@spinajs/rbac-http-user 2.0.486 → 2.0.488

package/lib/mjs/controllers/UserController.js

@@ -11,14 +11,14 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { PasswordDto } from '../dto/password-dto.js';
-import { User as UserModel, PasswordProvider, SessionProvider, passwordMatch, changePassword, _unwindGrants, AccessControl } from '@spinajs/rbac';
-import { BaseController, BasePath, Get, Ok, Body, Patch, Cookie, Policy } from '@spinajs/http';
+import { User as UserModel, PasswordProvider, SessionProvider, UserSession, passwordMatch, changePassword, AccessControl } from '@spinajs/rbac';
+import { BaseController, BasePath, Get, Ok, Body, Patch, Policy } from '@spinajs/http';
 import { InvalidArgument } from '@spinajs/exceptions';
 import { Autoinject } from '@spinajs/di';
-import { Config } from '@spinajs/configuration';
-import * as cs from 'cookie-signature';
-import { AuthorizedPolicy, Permission, Resource, User } from '@spinajs/rbac-http';
+import { AuthorizedPolicy, Permission, Resource, User, Session as SessionRouteArg, SessionId as SessionIdArg } from '@spinajs/rbac-http';
 import { _chain, _either } from '@spinajs/util';
+import { activeRoleOf, grantsFor } from '../services/grants.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Current user profile management.
  * Allows an authenticated user to read and modify their own account — refresh profile data,
@@ -39,10 +39,11 @@ let UserController = class UserController extends BaseController {
         // get user data from db
         await user.refresh();
         await user.Metadata.populate();
-        // refresh session data from DB
-        const sId = cs.unsign(ssid, this.CoockieSecret);
-        if (sId) {
-            const session = await this.SessionProvider.restore(sId);
+        // `@Cookie(true)` hands over the already-unsigned session id — the previous
+        // unsigned read plus a hand-rolled `cookie-signature` call duplicated what
+        // the framework's own extractor does, secret lookup included.
+        if (ssid) {
+            const session = await this.SessionProvider.restore(ssid);
             if (session) {
                 // Session stores the user UUID (see LoginController) — RbacUserFactory
                 // resolves the user from it on each request. Storing a dehydrated object
@@ -51,22 +52,28 @@ let UserController = class UserController extends BaseController {
                 await this.SessionProvider.save(session);
             }
         }
-        return new Ok(user.dehydrate());
+        // Same shape as every other user-bearing response ( login, whoami, 2FA
+        // verify ): relations included and DateTime rendered as ISO strings. Plain
+        // `dehydrate()` dropped Role/Metadata and emitted raw DateTime objects, so
+        // a client refreshing its profile got a different user than it logged in with.
+        return new Ok(user.dehydrateWithRelations({ dateTimeFormat: 'iso' }));
     }
     /**
      * Get current user grants
-     * Returns the flattened RBAC grants for the authenticated user, combining all roles
-     * the user is assigned to into a single permission map keyed by resource.
+     * Returns the flattened RBAC grants in effect for the authenticated user — those of
+     * the session's active role, resolved through its inheritance chain. Switching the
+     * active role (`POST /auth/active-role`) changes what this returns.
      * @security cookieAuth
-     * @returns {IGrantsMap} Combined RBAC grants map: resource → action → permission descriptor
+     * @returns {IGrantsMap} RBAC grants map for the active role: resource → action → permission descriptor
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    async getGrants(user) {
-        const grants = this.AC.getGrants();
-        const userGrants = user.Role.map(r => _unwindGrants(r, grants));
-        const combinedGrants = Object.assign({}, ...userGrants);
-        return new Ok(combinedGrants);
+    async getGrants(user, session) {
+        // Enforcement is bound to the session's ActiveRole, so reporting the union
+        // of every assigned role told clients about actions the server would then
+        // refuse — a user holding both 'admin' and 'user' saw admin grants while
+        // acting as 'user'. Resolve exactly what the middleware resolves.
+        return new Ok(grantsFor(this.AC, activeRoleOf(user, session)));
     }
     /**
      * Change own password
@@ -77,23 +84,41 @@ let UserController = class UserController extends BaseController {
      * @response 401 Unauthorized — valid session required
      * @response 403 Forbidden — insufficient permissions
      */
-    async newPassword(user, pwd) {
+    async newPassword(user, pwd, session) {
         if (pwd.Password !== pwd.ConfirmPassword) {
             throw new InvalidArgument('password does not match');
         }
-        return new Ok(_chain(user, _either(passwordMatch(pwd.OldPassword), changePassword(pwd.Password), () => {
+        await _chain(user, _either(passwordMatch(pwd.OldPassword), changePassword(pwd.Password), () => {
             throw new InvalidArgument('Old password is incorrect');
-        })));
+        }));
+        // `changePassword` destroys every session of this user — anyone who got in
+        // with the old password is out, which is the whole point. That includes the
+        // caller's own session, so it is replaced here with a brand new one ( a new
+        // id, not the old one revived ) and the client is handed the new cookie.
+        const replacement = new UserSession();
+        replacement.UserId = user.Id;
+        if (session) {
+            for (const [key, value] of session.Data) {
+                replacement.Data.set(key, value);
+            }
+        }
+        else {
+            replacement.Data.set('User', user.Uuid);
+            replacement.Data.set('Logged', true);
+            replacement.Data.set('Authorized', true);
+            replacement.Data.set('ActiveRole', user.Role?.[0]);
+        }
+        await this.SessionProvider.save(replacement);
+        return new Ok(null, {
+            Coockies: [this.SessionCookies.issue(replacement)],
+            Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+        });
     }
 };
 __decorate([
     Autoinject(),
     __metadata("design:type", PasswordProvider)
 ], UserController.prototype, "PasswordProvider", void 0);
-__decorate([
-    Config('http.cookie.secret'),
-    __metadata("design:type", String)
-], UserController.prototype, "CoockieSecret", void 0);
 __decorate([
     Autoinject(),
     __metadata("design:type", SessionProvider)
@@ -102,11 +127,15 @@ __decorate([
     Autoinject(AccessControl),
     __metadata("design:type", AccessControl)
 ], UserController.prototype, "AC", void 0);
+__decorate([
+    Autoinject(SessionCookieFactory),
+    __metadata("design:type", SessionCookieFactory)
+], UserController.prototype, "SessionCookies", void 0);
 __decorate([
     Get(),
     Permission(['readOwn']),
     __param(0, User()),
-    __param(1, Cookie()),
+    __param(1, SessionIdArg()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [UserModel, String]),
     __metadata("design:returntype", Promise)
@@ -115,8 +144,9 @@ __decorate([
     Get("grants"),
     Permission(['readOwn']),
     __param(0, User()),
+    __param(1, SessionRouteArg()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:paramtypes", [UserModel, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "getGrants", null);
 __decorate([
@@ -124,8 +154,9 @@ __decorate([
     Permission(["updateOwn"]),
     __param(0, User()),
     __param(1, Body()),
+    __param(2, SessionRouteArg()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [UserModel, PasswordDto]),
+    __metadata("design:paramtypes", [UserModel, PasswordDto, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "newPassword", null);
 UserController = __decorate([

