@spinajs/rbac-http-user 2.0.502 → 2.0.505

package/lib/mjs/policies/2FaPolicy.js

@@ -7,10 +7,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { InvalidOperation } from '@spinajs/exceptions';
 import { Config } from '@spinajs/configuration';
 import { BasePolicy } from '@spinajs/http';
-import { Forbidden } from '@spinajs/exceptions';
+import { Forbidden, InvalidOperation } from '@spinajs/exceptions';
 /**
  * Guards routes that only make sense when 2FA is switched on system-wide.
  *
@@ -22,11 +21,33 @@ export class TwoFactorAuthEnabled extends BasePolicy {
     isEnabled() {
         return true;
     }
-    execute(_req) {
+    async execute(_req) {
         if (this.TwoFactorConfig.enabled === false) {
-            throw new InvalidOperation('2 factor auth is not enabled');
+            // Deliberately Forbidden and not InvalidOperation: the latter has no
+            // @HandleException mapping in @spinajs/http and reaches the client as a
+            // 500, which a caller cannot distinguish from a fault.
+            //
+            // `Forbidden`'s constructor only accepts a message string (see
+            // `Exception` in @spinajs/exceptions), so the structured payload that
+            // the HTTP error handler serializes into the response body is attached
+            // as an extra `error` property after construction.
+            //
+            // This method must stay `async`: `createPolicyGate` (see
+            // packages/http/src/route-builder.ts) builds its wait list with
+            // `enabledPolicies.map(p => p.execute(...).then(...))`. A synchronous
+            // `throw` here would escape that `.map()` call entirely instead of
+            // becoming a rejected promise in the array, so `Promise.allSettled`
+            // would never even run — the whole policy gate blows up for every
+            // caller, authorized or not, instead of just this policy losing the
+            // race. Marking the method `async` turns the throw into a promise
+            // rejection, which is what the gate is built to handle.
+            throw Object.assign(new Forbidden('2 factor auth is not enabled'), {
+                error: {
+                    code: 'E_2FA_SYSTEM_DISABLED',
+                    message: '2 factor auth is not enabled',
+                },
+            });
         }
-        return Promise.resolve();
     }
 }
 __decorate([

package/lib/mjs/policies/2FaPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAI3C,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,IAAc;QAC3B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAbW;IADT,MAAM,CAAC,oBAAoB,CAAC;;6DACkB;AAejD;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,oBAAoB;IACnD,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"2FaPolicy.js","sourceRoot":"","sources":["../../../src/policies/2FaPolicy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAI3C,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,IAAc;QACjC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,qEAAqE;YACrE,wEAAwE;YACxE,uDAAuD;YACvD,EAAE;YACF,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,mDAAmD;YACnD,EAAE;YACF,yDAAyD;YACzD,gEAAgE;YAChE,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,kEAAkE;YAClE,wDAAwD;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,8BAA8B,CAAC,EAAE;gBACjE,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,8BAA8B;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAlCW;IADT,MAAM,CAAC,oBAAoB,CAAC;;6DACkB;AAoCjD;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,oBAAoB;IACnD,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED;;WAEG;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}