@spinajs/rbac 2.0.480 → 2.0.482

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/lib/cjs/actions.d.ts.map +1 -1
  2. package/lib/cjs/actions.js +32 -6
  3. package/lib/cjs/actions.js.map +1 -1
  4. package/lib/cjs/cli/ActivateUser.js +1 -1
  5. package/lib/cjs/cli/ActivateUser.js.map +1 -1
  6. package/lib/cjs/cli/BanUser.js +1 -1
  7. package/lib/cjs/cli/BanUser.js.map +1 -1
  8. package/lib/cjs/config/rbac.d.ts +11 -1
  9. package/lib/cjs/config/rbac.d.ts.map +1 -1
  10. package/lib/cjs/config/rbac.js +12 -3
  11. package/lib/cjs/config/rbac.js.map +1 -1
  12. package/lib/cjs/cron/DeactivatePasswords.d.ts.map +1 -1
  13. package/lib/cjs/cron/DeactivatePasswords.js +6 -2
  14. package/lib/cjs/cron/DeactivatePasswords.js.map +1 -1
  15. package/lib/cjs/index.d.ts +6 -0
  16. package/lib/cjs/index.d.ts.map +1 -1
  17. package/lib/cjs/index.js +6 -0
  18. package/lib/cjs/index.js.map +1 -1
  19. package/lib/cjs/interfaces.d.ts +63 -37
  20. package/lib/cjs/interfaces.d.ts.map +1 -1
  21. package/lib/cjs/interfaces.js +43 -1
  22. package/lib/cjs/interfaces.js.map +1 -1
  23. package/lib/cjs/middleware.d.ts +23 -1
  24. package/lib/cjs/middleware.d.ts.map +1 -1
  25. package/lib/cjs/middleware.js +158 -104
  26. package/lib/cjs/middleware.js.map +1 -1
  27. package/lib/cjs/models/User.d.ts.map +1 -1
  28. package/lib/cjs/models/User.js +15 -1
  29. package/lib/cjs/models/User.js.map +1 -1
  30. package/lib/cjs/ownership.d.ts +2 -0
  31. package/lib/cjs/ownership.d.ts.map +1 -0
  32. package/lib/cjs/ownership.js +46 -0
  33. package/lib/cjs/ownership.js.map +1 -0
  34. package/lib/cjs/session-codec.d.ts +15 -0
  35. package/lib/cjs/session-codec.d.ts.map +1 -0
  36. package/lib/cjs/session-codec.js +59 -0
  37. package/lib/cjs/session-codec.js.map +1 -0
  38. package/lib/cjs/session-expiration.d.ts +40 -0
  39. package/lib/cjs/session-expiration.d.ts.map +1 -0
  40. package/lib/cjs/session-expiration.js +93 -0
  41. package/lib/cjs/session-expiration.js.map +1 -0
  42. package/lib/cjs/session.d.ts +38 -18
  43. package/lib/cjs/session.d.ts.map +1 -1
  44. package/lib/cjs/session.js +91 -50
  45. package/lib/cjs/session.js.map +1 -1
  46. package/lib/mjs/actions.d.ts.map +1 -1
  47. package/lib/mjs/actions.js +32 -6
  48. package/lib/mjs/actions.js.map +1 -1
  49. package/lib/mjs/cli/ActivateUser.js +1 -1
  50. package/lib/mjs/cli/ActivateUser.js.map +1 -1
  51. package/lib/mjs/cli/BanUser.js +1 -1
  52. package/lib/mjs/cli/BanUser.js.map +1 -1
  53. package/lib/mjs/config/rbac.d.ts +11 -1
  54. package/lib/mjs/config/rbac.d.ts.map +1 -1
  55. package/lib/mjs/config/rbac.js +12 -3
  56. package/lib/mjs/config/rbac.js.map +1 -1
  57. package/lib/mjs/cron/DeactivatePasswords.d.ts.map +1 -1
  58. package/lib/mjs/cron/DeactivatePasswords.js +6 -2
  59. package/lib/mjs/cron/DeactivatePasswords.js.map +1 -1
  60. package/lib/mjs/index.d.ts +6 -0
  61. package/lib/mjs/index.d.ts.map +1 -1
  62. package/lib/mjs/index.js +6 -0
  63. package/lib/mjs/index.js.map +1 -1
  64. package/lib/mjs/interfaces.d.ts +63 -37
  65. package/lib/mjs/interfaces.d.ts.map +1 -1
  66. package/lib/mjs/interfaces.js +41 -0
  67. package/lib/mjs/interfaces.js.map +1 -1
  68. package/lib/mjs/middleware.d.ts +23 -1
  69. package/lib/mjs/middleware.d.ts.map +1 -1
  70. package/lib/mjs/middleware.js +158 -104
  71. package/lib/mjs/middleware.js.map +1 -1
  72. package/lib/mjs/models/User.d.ts.map +1 -1
  73. package/lib/mjs/models/User.js +15 -1
  74. package/lib/mjs/models/User.js.map +1 -1
  75. package/lib/mjs/ownership.d.ts +2 -0
  76. package/lib/mjs/ownership.d.ts.map +1 -0
  77. package/lib/mjs/ownership.js +44 -0
  78. package/lib/mjs/ownership.js.map +1 -0
  79. package/lib/mjs/session-codec.d.ts +15 -0
  80. package/lib/mjs/session-codec.d.ts.map +1 -0
  81. package/lib/mjs/session-codec.js +55 -0
  82. package/lib/mjs/session-codec.js.map +1 -0
  83. package/lib/mjs/session-expiration.d.ts +40 -0
  84. package/lib/mjs/session-expiration.d.ts.map +1 -0
  85. package/lib/mjs/session-expiration.js +90 -0
  86. package/lib/mjs/session-expiration.js.map +1 -0
  87. package/lib/mjs/session.d.ts +38 -18
  88. package/lib/mjs/session.d.ts.map +1 -1
  89. package/lib/mjs/session.js +89 -47
  90. package/lib/mjs/session.js.map +1 -1
  91. package/lib/tsconfig.cjs.tsbuildinfo +1 -1
  92. package/lib/tsconfig.mjs.tsbuildinfo +1 -1
  93. package/package.json +15 -12
@@ -1,7 +1,27 @@
1
1
  "use strict";
2
+ var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
3
+ var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
4
+ if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
5
+ else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
6
+ return c > 3 && r && Object.defineProperty(target, key, r), r;
7
+ };
8
+ var __metadata = (this && this.__metadata) || function (k, v) {
9
+ if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
10
+ };
2
11
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = void 0;
12
+ exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = exports.SessionExpirationProvider = void 0;
4
13
  const di_1 = require("@spinajs/di");
14
+ const configuration_1 = require("@spinajs/configuration");
15
+ const luxon_1 = require("luxon");
16
+ /**
17
+ * Configurable session expiration strategy. Resolved by config service name at
18
+ * `rbac.session.expiration.service`, mirroring the `rbac.password` pattern.