package/lib/mjs/controllers/UserController.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAClJ,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAc,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAIhD;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,cAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAY,IAAY;QAClE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,+BAA+B;QAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;QAExD,OAAO,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAGD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAU,GAAgB;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAGD,OAAO,IAAI,EAAE,CACX,MAAM,CACJ,IAAI,EACJ,OAAO,CACL,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAC9B,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE;YACH,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC,CAAC,CACL,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7FW;IADT,UAAU,EAAE;8BACe,gBAAgB;wDAAC;AAGnC;IADT,MAAM,CAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,UAAU,EAAE;8BACc,eAAe;uDAAC;AAGjC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;0CAAC;AAaf;IAFZ,GAAG,EAAE;IACL,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,MAAM,EAAE,CAAA;;qCAApB,SAAS;;6CAmB3C;AAaY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;+CAO7C;AAcY;IAFZ,KAAK,CAAC,UAAU,CAAC;IACjB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,WAAW;;iDAiBzE;AA9FU,cAAc;IAH1B,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,gBAAgB,CAAC;GACZ,cAAc,CA+F1B"}
+{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEhJ,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAc,OAAO,IAAI,eAAe,EAAE,SAAS,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrJ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE;;;;;GAKG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,cAAc;IAahD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAkB,IAAY;QACxE,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE/B,4EAA4E;QAC5E,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAqB,OAAiB;QAClF,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAGD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAU,GAAgB,EAAqB,OAAiB;QAC9G,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,CACV,IAAI,EACJ,OAAO,CACL,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAC9B,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE;YACH,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC,CAAC,CACL,CAAC;QAEF,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACtC,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACxC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACrC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACzC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7C,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE;YAClB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAxHW;IADT,UAAU,EAAE;8BACe,gBAAgB;wDAAC;AAGnC;IADT,UAAU,EAAE;8BACc,eAAe;uDAAC;AAGjC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;0CAAC;AAGlB;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;sDAAC;AAalC;IAFZ,GAAG,EAAE;IACL,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,YAAY,EAAE,CAAA;;qCAA1B,SAAS;;6CAwB3C;AAcY;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,eAAe,EAAE,CAAA;;qCAA7B,SAAS;;+CAM7C;AAcY;IAFZ,KAAK,CAAC,UAAU,CAAC;IACjB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;IAAoB,WAAA,eAAe,EAAE,CAAA;;qCAAvD,SAAS,EAAe,WAAW;;iDAuCzE;AAzHU,cAAc;IAH1B,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,gBAAgB,CAAC;GACZ,cAAc,CA0H1B"}

