@spfn/auth 0.2.0-beta.43 → 0.2.0-beta.44

package/README.md

@@ -1623,6 +1623,7 @@ Main user identity table.
 ```sql
 CREATE TABLE users (
   id BIGSERIAL PRIMARY KEY,
+  public_id UUID NOT NULL UNIQUE DEFAULT gen_random_uuid(),
   email TEXT UNIQUE,
   phone TEXT UNIQUE,
   username TEXT UNIQUE,
@@ -1643,6 +1644,7 @@ CREATE TABLE users (
 ```
 
 **Key Points:**
+- `public_id` is a UUID v4 for external-facing URLs and APIs (never expose internal `id`)
 - At least one of `email` OR `phone` required
 - `username` is unique and nullable (optional display/mention identifier)
 - `passwordHash` is bcrypt ($2b$10$..., 60 chars)

package/dist/{authenticate-CAJr3A4H.d.ts → authenticate-CRDUKQbi.d.ts}

@@ -36,6 +36,7 @@ interface Permission {
 }
 interface AuthSession {
     userId: number;
+    publicId: string;
     email: string | null;
     emailVerified: boolean;
     phoneVerified: boolean;
@@ -71,6 +72,7 @@ interface ProfileInfo {
  */
 interface UserProfile {
     userId: number;
+    publicId: string;
     email: string | null;
     username: string | null;
     emailVerified: boolean;
@@ -153,6 +155,7 @@ interface RegisterParams {
 }
 interface RegisterResult {
     userId: string;
+    publicId: string;
     email?: string;
     phone?: string;
 }
@@ -168,6 +171,7 @@ interface LoginParams {
 }
 interface LoginResult {
     userId: string;
+    publicId: string;
     email?: string;
     phone?: string;
     passwordChangeRequired: boolean;
@@ -548,6 +552,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
         }[];
         userId: number;
+        publicId: string;
         email: string | null;
         emailVerified: boolean;
         phoneVerified: boolean;
@@ -734,6 +739,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { R as RoleConfig, P as PermissionConfig, C as CheckAccountExistsResult, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, O as OAuthStartResult, U as UserProfile, c as ProfileInfo, m as mainAuthRouter } from './authenticate-CAJr3A4H.js';
-export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './authenticate-CAJr3A4H.js';
+import { R as RoleConfig, P as PermissionConfig, C as CheckAccountExistsResult, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, O as OAuthStartResult, U as UserProfile, c as ProfileInfo, m as mainAuthRouter } from './authenticate-CRDUKQbi.js';
+export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './authenticate-CRDUKQbi.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
 import * as _sinclair_typebox from '@sinclair/typebox';
@@ -172,6 +172,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
         }[];
         userId: number;
+        publicId: string;
         email: string | null;
         emailVerified: boolean;
         phoneVerified: boolean;
@@ -358,6 +359,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;

package/dist/nextjs/server.d.ts

@@ -156,6 +156,7 @@ declare function getAuthSessionData(): Promise<{
         category: "auth" | "user" | "rbac" | "system" | "custom" | undefined;
     }[];
     userId: number;
+    publicId: string;
     email: string | null;
     emailVerified: boolean;
     phoneVerified: boolean;

