@spinajs/rbac-http 2.0.180 → 2.0.181

package/lib/cjs/middlewares.js

@@ -1,92 +1,92 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RbacMiddleware = void 0;
-const rbac_1 = require("@spinajs/rbac");
-const di_1 = require("@spinajs/di");
-require("reflect-metadata");
-const configuration_1 = require("@spinajs/configuration");
-const cs = __importStar(require("cookie-signature"));
-const http_1 = require("@spinajs/http");
-let RbacMiddleware = class RbacMiddleware extends http_1.ServerMiddleware {
-    async resolve() {
-        if (!this.CoockieSecret) {
-            throw new Error('http.cookie.secrets is not set, cannot start UserFromSessionMiddleware. Set this value in configuration file !');
-        }
-    }
-    before() {
-        return async (req, _res, next) => {
-            try {
-                let session = null;
-                if (req.cookies?.ssid) {
-                    const ssid = cs.unsign(req.cookies.ssid, this.CoockieSecret);
-                    if (ssid) {
-                        session = await this.SessionProvider.restore(ssid);
-                    }
-                }
-                if (session) {
-                    /**
-                     * If we have session, try to restore user with data from session
-                     * otherwise try to create guest
-                     */
-                    req.storage.user = di_1.DI.resolve('RbacUserFactory', [session.Data.get('User')]);
-                    req.storage.session = session;
-                }
-                else {
-                    req.storage.user = di_1.DI.resolve('RbacGuestUserFactory');
-                }
-                next();
-            }
-            catch (err) {
-                next(err);
-            }
-        };
-    }
-    after() {
-        return null;
-    }
-};
-__decorate([
-    (0, configuration_1.Config)('http.cookie.secret'),
-    __metadata("design:type", String)
-], RbacMiddleware.prototype, "CoockieSecret", void 0);
-__decorate([
-    (0, di_1.Autoinject)(),
-    __metadata("design:type", rbac_1.SessionProvider)
-], RbacMiddleware.prototype, "SessionProvider", void 0);
-RbacMiddleware = __decorate([
-    (0, di_1.Injectable)(http_1.ServerMiddleware)
-], RbacMiddleware);
-exports.RbacMiddleware = RbacMiddleware;
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RbacMiddleware = void 0;
+const rbac_1 = require("@spinajs/rbac");
+const di_1 = require("@spinajs/di");
+require("reflect-metadata");
+const configuration_1 = require("@spinajs/configuration");
+const cs = __importStar(require("cookie-signature"));
+const http_1 = require("@spinajs/http");
+let RbacMiddleware = class RbacMiddleware extends http_1.ServerMiddleware {
+    async resolve() {
+        if (!this.CoockieSecret) {
+            throw new Error('http.cookie.secrets is not set, cannot start UserFromSessionMiddleware. Set this value in configuration file !');
+        }
+    }
+    before() {
+        return async (req, _res, next) => {
+            try {
+                let session = null;
+                if (req.cookies?.ssid) {
+                    const ssid = cs.unsign(req.cookies.ssid, this.CoockieSecret);
+                    if (ssid) {
+                        session = await this.SessionProvider.restore(ssid);
+                    }
+                }
+                if (session) {
+                    /**
+                     * If we have session, try to restore user with data from session
+                     * otherwise try to create guest
+                     */
+                    req.storage.user = di_1.DI.resolve('RbacUserFactory', [session.Data.get('User')]);
+                    req.storage.session = session;
+                }
+                else {
+                    req.storage.user = di_1.DI.resolve('RbacGuestUserFactory');
+                }
+                next();
+            }
+            catch (err) {
+                next(err);
+            }
+        };
+    }
+    after() {
+        return null;
+    }
+};
+exports.RbacMiddleware = RbacMiddleware;
+__decorate([
+    (0, configuration_1.Config)('http.cookie.secret'),
+    __metadata("design:type", String)
+], RbacMiddleware.prototype, "CoockieSecret", void 0);
+__decorate([
+    (0, di_1.Autoinject)(),
+    __metadata("design:type", rbac_1.SessionProvider)
+], RbacMiddleware.prototype, "SessionProvider", void 0);
+exports.RbacMiddleware = RbacMiddleware = __decorate([
+    (0, di_1.Injectable)(http_1.ServerMiddleware)
+], RbacMiddleware);
 //# sourceMappingURL=middlewares.js.map

