@spinajs/rbac-http-user 2.0.486 → 2.0.488

package/lib/mjs/controllers/PasswordResetController.d.ts

@@ -0,0 +1,54 @@
+import { BaseController, BadRequestResponse, Ok } from '@spinajs/http';
+import { PasswordResetConfirmDto, PasswordResetRequestDto } from '../dto/password-reset-dto.js';
+/** Reply shared by both reset routes — deliberately says nothing about the account. */
+export interface IPasswordResetAck {
+    Ok: true;
+}
+/**
+ * Password reset for users who cannot log in.
+ *
+ * Two public, unauthenticated steps: request a token, then redeem it. The token
+ * itself is issued into the user's metadata by `passwordChangeRequest` and
+ * delivered out of band (the `UserPasswordChangeRequest` event is what an app
+ * hooks to send the mail) — it is never returned over HTTP, so possession of
+ * the mailbox is what authorizes the reset.
+ *
+ * Neither route reveals whether an account exists. Both answer the same way for
+ * a known and an unknown address, which is the whole point of a reset endpoint
+ * that anybody may call: an attacker must not be able to farm valid addresses
+ * from it, and a failed redemption must not distinguish "no such user" from
+ * "wrong token".
+ *
+ * NOTE: these routes are unauthenticated and cheap to call in a loop. Put a
+ * rate limit in front of them at the edge — this package does not provide one.
+ *
+ * @tags Authentication
+ */
+export declare class PasswordResetController extends BaseController {
+    /**
+     * Request a password reset
+     * Issues a reset token for the account and emits `UserPasswordChangeRequest` so the
+     * application can deliver it. Always succeeds, whether or not the address is known.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement — never indicates whether the account exists
+     */
+    requestReset(payload: PasswordResetRequestDto): Promise<Ok<IPasswordResetAck>>;
+    /**
+     * Complete a password reset
+     * Redeems the token issued by `POST /auth/password/reset-request` and sets the new
+     * password. The token is single-use and expires after `rbac.password.passwordResetWaitTime`.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement of a successful reset
+     * @response 400 New passwords do not match, or the token is invalid or expired
+     */
+    confirmReset(payload: PasswordResetConfirmDto): Promise<Ok<IPasswordResetAck> | BadRequestResponse>;
+    /**
+     * Issue a reset token into the user's metadata and emit
+     * `UserPasswordChangeRequest`. Wraps the module-level action so tests can
+     * stub it without a database.
+     */
+    protected issueToken(email: string): Promise<unknown>;
+    /** Redeem a reset token. Wrapped for the same reason as {@link issueToken}. */
+    protected redeemToken(email: string, password: string, token: string): Promise<unknown>;
+}
+//# sourceMappingURL=PasswordResetController.d.ts.map

package/lib/mjs/controllers/PasswordResetController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetController.d.ts","sourceRoot":"","sources":["../../../src/controllers/PasswordResetController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,kBAAkB,EAAE,EAAE,EAAQ,MAAM,eAAe,CAAC;AAI7F,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEhG,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,uBAAwB,SAAQ,cAAc;IACzD;;;;;;OAMG;IAGU,YAAY,CAAS,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAcnG;;;;;;;OAOG;IAGU,YAAY,CAAS,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,kBAAkB,CAAC;IA+BxH;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD,+EAA+E;IAC/E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGxF"}

