@spinajs/rbac-http-user 2.0.486 → 2.0.488

package/lib/mjs/dto/password-reset-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-dto.js","sourceRoot":"","sources":["../../../src/dto/password-reset-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,4BAA4B;IACnC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,uCAAuC,EAAE;KACjG;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,2EAA2E;AAEpE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGlC,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AANY,uBAAuB;IADnC,MAAM,CAAC,6BAA6B,CAAC;;GACzB,uBAAuB,CAMnC;;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,iCAAiC;IACxC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,8CAA8C,EAAE;QACvG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACxG,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE;QACxG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACrG;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAC;CAC5D,CAAC;AAEF,iEAAiE;AAE1D,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IASlC,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAZY,uBAAuB;IADnC,MAAM,CAAC,6BAA6B,CAAC;;GACzB,uBAAuB,CAYnC"}

package/lib/mjs/handlers/DefaultLogoutHandler.d.ts

@@ -1,5 +1,7 @@
 import { SessionProvider } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
 import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Default logout handler: deletes the session and clears the ssid cookie.
  * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
@@ -7,8 +9,9 @@ import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
  */
 export declare class DefaultLogoutHandler extends LogoutHandler {
     Priority: number;
+    protected Log: Log;
     protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: Record<string, unknown>;
+    protected SessionCookies: SessionCookieFactory;
     handle(context: ILogoutContext): Promise<ILogoutResult | null>;
 }
 //# sourceMappingURL=DefaultLogoutHandler.d.ts.map

package/lib/mjs/handlers/DefaultLogoutHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,mBAAmB,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAuB5E"}
+{"version":3,"file":"DefaultLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,aAAa;IAC9C,QAAQ,SAAO;IAGtB,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAG5C,SAAS,CAAC,cAAc,EAAG,oBAAoB,CAAC;IAEnC,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAyB5E"}

package/lib/mjs/handlers/DefaultLogoutHandler.js

@@ -7,10 +7,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Injectable } from '@spinajs/di';
-import { AutoinjectService, Config } from '@spinajs/configuration';
-import { SessionProvider } from '@spinajs/rbac';
+import { Autoinject, Injectable } from '@spinajs/di';
+import { AutoinjectService } from '@spinajs/configuration';
+import { SessionProvider, hashSessionId } from '@spinajs/rbac';
+import { Log, Logger } from '@spinajs/log';
 import { LogoutHandler } from '../logout.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Default logout handler: deletes the session and clears the ssid cookie.
  * Runs last (priority 999) so any earlier handler can short-circuit (e.g.
@@ -27,30 +29,35 @@ let DefaultLogoutHandler = class DefaultLogoutHandler extends LogoutHandler {
             return { Body: null };
         }
         await this.SessionProvider.delete(context.Ssid);
+        this.Log.info(`Session destroyed by logout`, {
+            Session: hashSessionId(context.Ssid),
+            User: context.User?.Uuid,
+        });
         return {
             Body: null,
-            Cookies: [
-                {
-                    Name: 'ssid',
-                    Value: '',
-                    Options: {
-                        httpOnly: true,
-                        maxAge: 0,
-                        ...this.SessionCookieConfig,
-                    },
-                },
+            Cookies: [this.SessionCookies.clear()],
+            Headers: [
+                // Drop everything this origin left in the browser, not just the cookie:
+                // a cached authenticated page is still readable after logout on a
+                // shared machine, and `max-age=0` on the cookie does nothing about it.
+                { Name: 'Clear-Site-Data', Value: '"cache", "cookies", "storage"' },
+                { Name: 'Cache-Control', Value: 'no-store' },
             ],
         };
     }
 };
+__decorate([
+    Logger('rbac-session'),
+    __metadata("design:type", Log)
+], DefaultLogoutHandler.prototype, "Log", void 0);
 __decorate([
     AutoinjectService('rbac.session'),
     __metadata("design:type", SessionProvider)
 ], DefaultLogoutHandler.prototype, "SessionProvider", void 0);
 __decorate([
-    Config('rbac.session.cookie', {}),
-    __metadata("design:type", Object)
-], DefaultLogoutHandler.prototype, "SessionCookieConfig", void 0);
+    Autoinject(SessionCookieFactory),
+    __metadata("design:type", SessionCookieFactory)
+], DefaultLogoutHandler.prototype, "SessionCookies", void 0);
 DefaultLogoutHandler = __decorate([
     Injectable(LogoutHandler)
 ], DefaultLogoutHandler);

