@scryan7371/sdr-security 0.1.2 → 0.1.3

package/dist/nest/security-auth.service.test.js

@@ -32,22 +32,24 @@ const makeNotifier = () => ({
 const makeUser = () => ({
     id: "user-1",
     email: "user@example.com",
+});
+const makeSecurityUser = () => ({
+    userId: "user-1",
     passwordHash: "hashed:Secret123",
-    firstName: "A",
-    lastName: "B",
     emailVerifiedAt: new Date("2026-01-01T00:00:00.000Z"),
     emailVerificationToken: null,
     adminApprovedAt: new Date("2026-01-01T00:00:00.000Z"),
     isActive: true,
 });
 const setup = () => {
-    const usersRepo = makeRepo();
+    const appUsersRepo = makeRepo();
+    const securityUsersRepo = makeRepo();
     const refreshTokenRepo = makeRepo();
     const passwordResetRepo = makeRepo();
     const rolesRepo = makeRepo();
     const userRolesRepo = makeRepo();
     const notifier = makeNotifier();
-    const service = new security_auth_service_1.SecurityAuthService(usersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, {
+    const service = new security_auth_service_1.SecurityAuthService(appUsersRepo, securityUsersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, {
         jwtSecret: "secret",
         accessTokenExpiresIn: "15m",
         refreshTokenExpiresInDays: 30,
@@ -57,7 +59,8 @@ const setup = () => {
     }, notifier);
     return {
         service,
-        usersRepo,
+        appUsersRepo,
+        securityUsersRepo,
         refreshTokenRepo,
         passwordResetRepo,
         rolesRepo,
@@ -70,30 +73,30 @@ const setup = () => {
         vitest_1.vi.clearAllMocks();
     });
     (0, vitest_1.it)("registers user and sends verification", async () => {
-        const { service, usersRepo, userRolesRepo, rolesRepo, notifier } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
-        usersRepo.save.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, securityUsersRepo, userRolesRepo, rolesRepo, notifier, } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
+        appUsersRepo.save.mockResolvedValue(makeUser());
+        securityUsersRepo.save.mockResolvedValue(makeSecurityUser());
         userRolesRepo.find.mockResolvedValue([]);
         rolesRepo.find.mockResolvedValue([]);
         const result = await service.register({
             email: "USER@example.com",
             password: "Secret123",
-            firstName: "A",
-            lastName: "B",
         });
         (0, vitest_1.expect)(result.success).toBe(true);
-        (0, vitest_1.expect)(usersRepo.create).toHaveBeenCalledWith(vitest_1.expect.objectContaining({ email: "user@example.com" }));
+        (0, vitest_1.expect)(appUsersRepo.create).toHaveBeenCalledWith(vitest_1.expect.objectContaining({ email: "user@example.com" }));
         (0, vitest_1.expect)(notifier.sendEmailVerification).toHaveBeenCalled();
     });
     (0, vitest_1.it)("rejects duplicate email on register", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         await (0, vitest_1.expect)(service.register({ email: "user@example.com", password: "Secret123" })).rejects.toBeInstanceOf(common_1.BadRequestException);
     });
     (0, vitest_1.it)("handles login success and auth failures", async () => {
-        const { service, usersRepo, userRolesRepo, rolesRepo, refreshTokenRepo } = setup();
+        const { service, appUsersRepo, securityUsersRepo, userRolesRepo, rolesRepo, refreshTokenRepo, } = setup();
         const user = makeUser();
-        usersRepo.findOne.mockResolvedValue(user);
+        appUsersRepo.findOne.mockResolvedValue(user);
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
         userRolesRepo.find.mockResolvedValue([{ roleId: "r1" }]);
         rolesRepo.find.mockResolvedValue([{ id: "r1", roleKey: "admin" }]);
         const auth = await service.login({
@@ -103,27 +106,28 @@ const setup = () => {
         (0, vitest_1.expect)(auth.accessToken).toBe("signed-access-token");
         (0, vitest_1.expect)(jsonwebtoken_1.sign).toHaveBeenCalled();
         (0, vitest_1.expect)(refreshTokenRepo.save).toHaveBeenCalled();
-        usersRepo.findOne.mockResolvedValue(null);
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.login({ email: "none@example.com", password: "Secret123" })).rejects.toBeInstanceOf(common_1.UnauthorizedException);
     });
     (0, vitest_1.it)("blocks login when account is inactive or missing approvals", async () => {
-        const { service, usersRepo } = setup();
-        const inactive = { ...makeUser(), isActive: false };
-        usersRepo.findOne.mockResolvedValue(inactive);
-        await (0, vitest_1.expect)(service.login({ email: inactive.email, password: "Secret123" })).rejects.toThrow("Account is inactive");
-        usersRepo.findOne.mockResolvedValue({
-            ...makeUser(),
+        const { service, appUsersRepo, securityUsersRepo } = setup();
+        const inactive = { ...makeSecurityUser(), isActive: false };
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(inactive);
