@webda/core 4.0.0-beta.3 → 4.0.0-beta.4

package/lib/services/token.service.d.ts

@@ -0,0 +1,95 @@
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { MfaState, Session } from "../session/session.js";
+/** Raised for unknown, expired, revoked or reused tokens (403 TOKEN_INVALID) */
+export declare class TokenInvalid extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message?: string);
+}
+/** Tokens returned by a successful login or refresh */
+export interface IssuedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+/** Claims carried by an access token */
+export interface AccessClaims {
+    sub: string;
+    ident: string;
+    provider?: string;
+    amr: string[];
+    roles?: string[];
+    fam: string;
+    mfa: MfaState;
+    /** When the session was authenticated (ms): checked against the user's last password change */
+    authAt?: number;
+}
+/** TokenService parameters */
+export declare class TokenServiceParameters extends ServiceParameters {
+    /**
+     * Access token lifetime in seconds
+     * @default 900
+     */
+    accessTtl: number;
+    /**
+     * Refresh token lifetime in seconds
+     * @default 2592000
+     */
+    refreshTtl: number;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params?: any): this;
+}
+/**
+ * Issues access tokens (JWT) and rotating refresh tokens
+ * @WebdaModda TokenService
+ */
+export declare class TokenService<T extends TokenServiceParameters = TokenServiceParameters> extends Service<T> {
+    /**
+     * @param token - raw refresh token
+     * @returns SHA-256 hex
+     */
+    protected hash(token: string): string;
+    /**
+     * Issue an access + refresh token pair for a logged session
+     *
+     * Roles are not persisted: refreshed access tokens carry no roles until they are re-derived.
+     * @param session - logged session (must not be anonymous nor pending MFA)
+     * @param family - existing family when rotating
+     * @returns the tokens
+     */
+    issue(session: Session, family?: string): Promise<IssuedTokens>;
+    /**
+     * @param token - access token
+     * @returns claims, or undefined when invalid/expired
+     */
+    verifyAccess(token: string): Promise<AccessClaims | undefined>;
+    /**
+     * Exchange a refresh token (rotation with reuse detection)
+     *
+     * The token is only ever looked up by its hash, so an access token or any
+     * arbitrary string simply does not match a stored record.
+     * @param refreshToken - raw refresh token
+     * @returns new tokens and the rebuilt session
+     */
+    refresh(refreshToken: string): Promise<IssuedTokens & {
+        session: Session;
+    }>;
+    /**
+     * @param err - error thrown by a conditional write
+     * @returns true if the error is a failed write condition
+     */
+    protected isConditionFailure(err: any): boolean;
+    /**
+     * @param family - family to revoke
+     */
+    revokeFamily(family: string): Promise<void>;
+    /**
+     * @param userId - user whose tokens are revoked
+     */
+    revokeUser(userId: string): Promise<void>;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/lib/services/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAI1D,gFAAgF;AAChF,qBAAa,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAE,MAAwB,EAE5C;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC;IACd,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8BAA8B;AAC9B,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAK3B;CACF;AAED;;;GAGG;AACH,qBAAa,YAAY,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACrG;;;OAGG;IACH,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,MAA0B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCvF;IAED;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAMnE;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CA0ChF;IAED;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAE9C;IAED;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9C;CACF"}

