@spinajs/rbac 2.0.481 → 2.0.484

package/lib/cjs/interfaces.d.ts

@@ -39,28 +39,39 @@ export interface ISession {
      */
     SessionId: string;
     /**
-     * Expiration date. After that date session is invalid
+     * User id that owns this session. Single source of truth for ownership.
+     * 0 / -1 = anonymous.
      */
-    Expiration?: DateTime;
+    UserId: number;
     /**
-     * Session creation date. After that date session is invalid
+     * Session creation date.
      */
     Creation: DateTime;
+    /**
+     * Absolute expiration instant. After that date session is invalid.
+     * `undefined` = never expires.
+     */
+    Expiration?: DateTime;
     /**
      * Data holds by session
      */
     Data: Map<string, unknown>;
+}
+/**
+ * Configurable session expiration strategy. Resolved by config service name at
+ * `rbac.session.expiration.service`, mirroring the `rbac.password` pattern.
+ *
+ * Units for all shipped strategies are MINUTES.
+ */
+export declare abstract class SessionExpirationProvider {
     /**
-     * User id that owns this session
+     * Expiration to set when a session is first created. `undefined` = never expires.
      */
-    UserId: number;
+    abstract initial(session: ISession): DateTime | undefined;
     /**
-     *
-     * Extends session lifetime
-     *
-     * @param seconds  - how mutch to extend, if value not provided, default value from config is used
+     * Expiration to set when a session is renewed (touch).
      */
-    extend(seconds?: number): void;
+    abstract renew(session: ISession): DateTime | undefined;
 }
 /**
  * Service used for generating random password & for hash raw string
@@ -180,56 +191,71 @@ export declare abstract class FederatedAuthProvider<C, U = User> {
      */
     abstract authenticate(credentials: C): Promise<U>;
 }
-export declare abstract class SessionProvider<T = ISession> extends AsyncService {
+export declare abstract class SessionProvider<T extends ISession = ISession> extends AsyncService {
     /**
-     *
-     * Load session from store. If not exists or expired returns null
-     *
-     * @param sessionId - session identifier
+     * Expiration strategy, resolved by config service name at
+     * `rbac.session.expiration`. Every store shares the same strategy so
+     * expiration semantics are uniform across providers.
      */
-    abstract restore(sessionId: string): Promise<T | null>;
+    protected Expiration: SessionExpirationProvider;
     /**
+     * Load session from store. Returns `null` when the session is missing OR
+     * expired — providers MUST treat an expired row as absent.
      *
-     * Deletes session from store
-     *
-     * @param sessionId - session to delete
+     * @param sessionId - session identifier
      */
-    abstract delete(sessionId: string): Promise<void>;
+    abstract restore(sessionId: string): Promise<T | null>;
     /**
-     *
-     * Adds or updates session in store
+     * Upsert a session. MUST persist `session.Expiration` verbatim (never
+     * recompute it for an already-scheduled session). A brand-new session with
+     * no expiration set yet is given its initial expiration via the strategy.
      *
      * @param session - session to update / insert
      */
     abstract save(session: ISession): Promise<void>;
     /**
+     * Recompute `Expiration` via the strategy; if it changed, persist and report
+     * `true` so the caller refreshes the cookie. If unchanged (e.g. under
