@everystack/auth 0.4.2 → 0.4.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -2
- package/src/models/user.ts +13 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@everystack/auth",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.3",
|
|
4
4
|
"description": "JWT authentication handlers, password hashing, and React auth context",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"author": "Scalable Technology, Inc. <licensing@scalable.technology>",
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
},
|
|
92
92
|
"dependencies": {
|
|
93
93
|
"bcryptjs": "3.0.3",
|
|
94
|
-
"@everystack/model": "0.4.
|
|
94
|
+
"@everystack/model": "0.4.16"
|
|
95
95
|
},
|
|
96
96
|
"peerDependencies": {
|
|
97
97
|
"@everystack/api": ">=0.1.0",
|
|
@@ -120,6 +120,7 @@
|
|
|
120
120
|
"postgres": "3.4.9",
|
|
121
121
|
"ts-jest": "29.4.9",
|
|
122
122
|
"typescript": "5.9.3",
|
|
123
|
+
"@everystack/server": "0.4.20",
|
|
123
124
|
"@everystack/api": "0.4.0"
|
|
124
125
|
},
|
|
125
126
|
"scripts": {
|
package/src/models/user.ts
CHANGED
|
@@ -51,6 +51,19 @@ export const User = defineModel('users', {
|
|
|
51
51
|
updatedAt: field.timestamptz().defaultNow().notNull(),
|
|
52
52
|
},
|
|
53
53
|
constraints: [index('instanceId')],
|
|
54
|
+
// `deletedAt` on a user means a soft delete: the row stays, because auth rows are referenced
|
|
55
|
+
// by half the schema and destroying one breaks those references rather than cleaning them up.
|
|
56
|
+
// Every reader in this package already assumes that shape — the sign-in path and the auth
|
|
57
|
+
// SQL functions gate on `deleted_at IS NULL` rather than on the row's absence.
|
|
58
|
+
//
|
|
59
|
+
// Declared rather than defaulted because the admin `manage` ability below grants DELETE
|
|
60
|
+
// ("all actions"), which is the axis that matters here. It is INERT in both directions today,
|
|
61
|
+
// which is what makes it safe to add to a published package: no public read, so the compiled
|
|
62
|
+
// contract is unchanged (no fingerprint movement for any consumer); and `private: true` keeps
|
|
63
|
+
// this model out of the generic data API, so none of the handler's soft-delete behaviour
|
|
64
|
+
// applies either. It states the intent that the readers already depend on, and it stops the
|
|
65
|
+
// model from silently acquiring the opposite one.
|
|
66
|
+
softDelete: true,
|
|
54
67
|
abilities: [
|
|
55
68
|
can('manage', { role: 'admin' }),
|
|
56
69
|
// Self-read, column-scoped: id/email/role of your own row, never the hash.
|