package/lib/mjs/controllers/UserMetadataController.d.ts

@@ -3,14 +3,20 @@ import { User as UserModel, UserMetadata } from '@spinajs/rbac';
 import { PaginationDTO, OrderDTO, IFilterRequest } from '@spinajs/orm-http';
 import { UserMetadataDto } from '../dto/metadata-dto.js';
 import { FilterableUserMetadata } from '../models/FilterableUserMetadata.js';
+import { UserMetadataService } from '../services/UserMetadataService.js';
 /**
  * User metadata management.
  * Provides CRUD operations for key-value metadata entries attached to user accounts.
  * Admin routes operate on any user (identified by UUID), while own routes operate on the
  * currently authenticated user's metadata.
+ *
+ * Both families delegate to {@link UserMetadataService}, which owns the owner
+ * scoping — the only thing that ever differed between them is where the owner
+ * id comes from.
  * @tags User Metadata
  */
 export declare class UserMetadataController extends BaseController {
+    protected Metadata: UserMetadataService;
     /**
      * List metadata for a specific user (admin)
      * Returns a paginated, filtered, and ordered list of metadata entries for the given user.
@@ -74,18 +80,6 @@ export declare class UserMetadataController extends BaseController {
      * @response 404 User or metadata entry not found
      */
     deleteUserMetadata(user: UserModel, meta: number): Promise<Ok<any>>;
-    /**
-     * List own metadata
-     * Returns a paginated, filtered, and ordered list of metadata entries for the authenticated user.
-     * @security cookieAuth
-     * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of entries per page
-     * @param order.column Column to sort by (default: Id)
-     * @param order.order Sort direction: ASC or DESC (default: DESC)
-     * @returns {IUserMetadataEntry[]} Paginated list of own metadata entries
-     * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — readOwn permission required
-     */
     /**
      * List own metadata
      * Returns a paginated, filtered, and ordered list of metadata entries for the authenticated user.