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { k as AuthInitOptions, l as KeyAlgorithmType, n as InvitationStatus, f as VerificationPurpose, j as PermissionCategory, p as SocialProvider, q as AuthContext } from './authenticate-CAJr3A4H.js';
-export { B as ChangePasswordParams, w as CheckAccountExistsParams, C as CheckAccountExistsResult, a6 as EmailSchema, I as INVITATION_STATUSES, K as KEY_ALGORITHM, y as LoginParams, L as LoginResult, z as LogoutParams, a2 as OAuthCallbackParams, a3 as OAuthCallbackResult, a1 as OAuthStartParams, O as OAuthStartResult, a8 as PasswordSchema, a7 as PhoneSchema, x as RegisterParams, Q as RegisterPublicKeyParams, a as RegisterResult, W as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, e as SOCIAL_PROVIDERS, F as SendVerificationCodeParams, S as SendVerificationCodeResult, a9 as TargetTypeSchema, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, aa as VerificationPurposeSchema, V as VerificationTargetType, G as VerifyCodeParams, H as VerifyCodeResult, m as authRouter, a4 as authenticate, Z as buildOAuthErrorUrl, v as changePasswordService, r as checkAccountExistsService, $ as getEnabledOAuthProviders, a0 as getGoogleAccessToken, _ as isOAuthProviderEnabled, t as loginService, u as logoutService, Y as oauthCallbackService, X as oauthStartService, a5 as optionalAuth, J as registerPublicKeyService, s as registerService, N as revokeKeyService, M as rotateKeyService, D as sendVerificationCodeService, E as verifyCodeService } from './authenticate-CAJr3A4H.js';
+import { k as AuthInitOptions, l as KeyAlgorithmType, n as InvitationStatus, f as VerificationPurpose, j as PermissionCategory, p as SocialProvider, q as AuthContext } from './authenticate-CRDUKQbi.js';
+export { B as ChangePasswordParams, w as CheckAccountExistsParams, C as CheckAccountExistsResult, a6 as EmailSchema, I as INVITATION_STATUSES, K as KEY_ALGORITHM, y as LoginParams, L as LoginResult, z as LogoutParams, a2 as OAuthCallbackParams, a3 as OAuthCallbackResult, a1 as OAuthStartParams, O as OAuthStartResult, a8 as PasswordSchema, a7 as PhoneSchema, x as RegisterParams, Q as RegisterPublicKeyParams, a as RegisterResult, W as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, e as SOCIAL_PROVIDERS, F as SendVerificationCodeParams, S as SendVerificationCodeResult, a9 as TargetTypeSchema, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, aa as VerificationPurposeSchema, V as VerificationTargetType, G as VerifyCodeParams, H as VerifyCodeResult, m as authRouter, a4 as authenticate, Z as buildOAuthErrorUrl, v as changePasswordService, r as checkAccountExistsService, $ as getEnabledOAuthProviders, a0 as getGoogleAccessToken, _ as isOAuthProviderEnabled, t as loginService, u as logoutService, Y as oauthCallbackService, X as oauthStartService, a5 as optionalAuth, J as registerPublicKeyService, s as registerService, N as revokeKeyService, M as rotateKeyService, D as sendVerificationCodeService, E as verifyCodeService } from './authenticate-CRDUKQbi.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
@@ -79,6 +79,23 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        publicId: drizzle_orm_pg_core.PgColumn<{
+            name: "public_id";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         email: drizzle_orm_pg_core.PgColumn<{
             name: "email";
             tableName: "users";
@@ -268,6 +285,7 @@ declare function getUserByIdService(userId: number): Promise<{
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
     username: string | null;
@@ -286,6 +304,7 @@ declare function getUserByEmailService(email: string): Promise<{
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
     username: string | null;
@@ -304,6 +323,7 @@ declare function getUserByPhoneService(phone: string): Promise<{
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
     username: string | null;
@@ -341,6 +361,7 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
     createdAt: Date;
     updatedAt: Date;
     id: number;
+    publicId: string;
     email: string | null;
     phone: string | null;
     username: string | null;
@@ -1309,6 +1330,7 @@ declare function getAuthSessionService(userId: string | number | bigint): Promis
         category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
     }[];
     userId: number;
+    publicId: string;
     email: string | null;
     emailVerified: boolean;
     phoneVerified: boolean;
@@ -2823,6 +2845,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2842,6 +2865,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2861,6 +2885,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2880,6 +2905,27 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * Public ID(UUID)로 사용자 조회
+     * Read replica 사용
+     */
+    findByPublicId(publicId: string): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2899,6 +2945,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2921,6 +2968,7 @@ declare class UsersRepository extends BaseRepository {
             createdAt: Date;
             updatedAt: Date;
             id: number;
+            publicId: string;
             email: string | null;
             phone: string | null;
             username: string | null;
@@ -2946,6 +2994,7 @@ declare class UsersRepository extends BaseRepository {
         email: string | null;
         phone: string | null;
         id: number;
+        publicId: string;
         username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
@@ -2965,6 +3014,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -2984,6 +3034,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -3003,6 +3054,7 @@ declare class UsersRepository extends BaseRepository {
         createdAt: Date;
         updatedAt: Date;
         id: number;
+        publicId: string;
         email: string | null;
         phone: string | null;
         username: string | null;
@@ -3022,6 +3074,7 @@ declare class UsersRepository extends BaseRepository {
         email: string | null;
         phone: string | null;
         id: number;
+        publicId: string;
         username: string | null;
         passwordHash: string | null;
         passwordChangeRequired: boolean;
@@ -3063,6 +3116,7 @@ declare class UsersRepository extends BaseRepository {
      */
     fetchMinimalUserData(userId: number): Promise<{
         userId: number;
+        publicId: string;
         email: string | null;
         username: string | null;
         isEmailVerified: boolean;
@@ -3077,6 +3131,7 @@ declare class UsersRepository extends BaseRepository {
      */
     fetchFullUserData(userId: number): Promise<{
         userId: number;
+        publicId: string;
         email: string | null;
         username: string | null;
         isEmailVerified: boolean;
@@ -4805,6 +4860,7 @@ declare function getUser(c: Context | {
     email: string | null;
     phone: string | null;
     id: number;
+    publicId: string;
     username: string | null;
     passwordHash: string | null;
     passwordChangeRequired: boolean;

package/dist/server.js

@@ -4564,7 +4564,7 @@ var init_roles = __esm({
 });
 
