@carecard/validate 3.1.23 → 3.1.25

package/lib/validateNewUserRoleRequest.js

@@ -0,0 +1,79 @@
+'use strict';
+
+const {
+    error: { throwBadInputError },
+} = require('@carecard/common-util');
+const { isUserRoleRequestRoleString } = require('./validate');
+
+const DEFAULT_USER_ROLE_REQUEST_ROLE = 'student';
+const REQUIRE_SCOPE_WHEN_ROLE_OR_SCOPE_PRESENT = 'whenRoleOrScopePresent';
+
+function validateNewUserRoleRequestObject(roleRequest = {}, options = {}) {
+    const normalized = normalizeNewUserRoleRequestObject(roleRequest);
+    const defaultRole = Object.prototype.hasOwnProperty.call(options, 'defaultRole') ? options.defaultRole : DEFAULT_USER_ROLE_REQUEST_ROLE;
+    const requireScope = Object.prototype.hasOwnProperty.call(options, 'requireScope') ? options.requireScope : true;
+
+    if (normalized.role_name === undefined && defaultRole !== undefined) {
+        normalized.role_name = defaultRole;
+    }
+
+    if (normalized.role_name !== undefined && !isUserRoleRequestRoleString(normalized.role_name)) {
+        throwBadInputError({
+            userMessage: 'Invalid property: role.role',
+            details: { role: 'Role requests are limited to student, intern, or volunteer' },
+        });
+    }
+
+    if (shouldRequireScope(normalized, requireScope)) {
+        requireNewUserRoleRequestScope(normalized);
+    }
+
+    return normalized;
+}
+
+function normalizeNewUserRoleRequestObject(roleRequest) {
+    const normalized = { ...roleRequest };
+
+    assignAlias(normalized, 'role_name', 'roleName');
+    assignAlias(normalized, 'role_name', 'role');
+    assignAlias(normalized, 'institution_id', 'institutionId');
+    assignAlias(normalized, 'campus_id', 'campusId');
+    assignAlias(normalized, 'program_id', 'programId');
+
+    delete normalized.roleName;
+    delete normalized.role;
+    delete normalized.institutionId;
+    delete normalized.campusId;
+    delete normalized.programId;
+
+    return normalized;
+}
+
+function assignAlias(target, canonicalKey, aliasKey) {
+    if (target[canonicalKey] === undefined && target[aliasKey] !== undefined) {
+        target[canonicalKey] = target[aliasKey];
+    }
+}
+
+function shouldRequireScope(roleRequest, requireScope) {
+    if (requireScope === true) return true;
+    if (requireScope !== REQUIRE_SCOPE_WHEN_ROLE_OR_SCOPE_PRESENT) return false;
+
+    return roleRequest.role_name !== undefined || roleRequest.institution_id !== undefined || roleRequest.campus_id !== undefined;
+}
+
+function requireNewUserRoleRequestScope(roleRequest) {
+    if (!roleRequest.institution_id) {
+        throwBadInputError({ userMessage: 'Missing property: role.institutionId' });
+    }
+
+    if (!roleRequest.campus_id) {
+        throwBadInputError({ userMessage: 'Missing property: role.campusId' });
+    }
+}
+
+module.exports = {
+    DEFAULT_USER_ROLE_REQUEST_ROLE,
+    REQUIRE_SCOPE_WHEN_ROLE_OR_SCOPE_PRESENT,
+    validateNewUserRoleRequestObject,
+};

package/lib/validateProperties.js

@@ -22,6 +22,8 @@ const {
     isStreetString,
     isTextString,
     isUserRoleRequestStatusString,
+    isUserRoleRequestRoleString,
+    isCountryCodeString,
 } = require('./validate');
 
