@spinajs/rbac-http-user 2.0.486 → 2.0.487

package/lib/cjs/services/ImpersonationService.js

@@ -0,0 +1,147 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImpersonationService = exports.IMPERSONATION_KEYS = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const rbac_1 = require("@spinajs/rbac");
+const queue_1 = require("@spinajs/queue");
+/** Session keys holding the impersonation block. */
+exports.IMPERSONATION_KEYS = {
+    IMPERSONATOR: 'Impersonator',
+    STARTED_AT: 'ImpersonationStartedAt',
+    ORIGINAL_ACTIVE_ROLE: 'OriginalActiveRole',
+    /**
+     * Numeric id of the impersonator, stashed because `session.UserId` is handed
+     * over to the target for the duration — see {@link ImpersonationService.start}.
+     */
+    ORIGINAL_USER_ID: 'OriginalUserId',
+};
+/**
+ * Owns the impersonation session block.
+ *
+ * The revert path is reachable two ways — explicitly via `DELETE /auth/impersonate`
+ * and implicitly when an impersonating user logs out — and both used to carry
+ * their own copy of the key juggling. The copies had already drifted: the logout
+ * handler dereferenced a deleted impersonator without a guard and answered a
+ * logout with a 500, while the controller handled that same case.
+ */
+let ImpersonationService = class ImpersonationService {
+    /** True when the session is currently acting as somebody else. */
+    isActive(session) {
+        return Boolean(session?.Data.get(exports.IMPERSONATION_KEYS.IMPERSONATOR));
+    }
+    /**
+     * Begin acting as `target`. The impersonator's own ActiveRole is stashed so
+     * `revert` can restore it, and the effective ActiveRole becomes the target's
+     * first role.
+     *
+     * Two things beyond the key juggling:
+     *
+     *  - the session id is REGENERATED. Assuming another identity is a privilege
+     *    change, and a privilege change on a session id that an attacker may
+     *    already know is the definition of session fixation.
+     *  - `session.UserId` is handed over to the target and the impersonator's own
+     *    id is stashed. Ownership is what `deleteByUser` keys on, so while the
+     *    impersonation runs, "log this user out everywhere" aimed at the target
+     *    reaches the impersonating session too — which is exactly what an
+     *    administrator killing a compromised account expects.
+     *
+     * @returns the regenerated session and the ActiveRole now in effect
+     */
+    async start(session, impersonator, target, startedAt) {
+        const previousActiveRole = session.Data.get('ActiveRole');
+        session.Data.set(exports.IMPERSONATION_KEYS.IMPERSONATOR, impersonator.Uuid);
+        session.Data.set(exports.IMPERSONATION_KEYS.ORIGINAL_USER_ID, session.UserId ?? impersonator.Id);
+        session.Data.set('User', target.Uuid);
+        session.Data.set(exports.IMPERSONATION_KEYS.STARTED_AT, startedAt);
+        if (previousActiveRole !== undefined) {
+            session.Data.set(exports.IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE, previousActiveRole);
+        }
+        const targetActiveRole = target.Role?.[0];
+        if (targetActiveRole) {
+            session.Data.set('ActiveRole', targetActiveRole);
+        }
+        session.UserId = target.Id;
+        const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
+        return { Session: regenerated, ActiveRole: targetActiveRole };
+    }
+    /**
+     * End an active impersonation and put the original user back in the session.
+     *
+     * The session survives either way — reverting is not a logout. When the
+     * original user is gone the impersonation block is still cleared, so the
+     * session stops claiming an identity that cannot be resolved, and the caller
+     * is told to re-authenticate rather than being handed a 500.
+     */
+    async revert(session, target) {
+        if (!session) {
+            return { Status: 'not-impersonating' };
+        }
+        const impersonatorUuid = session.Data.get(exports.IMPERSONATION_KEYS.IMPERSONATOR);
+        if (!impersonatorUuid) {
+            return { Status: 'not-impersonating' };
+        }
+        const original = await this.loadOriginal(impersonatorUuid);
+        if (!original) {
+            await this.clearBlock(session);
+            return { Status: 'impersonator-gone' };
+        }
+        session.Data.set('User', original.Uuid);
+        const restoredActiveRole = session.Data.get(exports.IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE) ?? original.Role?.[0];
+        if (restoredActiveRole) {
+            session.Data.set('ActiveRole', restoredActiveRole);
+        }
+        // ownership goes back to the impersonator along with the identity
+        session.UserId = session.Data.get(exports.IMPERSONATION_KEYS.ORIGINAL_USER_ID) ?? original.Id;
+        this.dropBlockKeys(session);
+        // Dropping an identity is a privilege change too — the id the target's
+        // session was reachable under does not survive into the impersonator's.
+        const regenerated = await (0, rbac_1.regenerateSession)(this.SessionProvider, session);
+        await this.emitEnded(original, target);
+        return { Status: 'reverted', Original: original, ActiveRole: restoredActiveRole, Session: regenerated };
+    }
+    /** Drops the impersonation keys and persists the session under the same id. */
+    async clearBlock(session) {
+        this.dropBlockKeys(session);
+        await this.SessionProvider.save(session);
+    }
+    /** Removes the impersonation keys from session data without persisting. */
+    dropBlockKeys(session) {
+        session.Data.delete(exports.IMPERSONATION_KEYS.IMPERSONATOR);
+        session.Data.delete(exports.IMPERSONATION_KEYS.STARTED_AT);
+        session.Data.delete(exports.IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE);
+        session.Data.delete(exports.IMPERSONATION_KEYS.ORIGINAL_USER_ID);
+    }
+    /**
+     * Load the original (impersonator) user, or undefined when the account is
+     * gone. Extracted so tests can stub it without a database.
+     */
+    async loadOriginal(uuid) {
+        return (await rbac_1.User.getByUuid(uuid));
+    }
+    /**
+     * Hook for tests to intercept event emission without stubbing the
+     * module-level `_ev` ESM binding.
+     */
+    emitEnded(original, target) {
+        return (0, queue_1._ev)(new rbac_1.UserImpersonationEnded(original, target))();
+    }
+};
+exports.ImpersonationService = ImpersonationService;
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.session'),
+    __metadata("design:type", rbac_1.SessionProvider)
+], ImpersonationService.prototype, "SessionProvider", void 0);
+exports.ImpersonationService = ImpersonationService = __decorate([
+    (0, di_1.Injectable)()
+], ImpersonationService);
+//# sourceMappingURL=ImpersonationService.js.map

