@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/impersonation.js

@@ -1,8 +1,9 @@
-import { newAuthId as e, subjectFromUser as t } from "./userStore.js";
-import { Effect as n } from "effect";
-import { IMPERSONATION_METADATA_KEY as r, rawImpersonationMark as i } from "@voltro/protocol";
+import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
+import { newAuthId as t, subjectFromUser as n } from "./userStore.js";
+import { Effect as r } from "effect";
+import { IMPERSONATION_METADATA_KEY as i, rawImpersonationMark as a } from "@voltro/protocol";
 //#region src/impersonation.ts
-var a = 900, o = [
+var o = 900, s = [
 	"/mfa/enroll/start",
 	"/mfa/enroll/verify",
 	"/mfa/unenroll",
@@ -12,7 +13,7 @@ var a = 900, o = [
 	"/sessions/revoke-others",
 	"/switch-tenant",
 	"/impersonate/start"
-], s = (e) => {
+], c = (e) => {
 	if (typeof e != "object" || !e) return null;
 	let t = e;
 	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
@@ -23,93 +24,93 @@ var a = 900, o = [
 		expiresAt: t.expiresAt,
 		...typeof t.reason == "string" ? { reason: t.reason } : {}
 	};
-}, c = (e) => e.type === "user" ? s(i(e)) : null, l = (e) => c(e) !== null, u = () => (e) => {
+}, l = (e) => e.type === "user" ? c(a(e)) : null, u = (e) => l(e) !== null, d = () => (e) => {
 	if (e.type !== "user" || e.metadata === void 0) return e;
-	let t = s(e.metadata[r]), { metadata: n, ...i } = e;
+	let t = c(e.metadata[i]), { metadata: n, ...r } = e;
 	return {
-		...i,
+		...r,
 		metadata: t === null ? { __redacted: "all" } : {
 			__redacted: "all-except-impersonation",
-			[r]: t
+			[i]: t
 		}
 	};
-}, d = (e, t, n = {}) => ({
+}, f = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), f = (e, t) => n.suspend(() => {
-	let r = e.audit(t);
-	return r === void 0 ? n.void : n.isEffect(r) ? r : n.tryPromise({
-		try: () => Promise.resolve(r),
+}), p = (e, t) => r.suspend(() => {
+	let n = e.audit(t);
+	return n === void 0 ? r.void : r.isEffect(n) ? n : r.tryPromise({
+		try: () => Promise.resolve(n),
 		catch: (e) => e
 	});
-}).pipe(n.catchCause(() => n.void)), p = (i, a, o) => n.gen(function* () {
-	let s = o.impersonation, c = (o.now ?? Date.now)(), u = new Date(c), p = i.actorSubject, m = (e, t, r = {}) => f(s, {
+}).pipe(r.catchCause(() => r.void)), m = (e, a, o) => r.gen(function* () {
+	let s = o.impersonation, c = (o.now ?? Date.now)(), l = new Date(c), d = e.actorSubject, m = (t, n, i = {}) => p(s, {
 		kind: "refused",
-		at: u,
-		actorUserId: r.actorUser?.id ?? (p.type === "user" ? p.id : null),
-		actorEmail: r.actorUser?.email ?? null,
-		targetUserId: r.target?.id ?? null,
-		targetEmail: r.target?.email ?? null,
-		tenantId: p.tenantId ?? null,
-		reason: i.reason ?? null,
-		refusal: t,
-		ipAddress: i.ipAddress ?? null,
-		userAgent: i.userAgent ?? null
-	}).pipe(n.as(d(e, {
-		error: t,
-		...r.message === void 0 ? {} : { message: r.message }
+		at: l,
+		actorUserId: i.actorUser?.id ?? (d.type === "user" ? d.id : null),
+		actorEmail: i.actorUser?.email ?? null,
+		targetUserId: i.target?.id ?? null,
+		targetEmail: i.target?.email ?? null,
+		tenantId: d.tenantId ?? null,
+		reason: e.reason ?? null,
+		refusal: n,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}).pipe(r.as(f(t, {
+		error: n,
+		...i.message === void 0 ? {} : { message: i.message }
 	})));
-	if (p.type !== "user") return yield* m(401, "unauthenticated");
