@appxdigital/appx-core 0.1.121-beta.15 → 0.1.121-beta.16

package/CHANGELOG.md

@@ -51,6 +51,7 @@ A scalar field is included unless it is: the primary key (`@id`), a server-manag
 - `app.module.ts` uses `coreEnvFilePath()` for `envFilePath`.
 - Generated `package.json` adds `helmet`; the `start` script sets `NODE_ENV=development`.
 - `AuthController.getAllSessions` / `closeSpecificSession` use `@UseGuards(AuthenticatedGuard)`.
+- `app.module.ts` imports `AuthModule.forRoot()` (not the bare `AuthModule`) — see the migration note below.
 
 ### Migration
 
@@ -132,6 +133,17 @@ async update(@Param('id') id: string, @Body() data: Update<Model>Dto) { return s
 >
 > **For AI agents:** this is a behaviour restriction on a production app. Before deploying, tell the developer that (a) any create that sets a foreign key to a model without a `connect` rule now fails — and the app won't boot until those rules exist, and (b) any `create` condition that referenced a relation no longer enforces it there and must be re-expressed as a `connect` rule. Do not proceed silently. The boot-time error message names exactly what to add. See [`docs/permissions.md`](../docs/permissions.md#the-connect-action--authorizes-every-relationship-a-create-establishes).
 
+**6. Auth module — `AuthModule` → `AuthModule.forRoot()` (`src/app.module.ts`).**
+The bare `AuthModule` no longer registers anything; wire it as `AuthModule.forRoot()`
+(all providers + the built-in `/auth` controller). This exists so the controller
+can be conditionally omitted: to override the auth endpoints (e.g. widen
+registration to accept `name`), import `AuthModule.forRoot({ controller: false })`
+and register your own controller that `extends AuthController` at the same `/auth`
+prefix. The auth building blocks (`AuthController`, `AuthService`, `RegisterDto`,
+`UserDto`, the Passport strategies, guards) are now exported from the package root
+— stop importing them from `@appxdigital/appx-core/dist/...`. Full guide:
+[`docs/authentication.md`](../docs/authentication.md).
+
 **5. Create-permission enforcement (behaviour change — review before upgrading).**
 - Ensure every model/role that legitimately creates records has an explicit `create` permission (or `'ALL'`). Without one, create now returns `403` (previously unchecked). Internal framework flows (registration, sessions, tokens) are unaffected.
 - If you supplied arbitrary values for a field a `create` condition constrains (e.g. an owner id), those requests now return `403` unless the value matches — use `setUserIdField` to have the framework set it.

package/PRERELEASES.md

@@ -31,6 +31,20 @@ Prereleases are excluded from normal semver range resolution, so a project on
 
 ---
 
+## [0.1.121-beta.16] — unreleased
+
+**Fix — `AuthModule.forRoot({ controller: false })` now actually omits the
+controller.** In beta.15 the controller was also declared on the static `@Module()`,
+and NestJS *extends* (does not replace) that metadata with `forRoot()`'s — so
+`AuthController` stayed registered and overriding `/auth/register` produced a
+duplicate route (the base `RegisterDto` won → extra fields like `name` were
+rejected). All wiring now lives in `forRoot()`.
+
+- **Migration:** import **`AuthModule.forRoot()`**, not the bare `AuthModule` (which
+  now registers nothing). The scaffold is updated. `forRoot({ controller: false })`
+  omits the built-in controller so your own can take over `/auth`. Regression
+  test added (`test/unit/auth-module.spec.ts`).
+
 ## [0.1.121-beta.15] — unreleased
 
 **Library / docs. Additive — no behaviour change.** Auth is now extensible from

package/dist/modules/auth/auth.module.d.ts

@@ -1,11 +1,16 @@
 import { DynamicModule } from '@nestjs/common';
 export declare class AuthModule {
     /**
-     * For overriding the auth endpoints. `AuthModule.forRoot({ controller: false })`
-     * imports every auth provider globally (AuthService, Jwt, Passport, strategies,
-     * guards) but does NOT register the built-in `AuthController` — so you can
-     * register your OWN controller (e.g. one that `extends AuthController`) at the
-     * same `/auth` prefix with no duplicate route. See docs/authentication.md.
+     * Wires the auth module. **Always use `AuthModule.forRoot()`** — importing the
+     * bare `AuthModule` registers nothing (all wiring is here so the controller
+     * can be conditionally omitted).
+     *
+     * `AuthModule.forRoot()` registers the built-in `AuthController` (default).
+     * `AuthModule.forRoot({ controller: false })` registers every auth provider
+     * globally (AuthService, Jwt, Passport, strategies, guards) but NOT the
+     * controller — so you can register your OWN controller (e.g. one that
+     * `extends AuthController`) at the same `/auth` prefix with no duplicate
+     * route. See docs/authentication.md.
      */
     static forRoot(options?: {
         controller?: boolean;

