@spinajs/rbac 2.0.521 → 2.0.523

package/lib/cjs/orm-permission.d.ts

@@ -0,0 +1,77 @@
+import { Class } from '@spinajs/di';
+import { InsertQueryBuilder, IWhereBuilder, ModelBase } from '@spinajs/orm';
+import type { User } from './models/User.js';
+export declare const DEFAULT_PERMISSION_SCOPE = "default";
+/**
+ * Attribute prefix marking a named permission scope on a role grant (eg. `'scope:pool'`),
+ * read by `RbacModelPermissionMiddleware.policiesFor()` to pick a non-default
+ * `OrmPermissionPolicy`.
+ *
+ * WARNING: `accesscontrol`'s attribute union across a role and every role it `$extend`s
+ * collapses `['*']` merged with `['scope:x']` down to `['*']` (glob union absorption). A role
+ * granting `read:own: ['scope:pool']` while a role it `$extend`s (or that extends it) grants
+ * the same resource `['*']` silently loses the `scope:pool` token, and resolution falls
+ * through to the DEFAULT policy instead of the named one. This is a known limitation, not
+ * handled by this module — never mix `['*']` and `scope:` attributes for the SAME resource
+ * across an `$extend` chain.
+ */
+export declare const PERMISSION_SCOPE_ATTR_PREFIX = "scope:";
+export declare const ORM_PERMISSION_POLICY_MAP = "__orm_permission_policy__";
+/**
+ * Bound model recorded on a policy class by `@OrmPermission`. Needed because the map is
+ * keyed on the shared resource STRING (minification-safe), which two unrelated models can
+ * legally share for grant purposes — the model recorded here is what lets `policiesFor()`
+ * in middleware.ts pick the right policy for `builder.Model` instead of an arbitrary one.
+ */
+export declare const ORM_PERMISSION_MODEL: unique symbol;
+/**
+ * Keyed on the DECLARED `@OrmResource` string, never on `constructor.name` — grants are
+ * keyed on the same string, so a model's resource name is the single permission identity
+ * everywhere, and models sharing a resource (a view over the base table) share policies.
+ */
+export declare function policyMapKey(resource: string, scope: string): string;
+export declare abstract class OrmPermissionPolicy<M extends ModelBase<unknown> = ModelBase<unknown>> {
+    /**
+     * Default throws so an accidentally inert policy fails loud instead of running an
+     * unscoped query.
+     */
+    scope(_query: IWhereBuilder<M>, _user: User): void;
+    scopeRead(query: IWhereBuilder<M>, user: User): void;
+    scopeUpdate(query: IWhereBuilder<M>, user: User): void;
+    scopeDelete(query: IWhereBuilder<M>, user: User): void;
+    /**
+     * Default denies: a policy that does not opt into insert control must not silently
+     * allow inserts under a `:own` grant. An authorization denial, not a config error, so
+     * `Forbidden` (403) — contrast `scope()`'s default, which stays `OrmException` because an
+     * unimplemented scope is a config bug. Callers with an `OwnerField` never reach this: see
+     * `RbacModelPermissionMiddleware.beforeQueryExecution`'s OwnerField fallback.
+     */
+    authorizeCreate(_query: InsertQueryBuilder, _user: User): Promise<void>;
+}
+export type OrmPermissionPolicyClass = Class<OrmPermissionPolicy>;
+/** The model `@OrmPermission` bound `policy` to, or `undefined` for a policy built by hand
+ * (eg. the `OwnerFieldPolicy` fallback) that never went through the decorator.
+ *
+ * Read as an OWN property: `target[ORM_PERMISSION_MODEL] = model` stamps the constructor
+ * object itself, and ES class inheritance chains constructors ( `Sub.__proto__ === Base` ), so
+ * a plain property read here would let an undecorated `class Sub extends Base {}` silently
+ * inherit `Base`'s bound model instead of having none.
+ */
+export declare function ormPermissionModel(policy: OrmPermissionPolicyClass): Class<ModelBase<unknown>> | undefined;
+/**
+ * The single accessor for the policy map — used by both the registration side
+ * (`OrmPermission`) and the resolution side (`RbacModelPermissionMiddleware.policiesFor`) so
+ * the two can never read/write through differing DI cache accessors and drift apart.
+ */
+export declare function getOrCreatePolicyMap(): Map<string, OrmPermissionPolicyClass[]>;
+/**
+ * Registers `target` as a policy for `model`'s resource + `scope` in the DI hashmap.
+ * Refuses a model without `@OrmResource` (cannot be permission-guarded). The map value is a
+ * LIST: two unrelated models are allowed to share one resource+scope key (the
+ * CampaignFileAttachment / ArrowV1CampaignView shape) — only the same (model, scope) pair
+ * registered twice is a duplicate/config bug.
+ */
+export declare function OrmPermission<M extends ModelBase<unknown>>(model: Class<M>, scope?: string): (target: Class<OrmPermissionPolicy<M>>) => void;
+/** Test helper — wipes all registrations from the DI cache. */
+export declare function clearOrmPermissionRegistry(): void;
+//# sourceMappingURL=orm-permission.d.ts.map