package/lib/cjs/services/ImpersonationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImpersonationService.js","sourceRoot":"","sources":["../../../src/services/ImpersonationService.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAA2D;AAC3D,wCAAiG;AAEjG,0CAAqC;AAErC,oDAAoD;AACvC,QAAA,kBAAkB,GAAG;IAChC,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,wBAAwB;IACpC,oBAAoB,EAAE,oBAAoB;IAE1C;;;OAGG;IACH,gBAAgB,EAAE,gBAAgB;CAC1B,CAAC;AAWX;;;;;;;;GAQG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAI/B,kEAAkE;IAC3D,QAAQ,CAAC,OAAoC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,KAAK,CAAC,OAAiB,EAAE,YAAkB,EAAE,MAAY,EAAE,SAAiB;QACvF,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;QAEhF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE3D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CAAC,OAAoC,EAAE,MAAY;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,YAAY,CAAuB,CAAC;QACjG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QAED,kEAAkE;QAClE,OAAO,CAAC,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAAkB,CAAC,gBAAgB,CAAwB,IAAI,QAAQ,CAAC,EAAE,CAAC;QAE9G,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE5B,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEvC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,CAAC;IAED,+EAA+E;IACrE,KAAK,CAAC,UAAU,CAAC,OAAiB;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IACjE,aAAa,CAAC,OAAiB;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,0BAAkB,CAAC,YAAY,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,0BAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,0BAAkB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,0BAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,YAAY,CAAC,IAAY;QACvC,OAAO,CAAC,MAAM,WAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAqB,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,IAAA,WAAG,EAAC,IAAI,6BAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AA/HY,oDAAoB;AAErB;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;6DAAC;+BAFhC,oBAAoB;IADhC,IAAA,eAAU,GAAE;GACA,oBAAoB,CA+HhC"}

