@spinajs/rbac 2.0.481 → 2.0.482

package/lib/cjs/session-codec.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeSessionData = encodeSessionData;
+exports.decodeSessionData = decodeSessionData;
+const luxon_1 = require("luxon");
+const util_1 = require("@spinajs/util");
+/**
+ * Shared session-data serialization codec (fixes B5 — symmetric write/read).
+ *
+ * Persistent session stores (db / dynamodb / redis) use this pair so the
+ * `replacer` used on write and the `reviver` used on read are symmetric and
+ * structural types survive the round-trip:
+ *  - `Map` / `Set` via the shared @spinajs/util replacer/reviver,
+ *  - luxon `DateTime` via a tagged wrapper.
+ *
+ * The in-memory store keeps live objects and does not use this codec.
+ */
+const DATETIME_TAG = 'DateTime';
+/**
+ * `JSON.stringify` replacer. Must read the RAW value from the holder (`this`)
+ * because luxon's `DateTime.prototype.toJSON` would otherwise stringify the
+ * DateTime to an ISO string before we can tag it.
+ */
+function sessionReplacer(key, value) {
+    const raw = this[key];
+    if (raw instanceof luxon_1.DateTime) {
+        return { dataType: DATETIME_TAG, value: raw.toISO() };
+    }
+    return (0, util_1.replacer)(key, value);
+}
+/**
+ * `JSON.parse` reviver paired with {@link sessionReplacer}.
+ */
+function sessionReviver(key, value) {
+    if (value && typeof value === 'object' && value.dataType === DATETIME_TAG) {
+        return luxon_1.DateTime.fromISO(value.value);
+    }
+    return (0, util_1.reviver)(key, value);
+}
+/**
+ * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
+ * `DateTime` values.
+ *
+ * @param data - the session data map
+ */
+function encodeSessionData(data) {
+    return JSON.stringify({ dataType: 'Map', value: Array.from(data.entries()) }, sessionReplacer);
+}
+/**
+ * Restores a session `Data` map from a JSON string produced by
+ * {@link encodeSessionData}.
+ *
+ * @param json - the serialized session data
+ */
+function decodeSessionData(json) {
+    const parsed = JSON.parse(json, sessionReviver);
+    return parsed instanceof Map ? parsed : new Map();
+}
+//# sourceMappingURL=session-codec.js.map

package/lib/cjs/session-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":";;AA8CA,8CAEC;AAQD,8CAGC;AA3DD,iCAAiC;AACjC,wCAAkG;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,gBAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAA,eAAY,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,gBAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAA,cAAW,EAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;AAC/F,CAAC"}

package/lib/cjs/session-expiration.d.ts

@@ -0,0 +1,40 @@
+import { DateTime } from 'luxon';
+import { ISession, SessionExpirationProvider } from './interfaces.js';
+/**
+ * Absolute expiration: the session dies at a fixed instant from creation and is
+ * never extended. `touch` is therefore a no-op (renew returns the current
+ * Expiration unchanged).
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+export declare class AbsoluteExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    initial(session: ISession): DateTime | undefined;
+    renew(session: ISession): DateTime | undefined;
+}
+/**
+ * Sliding expiration: every renewal pushes the expiration to `now + ttl`, with
+ * no upper bound. Activity keeps the session alive indefinitely.
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+export declare class SlidingExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    initial(_session: ISession): DateTime | undefined;
+    renew(_session: ISession): DateTime | undefined;
+}
+/**
+ * Sliding expiration with an absolute cap: renewal pushes the expiration to
+ * `now + ttl` but never past `Creation + maxLifetime`. Combines idle timeout
+ * with a hard session lifetime ceiling.
+ *
+ * Settings: `rbac.session.expiration.ttl` and
+ * `rbac.session.expiration.maxLifetime` (both minutes).
+ */
+export declare class SlidingCappedExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    protected MaxLifetime: number;
+    initial(_session: ISession): DateTime | undefined;
+    renew(session: ISession): DateTime | undefined;
+}
+//# sourceMappingURL=session-expiration.d.ts.map