package/lib/cjs/orm-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-permission.d.ts","sourceRoot":"","sources":["../../src/orm-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAM,MAAM,aAAa,CAAC;AACxC,OAAO,EAA0B,kBAAkB,EAAE,aAAa,EAAE,SAAS,EAAgB,MAAM,cAAc,CAAC;AAGlH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,WAAW,CAAC;AACrD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAqC,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,8BAAsB,mBAAmB,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;IACzF;;;OAGG;IACI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAExD;IAEM,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE1D;IAEM,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE5D;IAEM,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE5D;IAED;;;;;;OAMG;IACU,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;CACF;AAED,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAG1G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAO9E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAE,MAAiC,YACnG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAG,IAAI,CAqBrD;AAED,+DAA+D;AAC/D,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD"}

package/lib/cjs/orm-permission.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrmPermissionPolicy = exports.ORM_PERMISSION_MODEL = exports.ORM_PERMISSION_POLICY_MAP = exports.PERMISSION_SCOPE_ATTR_PREFIX = exports.DEFAULT_PERMISSION_SCOPE = void 0;
+exports.policyMapKey = policyMapKey;
+exports.ormPermissionModel = ormPermissionModel;
+exports.getOrCreatePolicyMap = getOrCreatePolicyMap;
+exports.OrmPermission = OrmPermission;
+exports.clearOrmPermissionRegistry = clearOrmPermissionRegistry;
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const exceptions_1 = require("@spinajs/exceptions");
+exports.DEFAULT_PERMISSION_SCOPE = 'default';
+/**
+ * Attribute prefix marking a named permission scope on a role grant (eg. `'scope:pool'`),
+ * read by `RbacModelPermissionMiddleware.policiesFor()` to pick a non-default
+ * `OrmPermissionPolicy`.
+ *
+ * WARNING: `accesscontrol`'s attribute union across a role and every role it `$extend`s
+ * collapses `['*']` merged with `['scope:x']` down to `['*']` (glob union absorption). A role
+ * granting `read:own: ['scope:pool']` while a role it `$extend`s (or that extends it) grants
+ * the same resource `['*']` silently loses the `scope:pool` token, and resolution falls
+ * through to the DEFAULT policy instead of the named one. This is a known limitation, not
+ * handled by this module — never mix `['*']` and `scope:` attributes for the SAME resource
+ * across an `$extend` chain.
+ */
+exports.PERMISSION_SCOPE_ATTR_PREFIX = 'scope:';
+exports.ORM_PERMISSION_POLICY_MAP = '__orm_permission_policy__';
+/**
+ * Bound model recorded on a policy class by `@OrmPermission`. Needed because the map is
+ * keyed on the shared resource STRING (minification-safe), which two unrelated models can
+ * legally share for grant purposes — the model recorded here is what lets `policiesFor()`
+ * in middleware.ts pick the right policy for `builder.Model` instead of an arbitrary one.
+ */
+exports.ORM_PERMISSION_MODEL = Symbol.for('orm-permission-model');
+/**
+ * Keyed on the DECLARED `@OrmResource` string, never on `constructor.name` — grants are
+ * keyed on the same string, so a model's resource name is the single permission identity
+ * everywhere, and models sharing a resource (a view over the base table) share policies.
+ */
+function policyMapKey(resource, scope) {
+    return `${resource}:${scope}`;
+}
+class OrmPermissionPolicy {
+    /**
+     * Default throws so an accidentally inert policy fails loud instead of running an
+     * unscoped query.
+     */
+    scope(_query, _user) {
+        throw new orm_1.OrmException(`${this.constructor.name} defines neither a generic scope() nor a specific hook for this operation`);
+    }
+    scopeRead(query, user) {
+        this.scope(query, user);
+    }
+    scopeUpdate(query, user) {
+        this.scope(query, user);
+    }
+    scopeDelete(query, user) {
+        this.scope(query, user);
+    }
+    /**
+     * Default denies: a policy that does not opt into insert control must not silently
+     * allow inserts under a `:own` grant. An authorization denial, not a config error, so
+     * `Forbidden` (403) — contrast `scope()`'s default, which stays `OrmException` because an
+     * unimplemented scope is a config bug. Callers with an `OwnerField` never reach this: see
+     * `RbacModelPermissionMiddleware.beforeQueryExecution`'s OwnerField fallback.
+     */
+    async authorizeCreate(_query, _user) {
+        throw new exceptions_1.Forbidden(`${this.constructor.name} does not implement authorizeCreate — INSERT under :own is not permitted by this policy`);
+    }
+}
+exports.OrmPermissionPolicy = OrmPermissionPolicy;
+/** The model `@OrmPermission` bound `policy` to, or `undefined` for a policy built by hand
+ * (eg. the `OwnerFieldPolicy` fallback) that never went through the decorator.
+ *
+ * Read as an OWN property: `target[ORM_PERMISSION_MODEL] = model` stamps the constructor
+ * object itself, and ES class inheritance chains constructors ( `Sub.__proto__ === Base` ), so
+ * a plain property read here would let an undecorated `class Sub extends Base {}` silently
+ * inherit `Base`'s bound model instead of having none.
+ */
+function ormPermissionModel(policy) {
+    const target = policy;
+    return Object.prototype.hasOwnProperty.call(policy, exports.ORM_PERMISSION_MODEL) ? target[exports.ORM_PERMISSION_MODEL] : undefined;
+}
+/**
+ * The single accessor for the policy map — used by both the registration side
+ * (`OrmPermission`) and the resolution side (`RbacModelPermissionMiddleware.policiesFor`) so
+ * the two can never read/write through differing DI cache accessors and drift apart.
+ */
+function getOrCreatePolicyMap() {
+    if (di_1.DI.RootContainer.Cache.has(exports.ORM_PERMISSION_POLICY_MAP)) {
+        return di_1.DI.RootContainer.Cache.get(exports.ORM_PERMISSION_POLICY_MAP)[0];
+    }
+    const map = new Map();
+    di_1.DI.RootContainer.Cache.add(exports.ORM_PERMISSION_POLICY_MAP, map);
+    return map;
+}
+/**
+ * Registers `target` as a policy for `model`'s resource + `scope` in the DI hashmap.
+ * Refuses a model without `@OrmResource` (cannot be permission-guarded). The map value is a
+ * LIST: two unrelated models are allowed to share one resource+scope key (the
+ * CampaignFileAttachment / ArrowV1CampaignView shape) — only the same (model, scope) pair
+ * registered twice is a duplicate/config bug.
+ */
+function OrmPermission(model, scope = exports.DEFAULT_PERMISSION_SCOPE) {
+    return (target) => {
+        const descriptor = (0, orm_1.extractModelDescriptor)(model);
+        const resource = descriptor?.RbacResource;
+        if (!resource) {
+            throw new orm_1.OrmException(`cannot register ${target.name} for ${model.name}: model has no @OrmResource declaration`);
+        }
+        target[exports.ORM_PERMISSION_MODEL] = model;
+        const key = policyMapKey(resource, scope);
+        const map = getOrCreatePolicyMap();
+        const list = map.get(key) ?? [];
+        if (list.some((p) => ormPermissionModel(p) === model)) {
+            throw new orm_1.OrmException(`duplicate OrmPermission registration for ${model.name}/${scope} (${target.name} already registered for this model+scope)`);
+        }
+        list.push(target);
+        map.set(key, list);
+    };
+}
+/** Test helper — wipes all registrations from the DI cache. */
+function clearOrmPermissionRegistry() {
+    if (di_1.DI.RootContainer.Cache.has(exports.ORM_PERMISSION_POLICY_MAP)) {
+        di_1.DI.RootContainer.Cache.remove(exports.ORM_PERMISSION_POLICY_MAP);
+    }
+}
+//# sourceMappingURL=orm-permission.js.map

