/lib/cjs/handlers/ImpersonationLogoutHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAA2D;AAC3D,wCAA8E;AAC9E,0CAAqC;AACrC,4CAA4E;AAE5E;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,yBAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAsCvB,CAAC;IAjCQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,WAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAExD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,yEAAyE;QACzE,qBAAqB;QACrB,OAAO,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,IAAA,WAAG,EAAC,IAAI,6BAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AAvCY,gEAA0B;AAI3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACN,sBAAe;mEAAC;qCAJjC,0BAA0B;IADtC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,0BAA0B,CAuCtC"}
+{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,4CAA4E;AAC5E,iFAA2E;AAC3E,qEAAqE;AAErE;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,yBAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAqCvB,CAAC;IA7BQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9E,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,8DAA8D;gBAC9D,wDAAwD;gBACxD,OAAO;oBACL,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;oBAClC,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;iBACxD,CAAC;YAEJ,KAAK,mBAAmB;gBACtB,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,OAAO,IAAI,CAAC;YAEd;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;CACF,CAAA;AAtCY,gEAA0B;AAI3B;IADT,IAAA,eAAU,EAAC,8CAAoB,CAAC;8BACR,8CAAoB;iEAAC;AAGpC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;kEAAC;qCAPpC,0BAA0B;IADtC,IAAA,eAAU,EAAC,yBAAa,CAAC;GACb,0BAA0B,CAsCtC"}

package/lib/cjs/index.d.ts

@@ -8,9 +8,29 @@ export * from './handlers/ImpersonationLogoutHandler.js';
 export * from './handlers/DefaultLogoutHandler.js';
 export * from './controllers/UserMetadataController.js';
 export * from "./controllers/TwoFactorAuthController.js";
+export * from "./controllers/TwoFactorAuthUserController.js";
+export * from "./controllers/PasswordResetController.js";
+export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
 export * from "./2fa/Default2FaToken.js";
 export * from './actions/2fa.js';
+export * from './services/SessionCookies.js';
+export * from './services/grants.js';
+export * from './services/ImpersonationService.js';
+export * from './services/UserMetadataService.js';
+export * from './policies/2FaPolicy.js';
+export * from './events/User2FaEnabled.js';
+export * from './events/User2FaDisabled.js';
+export * from './events/User2FaPassed.js';
+export * from './events/User2FaReset.js';
+export * from './dto/confirm-password-dto.js';
+export * from './dto/impersonate-dto.js';
+export * from './dto/metadata-dto.js';
+export * from './dto/password-dto.js';
+export * from './dto/password-reset-dto.js';
+export * from './dto/switchRole-dto.js';
+export * from './dto/token-dto.js';
+export * from './dto/userLogin-dto.js';
 export declare class RbacHttpUserBootstrapper extends Bootstrapper {
     bootstrap(): void;
 }

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AAEzD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAGjC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI;CAO3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI;CAO3B"}

package/lib/cjs/index.js

@@ -33,9 +33,31 @@ __exportStar(require("./handlers/ImpersonationLogoutHandler.js"), exports);
 __exportStar(require("./handlers/DefaultLogoutHandler.js"), exports);
 __exportStar(require("./controllers/UserMetadataController.js"), exports);
 __exportStar(require("./controllers/TwoFactorAuthController.js"), exports);
+__exportStar(require("./controllers/TwoFactorAuthUserController.js"), exports);
+__exportStar(require("./controllers/PasswordResetController.js"), exports);
+__exportStar(require("./controllers/SessionsController.js"), exports);
 __exportStar(require("./cli/EnableUser2Fa.js"), exports);
 __exportStar(require("./2fa/Default2FaToken.js"), exports);
 __exportStar(require("./actions/2fa.js"), exports);
+__exportStar(require("./services/SessionCookies.js"), exports);
+__exportStar(require("./services/grants.js"), exports);
+__exportStar(require("./services/ImpersonationService.js"), exports);
+__exportStar(require("./services/UserMetadataService.js"), exports);
+__exportStar(require("./policies/2FaPolicy.js"), exports);
+// Emitted on the 2FA lifecycle and routed by name in this package's config —
+// consumers need the classes themselves to subscribe by type.
+__exportStar(require("./events/User2FaEnabled.js"), exports);
+__exportStar(require("./events/User2FaDisabled.js"), exports);
+__exportStar(require("./events/User2FaPassed.js"), exports);
+__exportStar(require("./events/User2FaReset.js"), exports);
+__exportStar(require("./dto/confirm-password-dto.js"), exports);
+__exportStar(require("./dto/impersonate-dto.js"), exports);
+__exportStar(require("./dto/metadata-dto.js"), exports);
+__exportStar(require("./dto/password-dto.js"), exports);
+__exportStar(require("./dto/password-reset-dto.js"), exports);
+__exportStar(require("./dto/switchRole-dto.js"), exports);
+__exportStar(require("./dto/token-dto.js"), exports);
+__exportStar(require("./dto/userLogin-dto.js"), exports);
 let RbacHttpUserBootstrapper = class RbacHttpUserBootstrapper extends di_1.Bootstrapper {
     bootstrap() {
         rbac_1.UserMetadataBase._hiddenKeys = [