package/lib/cjs/services/SessionCookies.d.ts

@@ -0,0 +1,41 @@
+import type { ISession, ISessionCookieConfig } from '@spinajs/rbac';
+/** Cookie descriptor accepted by the http `Coockies` response option. */
+export interface ISessionCookie {
+    Name: string;
+    Value: string;
+    Options: Record<string, unknown>;
+}
+/**
+ * Default name of the session cookie. Kept for callers that only need the
+ * literal; the ACTIVE name comes from configuration and may carry a `__Host-`
+ * prefix, so read {@link SessionCookieFactory.Name} instead of assuming this.
+ */
+export declare const SESSION_COOKIE_NAME = "ssid";
+/**
+ * Builds the session cookie.
+ *
+ * Every place that opens, rotates, or clears a session used to inline the same
+ * literal — login, 2FA verify, active-role switch and logout each carried their
+ * own copy, and each had to remember `signed`, `httpOnly`, the configured
+ * overrides, and to derive maxAge from the session's real expiration. A drift in
+ * any one of them silently produces a cookie the next request cannot restore.
+ *
+ * The attributes themselves are decided by `@spinajs/rbac` so the session
+ * middleware — which renews the very same cookie on every request, from a
+ * package that cannot import this one — produces a byte-identical set.
+ */
+export declare class SessionCookieFactory {
+    protected SessionCookieConfig: ISessionCookieConfig;
+    /** Configured cookie name, `__Host-` prefix included when enabled. */
+    get Name(): string;
+    /**
+     * Cookie carrying an active session. `maxAge` tracks the session's real
+     * expiration rather than a fixed constant, so sliding and absolute
+     * expiration strategies both produce a cookie that outlives exactly as long
+     * as the session behind it.
+     */
+    issue(session: ISession): ISessionCookie;
+    /** Same cookie, expired — clears the session client-side on logout. */
+    clear(): ISessionCookie;
+}
+//# sourceMappingURL=SessionCookies.d.ts.map

package/lib/cjs/services/SessionCookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionCookies.d.ts","sourceRoot":"","sources":["../../../src/services/SessionCookies.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGpE,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAE/B,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,sEAAsE;IACtE,IAAW,IAAI,IAAI,MAAM,CAExB;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc;IAI/C,uEAAuE;IAChE,KAAK,IAAI,cAAc;CAG/B"}