package/lib/cjs/orm-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-permission.js","sourceRoot":"","sources":["../../src/orm-permission.ts"],"names":[],"mappings":";;;;;;;;AAAA,oCAAwC;AACxC,sCAAkH;AAClH,oDAAgD;AAInC,QAAA,wBAAwB,GAAG,SAAS,CAAC;AAElD;;;;;;;;;;;;GAYG;AACU,QAAA,4BAA4B,GAAG,QAAQ,CAAC;AACxC,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAErE;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEvE;;;;GAIG;AACH,sBAA6B,QAAgB,EAAE,KAAa;IAC1D,OAAO,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;IACE;;;OAGG;IACI,KAAK,CAAC,MAAwB,EAAE,KAAW;QAChD,MAAM,IAAI,kBAAY,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,2EAA2E,CAAC,CAAC;IAC9H,CAAC;IAEM,SAAS,CAAC,KAAuB,EAAE,IAAU;QAClD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEM,WAAW,CAAC,KAAuB,EAAE,IAAU;QACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEM,WAAW,CAAC,KAAuB,EAAE,IAAU;QACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,MAA0B,EAAE,KAAW;QAClE,MAAM,IAAI,sBAAS,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,yFAAyF,CAAC,CAAC;IACzI,CAAC;CACF;;AAID;;;;;;;GAOG;AACH,4BAAmC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAA0E,CAAC;IAC1F,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAA,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAA,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH;IACE,IAAI,OAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,QAAA,yBAAyB,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,QAAA,yBAAyB,CAAC,CAAC,CAAC,CAA4C,CAAC;IAC7G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,OAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,QAAA,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,uBAA4D,KAAe,EAAE,KAAK,GAAW,QAAA,wBAAwB;IACnH,OAAO,CAAC,MAAqC,EAAQ,EAAE;QACrD,MAAM,UAAU,GAAG,IAAA,4BAAsB,EAAC,KAAK,CAAgC,CAAC;QAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAY,CAAC,mBAAmB,MAAM,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;QACpH,CAAC;QAEA,MAA8C,CAAC,QAAA,oBAAoB,CAAC,GAAG,KAAK,CAAC;QAE9E,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAY,CAAC,4CAA4C,KAAK,CAAC,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACrJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAA6C,CAAC,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D;IACE,IAAI,OAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,QAAA,yBAAyB,CAAC,EAAE,CAAC;QAC1D,OAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,QAAA,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/lib/cjs/password.d.ts