package/lib/cjs/session-expiration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expiration.d.ts","sourceRoot":"","sources":["../../src/session-expiration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGjC,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;GAMG;AACH,qBACa,kBAAmB,SAAQ,yBAAyB;IAE/D,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAEhB,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIhD,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAItD;AAED;;;;;GAKG;AACH,qBACa,iBAAkB,SAAQ,yBAAyB;IAE9D,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAEhB,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIjD,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAGvD;AAED;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,yBAAyB;IAEpE,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAGvB,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;IAExB,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIjD,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAKtD"}

package/lib/cjs/session-expiration.js

@@ -0,0 +1,93 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlidingCappedExpiration = exports.SlidingExpiration = exports.AbsoluteExpiration = void 0;
+const luxon_1 = require("luxon");
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const interfaces_js_1 = require("./interfaces.js");
+/**
+ * Absolute expiration: the session dies at a fixed instant from creation and is
+ * never extended. `touch` is therefore a no-op (renew returns the current
+ * Expiration unchanged).
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+let AbsoluteExpiration = class AbsoluteExpiration extends interfaces_js_1.SessionExpirationProvider {
+    initial(session) {
+        return session.Creation.plus({ minutes: this.Ttl });
+    }
+    renew(session) {
+        // no slide — keep whatever absolute instant was set at creation
+        return session.Expiration;
+    }
+};
+exports.AbsoluteExpiration = AbsoluteExpiration;
+__decorate([
+    (0, configuration_1.Config)('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], AbsoluteExpiration.prototype, "Ttl", void 0);
+exports.AbsoluteExpiration = AbsoluteExpiration = __decorate([
+    (0, di_1.Injectable)(interfaces_js_1.SessionExpirationProvider)
+], AbsoluteExpiration);
+/**
+ * Sliding expiration: every renewal pushes the expiration to `now + ttl`, with
+ * no upper bound. Activity keeps the session alive indefinitely.
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+let SlidingExpiration = class SlidingExpiration extends interfaces_js_1.SessionExpirationProvider {
+    initial(_session) {
+        return luxon_1.DateTime.now().plus({ minutes: this.Ttl });
+    }
+    renew(_session) {
+        return luxon_1.DateTime.now().plus({ minutes: this.Ttl });
+    }
+};
+exports.SlidingExpiration = SlidingExpiration;
+__decorate([
+    (0, configuration_1.Config)('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], SlidingExpiration.prototype, "Ttl", void 0);
+exports.SlidingExpiration = SlidingExpiration = __decorate([
+    (0, di_1.Injectable)(interfaces_js_1.SessionExpirationProvider)
+], SlidingExpiration);
+/**
+ * Sliding expiration with an absolute cap: renewal pushes the expiration to
+ * `now + ttl` but never past `Creation + maxLifetime`. Combines idle timeout
+ * with a hard session lifetime ceiling.
+ *
+ * Settings: `rbac.session.expiration.ttl` and
+ * `rbac.session.expiration.maxLifetime` (both minutes).
+ */
+let SlidingCappedExpiration = class SlidingCappedExpiration extends interfaces_js_1.SessionExpirationProvider {
+    initial(_session) {
+        return luxon_1.DateTime.now().plus({ minutes: this.Ttl });
+    }
+    renew(session) {
+        const slide = luxon_1.DateTime.now().plus({ minutes: this.Ttl });
+        const cap = session.Creation.plus({ minutes: this.MaxLifetime });
+        return slide < cap ? slide : cap;
+    }
+};
+exports.SlidingCappedExpiration = SlidingCappedExpiration;
+__decorate([
+    (0, configuration_1.Config)('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], SlidingCappedExpiration.prototype, "Ttl", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.session.expiration.maxLifetime', { defaultValue: 1440 }),
+    __metadata("design:type", Number)
+], SlidingCappedExpiration.prototype, "MaxLifetime", void 0);
+exports.SlidingCappedExpiration = SlidingCappedExpiration = __decorate([
+    (0, di_1.Injectable)(interfaces_js_1.SessionExpirationProvider)
+], SlidingCappedExpiration);
+//# sourceMappingURL=session-expiration.js.map