package/lib/mjs/handlers/DefaultLogoutHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,aAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IA+BxB,CAAC;IAvBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE;wBACP,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,CAAC;wBACT,GAAG,IAAI,CAAC,mBAAmB;qBAC5B;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA5BW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACN,eAAe;6DAAC;AAGlC;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACsB;AAP7C,oBAAoB;IADhC,UAAU,CAAC,aAAa,CAAC;GACb,oBAAoB,CAgChC"}
+{"version":3,"file":"DefaultLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/DefaultLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,aAAa;IAAhD;;QACE,aAAQ,GAAG,GAAG,CAAC;IAoCxB,CAAC;IAzBQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC3C,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACtC,OAAO,EAAE;gBACP,wEAAwE;gBACxE,kEAAkE;gBAClE,uEAAuE;gBACvE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,+BAA+B,EAAE;gBACnE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjCW;IADT,MAAM,CAAC,cAAc,CAAC;8BACP,GAAG;iDAAC;AAGV;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACN,eAAe;6DAAC;AAGlC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACN,oBAAoB;4DAAC;AAVrC,oBAAoB;IADhC,UAAU,CAAC,aAAa,CAAC;GACb,oBAAoB,CAqChC"}

package/lib/mjs/handlers/ImpersonationLogoutHandler.d.ts

@@ -1,5 +1,6 @@
-import { SessionProvider, User } from '@spinajs/rbac';
 import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
+import { ImpersonationService } from '../services/ImpersonationService.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Logout handler that detects an active impersonation and reverts it instead
  * of destroying the session. Runs early (priority 10) so it short-circuits
@@ -7,12 +8,8 @@ import { LogoutHandler, ILogoutContext, ILogoutResult } from '../logout.js';
  */
 export declare class ImpersonationLogoutHandler extends LogoutHandler {
     Priority: number;
-    protected SessionProvider: SessionProvider;
+    protected Impersonation: ImpersonationService;
+    protected SessionCookies: SessionCookieFactory;
     handle(context: ILogoutContext): Promise<ILogoutResult | null>;
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    protected emitEvent(original: User, target: User): Promise<void>;
 }
 //# sourceMappingURL=ImpersonationLogoutHandler.d.ts.map

package/lib/mjs/handlers/ImpersonationLogoutHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA0B,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,eAAe,EAAG,eAAe,CAAC;IAE/B,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0B3E;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}
+{"version":3,"file":"ImpersonationLogoutHandler.d.ts","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AACH,qBACa,0BAA2B,SAAQ,aAAa;IACpD,QAAQ,SAAM;IAGrB,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAG9C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAElC,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CA6B5E"}

