@kurdel/auth-db 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/database-jwt-session-repository.js

@@ -0,0 +1,26 @@
+import { resolveAuthDatabaseTables } from './auth-database-tables.js';
+/** Resolves persisted JWT sessions for token revocation checks. */
+export class DatabaseJwtSessionRepository {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async findById(id) {
+        const record = await this.db.get({
+            sql: [
+                'SELECT id, user_id, status, expires_at',
+                `FROM ${this.tables.jwtSessions} WHERE id = ?;`,
+            ].join(' '),
+            params: [id],
+        });
+        if (!record)
+            return null;
+        return {
+            id: record.id,
+            userId: record.user_id,
+            revoked: record.status !== 'active',
+            ...(record.expires_at ? { expiresAt: new Date(record.expires_at) } : {}),
+        };
+    }
+}
+//# sourceMappingURL=database-jwt-session-repository.js.map

package/lib/database-jwt-session-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-jwt-session-repository.js","sourceRoot":"","sources":["../src/database-jwt-session-repository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAA2B,MAAM,2BAA2B,CAAC;AAS/F,mEAAmE;AACnE,MAAM,OAAO,4BAA4B;IAGvC,YACmB,EAAY,EAC7B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAU;QAG7B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE;gBACH,wCAAwC;gBACxC,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW,gBAAgB;aAChD,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,EAAE,CAAC;SACb,CAAiC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;CACF"}

package/lib/database-jwt-session-service.d.ts

@@ -0,0 +1,31 @@
+import type { AuthEvent, AuthEventSink } from '@kurdel/auth';
+import type { Database, DatabaseSession } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+type TransactionalAuthEventSink = AuthEventSink & {
+    report(event: AuthEvent, database?: DatabaseSession): Promise<void> | void;
+};
+export type CreatedJwtSession = {
+    id: string;
+    userId: number;
+    expiresAt: string;
+};
+export declare class JwtSessionNotFoundError extends Error {
+    readonly userId: number;
+    readonly sessionId: string;
+    constructor(userId: number, sessionId: string);
+}
+export declare class ActiveJwtSessionUserNotFoundError extends Error {
+    readonly userId: number;
+    constructor(userId: number);
+}
+/** Creates and revokes the server-side state referenced by JWT `jti` claims. */
+export declare class DatabaseJwtSessionService {
+    private readonly db;
+    private readonly events?;
+    private readonly now;
+    private readonly tables;
+    constructor(db: Database, tables?: Partial<AuthDatabaseTables>, events?: TransactionalAuthEventSink | undefined, now?: () => Date);
+    create(userId: number, expiresAt: Date): Promise<CreatedJwtSession>;
+    revoke(userId: number, sessionId: string): Promise<void>;
+}
+export {};