package/lib/cjs/session-expiration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expiration.js","sourceRoot":"","sources":["../../src/session-expiration.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iCAAiC;AACjC,oCAAyC;AACzC,0DAAgD;AAChD,mDAAsE;AAEtE;;;;;;GAMG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,yCAAyB;IAIxD,OAAO,CAAC,OAAiB;QAC9B,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,OAAiB;QAC5B,gEAAgE;QAChE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;CACF,CAAA;AAZY,gDAAkB;AAEnB;IADT,IAAA,sBAAM,EAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;+CACtC;6BAFZ,kBAAkB;IAD9B,IAAA,eAAU,EAAC,yCAAyB,CAAC;GACzB,kBAAkB,CAY9B;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,yCAAyB;IAIvD,OAAO,CAAC,QAAkB;QAC/B,OAAO,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,QAAkB;QAC7B,OAAO,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAA;AAXY,8CAAiB;AAElB;IADT,IAAA,sBAAM,EAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;8CACtC;4BAFZ,iBAAiB;IAD7B,IAAA,eAAU,EAAC,yCAAyB,CAAC;GACzB,iBAAiB,CAW7B;AAED;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,yCAAyB;IAO7D,OAAO,CAAC,QAAkB;QAC/B,OAAO,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,OAAiB;QAC5B,MAAM,KAAK,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnC,CAAC;CACF,CAAA;AAhBY,0DAAuB;AAExB;IADT,IAAA,sBAAM,EAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;oDACtC;AAGb;IADT,IAAA,sBAAM,EAAC,qCAAqC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;4DACvC;kCALpB,uBAAuB;IADnC,IAAA,eAAU,EAAC,yCAAyB,CAAC;GACzB,uBAAuB,CAgBnC"}

package/lib/cjs/session.d.ts

@@ -1,40 +1,60 @@
 import { DateTime } from 'luxon';
 import { SessionProvider, ISession } from './interfaces.js';
-import { User } from './models/User.js';
 /**
  * Session base class
  */
 export declare class UserSession implements ISession {
-    protected SessionExpirationTime: number;
     SessionId: string;
     /**
-     * Expiration time for session, if null it does not expire
+     * User id that owns this session. Single source of truth for ownership.
      */
-    Expiration: DateTime | undefined;
-    Data: Map<string, unknown>;
+    UserId: number;
     Creation: DateTime;
     /**
-     * User id that owns this session
+     * Expiration time for session, if undefined it does not expire.
+     * Set by the SessionProvider through the configured expiration strategy.
      */
-    UserId: number;
+    Expiration: DateTime | undefined;
+    Data: Map<string, unknown>;
     constructor(session?: Partial<ISession>);
-    /**
-     * Extends lifetime of session
-     *
-     * @param seconds - hom mutch to extend
-     */
-    extend(seconds?: number): void;
 }
 /**
- * Simple session storage in memory, for testing or rapid prototyping
+ * Derives the `ssid` cookie `maxAge` (milliseconds) from a session's real
+ * `Expiration` (fixes B1 — the cookie previously always died at
+ * `expiration * 1000` ms i.e. ~2 minutes). Returns `undefined` for a
+ * never-expiring session (a session cookie), and never a negative value.
+ *
+ * @param session - the session whose expiry drives the cookie lifetime
+ */
+export declare function sessionCookieMaxAge(session: ISession): number | undefined;
+/**
+ * Session-fixation protection helper. Mints a NEW session id, copies the
+ * ownership identity and data across, deletes the old id and persists the new
+ * one. Apply on privilege elevation (login already mints a fresh session, but
+ * 2FA-authorize and role-switch elevate an existing one).
+ *
+ * The returned session carries a new `SessionId` so the caller can reset the
+ * `ssid` cookie. `Expiration` is left unset so `save` schedules a fresh one via
+ * the configured strategy (`Creation` is preserved, so a capped lifetime window
+ * is not extended).
+ *
+ * @param provider - the active session store
+ * @param session - the session to regenerate
+ */
+export declare function regenerateSession(provider: SessionProvider, session: ISession): Promise<ISession>;
+/**
+ * Simple session storage in memory, for testing or rapid prototyping.
+ * Keeps live session objects (no serialization).
  */
 export declare class MemorySessionStore extends SessionProvider<ISession> {
     protected Sessions: Map<string, ISession>;
-    truncate(): Promise<void>;
-    touch(session: ISession): Promise<void>;
     restore(sessionId: string): Promise<ISession | null>;
+    save(session: ISession): Promise<void>;
+    touch(session: ISession): Promise<boolean>;
     delete(sessionId: string): Promise<void>;
-    save(idOrSession: ISession | string, data?: object): Promise<void>;
-    logsOut(user: User): Promise<void>;
+    deleteByUser(userId: number): Promise<void>;
+    listByUser(userId: number): Promise<ISession[]>;
+    truncate(): Promise<void>;
+    private expirationEquals;
 }
 //# sourceMappingURL=session.d.ts.map

