@taon-dev/session 21.0.215 → 21.0.240

package/lib-esm/lib/taon-session/taon-session.provider.js

@@ -1,11 +1,205 @@
-//#region imports
-import { TaonBaseProvider, TaonProvider } from 'taon/lib-esm';
+import { TaonBaseClass, TaonBaseProvider, TaonProvider } from 'taon/lib-esm';
+import { GlobalStorage, UtilsOs } from 'tnp-core/lib-esm';
+//#region config classes
+//#region config classes / cookies
+const isProduction = !GlobalStorage.get('TAON_LOCAL_DEV') &&
+    (UtilsOs.isRunningInDocker() || UtilsOs.isRunningInCloudflareWorker());
+export class TaonSessionCookiesConfig extends TaonBaseClass {
+    constructor() {
+        super();
+        //#region @backend
+        this.ACCESS_TOKEN_SECRET = 'access-secret';
+        this.REFRESH_TOKEN_SECRET = 'refresh-secret';
+        //#endregion
+        this.ACCESS_TOKEN_EXPIRES = '15m';
+        this.REFRESH_TOKEN_EXPIRES_SECONDS = 60 * 60 * 24 * 7;
+        this.accessTokenCookieName = 'taon_access_token';
+        this.refreshTokenCookieName = 'taon_refresh_token';
+        this.sameSite = 'lax';
+        this.secure = isProduction;
+        this.httpOnly = true;
+    }
+}
 //#endregion
+//#region config classes / social login config
+export class TaonSessionSocialLoginConfig extends TaonBaseClass {
+    constructor() {
+        super();
+        this.google = {
+            enabled: false,
+        };
+        this.facebook = {
+            enabled: false,
+        };
+        this.microsoft = {
+            enabled: false,
+        };
+        this.apple = {
+            enabled: false,
+        };
+    }
+    get isAnySocialLoginEnabled() {
+        return !!(this.google.enabled ||
+            this.microsoft.enabled ||
+            this.facebook.enabled ||
+            this.apple.enabled);
+    }
+}
+//#endregion
+//#region config classes / password requirements
+export class TaonSessionPasswordRequirementsConfig {
+    constructor() {
+        this.minLength = 8;
+        this.maxLength = 128;
+        this.requireLowercase = false;
+        this.requireUppercase = false;
+        this.requireNumber = false;
+        this.requireSpecialCharacter = false;
+        this.specialCharacters = '!@#$%^&*';
+    }
+}
+//#endregion
+//#region config classes / registration requirements
+export class TaonSessionRegistrationConfig {
+    constructor() {
+        this.enabled = true;
+        this.requireEmailConfirmation = false;
+        this.requireRegistrationPassword = true;
+        this.allowDuplicateEmail = false;
+    }
+}
+//#endregion
+//#region config classes / login config
+export class TaonSessionLoginConfig extends TaonBaseClass {
+    /**
+     * TODO
+     * Whether FE may check whether email exists
+     * before showing password/register screen.
