@spinajs/rbac-http 2.0.481 → 2.0.482

package/lib/mjs/decorators.js

@@ -1,35 +1,93 @@
 import { Middleware, Parameter, Policy, Route, RouteMiddleware } from '@spinajs/http';
 import { RbacPolicy } from './policies/RbacPolicy.js';
+import { getInheritedDescriptor } from '@spinajs/di';
 /**
  * Global symbol so external packages (e.g. http-swagger) can read the RBAC
  * descriptor via Reflect metadata without importing rbac-http.
  */
 export const ACL_CONTROLLER_DESCRIPTOR = Symbol.for('ACL_CONTROLLER_DESCRIPTOR_SYMBOL');
-export function setRbacMetadata(target, callback) {
-    let metadata = Reflect.getMetadata(ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
-    if (!metadata) {
-        metadata = {
-            Resource: '',
-            Routes: new Map(),
-            Permission: ['readOwn'],
-        };
-        Reflect.defineMetadata(ACL_CONTROLLER_DESCRIPTOR, metadata, target.prototype || target);
+/**
+ * Permission a controller gets when neither it nor any ancestor declares one
+ * ( eg. a controller using route level `@Permission` only ).
+ */
+const DEFAULT_CONTROLLER_PERMISSION = ['readOwn'];
+/**
+ * NOTE: `Permission` starts EMPTY here, unlike the documented default, and
+ * `rbacDescriptor()` fills the default in afterwards. The collapse in
+ * `getInheritedDescriptor` seeds itself with this object and CONCATENATES
+ * arrays, so seeding `['readOwn']` would make every subclass inherit
+ * `['readOwn', ...parent permission]` - granting more than the parent, which is
+ * the one direction a permission list must never drift in.
+ */
+function createDefaultRbacDescriptor() {
+    return {
+        Resource: '',
+        Routes: new Map(),
+        Permission: [],
+    };
+}
+/**
+ * The descriptor OWNED by the decorated class, pre-populated with everything it
+ * inherits.
+ *
+ * `Reflect.getMetadata` walks the prototype chain, so a controller subclass used
+ * to find - and mutate - its parent's descriptor: an application declaring
+ * `@Resource` on a subclass rewrote the ACL resource and permissions of the
+ * package controller it extends. `getInheritedDescriptor` stores own metadata
+ * per class instead, keyed by identity.
+ *
+ * Stored on the prototype ( `target.prototype || target` covers both the class
+ * and the member decorator forms ) because that is where RbacPolicy and
+ * http-swagger reach it from, off a controller INSTANCE.
+ */
+function rbacDescriptor(target) {
+    const controller = target.prototype || target;
+    // True only for the very first decorator that touches THIS class, since
+    // getInheritedDescriptor stores own metadata as soon as it is called.
+    const isFirstDecorator = !Reflect.getOwnMetadata(ACL_CONTROLLER_DESCRIPTOR, controller);
+    // Decided BEFORE the collapse, and on the existence of an ancestor descriptor
+    // rather than on the collapsed value: an empty permission list is a
+    // declaration ( eg. `@Resource('r', [])` grants nothing ), so a subclass that
+    // inherits one must keep it. Standing the default in whenever the list came
+    // out empty would hand that subclass readOwn - MORE than its base grants.
+    const inherits = hasInheritedDescriptor(controller);
+    const metadata = getInheritedDescriptor(controller, ACL_CONTROLLER_DESCRIPTOR, createDefaultRbacDescriptor);
+    // Nothing to inherit - see createDefaultRbacDescriptor for why the default
+    // cannot simply be part of the seed. Only on creation, so that a later
+    // decorator cannot refill a list this class deliberately emptied.
+    if (isFirstDecorator && !inherits) {
+        metadata.Permission = [...DEFAULT_CONTROLLER_PERMISSION];
     }
+    return metadata;
+}
+/**
+ * True when something ABOVE `controller` in the prototype chain owns an ACL
+ * descriptor - ie. when the collapse has a real ancestor to take values from.
+ *
+ * Mirrors the walk inside `getInheritedDescriptor`, starting one level up
+ * because `controller`'s own descriptor is what the caller is about to create.
+ * Keyed by identity, never by class name, and undecorated classes in between
+ * are simply passed over since they own no metadata.
+ */
+function hasInheritedDescriptor(controller) {
+    let current = Object.getPrototypeOf(controller);
+    while (current && current !== Object.prototype && current !== Function.prototype) {
+        if (Reflect.getOwnMetadata(ACL_CONTROLLER_DESCRIPTOR, current)) {
+            return true;
+        }
+        current = Object.getPrototypeOf(current);
+    }
+    return false;
+}
+export function setRbacMetadata(target, callback) {
+    const metadata = rbacDescriptor(target);
     if (callback) {
         callback(metadata);
     }
 }
 function descriptor(callback) {
     return (target, propertyKey, indexOrDescriptor) => {
-        let metadata = Reflect.getMetadata(ACL_CONTROLLER_DESCRIPTOR, target.prototype || target);
-        if (!metadata) {
-            metadata = {
-                Resource: '',
-                Routes: new Map(),
-                Permission: ['readOwn'],
-            };
-            Reflect.defineMetadata(ACL_CONTROLLER_DESCRIPTOR, metadata, target.prototype || target);
-        }
+        const metadata = rbacDescriptor(target);
         if (callback) {
             callback(metadata, target, propertyKey, indexOrDescriptor);
         }
@@ -39,12 +97,24 @@ function descriptor(callback) {
  * Assign resource for controller
  *
  * @param resource - name of resource
- * @param permission - default permission
+ * @param permission - default permission. When omitted, the base controller's
+ *                     permission is kept ( `readOwn` if there is nothing to
+ *                     inherit ), so renaming a resource in a subclass does not
+ *                     silently change what it grants.
  */
-export function Resource(resource, permission = ['readOwn']) {
+export function Resource(resource, permission) {
     return descriptor((metadata) => {
         metadata.Resource = resource;
-        metadata.Permission = permission;
+        // ASSIGNED, never merged, and only when the argument was actually passed.
+        // Assigning is what lets an application NARROW a package controller -
+        // concatenating would grant the union of both lists, and a longer
+        // permission list grants more. Omitting the argument says nothing about
+        // permissions, so whatever was collapsed from the base controller stands.
+        // Copied because the array belongs to the call site, which is free to keep
+        // mutating it.
+        if (permission) {
+            metadata.Permission = [...permission];
+        }
     });
 }
 /**
@@ -56,12 +126,15 @@ export function Resource(resource, permission = ['readOwn']) {
 export function Permission(permission = ['readOwn']) {
     return descriptor((metadata, target, propertyKey) => {
         if (propertyKey) {
-            if (!metadata.Routes.has(propertyKey)) {
-                const route = {
-                    Permission: permission,
-                };
-                metadata.Routes.set(propertyKey, route);
-            }
+            // Always set, never guarded by `has()`: routes are inherited per member
+            // name now, so a guard would make a subclass's @Permission on an inherited
+            // route silently do nothing and leave the package controller's permission
+            // in force. Setting a FRESH entry is also what keeps the inherited entries
+            // - which the collapse shares by reference with the parent - from being
+            // rewritten here.
+            metadata.Routes.set(propertyKey, {
+                Permission: permission,
+            });
         }
         Policy(RbacPolicy)(target, propertyKey, undefined);
     });

