@spinajs/rbac-http 2.0.491 → 2.0.494

package/lib/mjs/dto/auth-responses.js

@@ -0,0 +1,276 @@
+import { DI } from '@spinajs/di';
+/**
+ * JSON schemas for the auth endpoints' RESPONSE bodies.
+ *
+ * ---------------------------------------------------------------------------
+ * Why this file exists
+ * ---------------------------------------------------------------------------
+ * The auth controllers already annotate their returns with the interface names
+ * from `interfaces.ts` (`@returns {ILoginResponse}`, `{IActiveRoleResponse}`,
+ * …). Those annotations resolved to nothing: the swagger builder asks its
+ * `SchemaProvider`s for a schema by name, no provider knows a plain TypeScript
+ * interface, and `inferSchemaFromString` then falls back to
+ * `{ type: 'object', description: '<name>' }` — an object with no properties.
+ *
+ * The published spec therefore described `/auth/login`, `/auth/2fa/verify` and
+ * both `/auth/active-role` operations as returning an empty object. Generated
+ * clients believed it: every one of those responses typed as `object`, and
+ * codegen that builds models from response schemas had nothing to build from.
+ *
+ * Registering the schemas under the SAME names the annotations already use is
+ * what makes them resolve — no controller annotation changes, and the component
+ * names in the spec are the ones the code has always claimed.
+ *
+ * ---------------------------------------------------------------------------
+ * Why raw registration and not `@Schema`
+ * ---------------------------------------------------------------------------
+ * `@Schema` is sugar for exactly the call below, keyed on the decorated class's
+ * name. Using it here would mean declaring classes called `ILoginResponse` and
+ * friends purely to carry a name — and they would collide with the interfaces of
+ * that name this package already exports. These describe responses; there is
+ * nothing to construct.
+ *
+ * ---------------------------------------------------------------------------
+ * Keep in sync with `interfaces.ts`
+ * ---------------------------------------------------------------------------
+ * The schemas below describe what the endpoints really put on the wire, which is
+ * what a client validator has to accept. Where that differs from the interface,
+ * the wire wins and the difference is called out in a comment.
+ */
+/** `format: date-time` as the backend emits it — `dateTimeFormat: 'iso'`, offset included. */
+const dateTime = { type: 'string', format: 'date-time' };
+const nullableDateTime = { type: 'string', format: 'date-time', nullable: true };
+/**
+ * One metadata row as dehydrated onto the wire.
+ *
+ * `Value` is a string regardless of `Type`: the column stores text and `Type`
+ * says how to read it. A client that wants the decoded value decodes it itself.
+ */
+export const UserMetadataEntrySchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'User metadata entry',
+    type: 'object',
+    properties: {
+        Id: { type: 'integer' },
+        Key: { type: 'string' },
+        Type: {
+            type: 'string',
+            enum: ['number', 'float', 'string', 'json', 'boolean', 'datetime'],
+        },
+        Value: { type: 'string', nullable: true },
+    },
+};
+/**
+ * A reference to the entry schema above, by the tag the builder resolves.
+ *
+ * `expandNamedSchemas` turns any node whose `description` names a registered
+ * schema into a `$ref` to that component — this is how the builder expresses a
+ * reference, and it is worth using rather than inlining the object three times.
+ *
+ * Not merely tidier: the metadata entry carries an enum, and an enum inline
+ * inside a `oneOf` arm (which `ILoginResponse` is) makes generators emit type
+ * references that index the union by a key only one arm has. Giving the entry
+ * its own component takes the enum out of the union entirely.
+ */
+const userMetadataEntryRef = { description: 'IUserMetadataEntry' };
+/**
+ * The user's own columns, as `dehydrateWithRelations({ dateTimeFormat: 'iso' })`
+ * produces them.
+ *
+ * `Password` is deliberately absent. It is a column on the ORM model, so any
+ * endpoint documented as returning the model advertises it as part of the
+ * response — it is never actually sent, and a spec must not say otherwise.
+ *
+ * `IsActive` is an integer, not a boolean: the column is a tinyint and the
+ * driver hands back 0/1.
+ */
+const userProperties = {
+    Uuid: { type: 'string' },
+    Email: { type: 'string', format: 'email' },
+    Login: { type: 'string' },
+    Role: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Every role assigned to the user — the set /auth/active-role may switch between',
+    },
+    IsActive: { type: 'integer', description: '1 when the account is active' },
+    CreatedAt: dateTime,
+    RegisteredAt: nullableDateTime,
+    DeletedAt: nullableDateTime,
+    LastLoginAt: nullableDateTime,
+    Metadata: { type: 'array', items: userMetadataEntryRef },
+};
+/**
+ * `required` on a RESPONSE, kept to the bare minimum on purpose.
+ *
+ * A response schema describes what a client must ACCEPT, not what it may send,
+ * and `required` there is a promise a client validator will enforce — one this
+ * codebase has already been bitten by, when response components were built from
+ * the write contract and `User.Password` came out `required`. Every ordinary row
+ * then failed validation. Response components are built without `required` for
+ * that reason, and hand-written ones have no business reinstating it.
+ *
+ * The practical edge: a client generated from this spec and deployed before the
+ * backend that fills a new field would reject every response outright, instead of
+ * seeing the field missing and saying so.
+ *
+ * `Uuid` is the one exception, and it is structural rather than a data guarantee:
+ * `ILoginResponse` is a union, and an arm with nothing required matches any
+ * object at all — including the two-factor replies, which would then never reach
+ * their own arms.
+ */
+const USER_REQUIRED = ['Uuid'];
+/**