package/lib/services/token.service.js

@@ -0,0 +1,182 @@
+import { createHash, randomBytes } from "node:crypto";
+import { getUuid } from "@webda/utils";
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { useCrypto } from "./cryptoservice.service.js";
+import { RefreshToken } from "../models/refreshtoken.model.js";
+import { Session } from "../session/session.js";
+const ACCESS_AUDIENCE = "webda-access";
+/** Raised for unknown, expired, revoked or reused tokens (403 TOKEN_INVALID) */
+export class TokenInvalid extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message = "Invalid token") {
+        super(message, 403);
+    }
+}
+/** TokenService parameters */
+export class TokenServiceParameters extends ServiceParameters {
+    /**
+     * Access token lifetime in seconds
+     * @default 900
+     */
+    accessTtl;
+    /**
+     * Refresh token lifetime in seconds
+     * @default 2592000
+     */
+    refreshTtl;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.accessTtl ??= 900;
+        this.refreshTtl ??= 2592000;
+        return this;
+    }
+}
+/**
+ * Issues access tokens (JWT) and rotating refresh tokens
+ * @WebdaModda TokenService
+ */
+export class TokenService extends Service {
+    /**
+     * @param token - raw refresh token
+     * @returns SHA-256 hex
+     */
+    hash(token) {
+        return createHash("sha256").update(token).digest("hex");
+    }
+    /**
+     * Issue an access + refresh token pair for a logged session
+     *
+     * Roles are not persisted: refreshed access tokens carry no roles until they are re-derived.
+     * @param session - logged session (must not be anonymous nor pending MFA)
+     * @param family - existing family when rotating
+     * @returns the tokens
+     */
+    async issue(session, family = getUuid("base64")) {
+        if (!session.isLogged()) {
+            throw new TokenInvalid("Session is not fully authenticated");
+        }
+        const refreshToken = randomBytes(32).toString("base64url");
+        await RefreshToken.create({
+            hash: this.hash(refreshToken),
+            userId: session.userId,
+            identId: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            mfa: session.mfa ?? "none",
+            family,
+            expiresAt: Date.now() + this.parameters.refreshTtl * 1000
+        });
+        session.refreshFamily = family;
+        // A refreshed session is re-authenticated by its (unrevoked) refresh token
+        session.authAt ??= Date.now();
+        const claims = {
+            sub: session.userId,
+            ident: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            roles: session.roles,
+            fam: family,
+            mfa: session.mfa ?? "none",
+            authAt: session.authAt
+        };
+        const accessToken = await useCrypto().jwtSign(claims, {
+            audience: ACCESS_AUDIENCE,
+            expiresIn: this.parameters.accessTtl
+        });
+        return { accessToken, refreshToken, expiresIn: this.parameters.accessTtl };
+    }
+    /**
+     * @param token - access token
+     * @returns claims, or undefined when invalid/expired
+     */
+    async verifyAccess(token) {
+        try {
+            return await useCrypto().jwtVerify(token, { audience: ACCESS_AUDIENCE });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Exchange a refresh token (rotation with reuse detection)
+     *
+     * The token is only ever looked up by its hash, so an access token or any
+     * arbitrary string simply does not match a stored record.
+     * @param refreshToken - raw refresh token
+     * @returns new tokens and the rebuilt session
+     */
+    async refresh(refreshToken) {
+        if (typeof refreshToken !== "string" || !refreshToken) {
+            throw new TokenInvalid();
+        }
+        const ref = RefreshToken.ref({ hash: this.hash(refreshToken) });
+        if (!(await ref.exists())) {
+            throw new TokenInvalid();
+        }
+        const stored = await ref.get();
+        if (stored.revokedAt || stored.expiresAt < Date.now()) {
+            throw new TokenInvalid();
+        }
+        if (stored.rotatedAt) {
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        // Compare-and-set: only one caller can move rotatedAt from undefined to a value
+        try {
+            await ref.patch({ rotatedAt: Date.now() }, "rotatedAt", undefined);
+        }
+        catch (err) {
+            if (!this.isConditionFailure(err)) {
+                throw err;
+            }
+            // Lost the race: treat as reuse and kill the family
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        const session = new Session();
+        session.login(stored.userId, stored.identId, {
+            provider: stored.provider,
+            amr: stored.amr,
+            mfa: stored.mfa ?? "none"
+        });
+        const tokens = await this.issue(session, stored.family);
+        // A revocation may have run between our read and the issue: its scan would have missed the new record
+        for await (const _ of RefreshToken.iterate("family = ? AND revokedAt IS NOT NULL LIMIT 1", [stored.family])) {
+            await RefreshToken.ref({ hash: this.hash(tokens.refreshToken) }).patch({
+                revokedAt: Date.now()
+            });
+            throw new TokenInvalid("Refresh token revoked");
+        }
+        return { ...tokens, session };
+    }
+    /**
+     * @param err - error thrown by a conditional write
+     * @returns true if the error is a failed write condition
+     */
+    isConditionFailure(err) {
+        return /condition/i.test(`${err?.name} ${err?.message}`);
+    }
+    /**
+     * @param family - family to revoke
+     */
+    async revokeFamily(family) {
+        for await (const token of RefreshToken.iterate("family = ? AND revokedAt IS NULL", [family])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+    /**
+     * @param userId - user whose tokens are revoked
+     */
+    async revokeUser(userId) {
+        for await (const token of RefreshToken.iterate("userId = ? AND revokedAt IS NULL", [userId])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+}
+//# sourceMappingURL=token.service.js.map