@@ -1,9 +1,14 @@
 import { PasswordProvider, PasswordValidationProvider } from './interfaces.js';
 import { DataValidator } from '@spinajs/validation';
 /**
- * Simple password service that use argon2 hash alghoritm and entropy-string to generate password
+ * Simple password service that use argon2 hash alghoritm
  */
 export declare class BasicPasswordProvider implements PasswordProvider {
+    protected GeneratorOptions: {
+        length: number;
+        characters: string[];
+    };
+    protected Validation: PasswordValidationProvider;
     hash(input: string): Promise<string>;
     /**
      *
@@ -13,6 +18,18 @@ export declare class BasicPasswordProvider implements PasswordProvider {
      * @param password - password to validate
      */
     verify(hash: string, password: string): Promise<boolean>;
+    /**
+     * A random password drawn from `rbac.password.generator` and guaranteed to
+     * satisfy `rbac.password.validation.rule`.
+     *
+     * The guarantee matters: a generated password is what a freshly created
+     * account holds, and one that fails the application's own rule is a password
+     * the account can never legitimately return to.
+     *
+     * @throws UnexpectedServerError when the configured pool cannot produce a
+     *   password the rule accepts. That is a configuration fault nobody calling
+     *   this can fix, so it must never reach a client as a 400.
+     */
     generate(): string;
 }
 /**

package/lib/cjs/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/password.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAI/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;GAEG;AACH,qBACa,qBAAsB,YAAW,gBAAgB;IAC/C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhD;IAED;;;;;;OAMG;IACU,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE;IAEM,QAAQ,IAAI,MAAM,CAIxB;CACF;AAED;;GAEG;AACH,qBACa,+BAAgC,SAAQ,0BAA0B;IAE7E,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAGnC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;IAE5B,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGtC;CACF"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/password.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAI/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA6BpD;;GAEG;AACH,qBACa,qBAAsB,YAAW,gBAAgB;IAE5D,SAAS,CAAC,gBAAgB,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAGrE,SAAS,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAEpC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhD;IAED;;;;;;OAMG;IACU,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE;IAED;;;;;;;;;;;OAWG;IACI,QAAQ,IAAI,MAAM,CAoBxB;CACF;AAED;;GAEG;AACH,qBACa,+BAAgC,SAAQ,0BAA0B;IAE7E,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAGnC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;IAE5B,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGtC;CACF"}