package/lib/mjs/controllers/UserMetadataController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAS7E;;;;;;GAMG;AACH,qBAGa,sBAAuB,SAAQ,cAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,YAAY,CACc,IAAI,EAAE,SAAS,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAc3B;;;;;;;;;;OAUG;IAGU,WAAW,CACe,IAAI,EAAE,SAAS,EACzC,GAAG,EAAE,MAAM;IAOxB;;;;;;;;;OASG;IAGU,eAAe,CACW,IAAI,EAAE,SAAS,EACvC,QAAQ,EAAE,YAAY;IAOrC;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAOxB,IAAI,EAAE,YAAY,EACc,KAAK,EAAE,SAAS,EAC3C,IAAI,EAAE,eAAe;IAUjC;;;;;;;;;;OAUG;IAGU,kBAAkB,CACQ,IAAI,EAAE,SAAS,EACzC,IAAI,EAAE,MAAM;IASzB;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,QAAQ,CACT,IAAI,EAAE,SAAS,EACd,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAe3B;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAW,GAAG,EAAE,MAAM;IAOlE;;;;;;;OAOG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAa,QAAQ,EAAE,YAAY;IAQnF;;;;;;;;;;OAUG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,eAAe;IAkBzG;;;;;;;;;OASG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM;CAK7E"}
+{"version":3,"file":"UserMetadataController.d.ts","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,EAAE,EAAwC,cAAc,EAAS,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAW,aAAa,EAAE,QAAQ,EAAU,cAAc,EAAa,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,qBAGa,sBAAuB,SAAQ,cAAc;IAGtD,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAExC;;;;;;;;;;;;;OAaG;IAGU,YAAY,CACc,IAAI,EAAE,SAAS,EACzC,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAM3B;;;;;;;;;;OAUG;IAGU,WAAW,CACe,IAAI,EAAE,SAAS,EACzC,GAAG,EAAE,MAAM;IAIxB;;;;;;;;;OASG;IAGU,eAAe,CACW,IAAI,EAAE,SAAS,EACvC,QAAQ,EAAE,YAAY;IAMrC;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAOxB,IAAI,EAAE,YAAY,EACc,KAAK,EAAE,SAAS,EAC3C,IAAI,EAAE,eAAe;IAUjC;;;;;;;;;;OAUG;IAGU,kBAAkB,CACQ,IAAI,EAAE,SAAS,EACzC,IAAI,EAAE,MAAM;IAMzB;;;;;;;;;;;OAWG;IAGU,QAAQ,CACT,IAAI,EAAE,SAAS,EACd,UAAU,CAAC,EAAE,aAAa,EAC1B,KAAK,CAAC,EAAE,QAAQ,EAEzB,MAAM,CAAC,EAAE,cAAc;IAK3B;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAW,GAAG,EAAE,MAAM;IAIlE;;;;;;;OAOG;IAGU,WAAW,CAAS,IAAI,EAAE,SAAS,EAAa,QAAQ,EAAE,YAAY;IAKnF;;;;;;;;;;OAUG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,eAAe;IAMzG;;;;;;;;;OASG;IAGU,cAAc,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM;CAK7E"}