package/lib/cjs/services/SessionCookies.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionCookieFactory = exports.SESSION_COOKIE_NAME = void 0;
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const rbac_1 = require("@spinajs/rbac");
+/**
+ * Default name of the session cookie. Kept for callers that only need the
+ * literal; the ACTIVE name comes from configuration and may carry a `__Host-`
+ * prefix, so read {@link SessionCookieFactory.Name} instead of assuming this.
+ */
+exports.SESSION_COOKIE_NAME = 'ssid';
+/**
+ * Builds the session cookie.
+ *
+ * Every place that opens, rotates, or clears a session used to inline the same
+ * literal — login, 2FA verify, active-role switch and logout each carried their
+ * own copy, and each had to remember `signed`, `httpOnly`, the configured
+ * overrides, and to derive maxAge from the session's real expiration. A drift in
+ * any one of them silently produces a cookie the next request cannot restore.
+ *
+ * The attributes themselves are decided by `@spinajs/rbac` so the session
+ * middleware — which renews the very same cookie on every request, from a
+ * package that cannot import this one — produces a byte-identical set.
+ */
+let SessionCookieFactory = class SessionCookieFactory {
+    /** Configured cookie name, `__Host-` prefix included when enabled. */
+    get Name() {
+        return (0, rbac_1.sessionCookieName)(this.SessionCookieConfig);
+    }
+    /**
+     * Cookie carrying an active session. `maxAge` tracks the session's real
+     * expiration rather than a fixed constant, so sliding and absolute
+     * expiration strategies both produce a cookie that outlives exactly as long
+     * as the session behind it.
+     */
+    issue(session) {
+        return (0, rbac_1.sessionCookie)(session, this.SessionCookieConfig);
+    }
+    /** Same cookie, expired — clears the session client-side on logout. */
+    clear() {
+        return (0, rbac_1.clearSessionCookie)(this.SessionCookieConfig);
+    }
+};
+exports.SessionCookieFactory = SessionCookieFactory;
+__decorate([
+    (0, configuration_1.Config)('rbac.session.cookie', {}),
+    __metadata("design:type", Object)
+], SessionCookieFactory.prototype, "SessionCookieConfig", void 0);
+exports.SessionCookieFactory = SessionCookieFactory = __decorate([
+    (0, di_1.Injectable)()
+], SessionCookieFactory);
+//# sourceMappingURL=SessionCookies.js.map

package/lib/cjs/services/SessionCookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionCookies.js","sourceRoot":"","sources":["../../../src/services/SessionCookies.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAgD;AAChD,oCAAyC;AAEzC,wCAAqF;AASrF;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;;;GAYG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAI/B,sEAAsE;IACtE,IAAW,IAAI;QACb,OAAO,IAAA,wBAAiB,EAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAiB;QAC5B,OAAO,IAAA,oBAAa,EAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,uEAAuE;IAChE,KAAK;QACV,OAAO,IAAA,yBAAkB,EAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAvBY,oDAAoB;AAErB;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACkB;+BAFzC,oBAAoB;IADhC,IAAA,eAAU,GAAE;GACA,oBAAoB,CAuBhC"}

package/lib/cjs/services/UserMetadataService.d.ts

@@ -0,0 +1,53 @@
+import { UserMetadata } from '@spinajs/rbac';
+import type { IFilterRequest, OrderDTO, PaginationDTO } from '@spinajs/orm-http';
+import { FilterableUserMetadata } from '../models/FilterableUserMetadata.js';
+import type { UserMetadataDto } from '../dto/metadata-dto.js';
+/**
+ * Fallback page size. A request without a `limit` used to reach `take(0)`,
+ * which the query builder rejects ( "take count should be a positive number" ),
+ * so plain listing requests failed instead of returning the first page.
+ */
+export declare const DEFAULT_PAGE_SIZE = 10;
+/**
+ * User metadata access, always scoped to one owner.
+ *
+ * The controller exposes each operation twice — once for the caller's own
+ * metadata and once for an administrator addressing a user by UUID — and the
+ * two differed only in where the owner id came from. Keeping the queries here
+ * means the ownership predicate is written once.
+ *
+ * Ownership is filtered explicitly rather than left to the rbac query
+ * middleware: metadata queries resolve to the unsafe base model, so no
+ * automatic owner scoping fires for them.
+ */
+export declare class UserMetadataService {
+    /** Paginated, filtered, ordered listing of one user's metadata. */
+    list(ownerId: number, pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope;
+    /** A single entry of one user, by key. Rejects when absent. */
+    getByKey(ownerId: number, key: string): Promise<UserMetadata>;
+    /**
+     * Insert an entry, or update it when the key already exists.
+     *
+     * Ownership is forced onto the model — a `user_id` arriving in the request
+     * body is never trusted.
+     */
+    upsert(ownerId: number, metadata: UserMetadata): Promise<void>;
+    /**
+     * Update an entry addressed by either its Id or its Key.
+     *
+     * The Key/Id lookup is grouped and AND-ed with the ownership filter. Without
+     * the grouping the flat `Key = ? OR Id = ? AND user_id = ?` binds as
+     * `Key = ? OR (Id = ? AND user_id = ?)`, which would let any caller update
+     * another user's entry by its Key.
+     */
+    update(ownerId: number, idOrKey: string | number, data: UserMetadataDto): Promise<void>;
+    /**
+     * Delete an entry by id, scoped to its owner.
+     *
+     * `destroy()` refuses to build an unbounded DELETE, so the entry id goes in
+     * as the primary key and ownership is AND-ed on top of it — deleting by id
+     * alone would let any caller remove anybody's entry.
+     */
+    delete(ownerId: number, id: number): Promise<void>;
+}
+//# sourceMappingURL=UserMetadataService.d.ts.map