+     */
+    // declare public exposeEmailExistence: boolean;
+    /**
+     * TODO
+     */
+    // declare public rememberMe: boolean;
+    constructor() {
+        super();
+        this.diableLoginByEmail = false;
+        this.linkToDashboard = '/';
+        this.displayDashboardButton = true;
+        // this.exposeEmailExistence = true;
+        // this.rememberMe = true;
+        if (isProduction) {
+            delete this.defaultEmail;
+            delete this.defaultPassword;
+        }
+    }
+}
+//#endregion
+//#region config classes / check if human config
+export class TaonSessionCheckIfHumanConfig {
+    constructor() {
+        this.duringLoginRegisterEmail = false;
+        this.duringRegistrationPassword = false;
+        this.duringLoginPassword = false;
+        this.duringPasswordReset = false;
+    }
+}
+//#endregion
+//#region config classes / sessions
+export class TaonSessionSessionsConfig {
+    constructor() {
+        this.allowMultipleSessions = true;
+        this.maxSessionsPerUser = 0;
+        this.trackActivity = true;
+        this.idleTimeoutSeconds = 0;
+    }
+}
+//#endregion
+//#region config classes / password recovery config
+export class TaonSessionPasswordRecoveryConfig {
+    constructor() {
+        this.enabled = true;
+        this.tokenExpiresSeconds = 60 * 60; // 1h
+        this.invalidateExistingSessionsAfterReset = true;
+    }
+}
+//#endregion
+//#region config classes / email confirmation config
+export class TaonSessionEmailConfirmationConfig {
+    constructor() {
+        this.enabled = true;
+        this.tokenExpiresSeconds = 60 * 60 * 24; // 24h
+        this.allowResend = true;
+        this.resendCooldownSeconds = 60;
+    }
+}
+//#endregion
+//#region config classes / security config
+export class TaonSessionSecurityConfig {
+    constructor() {
+        this.invalidateSessionsAfterPasswordChange = true;
+        this.rotateRefreshTokens = true;
+        this.detectRefreshTokenReuse = true;
+    }
+}
+//#endregion
+//#region config classes / rate limit config
+export class TaonSessionRateLimitConfig {
+    constructor(maxAttempts, windowSeconds) {
+        this.maxAttempts = maxAttempts;
+        this.windowSeconds = windowSeconds;
+    }
+}
+//#endregion
+//#region config classes / rate limits config
+export class TaonSessionRateLimitsConfig {
+    constructor() {
+        this.loginAttempts = new TaonSessionRateLimitConfig(10, 60);
+        this.passwordReset = new TaonSessionRateLimitConfig(5, 60 * 60);
+        this.emailConfirmationResend = new TaonSessionRateLimitConfig(5, 60 * 60);
+    }
+}
 let TaonSessionProvider = class TaonSessionProvider extends TaonBaseProvider {
-    ACCESS_TOKEN_SECRET = 'access-secret';
-    REFRESH_TOKEN_SECRET = 'refresh-secret';
-    ACCESS_TOKEN_EXPIRES = '15m';
-    REFRESH_TOKEN_EXPIRES_SECONDS = 60 * 60 * 24 * 7; // 7 days
+    /**
+     * Production means here - it runs on real server
+     */
+    isProduction = isProduction;
+    superUsersEmails = [];
+    /**
+     * Resolve social accounts by verified email as well as provider identity.
+     */
+    linkSocialAccountEmail = false;
+    cookies = new TaonSessionCookiesConfig();
+    login = new TaonSessionLoginConfig();
+    socialLogin = new TaonSessionSocialLoginConfig();
+    // passwordRequirements = new TaonSessionPasswordRequirementsConfig();
+    // registration = new TaonSessionRegistrationConfig();
+    // checkIfHuman = new TaonSessionCheckIfHumanConfig();
+    // socialLogin = new TaonSessionSocialLoginConfig();
+    // sessions = new TaonSessionSessionsConfig();
+    // passwordRecovery = new TaonSessionPasswordRecoveryConfig();
+    // emailConfirmation = new TaonSessionEmailConfirmationConfig();
+    // security = new TaonSessionSecurityConfig();
+    // rateLimits = new TaonSessionRateLimitsConfig();
+    async _() {
+        // TODO @UNCOMMENT disabled login by email when not on localhost
+        const originUrl = this.ctx.frontendHostUri;
+        const isLocalhost = originUrl.hostname === 'localhost' ||
+            originUrl.hostname === '127.0.0.1' ||
+            originUrl.hostname === '[::1]';
+        if (!isLocalhost) {
+            this.login.diableLoginByEmail = true;
+        }
+    }
+    clone() {
+        return {
+            isProduction: this.isProduction,
+            linkSocialAccountEmail: this.linkSocialAccountEmail,
