@spinajs/rbac-http 2.0.480 → 2.0.482

package/lib/cjs/controllers/GrantsController.d.ts

@@ -1,5 +1,5 @@
 import { BaseController, Ok } from '@spinajs/http';
-import { AccessControl } from '@spinajs/rbac';
+import { AccessControl, User as RbacUser } from '@spinajs/rbac';
 import { IGrantsMap } from '../interfaces.js';
 /**
  * RBAC grants management.
@@ -10,11 +10,13 @@ export declare class GrantsController extends BaseController {
     protected AC: AccessControl;
     /**
      * Get RBAC grants
-     * Returns the full RBAC grants object defining roles and their permissions across resources.
+     * Returns the RBAC grants for the requesting user's own role(s) only — not
+     * the full cross-role matrix, which would leak the entire access-control
+     * policy to any authenticated user.
      * @security cookieAuth
-     * @returns {IGrantsMap} RBAC grants map keyed by role name
+     * @returns {IGrantsMap} RBAC grants map keyed by the caller's role name(s)
      * @response 401 Unauthorized — valid session cookie required
      */
-    getGrants(): Ok<IGrantsMap>;
+    getGrants(user: RbacUser): Ok<IGrantsMap>;
 }
 //# sourceMappingURL=GrantsController.d.ts.map

package/lib/cjs/controllers/GrantsController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GrantsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAU,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IAGhD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;OAMG;IAEI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC;CAIrC"}
+{"version":3,"file":"GrantsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAU,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IAGhD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEI,SAAS,CAAS,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC;CAc3D"}

package/lib/cjs/controllers/GrantsController.js

@@ -8,12 +8,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GrantsController = void 0;
 const http_1 = require("@spinajs/http");
 const rbac_1 = require("@spinajs/rbac");
 const di_1 = require("@spinajs/di");
 const AuthorizedPolicy_js_1 = require("../policies/AuthorizedPolicy.js");
+const decorators_js_1 = require("../decorators.js");
 /**
  * RBAC grants management.
  * Provides access to the current RBAC access-control grants configuration.
@@ -22,13 +26,23 @@ const AuthorizedPolicy_js_1 = require("../policies/AuthorizedPolicy.js");
 let GrantsController = class GrantsController extends http_1.BaseController {
     /**
      * Get RBAC grants
-     * Returns the full RBAC grants object defining roles and their permissions across resources.
+     * Returns the RBAC grants for the requesting user's own role(s) only — not
+     * the full cross-role matrix, which would leak the entire access-control
+     * policy to any authenticated user.
      * @security cookieAuth
-     * @returns {IGrantsMap} RBAC grants map keyed by role name
+     * @returns {IGrantsMap} RBAC grants map keyed by the caller's role name(s)
      * @response 401 Unauthorized — valid session cookie required
      */
-    getGrants() {
-        return new http_1.Ok(this.AC.getGrants());
+    getGrants(user) {
+        const allGrants = this.AC.getGrants();
+        const roles = user?.Role ?? [];
+        const filtered = {};
+        for (const role of roles) {
+            if (allGrants[role]) {
+                filtered[role] = allGrants[role];
+            }
+        }
+        return new http_1.Ok(filtered);
     }
 };
 exports.GrantsController = GrantsController;
@@ -38,8 +52,9 @@ __decorate([
 ], GrantsController.prototype, "AC", void 0);
 __decorate([
     (0, http_1.Get)(),
+    __param(0, (0, decorators_js_1.User)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
+    __metadata("design:paramtypes", [rbac_1.User]),
     __metadata("design:returntype", http_1.Ok)
 ], GrantsController.prototype, "getGrants", null);
 exports.GrantsController = GrantsController = __decorate([