 function validateProperties(obj = {}) {
@@ -123,6 +125,12 @@ function validateProperties(obj = {}) {
                     returnObj[key] = value;
                 }
                 break;
+            case 'country_code':
+            case 'countryCode':
+                if (isCountryCodeString(value)) {
+                    returnObj[key] = value;
+                }
+                break;
             case 'token':
             case 'email_confirm_token':
             case 'emailConfirmToken':
@@ -196,6 +204,12 @@ function validateProperties(obj = {}) {
                     returnObj[key] = value;
                 }
                 break;
+            case 'user_role_request_role':
+            case 'userRoleRequestRole':
+                if (isUserRoleRequestRoleString(value)) {
+                    returnObj[key] = value;
+                }
+                break;
             case 'period':
                 if (isCharactersString(value)) {
                     returnObj[key] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@carecard/validate",
-    "version": "3.1.23",
+    "version": "3.1.25",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/CareCard-ca/pkg-validate.git"
@@ -12,7 +12,7 @@
         "test": "mocha --recursive",
         "test:types": "tsc --noEmit && echo \"\\n  ✔ Type tests passed: tsc --noEmit reported 0 errors across index.d.ts and test/**/*.ts\\n\"",
         "test:coverage": "tsc --noEmit && export NODE_ENV=test && nyc mocha --recursive",
-        "test:All": "npm run test && npm run test:types",
+        "test:All": "npm run test:coverage && npm run test:types",
         "format": "prettier --write .",
         "format:check": "prettier --check .",
         "prepare": "husky",
@@ -27,17 +27,29 @@
     "license": "ISC",
     "devDependencies": {
         "@types/mocha": "10.0.10",
-        "@types/node": "25.6.2",
+        "@types/node": "25.9.1",
         "eslint": "9.39.4",
         "husky": "9.1.7",
-        "lint-staged": "17.0.3",
-        "mocha": "11.7.5",
+        "lint-staged": "17.0.5",
+        "mocha": "11.7.6",
         "nyc": "18.0.0",
         "prettier": "3.8.3",
         "ts-node": "10.9.2",
-        "typescript": "5.9.3"
+        "typescript": "6.0.3"
     },
     "dependencies": {
-        "@carecard/common-util": "^3.1.13"
+        "@carecard/common-util": "3.1.15"
+    },
+    "nyc": {
+        "all": true,
+        "include": [
+            "index.js",
+            "lib/**/*.js"
+        ],
+        "check-coverage": true,
+        "branches": 100,
+        "functions": 100,
+        "lines": 100,
+        "statements": 100
     }
 }

package/readme.md

@@ -106,6 +106,7 @@ where the package supports both.
 | `isString6To16CharacterLong` and `isPasswordString`       | `strong_password`, `strongPassword`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `isEmailString`                                           | `email`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `isPhoneNumber`                                           | `phone_number`, `phoneNumber`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `isCountryCodeString`                                     | `country_code`, `countryCode`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `isUrlSafeString`                                         | `token`, `email_confirm_token`, `emailConfirmToken`, `verification_token`, `verificationToken`                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `isValidUuidString`                                       | `uuid`, `item_id`, `itemId`, `user_id`, `userId`, `address_id`, `addressId`, `image_id`, `imageId`, `order_id`, `orderId`, `category_id`, `categoryId`, `parent_id`, `parentId`, `college_id`, `collegeId`, `campus_id`, `campusId`, `program_id`, `programId`, `id`, `institution_id`, `institutionId`, `role_assignment_id`, `roleAssignmentId`, `user_role_id`, `userRoleId`, `phone_number_id`, `phoneNumberId`, `entity_id`, `entityId`, `changed_by`, `changedBy`, `request_id`, `requestId`                                          |
 | `isValidIntegerString`                                    | `offset_number`, `offsetNumber`, `number_of_orders`, `numberOfOrders`, `price`, `from`, `number`, `limit`, `offset`                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -363,3 +364,16 @@ npm run format:check
 
 CI runs on Node.js 25 and executes `npm run test:All`. Publishing to npm happens
 from `main` through the `Publish to npm` GitHub workflow.
+
+## Auth Boundary
+
+Validation protects request shape, not authorization. `ms-auth` owns its
+auth-table RLS contract: normal users are self-row only, JWT `roles: ["ad"]`
+is the auth super-admin signal, and public auth flows use narrow system
+contexts. Do not use validators as a replacement for service RLS or database
+context checks.
+
+Docs that mention `ms-auth` controller internals should use concise action
+names such as `loginUser`, `registerUser`, `getUserDetail`, and `renewJwt`.
+Access level is conveyed by route middleware and endpoint placement, not by
+`public`/`protected`/`admin`/`Handler` suffixes.