+ * Flattened RBAC grants: resource → action → permission descriptor.
+ *
+ * The resource and action keys are data, so the schema can only describe the
+ * shape two levels down. `additionalProperties` carries it.
+ */
+const grantsMap = {
+    type: 'object',
+    description: "Resolved grants for the active role, in accesscontrol's own format: " +
+        "resource → 'action:possession' → attributes. Feed it back into new AccessControl().",
+    properties: {
+        $extend: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Roles this one inherits from. Sits alongside the resources, and is not one.',
+        },
+    },
+    additionalProperties: {
+        type: 'object',
+        description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')",
+        additionalProperties: { type: 'array', items: { type: 'string' } },
+    },
+};
+/** `IUserWithGrants` — the payload a completed login or 2FA verification returns. */
+export const UserWithGrantsSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'User with grants',
+    type: 'object',
+    properties: {
+        ...userProperties,
+        ActiveRole: {
+            type: 'string',
+            description: 'Role whose grants are in effect; defaults to Role[0] at login',
+        },
+        Grants: grantsMap,
+    },
+    required: USER_REQUIRED,
+};
+/**
+ * `ITwoFactorAuthRequired` — password accepted, TOTP still owed.
+ *
+ * The flag is a plain boolean, not `const: true`. A single-value const becomes a
+ * one-member enum in the emitted spec, and an enum inside a `oneOf` arm is what
+ * makes generators reach for `Union["TheKey"]` — a key only one arm has. The
+ * discriminator is which key is PRESENT, which `required` already states.
+ */
+export const TwoFactorAuthRequiredSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor verification required',
+    type: 'object',
+    properties: {
+        TwoFactorAuthRequired: {
+            type: 'boolean',
+            description: 'Always true; the session is parked awaiting a TOTP code',
+        },
+    },
+    required: ['TwoFactorAuthRequired'],
+};
+/** `ITwoFactorInitRequired` — password accepted, enrolment owed before TOTP. */
+export const TwoFactorInitRequiredSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor enrolment required',
+    type: 'object',
+    properties: {
+        TwoFactorInitRequired: {
+            type: 'boolean',
+            description: 'Always true; the user must enrol a TOTP device before continuing',
+        },
+    },
+    required: ['TwoFactorInitRequired'],
+};
+/**
+ * `ILoginResponse` — the three shapes `/auth/login` can answer with.
+ *
+ * A discriminated union rather than one object with everything optional: the
+ * caller branches on which key is present, and a schema that makes all of them
+ * optional would validate a response carrying none.
+ */
+export const LoginResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Login response',
+    // Two-factor arms first. A validator walks the arms in order and takes the
+    // first that matches; the user arm requires only `Uuid` (see USER_REQUIRED),
+    // so putting it first would let it swallow a two-factor reply.
+    oneOf: [TwoFactorAuthRequiredSchema, TwoFactorInitRequiredSchema, UserWithGrantsSchema],
+};
+/** `IActiveRoleResponse` — what both `/auth/active-role` operations answer with. */
+export const ActiveRoleResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Active role',
+    type: 'object',
+    properties: {
+        ActiveRole: { type: 'string', description: 'Role whose grants are now in effect' },
+        Grants: grantsMap,
+    },
+};
+/**
+ * `IWhoamiResponse` — `/auth/whoami`.
+ *
+ * The user's own columns plus the two fields the session contributes. It is NOT
+ * the `User` ORM model, which is what this endpoint used to be documented as:
+ * that model knows nothing of `ActiveRole` or `Authorized` — the two fields a
+ * client needs most here — and does carry `Password`.
+ */
+export const WhoamiResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Current session user',
+    type: 'object',
+    properties: {
+        ...userProperties,
+        ActiveRole: {
+            type: 'string',
+            description: 'Role whose grants are in effect for this session',
+        },
+        Authorized: {
+            type: 'boolean',
+            description: 'False while the session has passed the password step but still owes 2FA. ' +
+                'Absent on sessions minted before this field existed, which were fully authorized.',
+        },
+    },
+    required: USER_REQUIRED,
+};
+/** `IEnable2faResponse` — the OTP provisioning URI from `/auth/2fa/setup`. */
+export const Enable2faResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor enrolment',
+    type: 'object',
+    properties: {
+        otp: {
+            type: 'string',
+            description: 'OTP provisioning URI to scan with an authenticator app',
+        },
+    },
+};
+/**
+ * Registers a schema under the name controllers reference it by.
+ *
+ * Same registry and same call `@Schema` makes, so `DtoSchemaProvider` resolves
+ * these exactly as it resolves a decorated DTO.
+ */
+function registerResponseSchema(name, schema) {
+    DI.register(schema).asMapValue('__schemas__', name);
+}
+registerResponseSchema('IUserMetadataEntry', UserMetadataEntrySchema);
+// `/user/grants` and `/grants` answer with the map on its own.
+registerResponseSchema('IGrantsMap', { $schema: 'http://json-schema.org/draft-07/schema#', title: 'Grants map', ...grantsMap });
+registerResponseSchema('IUserWithGrants', UserWithGrantsSchema);
+registerResponseSchema('ITwoFactorAuthRequired', TwoFactorAuthRequiredSchema);
+registerResponseSchema('ITwoFactorInitRequired', TwoFactorInitRequiredSchema);
+registerResponseSchema('ILoginResponse', LoginResponseSchema);
+registerResponseSchema('IActiveRoleResponse', ActiveRoleResponseSchema);
+registerResponseSchema('IWhoamiResponse', WhoamiResponseSchema);
+registerResponseSchema('IEnable2faResponse', Enable2faResponseSchema);
+//# sourceMappingURL=auth-responses.js.map

