@spinajs/rbac-http-user 2.0.486 → 2.0.488

package/lib/mjs/services/ImpersonationService.js

@@ -0,0 +1,144 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@spinajs/di';
+import { AutoinjectService } from '@spinajs/configuration';
+import { SessionProvider, User, UserImpersonationEnded, regenerateSession } from '@spinajs/rbac';
+import { _ev } from '@spinajs/queue';
+/** Session keys holding the impersonation block. */
+export const IMPERSONATION_KEYS = {
+    IMPERSONATOR: 'Impersonator',
+    STARTED_AT: 'ImpersonationStartedAt',
+    ORIGINAL_ACTIVE_ROLE: 'OriginalActiveRole',
+    /**
+     * Numeric id of the impersonator, stashed because `session.UserId` is handed
+     * over to the target for the duration — see {@link ImpersonationService.start}.
+     */
+    ORIGINAL_USER_ID: 'OriginalUserId',
+};
+/**
+ * Owns the impersonation session block.
+ *
+ * The revert path is reachable two ways — explicitly via `DELETE /auth/impersonate`
+ * and implicitly when an impersonating user logs out — and both used to carry
+ * their own copy of the key juggling. The copies had already drifted: the logout
+ * handler dereferenced a deleted impersonator without a guard and answered a
+ * logout with a 500, while the controller handled that same case.
+ */
+let ImpersonationService = class ImpersonationService {
+    /** True when the session is currently acting as somebody else. */
+    isActive(session) {
+        return Boolean(session?.Data.get(IMPERSONATION_KEYS.IMPERSONATOR));
+    }
+    /**
+     * Begin acting as `target`. The impersonator's own ActiveRole is stashed so
+     * `revert` can restore it, and the effective ActiveRole becomes the target's
+     * first role.
+     *
+     * Two things beyond the key juggling:
+     *
+     *  - the session id is REGENERATED. Assuming another identity is a privilege
+     *    change, and a privilege change on a session id that an attacker may
+     *    already know is the definition of session fixation.
+     *  - `session.UserId` is handed over to the target and the impersonator's own
+     *    id is stashed. Ownership is what `deleteByUser` keys on, so while the
+     *    impersonation runs, "log this user out everywhere" aimed at the target
+     *    reaches the impersonating session too — which is exactly what an
+     *    administrator killing a compromised account expects.
+     *
+     * @returns the regenerated session and the ActiveRole now in effect
+     */
+    async start(session, impersonator, target, startedAt) {
+        const previousActiveRole = session.Data.get('ActiveRole');
+        session.Data.set(IMPERSONATION_KEYS.IMPERSONATOR, impersonator.Uuid);
+        session.Data.set(IMPERSONATION_KEYS.ORIGINAL_USER_ID, session.UserId ?? impersonator.Id);
+        session.Data.set('User', target.Uuid);
+        session.Data.set(IMPERSONATION_KEYS.STARTED_AT, startedAt);
+        if (previousActiveRole !== undefined) {
+            session.Data.set(IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE, previousActiveRole);
+        }
+        const targetActiveRole = target.Role?.[0];
+        if (targetActiveRole) {
+            session.Data.set('ActiveRole', targetActiveRole);
+        }
+        session.UserId = target.Id;
+        const regenerated = await regenerateSession(this.SessionProvider, session);
+        return { Session: regenerated, ActiveRole: targetActiveRole };
+    }
+    /**
+     * End an active impersonation and put the original user back in the session.
+     *
+     * The session survives either way — reverting is not a logout. When the
+     * original user is gone the impersonation block is still cleared, so the
+     * session stops claiming an identity that cannot be resolved, and the caller
+     * is told to re-authenticate rather than being handed a 500.
+     */
+    async revert(session, target) {
+        if (!session) {
+            return { Status: 'not-impersonating' };
+        }
+        const impersonatorUuid = session.Data.get(IMPERSONATION_KEYS.IMPERSONATOR);
+        if (!impersonatorUuid) {
+            return { Status: 'not-impersonating' };
+        }
+        const original = await this.loadOriginal(impersonatorUuid);
+        if (!original) {
+            await this.clearBlock(session);
+            return { Status: 'impersonator-gone' };
+        }
+        session.Data.set('User', original.Uuid);
+        const restoredActiveRole = session.Data.get(IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE) ?? original.Role?.[0];
+        if (restoredActiveRole) {
+            session.Data.set('ActiveRole', restoredActiveRole);
+        }
+        // ownership goes back to the impersonator along with the identity
+        session.UserId = session.Data.get(IMPERSONATION_KEYS.ORIGINAL_USER_ID) ?? original.Id;
+        this.dropBlockKeys(session);
+        // Dropping an identity is a privilege change too — the id the target's
+        // session was reachable under does not survive into the impersonator's.
+        const regenerated = await regenerateSession(this.SessionProvider, session);
+        await this.emitEnded(original, target);
+        return { Status: 'reverted', Original: original, ActiveRole: restoredActiveRole, Session: regenerated };
+    }
+    /** Drops the impersonation keys and persists the session under the same id. */
+    async clearBlock(session) {
+        this.dropBlockKeys(session);
+        await this.SessionProvider.save(session);
+    }
+    /** Removes the impersonation keys from session data without persisting. */
+    dropBlockKeys(session) {
+        session.Data.delete(IMPERSONATION_KEYS.IMPERSONATOR);
+        session.Data.delete(IMPERSONATION_KEYS.STARTED_AT);
+        session.Data.delete(IMPERSONATION_KEYS.ORIGINAL_ACTIVE_ROLE);
+        session.Data.delete(IMPERSONATION_KEYS.ORIGINAL_USER_ID);
+    }
+    /**
+     * Load the original (impersonator) user, or undefined when the account is
+     * gone. Extracted so tests can stub it without a database.
+     */
+    async loadOriginal(uuid) {
+        return (await User.getByUuid(uuid));
+    }
+    /**
+     * Hook for tests to intercept event emission without stubbing the
+     * module-level `_ev` ESM binding.
+     */
+    emitEnded(original, target) {
+        return _ev(new UserImpersonationEnded(original, target))();
+    }
+};
+__decorate([
+    AutoinjectService('rbac.session'),
+    __metadata("design:type", SessionProvider)
+], ImpersonationService.prototype, "SessionProvider", void 0);
+ImpersonationService = __decorate([
+    Injectable()
+], ImpersonationService);
+export { ImpersonationService };
+//# sourceMappingURL=ImpersonationService.js.map