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAuD;AACvD,wCAAiD;AACjD,iEAAkE;AAElE,mEAAiD;AACjD,wEAAsD;AACtD,2EAAyD;AACzD,kEAAgD;AAEhD,8CAA4B;AAC5B,2EAAyD;AACzD,qEAAmD;AACnD,0EAAwD;AACxD,2EAAyD;AAEzD,yDAAuC;AACvC,2DAAyC;AAEzC,mDAAiC;AAI1B,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,iBAAY;IAC/C,SAAS;QACZ,uBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,uBAAgB,CAAC,WAAW;YAC/B,2CAAsB,CAAC,KAAK;YAC5B,2CAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,wBAAwB,CAQpC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAuD;AACvD,wCAAiD;AACjD,iEAAkE;AAElE,mEAAiD;AACjD,wEAAsD;AACtD,2EAAyD;AACzD,kEAAgD;AAEhD,8CAA4B;AAC5B,2EAAyD;AACzD,qEAAmD;AACnD,0EAAwD;AACxD,2EAAyD;AACzD,+EAA6D;AAC7D,2EAAyD;AACzD,sEAAoD;AAEpD,yDAAuC;AACvC,2DAAyC;AAEzC,mDAAiC;AAEjC,+DAA6C;AAC7C,uDAAqC;AACrC,qEAAmD;AACnD,oEAAkD;AAElD,0DAAwC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,6DAA2C;AAC3C,8DAA4C;AAC5C,4DAA0C;AAC1C,2DAAyC;AAEzC,gEAA8C;AAC9C,2DAAyC;AACzC,wDAAsC;AACtC,wDAAsC;AACtC,8DAA4C;AAC5C,0DAAwC;AACxC,qDAAmC;AACnC,yDAAuC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,iBAAY;IAC/C,SAAS;QACZ,uBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,uBAAgB,CAAC,WAAW;YAC/B,2CAAsB,CAAC,KAAK;YAC5B,2CAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,wBAAwB,CAQpC"}

package/lib/cjs/logout.d.ts

@@ -18,12 +18,19 @@ export interface ILogoutCookie {
     Value: string;
     Options: Record<string, unknown>;
 }
+/** Response header a handler may attach to its response */
+export interface ILogoutHeader {
+    Name: string;
+    Value: string;
+}
 /** Response payload a handler returns when it takes ownership of the logout */
 export interface ILogoutResult {
     /** Response body */
     Body?: unknown;
     /** Cookie operations to attach */
     Cookies?: ILogoutCookie[];
+    /** Response headers to attach ( eg. `Clear-Site-Data` ) */
+    Headers?: ILogoutHeader[];
 }
 /**
  * Pluggable logout step. Handlers are resolved via `DI.resolve(Array.ofType(LogoutHandler))`

package/lib/cjs/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAEzB,mDAAmD;IACnD,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,aAAa;IACjC;;;OAGG;IACI,QAAQ,EAAE,MAAM,CAAO;aAEd,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAC/E"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAEzB,mDAAmD;IACnD,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAE1B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,aAAa;IACjC;;;OAGG;IACI,QAAQ,EAAE,MAAM,CAAO;aAEd,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAC/E"}

package/lib/cjs/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":";;;AAkCA;;;;;;;;;;;;;;GAcG;AACH,MAAsB,aAAa;IAAnC;QACE;;;WAGG;QACI,aAAQ,GAAW,GAAG,CAAC;IAGhC,CAAC;CAAA;AARD,sCAQC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":";;;AA2CA;;;;;;;;;;;;;;GAcG;AACH,MAAsB,aAAa;IAAnC;QACE;;;WAGG;QACI,aAAQ,GAAW,GAAG,CAAC;IAGhC,CAAC;CAAA;AARD,sCAQC"}