package/lib/mjs/dto/auth-responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-responses.js","sourceRoot":"","sources":["../../../src/dto/auth-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAW,CAAC;AAClE,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,qBAAqB;IAC5B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;SACnE;QACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1C;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAW,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,gFAAgF;KAC9F;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC1E,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,gBAAgB;IAC9B,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE;CAChD,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,QAAQ;IACd,WAAW,EACT,sEAAsE;QACtE,qFAAqF;IACvF,UAAU,EAAE;QACV,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yEAAyE;QACtF,oBAAoB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KACnE;CACO,CAAC;AAEX,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,cAAc;QACjB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+DAA+D;SAC7E;QACD,MAAM,EAAE,SAAS;KAClB;IACD,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,qBAAqB,EAAE;YACrB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,+BAA+B;IACtC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,qBAAqB,EAAE;YACrB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,gBAAgB;IACvB,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,KAAK,EAAE,CAAC,2BAA2B,EAAE,2BAA2B,EAAE,oBAAoB,CAAC;CACxF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAClF,MAAM,EAAE,SAAS;KAClB;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,cAAc;QACjB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kDAAkD;SAChE;QACD,UAAU,EAAE;YACV,IAAI,EAAE,SAAS;YACf,WAAW,EACT,2EAA2E;gBAC3E,mFAAmF;SACtF;KACF;IACD,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,wDAAwD;SACtE;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,MAAc;IAC1D,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,sBAAsB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;AACtE,+DAA+D;AAC/D,sBAAsB,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAChI,sBAAsB,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AAChE,sBAAsB,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC;AAC9E,sBAAsB,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC;AAC9E,sBAAsB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;AAC9D,sBAAsB,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;AACxE,sBAAsB,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AAChE,sBAAsB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC"}

