@solidxai/core 0.1.16-beta.2 → 0.1.16-beta.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.16-beta.2",
+  "version": "0.1.16-beta.3",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/postman/signup-issues

@@ -1,2 +1,3 @@
-fullName -> not set in the case of public registration
-userType is not set in the case of public registration
+userType is not set in the case of public registration (pending)
+need to test with transactional and mobile type (pending)
+need to check the oauth flow as well

package/src/dtos/otp-sign-up.dto.ts

@@ -1,17 +1,26 @@
-import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional } from 'class-validator';
+import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 import { PasswordlessRegistrationValidateWhatSources } from "../constants";
+import { ApiProperty } from '@nestjs/swagger';
 
 export class OTPSignUpDto {
+    @IsOptional()
+    @IsString()
+    @ApiProperty()
+    fullName: string;
+
     @IsNotEmpty()
+    @ApiProperty()
     username: string;
 
     @IsOptional()
     @IsEmail()
+    @ApiProperty()
     email: string;
 
     @IsOptional()
     @IsNotEmpty()
+    @ApiProperty()
     mobile: string;
 
     @IsOptional()
@@ -19,5 +28,6 @@ export class OTPSignUpDto {
     validationSources: PasswordlessRegistrationValidateWhatSources[] = [];
 
     @IsOptional()
+    @ApiProperty()
     customPayload: any;
 }

package/src/services/authentication.service.ts

@@ -70,9 +70,18 @@ interface otp {
 
 /** Where a signup's role names come from. */
 enum RolesSource {
-  /** None from the caller: performSignUp applies the configured `defaultRole`. */
+  /**
+   * Ask nobody; returning [] lets performSignUp apply the configured `defaultRole`.
+   *
+   * No intent maps here today - it is kept for paths that deliberately bypass the
+   * provider. OAuth is the live example: its DTO can never carry a discriminator, so
+   * it takes `defaultRole` outright (currently inline in UserService).
+   */
   Default,
-  /** `provider.roles(dto)`, unconditionally. */
+  /**
+   * `provider.roles(dto)` - and nothing else. Yields [] when no provider is registered
+   * or when the provider declines to name any, which falls through to `defaultRole`.
+   */
   Provider,
   /** The caller's own `dto.roles`. */
   Caller,
@@ -82,10 +91,18 @@ enum RolesSource {
  * The single place that decides, per intent, which entity a signup builds and where
  * its roles come from.
  *
- * `useProvider` is currently computable from `rolesSource` (`Caller` implies false),
- * but the two answer different questions - "which entity?" and "which roles?" - that
- * merely coincide across these three intents. Keep both, and change behaviour here
- * rather than at a call site.
+ * Where an extension user provider is registered it is the authority on that app's user
+ * roles, so every provider-backed intent asks it. `defaultRole` is the *fallback* for
+ * when it names none - or when there is no provider at all - not the rule.
+ *
+ * SelfRegistration and ExtensionModel resolve identically today. They stay separate
+ * intents because only SelfRegistration is gated on `allowPublicRegistration`, and
+ * because "an anonymous visitor signing themselves up" and "an admin creating a user
+ * from the model's own form" are different things that may yet need to diverge.
+ *
+ * `useProvider` is computable from `rolesSource` today (`Caller` implies false), but the
+ * two answer different questions - "which entity?" and "which roles?" - that merely
+ * coincide across these intents. Keep both, and change behaviour here, not at a call site.
  */
 const SIGNUP_POLICY: Record<
   SignupIntent,
@@ -93,7 +110,7 @@ const SIGNUP_POLICY: Record<
 > = {
   [SignupIntent.SelfRegistration]: {
     useProvider: true,
-    rolesSource: RolesSource.Default,
+    rolesSource: RolesSource.Provider,
   },
   [SignupIntent.ExtensionModel]: {
     useProvider: true,
@@ -246,12 +263,24 @@ export class AuthenticationService {
     dto: Record<string, any>,
     source: RolesSource,
   ): string[] {
+    // Only `Caller` reads dto.roles. Anywhere else, roles in the body are ignored -
+    // which is what keeps an anonymous caller from naming their own on a @Public()
+    // endpoint - so say so rather than dropping them silently.
+    if (source !== RolesSource.Caller && dto.roles?.length) {
+      this.logger.warn(
+        `Ignoring caller-supplied roles for "${dto.username}": roles on this path come from ` +
+          (source === RolesSource.Provider
+            ? "the extension user provider"
+            : "the configured defaultRole"),
+      );
+    }
+
     switch (source) {
       case RolesSource.Provider:
-        // Sole authority. `dto.roles` is deliberately not read - not as a preference,
-        // not as a fallback. Reading it would skip roles(), which is where a provider
-        // validates its discriminator, and CreateUserDto types roles as
-        // UpdateRoleMetadataDto[] where performSignUp expects role-name strings.
+        // Sole authority. Reading dto.roles as a preference or fallback would skip
+        // roles(), which is where a provider validates its discriminator, and
+        // CreateUserDto types roles as UpdateRoleMetadataDto[] where performSignUp
+        // expects role-name strings. [] here falls through to `defaultRole`.
         return (
           this.solidRegistry
             .getExtensionUserCreationProvider()
@@ -262,14 +291,6 @@ export class AuthenticationService {
         return dto.roles ?? [];
 
       case RolesSource.Default:
-        // Public signup: the form has no business naming roles. Returning empty lets
-        // performSignUp apply the configured `defaultRole`, rather than adding a
-        // second mechanism for the same thing.
-        if (dto.roles?.length) {
-          this.logger.warn(
-            `Ignoring caller-supplied roles on public registration for "${dto.username}"`,
-          );
-        }
         return [];
     }
   }
@@ -772,16 +793,31 @@ export class AuthenticationService {
     validationSource: string,
   ): Promise<User> {
     if (isEmpty(existingUser)) {
+      // Resolved before anything is written: where a provider requires its discriminator
+      // roles() throws, and that should surface as a rejected request rather than as a
+      // half-registered user with no roles.
+      const roles = this.resolveSignupRoles(
+        signUpDto,
+        SIGNUP_POLICY[SignupIntent.SelfRegistration].rolesSource,
+      );
+
       // A new registration is saved through whichever repository createUser resolved,
       // which is the provider's when the app registers one.
       const { entity: user, repo } = await this.createUser(signUpDto);
       user.active = false; // User will be activated only after OTP verification, hence setting active to false for new user.
       await this.assignRegistrationOtp(validationSource, user);
       await repo.save(user);
-      await this.userService.addRoleToUser(
-        user.username,
-        this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
-      );
+
+      if (roles.length) {
+        await this.userService.addRolesToUser(user.username, roles);
+      } else {
+        // The provider named none, or there is no provider: fall back to the configured
+        // default, matching what performSignUp does on the password paths.
+        await this.userService.addRoleToUser(
+          user.username,
+          this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
+        );
+      }
       return user;
     }
 
@@ -812,9 +848,8 @@ export class AuthenticationService {
     entity.username = signUpDto.username;
     entity.email = signUpDto.email;
     entity.mobile = signUpDto.mobile;
-    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors
-    // the fallback in populateForSignup, which this path does not go through.
-    entity.fullName = signUpDto.username;
+    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors the fallback in populateForSignup, which this path does not go through.
+    entity.fullName = signUpDto.fullName?.trim() || signUpDto.username;
     entity.customPayload = signUpDto.customPayload;
     entity.lastLoginProvider = LoginProvider.OTP;