package/lib/services/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAY,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,gFAAgF;AAChF,MAAM,OAAO,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAW,eAAe;QAC3C,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;CACF;AAsBD,8BAA8B;AAC9B,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,SAAS,CAAS;IAClB;;;OAGG;IACH,UAAU,CAAS;IAEnB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC;QACvB,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,YAAwE,SAAQ,OAAU;IACrG;;;OAGG;IACO,IAAI,CAAC,KAAa;QAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,MAAM,GAAW,OAAO,CAAC,QAAQ,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI;SACnD,CAAC,CAAC;QACV,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;QAC/B,2EAA2E;QAC3E,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,KAAK,EAAE,OAAO,CAAC,SAAS;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YACpD,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,EAAE,WAAkB,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oDAAoD;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,sGAAsG;QACtG,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,8CAA8C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5G,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC,KAAK,CAAC;gBAC5E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACf,CAAC,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACO,kBAAkB,CAAC,GAAQ;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF"}

package/lib/session/manager.model.d.ts

@@ -21,6 +21,22 @@ export declare abstract class SessionManager<T extends ServiceParameters = Servi
      * @param session
      */
     abstract save(context: Context, session: Session): Promise<void>;
+    /**
+     * Build a stateless session from an access token (any transport)
+     * @param context - the context
+     * @param token - access token
+     * @returns the session, anonymous when the token is invalid
+     */
+    loadFromToken(context: Context, token: string): Promise<Session>;
+    /**
+     * Whether the user of an authenticated session changed their password after the session was authenticated
+     *
+     * Costs one user read (through the registered user resolver) per load of a session carrying `authAt`. A failing
+     * read counts as outdated: the session is then anonymous for that request.
+     * @param session - loaded session
+     * @returns true when the session must be treated as anonymous
+     */
+    protected isOutdated(session: Session): Promise<boolean>;
 }
 /** Persistent session data stored in a model with a TTL */
 export declare class SessionModel extends UuidModel {

package/lib/session/manager.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBA6B5C;CACF"}
+{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY7D;CACF;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBAgC5C;CACF"}

package/lib/session/manager.model.js

@@ -38,11 +38,56 @@ import { isWebContext } from "../contexts/icontext.js";
 import { getUuid } from "@webda/utils";
 import { ServiceParameters } from "../services/serviceparameters.js";
 import { Session } from "./session.js";
+import { useService, useUserResolver } from "../core/hooks.js";
+import { runAsSystem } from "../contexts/execution.js";
 import { UuidModel } from "@webda/models";
 /**
  * Manage load and save of sessions
  */
 export class SessionManager extends Service {
+    /**
+     * Build a stateless session from an access token (any transport)
+     * @param context - the context
+     * @param token - access token
+     * @returns the session, anonymous when the token is invalid
+     */
+    async loadFromToken(context, token) {
+        const session = new Session();
+        session.stateless = true;
+        const claims = await useService("TokenService").verifyAccess(token);
+        if (claims) {
+            session.login(claims.sub, claims.ident, { provider: claims.provider, amr: claims.amr, mfa: claims.mfa });
+            session.roles = claims.roles;
+            session.refreshFamily = claims.fam;
+            session.authAt = claims.authAt;
+            if (await this.isOutdated(session)) {
+                session.logout();
+            }
+        }
+        return session;
+    }
+    /**
+     * Whether the user of an authenticated session changed their password after the session was authenticated
+     *
+     * Costs one user read (through the registered user resolver) per load of a session carrying `authAt`. A failing
+     * read counts as outdated: the session is then anonymous for that request.
+     * @param session - loaded session
+     * @returns true when the session must be treated as anonymous
+     */
+    async isOutdated(session) {
+        if (session.userId === undefined || typeof session.authAt !== "number") {
+            return false;
+        }
+        try {
+            const user = await runAsSystem(() => useUserResolver().resolve(session.userId));
+            const changedAt = user?.password?.changedAt;
+            return typeof changedAt === "number" && changedAt > session.authAt;
+        }
+        catch (err) {
+            this.log("WARN", "Cannot check the session against the user password, session ignored", err?.message);
+            return true;
+        }
+    }
 }
 /** Persistent session data stored in a model with a TTL */
 export class SessionModel extends UuidModel {
@@ -107,6 +152,11 @@ let CookieSessionManager = (() => {
             if (!isWebContext(context)) {
                 return new Session();
             }
+            // A Bearer scheme is authoritative: an invalid token yields an anonymous session, never the cookie
+            const authorization = context.getHttpContext().getHeader("authorization");
+            if (typeof authorization === "string" && /^bearer(\s|$)/i.test(authorization)) {
+                return this.loadFromToken(context, authorization.substring(7).trim());
+            }
             const session = new Session();
             const cookie = await SecureCookie.load(this.parameters.cookie.name, session, context, this.parameters.jwt);
             if (this.sessionModel) {
@@ -119,6 +169,10 @@ let CookieSessionManager = (() => {
             else {
                 Object.assign(session, cookie);
             }
+            // A password change ends the sessions authenticated before it
+            if (await this.isOutdated(session)) {
+                session.logout();
+            }
             return session;
         }
         /**
@@ -128,9 +182,12 @@ let CookieSessionManager = (() => {
             if (!isWebContext(context)) {
                 return;
             }
+            if (session.stateless) {
+                return;
+            }
             // If store is found session info are stored in db
             if (this.sessionModel) {
-                if (this.sessionModel.exists(session.uuid)) {
+                if (await this.sessionModel.exists(session.uuid)) {
                     await this.sessionModel.update({
                         uuid: session.uuid,
                         session,