-	if (l(p)) return yield* m(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
-	if (!i.actorSessionId) return yield* m(400, "no_actor_session");
-	let h = yield* a.findById(p.id);
+	if (d.type !== "user") return yield* m(401, "unauthenticated");
+	if (u(d)) return yield* m(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
+	if (!e.actorSessionId) return yield* m(400, "no_actor_session");
+	let h = yield* a.findById(d.id);
 	if (!h) return yield* m(401, "unauthenticated");
-	if (!i.targetUserId && !i.targetEmail) return yield* m(400, "target_required", { actorUser: h });
-	let g = i.targetUserId ? yield* a.findById(i.targetUserId) : yield* a.findByEmail(i.targetEmail);
+	if (!e.targetUserId && !e.targetEmail) return yield* m(400, "target_required", { actorUser: h });
+	let g = e.targetUserId ? yield* a.findById(e.targetUserId) : yield* a.findByEmail(e.targetEmail);
 	if (!g) return yield* m(404, "target_not_found", { actorUser: h });
 	if (g.id === h.id) return yield* m(400, "self_impersonation", {
 		actorUser: h,
 		target: g
 	});
-	let _ = i.reason?.trim() ?? "";
+	let _ = e.reason?.trim() ?? "";
 	if ((s.requireReason ?? !0) && _.length === 0) return yield* m(400, "reason_required", {
 		actorUser: h,
 		target: g,
 		message: "A reason is required to impersonate a user."
 	});
 	if (!(yield* s.authority({
-		actor: p,
+		actor: d,
 		actorUser: h,
 		target: g
-	}).pipe(n.catchCause(() => n.succeed(!1))))) return yield* m(403, "not_permitted", {
+	}).pipe(r.catchCause(() => r.succeed(!1))))) return yield* m(403, "not_permitted", {
 		actorUser: h,
 		target: g
 	});
 	if (yield* s.authority({
-		actor: t(g),
+		actor: n(g),
 		actorUser: g,
 		target: h
-	}).pipe(n.catchCause(() => n.succeed(!0)))) return yield* m(403, "target_may_impersonate", {
+	}).pipe(r.catchCause(() => r.succeed(!0)))) return yield* m(403, "target_may_impersonate", {
 		actorUser: h,
 		target: g,
 		message: "This user may themselves impersonate others and cannot be impersonated."
 	});
-	let v = s.maxDurationSeconds ?? 900, y = Math.max(1, Math.min(i.durationSeconds ?? v, v)), b = new Date(c + y * 1e3), x = e("sess"), S = yield* a.insertImpersonationGrant({
-		id: e("imp"),
+	let v = s.maxDurationSeconds ?? 900, y = Math.max(1, Math.min(e.durationSeconds ?? v, v)), b = new Date(c + y * 1e3), x = t("sess"), S = yield* a.insertImpersonationGrant({
+		id: t("imp"),
 		sessionId: x,
 		actorUserId: h.id,
-		actorSessionId: i.actorSessionId,
+		actorSessionId: e.actorSessionId,
 		targetUserId: g.id,
 		tenantId: g.tenantId,
 		reason: _.length > 0 ? _ : null,
 		expiresAt: b,
-		ipAddress: i.ipAddress ?? null,
-		userAgent: i.userAgent ?? null
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
 	}), C = {
 		actorUserId: h.id,
-		actorSessionId: i.actorSessionId,
+		actorSessionId: e.actorSessionId,
 		grantId: S.id,
 		startedAt: S.startedAt.toISOString(),
 		expiresAt: b.toISOString(),
@@ -117,13 +118,13 @@ var a = 900, o = [
 	}, w = yield* o.issuer.issue(g, {
 		sessionId: x,
 		ttlSeconds: y,
-		metadata: { [r]: C },
-		ipAddress: i.ipAddress ?? null,
-		userAgent: i.userAgent ?? null
+		metadata: { [i]: C },
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
 	});
-	return yield* f(s, {
+	return yield* p(s, {
 		kind: "started",
-		at: u,
+		at: l,
 		actorUserId: h.id,
 		actorEmail: h.email,