+        await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Account is inactive");
+        securityUsersRepo.findOne.mockResolvedValue({
+            ...makeSecurityUser(),
             emailVerifiedAt: null,
         });
         await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Email verification required");
-        usersRepo.findOne.mockResolvedValue({
-            ...makeUser(),
+        securityUsersRepo.findOne.mockResolvedValue({
+            ...makeSecurityUser(),
             adminApprovedAt: null,
         });
         await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Admin approval required");
     });
     (0, vitest_1.it)("refreshes and revokes tokens", async () => {
-        const { service, usersRepo, refreshTokenRepo, userRolesRepo, rolesRepo } = setup();
+        const { service, appUsersRepo, securityUsersRepo, refreshTokenRepo, userRolesRepo, rolesRepo, } = setup();
         refreshTokenRepo.find.mockResolvedValue([
             {
                 id: "rt1",
@@ -132,7 +136,8 @@ const setup = () => {
                 expiresAt: new Date(Date.now() + 60_000),
             },
         ]);
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
         userRolesRepo.find.mockResolvedValue([]);
         rolesRepo.find.mockResolvedValue([]);
         const result = await service.refresh("token-bytes");
@@ -144,7 +149,7 @@ const setup = () => {
         });
     });
     (0, vitest_1.it)("rejects invalid refresh token and missing refresh user", async () => {
-        const { service, refreshTokenRepo, usersRepo } = setup();
+        const { service, refreshTokenRepo, appUsersRepo } = setup();
         refreshTokenRepo.find.mockResolvedValue([]);
         await (0, vitest_1.expect)(service.refresh("bad-token")).rejects.toThrow("Invalid refresh token");
         refreshTokenRepo.find.mockResolvedValue([
@@ -155,18 +160,18 @@ const setup = () => {
                 expiresAt: new Date(Date.now() + 60_000),
             },
         ]);
-        usersRepo.findOne.mockResolvedValue(null);
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.refresh("token-bytes")).rejects.toThrow("User not found");
     });
     (0, vitest_1.it)("changes password", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, securityUsersRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
         await (0, vitest_1.expect)(service.changePassword({
             userId: "user-1",
             currentPassword: "Secret123",
             newPassword: "NewPass1",
         })).resolves.toEqual({ success: true });
-        usersRepo.findOne.mockResolvedValue(null);
+        securityUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.changePassword({
             userId: "missing",
             currentPassword: "Secret123",
@@ -174,8 +179,9 @@ const setup = () => {
         })).rejects.toThrow("User not found");
     });
     (0, vitest_1.it)("handles forgot/reset password flow", async () => {
-        const { service, usersRepo, passwordResetRepo, notifier } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, securityUsersRepo, passwordResetRepo, notifier, } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
         passwordResetRepo.findOne.mockResolvedValue({
             id: "pr1",
             userId: "user-1",
@@ -193,8 +199,8 @@ const setup = () => {
         });
     });
     (0, vitest_1.it)("returns success for unknown forgot email and rejects bad reset token", async () => {
-        const { service, usersRepo, passwordResetRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
+        const { service, appUsersRepo, passwordResetRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.requestForgotPassword("none@example.com")).resolves.toEqual({
             success: true,
         });
@@ -210,10 +216,8 @@ const setup = () => {
         await (0, vitest_1.expect)(service.resetPassword("bad", "x")).rejects.toThrow("Invalid password reset token");
     });
     (0, vitest_1.it)("verifies email token and reads user roles", async () => {
-        const { service, usersRepo, userRolesRepo, rolesRepo } = setup();
-        usersRepo.findOne
-            .mockResolvedValueOnce(makeUser())
-            .mockResolvedValueOnce(makeUser());
+        const { service, securityUsersRepo, userRolesRepo, rolesRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
         userRolesRepo.find.mockResolvedValue([{ roleId: "r1" }]);
         rolesRepo.find.mockResolvedValue([{ id: "r1", roleKey: "coach" }]);
         await (0, vitest_1.expect)(service.verifyEmailByToken("token-bytes")).resolves.toEqual({
@@ -225,8 +229,8 @@ const setup = () => {
         });
     });
     (0, vitest_1.it)("rejects invalid email verification token", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
+        const { service, securityUsersRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.verifyEmailByToken("missing")).rejects.toThrow("Invalid verification token");
     });
     (0, vitest_1.it)("handles refresh with expired matching token", async () => {