package/lib/session/manager.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.model.js","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAW,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAoC,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,MAAM,OAAgB,cAAgE,SAAQ,OAAU;CAYvG;AAED,2DAA2D;AAC3D,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC,GAAG,CAAS;IACZ,OAAO,CAAM;IACb;;OAEG;IACH,YAAY,IAAS;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAc;IACjB;;OAEG;IACH,MAAM,CAAiB;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;;GAOG;IACU,oBAAoB;sBAEvB,cAAc;;;;iBAFX,oBAEX,SAAQ,WAAiB;;;yCACxB,MAAM,CAAC,eAAe,CAAC;YACxB,yLAAA,aAAa,6BAAb,aAAa,qGAAgB;;;QAA7B,aAAa,gEAAgB;QAE7B,YAAY,6DAAuC;QAEnD;;WAEG;QACH,KAAK,CAAC,IAAI,CAAC,OAAgB;YACzB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3G,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC3E,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;gBAC5B,CAAC;gBACD,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,IAAI,CAAC,OAAgB,EAAE,OAAgB;YAC3C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,kDAAkD;YAClD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;qBACvD,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;qBACvD,CAAC,CAAC;gBACL,CAAC;gBACD,YAAY,CAAC,IAAI,CACf,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAC3B,OAAO,EACP,EAAE,EACF,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAC5D,IAAI,CAAC,UAAU,CAAC,MAAM,CACvB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChH,CAAC;;;SA7DU,oBAAoB"}
+{"version":3,"file":"manager.model.js","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAW,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAoC,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,MAAM,OAAgB,cAAgE,SAAQ,OAAU;IAatG;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,KAAa;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACzG,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC;YACnC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,UAAU,CAAC,OAAgB;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAQ,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACrF,MAAM,SAAS,GAAG,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;YAC5C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,qEAAqE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC,GAAG,CAAS;IACZ,OAAO,CAAM;IACb;;OAEG;IACH,YAAY,IAAS;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAc;IACjB;;OAEG;IACH,MAAM,CAAiB;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;;GAOG;IACU,oBAAoB;sBAEvB,cAAc;;;;iBAFX,oBAEX,SAAQ,WAAiB;;;yCACxB,MAAM,CAAC,eAAe,CAAC;YACxB,yLAAA,aAAa,6BAAb,aAAa,qGAAgB;;;QAA7B,aAAa,gEAAgB;QAE7B,YAAY,6DAAuC;QAEnD;;WAEG;QACH,KAAK,CAAC,IAAI,CAAC,OAAgB;YACzB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,CAAC;YACD,mGAAmG;YACnG,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC1E,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3G,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC3E,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;gBAC5B,CAAC;gBACD,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,8DAA8D;YAC9D,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,IAAI,CAAC,OAAgB,EAAE,OAAgB;YAC3C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,kDAAkD;YAClD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;qBACvD,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;qBACvD,CAAC,CAAC;gBACL,CAAC;gBACD,YAAY,CAAC,IAAI,CACf,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAC3B,OAAO,EACP,EAAE,EACF,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAC5D,IAAI,CAAC,UAAU,CAAC,MAAM,CACvB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChH,CAAC;;;SAzEU,oBAAoB"}