 		targetUserId: g.id,
@@ -133,43 +134,43 @@ var a = 900, o = [
 		grantId: S.id,
 		reason: _.length > 0 ? _ : null,
 		expiresAt: b,
-		ipAddress: i.ipAddress ?? null,
-		userAgent: i.userAgent ?? null
-	}), d(200, {
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}), f(200, {
 		ok: !0,
 		impersonation: C,
 		subject: w.subject
 	}, { setCookie: w.setCookie });
-}), m = (e, t, r) => n.gen(function* () {
-	let i = r.impersonation, a = (r.now ?? Date.now)(), o = new Date(a), s = c(e.subject);
-	if (!s || !e.sessionId) return d(400, { error: "not_impersonating" });
-	let l = yield* t.findImpersonationGrantBySession(e.sessionId);
-	yield* t.endImpersonationGrant(e.sessionId, "stopped", o).pipe(n.ignore), e.subject.type === "user" && (yield* t.revokeSession(e.subject.id, e.sessionId).pipe(n.ignore)), r.invalidateSession?.(e.sessionId);
-	let u = yield* t.findById(s.actorUserId), p = yield* t.findSession(s.actorSessionId), m = p ? Math.floor((p.expiresAt.getTime() - a) / 1e3) : 0;
-	if (yield* f(i, {
+}), h = (t, n, i) => r.gen(function* () {
+	let a = i.impersonation, o = (i.now ?? Date.now)(), s = new Date(o), c = l(t.subject);
+	if (!c || !t.sessionId) return f(400, { error: "not_impersonating" });
+	let u = yield* n.findImpersonationGrantBySession(t.sessionId);
+	yield* n.endImpersonationGrant(t.sessionId, "stopped", s).pipe(r.ignore), t.subject.type === "user" && (yield* n.revokeSession(t.subject.id, t.sessionId).pipe(r.ignore)), i.invalidateSession?.(t.sessionId);
+	let d = yield* n.findById(c.actorUserId), m = yield* n.findSession(c.actorSessionId), h = m ? Math.floor((m.expiresAt.getTime() - o) / 1e3) : 0;
+	if (yield* p(a, {
 		kind: "stopped",
-		at: o,
-		actorUserId: s.actorUserId,
-		actorEmail: u?.email ?? null,
-		targetUserId: e.subject.type === "user" ? e.subject.id : null,
+		at: s,
+		actorUserId: c.actorUserId,
+		actorEmail: d?.email ?? null,
+		targetUserId: t.subject.type === "user" ? t.subject.id : null,
 		targetEmail: null,
-		tenantId: l?.tenantId ?? e.subject.tenantId ?? null,
-		sessionId: e.sessionId,
-		...l ? { grantId: l.id } : {},
-		reason: l?.reason ?? null
-	}), !u || !p || m <= 0) return d(200, {
+		tenantId: u?.tenantId ?? t.subject.tenantId ?? null,
+		sessionId: t.sessionId,
+		...u ? { grantId: u.id } : {},
+		reason: u?.reason ?? null
+	}), !d || !e(m, c.actorSessionId, d.id, o) || !Number.isSafeInteger(h) || h <= 0) return f(200, {
 		ok: !0,
 		restored: !1
-	}, { setCookie: r.issuer.clear() });
-	let h = yield* r.issuer.reissue(u, {
-		sessionId: s.actorSessionId,
-		ttlSeconds: m
+	}, { setCookie: i.issuer.clear() });
+	let g = yield* i.issuer.reissue(d, {
+		sessionId: c.actorSessionId,
+		ttlSeconds: h
 	});
-	return d(200, {
+	return f(200, {
 		ok: !0,
 		restored: !0,
-		subject: h.subject
-	}, { setCookie: h.setCookie });
+		subject: g.subject
+	}, { setCookie: g.setCookie });
 });
 //#endregion
-export { a as IMPERSONATION_DEFAULT_DURATION_S, o as IMPERSONATION_FORBIDDEN_SUBPATHS, p as handleImpersonationStart, m as handleImpersonationStop, u as impersonationAuditRedactor, c as impersonationOf, l as isImpersonated };
+export { o as IMPERSONATION_DEFAULT_DURATION_S, s as IMPERSONATION_FORBIDDEN_SUBPATHS, m as handleImpersonationStart, h as handleImpersonationStop, d as impersonationAuditRedactor, l as impersonationOf, u as isImpersonated };