package/dist/nest/security-workflows.module.js

@@ -15,6 +15,7 @@ const security_admin_guard_1 = require("./security-admin.guard");
 const security_jwt_guard_1 = require("./security-jwt.guard");
 const app_user_entity_1 = require("./entities/app-user.entity");
 const security_role_entity_1 = require("./entities/security-role.entity");
+const security_user_entity_1 = require("./entities/security-user.entity");
 const security_user_role_entity_1 = require("./entities/security-user-role.entity");
 const security_workflows_controller_1 = require("./security-workflows.controller");
 const security_workflows_service_1 = require("./security-workflows.service");
@@ -34,6 +35,7 @@ let SecurityWorkflowsModule = SecurityWorkflowsModule_1 = class SecurityWorkflow
             imports: [
                 typeorm_1.TypeOrmModule.forFeature([
                     app_user_entity_1.AppUserEntity,
+                    security_user_entity_1.SecurityUserEntity,
                     security_role_entity_1.SecurityRoleEntity,
                     security_user_role_entity_1.SecurityUserRoleEntity,
                 ]),

package/dist/nest/security-workflows.service.d.ts

@@ -1,14 +1,16 @@
 import { Repository } from "typeorm";
 import { AppUserEntity } from "./entities/app-user.entity";
 import { SecurityRoleEntity } from "./entities/security-role.entity";
+import { SecurityUserEntity } from "./entities/security-user.entity";
 import { SecurityUserRoleEntity } from "./entities/security-user-role.entity";
 import { SecurityWorkflowNotifier } from "./contracts";
 export declare class SecurityWorkflowsService {
-    private readonly usersRepo;
+    private readonly appUsersRepo;
+    private readonly securityUsersRepo;
     private readonly rolesRepo;
     private readonly userRolesRepo;
     private readonly notifier;
-    constructor(usersRepo: Repository<AppUserEntity>, rolesRepo: Repository<SecurityRoleEntity>, userRolesRepo: Repository<SecurityUserRoleEntity>, notifier: SecurityWorkflowNotifier);
+    constructor(appUsersRepo: Repository<AppUserEntity>, securityUsersRepo: Repository<SecurityUserEntity>, rolesRepo: Repository<SecurityRoleEntity>, userRolesRepo: Repository<SecurityUserRoleEntity>, notifier: SecurityWorkflowNotifier);
     markEmailVerifiedAndNotifyAdmins(userId: string): Promise<{
         success: true;
         notified: false;