package/lib/mjs/services/ImpersonationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImpersonationService.js","sourceRoot":"","sources":["../../../src/services/ImpersonationService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,wBAAwB;IACpC,oBAAoB,EAAE,oBAAoB;IAE1C;;;OAGG;IACH,gBAAgB,EAAE,gBAAgB;CAC1B,CAAC;AAWX;;;;;;;;GAQG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAI/B,kEAAkE;IAC3D,QAAQ,CAAC,OAAoC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,KAAK,CAAC,OAAiB,EAAE,YAAkB,EAAE,MAAY,EAAE,SAAiB;QACvF,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;QAEhF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE3D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CAAC,OAAoC,EAAE,MAAY;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAuB,CAAC;QACjG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAwB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACrD,CAAC;QAED,kEAAkE;QAClE,OAAO,CAAC,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAwB,IAAI,QAAQ,CAAC,EAAE,CAAC;QAE9G,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE5B,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEvC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,CAAC;IAED,+EAA+E;IACrE,KAAK,CAAC,UAAU,CAAC,OAAiB;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IACjE,aAAa,CAAC,OAAiB;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,YAAY,CAAC,IAAY;QACvC,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAqB,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,QAAc,EAAE,MAAY;QAC9C,OAAO,GAAG,CAAC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF,CAAA;AA7HW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;6DAAC;AAFhC,oBAAoB;IADhC,UAAU,EAAE;GACA,oBAAoB,CA+HhC"}