package/lib/cjs/controllers/GrantsController.js.map

@@ -1 +1 @@
-{"version":3,"file":"GrantsController.js","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAA0E;AAC1E,wCAA8C;AAC9C,oCAAyC;AACzC,yEAAmE;AAGnE;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,qBAAc;IAKhD;;;;;;OAMG;IAEI,SAAS;QACZ,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;CAEJ,CAAA;AAjBY,4CAAgB;AAGf;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;4CAAC;AAUrB;IADN,IAAA,UAAG,GAAE;;;oCACc,SAAE;iDAErB;2BAfQ,gBAAgB;IAF5B,IAAA,eAAQ,EAAC,QAAQ,CAAC;IAClB,IAAA,aAAM,EAAC,sCAAgB,CAAC;GACZ,gBAAgB,CAiB5B"}
+{"version":3,"file":"GrantsController.js","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAA0E;AAC1E,wCAAgE;AAChE,oCAAyC;AACzC,yEAAmE;AACnE,oDAAwC;AAGxC;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,qBAAc;IAKhD;;;;;;;;OAQG;IAEI,SAAS,CAAS,IAAc;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAgB,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,SAAE,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CAEJ,CAAA;AA7BY,4CAAgB;AAGf;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;4CAAC;AAYrB;IADN,IAAA,UAAG,GAAE;IACY,WAAA,IAAA,oBAAI,GAAE,CAAA;;qCAAO,WAAQ;oCAAG,SAAE;iDAY3C;2BA3BQ,gBAAgB;IAF5B,IAAA,eAAQ,EAAC,QAAQ,CAAC;IAClB,IAAA,aAAM,EAAC,sCAAgB,CAAC;GACZ,gBAAgB,CA6B5B"}

package/lib/cjs/decorators.d.ts

@@ -10,7 +10,10 @@ export declare function setRbacMetadata(target: any, callback: (meta: IRbacDescr
  * Assign resource for controller
  *
  * @param resource - name of resource
- * @param permission - default permission
+ * @param permission - default permission. When omitted, the base controller's
+ *                     permission is kept ( `readOwn` if there is nothing to
+ *                     inherit ), so renaming a resource in a subclass does not
+ *                     silently change what it grants.
  */
 export declare function Resource(resource: string, permission?: PermissionType[]): any;
 /**

package/lib/cjs/decorators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAExF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAerF;AAqBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAE,cAAc,EAAgB,OAKpF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAapE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAuFxF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAMrF;AAYD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,OAevE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAgBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}