+            cookies: this.cookies.clone(),
+            login: this.login.clone(),
+            socialLogin: this.socialLogin.clone(),
+        };
+    }
 };
 TaonSessionProvider = __decorate([
     TaonProvider({

package/lib-esm/lib/taon-session/taon-session.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"taon-session.provider.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,iBAAiB;AACjB,OAAO,EAAQ,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEpE,YAAY;AAKL,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAgB;IACvD,mBAAmB,GAAG,eAAe,CAAC;IAEtC,oBAAoB,GAAG,gBAAgB,CAAC;IAExC,oBAAoB,GAAG,KAAK,CAAC;IAE7B,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;CAC5D,CAAA;AARY,mBAAmB;IAH/B,YAAY,CAAC;QACZ,SAAS,EAAE,qBAAqB;KACjC,CAAC;GACW,mBAAmB,CAQ/B"}
+{"version":3,"file":"taon-session.provider.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAc,aAAa,EAAE,OAAO,EAAK,MAAM,kBAAkB,CAAC;AAEzE,wBAAwB;AAExB,kCAAkC;AAClC,MAAM,YAAY,GAChB,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACpC,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;AAEzE,MAAM,OAAO,wBAAyB,SAAQ,aAAa;IAmBzD;QACE,KAAK,EAAE,CAAC;QACR,kBAAkB;QAClB,IAAI,CAAC,mBAAmB,GAAG,eAAe,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,gBAAgB,CAAC;QAC7C,YAAY;QACZ,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAClC,IAAI,CAAC,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;QACjD,IAAI,CAAC,sBAAsB,GAAG,oBAAoB,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAE3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF;AACD,YAAY;AAEZ,8CAA8C;AAC9C,MAAM,OAAO,4BAA6B,SAAQ,aAAa;IA2B7D;QACE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,SAAS,GAAG;YACf,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,KAAK,GAAG;YACX,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,IAAW,uBAAuB;QAChC,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,MAAM,CAAC,OAAO;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO;YACtB,IAAI,CAAC,QAAQ,CAAC,OAAO;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CACnB,CAAC;IACJ,CAAC;CACF;AACD,YAAY;AAEZ,gDAAgD;AAChD,MAAM,OAAO,qCAAqC;IAehD;QACE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QAErB,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC;IACtC,CAAC;CACF;AACD,YAAY;AAEZ,oDAAoD;AACpD,MAAM,OAAO,6BAA6B;IAuBxC;QACE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;CACF;AACD,YAAY;AAEZ,uCAAuC;AACvC,MAAM,OAAO,sBAAuB,SAAQ,aAAa;IAWvD;;;;OAIG;IACH,gDAAgD;IAEhD;;OAEG;IACH,sCAAsC;IAEtC;QACE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;QAC3B,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACnC,oCAAoC;QACpC,0BAA0B;QAC1B,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,YAAY,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;IACH,CAAC;CACF;AACD,YAAY;AAEZ,gDAAgD;AAChD,MAAM,OAAO,6BAA6B;IASxC;QACE,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,0BAA0B,GAAG,KAAK,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;QAEjC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;CACF;AACD,YAAY;AAEZ,mCAAmC;AACnC,MAAM,OAAO,yBAAyB;IAsBpC;QACE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC;IAC9B,CAAC;CACF;AACD,YAAY;AAEZ,mDAAmD;AACnD,MAAM,OAAO,iCAAiC;IAO5C;QACE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK;QACzC,IAAI,CAAC,oCAAoC,GAAG,IAAI,CAAC;IACnD,CAAC;CACF;AACD,YAAY;AAEZ,oDAAoD;AACpD,MAAM,OAAO,kCAAkC;IAS7C;QACE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC;IAClC,CAAC;CACF;AACD,YAAY;AAEZ,0CAA0C;AAC1C,MAAM,OAAO,yBAAyB;IAgBpC;QACE,IAAI,CAAC,qCAAqC,GAAG,IAAI,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;IACtC,CAAC;CACF;AACD,YAAY;AAEZ,4CAA4C;AAC5C,MAAM,OAAO,0BAA0B;IAKrC,YAAY,WAAmB,EAAE,aAAqB;QACpD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AACD,YAAY;AAEZ,6CAA6C;AAC7C,MAAM,OAAO,2BAA2B;IAOtC;QACE,IAAI,CAAC,aAAa,GAAG,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAE5D,IAAI,CAAC,aAAa,GAAG,IAAI,0BAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,uBAAuB,GAAG,IAAI,0BAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF;AAiBM,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAgB;IACvD;;OAEG;IACH,YAAY,GAAG,YAAY,CAAC;IAE5B,gBAAgB,GAAa,EAAE,CAAC;IAEhC;;OAEG;IACH,sBAAsB,GAAG,KAAK,CAAC;IAE/B,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEzC,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAErC,WAAW,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEjD,sEAAsE;IAEtE,sDAAsD;IAEtD,sDAAsD;IAEtD,oDAAoD;IAEpD,8CAA8C;IAE9C,8DAA8D;IAE9D,gEAAgE;IAEhE,8CAA8C;IAE9C,kDAAkD;IAElD,KAAK,CAAC,CAAC;QACL,gEAAgE;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,MAAM,WAAW,GACf,SAAS,CAAC,QAAQ,KAAK,WAAW;YAClC,SAAS,CAAC,QAAQ,KAAK,WAAW;YAClC,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;SACtC,CAAC;IACJ,CAAC;CACF,CAAA;AA1DY,mBAAmB;IAH/B,YAAY,CAAC;QACZ,SAAS,EAAE,qBAAqB;KACjC,CAAC;GACW,mBAAmB,CA0D/B"}