19
+ *
20
+ * Units for all shipped strategies are MINUTES.
21
+ */
22
+ class SessionExpirationProvider {
23
+ }
24
+ exports.SessionExpirationProvider = SessionExpirationProvider;
5
25
  /**
6
26
  * Service used for generating random password & for hash raw string
7
27
  */
@@ -28,8 +48,30 @@ class FederatedAuthProvider {
28
48
  }
29
49
  exports.FederatedAuthProvider = FederatedAuthProvider;
30
50
  class SessionProvider extends di_1.AsyncService {
51
+ /**
52
+ * Sets the initial expiration on a freshly created session.
53
+ */
54
+ applyInitialExpiration(s) {
55
+ s.Expiration = this.Expiration.initial(s);
56
+ }
57
+ /**
58
+ * Sets the renewed expiration on a session being touched.
59
+ */
60
+ applyRenewedExpiration(s) {
61
+ s.Expiration = this.Expiration.renew(s);
62
+ }
63
+ /**
64
+ * True when the session carries an expiration in the past.
65
+ */
66
+ isExpired(s) {
67
+ return !!s.Expiration && s.Expiration <= luxon_1.DateTime.now();
68
+ }
31
69
  }
32
70
  exports.SessionProvider = SessionProvider;
71
+ __decorate([
72
+ (0, configuration_1.AutoinjectService)('rbac.session.expiration'),
73
+ __metadata("design:type", SessionExpirationProvider)
74
+ ], SessionProvider.prototype, "Expiration", void 0);
33
75
  var AthenticationErrorCodes;
34
76
  (function (AthenticationErrorCodes) {
35
77
  AthenticationErrorCodes[AthenticationErrorCodes["E_USER_BANNED"] = 1] = "E_USER_BANNED";
@@ -1 +1 @@
1
- {"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AACA,oCAA2C;AA2E3C;;GAEG;AACH,MAAsB,gBAAgB;CAsBrC;AAtBD,4CAsBC;AAED;;;;;GAKG;AACH,MAAsB,YAAY;CAgEjC;AAhED,oCAgEC;AAED;;;;;;GAMG;AACH,MAAsB,qBAAqB;CAwB1C;AAxBD,sDAwBC;AAED,MAAsB,eAA8B,SAAQ,iBAAY;CAwDvE;AAxDD,0CAwDC;AAED,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,uFAAiB,CAAA;IACjB,+FAAqB,CAAA;IACrB,uGAAyB,CAAA;IACzB,+GAA6B,CAAA;AAC/B,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAUD;;GAEG;AACH,MAAsB,0BAA0B;CAE/C;AAFD,gEAEC;AAGD,MAAa,WAAW;IAItB,YAAmB,IAAW,EAAE,IAAU;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AARD,kCAQC;AAED;;;;;GAKG;AACH,MAAsB,mBAAmB;CAExC;AAFD,kDAEC"}
1
+ {"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAA2C;AAC3C,0DAA2D;AAE3D,iCAAiC;AAkEjC;;;;;GAKG;AACH,MAAsB,yBAAyB;CAU9C;AAVD,8DAUC;AAED;;GAEG;AACH,MAAsB,gBAAgB;CAsBrC;AAtBD,4CAsBC;AAED;;;;;GAKG;AACH,MAAsB,YAAY;CAgEjC;AAhED,oCAgEC;AAED;;;;;;GAMG;AACH,MAAsB,qBAAqB;CAwB1C;AAxBD,sDAwBC;AAED,MAAsB,eAA+C,SAAQ,iBAAY;IA8DvF;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACO,SAAS,CAAC,CAAW;QAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;CACF;AAlFD,0CAkFC;AA3EW;IADT,IAAA,iCAAiB,EAAC,yBAAyB,CAAC;8BACtB,yBAAyB;mDAAC;AA6EnD,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,uFAAiB,CAAA;IACjB,+FAAqB,CAAA;IACrB,uGAAyB,CAAA;IACzB,+GAA6B,CAAA;AAC/B,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAUD;;GAEG;AACH,MAAsB,0BAA0B;CAE/C;AAFD,gEAEC;AAGD,MAAa,WAAW;IAItB,YAAmB,IAAW,EAAE,IAAU;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AARD,kCAQC;AAED;;;;;GAKG;AACH,MAAsB,mBAAmB;CAExC;AAFD,kDAEC"}
@@ -1,10 +1,32 @@
1
1
  import { QueryBuilder, QueryMiddleware } from '@spinajs/orm';
2
+ import { IRbacModelDescriptor } from './interfaces.js';
2
3
  import { AccessControl } from 'accesscontrol';
3
4
  import { Log } from '@spinajs/log-common';
4
5
  export declare class RbacModelPermissionMiddleware extends QueryMiddleware {
5
6
  protected Log: Log;
6
7
  protected Ac: AccessControl;
7
- beforeQueryExecution(_query: QueryBuilder<any>): void;
8
+ /**
9
+ * INSERT is enforced here rather than in `afterQueryCreation` because the row payload does
10
+ * not exist at construction time — `values()` is called afterwards and would overwrite an
11
+ * owner column stamped earlier. Reads and writes keep their where-clause injection at
12
+ * construction, where it has always been.
