@solidxai/core 0.1.16-beta.3 → 0.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.16-beta.3",
+  "version": "0.1.16",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/dtos/otp-sign-up.dto.ts

@@ -1,26 +1,17 @@
-import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional } from 'class-validator';
 
 import { PasswordlessRegistrationValidateWhatSources } from "../constants";
-import { ApiProperty } from '@nestjs/swagger';
 
 export class OTPSignUpDto {
-    @IsOptional()
-    @IsString()
-    @ApiProperty()
-    fullName: string;
-
     @IsNotEmpty()
-    @ApiProperty()
     username: string;
 
     @IsOptional()
     @IsEmail()
-    @ApiProperty()
     email: string;
 
     @IsOptional()
     @IsNotEmpty()
-    @ApiProperty()
     mobile: string;
 
     @IsOptional()
@@ -28,6 +19,5 @@ export class OTPSignUpDto {
     validationSources: PasswordlessRegistrationValidateWhatSources[] = [];
 
     @IsOptional()
-    @ApiProperty()
     customPayload: any;
 }

package/src/services/authentication.service.ts

@@ -70,18 +70,9 @@ interface otp {
 
 /** Where a signup's role names come from. */
 enum RolesSource {
-  /**
-   * Ask nobody; returning [] lets performSignUp apply the configured `defaultRole`.
-   *
-   * No intent maps here today - it is kept for paths that deliberately bypass the
-   * provider. OAuth is the live example: its DTO can never carry a discriminator, so
-   * it takes `defaultRole` outright (currently inline in UserService).
-   */
+  /** None from the caller: performSignUp applies the configured `defaultRole`. */
   Default,
-  /**
-   * `provider.roles(dto)` - and nothing else. Yields [] when no provider is registered
-   * or when the provider declines to name any, which falls through to `defaultRole`.
-   */
+  /** `provider.roles(dto)`, unconditionally. */
   Provider,
   /** The caller's own `dto.roles`. */
   Caller,
@@ -91,18 +82,10 @@ enum RolesSource {
  * The single place that decides, per intent, which entity a signup builds and where
  * its roles come from.
  *
- * Where an extension user provider is registered it is the authority on that app's user
- * roles, so every provider-backed intent asks it. `defaultRole` is the *fallback* for
- * when it names none - or when there is no provider at all - not the rule.
- *
- * SelfRegistration and ExtensionModel resolve identically today. They stay separate
- * intents because only SelfRegistration is gated on `allowPublicRegistration`, and
- * because "an anonymous visitor signing themselves up" and "an admin creating a user
- * from the model's own form" are different things that may yet need to diverge.
- *
- * `useProvider` is computable from `rolesSource` today (`Caller` implies false), but the
- * two answer different questions - "which entity?" and "which roles?" - that merely
- * coincide across these intents. Keep both, and change behaviour here, not at a call site.
+ * `useProvider` is currently computable from `rolesSource` (`Caller` implies false),
+ * but the two answer different questions - "which entity?" and "which roles?" - that
+ * merely coincide across these three intents. Keep both, and change behaviour here
+ * rather than at a call site.
  */
 const SIGNUP_POLICY: Record<
   SignupIntent,
@@ -110,7 +93,7 @@ const SIGNUP_POLICY: Record<
 > = {
   [SignupIntent.SelfRegistration]: {
     useProvider: true,
-    rolesSource: RolesSource.Provider,
+    rolesSource: RolesSource.Default,
   },
   [SignupIntent.ExtensionModel]: {
     useProvider: true,
@@ -263,24 +246,12 @@ export class AuthenticationService {
     dto: Record<string, any>,
     source: RolesSource,
   ): string[] {
-    // Only `Caller` reads dto.roles. Anywhere else, roles in the body are ignored -
-    // which is what keeps an anonymous caller from naming their own on a @Public()
-    // endpoint - so say so rather than dropping them silently.
-    if (source !== RolesSource.Caller && dto.roles?.length) {
-      this.logger.warn(
-        `Ignoring caller-supplied roles for "${dto.username}": roles on this path come from ` +
-          (source === RolesSource.Provider
-            ? "the extension user provider"
-            : "the configured defaultRole"),
-      );
-    }
-
     switch (source) {
       case RolesSource.Provider:
-        // Sole authority. Reading dto.roles as a preference or fallback would skip
-        // roles(), which is where a provider validates its discriminator, and
-        // CreateUserDto types roles as UpdateRoleMetadataDto[] where performSignUp
-        // expects role-name strings. [] here falls through to `defaultRole`.
+        // Sole authority. `dto.roles` is deliberately not read - not as a preference,
+        // not as a fallback. Reading it would skip roles(), which is where a provider
+        // validates its discriminator, and CreateUserDto types roles as
+        // UpdateRoleMetadataDto[] where performSignUp expects role-name strings.
         return (
           this.solidRegistry
             .getExtensionUserCreationProvider()
@@ -291,6 +262,14 @@ export class AuthenticationService {
         return dto.roles ?? [];
 