package/lib-esm/lib/taon-session/taon-session.repository.d.ts

@@ -0,0 +1,13 @@
+import { TaonBaseRepository, TaonServerMiddlewareInterceptOptions } from 'taon/lib-esm';
+import { TaonSessionEntity } from './taon-session.entity';
+export declare class TaonSessionRepository extends TaonBaseRepository<TaonSessionEntity> {
+    entityClassResolveFn: () => typeof TaonSessionEntity;
+    private readonly taonSessionKvRepository;
+    private readonly taonSessionProvider;
+    createSession(partialSessino: Partial<TaonSessionEntity>): Promise<TaonSessionEntity>;
+    requireActiveSession(sessionId: number, userId: number): Promise<TaonSessionEntity>;
+    touchSession(sessionId: number, userId: number, refresh?: boolean): Promise<void>;
+    revokeSession(sessionId: number, userId: number): Promise<void>;
+    getSessionBy(userId: number | string): Promise<TaonSessionEntity>;
+    throwIfNotAuthenticated({ req, res, next, }: Pick<TaonServerMiddlewareInterceptOptions, 'req' | 'res'> & Partial<Pick<TaonServerMiddlewareInterceptOptions, 'next'>>): Promise<void>;
+}

package/lib-esm/lib/taon-session/taon-session.repository.js

@@ -0,0 +1,138 @@
+//#region imports
+import { getStatusCode, getStatusText, HttpStatusEnum, Taon, TaonBaseRepository, TaonRepository, } from 'taon/lib-esm';
+import { TaonSessionEntity } from './taon-session.entity';
+import { TaonSessionKvRepository } from './taon-session.kv.repository';
+import { UtilsJwt } from 'tnp-core/lib-esm';
+import { TaonSessionProvider } from './taon-session.provider';
+//#endregion
+let TaonSessionRepository = class TaonSessionRepository extends TaonBaseRepository {
+    //#region fields & getters
+    entityClassResolveFn = () => TaonSessionEntity;
+    taonSessionKvRepository = this.injectKvRepository(TaonSessionKvRepository);
+    taonSessionProvider = this.injectProvider(TaonSessionProvider);
+    //#endregion
+    //#region create session entity
+    async createSession(partialSessino) {
+        //#region @websqlFunc
+        let session = new TaonSessionEntity().clone(partialSessino);
+        session = await this.save(session);
+        return session;
+        //#endregion
+    }
+    //#endregion
+    async requireActiveSession(sessionId, userId) {
+        //#region @websqlFunc
+        const session = await this.findOne({
+            select: { id: true, userId: true, revokedAt: true, expiresAt: true },
+            where: { id: sessionId, userId },
+        });
+        // console.log('requireActiveSession', {
+        //   sessionId,
+        //   userId,
+        // });
+        if (!session ||
+            session.revokedAt ||
+            !session.expiresAt ||
+            new Date(session.expiresAt).getTime() <= Date.now()) {
+            Taon.error({
+                context: 'requireActiveSession',
+                message: getStatusText(HttpStatusEnum.INVALID_TOKEN),
+                status: getStatusCode(HttpStatusEnum.INVALID_TOKEN),
+            });
+        }
+        return session;
+        //#endregion
+    }
+    async touchSession(sessionId, userId, refresh = false) {
+        //#region @websqlFunc
+        await this.requireActiveSession(sessionId, userId);
+        await this.repo.update({ id: sessionId, userId }, {
+            lastActivityAt: new Date(),
+            ...(refresh
+                ? {
+                    expiresAt: new Date(Date.now() +
+                        this.taonSessionProvider.cookies
+                            .REFRESH_TOKEN_EXPIRES_SECONDS *
+                            1000),
+                }
+                : {}),
+        });
+        //#endregion
+    }
+    async revokeSession(sessionId, userId) {
+        //#region @websqlFunc
+        await this.repo.update({ id: sessionId, userId }, {
+            revokedAt: new Date(),
+            revokeReason: 'logout',
+        });
+        //#endregion
+    }
+    //#region get session by id
+    async getSessionBy(userId) {
+        // TODO not only id ?
