@meridianjs/auth 1.9.0 → 1.11.0

package/dist/index.d.mts

@@ -8,7 +8,12 @@ interface RegisterInput {
     password: string;
     first_name?: string;
     last_name?: string;
-    role?: UserRole;
+    /**
+     * @internal — Only used by the invite flow. Public registration always
+     * derives the role automatically (first user → super-admin, else member).
+     * Callers must never expose this to untrusted input.
+     */
+    _inviteRole?: UserRole;
 }
 interface LoginInput {
     email: string;
@@ -130,10 +135,13 @@ declare function requirePermission(...permissions: string[]): (req: any, res: Re
  * param, body field, or URL path param (:id on /workspaces/:id sub-routes)
  * does not match the authenticated user's workspace.
  *
- * Allows the request through when no workspace identifier is present (so
- * general listing endpoints that omit workspace_id are not blocked).
+ * **WARNING:** This guard is currently inert because JWTs are always issued
+ * with `workspaceId: null` (multi-workspace users don't have a single
+ * workspace in their token). Workspace isolation is enforced per-route
+ * via `assertWorkspaceAccess` helpers instead. This function is kept for
+ * backwards compatibility but should not be relied upon.
  *
- * Must be used after `authenticateJWT`.
+ * @deprecated Use per-route `assertWorkspaceAccess` instead.
  */
 declare function requireWorkspace(req: any, res: Response, next: NextFunction): Response<any, Record<string, any>> | undefined;
 

package/dist/index.d.ts

@@ -8,7 +8,12 @@ interface RegisterInput {
     password: string;
     first_name?: string;
     last_name?: string;
-    role?: UserRole;
+    /**
+     * @internal — Only used by the invite flow. Public registration always
+     * derives the role automatically (first user → super-admin, else member).
+     * Callers must never expose this to untrusted input.
+     */
+    _inviteRole?: UserRole;
 }
 interface LoginInput {
     email: string;
@@ -130,10 +135,13 @@ declare function requirePermission(...permissions: string[]): (req: any, res: Re
  * param, body field, or URL path param (:id on /workspaces/:id sub-routes)
  * does not match the authenticated user's workspace.
  *
- * Allows the request through when no workspace identifier is present (so
- * general listing endpoints that omit workspace_id are not blocked).
+ * **WARNING:** This guard is currently inert because JWTs are always issued
+ * with `workspaceId: null` (multi-workspace users don't have a single
+ * workspace in their token). Workspace isolation is enforced per-route
+ * via `assertWorkspaceAccess` helpers instead. This function is kept for
+ * backwards compatibility but should not be relied upon.
  *
- * Must be used after `authenticateJWT`.
+ * @deprecated Use per-route `assertWorkspaceAccess` instead.
  */
 declare function requireWorkspace(req: any, res: Response, next: NextFunction): Response<any, Record<string, any>> | undefined;
 

package/dist/index.js

@@ -65,8 +65,10 @@ var AuthModuleService = class extends (0, import_framework_utils.MeridianService
       throw Object.assign(new Error("Email already registered"), { status: 409 });
     }
     const password_hash = await import_bcrypt.default.hash(input.password, BCRYPT_ROUNDS);
-    let role = input.role ?? "member";
-    if (!input.role) {
+    let role = "member";
+    if (input._inviteRole) {
+      role = input._inviteRole;
+    } else {
       const [, userCount] = await userService.listAndCountUsers({}, { limit: 1 });
       if (userCount === 0) role = "super-admin";
     }
@@ -222,12 +224,14 @@ var AuthModuleService = class extends (0, import_framework_utils.MeridianService
   async restoreFromInvite(userId, input) {
     const userService = this.container.resolve("userModuleService");
     const config = this.container.resolve("config");
+    const allowedRoles = ["super-admin", "admin", "moderator", "member"];
+    const role = input.role && allowedRoles.includes(input.role) ? input.role : "member";
     const password_hash = await import_bcrypt.default.hash(input.password, BCRYPT_ROUNDS);
     const user = await userService.restoreUser(userId, {
       password_hash,
       first_name: input.first_name ?? null,
       last_name: input.last_name ?? null,
-      role: input.role ?? "member"
+      role
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
     const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);

package/dist/index.mjs

@@ -25,8 +25,10 @@ var AuthModuleService = class extends MeridianService({}) {
       throw Object.assign(new Error("Email already registered"), { status: 409 });
     }
     const password_hash = await bcrypt.hash(input.password, BCRYPT_ROUNDS);
-    let role = input.role ?? "member";
-    if (!input.role) {
+    let role = "member";
+    if (input._inviteRole) {
+      role = input._inviteRole;
+    } else {
       const [, userCount] = await userService.listAndCountUsers({}, { limit: 1 });
       if (userCount === 0) role = "super-admin";
     }
@@ -182,12 +184,14 @@ var AuthModuleService = class extends MeridianService({}) {
   async restoreFromInvite(userId, input) {
     const userService = this.container.resolve("userModuleService");
     const config = this.container.resolve("config");
+    const allowedRoles = ["super-admin", "admin", "moderator", "member"];
+    const role = input.role && allowedRoles.includes(input.role) ? input.role : "member";
     const password_hash = await bcrypt.hash(input.password, BCRYPT_ROUNDS);
     const user = await userService.restoreUser(userId, {
       password_hash,
       first_name: input.first_name ?? null,
       last_name: input.last_name ?? null,
-      role: input.role ?? "member"
+      role
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
     const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/auth",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Meridian auth module — JWT authentication and middleware",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -26,8 +26,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@meridianjs/types": "^1.9.0",
-    "@meridianjs/framework-utils": "^1.9.0",
+    "@meridianjs/types": "^1.11.0",
+    "@meridianjs/framework-utils": "^1.11.0",
     "jsonwebtoken": "^9.0.2",
     "bcrypt": "^5.1.1"
   },