package/lib/mjs/services/SessionCookies.d.ts

@@ -0,0 +1,41 @@
+import type { ISession, ISessionCookieConfig } from '@spinajs/rbac';
+/** Cookie descriptor accepted by the http `Coockies` response option. */
+export interface ISessionCookie {
+    Name: string;
+    Value: string;
+    Options: Record<string, unknown>;
+}
+/**
+ * Default name of the session cookie. Kept for callers that only need the
+ * literal; the ACTIVE name comes from configuration and may carry a `__Host-`
+ * prefix, so read {@link SessionCookieFactory.Name} instead of assuming this.
+ */
+export declare const SESSION_COOKIE_NAME = "ssid";
+/**
+ * Builds the session cookie.
+ *
+ * Every place that opens, rotates, or clears a session used to inline the same
+ * literal — login, 2FA verify, active-role switch and logout each carried their
+ * own copy, and each had to remember `signed`, `httpOnly`, the configured
+ * overrides, and to derive maxAge from the session's real expiration. A drift in
+ * any one of them silently produces a cookie the next request cannot restore.
+ *
+ * The attributes themselves are decided by `@spinajs/rbac` so the session
+ * middleware — which renews the very same cookie on every request, from a
+ * package that cannot import this one — produces a byte-identical set.
+ */
+export declare class SessionCookieFactory {
+    protected SessionCookieConfig: ISessionCookieConfig;
+    /** Configured cookie name, `__Host-` prefix included when enabled. */
+    get Name(): string;
+    /**
+     * Cookie carrying an active session. `maxAge` tracks the session's real
+     * expiration rather than a fixed constant, so sliding and absolute
+     * expiration strategies both produce a cookie that outlives exactly as long
+     * as the session behind it.
+     */
+    issue(session: ISession): ISessionCookie;
+    /** Same cookie, expired — clears the session client-side on logout. */
+    clear(): ISessionCookie;
+}
+//# sourceMappingURL=SessionCookies.d.ts.map

package/lib/mjs/services/SessionCookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionCookies.d.ts","sourceRoot":"","sources":["../../../src/services/SessionCookies.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGpE,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAE/B,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,sEAAsE;IACtE,IAAW,IAAI,IAAI,MAAM,CAExB;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc;IAI/C,uEAAuE;IAChE,KAAK,IAAI,cAAc;CAG/B"}

package/lib/mjs/services/SessionCookies.js

@@ -0,0 +1,59 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Config } from '@spinajs/configuration';
+import { Injectable } from '@spinajs/di';
+import { clearSessionCookie, sessionCookie, sessionCookieName } from '@spinajs/rbac';
+/**
+ * Default name of the session cookie. Kept for callers that only need the
+ * literal; the ACTIVE name comes from configuration and may carry a `__Host-`
+ * prefix, so read {@link SessionCookieFactory.Name} instead of assuming this.
+ */
+export const SESSION_COOKIE_NAME = 'ssid';
+/**
+ * Builds the session cookie.
+ *
+ * Every place that opens, rotates, or clears a session used to inline the same
+ * literal — login, 2FA verify, active-role switch and logout each carried their
+ * own copy, and each had to remember `signed`, `httpOnly`, the configured
+ * overrides, and to derive maxAge from the session's real expiration. A drift in
+ * any one of them silently produces a cookie the next request cannot restore.
+ *
+ * The attributes themselves are decided by `@spinajs/rbac` so the session
+ * middleware — which renews the very same cookie on every request, from a
+ * package that cannot import this one — produces a byte-identical set.
+ */
+let SessionCookieFactory = class SessionCookieFactory {
+    /** Configured cookie name, `__Host-` prefix included when enabled. */
+    get Name() {
+        return sessionCookieName(this.SessionCookieConfig);
+    }
+    /**
+     * Cookie carrying an active session. `maxAge` tracks the session's real
+     * expiration rather than a fixed constant, so sliding and absolute
+     * expiration strategies both produce a cookie that outlives exactly as long
+     * as the session behind it.
+     */
+    issue(session) {
+        return sessionCookie(session, this.SessionCookieConfig);
+    }
+    /** Same cookie, expired — clears the session client-side on logout. */
+    clear() {
+        return clearSessionCookie(this.SessionCookieConfig);
+    }
+};
+__decorate([
+    Config('rbac.session.cookie', {}),
+    __metadata("design:type", Object)
+], SessionCookieFactory.prototype, "SessionCookieConfig", void 0);
+SessionCookieFactory = __decorate([
+    Injectable()
+], SessionCookieFactory);
+export { SessionCookieFactory };
+//# sourceMappingURL=SessionCookies.js.map