package/lib/cjs/policies/2FaPolicy.d.ts

@@ -1,8 +1,28 @@
 import { BasePolicy, Request as sRequest } from '@spinajs/http';
 import { TwoFactorAuthConfig } from '@spinajs/rbac-http';
-export declare class TwoFacRouteEnabled extends BasePolicy {
+/**
+ * Guards routes that only make sense when 2FA is switched on system-wide.
+ *
+ * This is the whole check for self-service routes: an already authorized user
+ * managing their own TOTP device has no pending 2FA step to look at. The
+ * login-window routes need more — see {@link TwoFacRouteEnabled}.
+ */
+export declare class TwoFactorAuthEnabled extends BasePolicy {
     protected TwoFactorConfig: TwoFactorAuthConfig;
     isEnabled(): boolean;
+    execute(_req: sRequest): Promise<void>;
+}
+/**
+ * Guards the routes that belong to the login-time 2FA step: the caller has
+ * passed password authentication and the session is parked awaiting TOTP
+ * verification.
+ *
+ * Combined with `NotAuthorizedPolicy` this window is deliberately narrow. It is
+ * NOT the right guard for managing a TOTP device — a session sitting in this
+ * window has not proven possession of the second factor yet, so anything it can
+ * reach must not be able to weaken 2FA.
+ */
+export declare class TwoFacRouteEnabled extends TwoFactorAuthEnabled {
     execute(req: sRequest): Promise<void>;
 }
 //# sourceMappingURL=2FaPolicy.d.ts.map

package/lib/cjs/policies/2FaPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"2FaPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,qBAAa,kBAAmB,SAAQ,UAAU;IAEhD,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAExC,SAAS,IAAI,OAAO;IAGpB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB7C"}
+{"version":3,"file":"2FaPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;IAElD,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAExC,SAAS,IAAI,OAAO;IAIpB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,oBAAoB;IAC7C,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBnD"}

package/lib/cjs/policies/2FaPolicy.js

@@ -9,19 +9,47 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TwoFacRouteEnabled = void 0;
+exports.TwoFacRouteEnabled = exports.TwoFactorAuthEnabled = void 0;
 const exceptions_1 = require("@spinajs/exceptions");
 const configuration_1 = require("@spinajs/configuration");
 const http_1 = require("@spinajs/http");
 const exceptions_2 = require("@spinajs/exceptions");
-class TwoFacRouteEnabled extends http_1.BasePolicy {
+/**
+ * Guards routes that only make sense when 2FA is switched on system-wide.
+ *
+ * This is the whole check for self-service routes: an already authorized user
+ * managing their own TOTP device has no pending 2FA step to look at. The
+ * login-window routes need more — see {@link TwoFacRouteEnabled}.
+ */
+class TwoFactorAuthEnabled extends http_1.BasePolicy {
     isEnabled() {
         return true;
     }
-    execute(req) {
+    execute(_req) {
         if (this.TwoFactorConfig.enabled === false) {
             throw new exceptions_1.InvalidOperation('2 factor auth is not enabled');
         }
+        return Promise.resolve();
+    }
+}
+exports.TwoFactorAuthEnabled = TwoFactorAuthEnabled;
+__decorate([
+    (0, configuration_1.Config)('rbac.twoFactorAuth'),
+    __metadata("design:type", Object)
+], TwoFactorAuthEnabled.prototype, "TwoFactorConfig", void 0);
+/**
+ * Guards the routes that belong to the login-time 2FA step: the caller has
+ * passed password authentication and the session is parked awaiting TOTP
+ * verification.
+ *
+ * Combined with `NotAuthorizedPolicy` this window is deliberately narrow. It is
+ * NOT the right guard for managing a TOTP device — a session sitting in this
+ * window has not proven possession of the second factor yet, so anything it can
+ * reach must not be able to weaken 2FA.
+ */
+class TwoFacRouteEnabled extends TwoFactorAuthEnabled {
+    async execute(req) {
+        await super.execute(req);
         if (!req.storage || !req.storage.Session) {
             throw new exceptions_1.InvalidOperation('Session is not set');
         }
@@ -35,8 +63,4 @@ class TwoFacRouteEnabled extends http_1.BasePolicy {
     }
 }
 exports.TwoFacRouteEnabled = TwoFacRouteEnabled;
-__decorate([
-    (0, configuration_1.Config)('rbac.twoFactorAuth'),
-    __metadata("design:type", Object)
-], TwoFacRouteEnabled.prototype, "TwoFactorConfig", void 0);
 //# sourceMappingURL=2FaPolicy.js.map

package/lib/cjs/policies/2FaPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAuD;AACvD,0DAAgD;AAChD,wCAAgE;AAEhE,oDAAgD;AAGhD,MAAa,kBAAmB,SAAQ,iBAAU;IAIzC,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACM,OAAO,CAAC,GAAa;QAC1B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,6BAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,6BAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAGD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AA1BD,gDA0BC;AAxBW;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;2DACkB"}
+{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAuD;AACvD,0DAAgD;AAChD,wCAAgE;AAEhE,oDAAgD;AAEhD;;;;;;GAMG;AACH,MAAa,oBAAqB,SAAQ,iBAAU;IAI3C,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,IAAc;QAC3B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,6BAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAfD,oDAeC;AAbW;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;6DACkB;AAejD;;;;;;;;;GASG;AACH,MAAa,kBAAmB,SAAQ,oBAAoB;IACnD,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,6BAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAjBD,gDAiBC"}