       case RolesSource.Default:
+        // Public signup: the form has no business naming roles. Returning empty lets
+        // performSignUp apply the configured `defaultRole`, rather than adding a
+        // second mechanism for the same thing.
+        if (dto.roles?.length) {
+          this.logger.warn(
+            `Ignoring caller-supplied roles on public registration for "${dto.username}"`,
+          );
+        }
         return [];
     }
   }
@@ -793,31 +772,16 @@ export class AuthenticationService {
     validationSource: string,
   ): Promise<User> {
     if (isEmpty(existingUser)) {
-      // Resolved before anything is written: where a provider requires its discriminator
-      // roles() throws, and that should surface as a rejected request rather than as a
-      // half-registered user with no roles.
-      const roles = this.resolveSignupRoles(
-        signUpDto,
-        SIGNUP_POLICY[SignupIntent.SelfRegistration].rolesSource,
-      );
-
       // A new registration is saved through whichever repository createUser resolved,
       // which is the provider's when the app registers one.
       const { entity: user, repo } = await this.createUser(signUpDto);
       user.active = false; // User will be activated only after OTP verification, hence setting active to false for new user.
       await this.assignRegistrationOtp(validationSource, user);
       await repo.save(user);
-
-      if (roles.length) {
-        await this.userService.addRolesToUser(user.username, roles);
-      } else {
-        // The provider named none, or there is no provider: fall back to the configured
-        // default, matching what performSignUp does on the password paths.
-        await this.userService.addRoleToUser(
-          user.username,
-          this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
-        );
-      }
+      await this.userService.addRoleToUser(
+        user.username,
+        this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
+      );
       return user;
     }
 
@@ -848,8 +812,9 @@ export class AuthenticationService {
     entity.username = signUpDto.username;
     entity.email = signUpDto.email;
     entity.mobile = signUpDto.mobile;
-    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors the fallback in populateForSignup, which this path does not go through.
-    entity.fullName = signUpDto.fullName?.trim() || signUpDto.username;
+    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors
+    // the fallback in populateForSignup, which this path does not go through.
+    entity.fullName = signUpDto.username;
     entity.customPayload = signUpDto.customPayload;
     entity.lastLoginProvider = LoginProvider.OTP;
 

package/CLAUDE.md

@@ -1,26 +0,0 @@
-# This is the SolidX API project.
-This is included as a dependency in consuming projects.
-
-# SolidX UI
-# The corresponding UI project is at the below path:
- /Users/oswald/projects/Solid_Starters/solid-core-ui
-
-# SolidX Docs
-# The documentation project is at the below path:
-/Users/oswald/projects/solidxai-docs
-
-# SolidX Agent
-# The agent project which has the skills for helping users configure, build and use SolidX is at the below path:
-/Users/oswald/projects/Solid_Starters/agent
-
-# SolidX Control Plane Commands
-# The control plane commands for managing SolidX instances are in the below path:
-/Users/oswald/projects/Solid_Starters/solidctl
-
-# Testing reference project 
-# This is the reference library management project that is used for testing and development of SolidX features. It is located at the below path:
-/Users/oswald/projects/Solid_Starters/solid-library-management
-
-# Code Builder project
-# This is the project that contains the code builder which generates code based on user input and templates. It is located at the below path:
-/Users/oswald/projects/Solid_Starters/solid-code-builder