package/lib/mjs/controllers/PasswordResetController.js

@@ -0,0 +1,126 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BaseController, BasePath, Body, BadRequestResponse, Ok, Post } from '@spinajs/http';
+import { confirmPasswordReset, passwordChangeRequest } from '@spinajs/rbac';
+import { ErrorCode, InvalidArgument } from '@spinajs/exceptions';
+import { SkipModelPermission } from '@spinajs/rbac-http';
+import { PasswordResetConfirmDto, PasswordResetRequestDto } from '../dto/password-reset-dto.js';
+/**
+ * Password reset for users who cannot log in.
+ *
+ * Two public, unauthenticated steps: request a token, then redeem it. The token
+ * itself is issued into the user's metadata by `passwordChangeRequest` and
+ * delivered out of band (the `UserPasswordChangeRequest` event is what an app
+ * hooks to send the mail) — it is never returned over HTTP, so possession of
+ * the mailbox is what authorizes the reset.
+ *
+ * Neither route reveals whether an account exists. Both answer the same way for
+ * a known and an unknown address, which is the whole point of a reset endpoint
+ * that anybody may call: an attacker must not be able to farm valid addresses
+ * from it, and a failed redemption must not distinguish "no such user" from
+ * "wrong token".
+ *
+ * NOTE: these routes are unauthenticated and cheap to call in a loop. Put a
+ * rate limit in front of them at the edge — this package does not provide one.
+ *
+ * @tags Authentication
+ */
+let PasswordResetController = class PasswordResetController extends BaseController {
+    /**
+     * Request a password reset
+     * Issues a reset token for the account and emits `UserPasswordChangeRequest` so the
+     * application can deliver it. Always succeeds, whether or not the address is known.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement — never indicates whether the account exists
+     */
+    async requestReset(payload) {
+        try {
+            await this.issueToken(payload.Email);
+        }
+        catch (err) {
+            // Swallowed on purpose. An unknown address, a deleted account or a
+            // banned one must produce exactly the response a valid address does —
+            // otherwise this route becomes an account enumeration oracle. Real
+            // faults ( mail queue, database ) are logged for operators.
+            this._log.warn(err, `Password reset request could not be processed for ${payload.Email}`);
+        }
+        return new Ok({ Ok: true });
+    }
+    /**
+     * Complete a password reset
+     * Redeems the token issued by `POST /auth/password/reset-request` and sets the new
+     * password. The token is single-use and expires after `rbac.password.passwordResetWaitTime`.
+     * @security []
+     * @returns {IPasswordResetAck} Acknowledgement of a successful reset
+     * @response 400 New passwords do not match, or the token is invalid or expired
+     */
+    async confirmReset(payload) {
+        if (payload.Password !== payload.ConfirmPassword) {
+            throw new InvalidArgument('password does not match');
+        }
+        try {
+            await this.redeemToken(payload.Email, payload.Password, payload.Token);
+        }
+        catch (err) {
+            // One opaque failure for every rejection reason: unknown account, wrong
+            // token, expired token. Distinguishing them would tell a caller which
+            // addresses exist and let them probe tokens by the error they get back.
+            const isRedemptionFailure = err instanceof ErrorCode || err instanceof InvalidArgument;
+            if (!isRedemptionFailure) {
+                this._log.error(err, `Password reset failed unexpectedly for ${payload.Email}`);
+                throw err;
+            }
+            this._log.warn(err, `Password reset rejected for ${payload.Email}`);
+            return new BadRequestResponse({
+                error: {
+                    code: 'E_RESET_TOKEN_INVALID',
+                    message: 'Password reset token is invalid or has expired',
+                },
+            });
+        }
+        return new Ok({ Ok: true });
+    }
+    /**
+     * Issue a reset token into the user's metadata and emit
+     * `UserPasswordChangeRequest`. Wraps the module-level action so tests can
+     * stub it without a database.
+     */
+    issueToken(email) {
+        return passwordChangeRequest(email);
+    }
+    /** Redeem a reset token. Wrapped for the same reason as {@link issueToken}. */
+    redeemToken(email, password, token) {
+        return confirmPasswordReset(email, password, token);
+    }
+};
+__decorate([
+    Post('password/reset-request'),
+    SkipModelPermission(),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [PasswordResetRequestDto]),
+    __metadata("design:returntype", Promise)
+], PasswordResetController.prototype, "requestReset", null);
+__decorate([
+    Post('password/reset'),
+    SkipModelPermission(),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [PasswordResetConfirmDto]),
+    __metadata("design:returntype", Promise)
+], PasswordResetController.prototype, "confirmReset", null);
+PasswordResetController = __decorate([
+    BasePath('auth')
+], PasswordResetController);
+export { PasswordResetController };
+//# sourceMappingURL=PasswordResetController.js.map

package/lib/mjs/controllers/PasswordResetController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetController.js","sourceRoot":"","sources":["../../../src/controllers/PasswordResetController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAOhG;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IACzD;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,OAAgC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,qDAAqD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAuB,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,OAAgC;QAChE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,mBAAmB,GAAG,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,eAAe,CAAC;YAEvF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,0CAA0C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,+BAA+B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAE7E,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,gDAAgD;iBAC1D;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAuB,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,KAAa;QAChC,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,+EAA+E;IACrE,WAAW,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAClE,OAAO,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AApEc;IAFZ,IAAI,CAAC,wBAAwB,CAAC;IAC9B,mBAAmB,EAAE;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAU,uBAAuB;;2DAYjE;AAYY;IAFZ,IAAI,CAAC,gBAAgB,CAAC;IACtB,mBAAmB,EAAE;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAU,uBAAuB;;2DA6BjE;AA/DU,uBAAuB;IADnC,QAAQ,CAAC,MAAM,CAAC;GACJ,uBAAuB,CA8EnC"}

