@spinajs/rbac 2.0.474 → 2.0.475

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spinajs/rbac",
-  "version": "2.0.474",
+  "version": "2.0.475",
   "description": "Role and Attribute based Access Control for SpinaJS framework",
   "main": "lib/cjs/index.js",
   "module": "lib/mjs/index.js",
@@ -47,15 +47,15 @@
   },
   "homepage": "https://github.com/spinajs/main#readme",
   "dependencies": {
-    "@spinajs/configuration": "^2.0.474",
-    "@spinajs/di": "^2.0.474",
-    "@spinajs/exceptions": "^2.0.474",
-    "@spinajs/log": "^2.0.474",
-    "@spinajs/orm": "^2.0.474",
-    "@spinajs/queue": "^2.0.474",
-    "@spinajs/reflection": "^2.0.474",
-    "@spinajs/util": "^2.0.474",
-    "@spinajs/validation": "^2.0.474",
+    "@spinajs/configuration": "^2.0.475",
+    "@spinajs/di": "^2.0.475",
+    "@spinajs/exceptions": "^2.0.475",
+    "@spinajs/log": "^2.0.475",
+    "@spinajs/orm": "^2.0.475",
+    "@spinajs/queue": "^2.0.475",
+    "@spinajs/reflection": "^2.0.475",
+    "@spinajs/util": "^2.0.475",
+    "@spinajs/validation": "^2.0.475",
     "accesscontrol": "^2.2.1",
     "argon2": "^0.44.0",
     "cron": "^2.2.0",
@@ -65,7 +65,7 @@
     "uuid": "^9.0.0"
   },
   "devDependencies": {
-    "@spinajs/orm-sqlite": "^2.0.474",
+    "@spinajs/orm-sqlite": "^2.0.475",
     "@types/cron": "^2.0.0",
     "@types/entropy-string": "^4.2.0"
   },

package/lib/cjs/events/UserImpersonationEnded.d.ts

@@ -1,12 +0,0 @@
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when an active impersonation ends (explicit stop, logout while
- * impersonating, or session expiry handling). UserUUID is the impersonator
- * who initiated the impersonation; TargetUUID is whoever they were acting as.
- */
-export declare class UserImpersonationEnded extends UserEvent {
-    TargetUUID: string;
-    constructor(original: User, target: User);
-}
-//# sourceMappingURL=UserImpersonationEnded.d.ts.map

package/lib/cjs/events/UserImpersonationEnded.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationEnded.d.ts","sourceRoot":"","sources":["../../../src/events/UserImpersonationEnded.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,qBACa,sBAAuB,SAAQ,SAAS;IAC5C,UAAU,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;CAIzC"}

package/lib/cjs/events/UserImpersonationEnded.js

@@ -1,32 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserImpersonationEnded = void 0;
-const queue_1 = require("@spinajs/queue");
-const UserEvent_js_1 = require("./UserEvent.js");
-const User_js_1 = require("../models/User.js");
-/**
- * Emitted when an active impersonation ends (explicit stop, logout while
- * impersonating, or session expiry handling). UserUUID is the impersonator
- * who initiated the impersonation; TargetUUID is whoever they were acting as.
- */
-let UserImpersonationEnded = class UserImpersonationEnded extends UserEvent_js_1.UserEvent {
-    constructor(original, target) {
-        super(original);
-        this.TargetUUID = target.Uuid;
-    }
-};
-exports.UserImpersonationEnded = UserImpersonationEnded;
-exports.UserImpersonationEnded = UserImpersonationEnded = __decorate([
-    (0, queue_1.Event)(),
-    __metadata("design:paramtypes", [User_js_1.User, User_js_1.User])
-], UserImpersonationEnded);
-//# sourceMappingURL=UserImpersonationEnded.js.map

package/lib/cjs/events/UserImpersonationEnded.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationEnded.js","sourceRoot":"","sources":["../../../src/events/UserImpersonationEnded.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAuC;AACvC,iDAA2C;AAC3C,+CAAyC;AAEzC;;;;GAIG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,wBAAS;IAGnD,YAAY,QAAc,EAAE,MAAY;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;CACF,CAAA;AAPY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,aAAK,GAAE;qCAIgB,cAAI,EAAU,cAAI;GAH7B,sBAAsB,CAOlC"}

package/lib/cjs/events/UserImpersonationStarted.d.ts

@@ -1,12 +0,0 @@
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when `original` starts impersonating `target`. UserUUID (from the
- * base class) holds the impersonator's UUID — the actor who triggered the
- * event — and TargetUUID holds whoever they impersonated.
- */
-export declare class UserImpersonationStarted extends UserEvent {
-    TargetUUID: string;
-    constructor(original: User, target: User);
-}
-//# sourceMappingURL=UserImpersonationStarted.d.ts.map