13
+ */
14
+ beforeQueryExecution(builder: QueryBuilder<any>): void;
8
15
  afterQueryCreation(builder: QueryBuilder): void;
16
+ /**
17
+ * Everything both hooks need, or `undefined` when this query is not subject to a check.
18
+ *
19
+ * Shared so the two hooks cannot drift on who is exempt: no async context, no user, an
20
+ * explicit skip flag, a model with no `@Resource()`, or a declared `PermissionScope` that
21
+ * does not match this builder type.
22
+ */
23
+ protected context(builder: QueryBuilder): {
24
+ descriptor: IRbacModelDescriptor;
25
+ resource: string;
26
+ canOwn: boolean;
27
+ canAny: boolean;
28
+ action: string;
29
+ user: import("./index.js").User;
30
+ } | undefined;
9
31
  }
10
32
  //# sourceMappingURL=middleware.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;AAGnL,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,qBAAqB,CAAC;AA4BlD,qBACa,6BAA8B,SAAQ,eAAe;IAGhE,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,EAAE,EAAG,aAAa,CAAC;IAE7B,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI;IACrD,kBAAkB,CAAC,OAAO,EAAE,YAAY;CAwFzC"}
1
+ {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;AAEnL,OAAO,EAAqB,oBAAoB,EAAkB,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,qBAAqB,CAAC;AA4ClD,qBACa,6BAA8B,SAAQ,eAAe;IAGhE,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,EAAE,EAAG,aAAa,CAAC;IAE7B;;;;;OAKG;IACH,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI;IA8BtD,kBAAkB,CAAC,OAAO,EAAE,YAAY;IA6CxC;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY;;;;;;;;CAoExC"}
@@ -16,115 +16,169 @@ const async_hooks_1 = require("async_hooks");
16
16
  const accesscontrol_1 = require("accesscontrol");
17
17
  const exceptions_1 = require("@spinajs/exceptions");
18
18
  const log_common_1 = require("@spinajs/log-common");
19
- const QUERY_TO_PERMISSION = {
20
- DeleteQueryBuilder: {
21
- own: "deleteOwn",
22
- all: "deleteAny"
23
- },
24
- UpdateQueryBuilder: {
25
- own: "updateOwn",
26
- all: "updateAny"
27
- },
28
- SelectQueryBuilder: {
29
- own: "readOwn",
30
- all: "readAny"
19
+ /**
20
+ * Which permission scopes a builder type is checked against.
21
+ *
22
+ * Keyed on the CONSTRUCTOR, not on `constructor.name`. A name-keyed lookup breaks under
23
+ * minification and silently yields "no mapping" — for a security check that means an
24
+ * unguarded query, which is why `IdentityMap` rejects name keys for the same reason (A9).
25
+ *
26
+ * `InsertQueryBuilder` was missing here while `PERMISSION_SCOPE_TO_QUERY` claimed to
27
+ * support `createOwn`/`createAny`, so the insert branch of the middleware could only ever
28
+ * have thrown a TypeError. The inverse map below is now DERIVED from this one, so the two
29
+ * cannot drift apart again.
30
+ */
31
+ const QUERY_TO_PERMISSION = new Map([
32
+ [orm_1.DeleteQueryBuilder, { own: 'deleteOwn', all: 'deleteAny' }],
33
+ [orm_1.UpdateQueryBuilder, { own: 'updateOwn', all: 'updateAny' }],
34
+ [orm_1.SelectQueryBuilder, { own: 'readOwn', all: 'readAny' }],
35
+ [orm_1.InsertQueryBuilder, { own: 'createOwn', all: 'createAny' }],
36
+ ]);
37
+ /** Derived inverse of {@link QUERY_TO_PERMISSION}. Never hand-maintained. */
38
+ const PERMISSION_SCOPE_TO_QUERY = new Map();
39
+ for (const [ctor, scopes] of QUERY_TO_PERMISSION) {
40
+ PERMISSION_SCOPE_TO_QUERY.set(scopes.own, ctor);
41
+ PERMISSION_SCOPE_TO_QUERY.set(scopes.all, ctor);
42
+ }
43
+ /**
44
+ * The permission scopes for `builder`, matched by `instanceof` so a driver-specific
45
+ * subclass resolves to its base builder's scopes instead of falling off the map.