package/lib/cjs/decorators.js

@@ -10,36 +10,94 @@ exports.FromSession = FromSession;
 exports.Session = Session;
 const http_1 = require("@spinajs/http");
 const RbacPolicy_js_1 = require("./policies/RbacPolicy.js");
+const di_1 = require("@spinajs/di");
 /**
  * Global symbol so external packages (e.g. http-swagger) can read the RBAC
  * descriptor via Reflect metadata without importing rbac-http.
  */
 exports.ACL_CONTROLLER_DESCRIPTOR = Symbol.for('ACL_CONTROLLER_DESCRIPTOR_SYMBOL');
-function setRbacMetadata(target, callback) {
-    let metadata = Reflect.getMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
-    if (!metadata) {
-        metadata = {
-            Resource: '',
-            Routes: new Map(),
-            Permission: ['readOwn'],
-        };
-        Reflect.defineMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, metadata, target.prototype || target);
+/**
+ * Permission a controller gets when neither it nor any ancestor declares one
+ * ( eg. a controller using route level `@Permission` only ).
+ */
+const DEFAULT_CONTROLLER_PERMISSION = ['readOwn'];
+/**
+ * NOTE: `Permission` starts EMPTY here, unlike the documented default, and
+ * `rbacDescriptor()` fills the default in afterwards. The collapse in
+ * `getInheritedDescriptor` seeds itself with this object and CONCATENATES
+ * arrays, so seeding `['readOwn']` would make every subclass inherit
+ * `['readOwn', ...parent permission]` - granting more than the parent, which is
+ * the one direction a permission list must never drift in.
+ */
+function createDefaultRbacDescriptor() {
+    return {
+        Resource: '',
+        Routes: new Map(),
+        Permission: [],
+    };
+}
+/**
+ * The descriptor OWNED by the decorated class, pre-populated with everything it
+ * inherits.
+ *
+ * `Reflect.getMetadata` walks the prototype chain, so a controller subclass used
+ * to find - and mutate - its parent's descriptor: an application declaring
+ * `@Resource` on a subclass rewrote the ACL resource and permissions of the
+ * package controller it extends. `getInheritedDescriptor` stores own metadata
+ * per class instead, keyed by identity.
+ *
+ * Stored on the prototype ( `target.prototype || target` covers both the class
+ * and the member decorator forms ) because that is where RbacPolicy and
+ * http-swagger reach it from, off a controller INSTANCE.
+ */
+function rbacDescriptor(target) {
+    const controller = target.prototype || target;
+    // True only for the very first decorator that touches THIS class, since
+    // getInheritedDescriptor stores own metadata as soon as it is called.
+    const isFirstDecorator = !Reflect.getOwnMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, controller);
+    // Decided BEFORE the collapse, and on the existence of an ancestor descriptor
+    // rather than on the collapsed value: an empty permission list is a
+    // declaration ( eg. `@Resource('r', [])` grants nothing ), so a subclass that
+    // inherits one must keep it. Standing the default in whenever the list came
+    // out empty would hand that subclass readOwn - MORE than its base grants.
+    const inherits = hasInheritedDescriptor(controller);
+    const metadata = (0, di_1.getInheritedDescriptor)(controller, exports.ACL_CONTROLLER_DESCRIPTOR, createDefaultRbacDescriptor);
+    // Nothing to inherit - see createDefaultRbacDescriptor for why the default
+    // cannot simply be part of the seed. Only on creation, so that a later
+    // decorator cannot refill a list this class deliberately emptied.
+    if (isFirstDecorator && !inherits) {
+        metadata.Permission = [...DEFAULT_CONTROLLER_PERMISSION];
     }
+    return metadata;
+}
+/**
+ * True when something ABOVE `controller` in the prototype chain owns an ACL
+ * descriptor - ie. when the collapse has a real ancestor to take values from.
+ *
+ * Mirrors the walk inside `getInheritedDescriptor`, starting one level up
+ * because `controller`'s own descriptor is what the caller is about to create.
+ * Keyed by identity, never by class name, and undecorated classes in between
+ * are simply passed over since they own no metadata.
+ */
+function hasInheritedDescriptor(controller) {
+    let current = Object.getPrototypeOf(controller);
+    while (current && current !== Object.prototype && current !== Function.prototype) {
+        if (Reflect.getOwnMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, current)) {
+            return true;
+        }
+        current = Object.getPrototypeOf(current);
+    }
+    return false;
+}
+function setRbacMetadata(target, callback) {
+    const metadata = rbacDescriptor(target);
     if (callback) {
         callback(metadata);
     }
 }
 function descriptor(callback) {
     return (target, propertyKey, indexOrDescriptor) => {
-        let metadata = Reflect.getMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
-        if (!metadata) {
-            metadata = {
-                Resource: '',
-                Routes: new Map(),
-                Permission: ['readOwn'],
-            };
-            Reflect.defineMetadata(exports.ACL_CONTROLLER_DESCRIPTOR, metadata, target.prototype || target);
-        }
+        const metadata = rbacDescriptor(target);
         if (callback) {
             callback(metadata, target, propertyKey, indexOrDescriptor);
         }
@@ -49,12 +107,24 @@ function descriptor(callback) {
  * Assign resource for controller
  *
  * @param resource - name of resource
- * @param permission - default permission
+ * @param permission - default permission. When omitted, the base controller's
+ *                     permission is kept ( `readOwn` if there is nothing to
+ *                     inherit ), so renaming a resource in a subclass does not
+ *                     silently change what it grants.
  */
-function Resource(resource, permission = ['readOwn']) {
+function Resource(resource, permission) {
     return descriptor((metadata) => {
         metadata.Resource = resource;
-        metadata.Permission = permission;
+        // ASSIGNED, never merged, and only when the argument was actually passed.
+        // Assigning is what lets an application NARROW a package controller -
+        // concatenating would grant the union of both lists, and a longer
+        // permission list grants more. Omitting the argument says nothing about
+        // permissions, so whatever was collapsed from the base controller stands.
+        // Copied because the array belongs to the call site, which is free to keep
+        // mutating it.
+        if (permission) {
+            metadata.Permission = [...permission];
+        }
     });
 }
 /**
@@ -66,12 +136,15 @@ function Resource(resource, permission = ['readOwn']) {
 function Permission(permission = ['readOwn']) {
     return descriptor((metadata, target, propertyKey) => {
         if (propertyKey) {
-            if (!metadata.Routes.has(propertyKey)) {
-                const route = {
-                    Permission: permission,
-                };
-                metadata.Routes.set(propertyKey, route);
-            }
+            // Always set, never guarded by `has()`: routes are inherited per member
+            // name now, so a guard would make a subclass's @Permission on an inherited
+            // route silently do nothing and leave the package controller's permission
+            // in force. Setting a FRESH entry is also what keeps the inherited entries
+            // - which the collapse shares by reference with the parent - from being
+            // rewritten here.
+            metadata.Routes.set(propertyKey, {
+                Permission: permission,
+            });
         }
         (0, http_1.Policy)(RbacPolicy_js_1.RbacPolicy)(target, propertyKey, undefined);
     });