package/lib/database-jwt-session-service.js

@@ -0,0 +1,74 @@
+import crypto from 'node:crypto';
+import { resolveAuthDatabaseTables } from './auth-database-tables.js';
+export class JwtSessionNotFoundError extends Error {
+    constructor(userId, sessionId) {
+        super(`JWT session '${sessionId}' was not found for user '${userId}'`);
+        this.userId = userId;
+        this.sessionId = sessionId;
+    }
+}
+export class ActiveJwtSessionUserNotFoundError extends Error {
+    constructor(userId) {
+        super(`Active user '${userId}' was not found`);
+        this.userId = userId;
+    }
+}
+/** Creates and revokes the server-side state referenced by JWT `jti` claims. */
+export class DatabaseJwtSessionService {
+    constructor(db, tables = {}, events, now = () => new Date()) {
+        this.db = db;
+        this.events = events;
+        this.now = now;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async create(userId, expiresAt) {
+        const expirationTime = expiresAt.getTime();
+        if (!Number.isFinite(expirationTime) || expirationTime <= this.now().getTime()) {
+            throw new RangeError('JWT session expiration must be in the future');
+        }
+        const id = crypto.randomUUID();
+        await this.db.transaction(async (transaction) => {
+            const user = await transaction.get({
+                sql: `SELECT id FROM ${this.tables.users} WHERE id = ? AND status = 'active';`,
+                params: [userId],
+            });
+            if (!user)
+                throw new ActiveJwtSessionUserNotFoundError(userId);
+            await transaction.run({
+                sql: [
+                    `INSERT INTO ${this.tables.jwtSessions}`,
+                    '(id, user_id, status, expires_at) VALUES (?, ?, ?, ?);',
+                ].join(' '),
+                params: [id, userId, 'active', expiresAt.toISOString()],
+            });
+            await this.events?.report({
+                type: 'jwt-session.created',
+                occurredAt: this.now(),
+                userId,
+                credential: { type: 'jwt', id },
+            }, transaction);
+        });
+        return { id, userId, expiresAt: expiresAt.toISOString() };
+    }
+    async revoke(userId, sessionId) {
+        await this.db.transaction(async (transaction) => {
+            const session = await transaction.get({
+                sql: `SELECT id FROM ${this.tables.jwtSessions} WHERE id = ? AND user_id = ?;`,
+                params: [sessionId, userId],
+            });
+            if (!session)
+                throw new JwtSessionNotFoundError(userId, sessionId);
+            await transaction.run({
+                sql: `UPDATE ${this.tables.jwtSessions} SET status = 'revoked' WHERE id = ?;`,
+                params: [sessionId],
+            });
+            await this.events?.report({
+                type: 'jwt-session.revoked',
+                occurredAt: this.now(),
+                userId,
+                credential: { type: 'jwt', id: sessionId },
+            }, transaction);
+        });
+    }
+}
+//# sourceMappingURL=database-jwt-session-service.js.map

package/lib/database-jwt-session-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-jwt-session-service.js","sourceRoot":"","sources":["../src/database-jwt-session-service.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAKjC,OAAO,EAAE,yBAAyB,EAA2B,MAAM,2BAA2B,CAAC;AAY/F,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAqB,MAAc,EAAW,SAAiB;QAC7D,KAAK,CAAC,gBAAgB,SAAS,6BAA6B,MAAM,GAAG,CAAC,CAAC;QADpD,WAAM,GAAN,MAAM,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAQ;IAE/D,CAAC;CACF;AAED,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAC1D,YAAqB,MAAc;QACjC,KAAK,CAAC,gBAAgB,MAAM,iBAAiB,CAAC,CAAC;QAD5B,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,yBAAyB;IAGpC,YACmB,EAAY,EAC7B,SAAsC,EAAE,EACvB,MAAmC,EACnC,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAHlC,OAAE,GAAF,EAAE,CAAU;QAEZ,WAAM,GAAN,MAAM,CAA6B;QACnC,QAAG,GAAH,GAAG,CAA+B;QAEnD,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,SAAe;QAC1C,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAE/B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC;gBACjC,GAAG,EAAE,kBAAkB,IAAI,CAAC,MAAM,CAAC,KAAK,sCAAsC;gBAC9E,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAE/D,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE;oBACH,eAAe,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;oBACxC,wDAAwD;iBACzD,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;aAChC,EAAE,WAAW,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,SAAiB;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpC,GAAG,EAAE,kBAAkB,IAAI,CAAC,MAAM,CAAC,WAAW,gCAAgC;gBAC9E,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEnE,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,uCAAuC;gBAC7E,MAAM,EAAE,CAAC,SAAS,CAAC;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE;aAC3C,EAAE,WAAW,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/database-password-credential-repository.d.ts