package/dist/modules/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAgC7D,qBAOa,UAAU;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAG,aAAa;CAUlE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAkC7D,qBAEa,UAAU;IACnB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAG,aAAa;CAUlE"}

package/dist/modules/auth/auth.module.js

@@ -21,8 +21,10 @@ const jwt_auth_guard_1 = require("./jwt-auth.guard");
 const authenticated_guard_1 = require("./authenticated.guard");
 const jwt_strategy_1 = require("./jwt.strategy");
 const refresh_token_strategy_1 = require("./refresh-token.strategy");
-// Shared so the static @Module (default: registers AuthController) and the
-// forRoot() hook (optionally skips it) provide identical wiring.
+// All wiring lives in forRoot() so the controller can be conditionally omitted.
+// The @Module() decorator is intentionally empty: NestJS *extends* (concatenates)
+// the decorator's metadata onto a DynamicModule, so a controller declared there
+// could never be removed by forRoot({ controller: false }).
 const authImports = [
     config_1.ConfigModule,
     user_module_1.UserModule,
@@ -40,11 +42,16 @@ const authProviders = [auth_service_1.AuthService, local_strategy_1.LocalStrateg
 const authExports = [auth_service_1.AuthService, jwt_auth_guard_1.JwtAuthGuard, authenticated_guard_1.AuthenticatedGuard, jwt_1.JwtModule];
 let AuthModule = exports.AuthModule = AuthModule_1 = class AuthModule {
     /**
-     * For overriding the auth endpoints. `AuthModule.forRoot({ controller: false })`
-     * imports every auth provider globally (AuthService, Jwt, Passport, strategies,
-     * guards) but does NOT register the built-in `AuthController` — so you can
-     * register your OWN controller (e.g. one that `extends AuthController`) at the
-     * same `/auth` prefix with no duplicate route. See docs/authentication.md.
+     * Wires the auth module. **Always use `AuthModule.forRoot()`** — importing the
+     * bare `AuthModule` registers nothing (all wiring is here so the controller
+     * can be conditionally omitted).
+     *
+     * `AuthModule.forRoot()` registers the built-in `AuthController` (default).
+     * `AuthModule.forRoot({ controller: false })` registers every auth provider
+     * globally (AuthService, Jwt, Passport, strategies, guards) but NOT the
+     * controller — so you can register your OWN controller (e.g. one that
+     * `extends AuthController`) at the same `/auth` prefix with no duplicate
+     * route. See docs/authentication.md.
      */
     static forRoot(options) {
         return {
@@ -59,10 +66,5 @@ let AuthModule = exports.AuthModule = AuthModule_1 = class AuthModule {
 };
 exports.AuthModule = AuthModule = AuthModule_1 = __decorate([
     (0, common_1.Global)(),
-    (0, common_1.Module)({
-        imports: authImports,
-        providers: authProviders,
-        controllers: [auth_controller_1.AuthController],
-        exports: authExports,
-    })
+    (0, common_1.Module)({})
 ], AuthModule);

package/docs/authentication.md

@@ -10,7 +10,10 @@ framework class).
 
 ## What `AuthModule` provides
 
-Importing `AuthModule` registers, under the `/auth` prefix:
+**Always wire it as `AuthModule.forRoot()`** — importing the bare `AuthModule`
+registers nothing (all wiring lives in `forRoot()` so the controller can be
+conditionally omitted; see the override section). `AuthModule.forRoot()` registers,
+under the `/auth` prefix:
 
 | Route | Guard | Body |
 |---|---|---|
@@ -80,11 +83,13 @@ export class AppModule {}
 export class MyAuthModule {}
 ```
 
-> **Why `forRoot({ controller: false })`?** If you import the plain `AuthModule`
-> *and* register your own `/auth` controller, you get two handlers for the same
-> routes. Skipping the built-in controller — while keeping its providers — is what
-> lets your controller take over cleanly. (Importing the plain `AuthModule` is
-> still correct when you're *not* overriding the controller.)
+> **Why `forRoot({ controller: false })`?** If the built-in controller *and* your
+> own `/auth` controller are both registered, you get two handlers for the same
+> routes (Express runs the first-registered, so the base `RegisterDto` would win
+> and reject your extra fields). `forRoot({ controller: false })` drops the built-in
+> controller while keeping every provider global, so your controller takes over
+> cleanly. Use plain `AuthModule.forRoot()` (no options) when you're *not*
+> overriding the controller.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.121-beta.15",
+    "version": "0.1.121-beta.16",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",