package/lib/cjs/services/UserMetadataService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserMetadataService.d.ts","sourceRoot":"","sources":["../../../src/services/UserMetadataService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,qBACa,mBAAmB;IAC9B,mEAAmE;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAc;IAWlG,+DAA+D;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAO5C;;;;;OAKG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3E;;;;;;;OAOG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpG;;;;;;OAMG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhE"}

package/lib/cjs/services/UserMetadataService.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserMetadataService = exports.DEFAULT_PAGE_SIZE = void 0;
+const di_1 = require("@spinajs/di");
+const rbac_1 = require("@spinajs/rbac");
+const orm_1 = require("@spinajs/orm");
+const FilterableUserMetadata_js_1 = require("../models/FilterableUserMetadata.js");
+/**
+ * Fallback page size. A request without a `limit` used to reach `take(0)`,
+ * which the query builder rejects ( "take count should be a positive number" ),
+ * so plain listing requests failed instead of returning the first page.
+ */
+exports.DEFAULT_PAGE_SIZE = 10;
+/**
+ * User metadata access, always scoped to one owner.
+ *
+ * The controller exposes each operation twice — once for the caller's own
+ * metadata and once for an administrator addressing a user by UUID — and the
+ * two differed only in where the owner id came from. Keeping the queries here
+ * means the ownership predicate is written once.
+ *
+ * Ownership is filtered explicitly rather than left to the rbac query
+ * middleware: metadata queries resolve to the unsafe base model, so no
+ * automatic owner scoping fires for them.
+ */
+let UserMetadataService = class UserMetadataService {
+    /** Paginated, filtered, ordered listing of one user's metadata. */
+    list(ownerId, pagination, order, filter) {
+        const limit = pagination?.limit || exports.DEFAULT_PAGE_SIZE;
+        return FilterableUserMetadata_js_1.FilterableUserMetadata.select()
+            .where('user_id', ownerId)
+            .filter(filter?.filters ?? [], filter?.op)
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
+            .order(order?.column ?? 'Id', order?.order ?? orm_1.SortOrder.DESC);
+    }
+    /** A single entry of one user, by key. Rejects when absent. */
+    getByKey(ownerId, key) {
+        return rbac_1.UserMetadata.where({
+            Key: key,
+            user_id: ownerId,
+        }).firstOrFail();
+    }
+    /**
+     * Insert an entry, or update it when the key already exists.
+     *
+     * Ownership is forced onto the model — a `user_id` arriving in the request
+     * body is never trusted.
+     */
+    async upsert(ownerId, metadata) {
+        metadata.user_id = ownerId;
+        await metadata.insert(orm_1.InsertBehaviour.InsertOrUpdate);
+    }
+    /**
+     * Update an entry addressed by either its Id or its Key.
+     *
+     * The Key/Id lookup is grouped and AND-ed with the ownership filter. Without
+     * the grouping the flat `Key = ? OR Id = ? AND user_id = ?` binds as
+     * `Key = ? OR (Id = ? AND user_id = ?)`, which would let any caller update
+     * another user's entry by its Key.
+     */
+    async update(ownerId, idOrKey, data) {
+        await rbac_1.UserMetadata.update({
+            Key: data.Key,
+            Value: data.Value,
+            Type: data.Type,
+        })
+            .where(function () {
+            this.where('Key', idOrKey).orWhere('Id', idOrKey);
+        })
+            .andWhere('user_id', ownerId);
+    }
+    /**
+     * Delete an entry by id, scoped to its owner.
+     *
+     * `destroy()` refuses to build an unbounded DELETE, so the entry id goes in
+     * as the primary key and ownership is AND-ed on top of it — deleting by id
+     * alone would let any caller remove anybody's entry.
+     */
+    async delete(ownerId, id) {
+        await rbac_1.UserMetadata.destroy(id).andWhere('user_id', ownerId);
+    }
+};
+exports.UserMetadataService = UserMetadataService;
+exports.UserMetadataService = UserMetadataService = __decorate([
+    (0, di_1.Injectable)()
+], UserMetadataService);
+//# sourceMappingURL=UserMetadataService.js.map