package/dist/nest/security-workflows.service.js

@@ -20,22 +20,25 @@ const contracts_1 = require("../api/contracts");
 const roles_1 = require("../api/roles");
 const app_user_entity_1 = require("./entities/app-user.entity");
 const security_role_entity_1 = require("./entities/security-role.entity");
+const security_user_entity_1 = require("./entities/security-user.entity");
 const security_user_role_entity_1 = require("./entities/security-user-role.entity");
 const tokens_1 = require("./tokens");
 let SecurityWorkflowsService = class SecurityWorkflowsService {
-    usersRepo;
+    appUsersRepo;
+    securityUsersRepo;
     rolesRepo;
     userRolesRepo;
     notifier;
-    constructor(usersRepo, rolesRepo, userRolesRepo, notifier) {
-        this.usersRepo = usersRepo;
+    constructor(appUsersRepo, securityUsersRepo, rolesRepo, userRolesRepo, notifier) {
+        this.appUsersRepo = appUsersRepo;
+        this.securityUsersRepo = securityUsersRepo;
         this.rolesRepo = rolesRepo;
         this.userRolesRepo = userRolesRepo;
         this.notifier = notifier;
     }
     async markEmailVerifiedAndNotifyAdmins(userId) {
-        await this.usersRepo.update({ id: userId }, { emailVerifiedAt: new Date(), emailVerificationToken: null });
-        const user = await this.usersRepo.findOne({ where: { id: userId } });
+        await this.securityUsersRepo.update({ userId }, { emailVerifiedAt: new Date(), emailVerificationToken: null });
+        const user = await this.appUsersRepo.findOne({ where: { id: userId } });
         if (!user) {
             throw new common_1.NotFoundException("User not found");
         }
@@ -48,15 +51,13 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
             user: {
                 id: user.id,
                 email: user.email,
-                firstName: user.firstName,
-                lastName: user.lastName,
             },
         });
         return { success: true, notified: true, adminEmails };
     }
     async setAdminApprovalAndNotifyUser(userId, approved) {
-        await this.usersRepo.update({ id: userId }, { adminApprovedAt: approved ? new Date() : null });
-        const user = await this.usersRepo.findOne({ where: { id: userId } });
+        await this.securityUsersRepo.update({ userId }, { adminApprovedAt: approved ? new Date() : null });
+        const user = await this.appUsersRepo.findOne({ where: { id: userId } });
         if (!user) {
             throw new common_1.NotFoundException("User not found");
         }
@@ -65,7 +66,6 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
         }
         await this.notifier.sendUserAccountApproved({
             email: user.email,
-            firstName: user.firstName,
         });
         return { success: true, notified: true };
     }
@@ -74,8 +74,9 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
             .createQueryBuilder("userRole")
             .innerJoin("security_role", "role", "role.id = userRole.role_id")
             .innerJoin("app_user", "user", "user.id = userRole.user_id")
+            .innerJoin("security_user", "securityUser", "securityUser.user_id = userRole.user_id")
             .where("role.role_key = :roleKey", { roleKey: contracts_1.ADMIN_ROLE })
-            .andWhere("user.is_active = :isActive", { isActive: true })
+            .andWhere("securityUser.is_active = :isActive", { isActive: true })
             .select("DISTINCT user.email", "email")
             .getRawMany();
         return rows.map((row) => row.email).filter(Boolean);
@@ -158,11 +159,11 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
         return this.setUserRoles(userId, nextRoles);
     }
     async setUserActive(userId, active) {
-        await this.usersRepo.update({ id: userId }, { isActive: active });
+        await this.securityUsersRepo.update({ userId }, { isActive: active });
         return { success: true, userId, active };
     }
     async assertUserExists(userId) {
-        const user = await this.usersRepo.findOne({ where: { id: userId } });
+        const user = await this.appUsersRepo.findOne({ where: { id: userId } });
         if (!user) {
             throw new common_1.NotFoundException("User not found");
         }
@@ -191,10 +192,12 @@ exports.SecurityWorkflowsService = SecurityWorkflowsService;
 exports.SecurityWorkflowsService = SecurityWorkflowsService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, typeorm_1.InjectRepository)(app_user_entity_1.AppUserEntity)),
-    __param(1, (0, typeorm_1.InjectRepository)(security_role_entity_1.SecurityRoleEntity)),
-    __param(2, (0, typeorm_1.InjectRepository)(security_user_role_entity_1.SecurityUserRoleEntity)),
-    __param(3, (0, common_1.Inject)(tokens_1.SECURITY_WORKFLOW_NOTIFIER)),
+    __param(1, (0, typeorm_1.InjectRepository)(security_user_entity_1.SecurityUserEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(security_role_entity_1.SecurityRoleEntity)),
+    __param(3, (0, typeorm_1.InjectRepository)(security_user_role_entity_1.SecurityUserRoleEntity)),
+    __param(4, (0, common_1.Inject)(tokens_1.SECURITY_WORKFLOW_NOTIFIER)),
     __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository, Object])
 ], SecurityWorkflowsService);