package/lib/mjs/services/SessionCookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionCookies.js","sourceRoot":"","sources":["../../../src/services/SessionCookies.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASrF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;;;GAYG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAI/B,sEAAsE;IACtE,IAAW,IAAI;QACb,OAAO,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAiB;QAC5B,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,uEAAuE;IAChE,KAAK;QACV,OAAO,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AArBW;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;iEACkB;AAFzC,oBAAoB;IADhC,UAAU,EAAE;GACA,oBAAoB,CAuBhC"}

package/lib/mjs/services/UserMetadataService.d.ts

@@ -0,0 +1,53 @@
+import { UserMetadata } from '@spinajs/rbac';
+import type { IFilterRequest, OrderDTO, PaginationDTO } from '@spinajs/orm-http';
+import { FilterableUserMetadata } from '../models/FilterableUserMetadata.js';
+import type { UserMetadataDto } from '../dto/metadata-dto.js';
+/**
+ * Fallback page size. A request without a `limit` used to reach `take(0)`,
+ * which the query builder rejects ( "take count should be a positive number" ),
+ * so plain listing requests failed instead of returning the first page.
+ */
+export declare const DEFAULT_PAGE_SIZE = 10;
+/**
+ * User metadata access, always scoped to one owner.
+ *
+ * The controller exposes each operation twice — once for the caller's own
+ * metadata and once for an administrator addressing a user by UUID — and the
+ * two differed only in where the owner id came from. Keeping the queries here
+ * means the ownership predicate is written once.
+ *
+ * Ownership is filtered explicitly rather than left to the rbac query
+ * middleware: metadata queries resolve to the unsafe base model, so no
+ * automatic owner scoping fires for them.
+ */
+export declare class UserMetadataService {
+    /** Paginated, filtered, ordered listing of one user's metadata. */
+    list(ownerId: number, pagination?: PaginationDTO, order?: OrderDTO, filter?: IFilterRequest): import("@spinajs/orm").ISelectQueryBuilder<FilterableUserMetadata[]> & import("@spinajs/orm").QueryScope;
+    /** A single entry of one user, by key. Rejects when absent. */
+    getByKey(ownerId: number, key: string): Promise<UserMetadata>;
+    /**
+     * Insert an entry, or update it when the key already exists.
+     *
+     * Ownership is forced onto the model — a `user_id` arriving in the request
+     * body is never trusted.
+     */
+    upsert(ownerId: number, metadata: UserMetadata): Promise<void>;
+    /**
+     * Update an entry addressed by either its Id or its Key.
+     *
+     * The Key/Id lookup is grouped and AND-ed with the ownership filter. Without
+     * the grouping the flat `Key = ? OR Id = ? AND user_id = ?` binds as
+     * `Key = ? OR (Id = ? AND user_id = ?)`, which would let any caller update
+     * another user's entry by its Key.
+     */
+    update(ownerId: number, idOrKey: string | number, data: UserMetadataDto): Promise<void>;
+    /**
+     * Delete an entry by id, scoped to its owner.
+     *
+     * `destroy()` refuses to build an unbounded DELETE, so the entry id goes in
+     * as the primary key and ownership is AND-ed on top of it — deleting by id
+     * alone would let any caller remove anybody's entry.
+     */
+    delete(ownerId: number, id: number): Promise<void>;
+}
+//# sourceMappingURL=UserMetadataService.d.ts.map

package/lib/mjs/services/UserMetadataService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserMetadataService.d.ts","sourceRoot":"","sources":["../../../src/services/UserMetadataService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,qBACa,mBAAmB;IAC9B,mEAAmE;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAc;IAWlG,+DAA+D;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAO5C;;;;;OAKG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3E;;;;;;;OAOG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpG;;;;;;OAMG;IACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhE"}