package/lib/cjs/services/UserMetadataService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserMetadataService.js","sourceRoot":"","sources":["../../../src/services/UserMetadataService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,wCAA6C;AAC7C,sCAA0D;AAE1D,mFAA6E;AAG7E;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;GAWG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,mEAAmE;IAC5D,IAAI,CAAC,OAAe,EAAE,UAA0B,EAAE,KAAgB,EAAE,MAAuB;QAChG,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,yBAAiB,CAAC;QAErD,OAAO,kDAAsB,CAAC,MAAM,EAAE;aACnC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;aACzB,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACzC,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,eAAS,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,+DAA+D;IACxD,QAAQ,CAAC,OAAe,EAAE,GAAW;QAC1C,OAAO,mBAAY,CAAC,KAAK,CAAC;YACxB,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAsB;QACzD,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAwB,EAAE,IAAqB;QAClF,MAAM,mBAAY,CAAC,MAAM,CAAC;YACxB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,KAAK,CAAC;YACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC;aACD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,EAAU;QAC7C,MAAM,mBAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AA9DY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,eAAU,GAAE;GACA,mBAAmB,CA8D/B"}

package/lib/cjs/services/grants.d.ts

@@ -0,0 +1,29 @@
+import { AccessControl, User } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import type { IGrantsMap, IUserWithGrants } from '@spinajs/rbac-http';
+/**
+ * Role whose grants are in effect for a session.
+ *
+ * Enforcement (see the rbac http middleware) resolves permissions from the
+ * session's ActiveRole and falls back to the first assigned role, so anything
+ * reported to a client has to resolve it the same way — otherwise the client is
+ * told about actions the server will refuse.
+ */
+export declare function activeRoleOf(user: User, session?: ISession | null): string | undefined;
+/**
+ * Grants in effect for a single role, flattened through its `$extend` chain.
+ * An absent role yields an empty map rather than throwing — a user with no role
+ * assigned simply has no grants.
+ */
+export declare function grantsFor(ac: AccessControl, activeRole: string | undefined): IGrantsMap;
+/**
+ * The login-style user payload: the dehydrated user plus their active role and
+ * the grants that role resolves to.
+ *
+ * Login, 2FA verification and ending an impersonation all hand the client the
+ * same shape, and all three previously assembled it by hand. `Role` is restored
+ * explicitly because `dehydrateWithRelations` flattens the relation to a string
+ * while clients expect the array they can switch between.
+ */
+export declare function buildUserWithGrants(user: User, activeRole: string | undefined, ac: AccessControl): IUserWithGrants;
+//# sourceMappingURL=grants.d.ts.map

package/lib/cjs/services/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/services/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEtE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,aAAa,GAAG,eAAe,CAOlH"}