+     * `AbsoluteExpiration`), skip the write and return `false`.
      *
-     * Updates session data for given id
-     *
-     * @param id - session id
-     * @param data  - key - value pair of data
+     * @param session - session to renew
      */
-    abstract save(id: string, data: object): Promise<void>;
+    abstract touch(session: ISession): Promise<boolean>;
     /**
+     * Deletes a single session from store.
      *
-     * Updates only EXPIRATION TIME of session, not changing other data
-     *
-     * @param session - session to update
+     * @param sessionId - session to delete
      */
-    abstract touch(session: ISession): Promise<void>;
+    abstract delete(sessionId: string): Promise<void>;
     /**
+     * Log a user out of all devices. Keyed on numeric `UserId` in every store.
      *
-     * Deletes all session table data
+     * @param userId - numeric owner id
+     */
+    abstract deleteByUser(userId: number): Promise<void>;
+    /**
+     * All live (non-expired) sessions for a user — powers "active devices" and
+     * selective revoke.
      *
+     * @param userId - numeric owner id
+     */
+    abstract listByUser(userId: number): Promise<ISession[]>;
+    /**
+     * Deletes all session table data.
      */
     abstract truncate(): Promise<void>;
     /**
-     *
-     * Deletes all sessions for given user ( logs out user from all devices )
-     *
-     * @param user
+     * Sets the initial expiration on a freshly created session.
      */
-    abstract logsOut(user: User): Promise<void>;
+    protected applyInitialExpiration(s: ISession): void;
+    /**
+     * Sets the renewed expiration on a session being touched.
+     */
+    protected applyRenewedExpiration(s: ISession): void;
+    /**
+     * True when the session carries an expiration in the past.
+     */
+    protected isExpired(s: ISession): boolean;
 }
 export declare enum AthenticationErrorCodes {
     E_USER_BANNED = 1,
@@ -238,6 +264,30 @@ export declare enum AthenticationErrorCodes {
     E_LOGIN_ATTEMPTS_EXCEEDED = 4
 }
 export type PermissionType = 'readAny' | 'readOwn' | 'updateAny' | 'updateOwn' | 'deleteAny' | 'deleteOwn' | 'createAny' | 'createOwn';
+/**
+ * Static a model may declare to constrain ONE operation, checked by
+ * `RbacModelPermissionMiddleware` before the generic `rbac` fallback.
+ *
+ * The hook receives the query builder as `this` and the acting user as its only argument,
+ * and is called only on the `:own` path — an `:any` grant short-circuits before it.
+ *
+ * ```ts
+ * class Entry extends ModelBase<Entry> {
+ *   // fallback for whichever of read / update / delete has no specific hook
+ *   static rbac(this: IWhereBuilder<Entry>, user: User) { ... }
+ *   static rbacDelete(this: DeleteQueryBuilder<Entry>, user: User) { ... }
+ * }
+ * ```
+ *
+ * `rbacCreate` is deliberately excluded from the `rbac` fallback: `rbac` has only ever run
+ * on builders with a WHERE clause, so every existing implementation is where-shaped and
+ * `InsertQueryBuilder` has no `where`. See {@link RBAC_HOOK_FALLBACK}.
+ */
+export type RbacHookName = 'rbacRead' | 'rbacUpdate' | 'rbacDelete' | 'rbacCreate';
+/**
+ * Name of the generic hook every operation except create falls back to.
+ */
+export declare const RBAC_HOOK_FALLBACK = "rbac";
 export interface IRbacModelDescriptor extends IModelDescriptor {
     RbacResource: string;
     OwnerField: string;