46
+ */
47
+ function permissionsFor(builder) {
48
+ for (const [ctor, scopes] of QUERY_TO_PERMISSION) {
49
+ if (builder instanceof ctor) {
50
+ return scopes;
51
+ }
31
52
  }
32
- };
33
- const PERMISSION_SCOPE_TO_QUERY = {
34
- deleteOwn: "DeleteQueryBuilder",
35
- deleteAny: "DeleteQueryBuilder",
36
- updateOwn: "UpdateQueryBuilder",
37
- updateAny: "UpdateQueryBuilder",
38
- readOwn: "SelectQueryBuilder",
39
- readAny: "SelectQueryBuilder",
40
- createOwn: "InsertQueryBuilder",
41
- createAny: "InsertQueryBuilder"
42
- };
53
+ return undefined;
54
+ }
43
55
  let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends orm_1.QueryMiddleware {
44
- beforeQueryExecution(_query) { }
56
+ /**
57
+ * INSERT is enforced here rather than in `afterQueryCreation` because the row payload does
58
+ * not exist at construction time — `values()` is called afterwards and would overwrite an
59
+ * owner column stamped earlier. Reads and writes keep their where-clause injection at
60
+ * construction, where it has always been.
61
+ */
62
+ beforeQueryExecution(builder) {
63
+ if (!(builder instanceof orm_1.InsertQueryBuilder)) {
64
+ return;
65
+ }
66
+ const context = this.context(builder);
67
+ if (!context) {
68
+ return;
69
+ }
70
+ const { descriptor, resource, canOwn, canAny } = context;
71
+ if (canAny) {
72
+ this.Log.trace(`Resource ${resource}:any insert permission granted`);
73
+ return;
74
+ }
75
+ if (!canOwn) {
76
+ throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
77
+ }
78
+ if (!descriptor.OwnerField) {
79
+ this.Log.error(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
80
+ throw new orm_1.OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
81
+ }
82
+ // Overwrite, never merge: a caller-supplied owner id is exactly the IDOR this closes.
83
+ builder.forceColumn(descriptor.OwnerField, context.user.PrimaryKeyValue);
84
+ }
45
85
  afterQueryCreation(builder) {
46
- if (typeof async_hooks_1.AsyncLocalStorage === 'function') {
47
- const store = di_1.DI.get(async_hooks_1.AsyncLocalStorage);
48
- if (store) {
49
- const storage = store.getStore();
50
- if (storage && storage.SkipModelPermissionCheck) {
51
- this.Log.trace(`Model permission check disabled for current execution context, skipping rbac check`);
52
- return;
53
- }
54
- if (storage && storage.User) {
55
- // add where statement
56
- const descriptor = (0, orm_1.extractModelDescriptor)(builder.Model);
57
- // if model does not have @Resource() decorator set, model name is used
58
- const resource = descriptor.RbacResource; // ?? descriptor.Name; // temporarly remove resource assign
59
- // no rbac is set do nothing
60
- if (!resource) {
61
- return;
62
- }
63
- if (storage?.PermissionScope) {
64
- if (!PERMISSION_SCOPE_TO_QUERY[storage.PermissionScope]) {
65
- this.Log.warn(`Permission scope ${storage.PermissionScope} does not match any query type, skipping rbac check`);
66
- return;
67
- }
68
- if (builder.constructor.name !== PERMISSION_SCOPE_TO_QUERY[storage.PermissionScope]) {
69
- this.Log.warn(`Permission scope ${storage.PermissionScope} does not match query type ${builder.constructor.name}, skipping rbac check`);
70
- return;
71
- }
72
- }
73
- const ownScope = storage?.PermissionScope ?? QUERY_TO_PERMISSION[builder.constructor.name].own;
74
- const anyScope = storage?.PermissionScope ?? QUERY_TO_PERMISSION[builder.constructor.name].all;
75
- const roles = storage.ActiveRole ? [storage.ActiveRole] : storage.User.Role;
76
- let canAny = false;
77
- let canOwn = false;
78
- try {
79
- canAny = this.Ac.can(roles)[anyScope](resource).granted;
80
- canOwn = this.Ac.can(roles)[ownScope](resource).granted;
81
- }
82
- catch (err) {
83
- // accesscontrol throws eg. "Role not found" when role has no grants registered
84
- // treat as no permission so caller gets Forbidden instead of library error
85
- this.Log.trace(`Permission check for roles ${roles} on resource ${resource} failed: ${err.message}, treating as no permission`);
86
- }
87
- if (builder instanceof orm_1.SelectQueryBuilder || builder instanceof orm_1.UpdateQueryBuilder || builder instanceof orm_1.DeleteQueryBuilder) {
88
- /**
89
- * Model can have custom rbac permission check
90
- */
91
- const rbacFunc = builder.Model?.rbac;
92
- if (canAny) {
93
- this.Log.trace(`Resource ${resource}:any permission granted for ${storage.User.Role}, scope: ${storage.PermissionScope}`);
94
- return;
95
- }
96
- else if (canOwn) {
97
- this.Log.trace(`Resource ${resource}:own permission granted for ${storage.User.Role}, scope: ${storage.PermissionScope}`);
98
- if (rbacFunc) {
99
- this.Log.trace(`Applying custom rbac func for ${resource}`);
100
- rbacFunc.call(builder, storage.User);
101
- }
102
- else if (descriptor.OwnerField) {
103
- this.Log.trace(`Applying owner field restriction for ${resource}`);
104
- builder.andWhere(descriptor.OwnerField, storage.User.PrimaryKeyValue);
105
- }
106
- else {
107
- this.Log.error(`Model ${descriptor.Name} does not have OwnerField set or static rbac function, cannot apply :own permission`);
108
- throw new orm_1.OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
109
- }
110
- }
111
- else {
112
- throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:read permission`);
113
- }
114
- }
115
- else if (builder instanceof orm_1.InsertQueryBuilder) {
116
- if (canOwn) {
117
- builder.values({
118
- [descriptor.OwnerField]: storage.User.PrimaryKeyValue
119
- });
120
- }
121
- else if (!canAny) {
122
- throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:insert permission`);
123
- }
124
- }
125
- }
86
+ // Insert is handled at execution time; anything else without a WHERE clause to constrain
87
+ // is not something this middleware knows how to guard.