package/lib/cjs/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAgE;AAChE,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;YACvB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;SACnI;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI;gBACF,IAAI,OAAO,GAAa,IAAI,CAAC;gBAC7B,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE;oBACrB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE;wBACR,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;qBACpD;iBACF;gBAED,IAAI,OAAO,EAAE;oBACX;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACnF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;iBAC/B;qBAAM;oBACL,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;iBAC7D;gBAED,IAAI,EAAE,CAAC;aACR;YAAC,OAAO,GAAG,EAAE;gBACZ,IAAI,CAAC,GAAG,CAAC,CAAC;aACX;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA3CC;IAAC,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAEhC;IAAC,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;AALhC,cAAc;IAD1B,IAAA,eAAU,EAAC,uBAAgB,CAAC;GAChB,cAAc,CA4C1B;AA5CY,wCAAc"}
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAgE;AAChE,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;YACvB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;SACnI;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI;gBACF,IAAI,OAAO,GAAa,IAAI,CAAC;gBAC7B,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE;oBACrB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE;wBACR,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;qBACpD;iBACF;gBAED,IAAI,OAAO,EAAE;oBACX;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACnF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;iBAC/B;qBAAM;oBACL,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;iBAC7D;gBAED,IAAI,EAAE,CAAC;aACR;YAAC,OAAO,GAAG,EAAE;gBACZ,IAAI,CAAC,GAAG,CAAC,CAAC;aACX;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA5CY,wCAAc;AAEf;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;yBALhC,cAAc;IAD1B,IAAA,eAAU,EAAC,uBAAgB,CAAC;GAChB,cAAc,CA4C1B"}

package/lib/cjs/policies/AllowGuest.d.ts

@@ -1,9 +1,9 @@
-import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
-/**
- * Policy to block guests
- */
-export declare class BlockGuest extends BasePolicy {
-    isEnabled(_action: IRoute, _instance: IController): boolean;
-    execute(req: sRequest): Promise<void>;
-}
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+/**
+ * Policy to block guests
+ */
+export declare class BlockGuest extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest): Promise<void>;
+}
 //# sourceMappingURL=AllowGuest.d.ts.map

package/lib/cjs/policies/AllowGuest.js

@@ -1,29 +1,29 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BlockGuest = void 0;
-const http_1 = require("@spinajs/http");
-const exceptions_1 = require("@spinajs/exceptions");
-/**
- * Policy to block guests
- */
-class BlockGuest extends http_1.BasePolicy {
-    isEnabled(_action, _instance) {
-        // acl is always on if set
-        return true;
-    }
-    async execute(req) {
-        if (!req.storage || !req.storage.user) {
-            throw new exceptions_1.Forbidden('user not logged or session expired');
-        }
-        const user = req.storage.user;
-        if (user.IsGuest) {
-            // if we disable guest account in config file, throw
-            if (!user.IsActive) {
-                throw new exceptions_1.Forbidden('guest account is disabled');
-            }
-        }
-        return Promise.resolve();
-    }
-}
-exports.BlockGuest = BlockGuest;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlockGuest = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Policy to block guests
+ */
+class BlockGuest extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        // acl is always on if set
+        return true;
+    }
+    async execute(req) {
+        if (!req.storage || !req.storage.user) {
+            throw new exceptions_1.Forbidden('user not logged or session expired');
+        }
+        const user = req.storage.user;
+        if (user.IsGuest) {
+            // if we disable guest account in config file, throw
+            if (!user.IsActive) {
+                throw new exceptions_1.Forbidden('guest account is disabled');
+            }
+        }
+        return Promise.resolve();
+    }
+}
+exports.BlockGuest = BlockGuest;
 //# sourceMappingURL=AllowGuest.js.map