package/lib/cjs/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,QAAQ,cAAc,CAAC;IAC5B,UAAiB,YAAY;QAC3B;;;;;;;WAOG;QACH,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,aAAa,CAAC;QAElI;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAErE;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7E;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACpG;CACF;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAEhC;AAED;;GAEG;AACH,8BAAsB,gBAAgB;IACpC;;;;;;OAMG;aACa,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;OAKG;aACa,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEpD;;OAEG;aACa,QAAQ,IAAI,MAAM;CACnC;AAED;;;;;GAKG;AACH,8BAAsB,YAAY,CAAC,CAAC,GAAG,IAAI;IACzC;;;;;OAKG;aACa,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEjE;;;;;;OAMG;aACa,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAEzE;;;;;OAKG;aACa,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnE;;;;OAIG;aACa,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnE;;;;;OAKG;aACa,SAAS,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpE;;;;;OAKG;aACa,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAErD;;;;;OAKG;aACa,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAErD;;;;;OAKG;aACa,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;;;GAMG;AACH,8BAAsB,qBAAqB,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI;IACrD;;OAEG;IACH,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC;IAE5B;;;;;;;;OAQG;aACa,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAEpD;;;;;OAKG;aACa,YAAY,CAAC,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,8BAAsB,eAAe,CAAC,CAAC,GAAG,QAAQ,CAAE,SAAQ,YAAY;IACtE;;;;;OAKG;aACa,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAE7D;;;;;OAKG;aACa,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD;;;;;OAKG;aACa,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtD;;;;;;OAMG;aACa,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7D;;;;;OAKG;aACa,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAEvD;;;;OAIG;aACa,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAEzC;;;;;OAKG;aACa,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CACnD;AAED,oBAAY,uBAAuB;IACjC,aAAa,IAAI;IACjB,iBAAiB,IAAI;IACrB,qBAAqB,IAAI;IACzB,yBAAyB,IAAI;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAEvI,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,8BAAsB,0BAA0B;aAC9B,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CACjD;AAGD,qBAAa,WAAW,CAAC,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,CAAC,CAAC;gBAEP,IAAI,EAAG,IAAI,EAAE,IAAI,CAAC,EAAI,CAAC;CAI3C;AAED;;;;;GAKG;AACH,8BAAsB,mBAAmB;aACvB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAG,MAAM,GAAG,MAAM,GAAI,IAAI,GAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CACtF;AAGD,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,IAAI;IACzC,IAAI,CAAC,EAAE,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB;;;;;KAKC;IACD,eAAe,CAAC,EAAE,cAAc,CAAC;IAEjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,QAAQ,cAAc,CAAC;IAC5B,UAAiB,YAAY;QAC3B;;;;;;;WAOG;QACH,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,aAAa,CAAC;QAElI;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAErE;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7E;;;;WAIG;QACH,cAAc,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACpG;CACF;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;OAGG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC;IAEtB;;OAEG;IACH,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AAED;;;;;GAKG;AACH,8BAAsB,yBAAyB;IAC7C;;OAEG;aACa,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAEhE;;OAEG;aACa,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAC/D;AAED;;GAEG;AACH,8BAAsB,gBAAgB;IACpC;;;;;;OAMG;aACa,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;OAKG;aACa,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEpD;;OAEG;aACa,QAAQ,IAAI,MAAM;CACnC;AAED;;;;;GAKG;AACH,8BAAsB,YAAY,CAAC,CAAC,GAAG,IAAI;IACzC;;;;;OAKG;aACa,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEjE;;;;;;OAMG;aACa,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAEzE;;;;;OAKG;aACa,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnE;;;;OAIG;aACa,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnE;;;;;OAKG;aACa,SAAS,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpE;;;;;OAKG;aACa,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAErD;;;;;OAKG;aACa,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAErD;;;;;OAKG;aACa,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;;;GAMG;AACH,8BAAsB,qBAAqB,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI;IACrD;;OAEG;IACH,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC;IAE5B;;;;;;;;OAQG;aACa,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAEpD;;;;;OAKG;aACa,YAAY,CAAC,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,8BAAsB,eAAe,CAAC,CAAC,SAAS,QAAQ,GAAG,QAAQ,CAAE,SAAQ,YAAY;IACvF;;;;OAIG;IAEH,SAAS,CAAC,UAAU,EAAG,yBAAyB,CAAC;IAEjD;;;;;OAKG;aACa,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAE7D;;;;;;OAMG;aACa,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtD;;;;;;OAMG;aACa,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAE1D;;;;OAIG;aACa,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD;;;;OAIG;aACa,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3D;;;;;OAKG;aACa,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE/D;;OAEG;aACa,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAEzC;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI;IAInD;;OAEG;IACH,SAAS,CAAC,sBAAsB,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI;IAInD;;OAEG;IACH,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO;CAG1C;AAED,oBAAY,uBAAuB;IACjC,aAAa,IAAI;IACjB,iBAAiB,IAAI;IACrB,qBAAqB,IAAI;IACzB,yBAAyB,IAAI;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAEvI;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,CAAC;AAEnF;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,8BAAsB,0BAA0B;aAC9B,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CACjD;AAGD,qBAAa,WAAW,CAAC,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,CAAC,CAAC;gBAEP,IAAI,EAAG,IAAI,EAAE,IAAI,CAAC,EAAI,CAAC;CAI3C;AAED;;;;;GAKG;AACH,8BAAsB,mBAAmB;aACvB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAG,MAAM,GAAG,MAAM,GAAI,IAAI,GAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CACtF;AAGD,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,IAAI;IACzC,IAAI,CAAC,EAAE,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB;;;;;KAKC;IACD,eAAe,CAAC,EAAE,cAAc,CAAC;IAEjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC"}