package/lib/cjs/decorators.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":";;;AAYA,0CAeC;AA2BD,4BAKC;AAQD,gCAaC;AAUD,kDAaC;AAKD,oBAEC;AAKD,kCAEC;AAED,0BAEC;AAxHD,wCAA0I;AAC1I,4DAAsD;AAItD;;;GAGG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF,SAAgB,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG;YACT,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;YACzD,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,iCAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG;gBACT,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;gBACzD,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,aAA+B,CAAC,SAAS,CAAC;IACnF,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG;oBACZ,UAAU,EAAE,UAAU;iBACvB,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,IAAA,aAAM,EAAC,0BAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB;IACjC,OAAO,IAAA,iBAAU,EACf,KAAM,SAAQ,sBAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,IAAI;IAClB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,OAAO;IACrB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":";;;AAkGA,0CAMC;AAqBD,4BAeC;AAQD,gCAgBC;AAUD,kDAaC;AAKD,oBAEC;AAKD,kCAEC;AAED,0BAEC;AA5MD,wCAA0I;AAC1I,4DAAsD;AAEtD,oCAAqD;AAGrD;;;GAGG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,6BAA6B,GAAqB,CAAC,SAAS,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,SAAS,2BAA2B;IAClC,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;QACzD,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,MAAW;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,UAAU,CAAC,CAAC;IAExF,8EAA8E;IAC9E,oEAAoE;IACpE,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAA,2BAAsB,EAAkB,UAAU,EAAE,iCAAyB,EAAE,2BAA2B,CAAC,CAAC;IAE7H,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAkB;IAChD,IAAI,OAAO,GAAkB,MAAM,CAAC,cAAc,CAAC,UAAU,CAAkB,CAAC;IAEhF,OAAO,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACjF,IAAI,OAAO,CAAC,cAAc,CAAC,iCAAyB,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAkB,CAAC;IAC5D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,UAA6B;IACtE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAE7B,0EAA0E;QAC1E,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,eAAe;QACf,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,kBAAkB;YAClB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;gBAC/B,UAAU,EAAE,UAAU;aACvB,CAAC,CAAC;QACL,CAAC;QAED,IAAA,aAAM,EAAC,0BAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB;IACjC,OAAO,IAAA,iBAAU,EACf,KAAM,SAAQ,sBAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,IAAI;IAClB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,OAAO;IACrB,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/lib/cjs/middlewares.d.ts

@@ -4,6 +4,7 @@ import * as express from 'express';
 import { Request as sRequest, ServerMiddleware } from '@spinajs/http';
 export declare class RbacMiddleware extends ServerMiddleware {
     protected CoockieSecret: string;
+    protected SessionCookieConfig: any;
     protected SessionProvider: SessionProvider;
     resolve(): Promise<void>;
     before(): (req: sRequest, res: express.Response, next: express.NextFunction) => void;

package/lib/cjs/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IA0CpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAA6B,MAAM,eAAe,CAAC;AAErF,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IAyDpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}

package/lib/cjs/middlewares.js

@@ -56,7 +56,7 @@ let RbacMiddleware = class RbacMiddleware extends http_1.ServerMiddleware {
         }
     }
     before() {
-        return async (req, _res, next) => {
+        return async (req, res, next) => {
             try {
                 let session = null;
                 if (req.cookies?.ssid) {
@@ -83,6 +83,20 @@ let RbacMiddleware = class RbacMiddleware extends http_1.ServerMiddleware {
                     req.storage.ActiveRole = sessionActiveRole && req.storage.User.Role.includes(sessionActiveRole)
                         ? sessionActiveRole
                         : req.storage.User.Role?.[0];
+                    // Sliding renewal: touch the session on every authenticated request.
+                    // The store recomputes Expiration via the configured strategy and
+                    // returns true only when it actually changed (sliding modes); under
+                    // absolute expiration it returns false and performs no write, so we
+                    // leave the cookie untouched.
+                    const renewed = await this.SessionProvider.touch(session);
+                    if (renewed) {
+                        res.cookie('ssid', session.SessionId, {
+                            signed: true,
+                            httpOnly: true,
+                            maxAge: (0, rbac_1.sessionCookieMaxAge)(session),
+                            ...this.SessionCookieConfig,
+                        });
+                    }
                 }
                 else {
                     req.storage.User = di_1.DI.resolve('RbacGuestUserFactory');
@@ -104,6 +118,10 @@ __decorate([
     (0, configuration_1.Config)('http.cookie.secret'),
     __metadata("design:type", String)
 ], RbacMiddleware.prototype, "CoockieSecret", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.session.cookie', {}),
+    __metadata("design:type", Object)
+], RbacMiddleware.prototype, "SessionCookieConfig", void 0);
 __decorate([
     (0, di_1.Autoinject)(),
     __metadata("design:type", rbac_1.SessionProvider)