@@ -0,0 +1,9 @@
+import type { PasswordCredential, PasswordCredentialRepository } from '@kurdel/auth';
+import type { Database } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export declare class DatabasePasswordCredentialRepository implements PasswordCredentialRepository {
+    private readonly db;
+    private readonly tables;
+    constructor(db: Database, tables?: Partial<AuthDatabaseTables>);
+    findByLogin(login: string): Promise<PasswordCredential | null>;
+}

package/lib/database-password-credential-repository.js

@@ -0,0 +1,19 @@
+import { resolveAuthDatabaseTables } from './auth-database-tables.js';
+export class DatabasePasswordCredentialRepository {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async findByLogin(login) {
+        const record = (await this.db.get({
+            sql: [
+                `SELECT credentials.user_id, credentials.password_hash FROM ${this.tables.passwordCredentials} credentials`,
+                `INNER JOIN ${this.tables.users} users ON users.id = credentials.user_id`,
+                'WHERE LOWER(users.email) = LOWER(?);',
+            ].join(' '),
+            params: [login.trim()],
+        }));
+        return record ? { userId: record.user_id, passwordHash: record.password_hash } : null;
+    }
+}
+//# sourceMappingURL=database-password-credential-repository.js.map

package/lib/database-password-credential-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-password-credential-repository.js","sourceRoot":"","sources":["../src/database-password-credential-repository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAA2B,MAAM,2BAA2B,CAAC;AAI/F,MAAM,OAAO,oCAAoC;IAG/C,YACmB,EAAY,EAC7B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAU;QAG7B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE;gBACH,8DAA8D,IAAI,CAAC,MAAM,CAAC,mBAAmB,cAAc;gBAC3G,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,0CAA0C;gBACzE,sCAAsC;aACvC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACvB,CAAC,CAAiC,CAAC;QACpC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;CACF"}

package/lib/database-password-service.d.ts

@@ -0,0 +1,14 @@
+import type { PasswordHasher } from '@kurdel/auth';
+import type { Database } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export declare class PasswordUserNotFoundError extends Error {
+    readonly userId: number;
+    constructor(userId: number);
+}
+export declare class DatabasePasswordService {
+    private readonly db;
+    private readonly hasher;
+    private readonly tables;
+    constructor(db: Database, hasher: PasswordHasher, tables?: Partial<AuthDatabaseTables>);
+    set(userId: number, password: string): Promise<void>;
+}

package/lib/database-password-service.js

@@ -0,0 +1,34 @@
+import { resolveAuthDatabaseTables } from './auth-database-tables.js';
+export class PasswordUserNotFoundError extends Error {
+    constructor(userId) {
+        super(`User '${userId}' was not found`);
+        this.userId = userId;
+    }
+}
+export class DatabasePasswordService {
+    constructor(db, hasher, tables = {}) {
+        this.db = db;
+        this.hasher = hasher;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async set(userId, password) {
+        const passwordHash = await this.hasher.hash(password);
+        await this.db.transaction(async (transaction) => {
+            const user = await transaction.get({
+                sql: `SELECT id FROM ${this.tables.users} WHERE id = ?;`,
+                params: [userId],
+            });
+            if (!user)
+                throw new PasswordUserNotFoundError(userId);
+            await transaction.run({
+                sql: [
+                    `INSERT INTO ${this.tables.passwordCredentials} (user_id, password_hash, updated_at)`,
+                    'VALUES (?, ?, CURRENT_TIMESTAMP)',
+                    'ON CONFLICT(user_id) DO UPDATE SET password_hash = excluded.password_hash, updated_at = CURRENT_TIMESTAMP;',
+                ].join(' '),
+                params: [userId, passwordHash],
+            });
+        });
+    }
+}
+//# sourceMappingURL=database-password-service.js.map

package/lib/database-password-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-password-service.js","sourceRoot":"","sources":["../src/database-password-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAA2B,MAAM,2BAA2B,CAAC;AAE/F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAqB,MAAc;QACjC,KAAK,CAAC,SAAS,MAAM,iBAAiB,CAAC,CAAC;QADrB,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IAGlC,YACmB,EAAY,EACZ,MAAsB,EACvC,SAAsC,EAAE;QAFvB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAgB;QAGvC,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,QAAgB;QACxC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC;gBACjC,GAAG,EAAE,kBAAkB,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;gBACxD,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE;oBACH,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB,uCAAuC;oBACrF,kCAAkC;oBAClC,4GAA4G;iBAC7G,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/database-user-service.d.ts