package/lib/cjs/services/grants.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.activeRoleOf = activeRoleOf;
+exports.grantsFor = grantsFor;
+exports.buildUserWithGrants = buildUserWithGrants;
+const rbac_1 = require("@spinajs/rbac");
+/**
+ * Role whose grants are in effect for a session.
+ *
+ * Enforcement (see the rbac http middleware) resolves permissions from the
+ * session's ActiveRole and falls back to the first assigned role, so anything
+ * reported to a client has to resolve it the same way — otherwise the client is
+ * told about actions the server will refuse.
+ */
+function activeRoleOf(user, session) {
+    return session?.Data.get('ActiveRole') ?? user.Role?.[0];
+}
+/**
+ * Grants in effect for a single role, flattened through its `$extend` chain.
+ * An absent role yields an empty map rather than throwing — a user with no role
+ * assigned simply has no grants.
+ */
+function grantsFor(ac, activeRole) {
+    return (activeRole ? (0, rbac_1._unwindGrants)(activeRole, ac.getGrants()) : {});
+}
+/**
+ * The login-style user payload: the dehydrated user plus their active role and
+ * the grants that role resolves to.
+ *
+ * Login, 2FA verification and ending an impersonation all hand the client the
+ * same shape, and all three previously assembled it by hand. `Role` is restored
+ * explicitly because `dehydrateWithRelations` flattens the relation to a string
+ * while clients expect the array they can switch between.
+ */
+function buildUserWithGrants(user, activeRole, ac) {
+    return {
+        ...user.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
+        Role: user.Role,
+        ActiveRole: activeRole,
+        Grants: grantsFor(ac, activeRole),
+    };
+}
+//# sourceMappingURL=grants.js.map

package/lib/cjs/services/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/services/grants.ts"],"names":[],"mappings":";;AAYA,oCAEC;AAOD,8BAEC;AAWD,kDAOC;AAzCD,wCAAmE;AAInE;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,IAAU,EAAE,OAAyB;IAChE,OAAQ,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,EAAiB,EAAE,UAA8B;IACzE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAe,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CAAC,IAAU,EAAE,UAA8B,EAAE,EAAiB;IAC/F,OAAO;QACL,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACzD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC;KACJ,CAAC;AAClC,CAAC"}

package/lib/mjs/config/rbac-http.d.ts

@@ -40,27 +40,12 @@ declare const rbacHttp: {
             forceUser: boolean;
             service: string;
         };
-        fingerprint: {
-            enabled: boolean;
-            maxDevices: number;
-            service: string;
-        };
-        session: {
-            cookie: {
-                sameSite: string;
-            };
-        };
         password: {
-            tokenTTL: number;
             /**
              * Block account after invalid login attempts
              */
             blockAfterAttempts: number;
         };
-        /**
-         * Should federated login be enabled ? eg. facebook
-         */
-        allowFederated: boolean;
     };
     http: {};
 };

package/lib/mjs/config/rbac-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;YAiBR;;eAEG;;YAGH;;eAEG;;;;;;;;;;;;;;;;;;;;;;;YAyBH;;eAEG;;;QAGL;;WAEG;;;;CAQN,CAAC;AAEF,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"rbac-http.d.ts","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;YAiBR;;eAEG;;YAGH;;eAEG;;;;;;;;;;;;YAmBH;;eAEG;;;;;CASR,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/lib/mjs/config/rbac-http.js

@@ -37,28 +37,18 @@ const rbacHttp = {
             forceUser: false,
             service: 'Default2FaToken',
         },
-        fingerprint: {
-            enabled: false,
-            maxDevices: 3,
-            service: 'FingerprintJs',
-        },
-        session: {
-            cookie: {
-                sameSite: 'lax'
-            }
-        },
+        // NOTE: the session cookie ( `rbac.session.cookie` ) is configured by
+        // @spinajs/rbac and defaults to Secure + SameSite=Strict + HttpOnly. This
+        // package used to weaken it to SameSite=Lax here, which is what let a
+        // cross-site GET reach the logout route.
         password: {
-            // password reset token ttl in minutes
-            tokenTTL: 60,
+            // NOTE: the password reset token's lifetime is `rbac.password.passwordResetWaitTime`
+            // ( seconds, defined by @spinajs/rbac ) — this package does not restate it.
             /**
              * Block account after invalid login attempts
              */
             blockAfterAttempts: 3,
         },
-        /**
-         * Should federated login be enabled ? eg. facebook
-         */
-        allowFederated: false,
     },
     http: {
     // middlewares: [