package/lib/cjs/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAK5D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IAE1C,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEjC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;IAEvC,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;gBAEV,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;IAMvC;;;;OAIG;IACI,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAE/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAYpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxE,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB1C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI5D;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IACnC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;;OAGG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;gBAElC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;CAKxC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWvG;AAED;;;GAGG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAepD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAU/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,gBAAgB;CAMzB"}

package/lib/cjs/session.js

@@ -8,102 +8,143 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MemorySessionStore = exports.UserSession = void 0;
+exports.sessionCookieMaxAge = sessionCookieMaxAge;
+exports.regenerateSession = regenerateSession;
 const luxon_1 = require("luxon");
 const interfaces_js_1 = require("./interfaces.js");
 const di_1 = require("@spinajs/di");
-const configuration_1 = require("@spinajs/configuration");
 const uuid_1 = require("uuid");
-const lodash_1 = __importDefault(require("lodash"));
 /**
  * Session base class
  */
 let UserSession = class UserSession {
     constructor(session) {
         this.SessionId = (0, uuid_1.v4)();
+        this.Creation = luxon_1.DateTime.now();
         /**
-         * Expiration time for session, if null it does not expire
+         * Expiration time for session, if undefined it does not expire.
+         * Set by the SessionProvider through the configured expiration strategy.
          */
         this.Expiration = undefined;
         this.Data = new Map();
-        this.Creation = luxon_1.DateTime.now();
         if (session) {
             Object.assign(this, session);
         }
     }
-    /**
-     * Extends lifetime of session
-     *
-     * @param seconds - hom mutch to extend
-     */
-    extend(seconds) {
-        this.Expiration = luxon_1.DateTime.now().plus({ seconds: seconds ? seconds : this.SessionExpirationTime });
-    }
 };
 exports.UserSession = UserSession;
-__decorate([
-    (0, configuration_1.Config)('rbac.session.expiration'),
-    __metadata("design:type", Number)
-], UserSession.prototype, "SessionExpirationTime", void 0);
 exports.UserSession = UserSession = __decorate([
     (0, di_1.NewInstance)(),
     __metadata("design:paramtypes", [Object])
 ], UserSession);
 /**
- * Simple session storage in memory, for testing or rapid prototyping
+ * Derives the `ssid` cookie `maxAge` (milliseconds) from a session's real
+ * `Expiration` (fixes B1 — the cookie previously always died at
+ * `expiration * 1000` ms i.e. ~2 minutes). Returns `undefined` for a
+ * never-expiring session (a session cookie), and never a negative value.
+ *
+ * @param session - the session whose expiry drives the cookie lifetime
+ */
+function sessionCookieMaxAge(session) {
+    if (!session.Expiration) {
+        return undefined;
+    }
+    return Math.max(0, Math.floor(session.Expiration.diff(luxon_1.DateTime.now()).milliseconds));
+}
+/**
+ * Session-fixation protection helper. Mints a NEW session id, copies the
+ * ownership identity and data across, deletes the old id and persists the new
+ * one. Apply on privilege elevation (login already mints a fresh session, but
+ * 2FA-authorize and role-switch elevate an existing one).
+ *
+ * The returned session carries a new `SessionId` so the caller can reset the
+ * `ssid` cookie. `Expiration` is left unset so `save` schedules a fresh one via