package/lib/cjs/password.js

@@ -49,9 +49,33 @@ const argon = __importStar(require("argon2"));
 const di_1 = require("@spinajs/di");
 const configuration_1 = require("@spinajs/configuration");
 const validation_1 = require("@spinajs/validation");
-const entropy_string_1 = require("entropy-string");
+const exceptions_1 = require("@spinajs/exceptions");
+const crypto_1 = require("crypto");
 /**
- * Simple password service that use argon2 hash alghoritm and entropy-string to generate password
+ * How many draws `generate()` makes before declaring the generator pool and the
+ * validation rule incompatible.
+ *
+ * The pool says which characters may appear, not which classes are MANDATORY, so
+ * a uniform draw can legitimately miss a class the rule demands - with a
+ * 62-character alphanumeric pool at length 16, about 6% of draws contain no
+ * digit. One draw plus an assertion would therefore fail 6% of the time, which
+ * is a broken generator rather than a misconfiguration signal. Ten draws bring a
+ * spurious failure to roughly 6e-13, while a pool that genuinely cannot satisfy
+ * the rule still exhausts every attempt and throws.
+ */
+const GENERATE_ATTEMPTS = 10;
+/**
+ * Used when an application has not declared `rbac.password.generator`. Mirrors
+ * the shipped config default, so an application that never configures a
+ * generator still creates usable accounts - the same reason `_create_middleware`
+ * carries a fallback for `rbac.actions`.
+ *
+ * A DECLARED but empty pool still throws: that is a misconfiguration, not an
+ * omission.
+ */
+const DEFAULT_GENERATOR = { length: 16, characters: ['abcdefghijklmnopqrstuvwxyz', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', '0123456789'] };
+/**
+ * Simple password service that use argon2 hash alghoritm
  */
 let BasicPasswordProvider = class BasicPasswordProvider {
     async hash(input) {
@@ -68,13 +92,45 @@ let BasicPasswordProvider = class BasicPasswordProvider {
     async verify(hash, password) {
         return await argon.verify(hash, password);
     }
+    /**
+     * A random password drawn from `rbac.password.generator` and guaranteed to
+     * satisfy `rbac.password.validation.rule`.
+     *
+     * The guarantee matters: a generated password is what a freshly created
+     * account holds, and one that fails the application's own rule is a password
+     * the account can never legitimately return to.
+     *
+     * @throws UnexpectedServerError when the configured pool cannot produce a
+     *   password the rule accepts. That is a configuration fault nobody calling
+     *   this can fix, so it must never reach a client as a 400.
+     */
     generate() {
-        // generates password with entropy of 60 bits ( balance of ease vs value )
-        const random = new entropy_string_1.Entropy({ charset: entropy_string_1.charset32 });
-        return random.string(60);
+        const options = this.GeneratorOptions ?? DEFAULT_GENERATOR;
+        const length = options.length ?? DEFAULT_GENERATOR.length;
+        const pool = (options.characters ?? DEFAULT_GENERATOR.characters).join('');
+        if (length < 1 || pool.length === 0) {
+            throw new exceptions_1.UnexpectedServerError('rbac.password.generator must define a positive length and a non-empty character pool');
+        }
+        for (let attempt = 0; attempt < GENERATE_ATTEMPTS; attempt++) {
+            // randomInt is the CSPRNG - Math.random is predictable from a handful of
+            // outputs, and this value guards an account.
+            const candidate = Array.from({ length }, () => pool[(0, crypto_1.randomInt)(pool.length)]).join('');
+            if (this.Validation.check(candidate)) {
+                return candidate;
+            }
+        }
+        throw new exceptions_1.UnexpectedServerError(`Could not generate a password satisfying rbac.password.validation.rule in ${GENERATE_ATTEMPTS} attempts. The generator character pool and the validation rule disagree - check rbac.password.generator.`);
     }
 };
 exports.BasicPasswordProvider = BasicPasswordProvider;
+__decorate([
+    (0, configuration_1.Config)('rbac.password.generator'),
+    __metadata("design:type", Object)
+], BasicPasswordProvider.prototype, "GeneratorOptions", void 0);
+__decorate([
+    (0, configuration_1.AutoinjectService)('rbac.password.validation'),
+    __metadata("design:type", interfaces_js_1.PasswordValidationProvider)
+], BasicPasswordProvider.prototype, "Validation", void 0);
 exports.BasicPasswordProvider = BasicPasswordProvider = __decorate([
     (0, di_1.Injectable)(interfaces_js_1.PasswordProvider)
 ], BasicPasswordProvider);

package/lib/cjs/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/password.ts"],"names":[],"mappings":";AAAA,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE5C,mDAA+E;AAC/E,MAAY,KAAK,mCAAe;AAChC,oCAAqD;AACrD,0DAAgD;AAChD,oDAAoD;AACpD,mDAAoD;AAEpD;;GAEG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACzB,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,gDAAgD;QAChD,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QAChD,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEM,QAAQ;QACb,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,wBAAO,CAAC,EAAE,OAAO,EAAE,0BAAS,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF,CAAA;;gCAtBY,qBAAqB;IADjC,IAAA,eAAU,EAAC,gCAAgB,CAAC;GAChB,qBAAqB,CAsBjC;AAED;;GAEG;AAEI,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,0CAA0B;IAOtE,KAAK,CAAC,QAAgB;QAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAe,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;;AATW;IADT,IAAA,sBAAM,EAAC,+BAA+B,CAAC;;yEACL;AAGzB;IADT,IAAA,eAAU,GAAE;8BACQ,0BAAa;kEAAC;0CALxB,+BAA+B;IAD3C,IAAA,eAAU,EAAC,0CAA0B,CAAC;GAC1B,+BAA+B,CAW3C"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/password.ts"],"names":[],"mappings":";AAAA,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE5C,mDAA+E;AAC/E,MAAY,KAAK,mCAAe;AAChC,oCAAqD;AACrD,0DAAmE;AACnE,oDAAoD;AACpD,oDAA4D;AAC5D,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,YAAY,CAAC,EAAE,CAAC;AAEjI;;GAEG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAOzB,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,gDAAgD;QAChD,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QAChD,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;OAWG;IACI,QAAQ;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3E,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,kCAAqB,CAAC,sFAAsF,CAAC,CAAC;QAC1H,CAAC;QAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEtF,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,kCAAqB,CAAC,6EAA6E,iBAAiB,2GAA2G,CAAC,CAAC;IAC7O,CAAC;CACF,CAAA;;AAtDW;IADT,IAAA,sBAAM,EAAC,yBAAyB,CAAC;;+DACmC;AAG3D;IADT,IAAA,iCAAiB,EAAC,0BAA0B,CAAC;8BACxB,0CAA0B;yDAAC;gCALtC,qBAAqB;IADjC,IAAA,eAAU,EAAC,gCAAgB,CAAC;GAChB,qBAAqB,CAwDjC;AAED;;GAEG;AAEI,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,0CAA0B;IAOtE,KAAK,CAAC,QAAgB;QAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAe,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;;AATW;IADT,IAAA,sBAAM,EAAC,+BAA+B,CAAC;;yEACL;AAGzB;IADT,IAAA,eAAU,GAAE;8BACQ,0BAAa;kEAAC;0CALxB,+BAA+B;IAD3C,IAAA,eAAU,EAAC,0CAA0B,CAAC;GAC1B,+BAA+B,CAW3C"}