package/lib/mjs/config/rbac-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-http.js","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3K,CAAC;AAGD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAClB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,cAAc,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACvD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SACtD;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP;;eAEG;YACH,MAAM,EAAE,SAAS;YAEjB;;eAEG;YACH,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC;SACV;QACD,aAAa,EAAE;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB;SAC3B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,eAAe;SACzB;QACD,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK;aAChB;SACF;QACD,QAAQ,EAAE;YACR,sCAAsC;YACtC,QAAQ,EAAE,EAAE;YAEZ;;eAEG;YACH,kBAAkB,EAAE,CAAC;SACtB;QACD;;WAEG;QACH,cAAc,EAAE,KAAK;KACtB;IACD,IAAI,EAAE;IACJ,iBAAiB;IACjB,+CAA+C;IAC/C,KAAK;KACN;CACF,CAAC;AAEF,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"rbac-http.js","sourceRoot":"","sources":["../../../src/config/rbac-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3K,CAAC;AAGD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAClB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,cAAc,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACvD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SACtD;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE;YACP;;eAEG;YACH,MAAM,EAAE,SAAS;YAEjB;;eAEG;YACH,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC;SACV;QACD,aAAa,EAAE;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB;SAC3B;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,yCAAyC;QACzC,QAAQ,EAAE;YACR,qFAAqF;YACrF,4EAA4E;YAE5E;;eAEG;YACH,kBAAkB,EAAE,CAAC;SACtB;KACF;IACD,IAAI,EAAE;IACJ,iBAAiB;IACjB,+CAA+C;IAC/C,KAAK;KACN;CACF,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/lib/mjs/controllers/ActiveRoleController.d.ts

@@ -3,6 +3,7 @@ import { BaseController, Ok, BadRequestResponse, Unauthorized } from '@spinajs/h
 import { AccessControl, AuthProvider, PasswordProvider, SessionProvider } from '@spinajs/rbac';
 import type { ISession, User } from '@spinajs/rbac';
 import { IActiveRoleResponse } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Active role endpoints.
  * Let users with multiple roles inspect and switch the currently active role.
@@ -16,7 +17,7 @@ export declare class ActiveRoleController extends BaseController {
     protected PasswordProvider: PasswordProvider;
     protected SessionProvider: SessionProvider;
     protected RolesRequiringPassword: string[];
-    protected SessionCookieConfig: any;
+    protected SessionCookies: SessionCookieFactory;
     /**
      * Get active role
      * Returns the currently active role for the session and the RBAC grants

package/lib/mjs/controllers/ActiveRoleController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAyD,MAAM,eAAe,CAAC;AACtJ,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtI;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAEnC;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAqDvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAOjE"}
+{"version":3,"file":"ActiveRoleController.d.ts","sourceRoot":"","sources":["../../../src/controllers/ActiveRoleController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAwB,EAAE,EAAO,kBAAkB,EAAE,YAAY,EAAU,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAA+E,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;GAMG;AACH,qBACa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;OAOG;IAGU,aAAa,CAAiB,IAAI,EAAE,IAAI,EAAiB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAI3H;;;;;;;;;OASG;IAGU,gBAAgB,CACX,IAAI,EAAE,IAAI,EACP,OAAO,EAAE,QAAQ,EAC5B,OAAO,EAAE,aAAa,GAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,GAAG,YAAY,CAAC;IA0CvE,SAAS,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB;CAMjE"}