package/lib/cjs/events/UserImpersonationStarted.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationStarted.d.ts","sourceRoot":"","sources":["../../../src/events/UserImpersonationStarted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,qBACa,wBAAyB,SAAQ,SAAS;IAC9C,UAAU,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;CAIzC"}

package/lib/cjs/events/UserImpersonationStarted.js

@@ -1,32 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserImpersonationStarted = void 0;
-const queue_1 = require("@spinajs/queue");
-const UserEvent_js_1 = require("./UserEvent.js");
-const User_js_1 = require("../models/User.js");
-/**
- * Emitted when `original` starts impersonating `target`. UserUUID (from the
- * base class) holds the impersonator's UUID — the actor who triggered the
- * event — and TargetUUID holds whoever they impersonated.
- */
-let UserImpersonationStarted = class UserImpersonationStarted extends UserEvent_js_1.UserEvent {
-    constructor(original, target) {
-        super(original);
-        this.TargetUUID = target.Uuid;
-    }
-};
-exports.UserImpersonationStarted = UserImpersonationStarted;
-exports.UserImpersonationStarted = UserImpersonationStarted = __decorate([
-    (0, queue_1.Event)(),
-    __metadata("design:paramtypes", [User_js_1.User, User_js_1.User])
-], UserImpersonationStarted);
-//# sourceMappingURL=UserImpersonationStarted.js.map

package/lib/cjs/events/UserImpersonationStarted.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationStarted.js","sourceRoot":"","sources":["../../../src/events/UserImpersonationStarted.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAuC;AACvC,iDAA2C;AAC3C,+CAAyC;AAEzC;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,wBAAS;IAGrD,YAAY,QAAc,EAAE,MAAY;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;CACF,CAAA;AAPY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,aAAK,GAAE;qCAIgB,cAAI,EAAU,cAAI;GAH7B,wBAAwB,CAOpC"}

package/lib/cjs/impersonation.d.ts

@@ -1,32 +0,0 @@
-import { AccessControl } from 'accesscontrol';
-export type ImpersonationDenialReason = 'PROTECTED_ROLE' | 'PRIVILEGE_ESCALATION' | 'SELF_TARGET';
-export interface IImpersonationCheckOptions {
-    /** Roles of the user who wants to impersonate */
-    originalRoles: string[];
-    /** Roles of the target user */
-    targetRoles: string[];
-    /** Roles that may never be impersonated (default: ['system']) */
-    protectedRoles: string[];
-    /** AccessControl instance — used to compare effective grants */
-    ac: AccessControl;
-}
-export interface IImpersonationCheckResult {
-    allowed: boolean;
-    reason?: ImpersonationDenialReason;
-    detail?: string;
-}
-/**
- * Decides whether `originalRoles` may impersonate a user with `targetRoles`.
- *
- * Rules:
- *  1. If target has any role in `protectedRoles` → denied (PROTECTED_ROLE).
- *  2. If target has any effective grant the original does NOT have, that's an
- *     escalation and impersonation is denied (PRIVILEGE_ESCALATION). This
- *     blocks equal-or-higher targets — admin cannot impersonate admin, user
- *     cannot impersonate admin, but admin can impersonate user.
- *
- * The grant comparison walks accesscontrol's resolved grants, so $extend is
- * honored transitively.
- */
-export declare function canImpersonate(opts: IImpersonationCheckOptions): IImpersonationCheckResult;
-//# sourceMappingURL=impersonation.d.ts.map

package/lib/cjs/impersonation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonation.d.ts","sourceRoot":"","sources":["../../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAElG,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,iEAAiE;IACjE,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,gEAAgE;IAChE,EAAE,EAAE,aAAa,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CAoC1F"}