+ * the configured strategy (`Creation` is preserved, so a capped lifetime window
+ * is not extended).
+ *
+ * @param provider - the active session store
+ * @param session - the session to regenerate
+ */
+async function regenerateSession(provider, session) {
+    const regenerated = new UserSession({
+        UserId: session.UserId,
+        Creation: session.Creation,
+        Data: new Map(session.Data),
+    });
+    await provider.delete(session.SessionId);
+    await provider.save(regenerated);
+    return regenerated;
+}
+/**
+ * Simple session storage in memory, for testing or rapid prototyping.
+ * Keeps live session objects (no serialization).
  */
 let MemorySessionStore = class MemorySessionStore extends interfaces_js_1.SessionProvider {
     constructor() {
         super(...arguments);
         this.Sessions = new Map();
     }
-    async truncate() {
-        this.Sessions = new Map();
-    }
-    async touch(session) {
-        return this.save(session);
-    }
     async restore(sessionId) {
-        if (this.Sessions.has(sessionId)) {
-            const session = this.Sessions.get(sessionId);
-            if (!session.Expiration || session.Expiration > luxon_1.DateTime.now()) {
-                return session;
-            }
+        const session = this.Sessions.get(sessionId);
+        if (!session) {
             return null;
         }
-        return null;
-    }
-    async delete(sessionId) {
-        if (this.Sessions.has(sessionId)) {
+        // an expired row is treated as absent (and evicted)
+        if (this.isExpired(session)) {
             this.Sessions.delete(sessionId);
+            return null;
         }
+        return session;
     }
-    async save(idOrSession, data) {
-        if (lodash_1.default.isString(idOrSession)) {
-            const s = this.Sessions.get(idOrSession);
-            for (const key in data) {
-                s.Data.set(key, data[key]);
-            }
+    async save(session) {
+        // A brand-new session without a scheduled expiration gets its initial
+        // expiration from the strategy. An already-scheduled expiration is
+        // persisted verbatim (fixes B3 — never recompute on every save).
+        if (session.Expiration === undefined) {
+            this.applyInitialExpiration(session);
         }
-        else {
-            this.Sessions.set(idOrSession.SessionId, idOrSession);
+        this.Sessions.set(session.SessionId, session);
+    }
+    async touch(session) {
+        const current = session.Expiration;
+        const renewed = this.Expiration.renew(session);
+        // no change (e.g. AbsoluteExpiration) — skip the write, report false
+        if (this.expirationEquals(current, renewed)) {
+            return false;
         }
+        session.Expiration = renewed;
+        this.Sessions.set(session.SessionId, session);
+        return true;
+    }
+    async delete(sessionId) {
+        this.Sessions.delete(sessionId);
     }
-    logsOut(user) {
-        const sessionsToDelete = [];
+    async deleteByUser(userId) {
         for (const [key, session] of this.Sessions.entries()) {
-            if (session.UserId === user.Id) {
-                sessionsToDelete.push(key);
+            if (session.UserId === userId) {
+                this.Sessions.delete(key);
             }
         }
-        for (const sessionId of sessionsToDelete) {
-            this.Sessions.delete(sessionId);
+    }
+    async listByUser(userId) {
+        const result = [];
+        for (const session of this.Sessions.values()) {
+            if (session.UserId === userId && !this.isExpired(session)) {
+                result.push(session);
+            }
+        }
+        return result;
+    }
+    async truncate() {
+        this.Sessions = new Map();
+    }
+    expirationEquals(a, b) {
+        if (a === undefined || b === undefined) {
+            return a === b;
         }
-        return Promise.resolve();
+        return a.toMillis() === b.toMillis();
     }
 };
 exports.MemorySessionStore = MemorySessionStore;

