@spinajs/rbac-http 2.0.491 → 2.0.495

package/lib/cjs/index.d.ts

@@ -1,3 +1,4 @@
+import './dto/auth-responses.js';
 export * from './decorators.js';
 export * from './interfaces.js';
 export * from './middlewares.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,yBAAyB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,mCAAmC,CAAC"}

package/lib/cjs/index.js

@@ -14,6 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// Side-effect import, not `export *`: this module registers the auth response
+// schemas under the interface names the controllers annotate with, and the
+// classes-free registration means there is nothing to re-export. Importing it
+// here is what guarantees the registration has happened by the time the swagger
+// builder asks for those names.
+require("./dto/auth-responses.js");
 __exportStar(require("./decorators.js"), exports);
 __exportStar(require("./interfaces.js"), exports);
 __exportStar(require("./middlewares.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,kDAAgC;AAChC,mDAAiC;AACjC,2DAAyC;AACzC,oDAAkC;AAClC,kDAAgC;AAEhC,2DAAyC;AACzC,2DAAyC;AACzC,6DAA2C;AAC3C,gEAA8C;AAC9C,2DAAyC;AACzC,mEAAiD;AACjD,iEAA+C;AAE/C,oEAAkD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,gCAAgC;AAChC,mCAAiC;AAEjC,kDAAgC;AAChC,kDAAgC;AAChC,mDAAiC;AACjC,2DAAyC;AACzC,oDAAkC;AAClC,kDAAgC;AAEhC,2DAAyC;AACzC,2DAAyC;AACzC,6DAA2C;AAC3C,gEAA8C;AAC9C,2DAAyC;AACzC,mEAAiD;AACjD,iEAA+C;AAE/C,oEAAkD"}

package/lib/cjs/interfaces.d.ts

@@ -24,10 +24,23 @@ export interface IUserProfile {
 export interface IUserData extends IUserProfile {
     Metadata?: IUserMetadataEntry[];
 }
-/** Flattened RBAC grants for a user: resource → action → permission descriptor */
-export type IGrantsMap = Record<string, Record<string, {
-    attributes: string[];
-}>>;
+/**
+ * Flattened RBAC grants for a user: resource → `'action:possession'` → attributes.
+ *
+ * This is `accesscontrol`'s own grants format, which is what `_unwindGrants`
+ * produces and what a client feeds straight back into `new AccessControl(...)`.
+ * The attribute list is a bare `string[]` (`['*']`), NOT a `{ attributes }`
+ * wrapper — that wrapper is what this type used to claim, and it described no
+ * payload the API has ever sent.
+ *
+ * `$extend` rides at the same level as the resources when the role inherits from
+ * others; its value is the list of inherited role names, so a consumer that
+ * treats every key as a resource has to skip it.
+ */
+export type IGrantsMap = {
+    /** Roles this one inherits from — present only on a role that extends others. */
+    $extend?: string[];
+} & Record<string, Record<string, string[]> | string[] | undefined>;
 /** Successful authentication response — user profile merged with RBAC grants */
 export interface IUserWithGrants extends IUserProfile {
     /**
@@ -42,6 +55,25 @@ export interface IActiveRoleResponse {
     ActiveRole: string;
     Grants: IGrantsMap;
 }
+/**
+ * Response for GET /auth/whoami — the session's user plus what the session
+ * itself knows about it.
+ *
+ * Not `IUserWithGrants`: whoami resolves no grants, because grants belong to the
+ * active role and /auth/active-role is what answers with them.
+ */
+export interface IWhoamiResponse extends IUserData {
+    /** Role whose grants are in effect for this session. */
+    ActiveRole: string;
+    /**
+     * False while the session has passed the password step but still owes 2FA.
+     *
+     * Absent on sessions minted before this field existed; those predate 2FA
+     * gating and were by definition fully authorized, which is why the endpoint
+     * defaults it to true rather than false.
+     */
+    Authorized: boolean;
+}
 /** Response for /auth/impersonate when an impersonation has just been started or queried */
 export interface IImpersonationResponse {
     /** Target user (whose identity is now in effect) */

package/lib/cjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/D,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACtE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEpE,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE/F,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAElB;;;;;WAKG;QACH,eAAe,CAAC,EAAG,cAAc,CAAC;QAElC;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB;;;;WAIG;QACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAE3B;;;;WAIG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;CACF;AAGD,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;IAE7B;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,8BAAsB,qBAAqB;IACzC;;OAEG;aACa,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAE3D;;;;OAIG;aACa,OAAO,CAAC,IAAI,EAAG,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;OAEG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAElD;;OAEG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;OAEG;aACa,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD;;;;OAIG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAE3D;;;;;OAKG;aACa,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,8BAAsB,mBAAmB;CAAG;AAE5C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/lib/cjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AA+JA,MAAsB,qBAAqB;CA0C1C;AA1CD,sDA0CC;AAED,MAAsB,mBAAmB;CAAG;AAA5C,kDAA4C"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AAmMA,MAAsB,qBAAqB;CA0C1C;AA1CD,sDA0CC;AAED,MAAsB,mBAAmB;CAAG;AAA5C,kDAA4C"}