package/lib/mjs/services/UserMetadataService.js

@@ -0,0 +1,91 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { UserMetadata } from '@spinajs/rbac';
+import { InsertBehaviour, SortOrder } from '@spinajs/orm';
+import { FilterableUserMetadata } from '../models/FilterableUserMetadata.js';
+/**
+ * Fallback page size. A request without a `limit` used to reach `take(0)`,
+ * which the query builder rejects ( "take count should be a positive number" ),
+ * so plain listing requests failed instead of returning the first page.
+ */
+export const DEFAULT_PAGE_SIZE = 10;
+/**
+ * User metadata access, always scoped to one owner.
+ *
+ * The controller exposes each operation twice — once for the caller's own
+ * metadata and once for an administrator addressing a user by UUID — and the
+ * two differed only in where the owner id came from. Keeping the queries here
+ * means the ownership predicate is written once.
+ *
+ * Ownership is filtered explicitly rather than left to the rbac query
+ * middleware: metadata queries resolve to the unsafe base model, so no
+ * automatic owner scoping fires for them.
+ */
+let UserMetadataService = class UserMetadataService {
+    /** Paginated, filtered, ordered listing of one user's metadata. */
+    list(ownerId, pagination, order, filter) {
+        const limit = pagination?.limit || DEFAULT_PAGE_SIZE;
+        return FilterableUserMetadata.select()
+            .where('user_id', ownerId)
+            .filter(filter?.filters ?? [], filter?.op)
+            .take(limit)
+            .skip(limit * (pagination?.page ?? 0))
+            .order(order?.column ?? 'Id', order?.order ?? SortOrder.DESC);
+    }
+    /** A single entry of one user, by key. Rejects when absent. */
+    getByKey(ownerId, key) {
+        return UserMetadata.where({
+            Key: key,
+            user_id: ownerId,
+        }).firstOrFail();
+    }
+    /**
+     * Insert an entry, or update it when the key already exists.
+     *
+     * Ownership is forced onto the model — a `user_id` arriving in the request
+     * body is never trusted.
+     */
+    async upsert(ownerId, metadata) {
+        metadata.user_id = ownerId;
+        await metadata.insert(InsertBehaviour.InsertOrUpdate);
+    }
+    /**
+     * Update an entry addressed by either its Id or its Key.
+     *
+     * The Key/Id lookup is grouped and AND-ed with the ownership filter. Without
+     * the grouping the flat `Key = ? OR Id = ? AND user_id = ?` binds as
+     * `Key = ? OR (Id = ? AND user_id = ?)`, which would let any caller update
+     * another user's entry by its Key.
+     */
+    async update(ownerId, idOrKey, data) {
+        await UserMetadata.update({
+            Key: data.Key,
+            Value: data.Value,
+            Type: data.Type,
+        })
+            .where(function () {
+            this.where('Key', idOrKey).orWhere('Id', idOrKey);
+        })
+            .andWhere('user_id', ownerId);
+    }
+    /**
+     * Delete an entry by id, scoped to its owner.
+     *
+     * `destroy()` refuses to build an unbounded DELETE, so the entry id goes in
+     * as the primary key and ownership is AND-ed on top of it — deleting by id
+     * alone would let any caller remove anybody's entry.
+     */
+    async delete(ownerId, id) {
+        await UserMetadata.destroy(id).andWhere('user_id', ownerId);
+    }
+};
+UserMetadataService = __decorate([
+    Injectable()
+], UserMetadataService);
+export { UserMetadataService };
+//# sourceMappingURL=UserMetadataService.js.map

package/lib/mjs/services/UserMetadataService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserMetadataService.js","sourceRoot":"","sources":["../../../src/services/UserMetadataService.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAG7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;GAWG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,mEAAmE;IAC5D,IAAI,CAAC,OAAe,EAAE,UAA0B,EAAE,KAAgB,EAAE,MAAuB;QAChG,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,iBAAiB,CAAC;QAErD,OAAO,sBAAsB,CAAC,MAAM,EAAE;aACnC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;aACzB,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aACzC,IAAI,CAAC,KAAK,CAAC;aACX,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;aACrC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,+DAA+D;IACxD,QAAQ,CAAC,OAAe,EAAE,GAAW;QAC1C,OAAO,YAAY,CAAC,KAAK,CAAC;YACxB,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAsB;QACzD,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAwB,EAAE,IAAqB;QAClF,MAAM,YAAY,CAAC,MAAM,CAAC;YACxB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,KAAK,CAAC;YACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC;aACD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,EAAU;QAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AA9DY,mBAAmB;IAD/B,UAAU,EAAE;GACA,mBAAmB,CA8D/B"}