package/lib/mjs/decorators.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAiC,MAAM,eAAe,CAAC;AAC1I,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAItD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG;YACT,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;YACzD,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,IAAI,QAAQ,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG;gBACT,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;gBACzD,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,aAA+B,CAAC,SAAS,CAAC;IACnF,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG;oBACZ,UAAU,EAAE,UAAU;iBACvB,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CACf,KAAM,SAAQ,eAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/decorators.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAiC,MAAM,eAAe,CAAC;AAC1I,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,6BAA6B,GAAqB,CAAC,SAAS,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,SAAS,2BAA2B;IAClC,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,IAAI,GAAG,EAA0C;QACzD,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,MAAW;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;IAExF,8EAA8E;IAC9E,oEAAoE;IACpE,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,sBAAsB,CAAkB,UAAU,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAE7H,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAkB;IAChD,IAAI,OAAO,GAAkB,MAAM,CAAC,cAAc,CAAC,UAAU,CAAkB,CAAC;IAEhF,OAAO,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACjF,IAAI,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAkB,CAAC;IAC5D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,QAAyC;IACpF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAA0I;IAC5J,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,iBAA8C,EAAE,EAAE;QACnG,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,UAA6B;IACtE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAE7B,0EAA0E;QAC1E,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,eAAe;QACf,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,aAA+B,CAAC,SAAS,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,QAAyB,EAAE,MAAW,EAAE,WAAmB,EAAE,EAAE;QAChF,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,kBAAkB;YAClB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;gBAC/B,UAAU,EAAE,UAAU;aACvB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CACf,KAAM,SAAQ,eAAe;QACpB,SAAS,CAAC,MAAc,EAAE,WAAwB;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACM,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB;YACzG,GAAgB,CAAC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACM,KAAK,CAAC,UAAU,CAAC,SAAmB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,IAAsB,EAAE,MAAc,EAAE,WAAwB,IAAkB,CAAC;KAChI,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/lib/mjs/middlewares.d.ts