package/lib/mjs/handlers/ImpersonationLogoutHandler.js

@@ -7,11 +7,10 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Injectable } from '@spinajs/di';
-import { AutoinjectService } from '@spinajs/configuration';
-import { SessionProvider, User, UserImpersonationEnded } from '@spinajs/rbac';
-import { _ev } from '@spinajs/queue';
+import { Autoinject, Injectable } from '@spinajs/di';
 import { LogoutHandler } from '../logout.js';
+import { ImpersonationService } from '../services/ImpersonationService.js';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Logout handler that detects an active impersonation and reverts it instead
  * of destroying the session. Runs early (priority 10) so it short-circuits
@@ -23,39 +22,39 @@ let ImpersonationLogoutHandler = class ImpersonationLogoutHandler extends Logout
         this.Priority = 10;
     }
     async handle(context) {
-        const session = context.Session;
-        if (!session)
+        if (!this.Impersonation.isActive(context.Session)) {
             return null;
-        const impersonatorUuid = session.Data.get('Impersonator');
-        if (!impersonatorUuid)
-            return null;
-        const original = await User.getByUuid(impersonatorUuid);
-        session.Data.set('User', original.Uuid);
-        session.Data.delete('Impersonator');
-        session.Data.delete('ImpersonationStartedAt');
-        const restoredActiveRole = session.Data.get('OriginalActiveRole') ?? original.Role?.[0];
-        if (restoredActiveRole) {
-            session.Data.set('ActiveRole', restoredActiveRole);
         }
-        session.Data.delete('OriginalActiveRole');
-        await this.SessionProvider.save(session);
-        await this.emitEvent(original, context.User);
-        // Take ownership of the response: no cookie change — the original user's
-        // session continues.
-        return { Body: { ImpersonationEnded: true } };
-    }
-    /**
-     * Hook for tests to intercept event emission without stubbing the module-level
-     * `_ev` ESM binding.
-     */
-    emitEvent(original, target) {
-        return _ev(new UserImpersonationEnded(original, target))();
+        const result = await this.Impersonation.revert(context.Session, context.User);
+        switch (result.Status) {
+            case 'reverted':
+                // Take ownership of the response: the original user's session
+                // continues, under the new id the revert rotated it to.
+                return {
+                    Body: { ImpersonationEnded: true },
+                    Cookies: [this.SessionCookies.issue(result.Session)],
+                    Headers: [{ Name: 'Cache-Control', Value: 'no-store' }],
+                };
+            case 'impersonator-gone':
+                // The impersonator's account disappeared mid-impersonation. The stale
+                // block has been cleared, but there is no identity left to hand the
+                // session back to — defer to the default handler so the session is
+                // destroyed and the caller is logged out properly. Reverting used to
+                // dereference the missing user here and answer a logout with a 500.
+                return null;
+            default:
+                return null;
+        }
     }
 };
 __decorate([
-    AutoinjectService('rbac.session'),
-    __metadata("design:type", SessionProvider)
-], ImpersonationLogoutHandler.prototype, "SessionProvider", void 0);
+    Autoinject(ImpersonationService),
+    __metadata("design:type", ImpersonationService)
+], ImpersonationLogoutHandler.prototype, "Impersonation", void 0);
+__decorate([
+    Autoinject(SessionCookieFactory),
+    __metadata("design:type", SessionCookieFactory)
+], ImpersonationLogoutHandler.prototype, "SessionCookies", void 0);
 ImpersonationLogoutHandler = __decorate([
     Injectable(LogoutHandler)
 ], ImpersonationLogoutHandler);

package/lib/mjs/handlers/ImpersonationLogoutHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAE5E;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,aAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAsCvB,CAAC;IAjCQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAExD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,yEAAyE;QACzE,qBAAqB;QACrB,OAAO,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,GAAG,CAAC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AAnCW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACN,eAAe;mEAAC;AAJjC,0BAA0B;IADtC,UAAU,CAAC,aAAa,CAAC;GACb,0BAA0B,CAuCtC"}
+{"version":3,"file":"ImpersonationLogoutHandler.js","sourceRoot":"","sources":["../../../src/handlers/ImpersonationLogoutHandler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAiC,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;GAIG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,aAAa;IAAtD;;QACE,aAAQ,GAAG,EAAE,CAAC;IAqCvB,CAAC;IA7BQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9E,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,8DAA8D;gBAC9D,wDAAwD;gBACxD,OAAO;oBACL,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;oBAClC,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;iBACxD,CAAC;YAEJ,KAAK,mBAAmB;gBACtB,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,OAAO,IAAI,CAAC;YAEd;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;CACF,CAAA;AAlCW;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACR,oBAAoB;iEAAC;AAGpC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;kEAAC;AAPpC,0BAA0B;IADtC,UAAU,CAAC,aAAa,CAAC;GACb,0BAA0B,CAsCtC"}

package/lib/mjs/index.d.ts

@@ -8,9 +8,29 @@ export * from './handlers/ImpersonationLogoutHandler.js';
 export * from './handlers/DefaultLogoutHandler.js';
 export * from './controllers/UserMetadataController.js';
 export * from "./controllers/TwoFactorAuthController.js";
+export * from "./controllers/TwoFactorAuthUserController.js";
+export * from "./controllers/PasswordResetController.js";
+export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
 export * from "./2fa/Default2FaToken.js";
 export * from './actions/2fa.js';
+export * from './services/SessionCookies.js';
+export * from './services/grants.js';
+export * from './services/ImpersonationService.js';
+export * from './services/UserMetadataService.js';
+export * from './policies/2FaPolicy.js';
+export * from './events/User2FaEnabled.js';
+export * from './events/User2FaDisabled.js';
+export * from './events/User2FaPassed.js';
+export * from './events/User2FaReset.js';
+export * from './dto/confirm-password-dto.js';
+export * from './dto/impersonate-dto.js';
+export * from './dto/metadata-dto.js';
+export * from './dto/password-dto.js';
+export * from './dto/password-reset-dto.js';
+export * from './dto/switchRole-dto.js';
+export * from './dto/token-dto.js';
+export * from './dto/userLogin-dto.js';
 export declare class RbacHttpUserBootstrapper extends Bootstrapper {
     bootstrap(): void;
 }