package/lib/cjs/interfaces.js

@@ -1,7 +1,27 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = void 0;
+exports.UserProfileProvider = exports.UserProfile = exports.PasswordValidationProvider = exports.RBAC_HOOK_FALLBACK = exports.AthenticationErrorCodes = exports.SessionProvider = exports.FederatedAuthProvider = exports.AuthProvider = exports.PasswordProvider = exports.SessionExpirationProvider = void 0;
 const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const luxon_1 = require("luxon");
+/**
+ * Configurable session expiration strategy. Resolved by config service name at
+ * `rbac.session.expiration.service`, mirroring the `rbac.password` pattern.
+ *
+ * Units for all shipped strategies are MINUTES.
+ */
+class SessionExpirationProvider {
+}
+exports.SessionExpirationProvider = SessionExpirationProvider;
 /**
  * Service used for generating random password & for hash raw string
  */
@@ -28,8 +48,30 @@ class FederatedAuthProvider {
 }
 exports.FederatedAuthProvider = FederatedAuthProvider;
 class SessionProvider extends di_1.AsyncService {
+    /**
+     * Sets the initial expiration on a freshly created session.
+     */
+    applyInitialExpiration(s) {
+        s.Expiration = this.Expiration.initial(s);
+    }
+    /**
+     * Sets the renewed expiration on a session being touched.
+     */
+    applyRenewedExpiration(s) {
+        s.Expiration = this.Expiration.renew(s);
+    }
+    /**
+     * True when the session carries an expiration in the past.
+     */
+    isExpired(s) {
+        return !!s.Expiration && s.Expiration <= luxon_1.DateTime.now();
+    }
 }
 exports.SessionProvider = SessionProvider;
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.session.expiration'),
+    __metadata("design:type", SessionExpirationProvider)
+], SessionProvider.prototype, "Expiration", void 0);
 var AthenticationErrorCodes;
 (function (AthenticationErrorCodes) {
     AthenticationErrorCodes[AthenticationErrorCodes["E_USER_BANNED"] = 1] = "E_USER_BANNED";
@@ -37,6 +79,10 @@ var AthenticationErrorCodes;
     AthenticationErrorCodes[AthenticationErrorCodes["E_INVALID_CREDENTIALS"] = 3] = "E_INVALID_CREDENTIALS";
     AthenticationErrorCodes[AthenticationErrorCodes["E_LOGIN_ATTEMPTS_EXCEEDED"] = 4] = "E_LOGIN_ATTEMPTS_EXCEEDED";
 })(AthenticationErrorCodes || (exports.AthenticationErrorCodes = AthenticationErrorCodes = {}));
+/**
+ * Name of the generic hook every operation except create falls back to.
+ */
+exports.RBAC_HOOK_FALLBACK = 'rbac';
 /**
  * Interface to provide implementation of password rule validation
  */

package/lib/cjs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;AACA,oCAA2C;AA2E3C;;GAEG;AACH,MAAsB,gBAAgB;CAsBrC;AAtBD,4CAsBC;AAED;;;;;GAKG;AACH,MAAsB,YAAY;CAgEjC;AAhED,oCAgEC;AAED;;;;;;GAMG;AACH,MAAsB,qBAAqB;CAwB1C;AAxBD,sDAwBC;AAED,MAAsB,eAA8B,SAAQ,iBAAY;CAwDvE;AAxDD,0CAwDC;AAED,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,uFAAiB,CAAA;IACjB,+FAAqB,CAAA;IACrB,uGAAyB,CAAA;IACzB,+GAA6B,CAAA;AAC/B,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAUD;;GAEG;AACH,MAAsB,0BAA0B;CAE/C;AAFD,gEAEC;AAGD,MAAa,WAAW;IAItB,YAAmB,IAAW,EAAE,IAAU;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AARD,kCAQC;AAED;;;;;GAKG;AACH,MAAsB,mBAAmB;CAExC;AAFD,kDAEC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAA2C;AAC3C,0DAA2D;AAE3D,iCAAiC;AAkEjC;;;;;GAKG;AACH,MAAsB,yBAAyB;CAU9C;AAVD,8DAUC;AAED;;GAEG;AACH,MAAsB,gBAAgB;CAsBrC;AAtBD,4CAsBC;AAED;;;;;GAKG;AACH,MAAsB,YAAY;CAgEjC;AAhED,oCAgEC;AAED;;;;;;GAMG;AACH,MAAsB,qBAAqB;CAwB1C;AAxBD,sDAwBC;AAED,MAAsB,eAA+C,SAAQ,iBAAY;IA8DvF;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACO,sBAAsB,CAAC,CAAW;QAC1C,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACO,SAAS,CAAC,CAAW;QAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,gBAAQ,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;CACF;AAlFD,0CAkFC;AA3EW;IADT,IAAA,iCAAiB,EAAC,yBAAyB,CAAC;8BACtB,yBAAyB;mDAAC;AA6EnD,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,uFAAiB,CAAA;IACjB,+FAAqB,CAAA;IACrB,uGAAyB,CAAA;IACzB,+GAA6B,CAAA;AAC/B,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAyBD;;GAEG;AACU,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAQzC;;GAEG;AACH,MAAsB,0BAA0B;CAE/C;AAFD,gEAEC;AAGD,MAAa,WAAW;IAItB,YAAmB,IAAW,EAAE,IAAU;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AARD,kCAQC;AAED;;;;;GAKG;AACH,MAAsB,mBAAmB;CAExC;AAFD,kDAEC"}

package/lib/cjs/middleware.d.ts

@@ -1,10 +1,33 @@
 import { QueryBuilder, QueryMiddleware } from '@spinajs/orm';
+import { IRbacModelDescriptor, RbacHookName } from './interfaces.js';
 import { AccessControl } from 'accesscontrol';
 import { Log } from '@spinajs/log-common';
 export declare class RbacModelPermissionMiddleware extends QueryMiddleware {
     protected Log: Log;
     protected Ac: AccessControl;
-    beforeQueryExecution(_query: QueryBuilder<any>): void;
+    /**
+     * INSERT is enforced here rather than in `afterQueryCreation` because the row payload does
+     * not exist at construction time — `values()` is called afterwards and would overwrite an
+     * owner column stamped earlier. Reads and writes keep their where-clause injection at
+     * construction, where it has always been.
+     */
+    beforeQueryExecution(builder: QueryBuilder<any>): Promise<void>;
     afterQueryCreation(builder: QueryBuilder): void;
+    /**
+     * Everything both hooks need, or `undefined` when this query is not subject to a check.
+     *
+     * Shared so the two hooks cannot drift on who is exempt: no async context, no user, an
+     * explicit skip flag, a model with no `@Resource()`, or a declared `PermissionScope` that
+     * does not match this builder type.
+     */
+    protected context(builder: QueryBuilder): {
+        descriptor: IRbacModelDescriptor;
+        resource: string;
+        canOwn: boolean;
+        canAny: boolean;
+        action: string;
+        hook: RbacHookName;
+        user: import("./index.js").User;
+    } | undefined;
 }
 //# sourceMappingURL=middleware.d.ts.map

package/lib/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;AAGnL,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,qBAAqB,CAAC;AA4BlD,qBACa,6BAA8B,SAAQ,eAAe;IAGhE,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,EAAE,EAAG,aAAa,CAAC;IAE7B,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI;IACrD,kBAAkB,CAAC,OAAO,EAAE,YAAY;CAwFzC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAgF,YAAY,EAAE,eAAe,EAA0C,MAAM,cAAc,CAAC;AAEnL,OAAO,EAAqB,oBAAoB,EAAsC,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5H,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAU,MAAM,qBAAqB,CAAC;AAuFlD,qBACa,6BAA8B,SAAQ,eAAe;IAGhE,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAGpB,SAAS,CAAC,EAAE,EAAG,aAAa,CAAC;IAE7B;;;;;OAKG;IACG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA8CrE,kBAAkB,CAAC,OAAO,EAAE,YAAY;IA8CxC;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY;;;;;;;;;CAoExC"}