package/lib/mjs/controllers/UserMetadataController.js

@@ -12,22 +12,21 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Post, BasePath, Ok, Del, Body, Get, Query, Param, Policy, BaseController, Patch } from '@spinajs/http';
 import { User as UserModel, UserMetadata } from '@spinajs/rbac';
+import { Autoinject } from '@spinajs/di';
 import { AuthorizedPolicy, Permission, Resource, User } from '@spinajs/rbac-http';
 import { AsModel, PaginationDTO, OrderDTO, Filter, FromModel } from '@spinajs/orm-http';
 import { UserMetadataDto } from '../dto/metadata-dto.js';
-import { InsertBehaviour, SortOrder } from '@spinajs/orm';
 import { FilterableUserMetadata } from '../models/FilterableUserMetadata.js';
-/**
- * Fallback page size. A request without a `limit` used to reach `take(0)`,
- * which the query builder rejects ( "take count should be a positive number" ),
- * so plain listing requests failed instead of returning the first page.
- */
-const DEFAULT_PAGE_SIZE = 10;
+import { UserMetadataService } from '../services/UserMetadataService.js';
 /**
  * User metadata management.
  * Provides CRUD operations for key-value metadata entries attached to user accounts.
  * Admin routes operate on any user (identified by UUID), while own routes operate on the
  * currently authenticated user's metadata.
+ *
+ * Both families delegate to {@link UserMetadataService}, which owns the owner
+ * scoping — the only thing that ever differed between them is where the owner
+ * id comes from.
  * @tags User Metadata
  */
 let UserMetadataController = class UserMetadataController extends BaseController {
@@ -46,13 +45,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 User not found
      */
     async readUserMeta(user, pagination, order, filter) {
-        const limit = pagination?.limit || DEFAULT_PAGE_SIZE;
-        return new Ok(FilterableUserMetadata.select().where({
-            user_id: user.Id
-        }).filter(filter?.filters ?? [], filter?.op)
-            .take(limit)
-            .skip(limit * (pagination?.page ?? 0))
-            .order(order?.column ?? 'Id', order?.order ?? SortOrder.DESC));
+        return new Ok(this.Metadata.list(user.Id, pagination, order, filter));
     }
     /**
      * Get a single metadata entry for a specific user (admin)
@@ -66,10 +59,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 User or metadata key not found
      */
     async getUserMeta(user, key) {
-        return new Ok(UserMetadata.where({
-            Key: key,
-            user_id: user.Id
-        }).firstOrFail());
+        return new Ok(this.Metadata.getByKey(user.Id, key));
     }
     /**
      * Add or update metadata for a specific user (admin)
@@ -82,8 +72,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 User not found
      */
     async addUserMetadata(user, metadata) {
-        metadata.User.attach(user);
-        await metadata.insert(InsertBehaviour.InsertOrUpdate);
+        await this.Metadata.upsert(user.Id, metadata);
         return new Ok();
     }
     /**
@@ -99,11 +88,10 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 User or metadata entry not found
      */
     async updateUserMetadata(meta, _user, data) {
-        await meta.update({
-            Key: data.Key,
-            Value: data.Value,
-            Type: data.Type
-        });
+        // @FromModel already resolved the entry within the addressed user's
+        // scope ( so a miss is a 404 ); the write still goes through the
+        // owner-scoped service so the predicate is not restated here.
+        await this.Metadata.update(_user.Id, meta.Id, data);
         return new Ok();
     }
     /**
@@ -118,24 +106,9 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 User or metadata entry not found
      */
     async deleteUserMetadata(user, meta) {
-        // NOTE: destroy() refuses to build an unbounded DELETE, so the entry id
-        // goes in as the primary key and ownership is AND-ed on top of it —
-        // deleting by id alone would let any user id delete anybody's entry.
-        await UserMetadata.destroy(meta).andWhere('user_id', user.Id);
+        await this.Metadata.delete(user.Id, meta);
         return new Ok();
     }
-    /**
-     * List own metadata
-     * Returns a paginated, filtered, and ordered list of metadata entries for the authenticated user.
-     * @security cookieAuth
-     * @param pagination.page Page number (zero-based)
-     * @param pagination.limit Number of entries per page
-     * @param order.column Column to sort by (default: Id)
-     * @param order.order Sort direction: ASC or DESC (default: DESC)
-     * @returns {IUserMetadataEntry[]} Paginated list of own metadata entries
-     * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — readOwn permission required
-     */
     /**
      * List own metadata
      * Returns a paginated, filtered, and ordered list of metadata entries for the authenticated user.
@@ -149,15 +122,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 403 Forbidden — readOwn permission required
      */
     async readMeta(user, pagination, order, filter) {
-        // Explicit owner scoping: the rbac query middleware does not enforce
-        // ownership for the metadata model (queries resolve to the unsafe base
-        // model without an @OrmResource), so every own-route filters by the
-        // authenticated user's id directly.
-        const limit = pagination?.limit || DEFAULT_PAGE_SIZE;
-        return new Ok(FilterableUserMetadata.select().where('user_id', user.Id).filter(filter?.filters ?? [], filter?.op)
-            .take(limit)
-            .skip(limit * (pagination?.page ?? 0))
-            .order(order?.column ?? 'Id', order?.order ?? SortOrder.DESC));
+        return new Ok(this.Metadata.list(user.Id, pagination, order, filter));
     }
     /**
      * Get own metadata entry by key
@@ -170,10 +135,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 Metadata key not found
      */
     async getMeta(user, key) {
-        return new Ok(UserMetadata.where({
-            Key: key,
-            user_id: user.Id,
-        }).firstOrFail());
+        return new Ok(this.Metadata.getByKey(user.Id, key));
     }
     /**
      * Add or update own metadata
@@ -184,10 +146,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 403 Forbidden — updateOwn permission required
      */
     async addMetadata(user, metadata) {
-        // force ownership to the authenticated user — never trust a user_id
-        // supplied in the request body
-        metadata.user_id = user.Id;
-        await metadata.insert(InsertBehaviour.InsertOrUpdate);
+        await this.Metadata.upsert(user.Id, metadata);
         return new Ok();
     }
     /**
@@ -202,19 +161,7 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 Metadata entry not found
      */
     async updateMetadata(user, meta, data) {
-        // The Key/Id lookup is grouped and AND-ed with an explicit ownership
-        // filter. Without the grouping the flat "Key = ? OR Id = ? AND user_id = ?"
-        // binds as "Key = ? OR (Id = ? AND user_id = ?)", letting any user update
-        // another user's metadata by its Key. Scoping by user_id explicitly (not
-        // relying on the query middleware, which does not fire for this model)
-        // keeps the update owner-bound.
-        await UserMetadata.update({
-            Key: data.Key,
-            Value: data.Value,
-            Type: data.Type
-        }).where(function () {
-            this.where("Key", meta).orWhere("Id", meta);
-        }).andWhere('user_id', user.Id);
+        await this.Metadata.update(user.Id, meta, data);
         return new Ok();
     }
     /**
@@ -228,10 +175,14 @@ let UserMetadataController = class UserMetadataController extends BaseController
      * @response 404 Metadata entry not found
      */
     async deleteMetadata(user, meta) {
-        await UserMetadata.destroy(meta).andWhere('user_id', user.Id);
+        await this.Metadata.delete(user.Id, meta);
         return new Ok();
     }
 };
+__decorate([
+    Autoinject(UserMetadataService),
+    __metadata("design:type", UserMetadataService)
+], UserMetadataController.prototype, "Metadata", void 0);
 __decorate([
     Get(":user/metadata"),
     Permission(['readAny']),