package/lib/session/session.d.ts

@@ -1,3 +1,15 @@
+/**
+ * MFA progress of a session
+ */
+export type MfaState = "none" | "pending" | "verified";
+/**
+ * Options for {@link Session.login}
+ */
+export interface LoginOptions {
+    provider?: string;
+    amr?: string[];
+    mfa?: MfaState;
+}
 /**
  * Session
  */
@@ -19,12 +31,38 @@ export declare class Session {
      * User current roles
      */
     roles: string[];
+    /**
+     * Authentication provider used
+     */
+    provider?: string;
+    /**
+     * Authentication methods used
+     */
+    amr?: string[];
+    /**
+     * MFA state of the session
+     */
+    mfa?: MfaState;
+    /**
+     * Refresh token family identifier
+     */
+    refreshFamily?: string;
+    /**
+     * When the session was authenticated (ms timestamp, stamped by the Authentication service): a session older than
+     * the last password change of its user is loaded as anonymous
+     */
+    authAt?: number;
+    /**
+     * Session is stateless (not persisted in cookies)
+     */
+    stateless?: boolean;
     /**
      * Login
      * @param userId - the user identifier
      * @param identUsed - the identity used
+     * @param options - login options including provider, amr, and mfa state
      */
-    login(userId: string, identUsed: string): void;
+    login(userId: string, identUsed: string, options?: LoginOptions): void;
     /**
      * Logout
      */
@@ -34,6 +72,11 @@ export declare class Session {
      * @returns true if the condition is met
      */
     isLogged(): boolean;
+    /**
+     * If session is pending MFA verification
+     * @returns true if the condition is met
+     */
+    isPending(): boolean;
     /**
      * Session is dirty and requires save
      * @returns true if the condition is met

package/lib/session/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session/session.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,OAAO;IAElB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAS;IACnC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAGtC;IACD;;OAEG;IACH,MAAM,SAIL;IAED;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAElB;IAED;;;OAGG;IACH,OAAO,IAAI,OAAO,CAEjB;IAED;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAef;CACF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,OAAO;IACzC;;OAEG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session/session.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,qBAAa,OAAO;IAElB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAS;IACnC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf;;OAEG;IACH,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,QAMlE;IACD;;OAEG;IACH,MAAM,SASL;IAED;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAElB;IAED;;;OAGG;IACH,SAAS,IAAI,OAAO,CAEnB;IAED;;;OAGG;IACH,OAAO,IAAI,OAAO,CAEjB;IAED;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAef;CACF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,OAAO;IACzC;;OAEG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB"}