package/lib/mjs/controllers/SessionsController.d.ts

@@ -0,0 +1,65 @@
+import { BaseController, NotFound, Ok } from '@spinajs/http';
+import { SessionProvider, User as UserModel } from '@spinajs/rbac';
+import type { ISession } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
+/** One live session of the calling user. */
+export interface IUserSessionEntry {
+    /**
+     * Opaque, stable handle for the session. Deliberately NOT the session id:
+     * listing your own sessions must not hand out working credentials for them,
+     * because the response ( and anything that caches or logs it ) would then be
+     * as good as the cookies themselves.
+     */
+    Handle: string;
+    /** ISO instant the session was opened */
+    Created: string;
+    /** ISO instant the session expires, or null when it never does */
+    Expires: string | null;
+    /** True for the session making this request */
+    Current: boolean;
+}
+/**
+ * Active sessions of the calling user — "where am I logged in", plus the means
+ * to end any of them.
+ *
+ * OWASP asks for exactly this: the user should be able to see concurrent
+ * sessions and terminate them remotely, which is how a person who suspects a
+ * stolen cookie gets rid of it without an administrator.
+ *
+ * @tags User
+ */
+export declare class SessionsController extends BaseController {
+    protected Log: Log;
+    protected SessionProvider: SessionProvider;
+    /**
+     * List own sessions
+     * Returns every live session of the authenticated user, newest first, with the
+     * one making the request flagged.
+     * @security cookieAuth
+     * @returns {IUserSessionEntry[]} Live sessions of the calling user
+     * @response 401 Unauthorized — valid session required
+     */
+    list(user: UserModel, ssid: string): Promise<Ok<IUserSessionEntry[]>>;
+    /**
+     * Revoke one session
+     * Ends the session identified by its handle. Revoking the current session is
+     * allowed and logs the caller out.
+     * @security cookieAuth
+     * @param handle Session handle as returned by `GET /user/sessions`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 404 No such session for this user
+     */
+    revoke(user: UserModel, handle: string): Promise<Ok | NotFound>;
+    /**
+     * Revoke every other session
+     * Ends all sessions of the user except the one making the request — the
+     * "log out everywhere else" action after a suspected compromise.
+     * @security cookieAuth
+     * @response 200 Other sessions revoked
+     * @response 401 Unauthorized — valid session required
+     */
+    revokeOthers(user: UserModel, ssid: string): Promise<Ok>;
+    protected toEntry(session: ISession, currentHandle: string | null): IUserSessionEntry;
+}
+//# sourceMappingURL=SessionsController.d.ts.map

package/lib/mjs/controllers/SessionsController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/SessionsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,QAAQ,EAAE,EAAE,EAAiB,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAiB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAG3C,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAEhB,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,qBAGa,kBAAmB,SAAQ,cAAc;IAEpD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C;;;;;;;OAOG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAW1G;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC;IAkB7F;;;;;;;OAOG;IAGU,YAAY,CAAS,IAAI,EAAE,SAAS,EAAkB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAkB7F,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB;CAUtF"}