package/dist/nest/security-workflows.service.test.js

@@ -19,25 +19,31 @@ const makeNotifier = () => ({
 const makeUser = () => ({
     id: "user-1",
     email: "user@example.com",
-    firstName: "A",
-    lastName: "B",
     isActive: true,
 });
 const setup = () => {
-    const usersRepo = makeRepo();
+    const appUsersRepo = makeRepo();
+    const securityUsersRepo = makeRepo();
     const rolesRepo = makeRepo();
     const userRolesRepo = makeRepo();
     const notifier = makeNotifier();
-    const service = new security_workflows_service_1.SecurityWorkflowsService(usersRepo, rolesRepo, userRolesRepo, notifier);
-    return { service, usersRepo, rolesRepo, userRolesRepo, notifier };
+    const service = new security_workflows_service_1.SecurityWorkflowsService(appUsersRepo, securityUsersRepo, rolesRepo, userRolesRepo, notifier);
+    return {
+        service,
+        appUsersRepo,
+        securityUsersRepo,
+        rolesRepo,
+        userRolesRepo,
+        notifier,
+    };
 };
 (0, vitest_1.describe)("SecurityWorkflowsService", () => {
     (0, vitest_1.beforeEach)(() => {
         vitest_1.vi.clearAllMocks();
     });
     (0, vitest_1.it)("marks email verified and notifies admins", async () => {
-        const { service, usersRepo, userRolesRepo, notifier } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, userRolesRepo, notifier } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         const getRawMany = vitest_1.vi
             .fn()
             .mockResolvedValue([{ email: "admin@example.com" }]);
@@ -58,8 +64,8 @@ const setup = () => {
         (0, vitest_1.expect)(notifier.sendAdminsUserEmailVerified).toHaveBeenCalled();
     });
     (0, vitest_1.it)("returns not-notified when no admins are present", async () => {
-        const { service, usersRepo, userRolesRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, userRolesRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         const qb = {
             innerJoin: vitest_1.vi.fn().mockReturnThis(),
             where: vitest_1.vi.fn().mockReturnThis(),
@@ -71,23 +77,22 @@ const setup = () => {
         await (0, vitest_1.expect)(service.markEmailVerifiedAndNotifyAdmins("user-1")).resolves.toEqual({ success: true, notified: false, adminEmails: [] });
     });
     (0, vitest_1.it)("throws when user is missing during verification flow", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
+        const { service, appUsersRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.markEmailVerifiedAndNotifyAdmins("missing")).rejects.toBeInstanceOf(common_1.NotFoundException);
     });
     (0, vitest_1.it)("handles admin approval notifications", async () => {
-        const { service, usersRepo, notifier } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, notifier } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         await (0, vitest_1.expect)(service.setAdminApprovalAndNotifyUser("user-1", false)).resolves.toEqual({ success: true, notified: false });
         await (0, vitest_1.expect)(service.setAdminApprovalAndNotifyUser("user-1", true)).resolves.toEqual({ success: true, notified: true });
         (0, vitest_1.expect)(notifier.sendUserAccountApproved).toHaveBeenCalledWith({
             email: "user@example.com",
-            firstName: "A",
         });
     });
     (0, vitest_1.it)("throws when approval target user is missing", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
+        const { service, appUsersRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.setAdminApprovalAndNotifyUser("missing", true)).rejects.toBeInstanceOf(common_1.NotFoundException);
     });
     (0, vitest_1.it)("manages role catalog and protected role removal", async () => {
@@ -125,8 +130,8 @@ const setup = () => {
         (0, vitest_1.expect)(userRolesRepo.delete).toHaveBeenCalledWith({ roleId: "r2" });
     });
     (0, vitest_1.it)("gets and sets user roles", async () => {
-        const { service, usersRepo, userRolesRepo, rolesRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, userRolesRepo, rolesRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         userRolesRepo.find.mockResolvedValue([{ roleId: "r1" }]);
         rolesRepo.find.mockResolvedValue([{ id: "r1", roleKey: "ADMIN" }]);
         await (0, vitest_1.expect)(service.getUserRoles("user-1")).resolves.toEqual({
@@ -143,8 +148,8 @@ const setup = () => {
         (0, vitest_1.expect)(userRolesRepo.save).toHaveBeenCalled();
     });
     (0, vitest_1.it)("assigns and removes role from user", async () => {
-        const { service, usersRepo, userRolesRepo, rolesRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(makeUser());
+        const { service, appUsersRepo, userRolesRepo, rolesRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
         userRolesRepo.find.mockResolvedValue([]);
         rolesRepo.find.mockResolvedValue([]);
         await service.assignRoleToUser("user-1", "coach");
@@ -156,17 +161,17 @@ const setup = () => {
         (0, vitest_1.expect)(userRolesRepo.delete).toHaveBeenCalledWith({ userId: "user-1" });
     });
     (0, vitest_1.it)("sets user active state", async () => {
-        const { service, usersRepo } = setup();
+        const { service, securityUsersRepo } = setup();
         await (0, vitest_1.expect)(service.setUserActive("user-1", false)).resolves.toEqual({
             success: true,
             userId: "user-1",
             active: false,
         });
-        (0, vitest_1.expect)(usersRepo.update).toHaveBeenCalledWith({ id: "user-1" }, { isActive: false });
+        (0, vitest_1.expect)(securityUsersRepo.update).toHaveBeenCalledWith({ userId: "user-1" }, { isActive: false });
     });
     (0, vitest_1.it)("throws when role operations target missing user", async () => {
-        const { service, usersRepo } = setup();
-        usersRepo.findOne.mockResolvedValue(null);
+        const { service, appUsersRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
         await (0, vitest_1.expect)(service.getUserRoles("missing")).rejects.toBeInstanceOf(common_1.NotFoundException);
         await (0, vitest_1.expect)(service.setUserRoles("missing", ["ADMIN"])).rejects.toBeInstanceOf(common_1.NotFoundException);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scryan7371/sdr-security",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Reusable auth/security capability for API and app clients.",
   "main": "dist/index.js",
   "exports": {
@@ -62,10 +62,10 @@
     "@nestjs/typeorm": "11.0.0",
     "@types/jsonwebtoken": "9.0.10",
     "@types/node": "^25.2.3",
-    "@types/pg": "8.15.5",
+    "@types/pg": "8.16.0",
     "@vitest/coverage-v8": "^4.0.18",
     "eslint": "9.18.0",
-    "pg": "8.16.3",
+    "pg": "8.18.0",
     "prettier": "3.8.1",
     "typeorm": "0.3.28",
     "typescript": "5.9.3",