+        // let session = new TaonSessionEntity().clone(partialSessino);
+        // session = await this.save(session);
+        return null;
+    }
+    //#endregion
+    //#region throw if not authroized
+    async throwIfNotAuthenticated({ req, res, next, }) {
+        //#region @websqlFunc
+        if (!next) {
+            next = () => void 0;
+        }
+        const token = this.taonSessionKvRepository.getTokenFromRequest(req);
+        if (!token) {
+            Taon.error({
+                message: getStatusText(HttpStatusEnum.NO_TOKEN),
+                status: getStatusCode(HttpStatusEnum.NO_TOKEN),
+            });
+            return;
+        }
+        let payload;
+        try {
+            payload = await UtilsJwt.verify(token, this.taonSessionProvider.cookies.ACCESS_TOKEN_SECRET);
+        }
+        catch (err) {
+            Taon.error({
+                context: 'throwIfNotAuthenticated',
+                message: getStatusText(HttpStatusEnum.INVALID_TOKEN),
+                status: getStatusCode(HttpStatusEnum.INVALID_TOKEN),
+            });
+            return;
+        }
+        if (typeof payload.userId !== 'number' ||
+            !Number.isSafeInteger(payload.userId) ||
+            payload.userId <= 0) {
+            Taon.error({
+                context: 'throwIfNotAuthenticated',
+                message: getStatusText(HttpStatusEnum.INVALID_TOKEN),
+                status: getStatusCode(HttpStatusEnum.INVALID_TOKEN),
+            });
+            return;
+        }
+        if (payload.sessionId !== undefined) {
+            if (typeof payload.sessionId !== 'number' ||
+                !Number.isSafeInteger(payload.sessionId) ||
+                payload.sessionId <= 0) {
+                Taon.error({
+                    context: 'throwIfNotAuthenticated',
+                    message: getStatusText(HttpStatusEnum.INVALID_TOKEN),
+                    status: getStatusCode(HttpStatusEnum.INVALID_TOKEN),
+                });
+                return;
+            }
+            await this.touchSession(payload.sessionId, payload.userId);
+        }
+        Object.assign(req, { userId: payload.userId });
+        next();
+        //#endregion
+    }
+};
+TaonSessionRepository = __decorate([
+    TaonRepository({
+        className: 'TaonSessionRepository',
+    })
+], TaonSessionRepository);
+export { TaonSessionRepository };
+//# sourceMappingURL=taon-session.repository.js.map

package/lib-esm/lib/taon-session/taon-session.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taon-session.repository.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,iBAAiB;AACjB,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,IAAI,EACJ,kBAAkB,EAClB,cAAc,GAEf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY;AAKL,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,kBAAqC;IAC9E,0BAA0B;IAC1B,oBAAoB,GAAmC,GAAG,EAAE,CAC1D,iBAAiB,CAAC;IAEH,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,CAChE,uBAAuB,CACxB,CAAC;IAEe,mBAAmB,GAClC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAC3C,YAAY;IAEZ,+BAA+B;IAC/B,KAAK,CAAC,aAAa,CACjB,cAA0C;QAE1C,qBAAqB;QACrB,IAAI,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5D,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;QACf,YAAY;IACd,CAAC;IACD,YAAY;IAEZ,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,MAAc;QAEd,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YACpE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SACjC,CAAC,CAAC;QACH,wCAAwC;QACxC,eAAe;QACf,YAAY;QACZ,MAAM;QAEN,IACE,CAAC,OAAO;YACR,OAAO,CAAC,SAAS;YACjB,CAAC,OAAO,CAAC,SAAS;YAClB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EACnD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC;gBACT,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;gBACpD,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;QACf,YAAY;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,MAAc,EACd,OAAO,GAAG,KAAK;QAEf,qBAAqB;QACrB,MAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CACpB,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EACzB;YACE,cAAc,EAAE,IAAI,IAAI,EAAE;YAC1B,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE;wBACR,IAAI,CAAC,mBAAmB,CAAC,OAAO;6BAC7B,6BAA6B;4BAC9B,IAAI,CACT;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CACF,CAAC;QACF,YAAY;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAAc;QACnD,qBAAqB;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CACpB,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EACzB;YACE,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,YAAY,EAAE,QAAQ;SACvB,CACF,CAAC;QACF,YAAY;IACd,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,YAAY,CAAC,MAAuB;QACxC,qBAAqB;QACrB,+DAA+D;QAC/D,sCAAsC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,YAAY;IAEZ,iCAAiC;IACjC,KAAK,CAAC,uBAAuB,CAAC,EAC5B,GAAG,EACH,GAAG,EACH,IAAI,GAIH;QACD,qBAAqB;QACrB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC;gBACT,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAC/C,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC;aAC/C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAA4B,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAC7B,KAAK,EACL,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,mBAAmB,CACrD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC;gBACT,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;gBACpD,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;aACpD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,OAAO,CAAC,MAAM,IAAI,CAAC,EACnB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC;gBACT,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;gBACpD,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;aACpD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,IACE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;gBACrC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxC,OAAO,CAAC,SAAS,IAAI,CAAC,EACtB,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC;oBACT,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;oBACpD,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;iBACpD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC;QACP,YAAY;IACd,CAAC;CAEF,CAAA;AA3KY,qBAAqB;IAHjC,cAAc,CAAC;QACd,SAAS,EAAE,uBAAuB;KACnC,CAAC;GACW,qBAAqB,CA2KjC"}

package/lib-esm/lib/taon-session/taon-session.state.service.d.ts

@@ -0,0 +1,59 @@
+import { BehaviorSubject, Observable } from 'rxjs';
+import { TaonBaseProvider } from 'taon/lib-esm';
+import { TaonStateMachine } from 'tnp-core/lib-esm';
+import { TaonSessionState } from './taon-session.models';
+export declare class TaonSessionStateService extends TaonBaseProvider {
+    /**
+     * Refreshes session/authentication information.
+     *
+     * This causes getCurrentUserId() to be called again.
+     */
+    protected readonly refreshSrc: BehaviorSubject<void>;
+    /**
+     * Refreshes authorization context without reloading
+     * the current session/user.
+     *
+     * Useful when roles/groups/permissions change while
+     * the currently authenticated user stays the same.
+     */
+    protected readonly contextRefreshSrc: BehaviorSubject<void>;
+    protected readonly userId: import("tnp-core/lib-esm").BackendSignal<number>;
+    protected readonly currentSlide: import("tnp-core/lib-esm").BackendSignal<TaonSessionState>;
+    private allowedStateMap;
+    state: TaonStateMachine<TaonSessionState>;
+    /**
+     * Current authenticated user.
+     *
+     * Shared because multiple consumers may depend on userId$,
+     * isLoggedIn$ and context$ at the same time.
+     *
+     * One refresh => one getCurrentUserId() request.
+     */
+    protected readonly userId$: Observable<number>;
+    /**
+     * Projection of userId$.
+     *
+     * Does NOT cause another getCurrentUserId() call because
+     * userId$ is shared.
+     */
+    readonly isLoggedIn$: Observable<boolean>;
+    executeActionForState(): void;
+    logout(successCallback?: () => void): void;
+    /**
+     * Reload complete authentication/session state.
+     *
+     * This causes:
+     *
+     * getCurrentUserId()
+     *   -> userId$
+     *   -> isLoggedIn$
+     *   -> context$
+     */
+    refresh(): void;
+    /**
+     * Reload authorization context only.
+     *
+     * Does NOT call getCurrentUserId().
+     */
+    refreshContext(): void;
+}