package/lib/cjs/permission-service.d.ts

@@ -0,0 +1,80 @@
+import { Permission } from 'accesscontrol';
+import { Class } from '@spinajs/di';
+import type { User } from './models/User.js';
+export type PermissionVerb = 'create' | 'read' | 'update' | 'delete';
+export type PermissionGrantScope = 'any' | 'own' | 'none';
+/**
+ * Base for per-domain permission services: decides and explains authorization at the
+ * domain layer, BEFORE any effect — the ORM rbac middleware stays the enforcement
+ * backstop. One concrete class per rbac resource; public API is domain-named assert
+ * methods built from the protected primitives below. The rbac User model is the actor —
+ * no wrapper objects.
+ *
+ * Stateless by contract: no instance fields in subclasses. Spinajs DI caches resolved
+ * instances, so `@FromDI()` injection in controllers, `@Autoinject` fields and
+ * `usePermission()` anywhere else share one instance safely.
+ */
+export declare abstract class PermissionService {
+    /** Rbac resource name this service guards — same string the grants config uses. */
+    protected abstract readonly Resource: string;
+    /**
+     * The acting user: explicit argument wins, else the rbac AsyncLocalStorage store.
+     * No user anywhere throws — a permission decision must never silently pass without
+     * an identity.
+     */
+    protected user(user?: User): User;
+    /** Roles the decision runs against — the shared ActiveRole rule against the ambient store. */
+    protected effectiveRoles(user: User): string[];
+    protected grantScope(user: User, verb: PermissionVerb): PermissionGrantScope;
+    /** Single guarded probe against this.Resource — an unknown role answers false. */
+    protected can(roles: string[], permission: string): boolean;
+    /** Resolve acting user + scope, refusing `none` with the (overridable) domain error. */
+    protected assertGrant(verb: PermissionVerb, user?: User): {
+        user: User;
+        scope: 'any' | 'own';
+    };
+    /**
+     * Runs `fn` as the given user, so rbac-scoped ORM queries inside answer "what does
+     * THIS user see" — ownership rules stay stated once, in the query layer. The store's
+     * own user runs in the ambient store untouched; any other user impersonates: User is
+     * swapped and ActiveRole cleared (it belongs to the ambient user only), everything
+     * else in the store kept.
+     */
+    protected withUser<T>(user: User, fn: () => T | Promise<T>): Promise<T>;
+    protected noPermissionError(user: User, verb: PermissionVerb): Error;
+    protected noUserError(): Error;
+    private storage;
+}
+/**
+ * Retrieves a permission service from DI — sugar for domain services and plain
+ * functions down the callstack, so code reads as intent
+ * (`usePermission(ContentEntriesPermission)`) instead of container plumbing.
+ * Answers the same DI-cached instance controllers receive via `@FromDI()`.
+ *
+ * Accepts ONLY PermissionService subclasses — the generic constraint is erased at
+ * runtime, so this is enforced here too instead of degrading into a bare DI.resolve.
+ */
+export declare function usePermission<T extends PermissionService>(type: Class<T>): T;
+/**
+ * THE guarded accesscontrol probe — single home for the AccessControlError semantics
+ * previously copy-pasted into the ORM query middleware and rbac-http's RbacPolicy.
+ * Answers the Permission object (grant attributes stay reachable), or null for a role
+ * unknown to accesscontrol — which throws AccessControlError for any role absent from
+ * the grants map and rejects the whole role array on one unknown member. A genuine
+ * programming error (bad permission name) still propagates loud.
+ */
+export declare function probeGrant(roles: string | string[], permission: string, resource: string): Permission | null;
+/**
+ * THE ActiveRole rule — single home for the narrowing previously inlined in the ORM
+ * query middleware and rbac-http's checkRoutePermission. The session's ActiveRole
+ * applies only to the user it was selected for — matched by id; any other user answers
+ * their full role list.
+ *
+ * The storage parameter is structural (not IRbacAsyncStorage) so both the rbac ALS
+ * store and http's request storage (whose User is `User | null`) fit.
+ */
+export declare function effectiveRoles(user: User, storage?: {
+    User?: User | null;
+    ActiveRole?: string;
+}): string[];
+//# sourceMappingURL=permission-service.d.ts.map