package/src/api/contracts.ts

@@ -4,8 +4,6 @@ export type UserRole = string;
 export type SafeUser = {
   id: string;
   email: string;
-  firstName: string | null;
-  lastName: string | null;
   phone: string | null;
   roles: UserRole[];
   emailVerifiedAt: string | Date | null;

package/src/api/migrations/1739500000000-create-security-identity.ts

@@ -2,20 +2,13 @@ export class CreateSecurityIdentity1739500000000 {
   name = "CreateSecurityIdentity1739500000000";
 
   async up(queryRunner: {
-    query: (sql: string, params?: unknown[]) => Promise<unknown>;
+    query: (sql: string) => Promise<unknown>;
   }): Promise<void> {
-    const userTable = getSafeIdentifier(process.env.USER_TABLE, "app_user");
-    const userSchema = getSafeIdentifier(
-      process.env.USER_TABLE_SCHEMA,
-      "public",
-    );
-    const userTableRef = `"${userSchema}"."${userTable}"`;
-
-    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "uuid-ossp"`);
+    const userTableRef = getUserTableReference();
 
     await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_identity" (
-        "id" uuid PRIMARY KEY NOT NULL DEFAULT uuid_generate_v4(),
+        "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
         "user_id" varchar NOT NULL,
         "provider" varchar NOT NULL,
         "provider_subject" varchar NOT NULL,
@@ -31,46 +24,6 @@ export class CreateSecurityIdentity1739500000000 {
     await queryRunner.query(
       `CREATE UNIQUE INDEX IF NOT EXISTS "IDX_security_identity_user_provider" ON "security_identity" ("user_id", "provider")`,
     );
-
-    const hasGoogleSubjectColumn = (await queryRunner.query(
-      `
-        SELECT 1
-        FROM information_schema.columns
-        WHERE table_schema = $1
-          AND table_name = $2
-          AND column_name = 'google_subject'
-        LIMIT 1
-      `,
-      [userSchema, userTable],
-    )) as Array<{ "?column?": number }>;
-
-    if (hasGoogleSubjectColumn.length > 0) {
-      await queryRunner.query(`
-        INSERT INTO "security_identity" (
-          "user_id",
-          "provider",
-          "provider_subject",
-          "created_at",
-          "updated_at"
-        )
-        SELECT
-          "id",
-          'google',
-          "google_subject",
-          now(),
-          now()
-        FROM ${userTableRef}
-        WHERE "google_subject" IS NOT NULL
-        ON CONFLICT ("provider", "provider_subject") DO NOTHING
-      `);
-
-      await queryRunner.query(
-        `DROP INDEX IF EXISTS "IDX_app_user_google_subject"`,
-      );
-      await queryRunner.query(
-        `ALTER TABLE ${userTableRef} DROP COLUMN IF EXISTS "google_subject"`,
-      );
-    }
   }
 
   async down(queryRunner: {
@@ -93,3 +46,11 @@ const getSafeIdentifier = (value: string | undefined, fallback: string) => {
   }
   return resolved;
 };
+
+const getUserTableReference = () => {
+  const table = getSafeIdentifier(process.env.USER_TABLE, "app_user");
+  const schema = process.env.USER_TABLE_SCHEMA
+    ? getSafeIdentifier(process.env.USER_TABLE_SCHEMA, "public")
+    : "public";
+  return `"${schema}"."${table}"`;
+};