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AAEzD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAGjC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI;CAO3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI;CAO3B"}

package/lib/mjs/index.js

@@ -16,9 +16,31 @@ export * from './handlers/ImpersonationLogoutHandler.js';
 export * from './handlers/DefaultLogoutHandler.js';
 export * from './controllers/UserMetadataController.js';
 export * from "./controllers/TwoFactorAuthController.js";
+export * from "./controllers/TwoFactorAuthUserController.js";
+export * from "./controllers/PasswordResetController.js";
+export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
 export * from "./2fa/Default2FaToken.js";
 export * from './actions/2fa.js';
+export * from './services/SessionCookies.js';
+export * from './services/grants.js';
+export * from './services/ImpersonationService.js';
+export * from './services/UserMetadataService.js';
+export * from './policies/2FaPolicy.js';
+// Emitted on the 2FA lifecycle and routed by name in this package's config —
+// consumers need the classes themselves to subscribe by type.
+export * from './events/User2FaEnabled.js';
+export * from './events/User2FaDisabled.js';
+export * from './events/User2FaPassed.js';
+export * from './events/User2FaReset.js';
+export * from './dto/confirm-password-dto.js';
+export * from './dto/impersonate-dto.js';
+export * from './dto/metadata-dto.js';
+export * from './dto/password-dto.js';
+export * from './dto/password-reset-dto.js';
+export * from './dto/switchRole-dto.js';
+export * from './dto/token-dto.js';
+export * from './dto/userLogin-dto.js';
 let RbacHttpUserBootstrapper = class RbacHttpUserBootstrapper extends Bootstrapper {
     bootstrap() {
         UserMetadataBase._hiddenKeys = [

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AAEzD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAI1B,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,YAAY;IAC/C,SAAS;QACZ,gBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,gBAAgB,CAAC,WAAW;YAC/B,sBAAsB,CAAC,KAAK;YAC5B,sBAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,wBAAwB;IADpC,UAAU,CAAC,YAAY,CAAC;GACZ,wBAAwB,CAQpC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,YAAY;IAC/C,SAAS;QACZ,gBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,gBAAgB,CAAC,WAAW;YAC/B,sBAAsB,CAAC,KAAK;YAC5B,sBAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,wBAAwB;IADpC,UAAU,CAAC,YAAY,CAAC;GACZ,wBAAwB,CAQpC"}

package/lib/mjs/logout.d.ts

@@ -18,12 +18,19 @@ export interface ILogoutCookie {
     Value: string;
     Options: Record<string, unknown>;
 }
+/** Response header a handler may attach to its response */
+export interface ILogoutHeader {
+    Name: string;
+    Value: string;
+}
 /** Response payload a handler returns when it takes ownership of the logout */
 export interface ILogoutResult {
     /** Response body */
     Body?: unknown;
     /** Cookie operations to attach */
     Cookies?: ILogoutCookie[];
+    /** Response headers to attach ( eg. `Clear-Site-Data` ) */
+    Headers?: ILogoutHeader[];
 }
 /**
  * Pluggable logout step. Handlers are resolved via `DI.resolve(Array.ofType(LogoutHandler))`

package/lib/mjs/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAEzB,mDAAmD;IACnD,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,aAAa;IACjC;;;OAGG;IACI,QAAQ,EAAE,MAAM,CAAO;aAEd,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAC/E"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAEzB,mDAAmD;IACnD,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAE1B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,aAAa;IACjC;;;OAGG;IACI,QAAQ,EAAE,MAAM,CAAO;aAEd,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAC/E"}

package/lib/mjs/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AAkCA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAgB,aAAa;IAAnC;QACE;;;WAGG;QACI,aAAQ,GAAW,GAAG,CAAC;IAGhC,CAAC;CAAA"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/logout.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAgB,aAAa;IAAnC;QACE;;;WAGG;QACI,aAAQ,GAAW,GAAG,CAAC;IAGhC,CAAC;CAAA"}