88
+ if (!(builder instanceof orm_1.SelectQueryBuilder || builder instanceof orm_1.UpdateQueryBuilder || builder instanceof orm_1.DeleteQueryBuilder)) {
89
+ return;
90
+ }
91
+ const context = this.context(builder);
92
+ if (!context) {
93
+ return;
94
+ }
95
+ const { descriptor, resource, canOwn, canAny } = context;
96
+ if (canAny) {
97
+ this.Log.trace(`Resource ${resource}:any permission granted`);
98
+ return;
99
+ }
100
+ if (!canOwn) {
101
+ throw new exceptions_1.Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
102
+ }
103
+ this.Log.trace(`Resource ${resource}:own permission granted`);
104
+ /**
105
+ * Model can have custom rbac permission check
106
+ */
107
+ const rbacFunc = builder.Model?.rbac;
108
+ if (rbacFunc) {
109
+ this.Log.trace(`Applying custom rbac func for ${resource}`);
110
+ rbacFunc.call(builder, context.user);
111
+ return;
112
+ }
113
+ if (!descriptor.OwnerField) {
114
+ this.Log.error(`Model ${descriptor.Name} does not have OwnerField set or static rbac function, cannot apply :own permission`);
115
+ throw new orm_1.OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
116
+ }
117
+ this.Log.trace(`Applying owner field restriction for ${resource}`);
118
+ builder.andWhere(descriptor.OwnerField, context.user.PrimaryKeyValue);
119
+ }
120
+ /**
121
+ * Everything both hooks need, or `undefined` when this query is not subject to a check.
122
+ *
123
+ * Shared so the two hooks cannot drift on who is exempt: no async context, no user, an
124
+ * explicit skip flag, a model with no `@Resource()`, or a declared `PermissionScope` that
125
+ * does not match this builder type.
126
+ */
127
+ context(builder) {
128
+ if (typeof async_hooks_1.AsyncLocalStorage !== 'function') {
129
+ return undefined;
130
+ }
131
+ const store = di_1.DI.get(async_hooks_1.AsyncLocalStorage);
132
+ const storage = store?.getStore();
133
+ if (!storage || !storage.User) {
134
+ return undefined;
135
+ }
136
+ if (storage.SkipModelPermissionCheck) {
137
+ this.Log.trace(`Model permission check disabled for current execution context, skipping rbac check`);
138
+ return undefined;
139
+ }
140
+ const descriptor = (0, orm_1.extractModelDescriptor)(builder.Model);
141
+ // if model does not have @Resource() decorator set, no rbac is applied
142
+ const resource = descriptor?.RbacResource;
143
+ if (!resource) {
144
+ return undefined;
145
+ }
146
+ const scopes = permissionsFor(builder);
147
+ if (!scopes) {
148
+ // An unmapped builder type reaching a security middleware means an unguarded query.
149
+ // Fail loudly rather than let it through — the previous code read `.own` off
150
+ // `undefined` here and died with a bare TypeError.
151
+ throw new orm_1.OrmException(`rbac cannot check permissions for query builder ${builder.constructor.name}: no permission mapping registered`);
152
+ }
153
+ if (storage.PermissionScope) {
154
+ const expected = PERMISSION_SCOPE_TO_QUERY.get(storage.PermissionScope);
155
+ if (!expected) {
156
+ this.Log.warn(`Permission scope ${storage.PermissionScope} does not match any query type, skipping rbac check`);
157
+ return undefined;
126
158
  }
159
+ if (!(builder instanceof expected)) {
160
+ this.Log.warn(`Permission scope ${storage.PermissionScope} does not match query type ${builder.constructor.name}, skipping rbac check`);
161
+ return undefined;
162
+ }
163
+ }
164
+ const ownScope = storage.PermissionScope ?? scopes.own;
165
+ const anyScope = storage.PermissionScope ?? scopes.all;
166
+ const roles = storage.ActiveRole ? [storage.ActiveRole] : storage.User.Role;
167
+ let canAny = false;
168
+ let canOwn = false;
169
+ try {
170
+ canAny = this.Ac.can(roles)[anyScope](resource).granted;
171
+ canOwn = this.Ac.can(roles)[ownScope](resource).granted;
172
+ }
173
+ catch (err) {
174
+ // accesscontrol throws eg. "Role not found" when role has no grants registered
175
+ // treat as no permission so caller gets Forbidden instead of library error
176
+ this.Log.trace(`Permission check for roles ${roles} on resource ${resource} failed: ${err.message}, treating as no permission`);
127
177
  }
178
+ // 'readOwn' -> 'read'. Keeps the Forbidden message accurate per builder type instead of
179
+ // the old hard-coded ':read', which was wrong for updates and deletes.