 // src/server/entities/users.ts
-import { text as text2, check, boolean as boolean2, index as index2 } from "drizzle-orm/pg-core";
+import { text as text2, check, boolean as boolean2, index as index2, uuid } from "drizzle-orm/pg-core";
 import { id as id2, timestamps as timestamps2, enumText, utcTimestamp, foreignKey } from "@spfn/core/db";
 import { sql } from "drizzle-orm";
 var users;
@@ -4579,6 +4579,9 @@ var init_users = __esm({
       {
         // Identity
         id: id2(),
+        // Public-facing UUID (for URLs, external APIs)
+        // Never expose internal bigserial ID externally
+        publicId: uuid("public_id").notNull().unique().defaultRandom(),
         // Email address (unique identifier)
         // Used for: login, password reset, notifications
         email: text2("email").unique(),
@@ -4626,6 +4629,7 @@ var init_users = __esm({
           sql`${table.email} IS NOT NULL OR ${table.phone} IS NOT NULL`
         ),
         // Indexes for query optimization
+        index2("users_public_id_idx").on(table.publicId),
         index2("users_email_idx").on(table.email),
         index2("users_phone_idx").on(table.phone),
         index2("users_username_idx").on(table.username),
@@ -5355,6 +5359,14 @@ var init_users_repository = __esm({
         const result = await this.readDb.select().from(users).where(eq(users.username, username)).limit(1);
         return result[0] ?? null;
       }
+      /**
+       * Public ID(UUID)로 사용자 조회
+       * Read replica 사용
+       */
+      async findByPublicId(publicId) {
+        const result = await this.readDb.select().from(users).where(eq(users.publicId, publicId)).limit(1);
+        return result[0] ?? null;
+      }
       /**
        * 이메일 또는 전화번호로 사용자 조회
        * Read replica 사용
@@ -5495,6 +5507,7 @@ var init_users_repository = __esm({
       async fetchMinimalUserData(userId) {
         const user = await this.readDb.select({
           id: users.id,
+          publicId: users.publicId,
           email: users.email,
           username: users.username,
           emailVerifiedAt: users.emailVerifiedAt,
@@ -5505,6 +5518,7 @@ var init_users_repository = __esm({
         }
         return {
           userId: user.id,
+          publicId: user.publicId,
           email: user.email,
           username: user.username,
           isEmailVerified: !!user.emailVerifiedAt,
@@ -5521,6 +5535,7 @@ var init_users_repository = __esm({
       async fetchFullUserData(userId) {
         const user = await this.readDb.select({
           id: users.id,
+          publicId: users.publicId,
           email: users.email,
           username: users.username,
           emailVerifiedAt: users.emailVerifiedAt,
@@ -5534,6 +5549,7 @@ var init_users_repository = __esm({
         }
         return {
           userId: user.id,
+          publicId: user.publicId,
           email: user.email,
           username: user.username,
           isEmailVerified: !!user.emailVerifiedAt,
@@ -7246,6 +7262,7 @@ async function registerService(params) {
   });
   const result = {
     userId: String(newUser.id),
+    publicId: newUser.publicId,
     email: newUser.email || void 0,
     phone: newUser.phone || void 0
   };
@@ -7291,6 +7308,7 @@ async function loginService(params) {
   await updateLastLoginService(user.id);
   const result = {
     userId: String(user.id),
+    publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
     passwordChangeRequired: user.passwordChangeRequired
@@ -7770,6 +7788,7 @@ async function getAuthSessionService(userId) {
   ]);
   return {
     userId: user.userId,
+    publicId: user.publicId,
     email: user.email,
     emailVerified: user.isEmailVerified,
     phoneVerified: user.isPhoneVerified,
@@ -7787,6 +7806,7 @@ async function getUserProfileService(userId) {
   ]);
   return {
     userId: user.userId,
+    publicId: user.publicId,
     email: user.email,
     username: user.username,
     emailVerified: user.isEmailVerified,