package/lib/mjs/policies/2FaPolicy.d.ts

@@ -1,8 +1,28 @@
 import { BasePolicy, Request as sRequest } from '@spinajs/http';
 import { TwoFactorAuthConfig } from '@spinajs/rbac-http';
-export declare class TwoFacRouteEnabled extends BasePolicy {
+/**
+ * Guards routes that only make sense when 2FA is switched on system-wide.
+ *
+ * This is the whole check for self-service routes: an already authorized user
+ * managing their own TOTP device has no pending 2FA step to look at. The
+ * login-window routes need more — see {@link TwoFacRouteEnabled}.
+ */
+export declare class TwoFactorAuthEnabled extends BasePolicy {
     protected TwoFactorConfig: TwoFactorAuthConfig;
     isEnabled(): boolean;
+    execute(_req: sRequest): Promise<void>;
+}
+/**
+ * Guards the routes that belong to the login-time 2FA step: the caller has
+ * passed password authentication and the session is parked awaiting TOTP
+ * verification.
+ *
+ * Combined with `NotAuthorizedPolicy` this window is deliberately narrow. It is
+ * NOT the right guard for managing a TOTP device — a session sitting in this
+ * window has not proven possession of the second factor yet, so anything it can
+ * reach must not be able to weaken 2FA.
+ */
+export declare class TwoFacRouteEnabled extends TwoFactorAuthEnabled {
     execute(req: sRequest): Promise<void>;
 }
 //# sourceMappingURL=2FaPolicy.d.ts.map

package/lib/mjs/policies/2FaPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"2FaPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,qBAAa,kBAAmB,SAAQ,UAAU;IAEhD,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAExC,SAAS,IAAI,OAAO;IAGpB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB7C"}
+{"version":3,"file":"2FaPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;IAElD,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAExC,SAAS,IAAI,OAAO;IAIpB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,oBAAoB;IAC7C,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBnD"}

package/lib/mjs/policies/2FaPolicy.js

@@ -11,14 +11,41 @@ import { InvalidOperation } from '@spinajs/exceptions';
 import { Config } from '@spinajs/configuration';
 import { BasePolicy } from '@spinajs/http';
 import { Forbidden } from '@spinajs/exceptions';
-export class TwoFacRouteEnabled extends BasePolicy {
+/**
+ * Guards routes that only make sense when 2FA is switched on system-wide.
+ *
+ * This is the whole check for self-service routes: an already authorized user
+ * managing their own TOTP device has no pending 2FA step to look at. The
+ * login-window routes need more — see {@link TwoFacRouteEnabled}.
+ */
+export class TwoFactorAuthEnabled extends BasePolicy {
     isEnabled() {
         return true;
     }
-    execute(req) {
+    execute(_req) {
         if (this.TwoFactorConfig.enabled === false) {
             throw new InvalidOperation('2 factor auth is not enabled');
         }
+        return Promise.resolve();
+    }
+}
+__decorate([
+    Config('rbac.twoFactorAuth'),
+    __metadata("design:type", Object)
+], TwoFactorAuthEnabled.prototype, "TwoFactorConfig", void 0);
+/**
+ * Guards the routes that belong to the login-time 2FA step: the caller has
+ * passed password authentication and the session is parked awaiting TOTP
+ * verification.
+ *
+ * Combined with `NotAuthorizedPolicy` this window is deliberately narrow. It is
+ * NOT the right guard for managing a TOTP device — a session sitting in this
+ * window has not proven possession of the second factor yet, so anything it can
+ * reach must not be able to weaken 2FA.
+ */
+export class TwoFacRouteEnabled extends TwoFactorAuthEnabled {
+    async execute(req) {
+        await super.execute(req);
         if (!req.storage || !req.storage.Session) {
             throw new InvalidOperation('Session is not set');
         }
@@ -31,8 +58,4 @@ export class TwoFacRouteEnabled extends BasePolicy {
         return Promise.resolve();
     }
 }
-__decorate([
-    Config('rbac.twoFactorAuth'),
-    __metadata("design:type", Object)
-], TwoFacRouteEnabled.prototype, "TwoFactorConfig", void 0);
 //# sourceMappingURL=2FaPolicy.js.map

package/lib/mjs/policies/2FaPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAIzC,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACM,OAAO,CAAC,GAAa;QAC1B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAGD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAxBW;IADT,MAAM,CAAC,oBAAoB,CAAC;;2DACkB"}
+{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAI3C,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,IAAc;QAC3B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAbW;IADT,MAAM,CAAC,oBAAoB,CAAC;;6DACkB;AAejD;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,oBAAoB;IACnD,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/lib/mjs/services/ImpersonationService.d.ts