package/lib/session/session.js

@@ -40,11 +40,16 @@ let Session = (() => {
     let _changed_decorators;
     let _changed_initializers = [];
     let _changed_extraInitializers = [];
+    let _stateless_decorators;
+    let _stateless_initializers = [];
+    let _stateless_extraInitializers = [];
     return class Session {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
             _changed_decorators = [NotEnumerable];
+            _stateless_decorators = [NotEnumerable];
             __esDecorate(null, null, _changed_decorators, { kind: "field", name: "changed", static: false, private: false, access: { has: obj => "changed" in obj, get: obj => obj.changed, set: (obj, value) => { obj.changed = value; } }, metadata: _metadata }, _changed_initializers, _changed_extraInitializers);
+            __esDecorate(null, null, _stateless_decorators, { kind: "field", name: "stateless", static: false, private: false, access: { has: obj => "stateless" in obj, get: obj => obj.stateless, set: (obj, value) => { obj.stateless = value; } }, metadata: _metadata }, _stateless_initializers, _stateless_extraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         changed = __runInitializers(this, _changed_initializers, false);
@@ -64,14 +69,43 @@ let Session = (() => {
          * User current roles
          */
         roles;
+        /**
+         * Authentication provider used
+         */
+        provider;
+        /**
+         * Authentication methods used
+         */
+        amr;
+        /**
+         * MFA state of the session
+         */
+        mfa;
+        /**
+         * Refresh token family identifier
+         */
+        refreshFamily;
+        /**
+         * When the session was authenticated (ms timestamp, stamped by the Authentication service): a session older than
+         * the last password change of its user is loaded as anonymous
+         */
+        authAt;
+        /**
+         * Session is stateless (not persisted in cookies)
+         */
+        stateless = __runInitializers(this, _stateless_initializers, void 0);
         /**
          * Login
          * @param userId - the user identifier
          * @param identUsed - the identity used
+         * @param options - login options including provider, amr, and mfa state
          */
-        login(userId, identUsed) {
+        login(userId, identUsed, options = {}) {
             this.userId = userId;
             this.identUsed = identUsed;
+            this.provider = options.provider;
+            this.amr = options.amr ?? [];
+            this.mfa = options.mfa ?? "none";
         }
         /**
          * Logout
@@ -80,13 +114,25 @@ let Session = (() => {
             delete this.userId;
             delete this.identUsed;
             delete this.roles;
+            delete this.provider;
+            delete this.amr;
+            delete this.mfa;
+            delete this.refreshFamily;
+            delete this.authAt;
         }
         /**
          * If session is authenticated
          * @returns true if the condition is met
          */
         isLogged() {
-            return this.userId !== undefined;
+            return this.userId !== undefined && this.mfa !== "pending";
+        }
+        /**
+         * If session is pending MFA verification
+         * @returns true if the condition is met
+         */
+        isPending() {
+            return this.userId !== undefined && this.mfa === "pending";
         }
         /**
          * Session is dirty and requires save
@@ -115,6 +161,9 @@ let Session = (() => {
             };
             return new Proxy(this, proxyHandler);
         }
+        constructor() {
+            __runInitializers(this, _stateless_extraInitializers);
+        }
     };
 })();
 export { Session };

package/lib/session/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session/session.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;GAEG;IACU,OAAO;;;;iBAAP,OAAO;;;mCACjB,aAAa;YACd,uKAAU,OAAO,6BAAP,OAAO,yFAAkB;;;QAAzB,OAAO,kDAAY,KAAK,EAAC;QACnC;;WAEG;QACH,IAAI,uDAAS;QACb;;WAEG;QACH,MAAM,CAAU;QAChB;;WAEG;QACH,SAAS,CAAS;QAElB;;WAEG;QACH,KAAK,CAAW;QAEhB;;;;WAIG;QACH,KAAK,CAAC,MAAc,EAAE,SAAiB;YACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;QACD;;WAEG;QACH,MAAM;YACJ,OAAO,IAAI,CAAC,MAAM,CAAC;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED;;;WAGG;QACH,QAAQ;YACN,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QACnC,CAAC;QAED;;;WAGG;QACH,OAAO;YACL,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED;;;WAGG;QACH,QAAQ;YACN,MAAM,YAAY,GAAG;gBACnB,GAAG,EAAE,CAAC,GAAS,EAAE,QAAgB,EAAE,KAAU,EAAE,EAAE;oBAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;oBACtB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,GAAG,EAAE,CAAC,GAAS,EAAE,QAAgB,EAAE,EAAE;oBACnC,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACtC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;aACF,CAAC;YACF,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;;;SA1EU,OAAO;AA6EpB;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,OAAO;CAK1C"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session/session.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAgB/C;;GAEG;IACU,OAAO;;;;;;;iBAAP,OAAO;;;mCACjB,aAAa;qCAiDb,aAAa;YAhDd,uKAAU,OAAO,6BAAP,OAAO,yFAAkB;YAiDnC,6KAAA,SAAS,6BAAT,SAAS,6FAAW;;;QAjDV,OAAO,kDAAY,KAAK,EAAC;QACnC;;WAEG;QACH,IAAI,uDAAS;QACb;;WAEG;QACH,MAAM,CAAU;QAChB;;WAEG;QACH,SAAS,CAAS;QAElB;;WAEG;QACH,KAAK,CAAW;QAEhB;;WAEG;QACH,QAAQ,CAAU;QAElB;;WAEG;QACH,GAAG,CAAY;QAEf;;WAEG;QACH,GAAG,CAAY;QAEf;;WAEG;QACH,aAAa,CAAU;QAEvB;;;WAGG;QACH,MAAM,CAAU;QAEhB;;WAEG;QAEH,SAAS,4DAAW;QAEpB;;;;;WAKG;QACH,KAAK,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAO,GAAiB,EAAE;YACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC;QACnC,CAAC;QACD;;WAEG;QACH,MAAM;YACJ,OAAO,IAAI,CAAC,MAAM,CAAC;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,CAAC;YAChB,OAAO,IAAI,CAAC,GAAG,CAAC;YAChB,OAAO,IAAI,CAAC,aAAa,CAAC;YAC1B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED;;;WAGG;QACH,QAAQ;YACN,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;QAC7D,CAAC;QAED;;;WAGG;QACH,SAAS;YACP,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;QAC7D,CAAC;QAED;;;WAGG;QACH,OAAO;YACL,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED;;;WAGG;QACH,QAAQ;YACN,MAAM,YAAY,GAAG;gBACnB,GAAG,EAAE,CAAC,GAAS,EAAE,QAAgB,EAAE,KAAU,EAAE,EAAE;oBAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;oBACtB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,GAAG,EAAE,CAAC,GAAS,EAAE,QAAgB,EAAE,EAAE;oBACnC,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACtC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;aACF,CAAC;YACF,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;;;;;;SA3HU,OAAO;AA8HpB;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,OAAO;CAK1C"}