package/lib/mjs/controllers/UserMetadataController.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAkB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;GAMG;AAII,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,cAAc;IAEtD;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,YAAY,CACc,IAAe,EACzC,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,iBAAiB,CAAC;QAErD,OAAO,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACvC,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,WAAW,CACe,IAAe,EACzC,GAAW;QACpB,OAAO,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CACW,IAAe,EACvC,QAAsB;QAEjC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CAOxB,IAAkB,EACc,KAAgB,EAC3C,IAAqB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAA;QAEF,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CACQ,IAAe,EACzC,IAAY;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAIH;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACT,IAAe,EACd,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,iBAAiB,CAAC;QAErD,OAAO,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aAC5G,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAChE,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAW,GAAW;QAC9D,OAAO,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAa,QAAsB;QAC/E,oEAAoE;QACpE,+BAA+B;QAC/B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY,EAAU,IAAqB;QACrG,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,YAAY,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC,KAAK,CAAC;YACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY;QACtE,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;CACJ,CAAA;AA7PgB;IAFZ,GAAG,CAAC,gBAAgB,CAAC;IACrB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,MAAM,CAAC,sBAAsB,CAAC,CAAA;;qCAHU,SAAS;QAC5B,aAAa;QAClB,QAAQ;;0DAa5B;AAgBY;IAFZ,GAAG,CAAC,qBAAqB,CAAC;IAC1B,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;;qCADiC,SAAS;;yDAMrD;AAcY;IAFZ,IAAI,CAAC,gBAAgB,CAAC;IACtB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,OAAO,EAAE,CAAA;;qCAD+B,SAAS;QAC7B,YAAY;;6DAKpC;AAgBY;IAFZ,KAAK,CAAC,uBAAuB,CAAC;IAC9B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC;QACP,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC,CAAC;KACL,CAAC,CAAA;IACD,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAI,EAAE,CAAA;;qCAFE,YAAY;QACqB,SAAS;QACrC,eAAe;;gEAQhC;AAeY;IAFZ,GAAG,CAAC,sBAAsB,CAAC;IAC3B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;;qCADiC,SAAS;;gEAQrD;AA+BY;IAFZ,GAAG,CAAC,UAAU,CAAC;IACf,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,MAAM,CAAC,sBAAsB,CAAC,CAAA;;qCAHjB,SAAS;QACD,aAAa;QAClB,QAAQ;;sDAe5B;AAcY;IAFZ,GAAG,CAAC,eAAe,CAAC;IACpB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;qDAK3C;AAYY;IAFZ,IAAI,CAAC,UAAU,CAAC;IAChB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAArB,SAAS,EAAuB,YAAY;;yDAMlF;AAeY;IAFZ,KAAK,CAAC,gBAAgB,CAAC;IACvB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAzC,SAAS,UAAuC,eAAe;;4DAgBxG;AAcY;IAFZ,GAAG,CAAC,gBAAgB,CAAC;IACrB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;4DAIlD;AA9QQ,sBAAsB;IAHlC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,eAAe,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC;GACZ,sBAAsB,CA+QlC"}
+{"version":3,"file":"UserMetadataController.js","sourceRoot":"","sources":["../../../src/controllers/UserMetadataController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAChH,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAkB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AAII,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,cAAc;IAKtD;;;;;;;;;;;;;OAaG;IAGU,AAAN,KAAK,CAAC,YAAY,CACc,IAAe,EACzC,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAGD;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,WAAW,CACe,IAAe,EACzC,GAAW;QACpB,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,eAAe,CACW,IAAe,EACvC,QAAsB;QAEjC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9C,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CAOxB,IAAkB,EACc,KAAgB,EAC3C,IAAqB;QAE7B,oEAAoE;QACpE,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEpD,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,kBAAkB,CACQ,IAAe,EACzC,IAAY;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE1C,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,QAAQ,CACT,IAAe,EACd,UAA0B,EAC1B,KAAgB,EAEzB,MAAuB;QAEvB,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAW,GAAW;QAC9D,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,WAAW,CAAS,IAAe,EAAa,QAAsB;QAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9C,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY,EAAU,IAAqB;QACrG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhD,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,cAAc,CAAS,IAAe,EAAW,IAAY;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE1C,OAAO,IAAI,EAAE,EAAE,CAAC;IACpB,CAAC;CACJ,CAAA;AArNa;IADT,UAAU,CAAC,mBAAmB,CAAC;8BACZ,mBAAmB;wDAAC;AAkB3B;IAFZ,GAAG,CAAC,gBAAgB,CAAC;IACrB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,MAAM,CAAC,sBAAsB,CAAC,CAAA;;qCAHU,SAAS;QAC5B,aAAa;QAClB,QAAQ;;0DAK5B;AAgBY;IAFZ,GAAG,CAAC,qBAAqB,CAAC;IAC1B,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;;qCADiC,SAAS;;yDAGrD;AAcY;IAFZ,IAAI,CAAC,gBAAgB,CAAC;IACtB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,OAAO,EAAE,CAAA;;qCAD+B,SAAS;QAC7B,YAAY;;6DAIpC;AAgBY;IAFZ,KAAK,CAAC,uBAAuB,CAAC;IAC9B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC;QACP,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC,CAAC;KACL,CAAC,CAAA;IACD,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,IAAI,EAAE,CAAA;;qCAFE,YAAY;QACqB,SAAS;QACrC,eAAe;;gEAQhC;AAeY;IAFZ,GAAG,CAAC,sBAAsB,CAAC;IAC3B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IAErB,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,WAAA,KAAK,EAAE,CAAA;;qCADiC,SAAS;;gEAKrD;AAgBY;IAFZ,GAAG,CAAC,UAAU,CAAC;IACf,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,MAAM,CAAC,sBAAsB,CAAC,CAAA;;qCAHjB,SAAS;QACD,aAAa;QAClB,QAAQ;;sDAK5B;AAcY;IAFZ,GAAG,CAAC,eAAe,CAAC;IACpB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;qDAE3C;AAYY;IAFZ,IAAI,CAAC,UAAU,CAAC;IAChB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACA,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAArB,SAAS,EAAuB,YAAY;;yDAGlF;AAeY;IAFZ,KAAK,CAAC,gBAAgB,CAAC;IACvB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAzC,SAAS,UAAuC,eAAe;;4DAIxG;AAcY;IAFZ,GAAG,CAAC,gBAAgB,CAAC;IACrB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACG,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;4DAIlD;AAvNQ,sBAAsB;IAHlC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,eAAe,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC;GACZ,sBAAsB,CAwNlC"}