@@ -4,6 +4,7 @@ import * as express from 'express';
 import { Request as sRequest, ServerMiddleware } from '@spinajs/http';
 export declare class RbacMiddleware extends ServerMiddleware {
     protected CoockieSecret: string;
+    protected SessionCookieConfig: any;
     protected SessionProvider: SessionProvider;
     resolve(): Promise<void>;
     before(): (req: sRequest, res: express.Response, next: express.NextFunction) => void;

package/lib/mjs/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAEhE,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IA0CpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,eAAe,EAA6B,MAAM,eAAe,CAAC;AAErF,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,qBACa,cAAe,SAAQ,gBAAgB;IAElD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAGhC,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC;IAGnC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE9B,OAAO;IAMb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IAyDpF,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI;CAGpG"}

package/lib/mjs/middlewares.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { SessionProvider } from '@spinajs/rbac';
+import { SessionProvider, sessionCookieMaxAge } from '@spinajs/rbac';
 import { Autoinject, DI, Injectable } from '@spinajs/di';
 import 'reflect-metadata';
 import { Config } from '@spinajs/configuration';
@@ -20,7 +20,7 @@ let RbacMiddleware = class RbacMiddleware extends ServerMiddleware {
         }
     }
     before() {
-        return async (req, _res, next) => {
+        return async (req, res, next) => {
             try {
                 let session = null;
                 if (req.cookies?.ssid) {
@@ -47,6 +47,20 @@ let RbacMiddleware = class RbacMiddleware extends ServerMiddleware {
                     req.storage.ActiveRole = sessionActiveRole && req.storage.User.Role.includes(sessionActiveRole)
                         ? sessionActiveRole
                         : req.storage.User.Role?.[0];
+                    // Sliding renewal: touch the session on every authenticated request.
+                    // The store recomputes Expiration via the configured strategy and
+                    // returns true only when it actually changed (sliding modes); under
+                    // absolute expiration it returns false and performs no write, so we
+                    // leave the cookie untouched.
+                    const renewed = await this.SessionProvider.touch(session);
+                    if (renewed) {
+                        res.cookie('ssid', session.SessionId, {
+                            signed: true,
+                            httpOnly: true,
+                            maxAge: sessionCookieMaxAge(session),
+                            ...this.SessionCookieConfig,
+                        });
+                    }
                 }
                 else {
                     req.storage.User = DI.resolve('RbacGuestUserFactory');
@@ -67,6 +81,10 @@ __decorate([
     Config('http.cookie.secret'),
     __metadata("design:type", String)
 ], RbacMiddleware.prototype, "CoockieSecret", void 0);
+__decorate([
+    Config('rbac.session.cookie', {}),
+    __metadata("design:type", Object)
+], RbacMiddleware.prototype, "SessionCookieConfig", void 0);
 __decorate([
     Autoinject(),
     __metadata("design:type", SessionProvider)

package/lib/mjs/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,eAAe,EAAQ,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAO3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE;YACjF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxDW;IADT,MAAM,CAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,UAAU,EAAE;8BACc,eAAe;uDAAC;AALhC,cAAc;IAD1B,UAAU,CAAC,gBAAgB,CAAC;GAChB,cAAc,CA0D1B"}
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,eAAe,EAAQ,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAU3C,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,IAAI,OAAO,GAAoB,IAAI,CAAC;gBACpC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAmB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7E,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ;;;uBAGG;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;oBAE9B,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;oBAChF,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;oBAC/E,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBAC7F,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAE/B,qEAAqE;oBACrE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,8BAA8B;oBAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC1D,IAAI,OAAO,EAAE,CAAC;wBACZ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;4BACpC,MAAM,EAAE,IAAI;4BACZ,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC;4BACpC,GAAG,IAAI,CAAC,mBAAmB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,CAAO,sBAAsB,CAAC,CAAC;oBAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IACM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1EW;IADT,MAAM,CAAC,oBAAoB,CAAC;;qDACG;AAGtB;IADT,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;;2DACC;AAGzB;IADT,UAAU,EAAE;8BACc,eAAe;uDAAC;AARhC,cAAc;IAD1B,UAAU,CAAC,gBAAgB,CAAC;GAChB,cAAc,CA4E1B"}