package/lib/cjs/impersonation.js

@@ -1,97 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canImpersonate = canImpersonate;
-/**
- * Decides whether `originalRoles` may impersonate a user with `targetRoles`.
- *
- * Rules:
- *  1. If target has any role in `protectedRoles` → denied (PROTECTED_ROLE).
- *  2. If target has any effective grant the original does NOT have, that's an
- *     escalation and impersonation is denied (PRIVILEGE_ESCALATION). This
- *     blocks equal-or-higher targets — admin cannot impersonate admin, user
- *     cannot impersonate admin, but admin can impersonate user.
- *
- * The grant comparison walks accesscontrol's resolved grants, so $extend is
- * honored transitively.
- */
-function canImpersonate(opts) {
-    const { originalRoles, targetRoles, protectedRoles, ac } = opts;
-    const protectedHit = targetRoles.find(r => protectedRoles.includes(r));
-    if (protectedHit) {
-        return { allowed: false, reason: 'PROTECTED_ROLE', detail: protectedHit };
-    }
-    // accesscontrol throws if a role is unknown; guard so unknown target roles
-    // (e.g. orphaned data) don't crash the check — treat them as 'no grants'.
-    const safePermissions = (roles) => {
-        try {
-            return collectPermissions(ac, roles);
-        }
-        catch {
-            return new Set();
-        }
-    };
-    const targetPerms = safePermissions(targetRoles);
-    const originalPerms = safePermissions(originalRoles);
-    for (const perm of targetPerms) {
-        if (!originalPerms.has(perm)) {
-            return { allowed: false, reason: 'PRIVILEGE_ESCALATION', detail: perm };
-        }
-    }
-    // Equal privileges count as escalation per the spec: an impersonator should
-    // be strictly more privileged than the target. If target has no role at all
-    // (empty grants) we still allow — impersonating a permissionless user is
-    // safe by definition.
-    if (targetPerms.size > 0 && targetPerms.size === originalPerms.size) {
-        return { allowed: false, reason: 'PRIVILEGE_ESCALATION', detail: 'equal privileges' };
-    }
-    return { allowed: true };
-}
-/**
- * Build a flat set of "resource::action" strings representing every permission
- * granted to the union of `roles`. Used so we can compare two role sets by
- * simple set inclusion.
- */
-function collectPermissions(ac, roles) {
-    const out = new Set();
-    if (roles.length === 0)
-        return out;
-    const grants = ac.getGrants();
-    const actions = [
-        'createAny', 'createOwn', 'readAny', 'readOwn', 'updateAny', 'updateOwn', 'deleteAny', 'deleteOwn',
-    ];
-    // Resources are not enumerable directly via the can() API — read them from
-    // the raw grants map and walk every $extend chain reachable from `roles`.
-    const visited = new Set();
-    const stack = [...roles];
-    const resources = new Set();
-    while (stack.length) {
-        const role = stack.pop();
-        if (visited.has(role))
-            continue;
-        visited.add(role);
-        const roleGrants = grants[role];
-        if (!roleGrants)
-            continue;
-        for (const key of Object.keys(roleGrants)) {
-            if (key === '$extend') {
-                for (const inherited of roleGrants[key])
-                    stack.push(inherited);
-            }
-            else {
-                resources.add(key);
-            }
-        }
-    }
-    for (const resource of resources) {
-        for (const action of actions) {
-            // ac.can(roles)[action](resource).granted is true if ANY of the roles
-            // (or their $extend chain) grants the action — exactly the "union of
-            // effective permissions" we want.
-            if (ac.can(roles)[action](resource).granted) {
-                out.add(`${resource}::${action}`);
-            }
-        }
-    }
-    return out;
-}
-//# sourceMappingURL=impersonation.js.map

package/lib/cjs/impersonation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../../src/impersonation.ts"],"names":[],"mappings":";;AAqCA,wCAoCC;AAjDD;;;;;;;;;;;;GAYG;AACH,SAAgB,cAAc,CAAC,IAAgC;IAC7D,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEhE,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,CAAC,KAAe,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,sBAAsB;IACtB,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,EAAiB,EAAE,KAAe;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEnC,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAqH;QAChI,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;KACnG,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GAAG,CAAa;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,sEAAsE;YACtE,qEAAqE;YACrE,kCAAkC;YAClC,IAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/mjs/events/UserImpersonationEnded.d.ts

@@ -1,12 +0,0 @@
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when an active impersonation ends (explicit stop, logout while
- * impersonating, or session expiry handling). UserUUID is the impersonator
- * who initiated the impersonation; TargetUUID is whoever they were acting as.
- */
-export declare class UserImpersonationEnded extends UserEvent {
-    TargetUUID: string;
-    constructor(original: User, target: User);
-}
-//# sourceMappingURL=UserImpersonationEnded.d.ts.map

package/lib/mjs/events/UserImpersonationEnded.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationEnded.d.ts","sourceRoot":"","sources":["../../../src/events/UserImpersonationEnded.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,qBACa,sBAAuB,SAAQ,SAAS;IAC5C,UAAU,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;CAIzC"}