package/lib/stores/memory.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.service.d.ts","sourceRoot":"","sources":["../../src/stores/memory.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAqC,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAIpG,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IACxD;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;QACb;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAU3B;CACF;AA0FD,4DAA4D;AAC5D,cAAM,cAAe,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAI9B;CACF;AAED;;;;;GAKG;AACH,qBAAa,WAAW,CAAC,CAAC,SAAS,qBAAqB,GAAG,qBAAqB,CAAE,SAAQ,KAAK,CAAC,CAAC,CAAC;IAChG;;OAEG;IACH,OAAO,EAAE,cAAc,CAAwB;IAC/C;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAAC;IAC3B;;OAEG;IACH,kBAAkB,MAAQ;IAC1B;;OAEG;IACH,OAAO,CAAC,GAAG,CAAS;IAEpB;;;;;;;OAOG;IACG,OAAO,kBAiCZ;IAED;;OAEG;IACG,IAAI,kBA0BT;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAe1B;IAED;;OAEG;IACH,cAAc,SAwBb;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;;OAIG;IAEH,aAAa,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAO3D;CACF"}
+{"version":3,"file":"memory.service.d.ts","sourceRoot":"","sources":["../../src/stores/memory.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAqC,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAIpG,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IACxD;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;QACb;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAU3B;CACF;AA0FD,4DAA4D;AAC5D,cAAM,cAAe,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAI9B;CACF;AAED;;;;;GAKG;AACH,qBAAa,WAAW,CAAC,CAAC,SAAS,qBAAqB,GAAG,qBAAqB,CAAE,SAAQ,KAAK,CAAC,CAAC,CAAC;IAChG;;OAEG;IACH,OAAO,EAAE,cAAc,CAAwB;IAC/C;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAAC;IAC3B;;OAEG;IACH,kBAAkB,MAAQ;IAC1B;;OAEG;IACH,OAAO,CAAC,GAAG,CAAS;IAEpB;;;;;;;OAOG;IACG,OAAO,kBAqCZ;IAED;;OAEG;IACG,IAAI,kBA8BT;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAe1B;IAED;;OAEG;IACH,cAAc,SAwBb;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;;OAIG;IAEH,aAAa,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAQ3D;CACF"}

package/lib/stores/memory.service.js

@@ -331,11 +331,12 @@ let MemoryStore = (() => {
          */
         getRepository(model) {
             // Use our own storage to allow persistence
-            const pks = useModelMetadata(model).PrimaryKey;
-            const inner = new MemoryRepository(model, pks, undefined, this.storage);
+            const meta = useModelMetadata(model);
+            const pks = meta.PrimaryKey;
+            const inner = new MemoryRepository(model, pks, meta.PrimaryKeySeparator, this.storage);
             // Wrap in EventRepository so typed CRUD events (Created/Updated/...) fire;
             // consumers reach them via useRepository(model).on(...).
-            return new EventRepository(model, pks, inner);
+            return new EventRepository(model, pks, inner, meta.PrimaryKeySeparator);
         }
     };
 })();