180
+ const action = anyScope.replace(/(Any|Own)$/, '');
181
+ return { descriptor, resource, canOwn, canAny, action, user: storage.User };
128
182
  }
129
183
  };
130
184
  exports.RbacModelPermissionMiddleware = RbacModelPermissionMiddleware;
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyD;AACzD,sCAAmL;AACnL,6CAAgD;AAEhD,iDAA8C;AAC9C,oDAAgD;AAChD,oDAAkD;AAElD,MAAM,mBAAmB,GAAG;IAC1B,kBAAkB,EAAE;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;KACjB;IACD,kBAAkB,EAAE;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;KACjB;IACD,kBAAkB,EAAE;QAClB,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,SAAS;KACf;CACF,CAAA;AAED,MAAM,yBAAyB,GAAG;IAChC,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,oBAAoB;IAC7B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;CAChC,CAAA;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,qBAAe;IAQhE,oBAAoB,CAAC,MAAyB,IAAU,CAAC;IACzD,kBAAkB,CAAC,OAAqB;QACtC,IAAI,OAAO,+BAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAE,CAAC,GAAG,CAAC,+BAAiB,CAAC,CAAC;YACxC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAuB,CAAC;gBAEtD,IAAI,OAAO,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;oBAChD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;oBACrG,OAAO;gBACT,CAAC;gBAED,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBAC5B,sBAAsB;oBACtB,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;oBAEjF,uEAAuE;oBACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,2DAA2D;oBAErG,4BAA4B;oBAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;wBAC7B,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;4BACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,qDAAqD,CAAC,CAAC;4BAChH,OAAO;wBACT,CAAC;wBAED,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;4BACpF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,8BAA8B,OAAO,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,CAAC;4BACxI,OAAO;wBACT,CAAC;oBACH,CAAC;oBAED,MAAM,QAAQ,GAAG,OAAO,EAAE,eAAe,IAAK,mBAA2B,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;oBACxG,MAAM,QAAQ,GAAG,OAAO,EAAE,eAAe,IAAK,mBAA2B,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;oBACxG,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAE5E,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,CAAC;wBACH,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;wBAClE,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;oBACpE,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,+EAA+E;wBAC/E,2EAA2E;wBAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,KAAK,gBAAgB,QAAQ,YAAa,GAAa,CAAC,OAAO,6BAA6B,CAAC,CAAC;oBAC7I,CAAC;oBAGD,IAAI,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,EAAE,CAAC;wBAE5H;;2BAEG;wBACH,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAa,EAAE,IAAgB,CAAC;wBAC1D,IAAI,MAAM,EAAE,CAAC;4BACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;4BAC1H,OAAO;wBACT,CAAC;6BAAM,IAAI,MAAM,EAAE,CAAC;4BAClB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;4BAC1H,IAAI,QAAQ,EAAE,CAAC;gCACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;gCAC5D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;4BACvC,CAAC;iCAAM,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gCACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;gCACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BACxE,CAAC;iCAAM,CAAC;gCACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,qFAAqF,CAAC,CAAC;gCAAC,MAAM,IAAI,kBAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;4BAC/O,CAAC;wBACH,CAAC;6BACI,CAAC;4BACJ,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,kBAAkB,CAAC,CAAC;wBAC7F,CAAC;oBACH,CAAC;yBAAM,IAAI,OAAO,YAAY,wBAAkB,EAAE,CAAC;wBACjD,IAAI,MAAM,EAAE,CAAC;4BACX,OAAO,CAAC,MAAM,CAAC;gCACb,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;6BACtD,CAAC,CAAC;wBACL,CAAC;6BAAM,IAAI,CAAC,MAAM,EAAE,CAAC;4BACnB,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,oBAAoB,CAAC,CAAC;wBAC/F,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AAjGY,sEAA6B;AAG9B;IADT,IAAA,mBAAM,EAAC,MAAM,CAAC;8BACC,gBAAG;0DAAC;AAGV;IADT,IAAA,eAAU,GAAE;8BACE,6BAAa;yDAAC;wCANlB,6BAA6B;IADzC,IAAA,eAAU,EAAC,qBAAe,CAAC;GACf,6BAA6B,CAiGzC"}
1
+ {"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyD;AACzD,sCAAmL;AACnL,6CAAgD;AAEhD,iDAA8C;AAC9C,oDAAgD;AAChD,oDAAkD;AAIlD;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAiE;IAClG,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvF,CAAC,wBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;CAC5F,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;IACjD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAqB;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,IAAI,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,qBAAe;IAQhE;;;;;OAKG;IACH,oBAAoB,CAAC,OAA0B;QAC7C,IAAI,CAAC,CAAC,OAAO,YAAY,wBAAkB,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;YACtG,MAAM,IAAI,kBAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,sFAAsF;QACtF,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,kBAAkB,CAAC,OAAqB;QACtC,yFAAyF;QACzF,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,IAAI,OAAO,YAAY,wBAAkB,CAAC,EAAE,CAAC;YAC/H,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;QAE9D;;WAEG;QACH,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAa,EAAE,IAAgB,CAAC;QAE1D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,qFAAqF,CAAC,CAAC;YAC9H,MAAM,IAAI,kBAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACO,OAAO,CAAC,OAAqB;QACrC,IAAI,OAAO,+BAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,OAAE,CAAC,GAAG,CAAC,+BAAiB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAmC,CAAC;QAEnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACrG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;QAEjF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oFAAoF;YACpF,6EAA6E;YAC7E,mDAAmD;YACnD,MAAM,IAAI,kBAAY,CAAC,mDAAmD,OAAO,CAAC,WAAW,CAAC,IAAI,oCAAoC,CAAC,CAAC;QAC1I,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,qDAAqD,CAAC,CAAC;gBAChH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,8BAA+B,OAAwB,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,CAAC;gBAC1J,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAE5E,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAClE,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+EAA+E;YAC/E,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,KAAK,gBAAgB,QAAQ,YAAa,GAAa,CAAC,OAAO,6BAA6B,CAAC,CAAC;QAC7I,CAAC;QAED,wFAAwF;QACxF,uEAAuE;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAElD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9E,CAAC;CACF,CAAA;AApKY,sEAA6B;AAG9B;IADT,IAAA,mBAAM,EAAC,MAAM,CAAC;8BACC,gBAAG;0DAAC;AAGV;IADT,IAAA,eAAU,GAAE;8BACE,6BAAa;yDAAC;wCANlB,6BAA6B;IADzC,IAAA,eAAU,EAAC,qBAAe,CAAC;GACf,6BAA6B,CAoKzC"}
@@ -1 +1 @@
1
- {"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAEhD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAejE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAa7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,CAE7B;IAEM,sBAAsB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAcpF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAO5D;;;;OAIG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;WAItB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,SAAS,CAAC,IAAI,EAAE,MAAM;IAMpC;;;;;OAKG;WACW,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAGxD;AAED;;GAEG;AACH,qBAEa,IAAK,SAAQ,QAAQ;CAEjC"}
1
+ {"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAEhD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAejE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAa7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,CAoB7B;IAEM,sBAAsB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAcpF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAO5D;;;;OAIG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;WAItB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,SAAS,CAAC,IAAI,EAAE,MAAM;IAMpC;;;;;OAKG;WACW,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAGxD;AAED;;GAEG;AACH,qBAEa,IAAK,SAAQ,QAAQ;CAEjC"}
@@ -168,7 +168,21 @@ let UserBase = UserBase_1 = class UserBase extends orm_1.ModelBase {
168
168
  return this.Role.indexOf('guest') !== -1 || this.Role.length === 0;
169
169
  }
170
170
  get IsBanned() {
171
- return this.Metadata[USER_COMMON_METADATA.USER_BAN_IS_BANNED] === true;
171
+ if (this.Metadata[USER_COMMON_METADATA.USER_BAN_IS_BANNED] !== true) {
172
+ return false;
173
+ }
174
+ const start = this.Metadata[USER_COMMON_METADATA.USER_BAN_START_DATE];
175
+ const duration = this.Metadata[USER_COMMON_METADATA.USER_BAN_DURATION];
176
+ // no start/duration recorded -> treat as a permanent ban
177
+ if (!start || duration === null || duration === undefined) {
178
+ return true;
179
+ }
180
+ const startDt = start instanceof luxon_1.DateTime ? start : luxon_1.DateTime.fromISO(String(start));
181
+ if (!startDt.isValid) {
182
+ return true;
183
+ }
184
+ // ban is still active only until start + duration (seconds) elapses
185
+ return startDt.plus({ seconds: Number(duration) }) > luxon_1.DateTime.now();
172
186
  }
173
187
  dehydrateWithRelations(options) {
174
188
  const base = super.dehydrateWithRelations(options);
@@ -1 +1 @@
1
- {"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAE1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAA;QAGhB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,cAAO,GAAE,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzH,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,UAAU,KAAK,QAAQ,EAC9B;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AA3HD,0CA2HC;AAED;;GAEG;AACH,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;AAC7D,CAAC,EA7BW,oBAAoB,oCAApB,oBAAoB,QA6B/B;AAED;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC;IACzE,CAAC;IAEM,sBAAsB,CAAC,OAA2B;QAEvD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAA+C,CAAA;QAEhG;;WAEG;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kCAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAA;QACjG,CAAC;QAED,OAAO,IAAW,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,QAAgB,EAAE,UAAkB;QAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,OAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CAAC,UAA2B;QACrD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;;AAnNU,4BAAQ;AAUI,qBAAY,GAAoB,IAAI,eAAe,EAAE,AAAzC,CAA0C;AAYtE;IADN,IAAA,aAAO,GAAE;;oCACS;AAoBZ;IADN,IAAA,SAAG,GAAE;;sCACiB;AAMhB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;2CAAC;AAMrB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,gBAAU,GAAE;8BACM,gBAAQ;2CAAC;AAGrB;IADN,IAAA,cAAE,GAAE;8BACgB,gBAAQ;6CAAC;AAiBvB;IAHN,IAAA,aAAO,EAAC,kCAAgB,EAAE;QACzB,UAAU,EAAE,SAAS;KACtB,CAAC;8BACgB,sBAAgB;0CAAyB;mBAhFhD,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;;GACF,QAAQ,CAoNpB;AAED;;GAEG;AAGI,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,QAAQ;CAEjC,CAAA;AAFY,oBAAI;eAAJ,IAAI;IAFhB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;GACF,IAAI,CAEhB"}
1