package/lib/cjs/permission-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/permission-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAM,MAAM,aAAa,CAAC;AAGxC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACrE,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,8BAAsB,iBAAiB;IACrC,mFAAmF;IACnF,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE7C;;;;OAIG;IACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAWhC;IAED,8FAA8F;IAC9F,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAE7C;IAED,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,GAAG,oBAAoB,CAU3E;IAED,kFAAkF;IAClF,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1D;IAED,wFAAwF;IACxF,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAA;KAAE,CAS7F;IAED;;;;;;OAMG;IACH,UAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS5E;IAED,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,GAAG,KAAK,CAEnE;IAED,SAAS,CAAC,WAAW,IAAI,KAAK,CAE7B;IAED,OAAO,CAAC,OAAO;CAGhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAM5E;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAc5G;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAK1G"}

package/lib/cjs/permission-service.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionService = void 0;
+exports.usePermission = usePermission;
+exports.probeGrant = probeGrant;
+exports.effectiveRoles = effectiveRoles;
+const node_async_hooks_1 = require("node:async_hooks");
+const accesscontrol_1 = require("accesscontrol");
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Base for per-domain permission services: decides and explains authorization at the
+ * domain layer, BEFORE any effect — the ORM rbac middleware stays the enforcement
+ * backstop. One concrete class per rbac resource; public API is domain-named assert
+ * methods built from the protected primitives below. The rbac User model is the actor —
+ * no wrapper objects.
+ *
+ * Stateless by contract: no instance fields in subclasses. Spinajs DI caches resolved
+ * instances, so `@FromDI()` injection in controllers, `@Autoinject` fields and
+ * `usePermission()` anywhere else share one instance safely.
+ */
+class PermissionService {
+    /**
+     * The acting user: explicit argument wins, else the rbac AsyncLocalStorage store.
+     * No user anywhere throws — a permission decision must never silently pass without
+     * an identity.
+     */
+    user(user) {
+        if (user) {
+            return user;
+        }
+        const store = this.storage().getStore();
+        if (!store?.User) {
+            throw this.noUserError();
+        }
+        return store.User;
+    }
+    /** Roles the decision runs against — the shared ActiveRole rule against the ambient store. */
+    effectiveRoles(user) {
+        return effectiveRoles(user, this.storage().getStore());
+    }
+    grantScope(user, verb) {
+        const roles = this.effectiveRoles(user);
+        if (this.can(roles, `${verb}Any`)) {
+            return 'any';
+        }
+        if (this.can(roles, `${verb}Own`)) {
+            return 'own';
+        }
+        return 'none';
+    }
+    /** Single guarded probe against this.Resource — an unknown role answers false. */
+    can(roles, permission) {
+        return probeGrant(roles, permission, this.Resource)?.granted ?? false;
+    }
+    /** Resolve acting user + scope, refusing `none` with the (overridable) domain error. */
+    assertGrant(verb, user) {
+        const acting = this.user(user);
+        const scope = this.grantScope(acting, verb);
+        if (scope === 'none') {
+            throw this.noPermissionError(acting, verb);
+        }
+        return { user: acting, scope };
+    }
+    /**
+     * Runs `fn` as the given user, so rbac-scoped ORM queries inside answer "what does
+     * THIS user see" — ownership rules stay stated once, in the query layer. The store's
+     * own user runs in the ambient store untouched; any other user impersonates: User is
+     * swapped and ActiveRole cleared (it belongs to the ambient user only), everything
+     * else in the store kept.
+     */
+    async withUser(user, fn) {
+        const storage = this.storage();
+        const parent = storage.getStore() ?? {};
+        if (parent.User?.Id === user.Id) {
+            return fn();
+        }
+        return storage.run({ ...parent, User: user, ActiveRole: undefined }, async () => fn());
+    }
+    noPermissionError(user, verb) {
+        return new exceptions_1.Forbidden(`user ${user.Id} has no ${verb} grant for resource ${this.Resource}`);
+    }
+    noUserError() {
+        return new exceptions_1.Forbidden('no acting user: none was given and none is present in the execution context');
+    }
+    storage() {
+        return di_1.DI.resolve(node_async_hooks_1.AsyncLocalStorage);
+    }
+}
+exports.PermissionService = PermissionService;
+/**
+ * Retrieves a permission service from DI — sugar for domain services and plain
+ * functions down the callstack, so code reads as intent
+ * (`usePermission(ContentEntriesPermission)`) instead of container plumbing.
+ * Answers the same DI-cached instance controllers receive via `@FromDI()`.
+ *
+ * Accepts ONLY PermissionService subclasses — the generic constraint is erased at
+ * runtime, so this is enforced here too instead of degrading into a bare DI.resolve.
+ */
+function usePermission(type) {
+    if (typeof type !== 'function' || !(type.prototype instanceof PermissionService)) {
+        throw new Error(`usePermission accepts only PermissionService subclasses, got ${typeof type === 'function' ? type.name : typeof type}`);
+    }
+    return di_1.DI.resolve(type);
+}
+/**
+ * THE guarded accesscontrol probe — single home for the AccessControlError semantics
+ * previously copy-pasted into the ORM query middleware and rbac-http's RbacPolicy.
+ * Answers the Permission object (grant attributes stay reachable), or null for a role
+ * unknown to accesscontrol — which throws AccessControlError for any role absent from
+ * the grants map and rejects the whole role array on one unknown member. A genuine
+ * programming error (bad permission name) still propagates loud.
+ */
+function probeGrant(roles, permission, resource) {
+    const ac = di_1.DI.get('AccessControl');
+    if (!ac) {
+        throw new Error('no AccessControl registered in DI — rbac is not bootstrapped');
+    }
+    try {
+        return ac.can(roles)[permission](resource);
+    }
+    catch (err) {
+        if (accesscontrol_1.AccessControl.isAccessControlError(err)) {
+            return null;
+        }
+        throw err;
+    }
+}
+/**
+ * THE ActiveRole rule — single home for the narrowing previously inlined in the ORM
+ * query middleware and rbac-http's checkRoutePermission. The session's ActiveRole
+ * applies only to the user it was selected for — matched by id; any other user answers
+ * their full role list.
+ *
+ * The storage parameter is structural (not IRbacAsyncStorage) so both the rbac ALS
+ * store and http's request storage (whose User is `User | null`) fit.
+ */
+function effectiveRoles(user, storage) {
+    if (storage?.ActiveRole && storage.User?.Id === user.Id) {
+        return [storage.ActiveRole];
+    }
+    return user.Role;
+}
+//# sourceMappingURL=permission-service.js.map