package/lib/cjs/policies/BlockGuest.d.ts

@@ -1,9 +1,9 @@
-import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
-/**
- * Policy to block guests
- */
-export declare class BlockGuest extends BasePolicy {
-    isEnabled(_action: IRoute, _instance: IController): boolean;
-    execute(req: sRequest): Promise<void>;
-}
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+/**
+ * Policy to block guests
+ */
+export declare class BlockGuest extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest): Promise<void>;
+}
 //# sourceMappingURL=BlockGuest.d.ts.map

package/lib/cjs/policies/BlockGuest.js

@@ -1,25 +1,25 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BlockGuest = void 0;
-const http_1 = require("@spinajs/http");
-const exceptions_1 = require("@spinajs/exceptions");
-/**
- * Policy to block guests
- */
-class BlockGuest extends http_1.BasePolicy {
-    isEnabled(_action, _instance) {
-        // acl is always on if set
-        return true;
-    }
-    async execute(req) {
-        if (!req.storage || !req.storage.user) {
-            throw new exceptions_1.Forbidden('user not logged or session expired');
-        }
-        if (req.storage.user) {
-            throw new exceptions_1.Forbidden('user not logged or session expired');
-        }
-        return Promise.resolve();
-    }
-}
-exports.BlockGuest = BlockGuest;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlockGuest = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Policy to block guests
+ */
+class BlockGuest extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        // acl is always on if set
+        return true;
+    }
+    async execute(req) {
+        if (!req.storage || !req.storage.user) {
+            throw new exceptions_1.Forbidden('user not logged or session expired');
+        }
+        if (req.storage.user) {
+            throw new exceptions_1.Forbidden('user not logged or session expired');
+        }
+        return Promise.resolve();
+    }
+}
+exports.BlockGuest = BlockGuest;
 //# sourceMappingURL=BlockGuest.js.map

package/lib/cjs/policies/LoggedPolicy.d.ts

@@ -1,10 +1,10 @@
-import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
-/**
- * Simple policy to only check if user is authorized ( do not check permissions for routes)
- * Usefull if we want to give acces for all logged users
- */
-export declare class LoggedPolicy extends BasePolicy {
-    isEnabled(_action: IRoute, _instance: IController): boolean;
-    execute(req: sRequest): Promise<void>;
-}
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+/**
+ * Simple policy to only check if user is authorized ( do not check permissions for routes)
+ * Usefull if we want to give acces for all logged users
+ */
+export declare class LoggedPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest): Promise<void>;
+}
 //# sourceMappingURL=LoggedPolicy.d.ts.map

package/lib/cjs/policies/LoggedPolicy.js

@@ -1,23 +1,23 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoggedPolicy = void 0;
-const http_1 = require("@spinajs/http");
-const exceptions_1 = require("@spinajs/exceptions");
-/**
- * Simple policy to only check if user is authorized ( do not check permissions for routes)
- * Usefull if we want to give acces for all logged users
- */
-class LoggedPolicy extends http_1.BasePolicy {
-    isEnabled(_action, _instance) {
-        // acl is always on if set
-        return true;
-    }
-    async execute(req) {
-        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
-            throw new exceptions_1.Forbidden('user not logged or session expired');
-        }
-        return Promise.resolve();
-    }
-}
-exports.LoggedPolicy = LoggedPolicy;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoggedPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Simple policy to only check if user is authorized ( do not check permissions for routes)
+ * Usefull if we want to give acces for all logged users
+ */
+class LoggedPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        // acl is always on if set
+        return true;
+    }
+    async execute(req) {
+        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
+            throw new exceptions_1.Forbidden('user not logged or session expired');
+        }
+        return Promise.resolve();
+    }
+}
+exports.LoggedPolicy = LoggedPolicy;
 //# sourceMappingURL=LoggedPolicy.js.map