package/lib/mjs/policies/AllowGuest.d.ts

@@ -1,6 +1,9 @@
 import { BasePolicy, IController, IRoute, Request as sRequest } from '@spinajs/http';
 /**
- * Policy to block guests
+ * Policy that ALLOWS guest users through. Access is only refused when the
+ * request has no user/session at all, or when the guest account itself has
+ * been globally disabled (IsActive === false). Use BlockGuest for the opposite
+ * behavior (reject guests, require a real logged-in user).
  */
 export declare class AllowGuest extends BasePolicy {
     isEnabled(_action: IRoute, _instance: IController): boolean;

package/lib/mjs/policies/AllowGuest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AllowGuest.d.ts","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ;CAenC"}
+{"version":3,"file":"AllowGuest.d.ts","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrF;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ;CAenC"}

package/lib/mjs/policies/AllowGuest.js

@@ -1,7 +1,10 @@
 import { BasePolicy } from '@spinajs/http';
 import { AuthenticationFailed, Forbidden } from '@spinajs/exceptions';
 /**
- * Policy to block guests
+ * Policy that ALLOWS guest users through. Access is only refused when the
+ * request has no user/session at all, or when the guest account itself has
+ * been globally disabled (IsActive === false). Use BlockGuest for the opposite
+ * behavior (reject guests, require a real logged-in user).
  */
 export class AllowGuest extends BasePolicy {
     isEnabled(_action, _instance) {

package/lib/mjs/policies/AllowGuest.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllowGuest.js","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4C,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"AllowGuest.js","sourceRoot":"","sources":["../../../src/policies/AllowGuest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4C,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IACjC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,oDAAoD;YACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/lib/mjs/policies/RbacPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAkB,IAAI,EAAE,MAAM,eAAe,CAAC;AAErD;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA0B1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}
+{"version":3,"file":"RbacPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAe,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAKlG,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;;IAQrB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAKrD,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW;CA4C1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQ3G"}

package/lib/mjs/policies/RbacPolicy.js

@@ -16,12 +16,28 @@ export class RbacPolicy extends BasePolicy {
     }
     async execute(req, action, instance) {
         const descriptor = Reflect.getMetadata(ACL_CONTROLLER_DESCRIPTOR, instance);
+        // Guard BEFORE dereferencing: RbacPolicy applied to a route/controller with
+        // no ACL metadata (e.g. @Policy(RbacPolicy) without @Resource/@Permission)
+        // must produce the descriptive server error, not a raw TypeError 500 from
+        // reading `.Permission` / `.Routes` off undefined.
+        if (!descriptor) {
+            throw new ServerError(`no route permission or resources assigned`);
+        }
         let permission = descriptor.Permission ?? [];
         if (descriptor.Routes.has(String(action.Method))) {
-            //req.storage.PermissionScope = descriptor.Routes.get(action.Method).Permission;
-            if (req.headers['x-permission-scope']) {
-                req.storage.PermissionScope = req.headers['x-permission-scope'] ?? null;
-            }
+            // SECURITY: PermissionScope must NEVER be taken from a client-supplied
+            // header. The ORM rbac query middleware uses PermissionScope to decide
+            // which own/any grant to enforce and, on a scope it does not recognise or
+            // that does not match the query type, it SKIPS row-level enforcement
+            // entirely. Letting the client set it therefore allowed any authenticated
+            // user holding only *Own grants to send `x-permission-scope: <anything>`
+            // and read/update/delete every row (owner-field WHERE restriction never
+            // applied). With no scope set, the middleware falls back to the correct
+            // query-derived scope (QUERY_TO_PERMISSION), which is the secure default.
+            //
+            // If a route ever needs an explicit scope it must be derived server-side
+            // from the route's declared permission, not from the request, e.g.:
+            //   req.storage.PermissionScope = descriptor.Routes.get(String(action.Method))!.Permission?.[0];
             permission = descriptor.Routes.get(String(action.Method)).Permission ?? [];
         }
         // check if route has its own permission

package/lib/mjs/policies/RbacPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAmB,IAAI,IAAI,CAAC;YAC5F,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"RbacPolicy.js","sourceRoot":"","sources":["../../../src/policies/RbacPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,WAAW,EAAuB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAGxC;QACE,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAa,EAAE,MAAc,EAAE,QAAqB;QACvE,MAAM,UAAU,GAAoB,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAE7F,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,EAAE;YACF,yEAAyE;YACzE,oEAAoE;YACpE,iGAAiG;YACjG,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,WAAW,SAAS,6BAA6B,UAAU,iBAAiB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,QAAgB,EAAE,UAAkB;IAC/F,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,QAAgB,EAAE,UAAkB;IAClF,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAa,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC"}