package/lib/cjs/services/ImpersonationService.d.ts

@@ -0,0 +1,90 @@
+import { SessionProvider, User } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+/** Session keys holding the impersonation block. */
+export declare const IMPERSONATION_KEYS: {
+    readonly IMPERSONATOR: "Impersonator";
+    readonly STARTED_AT: "ImpersonationStartedAt";
+    readonly ORIGINAL_ACTIVE_ROLE: "OriginalActiveRole";
+    /**
+     * Numeric id of the impersonator, stashed because `session.UserId` is handed
+     * over to the target for the duration — see {@link ImpersonationService.start}.
+     */
+    readonly ORIGINAL_USER_ID: "OriginalUserId";
+};
+/** Outcome of an attempt to end an impersonation. */
+export type RevertResult = 
+/** Impersonation ended; the original user is back in the session. */
+{
+    Status: 'reverted';
+    Original: User;
+    ActiveRole: string | undefined;
+    Session: ISession;
+}
+/** The session carried no impersonation — nothing was changed. */
+ | {
+    Status: 'not-impersonating';
+}
+/** The impersonator no longer exists; the stale block was cleared. */
+ | {
+    Status: 'impersonator-gone';
+};
+/**
+ * Owns the impersonation session block.
+ *
+ * The revert path is reachable two ways — explicitly via `DELETE /auth/impersonate`
+ * and implicitly when an impersonating user logs out — and both used to carry
+ * their own copy of the key juggling. The copies had already drifted: the logout
+ * handler dereferenced a deleted impersonator without a guard and answered a
+ * logout with a 500, while the controller handled that same case.
+ */
+export declare class ImpersonationService {
+    protected SessionProvider: SessionProvider;
+    /** True when the session is currently acting as somebody else. */
+    isActive(session: ISession | null | undefined): boolean;
+    /**
+     * Begin acting as `target`. The impersonator's own ActiveRole is stashed so
+     * `revert` can restore it, and the effective ActiveRole becomes the target's
+     * first role.
+     *
+     * Two things beyond the key juggling:
+     *
+     *  - the session id is REGENERATED. Assuming another identity is a privilege
+     *    change, and a privilege change on a session id that an attacker may
+     *    already know is the definition of session fixation.
+     *  - `session.UserId` is handed over to the target and the impersonator's own
+     *    id is stashed. Ownership is what `deleteByUser` keys on, so while the
+     *    impersonation runs, "log this user out everywhere" aimed at the target
+     *    reaches the impersonating session too — which is exactly what an
+     *    administrator killing a compromised account expects.
+     *
+     * @returns the regenerated session and the ActiveRole now in effect
+     */
+    start(session: ISession, impersonator: User, target: User, startedAt: string): Promise<{
+        Session: ISession;
+        ActiveRole: string | undefined;
+    }>;
+    /**
+     * End an active impersonation and put the original user back in the session.
+     *
+     * The session survives either way — reverting is not a logout. When the
+     * original user is gone the impersonation block is still cleared, so the
+     * session stops claiming an identity that cannot be resolved, and the caller
+     * is told to re-authenticate rather than being handed a 500.
+     */
+    revert(session: ISession | null | undefined, target: User): Promise<RevertResult>;
+    /** Drops the impersonation keys and persists the session under the same id. */
+    protected clearBlock(session: ISession): Promise<void>;
+    /** Removes the impersonation keys from session data without persisting. */
+    protected dropBlockKeys(session: ISession): void;
+    /**
+     * Load the original (impersonator) user, or undefined when the account is
+     * gone. Extracted so tests can stub it without a database.
+     */
+    protected loadOriginal(uuid: string): Promise<User | undefined>;
+    /**
+     * Hook for tests to intercept event emission without stubbing the
+     * module-level `_ev` ESM binding.
+     */
+    protected emitEnded(original: User, target: User): Promise<void>;
+}
+//# sourceMappingURL=ImpersonationService.d.ts.map

package/lib/cjs/services/ImpersonationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImpersonationService.d.ts","sourceRoot":"","sources":["../../../src/services/ImpersonationService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA6C,MAAM,eAAe,CAAC;AACjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;;IAK7B;;;OAGG;;CAEK,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,YAAY;AACtB,qEAAqE;AACnE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAA;CAAE;AAC3F,kEAAkE;GAChE;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE;AACjC,sEAAsE;GACpE;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEpC;;;;;;;;GAQG;AACH,qBACa,oBAAoB;IAE/B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C,kEAAkE;IAC3D,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAI9D;;;;;;;;;;;;;;;;;OAiBG;IACU,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAwB1J;;;;;;;OAOG;IACU,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAuC9F,+EAA+E;cAC/D,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,2EAA2E;IAC3E,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI;IAOhD;;;OAGG;cACa,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAIrE;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}