package/lib/mjs/controllers/SessionsController.js

@@ -0,0 +1,140 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BaseController, BasePath, Del, Get, NotFound, Ok, Param, Policy } from '@spinajs/http';
+import { SessionProvider, User as UserModel, hashSessionId } from '@spinajs/rbac';
+import { AutoinjectService } from '@spinajs/configuration';
+import { Log, Logger } from '@spinajs/log';
+import { AuthorizedPolicy, Permission, Resource, SessionId as SessionIdArg, User } from '@spinajs/rbac-http';
+/**
+ * Active sessions of the calling user — "where am I logged in", plus the means
+ * to end any of them.
+ *
+ * OWASP asks for exactly this: the user should be able to see concurrent
+ * sessions and terminate them remotely, which is how a person who suspects a
+ * stolen cookie gets rid of it without an administrator.
+ *
+ * @tags User
+ */
+let SessionsController = class SessionsController extends BaseController {
+    /**
+     * List own sessions
+     * Returns every live session of the authenticated user, newest first, with the
+     * one making the request flagged.
+     * @security cookieAuth
+     * @returns {IUserSessionEntry[]} Live sessions of the calling user
+     * @response 401 Unauthorized — valid session required
+     */
+    async list(user, ssid) {
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        const current = ssid ? hashSessionId(ssid) : null;
+        const entries = sessions
+            .map((s) => this.toEntry(s, current))
+            .sort((a, b) => (a.Created < b.Created ? 1 : -1));
+        return new Ok(entries);
+    }
+    /**
+     * Revoke one session
+     * Ends the session identified by its handle. Revoking the current session is
+     * allowed and logs the caller out.
+     * @security cookieAuth
+     * @param handle Session handle as returned by `GET /user/sessions`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 404 No such session for this user
+     */
+    async revoke(user, handle) {
+        // Resolved through the user's OWN session list, so a handle belonging to
+        // somebody else's session simply is not found here — the route cannot be
+        // used to end a stranger's session even if its handle leaks.
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        const match = sessions.find((s) => hashSessionId(s.SessionId) === handle);
+        if (!match) {
+            return new NotFound({ error: { code: 'E_SESSION_NOT_FOUND', message: 'No such session' } });
+        }
+        await this.SessionProvider.delete(match.SessionId);
+        this.Log.info(`Session revoked by its owner`, { Session: handle, User: user.Uuid });
+        return new Ok(null, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+    }
+    /**
+     * Revoke every other session
+     * Ends all sessions of the user except the one making the request — the
+     * "log out everywhere else" action after a suspected compromise.
+     * @security cookieAuth
+     * @response 200 Other sessions revoked
+     * @response 401 Unauthorized — valid session required
+     */
+    async revokeOthers(user, ssid) {
+        const sessions = await this.SessionProvider.listByUser(user.Id);
+        let revoked = 0;
+        for (const session of sessions) {
+            if (session.SessionId === ssid) {
+                continue;
+            }
+            await this.SessionProvider.delete(session.SessionId);
+            revoked++;
+        }
+        this.Log.info(`Revoked ${revoked} other session(s)`, { User: user.Uuid });
+        return new Ok({ Revoked: revoked }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+    }
+    toEntry(session, currentHandle) {
+        const handle = hashSessionId(session.SessionId);
+        return {
+            Handle: handle,
+            Created: session.Creation?.toISO() ?? '',
+            Expires: session.Expiration?.toISO() ?? null,
+            Current: handle === currentHandle,
+        };
+    }
+};
+__decorate([
+    Logger('rbac-session'),
+    __metadata("design:type", Log)
+], SessionsController.prototype, "Log", void 0);
+__decorate([
+    AutoinjectService('rbac.session'),
+    __metadata("design:type", SessionProvider)
+], SessionsController.prototype, "SessionProvider", void 0);
+__decorate([
+    Get('sessions'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __param(1, SessionIdArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "list", null);
+__decorate([
+    Del('sessions/:handle'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Param()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "revoke", null);
+__decorate([
+    Del('sessions'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, SessionIdArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String]),
+    __metadata("design:returntype", Promise)
+], SessionsController.prototype, "revokeOthers", null);
+SessionsController = __decorate([
+    BasePath('user'),
+    Resource('user'),
+    Policy(AuthorizedPolicy)
+], SessionsController);
+export { SessionsController };
+//# sourceMappingURL=SessionsController.js.map

package/lib/mjs/controllers/SessionsController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionsController.js","sourceRoot":"","sources":["../../../src/controllers/SessionsController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,IAAI,YAAY,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAsB7G;;;;;;;;;GASG;AAII,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,cAAc;IAOpD;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe,EAAkB,IAAY;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAElD,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,MAAc;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpF,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,YAAY,CAAS,IAAe,EAAkB,IAAY;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,OAAO,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAES,OAAO,CAAC,OAAiB,EAAE,aAA4B;QAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;YACxC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,IAAI;YAC5C,OAAO,EAAE,MAAM,KAAK,aAAa;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AA9FW;IADT,MAAM,CAAC,cAAc,CAAC;8BACR,GAAG;+CAAC;AAGT;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;2DAAC;AAY9B;IAFZ,GAAG,CAAC,UAAU,CAAC;IACf,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,YAAY,EAAE,CAAA;;qCAA1B,SAAS;;8CASxC;AAcY;IAFZ,GAAG,CAAC,kBAAkB,CAAC;IACvB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;gDAgB1C;AAYY;IAFZ,GAAG,CAAC,UAAU,CAAC;IACf,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACC,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,YAAY,EAAE,CAAA;;qCAA1B,SAAS;;sDAgBhD;AApFU,kBAAkB;IAH9B,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,gBAAgB,CAAC;GACZ,kBAAkB,CAgG9B"}