package/lib/mjs/services/grants.d.ts

@@ -0,0 +1,29 @@
+import { AccessControl, User } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import type { IGrantsMap, IUserWithGrants } from '@spinajs/rbac-http';
+/**
+ * Role whose grants are in effect for a session.
+ *
+ * Enforcement (see the rbac http middleware) resolves permissions from the
+ * session's ActiveRole and falls back to the first assigned role, so anything
+ * reported to a client has to resolve it the same way — otherwise the client is
+ * told about actions the server will refuse.
+ */
+export declare function activeRoleOf(user: User, session?: ISession | null): string | undefined;
+/**
+ * Grants in effect for a single role, flattened through its `$extend` chain.
+ * An absent role yields an empty map rather than throwing — a user with no role
+ * assigned simply has no grants.
+ */
+export declare function grantsFor(ac: AccessControl, activeRole: string | undefined): IGrantsMap;
+/**
+ * The login-style user payload: the dehydrated user plus their active role and
+ * the grants that role resolves to.
+ *
+ * Login, 2FA verification and ending an impersonation all hand the client the
+ * same shape, and all three previously assembled it by hand. `Role` is restored
+ * explicitly because `dehydrateWithRelations` flattens the relation to a string
+ * while clients expect the array they can switch between.
+ */
+export declare function buildUserWithGrants(user: User, activeRole: string | undefined, ac: AccessControl): IUserWithGrants;
+//# sourceMappingURL=grants.d.ts.map

package/lib/mjs/services/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/services/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEtE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,aAAa,GAAG,eAAe,CAOlH"}

package/lib/mjs/services/grants.js

@@ -0,0 +1,38 @@
+import { _unwindGrants } from '@spinajs/rbac';
+/**
+ * Role whose grants are in effect for a session.
+ *
+ * Enforcement (see the rbac http middleware) resolves permissions from the
+ * session's ActiveRole and falls back to the first assigned role, so anything
+ * reported to a client has to resolve it the same way — otherwise the client is
+ * told about actions the server will refuse.
+ */
+export function activeRoleOf(user, session) {
+    return session?.Data.get('ActiveRole') ?? user.Role?.[0];
+}
+/**
+ * Grants in effect for a single role, flattened through its `$extend` chain.
+ * An absent role yields an empty map rather than throwing — a user with no role
+ * assigned simply has no grants.
+ */
+export function grantsFor(ac, activeRole) {
+    return (activeRole ? _unwindGrants(activeRole, ac.getGrants()) : {});
+}
+/**
+ * The login-style user payload: the dehydrated user plus their active role and
+ * the grants that role resolves to.
+ *
+ * Login, 2FA verification and ending an impersonation all hand the client the
+ * same shape, and all three previously assembled it by hand. `Role` is restored
+ * explicitly because `dehydrateWithRelations` flattens the relation to a string
+ * while clients expect the array they can switch between.
+ */
+export function buildUserWithGrants(user, activeRole, ac) {
+    return {
+        ...user.dehydrateWithRelations({ dateTimeFormat: 'iso' }),
+        Role: user.Role,
+        ActiveRole: activeRole,
+        Grants: grantsFor(ac, activeRole),
+    };
+}
+//# sourceMappingURL=grants.js.map

package/lib/mjs/services/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/services/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,aAAa,EAAE,MAAM,eAAe,CAAC;AAInE;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,OAAyB;IAChE,OAAQ,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAwB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,EAAiB,EAAE,UAA8B;IACzE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAe,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,UAA8B,EAAE,EAAiB;IAC/F,OAAO;QACL,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACzD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC;KACJ,CAAC;AAClC,CAAC"}