package/lib/mjs/dto/confirm-password-dto.d.ts

@@ -0,0 +1,23 @@
+export declare const ConfirmPasswordDtoSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Password: {
+            type: string;
+            maxLength: number;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/**
+ * Re-authentication payload for sensitive self-service operations — enabling or
+ * disabling 2FA. A hijacked session alone must not be enough to weaken a
+ * user's second factor.
+ */
+export declare class ConfirmPasswordDto {
+    Password: string;
+    constructor(data: any);
+}
+//# sourceMappingURL=confirm-password-dto.d.ts.map

package/lib/mjs/dto/confirm-password-dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-password-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/confirm-password-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB;;;;;;;;;;;;CAQpC,CAAC;AAEF;;;;GAIG;AACH,qBACa,kBAAkB;IACtB,QAAQ,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,GAAG;CAGtB"}

package/lib/mjs/dto/{user-dto.js → confirm-password-dto.js}

@@ -8,23 +8,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Schema } from '@spinajs/validation';
-export const UserDtoSchema = {
+export const ConfirmPasswordDtoSchema = {
     $schema: 'http://json-schema.org/draft-07/schema#',
-    title: 'User DTO',
+    title: 'Confirm password DTO',
     type: 'object',
     properties: {
-        Email: { type: 'string', format: 'email', maxLength: 64 },
-        Login: { type: 'string', maxLength: 64 },
+        Password: { type: 'string', maxLength: 32, description: 'Current password, re-entered to confirm a sensitive change' },
     },
+    required: ['Password'],
 };
-let UserDto = class UserDto {
+/**
+ * Re-authentication payload for sensitive self-service operations — enabling or
+ * disabling 2FA. A hijacked session alone must not be enough to weaken a
+ * user's second factor.
+ */
+let ConfirmPasswordDto = class ConfirmPasswordDto {
     constructor(data) {
         Object.assign(this, data);
     }
 };
-UserDto = __decorate([
-    Schema(UserDtoSchema),
+ConfirmPasswordDto = __decorate([
+    Schema(ConfirmPasswordDtoSchema),
     __metadata("design:paramtypes", [Object])
-], UserDto);
-export { UserDto };
-//# sourceMappingURL=user-dto.js.map
+], ConfirmPasswordDto);
+export { ConfirmPasswordDto };
+//# sourceMappingURL=confirm-password-dto.js.map