package/lib/cjs/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,iCAAiC;AACjC,mDAA4D;AAC5D,oCAAsD;AACtD,0DAAgD;AAChD,+BAAoC;AACpC,oDAAuB;AAGvB;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAoBtB,YAAY,OAA2B;QAhBhC,cAAS,GAAW,IAAA,SAAM,GAAE,CAAC;QAEpC;;WAEG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAEvC,aAAQ,GAAa,gBAAQ,CAAC,GAAG,EAAE,CAAC;QAQzC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,OAAgB;QAC5B,IAAI,CAAC,UAAU,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACrG,CAAC;CACF,CAAA;AAlCY,kCAAW;AAEZ;IADT,IAAA,sBAAM,EAAC,yBAAyB,CAAC;;0DACM;sBAF7B,WAAW;IADvB,IAAA,gBAAW,GAAE;;GACD,WAAW,CAkCvB;AAED;;GAEG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,+BAAyB;IAA1D;;QAEK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IAwD1E,CAAC;IAtDQ,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAA8B,EAAE,IAAa;QAC7D,IAAI,gBAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;YAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAG,IAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEM,OAAO,CAAC,IAAU;QAEvB,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA1DY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAU,EAAC,+BAAe,CAAC;GACf,kBAAkB,CA0D9B"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;;;;AA0CA,kDAKC;AAgBD,8CAWC;AA1ED,iCAAiC;AACjC,mDAA4D;AAC5D,oCAAsD;AACtD,+BAAoC;AAEpC;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAkBtB,YAAY,OAA2B;QAjBhC,cAAS,GAAW,IAAA,SAAM,GAAE,CAAC;QAO7B,aAAQ,GAAa,gBAAQ,CAAC,GAAG,EAAE,CAAC;QAE3C;;;WAGG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAA;AAvBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,gBAAW,GAAE;;GACD,WAAW,CAuBvB;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,+BAAyB;IAA1D;;QACK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IA0E1E,CAAC;IAxEQ,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AA3EY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAU,EAAC,+BAAe,CAAC;GACf,kBAAkB,CA2E9B"}

package/lib/mjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAiB/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAWrD;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6DvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBA4BhH;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAmB3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAGzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAiB/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAWrD;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAiBjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBA4BhH;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAmB3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAGzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F"}