@@ -0,0 +1,90 @@
+import { SessionProvider, User } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+/** Session keys holding the impersonation block. */
+export declare const IMPERSONATION_KEYS: {
+    readonly IMPERSONATOR: "Impersonator";
+    readonly STARTED_AT: "ImpersonationStartedAt";
+    readonly ORIGINAL_ACTIVE_ROLE: "OriginalActiveRole";
+    /**
+     * Numeric id of the impersonator, stashed because `session.UserId` is handed
+     * over to the target for the duration — see {@link ImpersonationService.start}.
+     */
+    readonly ORIGINAL_USER_ID: "OriginalUserId";
+};
+/** Outcome of an attempt to end an impersonation. */
+export type RevertResult = 
+/** Impersonation ended; the original user is back in the session. */
+{
+    Status: 'reverted';
+    Original: User;
+    ActiveRole: string | undefined;
+    Session: ISession;
+}
+/** The session carried no impersonation — nothing was changed. */
+ | {
+    Status: 'not-impersonating';
+}
+/** The impersonator no longer exists; the stale block was cleared. */
+ | {
+    Status: 'impersonator-gone';
+};
+/**
+ * Owns the impersonation session block.
+ *
+ * The revert path is reachable two ways — explicitly via `DELETE /auth/impersonate`
+ * and implicitly when an impersonating user logs out — and both used to carry
+ * their own copy of the key juggling. The copies had already drifted: the logout
+ * handler dereferenced a deleted impersonator without a guard and answered a
+ * logout with a 500, while the controller handled that same case.
+ */
+export declare class ImpersonationService {
+    protected SessionProvider: SessionProvider;
+    /** True when the session is currently acting as somebody else. */
+    isActive(session: ISession | null | undefined): boolean;
+    /**
+     * Begin acting as `target`. The impersonator's own ActiveRole is stashed so
+     * `revert` can restore it, and the effective ActiveRole becomes the target's
+     * first role.
+     *
+     * Two things beyond the key juggling:
+     *
+     *  - the session id is REGENERATED. Assuming another identity is a privilege
+     *    change, and a privilege change on a session id that an attacker may
+     *    already know is the definition of session fixation.
+     *  - `session.UserId` is handed over to the target and the impersonator's own
+     *    id is stashed. Ownership is what `deleteByUser` keys on, so while the
+     *    impersonation runs, "log this user out everywhere" aimed at the target
+     *    reaches the impersonating session too — which is exactly what an
+     *    administrator killing a compromised account expects.
+     *
+     * @returns the regenerated session and the ActiveRole now in effect
+     */
+    start(session: ISession, impersonator: User, target: User, startedAt: string): Promise<{
+        Session: ISession;
+        ActiveRole: string | undefined;
+    }>;
+    /**
+     * End an active impersonation and put the original user back in the session.
+     *
+     * The session survives either way — reverting is not a logout. When the
+     * original user is gone the impersonation block is still cleared, so the
+     * session stops claiming an identity that cannot be resolved, and the caller
+     * is told to re-authenticate rather than being handed a 500.
+     */
+    revert(session: ISession | null | undefined, target: User): Promise<RevertResult>;
+    /** Drops the impersonation keys and persists the session under the same id. */
+    protected clearBlock(session: ISession): Promise<void>;
+    /** Removes the impersonation keys from session data without persisting. */
+    protected dropBlockKeys(session: ISession): void;
+    /**
+     * Load the original (impersonator) user, or undefined when the account is
+     * gone. Extracted so tests can stub it without a database.
+     */
+    protected loadOriginal(uuid: string): Promise<User | undefined>;
+    /**
+     * Hook for tests to intercept event emission without stubbing the
+     * module-level `_ev` ESM binding.
+     */
+    protected emitEnded(original: User, target: User): Promise<void>;
+}
+//# sourceMappingURL=ImpersonationService.d.ts.map

package/lib/mjs/services/ImpersonationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImpersonationService.d.ts","sourceRoot":"","sources":["../../../src/services/ImpersonationService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,IAAI,EAA6C,MAAM,eAAe,CAAC;AACjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;;IAK7B;;;OAGG;;CAEK,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,YAAY;AACtB,qEAAqE;AACnE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAA;CAAE;AAC3F,kEAAkE;GAChE;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE;AACjC,sEAAsE;GACpE;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEpC;;;;;;;;GAQG;AACH,qBACa,oBAAoB;IAE/B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C,kEAAkE;IAC3D,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAI9D;;;;;;;;;;;;;;;;;OAiBG;IACU,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAwB1J;;;;;;;OAOG;IACU,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAuC9F,+EAA+E;cAC/D,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,2EAA2E;IAC3E,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI;IAOhD;;;OAGG;cACa,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAIrE;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}