package/lib/mjs/dto/confirm-password-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-password-dto.js","sourceRoot":"","sources":["../../../src/dto/confirm-password-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE;KACvH;IACD,QAAQ,EAAE,CAAC,UAAU,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAG7B,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AANY,kBAAkB;IAD9B,MAAM,CAAC,wBAAwB,CAAC;;GACpB,kBAAkB,CAM9B"}

package/lib/mjs/dto/password-reset-dto.d.ts

@@ -0,0 +1,58 @@
+export declare const PasswordResetRequestDtoSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Email: {
+            type: string;
+            format: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** Payload starting a password reset — identifies the account by email. */
+export declare class PasswordResetRequestDto {
+    Email: string;
+    constructor(data: any);
+}
+export declare const PasswordResetConfirmDtoSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Email: {
+            type: string;
+            format: string;
+            description: string;
+        };
+        Token: {
+            type: string;
+            maxLength: number;
+            minLength: number;
+            description: string;
+        };
+        Password: {
+            type: string;
+            maxLength: number;
+            minLength: number;
+            description: string;
+        };
+        ConfirmPassword: {
+            type: string;
+            maxLength: number;
+            minLength: number;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** Payload completing a password reset with the issued token. */
+export declare class PasswordResetConfirmDto {
+    Email: string;
+    Token: string;
+    Password: string;
+    ConfirmPassword: string;
+    constructor(data: any);
+}
+//# sourceMappingURL=password-reset-dto.d.ts.map

package/lib/mjs/dto/password-reset-dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/password-reset-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,6BAA6B;;;;;;;;;;;;CAQzC,CAAC;AAEF,2EAA2E;AAC3E,qBACa,uBAAuB;IAC3B,KAAK,EAAE,MAAM,CAAC;gBAET,IAAI,EAAE,GAAG;CAGtB;AAED,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWzC,CAAC;AAEF,iEAAiE;AACjE,qBACa,uBAAuB;IAC3B,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,EAAE,MAAM,CAAC;IAEd,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,EAAE,MAAM,CAAC;gBAEnB,IAAI,EAAE,GAAG;CAGtB"}

package/lib/mjs/dto/password-reset-dto.js

@@ -0,0 +1,54 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Schema } from '@spinajs/validation';
+export const PasswordResetRequestDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Password reset request DTO',
+    type: 'object',
+    properties: {
+        Email: { type: 'string', format: 'email', description: 'Email address of the account to reset' },
+    },
+    required: ['Email'],
+};
+/** Payload starting a password reset — identifies the account by email. */
+let PasswordResetRequestDto = class PasswordResetRequestDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+PasswordResetRequestDto = __decorate([
+    Schema(PasswordResetRequestDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], PasswordResetRequestDto);
+export { PasswordResetRequestDto };
+export const PasswordResetConfirmDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Password reset confirmation DTO',
+    type: 'object',
+    properties: {
+        Email: { type: 'string', format: 'email', description: 'Email address the reset token was issued for' },
+        Token: { type: 'string', maxLength: 64, minLength: 1, description: 'Reset token delivered to the user' },
+        Password: { type: 'string', maxLength: 32, minLength: 6, description: 'New password (6–32 characters)' },
+        ConfirmPassword: { type: 'string', maxLength: 32, minLength: 6, description: 'Must match Password' },
+    },
+    required: ['Email', 'Token', 'Password', 'ConfirmPassword'],
+};
+/** Payload completing a password reset with the issued token. */
+let PasswordResetConfirmDto = class PasswordResetConfirmDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+PasswordResetConfirmDto = __decorate([
+    Schema(PasswordResetConfirmDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], PasswordResetConfirmDto);
+export { PasswordResetConfirmDto };
+//# sourceMappingURL=password-reset-dto.js.map