package/lib/cjs/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAgE;AAChE,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1DY,wCAAc;AAEf;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;yBALhC,cAAc;IAD1B,IAAA,eAAU,EAAC,uBAAgB,CAAC;GAChB,cAAc,CA0D1B"}
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAqF;AACrF,oCAAyD;AACzD,4BAA0B;AAE1B,0DAAgD;AAChD,qDAAuC;AACvC,wCAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,uBAAgB;IAU3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,OAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAE/B,qEAAqE;oBACrE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,8BAA8B;oBAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC1D,IAAI,OAAO,EAAE,CAAC;wBACZ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;4BACpC,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,IAAA,0BAAmB,EAAC,OAAO,CAAC;4BACpC,GAAG,IAAI,CAAC,mBAAmB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,OAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA5EY,wCAAc;AAEf;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,IAAA,sBAAM,EAAC,qBAAqB,EAAE,EAAE,CAAC;;2DACC;AAGzB;IADT,IAAA,eAAU,GAAE;8BACc,sBAAe;uDAAC;yBARhC,cAAc;IAD1B,IAAA,eAAU,EAAC,uBAAgB,CAAC;GAChB,cAAc,CA4E1B"}

package/lib/cjs/policies/AllowGuest.d.ts

@@ -1,6 +1,9 @@
 import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
 /**
- * Policy to block guests
+ * Policy that ALLOWS guest users through. Access is only refused when the
+ * request has no user/session at all, or when the guest account itself has
+ * been globally disabled (IsActive === false). Use BlockGuest for the opposite
+ * behavior (reject guests, require a real logged-in user).
  */
 export declare class AllowGuest extends BasePolicy {
     isEnabled(_action: IRoute, _instance: IController): boolean;

package/lib/cjs/policies/AllowGuest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AllowGuest.d.ts","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ;CAenC"}
+{"version":3,"file":"AllowGuest.d.ts","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ;CAenC"}

package/lib/cjs/policies/AllowGuest.js

@@ -4,7 +4,10 @@ exports.AllowGuest = void 0;
 const http_1 = require("@spinajs/http");
 const exceptions_1 = require("@spinajs/exceptions");
 /**
- * Policy to block guests
+ * Policy that ALLOWS guest users through. Access is only refused when the
+ * request has no user/session at all, or when the guest account itself has
+ * been globally disabled (IsActive === false). Use BlockGuest for the opposite
+ * behavior (reject guests, require a real logged-in user).
  */
 class AllowGuest extends http_1.BasePolicy {
     isEnabled(_action, _instance) {

package/lib/cjs/policies/AllowGuest.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllowGuest.js","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":";;;AAAA,wCAAqF;AACrF,oDAAsE;AAEtE;;GAEG;AACH,MAAa,UAAW,SAAQ,iBAAU;IACjC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,sBAAS,CAAC,2BAA2B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AArBD,gCAqBC"}
+{"version":3,"file":"AllowGuest.js","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":";;;AAAA,wCAAqF;AACrF,oDAAsE;AAEtE;;;;;GAKG;AACH,MAAa,UAAW,SAAQ,iBAAU;IACjC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,sBAAS,CAAC,2BAA2B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AArBD,gCAqBC"}

package/lib/cjs/policies/RbacPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA0B1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
+{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA4C1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}