package/lib/mjs/index.d.ts

@@ -1,3 +1,4 @@
+import './dto/auth-responses.js';
 export * from './decorators.js';
 export * from './interfaces.js';
 export * from './middlewares.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,yBAAyB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}

package/lib/mjs/index.js

@@ -1,3 +1,9 @@
+// Side-effect import, not `export *`: this module registers the auth response
+// schemas under the interface names the controllers annotate with, and the
+// classes-free registration means there is nothing to re-export. Importing it
+// here is what guarantees the registration has happened by the time the swagger
+// builder asks for those names.
+import './dto/auth-responses.js';
 export * from './decorators.js';
 export * from './interfaces.js';
 export * from './middlewares.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,gCAAgC;AAChC,OAAO,yBAAyB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -24,10 +24,23 @@ export interface IUserProfile {
 export interface IUserData extends IUserProfile {
     Metadata?: IUserMetadataEntry[];
 }
-/** Flattened RBAC grants for a user: resource → action → permission descriptor */
-export type IGrantsMap = Record<string, Record<string, {
-    attributes: string[];
-}>>;
+/**
+ * Flattened RBAC grants for a user: resource → `'action:possession'` → attributes.
+ *
+ * This is `accesscontrol`'s own grants format, which is what `_unwindGrants`
+ * produces and what a client feeds straight back into `new AccessControl(...)`.
+ * The attribute list is a bare `string[]` (`['*']`), NOT a `{ attributes }`
+ * wrapper — that wrapper is what this type used to claim, and it described no
+ * payload the API has ever sent.
+ *
+ * `$extend` rides at the same level as the resources when the role inherits from
+ * others; its value is the list of inherited role names, so a consumer that
+ * treats every key as a resource has to skip it.
+ */
+export type IGrantsMap = {
+    /** Roles this one inherits from — present only on a role that extends others. */
+    $extend?: string[];
+} & Record<string, Record<string, string[]> | string[] | undefined>;
 /** Successful authentication response — user profile merged with RBAC grants */
 export interface IUserWithGrants extends IUserProfile {
     /**
@@ -42,6 +55,25 @@ export interface IActiveRoleResponse {
     ActiveRole: string;
     Grants: IGrantsMap;
 }
+/**
+ * Response for GET /auth/whoami — the session's user plus what the session
+ * itself knows about it.
+ *
+ * Not `IUserWithGrants`: whoami resolves no grants, because grants belong to the
+ * active role and /auth/active-role is what answers with them.
+ */
+export interface IWhoamiResponse extends IUserData {
+    /** Role whose grants are in effect for this session. */
+    ActiveRole: string;
+    /**
+     * False while the session has passed the password step but still owes 2FA.
+     *
+     * Absent on sessions minted before this field existed; those predate 2FA
+     * gating and were by definition fully authorized, which is why the endpoint
+     * defaults it to true rather than false.
+     */
+    Authorized: boolean;
+}
 /** Response for /auth/impersonate when an impersonation has just been started or queried */
 export interface IImpersonationResponse {
     /** Target user (whose identity is now in effect) */

package/lib/mjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEpE,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/lib/mjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AA+JA,MAAM,OAAgB,qBAAqB;CA0C1C;AAED,MAAM,OAAgB,mBAAmB;CAAG"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAmMA,MAAM,OAAgB,qBAAqB;CA0C1C;AAED,MAAM,OAAgB,mBAAmB;CAAG"}