package/lib/mjs/events/UserImpersonationEnded.js

@@ -1,29 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Event } from '@spinajs/queue';
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when an active impersonation ends (explicit stop, logout while
- * impersonating, or session expiry handling). UserUUID is the impersonator
- * who initiated the impersonation; TargetUUID is whoever they were acting as.
- */
-let UserImpersonationEnded = class UserImpersonationEnded extends UserEvent {
-    constructor(original, target) {
-        super(original);
-        this.TargetUUID = target.Uuid;
-    }
-};
-UserImpersonationEnded = __decorate([
-    Event(),
-    __metadata("design:paramtypes", [User, User])
-], UserImpersonationEnded);
-export { UserImpersonationEnded };
-//# sourceMappingURL=UserImpersonationEnded.js.map

package/lib/mjs/events/UserImpersonationEnded.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationEnded.js","sourceRoot":"","sources":["../../../src/events/UserImpersonationEnded.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,SAAS;IAGnD,YAAY,QAAc,EAAE,MAAY;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;CACF,CAAA;AAPY,sBAAsB;IADlC,KAAK,EAAE;qCAIgB,IAAI,EAAU,IAAI;GAH7B,sBAAsB,CAOlC"}

package/lib/mjs/events/UserImpersonationStarted.d.ts

@@ -1,12 +0,0 @@
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when `original` starts impersonating `target`. UserUUID (from the
- * base class) holds the impersonator's UUID — the actor who triggered the
- * event — and TargetUUID holds whoever they impersonated.
- */
-export declare class UserImpersonationStarted extends UserEvent {
-    TargetUUID: string;
-    constructor(original: User, target: User);
-}
-//# sourceMappingURL=UserImpersonationStarted.d.ts.map

package/lib/mjs/events/UserImpersonationStarted.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationStarted.d.ts","sourceRoot":"","sources":["../../../src/events/UserImpersonationStarted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,qBACa,wBAAyB,SAAQ,SAAS;IAC9C,UAAU,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;CAIzC"}

package/lib/mjs/events/UserImpersonationStarted.js

@@ -1,29 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Event } from '@spinajs/queue';
-import { UserEvent } from './UserEvent.js';
-import { User } from '../models/User.js';
-/**
- * Emitted when `original` starts impersonating `target`. UserUUID (from the
- * base class) holds the impersonator's UUID — the actor who triggered the
- * event — and TargetUUID holds whoever they impersonated.
- */
-let UserImpersonationStarted = class UserImpersonationStarted extends UserEvent {
-    constructor(original, target) {
-        super(original);
-        this.TargetUUID = target.Uuid;
-    }
-};
-UserImpersonationStarted = __decorate([
-    Event(),
-    __metadata("design:paramtypes", [User, User])
-], UserImpersonationStarted);
-export { UserImpersonationStarted };
-//# sourceMappingURL=UserImpersonationStarted.js.map

package/lib/mjs/events/UserImpersonationStarted.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserImpersonationStarted.js","sourceRoot":"","sources":["../../../src/events/UserImpersonationStarted.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,SAAS;IAGrD,YAAY,QAAc,EAAE,MAAY;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;CACF,CAAA;AAPY,wBAAwB;IADpC,KAAK,EAAE;qCAIgB,IAAI,EAAU,IAAI;GAH7B,wBAAwB,CAOpC"}

package/lib/mjs/impersonation.d.ts

@@ -1,32 +0,0 @@
-import { AccessControl } from 'accesscontrol';
-export type ImpersonationDenialReason = 'PROTECTED_ROLE' | 'PRIVILEGE_ESCALATION' | 'SELF_TARGET';
-export interface IImpersonationCheckOptions {
-    /** Roles of the user who wants to impersonate */
-    originalRoles: string[];
-    /** Roles of the target user */
-    targetRoles: string[];
-    /** Roles that may never be impersonated (default: ['system']) */
-    protectedRoles: string[];
-    /** AccessControl instance — used to compare effective grants */
-    ac: AccessControl;
-}
-export interface IImpersonationCheckResult {
-    allowed: boolean;
-    reason?: ImpersonationDenialReason;
-    detail?: string;
-}
-/**
- * Decides whether `originalRoles` may impersonate a user with `targetRoles`.
- *
- * Rules:
- *  1. If target has any role in `protectedRoles` → denied (PROTECTED_ROLE).
- *  2. If target has any effective grant the original does NOT have, that's an
- *     escalation and impersonation is denied (PRIVILEGE_ESCALATION). This
- *     blocks equal-or-higher targets — admin cannot impersonate admin, user
- *     cannot impersonate admin, but admin can impersonate user.
- *
- * The grant comparison walks accesscontrol's resolved grants, so $extend is
- * honored transitively.
- */
-export declare function canImpersonate(opts: IImpersonationCheckOptions): IImpersonationCheckResult;
-//# sourceMappingURL=impersonation.d.ts.map