package/lib/mjs/dto/auth-responses.d.ts

@@ -0,0 +1,374 @@
+/**
+ * One metadata row as dehydrated onto the wire.
+ *
+ * `Value` is a string regardless of `Type`: the column stores text and `Type`
+ * says how to read it. A client that wants the decoded value decodes it itself.
+ */
+export declare const UserMetadataEntrySchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Id: {
+            type: string;
+        };
+        Key: {
+            type: string;
+        };
+        Type: {
+            type: string;
+            enum: string[];
+        };
+        Value: {
+            type: string;
+            nullable: boolean;
+        };
+    };
+};
+/** `IUserWithGrants` — the payload a completed login or 2FA verification returns. */
+export declare const UserWithGrantsSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Grants: {
+            readonly type: "object";
+            readonly description: string;
+            readonly properties: {
+                readonly $extend: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                };
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                readonly additionalProperties: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+        Uuid: {
+            readonly type: "string";
+        };
+        Email: {
+            readonly type: "string";
+            readonly format: "email";
+        };
+        Login: {
+            readonly type: "string";
+        };
+        Role: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+        };
+        IsActive: {
+            readonly type: "integer";
+            readonly description: "1 when the account is active";
+        };
+        CreatedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+        };
+        RegisteredAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        DeletedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        LastLoginAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        Metadata: {
+            readonly type: "array";
+            readonly items: {
+                readonly description: "IUserMetadataEntry";
+            };
+        };
+    };
+    required: string[];
+};
+/**
+ * `ITwoFactorAuthRequired` — password accepted, TOTP still owed.
+ *
+ * The flag is a plain boolean, not `const: true`. A single-value const becomes a
+ * one-member enum in the emitted spec, and an enum inside a `oneOf` arm is what
+ * makes generators reach for `Union["TheKey"]` — a key only one arm has. The
+ * discriminator is which key is PRESENT, which `required` already states.
+ */
+export declare const TwoFactorAuthRequiredSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        TwoFactorAuthRequired: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** `ITwoFactorInitRequired` — password accepted, enrolment owed before TOTP. */
+export declare const TwoFactorInitRequiredSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        TwoFactorInitRequired: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/**
+ * `ILoginResponse` — the three shapes `/auth/login` can answer with.
+ *
+ * A discriminated union rather than one object with everything optional: the
+ * caller branches on which key is present, and a schema that makes all of them
+ * optional would validate a response carrying none.
+ */
+export declare const LoginResponseSchema: {
+    $schema: string;
+    title: string;
+    oneOf: ({
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            ActiveRole: {
+                type: string;
+                description: string;
+            };
+            Grants: {
+                readonly type: "object";
+                readonly description: string;
+                readonly properties: {
+                    readonly $extend: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                    };
+                };
+                readonly additionalProperties: {
+                    readonly type: "object";
+                    readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                };
+            };
+            Uuid: {
+                readonly type: "string";
+            };
+            Email: {
+                readonly type: "string";
+                readonly format: "email";
+            };
+            Login: {
+                readonly type: "string";
+            };
+            Role: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+            };
+            IsActive: {
+                readonly type: "integer";
+                readonly description: "1 when the account is active";
+            };
+            CreatedAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+            };
+            RegisteredAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            DeletedAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            LastLoginAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            Metadata: {
+                readonly type: "array";
+                readonly items: {
+                    readonly description: "IUserMetadataEntry";
+                };
+            };
+        };
+        required: string[];
+    } | {
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            TwoFactorAuthRequired: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    } | {
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            TwoFactorInitRequired: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    })[];
+};
+/** `IActiveRoleResponse` — what both `/auth/active-role` operations answer with. */
+export declare const ActiveRoleResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Grants: {
+            readonly type: "object";
+            readonly description: string;
+            readonly properties: {
+                readonly $extend: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                };
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                readonly additionalProperties: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * `IWhoamiResponse` — `/auth/whoami`.
+ *
+ * The user's own columns plus the two fields the session contributes. It is NOT
+ * the `User` ORM model, which is what this endpoint used to be documented as:
+ * that model knows nothing of `ActiveRole` or `Authorized` — the two fields a
+ * client needs most here — and does carry `Password`.
+ */
+export declare const WhoamiResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Authorized: {
+            type: string;
+            description: string;
+        };
+        Uuid: {
+            readonly type: "string";
+        };
+        Email: {
+            readonly type: "string";
+            readonly format: "email";
+        };
+        Login: {
+            readonly type: "string";
+        };
+        Role: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+        };
+        IsActive: {
+            readonly type: "integer";
+            readonly description: "1 when the account is active";
+        };
+        CreatedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+        };
+        RegisteredAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        DeletedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        LastLoginAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        Metadata: {
+            readonly type: "array";
+            readonly items: {
+                readonly description: "IUserMetadataEntry";
+            };
+        };
+    };
+    required: string[];
+};
+/** `IEnable2faResponse` — the OTP provisioning URI from `/auth/2fa/setup`. */
+export declare const Enable2faResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        otp: {
+            type: string;
+            description: string;
+        };
+    };
+};
+//# sourceMappingURL=auth-responses.d.ts.map

package/lib/mjs/dto/auth-responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-responses.d.ts","sourceRoot":"","sources":["../../../src/dto/auth-responses.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;CAanC,CAAC;AA0FF,qFAAqF;AACrF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAahC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;CAWvC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,2BAA2B;;;;;;;;;;;CAWvC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO/B,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQpC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBhC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;;;;;;;CAUnC,CAAC"}