package/lib/cjs/permission-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../src/permission-service.ts"],"names":[],"mappings":";;;;;;AAAA,uDAAqD;AACrD,iDAA0D;AAC1D,oCAAwC;AACxC,oDAAgD;AAOhD;;;;;;;;;;GAUG;AACH;IAIE;;;;OAIG;IACO,IAAI,CAAC,IAAW;QACxB,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,8FAA8F;IACpF,cAAc,CAAC,IAAU;QACjC,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IAES,UAAU,CAAC,IAAU,EAAE,IAAoB;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kFAAkF;IACxE,GAAG,CAAC,KAAe,EAAE,UAAkB;QAC/C,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC;IACxE,CAAC;IAED,wFAAwF;IAC9E,WAAW,CAAC,IAAoB,EAAE,IAAW;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,QAAQ,CAAI,IAAU,EAAE,EAAwB;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QAExC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAES,iBAAiB,CAAC,IAAU,EAAE,IAAoB;QAC1D,OAAO,IAAI,sBAAS,CAAC,QAAQ,IAAI,CAAC,EAAE,WAAW,IAAI,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IAES,WAAW;QACnB,OAAO,IAAI,sBAAS,CAAC,6EAA6E,CAAC,CAAC;IACtG,CAAC;IAEO,OAAO;QACb,OAAO,OAAE,CAAC,OAAO,CAAC,oCAAiB,CAAyC,CAAC;IAC/E,CAAC;CACF;;AAED;;;;;;;;GAQG;AACH,uBAA2D,IAAc;IACvE,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,YAAY,iBAAiB,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,gEAAgE,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1I,CAAC;IAED,OAAO,OAAE,CAAC,OAAO,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,oBAA2B,KAAwB,EAAE,UAAkB,EAAE,QAAgB;IACvF,MAAM,EAAE,GAAG,OAAE,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC;QACH,OAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAA0D,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,6BAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,wBAA+B,IAAU,EAAE,OAAqD;IAC9F,IAAI,OAAO,EAAE,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}

package/lib/cjs/profile.js

@@ -15,7 +15,7 @@ const interfaces_js_1 = require("./interfaces.js");
  */
 let BasicProfileProvider = class BasicProfileProvider {
     async retrieve(user) {
-        const u = await (0, index_js_1._user)(user)();
+        const u = await (0, index_js_1.getUser)(user);
         return new interfaces_js_1.UserProfile(u);
     }
 };

package/lib/cjs/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,yCAAmC;AACnC,mDAAmE;AAGnE;;GAEG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACtB,KAAK,CAAC,QAAQ,CAAI,IAA4B;QACjD,MAAM,CAAC,GAAG,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,2BAAW,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;CAEJ,CAAA;;+BANY,oBAAoB;IADhC,IAAA,eAAU,EAAC,mCAAmB,CAAC;GACnB,oBAAoB,CAMhC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,yCAAqC;AACrC,mDAAmE;AAGnE;;GAEG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACtB,KAAK,CAAC,QAAQ,CAAI,IAA4B;QACjD,MAAM,CAAC,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,2BAAW,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;CAEJ,CAAA;;+BANY,oBAAoB;IADhC,IAAA,eAAU,EAAC,mCAAmB,CAAC;GACnB,oBAAoB,CAMhC"}