package/lib/mjs/impersonation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonation.d.ts","sourceRoot":"","sources":["../../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAElG,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,iEAAiE;IACjE,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,gEAAgE;IAChE,EAAE,EAAE,aAAa,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CAoC1F"}

package/lib/mjs/impersonation.js

@@ -1,94 +0,0 @@
-/**
- * Decides whether `originalRoles` may impersonate a user with `targetRoles`.
- *
- * Rules:
- *  1. If target has any role in `protectedRoles` → denied (PROTECTED_ROLE).
- *  2. If target has any effective grant the original does NOT have, that's an
- *     escalation and impersonation is denied (PRIVILEGE_ESCALATION). This
- *     blocks equal-or-higher targets — admin cannot impersonate admin, user
- *     cannot impersonate admin, but admin can impersonate user.
- *
- * The grant comparison walks accesscontrol's resolved grants, so $extend is
- * honored transitively.
- */
-export function canImpersonate(opts) {
-    const { originalRoles, targetRoles, protectedRoles, ac } = opts;
-    const protectedHit = targetRoles.find(r => protectedRoles.includes(r));
-    if (protectedHit) {
-        return { allowed: false, reason: 'PROTECTED_ROLE', detail: protectedHit };
-    }
-    // accesscontrol throws if a role is unknown; guard so unknown target roles
-    // (e.g. orphaned data) don't crash the check — treat them as 'no grants'.
-    const safePermissions = (roles) => {
-        try {
-            return collectPermissions(ac, roles);
-        }
-        catch {
-            return new Set();
-        }
-    };
-    const targetPerms = safePermissions(targetRoles);
-    const originalPerms = safePermissions(originalRoles);
-    for (const perm of targetPerms) {
-        if (!originalPerms.has(perm)) {
-            return { allowed: false, reason: 'PRIVILEGE_ESCALATION', detail: perm };
-        }
-    }
-    // Equal privileges count as escalation per the spec: an impersonator should
-    // be strictly more privileged than the target. If target has no role at all
-    // (empty grants) we still allow — impersonating a permissionless user is
-    // safe by definition.
-    if (targetPerms.size > 0 && targetPerms.size === originalPerms.size) {
-        return { allowed: false, reason: 'PRIVILEGE_ESCALATION', detail: 'equal privileges' };
-    }
-    return { allowed: true };
-}
-/**
- * Build a flat set of "resource::action" strings representing every permission
- * granted to the union of `roles`. Used so we can compare two role sets by
- * simple set inclusion.
- */
-function collectPermissions(ac, roles) {
-    const out = new Set();
-    if (roles.length === 0)
-        return out;
-    const grants = ac.getGrants();
-    const actions = [
-        'createAny', 'createOwn', 'readAny', 'readOwn', 'updateAny', 'updateOwn', 'deleteAny', 'deleteOwn',
-    ];
-    // Resources are not enumerable directly via the can() API — read them from
-    // the raw grants map and walk every $extend chain reachable from `roles`.
-    const visited = new Set();
-    const stack = [...roles];
-    const resources = new Set();
-    while (stack.length) {
-        const role = stack.pop();
-        if (visited.has(role))
-            continue;
-        visited.add(role);
-        const roleGrants = grants[role];
-        if (!roleGrants)
-            continue;
-        for (const key of Object.keys(roleGrants)) {
-            if (key === '$extend') {
-                for (const inherited of roleGrants[key])
-                    stack.push(inherited);
-            }
-            else {
-                resources.add(key);
-            }
-        }
-    }
-    for (const resource of resources) {
-        for (const action of actions) {
-            // ac.can(roles)[action](resource).granted is true if ANY of the roles
-            // (or their $extend chain) grants the action — exactly the "union of
-            // effective permissions" we want.
-            if (ac.can(roles)[action](resource).granted) {
-                out.add(`${resource}::${action}`);
-            }
-        }
-    }
-    return out;
-}
-//# sourceMappingURL=impersonation.js.map

package/lib/mjs/impersonation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../../src/impersonation.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgC;IAC7D,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEhE,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,CAAC,KAAe,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,sBAAsB;IACtB,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,EAAiB,EAAE,KAAe;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEnC,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAqH;QAChI,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;KACnG,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GAAG,CAAa;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,sEAAsE;YACtE,qEAAqE;YACrE,kCAAkC;YAClC,IAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}