package/lib/cjs/policies/RbacPolicy.js

@@ -22,12 +22,28 @@ class RbacPolicy extends http_1.BasePolicy {
     }
     async execute(req, action, instance) {
         const descriptor = Reflect.getMetadata(decorators_js_1.ACL_CONTROLLER_DESCRIPTOR, instance);
+        // Guard BEFORE dereferencing: RbacPolicy applied to a route/controller with
+        // no ACL metadata (e.g. @Policy(RbacPolicy) without @Resource/@Permission)
+        // must produce the descriptive server error, not a raw TypeError 500 from
+        // reading `.Permission` / `.Routes` off undefined.
+        if (!descriptor) {
+            throw new http_1.ServerError(`no route permission or resources assigned`);
+        }
         let permission = descriptor.Permission ?? [];
         if (descriptor.Routes.has(String(action.Method))) {
-            //req.storage.PermissionScope = descriptor.Routes.get(action.Method).Permission;
-            if (req.headers['x-permission-scope']) {
-                req.storage.PermissionScope = req.headers['x-permission-scope'] ?? null;
-            }
+            // SECURITY: PermissionScope must NEVER be taken from a client-supplied
+            // header. The ORM rbac query middleware uses PermissionScope to decide
+            // which own/any grant to enforce and, on a scope it does not recognise or
+            // that does not match the query type, it SKIPS row-level enforcement
+            // entirely. Letting the client set it therefore allowed any authenticated
+            // user holding only *Own grants to send `x-permission-scope: <anything>`
+            // and read/update/delete every row (owner-field WHERE restriction never
+            // applied). With no scope set, the middleware falls back to the correct
+            // query-derived scope (QUERY_TO_PERMISSION), which is the secure default.
+            //
+            // If a route ever needs an explicit scope it must be derived server-side
+            // from the route's declared permission, not from the request, e.g.:
+            //   req.storage.PermissionScope = descriptor.Routes.get(String(action.Method))!.Permission?.[0];
             permission = descriptor.Routes.get(String(action.Method)).Permission ?? [];
         }
         // check if route has its own permission

package/lib/cjs/policies/RbacPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;AAqDA,kDAGC;AAED,kDAQC;AAED,oDAQC;AA3ED,wCAAkG;AAClG,oDAAsE;AACtE,oDAA6D;AAE7D,oCAAiC;AAGjC;;GAEG;AACH,MAAa,UAAW,SAAQ,iBAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAmB,IAAI,IAAI,CAAC;YAC5F,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,sBAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAxCD,gCAwCC;AAED,SAAgB,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":";;;AAuEA,kDAGC;AAED,kDAQC;AAED,oDAQC;AA7FD,wCAAkG;AAClG,oDAAsE;AACtE,oDAA6D;AAE7D,oCAAiC;AAGjC;;GAEG;AACH,MAAa,UAAW,SAAQ,iBAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,EAAE;YACF,yEAAyE;YACzE,oEAAoE;YACpE,iGAAiG;YACjG,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,iCAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,sBAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AA1DD,gCA0DC;AAED,SAAgB,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}

package/lib/mjs/controllers/GrantsController.d.ts

@@ -1,5 +1,5 @@
 import { BaseController, Ok } from '@spinajs/http';
-import { AccessControl } from '@spinajs/rbac';
+import { AccessControl, User as RbacUser } from '@spinajs/rbac';
 import { IGrantsMap } from '../interfaces.js';
 /**
  * RBAC grants management.
@@ -10,11 +10,13 @@ export declare class GrantsController extends BaseController {
     protected AC: AccessControl;
     /**
      * Get RBAC grants
-     * Returns the full RBAC grants object defining roles and their permissions across resources.
+     * Returns the RBAC grants for the requesting user's own role(s) only — not
+     * the full cross-role matrix, which would leak the entire access-control
+     * policy to any authenticated user.
      * @security cookieAuth
-     * @returns {IGrantsMap} RBAC grants map keyed by role name
+     * @returns {IGrantsMap} RBAC grants map keyed by the caller's role name(s)
      * @response 401 Unauthorized — valid session cookie required
      */
-    getGrants(): Ok<IGrantsMap>;
+    getGrants(user: RbacUser): Ok<IGrantsMap>;
 }
 //# sourceMappingURL=GrantsController.d.ts.map

package/lib/mjs/controllers/GrantsController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GrantsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAU,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IAGhD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;OAMG;IAEI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC;CAIrC"}
+{"version":3,"file":"GrantsController.d.ts","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,EAAE,EAAU,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IAGhD,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;OAQG;IAEI,SAAS,CAAS,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC;CAc3D"}