package/lib/cjs/policies/NotLoggedPolicy.d.ts

@@ -1,10 +1,10 @@
-import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
-/**
- * Simple policy to only check if user is authorized ( do not check permissions for routes)
- * Usefull if we want to give acces for all logged users
- */
-export declare class NotLoggedPolicy extends BasePolicy {
-    isEnabled(_action: IRoute, _instance: IController): boolean;
-    execute(req: sRequest): Promise<void>;
-}
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+/**
+ * Simple policy to only check if user is authorized ( do not check permissions for routes)
+ * Usefull if we want to give acces for all logged users
+ */
+export declare class NotLoggedPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest): Promise<void>;
+}
 //# sourceMappingURL=NotLoggedPolicy.d.ts.map

package/lib/cjs/policies/NotLoggedPolicy.js

@@ -1,22 +1,22 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NotLoggedPolicy = void 0;
-const http_1 = require("@spinajs/http");
-const exceptions_1 = require("@spinajs/exceptions");
-/**
- * Simple policy to only check if user is authorized ( do not check permissions for routes)
- * Usefull if we want to give acces for all logged users
- */
-class NotLoggedPolicy extends http_1.BasePolicy {
-    isEnabled(_action, _instance) {
-        return true;
-    }
-    async execute(req) {
-        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
-            return Promise.resolve();
-        }
-        throw new exceptions_1.InvalidOperation('Cannot perform action when user is logged.');
-    }
-}
-exports.NotLoggedPolicy = NotLoggedPolicy;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotLoggedPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Simple policy to only check if user is authorized ( do not check permissions for routes)
+ * Usefull if we want to give acces for all logged users
+ */
+class NotLoggedPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req) {
+        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
+            return Promise.resolve();
+        }
+        throw new exceptions_1.InvalidOperation('Cannot perform action when user is logged.');
+    }
+}
+exports.NotLoggedPolicy = NotLoggedPolicy;
 //# sourceMappingURL=NotLoggedPolicy.js.map

package/lib/cjs/policies/RbacPolicy.d.ts

@@ -1,16 +1,16 @@
-import { AccessControl, Permission } from 'accesscontrol';
-import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
-import { User } from '@spinajs/rbac';
-/**
- * Checks if user is logged, authorized & have proper permissions
- */
-export declare class RbacPolicy extends BasePolicy {
-    protected Ac: AccessControl;
-    constructor();
-    isEnabled(_action: IRoute, _instance: IController): boolean;
-    execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
-}
-export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission;
-export declare function checkUserPermission(user: User, resource: string, permission: string): Permission;
-export declare function checkRoutePermission(req: sRequest, resource: string, permission: string): Permission;
+import { AccessControl, Permission } from 'accesscontrol';
+import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
+import { User } from '@spinajs/rbac';
+/**
+ * Checks if user is logged, authorized & have proper permissions
+ */
+export declare class RbacPolicy extends BasePolicy {
+    protected Ac: AccessControl;
+    constructor();
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: sRequest, action: IRoute, instance: IController): Promise<void>;
+}
+export declare function checkRbacPermission(role: string | string[], resource: string, permission: string): Permission;
+export declare function checkUserPermission(user: User, resource: string, permission: string): Permission;
+export declare function checkRoutePermission(req: sRequest, resource: string, permission: string): Permission;
 //# sourceMappingURL=RbacPolicy.d.ts.map