@@ -1,4 +1,4 @@
-import type { IDatabase } from '@kurdel/db';
+import type { Database } from '@kurdel/db';
 import { type AuthDatabaseTables } from './auth-database-tables.js';
 export type UserStatus = 'active' | 'disabled';
 export interface CreateUserInput {
@@ -16,6 +16,34 @@ export interface ListUsersInput {
     limit: number;
     offset: number;
     status?: UserStatus;
+    search?: string;
+    sortBy?: 'id' | 'name' | 'email' | 'status' | 'createdAt' | 'updatedAt';
+    sortDirection?: 'asc' | 'desc';
+}
+export interface BulkUpdateUsersInput {
+    userIds: number[];
+    status?: UserStatus;
+    addRoles?: string[];
+    removeRoles?: string[];
+}
+export interface RoleSummary {
+    id: number;
+    name: string;
+    userCount: number;
+    permissions: string[];
+}
+export interface AdminDashboardStats {
+    users: {
+        total: number;
+        active: number;
+        disabled: number;
+    };
+    apiKeys: {
+        active: number;
+        revoked: number;
+        expired: number;
+    };
+    failedAuthenticationsLast24Hours: number;
 }
 export interface ManagedUser {
     id: number;
@@ -36,6 +64,10 @@ export declare class UnknownRolesError extends Error {
     readonly roles: string[];
     constructor(roles: string[]);
 }
+export declare class UnknownPermissionsError extends Error {
+    readonly permissions: string[];
+    constructor(permissions: string[]);
+}
 export declare class UserNotFoundError extends Error {
     readonly userId: number;
     constructor(userId: number);
@@ -44,21 +76,49 @@ export declare class DuplicateUserEmailError extends Error {
     readonly email: string;
     constructor(email: string);
 }
+export declare class RoleNotFoundError extends Error {
+    readonly roleId: number;
+    constructor(roleId: number);
+}
+export declare class DuplicateRoleNameError extends Error {
+    readonly name: string;
+    constructor(name: string);
+}
+export declare class RoleInUseError extends Error {
+    readonly roleId: number;
+    readonly userCount: number;
+    constructor(roleId: number, userCount: number);
+}
 export declare class DatabaseUserService {
     private readonly db;
     private readonly tables;
-    constructor(db: IDatabase, tables?: Partial<AuthDatabaseTables>);
+    constructor(db: Database, tables?: Partial<AuthDatabaseTables>);
     listRoles(): Promise<string[]>;
+    listRoleSummaries(): Promise<RoleSummary[]>;
+    listPermissions(): Promise<string[]>;
+    setRolePermissions(roleId: number, names: string[]): Promise<RoleSummary>;
+    createRole(name: string): Promise<RoleSummary>;
+    renameRole(roleId: number, name: string): Promise<RoleSummary>;
+    deleteRole(roleId: number): Promise<void>;
     create(input: CreateUserInput): Promise<ManagedUser>;
     list(input: ListUsersInput): Promise<UserList>;
+    bulkUpdate(input: BulkUpdateUsersInput): Promise<ManagedUser[]>;
+    bulkDelete(userIds: number[]): Promise<void>;
+    dashboardStats(): Promise<AdminDashboardStats>;
     findById(userId: number): Promise<ManagedUser>;
     update(userId: number, input: UpdateUserInput): Promise<ManagedUser>;
     delete(userId: number): Promise<void>;
     private findRecord;
+    private findRole;
+    private ensureUsersExist;
     private resolveRoles;
+    private resolvePermissions;
+    private loadRolePermissions;
     private replaceRoles;
     private loadRoles;
     private mapUser;
     private normalizeEmail;
     private rethrowEmailConflict;
+    private rethrowRoleConflict;
+    private isUniqueConstraintError;
 }