package/lib/mjs/controllers/GrantsController.js

@@ -7,10 +7,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { BaseController, BasePath, Get, Ok, Policy } from '@spinajs/http';
-import { AccessControl } from '@spinajs/rbac';
+import { AccessControl, User as RbacUser } from '@spinajs/rbac';
 import { Autoinject } from '@spinajs/di';
 import { AuthorizedPolicy } from '../policies/AuthorizedPolicy.js';
+import { User } from '../decorators.js';
 /**
  * RBAC grants management.
  * Provides access to the current RBAC access-control grants configuration.
@@ -19,13 +23,23 @@ import { AuthorizedPolicy } from '../policies/AuthorizedPolicy.js';
 let GrantsController = class GrantsController extends BaseController {
     /**
      * Get RBAC grants
-     * Returns the full RBAC grants object defining roles and their permissions across resources.
+     * Returns the RBAC grants for the requesting user's own role(s) only — not
+     * the full cross-role matrix, which would leak the entire access-control
+     * policy to any authenticated user.
      * @security cookieAuth
-     * @returns {IGrantsMap} RBAC grants map keyed by role name
+     * @returns {IGrantsMap} RBAC grants map keyed by the caller's role name(s)
      * @response 401 Unauthorized — valid session cookie required
      */
-    getGrants() {
-        return new Ok(this.AC.getGrants());
+    getGrants(user) {
+        const allGrants = this.AC.getGrants();
+        const roles = user?.Role ?? [];
+        const filtered = {};
+        for (const role of roles) {
+            if (allGrants[role]) {
+                filtered[role] = allGrants[role];
+            }
+        }
+        return new Ok(filtered);
     }
 };
 __decorate([
@@ -34,8 +48,9 @@ __decorate([
 ], GrantsController.prototype, "AC", void 0);
 __decorate([
     Get(),
+    __param(0, User()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
+    __metadata("design:paramtypes", [RbacUser]),
     __metadata("design:returntype", Ok)
 ], GrantsController.prototype, "getGrants", null);
 GrantsController = __decorate([

package/lib/mjs/controllers/GrantsController.js.map

@@ -1 +1 @@
-{"version":3,"file":"GrantsController.js","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,cAAc;IAKhD;;;;;;OAMG;IAEI,SAAS;QACZ,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;CAEJ,CAAA;AAda;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;4CAAC;AAUrB;IADN,GAAG,EAAE;;;oCACc,EAAE;iDAErB;AAfQ,gBAAgB;IAF5B,QAAQ,CAAC,QAAQ,CAAC;IAClB,MAAM,CAAC,gBAAgB,CAAC;GACZ,gBAAgB,CAiB5B"}
+{"version":3,"file":"GrantsController.js","sourceRoot":"","sources":["../../../src/controllers/GrantsController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,cAAc;IAKhD;;;;;;;;OAQG;IAEI,SAAS,CAAS,IAAc;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAgB,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CAEJ,CAAA;AA1Ba;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;4CAAC;AAYrB;IADN,GAAG,EAAE;IACY,WAAA,IAAI,EAAE,CAAA;;qCAAO,QAAQ;oCAAG,EAAE;iDAY3C;AA3BQ,gBAAgB;IAF5B,QAAQ,CAAC,QAAQ,CAAC;IAClB,MAAM,CAAC,gBAAgB,CAAC;GACZ,gBAAgB,CA6B5B"}

package/lib/mjs/decorators.d.ts

@@ -10,7 +10,10 @@ export declare function setRbacMetadata(target: any, callback: (meta: IRbacDescr
  * Assign resource for controller
  *
  * @param resource - name of resource
- * @param permission - default permission
+ * @param permission - default permission. When omitted, the base controller's
+ *                     permission is kept ( `readOwn` if there is nothing to
+ *                     inherit ), so renaming a resource in a subclass does not
+ *                     silently change what it grants.
  */
 export declare function Resource(resource: string, permission?: PermissionType[]): any;
 /**

package/lib/mjs/decorators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAExF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAerF;AAqBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAE,cAAc,EAAgB,OAKpF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAapE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,eAAiD,CAAC;AAuFxF,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,QAMrF;AAYD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,OAevE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,cAAc,EAAgB,OAgBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,0GAalC;AAED;;GAEG;AACH,wBAAgB,IAAI,0GAEnB;AAED;;GAEG;AACH,wBAAgB,WAAW,0GAE1B;AAED,wBAAgB,OAAO,0GAEtB"}