package/lib/mjs/controllers/TwoFactorAuthController.d.ts

@@ -1,41 +1,42 @@
 import { TokenDto } from './../dto/token-dto.js';
 import { BaseController, Ok, ForbiddenResponse } from '@spinajs/http';
 import { ISession, SessionProvider, User as UserModel, AccessControl } from '@spinajs/rbac';
-import { QueueService } from '@spinajs/queue';
-import { IEnable2faResponse, IUserWithGrants } from "@spinajs/rbac-http";
+import { IEnable2faResponse, IUserWithGrants } from '@spinajs/rbac-http';
+import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
- * Two-factor authentication (TOTP) management.
- * Enables, disables, and verifies TOTP-based two-factor authentication for users.
- * All routes are only available when 2FA is enabled in the system configuration.
- * The caller must be logged in but does NOT need to be fully authorized (2FA verified),
- * allowing these routes to be used during the 2FA verification step itself.
+ * Two-factor authentication during login.
+ *
+ * These routes serve the narrow window between a successful password check and
+ * full authorization: the session is `Logged` but not `Authorized` and carries
+ * the `TwoFactorAuth` marker. Both class policies must hold, so the window
+ * closes the moment verification succeeds.
+ *
+ * Managing a TOTP device outside that window — enrolling for the first time, or
+ * turning 2FA off — lives on {@link TwoFactorAuthUserController} under
+ * `/user/2fa`, where the caller is fully authorized. Notably there is no
+ * "disable" here on purpose: a session that has not yet proven possession of
+ * the second factor must not be able to remove it, which would reduce the whole
+ * scheme to the password alone.
+ *
  * @tags Two-Factor Authentication
  */
 export declare class TwoFactorAuthController extends BaseController {
-    protected Queue: QueueService;
     protected SessionProvider: SessionProvider;
-    protected SessionCookieConfig: any;
+    protected SessionCookies: SessionCookieFactory;
     protected AC: AccessControl;
     /**
-     * Enable two-factor authentication
-     * Generates a TOTP secret for the authenticated user and returns the OTP provisioning URI
-     * to be scanned by an authenticator app. Throws if 2FA is already enabled for the user.
+     * Set up two-factor authentication during login
+     * Generates a TOTP secret for a user who must enrol before continuing — the state
+     * signalled by `TwoFactorInitRequired` at login when `rbac.twoFactorAuth.forceUser`
+     * is on. Returns the OTP provisioning URI to scan with an authenticator app; the
+     * caller then confirms with `POST /auth/2fa/verify`.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
      * @response 401 Unauthorized — valid session required
+     * @response 403 Session is not awaiting two-factor enrolment
      */
-    enable2fa(user: UserModel): Promise<Ok<IEnable2faResponse>>;
-    /**
-     * Disable two-factor authentication
-     * Removes the TOTP secret and disables 2FA for the authenticated user.
-     * Throws if 2FA is not currently enabled for the user.
-     * @security cookieAuth
-     * @response 200 Two-factor authentication disabled successfully
-     * @response 400 Two-factor authentication is not enabled for this user
-     * @response 401 Unauthorized — valid session required
-     */
-    disable2Fa(user: UserModel): Promise<Ok<any>>;
+    setup2fa(user: UserModel): Promise<Ok<IEnable2faResponse>>;
     /**
      * Verify TOTP token
      * Validates the provided TOTP token against the user's 2FA secret. On success, marks the session

package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAa,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAyC,aAAa,EAA0C,MAAM,eAAe,CAAC;AAO3K,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKpG;;;;;;;GAOG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEvD,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;IAG9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEU,SAAS,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAYhF;;;;;;;;OAQG;IAEU,UAAU,CAAS,IAAI,EAAE,SAAS;IAS/C;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAgE5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhF"}
+{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAW/E;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC;IAyC5J;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9E"}