package/lib/cjs/policies/RbacPolicy.js

@@ -1,59 +1,59 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkRoutePermission = exports.checkUserPermission = exports.checkRbacPermission = exports.RbacPolicy = void 0;
-const http_1 = require("@spinajs/http");
-const exceptions_1 = require("@spinajs/exceptions");
-const decorators_js_1 = require("../decorators.js");
-const di_1 = require("@spinajs/di");
-/**
- * Checks if user is logged, authorized & have proper permissions
- */
-class RbacPolicy extends http_1.BasePolicy {
-    constructor() {
-        super();
-        this.Ac = di_1.DI.get('AccessControl');
-    }
-    isEnabled(_action, _instance) {
-        // acl is always on if set
-        return true;
-    }
-    async execute(req, action, instance) {
-        const descriptor = Reflect.getMetadata(decorators_js_1.ACL_CONTROLLER_DESCRIPTOR, instance);
-        let permission = descriptor.Permission ?? '';
-        // check if route has its own permission
-        if (descriptor.Routes.has(action.Method)) {
-            permission = descriptor.Routes.get(action.Method).Permission ?? '';
-        }
-        if (!descriptor || !descriptor.Permission) {
-            throw new exceptions_1.Forbidden(`no route permission or resources assigned`);
-        }
-        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
-            throw new exceptions_1.Forbidden('user not logged or session expired');
-        }
-        if (!checkRoutePermission(req, descriptor.Resource, permission).granted) {
-            throw new exceptions_1.Forbidden(`role(s) ${req.storage.user.Role} does not have permission ${permission} for resource ${descriptor.Resource}`);
-        }
-    }
-}
-exports.RbacPolicy = RbacPolicy;
-function checkRbacPermission(role, resource, permission) {
-    const ac = di_1.DI.get('AccessControl');
-    return ac.can(role)[permission](resource);
-}
-exports.checkRbacPermission = checkRbacPermission;
-function checkUserPermission(user, resource, permission) {
-    const ac = di_1.DI.get('AccessControl');
-    if (!user) {
-        return null;
-    }
-    return ac.can(user.Role)[permission](resource);
-}
-exports.checkUserPermission = checkUserPermission;
-function checkRoutePermission(req, resource, permission) {
-    if (!req.storage || !req.storage.user) {
-        return null;
-    }
-    return checkUserPermission(req.storage.user, resource, permission);
-}
-exports.checkRoutePermission = checkRoutePermission;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRoutePermission = exports.checkUserPermission = exports.checkRbacPermission = exports.RbacPolicy = void 0;
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+const decorators_js_1 = require("../decorators.js");
+const di_1 = require("@spinajs/di");
+/**
+ * Checks if user is logged, authorized & have proper permissions
+ */
+class RbacPolicy extends http_1.BasePolicy {
+    constructor() {
+        super();
+        this.Ac = di_1.DI.get('AccessControl');
+    }
+    isEnabled(_action, _instance) {
+        // acl is always on if set
+        return true;
+    }
+    async execute(req, action, instance) {
+        const descriptor = Reflect.getMetadata(decorators_js_1.ACL_CONTROLLER_DESCRIPTOR, instance);
+        let permission = descriptor.Permission ?? '';
+        // check if route has its own permission
+        if (descriptor.Routes.has(action.Method)) {
+            permission = descriptor.Routes.get(action.Method).Permission ?? '';
+        }
+        if (!descriptor || !descriptor.Permission) {
+            throw new exceptions_1.Forbidden(`no route permission or resources assigned`);
+        }
+        if (!req.storage || !req.storage.user || !req.storage.session.Data.get('Authorized')) {
+            throw new exceptions_1.Forbidden('user not logged or session expired');
+        }
+        if (!checkRoutePermission(req, descriptor.Resource, permission).granted) {
+            throw new exceptions_1.Forbidden(`role(s) ${req.storage.user.Role} does not have permission ${permission} for resource ${descriptor.Resource}`);
+        }
+    }
+}
+exports.RbacPolicy = RbacPolicy;
+function checkRbacPermission(role, resource, permission) {
+    const ac = di_1.DI.get('AccessControl');
+    return ac.can(role)[permission](resource);
+}
+exports.checkRbacPermission = checkRbacPermission;
+function checkUserPermission(user, resource, permission) {
+    const ac = di_1.DI.get('AccessControl');
+    if (!user) {
+        return null;
+    }
+    return ac.can(user.Role)[permission](resource);
+}
+exports.checkUserPermission = checkUserPermission;
+function checkRoutePermission(req, resource, permission) {
+    if (!req.storage || !req.storage.user) {
+        return null;
+    }
+    return checkUserPermission(req.storage.user, resource, permission);
+}
+exports.checkRoutePermission = checkRoutePermission;
 //# sourceMappingURL=RbacPolicy.js.map