package/lib/mjs/actions.js

@@ -6,6 +6,8 @@ import { _ev } from '@spinajs/queue';
 import { USER_COMMON_METADATA, User, UserBase } from './models/User.js';
 import { _cfg, _service } from '@spinajs/configuration';
 import { UserActivated, UserBanned, UserChanged, UserCreated, UserDeactivated, UserDeleted, UserLogged, UserPasswordChangeRequest, UserPasswordChanged, UserRoleGranted, UserRoleRevoked, UserUnbanned } from './events/index.js';
+import { DI } from '@spinajs/di';
+import { Configuration } from '@spinajs/configuration';
 import { AuthProvider, PasswordProvider, PasswordValidationProvider } from './interfaces.js';
 import { DateTime } from 'luxon';
 import { ErrorCode } from '@spinajs/exceptions';
@@ -213,6 +215,20 @@ export async function activate(identifier) {
 export async function deactivate(identifier) {
     return _chain(_user(identifier), _user_update({ IsActive: false }), _user_ev(UserDeactivated), _user_email('deactivated'));
 }
+/**
+ * Reads a create-middleware list from configuration.
+ *
+ * NOTE: we deliberately do NOT use `_cfg(path, [])` here. `_cfg` wraps its
+ * result in `_non_nil()`, which rejects empty arrays — so an unset or
+ * empty `beforeCreate` / `afterCreate` (the default in the shipped config)
+ * would throw and break user creation. Reading the value directly keeps an
+ * empty list as a valid "no middleware" result.
+ */
+function _create_middleware(path) {
+    const cfg = DI.get(Configuration);
+    const mw = cfg?.get(path, []);
+    return Array.isArray(mw) ? mw : [];
+}
 /**
  * Creates a new user account.
  *
@@ -248,11 +264,11 @@ export async function create(email, login, password, roles, id, metadata) {
         Uuid: uuidv4(),
     })), 
     // run before create middleware
-    (u) => _chain(_cfg('rbac.actions.create.beforeCreate', []), (beforeCreate) => _chain(u, ...beforeCreate)), 
+    (u) => _chain(u, ..._create_middleware('rbac.actions.create.beforeCreate')), 
     // insert to db
     _insert(), _either(() => metadata !== undefined, _set_user_meta(metadata ? Object.entries(metadata).map(([key, value]) => ({ key, value })) : []), async (u) => u), 
     // run after create middleware
-    (u) => _chain(_cfg('rbac.actions.create.afterCreate', []), (afterCreate) => _chain(u, ...afterCreate)), 
+    (u) => _chain(u, ..._create_middleware('rbac.actions.create.afterCreate')), 
     // send event
     _user_ev(UserCreated, (u) => u.toJSON()), 
     // send email
@@ -327,11 +343,21 @@ export async function ban(identifier, reason, duration) {
  * @returns
  */
 export async function unban(identifier) {
-    return _chain(_user(identifier), (u) => {
+    return _chain(_user(identifier), 
+    // guard must return the user so the chain can keep flowing it downstream
+    _tap(async (u) => {
         if (!u.Metadata[USER_COMMON_METADATA.USER_BAN_IS_BANNED]) {
             throw new ErrorCode(E_CODES.E_USER_BANNED, `User is already unbanned`, { user: u });
         }
-    }, _set_user_meta('/^user:ban/', null), _user_ev(UserUnbanned));
+    }), 
+    // actually remove the ban metadata from the DB. Assigning a regex-like
+    // string key never cleared anything; delete() removes each key from store.
+    _tap(async (u) => {
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_BAN_IS_BANNED);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_BAN_START_DATE);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_BAN_DURATION);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_BAN_REASON);
+    }), _user_ev(UserUnbanned));
 }
 /**
  * Initiates a password-change request for a user.
@@ -341,7 +367,7 @@ export async function unban(identifier) {
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 export async function passwordChangeRequest(identifier) {
-    const pwdWaitTime = await _cfg('rbac.password.reset_wait_time')();
+    const pwdWaitTime = await _cfg('rbac.password.passwordResetWaitTime')();
     return _chain(_user(identifier), _set_user_meta([
         { key: USER_COMMON_METADATA.USER_PWD_RESET_START_DATE, value: DateTime.now() },
         { key: USER_COMMON_METADATA.USER_PWD_RESET_TOKEN, value: uuidv4() },
@@ -358,7 +384,7 @@ export async function passwordChangeRequest(identifier) {
  */
 export async function confirmPasswordReset(identifier, newPassword, token) {
     return _chain(_user(identifier), _tap((u) => _chain(u, _zip(_get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_START_DATE), _get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME)), ([dueDate, waitTime]) => {
-        if (dueDate.plus(waitTime) < DateTime.now()) {
+        if (dueDate.plus({ seconds: waitTime }) < DateTime.now()) {
             throw new ErrorCode(E_CODES.E_TOKEN_EXPIRED, `Password change token expired, token expiration date is: ${dueDate.toISO()}`, {
                 dueDate,
                 waitTime,