+ {"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAE1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAA;QAGhB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,cAAO,GAAE,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzH,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,UAAU,KAAK,QAAQ,EAC9B;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AA3HD,0CA2HC;AAED;;GAEG;AACH,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;AAC7D,CAAC,EA7BW,oBAAoB,oCAApB,oBAAoB,QA6B/B;AAED;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAEvE,yDAAyD;QACzD,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IACtE,CAAC;IAEM,sBAAsB,CAAC,OAA2B;QAEvD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAA+C,CAAA;QAEhG;;WAEG;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kCAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAA;QACjG,CAAC;QAED,OAAO,IAAW,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,QAAgB,EAAE,UAAkB;QAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,OAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CAAC,UAA2B;QACrD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;;AArOU,4BAAQ;AAUI,qBAAY,GAAoB,IAAI,eAAe,EAAE,AAAzC,CAA0C;AAYtE;IADN,IAAA,aAAO,GAAE;;oCACS;AAoBZ;IADN,IAAA,SAAG,GAAE;;sCACiB;AAMhB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;2CAAC;AAMrB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,gBAAU,GAAE;8BACM,gBAAQ;2CAAC;AAGrB;IADN,IAAA,cAAE,GAAE;8BACgB,gBAAQ;6CAAC;AAiBvB;IAHN,IAAA,aAAO,EAAC,kCAAgB,EAAE;QACzB,UAAU,EAAE,SAAS;KACtB,CAAC;8BACgB,sBAAgB;0CAAyB;mBAhFhD,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;;GACF,QAAQ,CAsOpB;AAED;;GAEG;AAGI,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,QAAQ;CAEjC,CAAA;AAFY,oBAAI;eAAJ,IAAI;IAFhB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;GACF,IAAI,CAEhB"}
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=ownership.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../src/ownership.ts"],"names":[],"mappings":""}
@@ -0,0 +1,46 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ const orm_1 = require("@spinajs/orm");
4
+ /**
5
+ * Implementation of the ownership helpers declared on `IModelStatic` in
6
+ * `interfaces.ts`. They were previously declared but never implemented, so any
7
+ * call to `Model.ensureOwnership` / `Model.checkOwnership` threw
8
+ * "not a function". They are attached to `ModelBase` so every model gets them.
9
+ *
10
+ * A model participates in ownership checks by decorating its owner column with
11
+ * `@ResourceOwner()`, which sets `OwnerField` on the model descriptor.
12
+ */
13
+ function rbacDescriptor(model) {
14
+ const descriptor = (0, orm_1.extractModelDescriptor)(model);
15
+ if (!descriptor || !descriptor.OwnerField) {
16
+ const name = descriptor?.Name ?? model?.name;
17
+ throw new orm_1.OrmException(`Model ${name} does not have an @ResourceOwner() field, cannot check ownership`);
18
+ }
19
+ return descriptor;
20
+ }
21
+ /**
22
+ * Alters a query so it only returns/updates/deletes rows owned by `user`.
23
+ */
24
+ orm_1.ModelBase.ensureOwnership = function (query, user) {
25
+ const descriptor = rbacDescriptor(this);
26
+ return query.where(descriptor.OwnerField, user.PrimaryKeyValue);
27
+ };
28
+ /**
29
+ * Checks whether a model (or its primary key) is owned by `user`.
30
+ * When passed a loaded model the owner column is compared in memory; when
31
+ * passed a primary key the ownership is verified with a scoped DB query.
32
+ */
33
+ orm_1.ModelBase.checkOwnership = async function (modelOrPrimaryKey, user) {
34
+ const descriptor = rbacDescriptor(this);
35
+ if (modelOrPrimaryKey instanceof orm_1.ModelBase) {
36
+ return modelOrPrimaryKey[descriptor.OwnerField] === user.PrimaryKeyValue;
37
+ }
38
+ // `descriptor.PrimaryKey` is a string[] since the composite-key refactor, so it cannot be
39
+ // handed to `where()` as a column name — that took the whereObject path and filtered on
40
+ // nothing. `wherePk` is the ORM's single home for key predicates and handles both shapes.
41
+ const query = this.query();
42
+ (0, orm_1.wherePk)(query, descriptor, modelOrPrimaryKey);
43
+ const found = await query.where(descriptor.OwnerField, user.PrimaryKeyValue).first();
44
+ return found !== undefined && found !== null;
45
+ };
46
+ //# sourceMappingURL=ownership.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/ownership.ts"],"names":[],"mappings":";;AAAA,sCAAsK;AAItK;;;;;;;;GAQG;AAEH,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,KAAY,CAAyB,CAAC;IAEhF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAK,KAAa,EAAE,IAAI,CAAC;QACtD,MAAM,IAAI,kBAAY,CAAC,SAAS,IAAI,kEAAkE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACF,eAAqD,CAAC,eAAe,GAAG,UAEvE,KAAqF,EACrF,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,OAAQ,KAAa,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;GAIG;AACF,eAAoD,CAAC,cAAc,GAAG,KAAK,WAE1E,iBAAmD,EACnD,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,iBAAiB,YAAY,eAAS,EAAE,CAAC;QAC3C,OAAQ,iBAAyB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC;IACpF,CAAC;IAED,0FAA0F;IAC1F,wFAAwF;IACxF,0FAA0F;IAC1F,MAAM,KAAK,GAAI,IAAY,CAAC,KAAK,EAAE,CAAC;IACpC,IAAA,aAAO,EAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;IAErF,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC,CAAC"}
@@ -0,0 +1,15 @@
1
+ /**
2
+ * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
3
+ * `DateTime` values.
4
+ *
5
+ * @param data - the session data map
6
+ */
7
+ export declare function encodeSessionData(data: Map<string, unknown>): string;
8
+ /**
9
+ * Restores a session `Data` map from a JSON string produced by
10
+ * {@link encodeSessionData}.
11
+ *
12
+ * @param json - the serialized session data
13
+ */
14
+ export declare function decodeSessionData(json: string): Map<string, unknown>;
15
+ //# sourceMappingURL=session-codec.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpE"}