@xeplr/auth 1.0.0 → 1.0.1

package/bin/migrate.js

@@ -1,18 +1,26 @@
 #!/usr/bin/env node
 
+// Reads process.env ONLY. The consuming app loads its .env (e.g. via dotenv-cli
+// in the npm script) — @xeplr/* packages never read .env files.
+
 const path = require('path');
-const { up, rollback, status } = require('@xeplr/db').migrator;
+const { up, status } = require('@xeplr/db').sqlMigrator;
+const { resolveConfig } = require('@xeplr/db');
 
 /**
  * xeplr-auth-migrate
  *
- * Runs auth migrations bundled with this package.
- * Reuses xeplr-db's migrator — no duplicated knex logic.
+ * Runs auth's bundled .sql migrations, followed by the consumer app's
+ * EXTENSION migrations dir (schema + data — auth has no separate seed step;
+ * base data lives in migrations so it runs exactly once). Reuses xeplr-db's
+ * sqlMigrator — hand-written .sql files, no down(), ledger-tracked.
+ *
+ * The app points at its extension dir ONCE via env: AUTH_EXT_MIGRATIONS_DIR
+ * (or --extDir). Base migrations run first, then the app's — one ledger.
  *
  * Usage:
- *   xeplr-auth-migrate up [--db <database>]
- *   xeplr-auth-migrate rollback [--db <database>]
- *   xeplr-auth-migrate status [--db <database>]
+ *   xeplr-auth-migrate up [--extDir <dir>] [--db <database>]
+ *   xeplr-auth-migrate status [--extDir <dir>] [--db <database>]
  */
 
 function parseArgs(argv) {
@@ -33,30 +41,33 @@ async function main() {
   const args = parseArgs(process.argv.slice(2));
   const command = args._[0];
 
-  // Always use bundled migrations directory
+  // Bundled auth migrations (base) + the app's extension migrations dir, which
+  // the app configures ONCE via AUTH_EXT_MIGRATIONS_DIR (or --extDir). Base runs
+  // first, then the extension — one shared ledger.
   const options = {
     ...args,
-    db: args.db || process.env.DB_AUTH || process.env.DB_NAME,
-    dir: path.join(__dirname, '..', 'migrations')
+    db: args.db || process.env.AUTH_DB_NAME,
+    dir: path.join(__dirname, '..', 'migrations'),
+    extDir: args.extDir || args['ext-dir'] || process.env.AUTH_EXT_MIGRATIONS_DIR,
+    connectionName: args['connection-name'] || args.connectionName || 'auth'
   };
 
+  if (['up', 'status'].indexOf(command) !== -1) {
+    // App tells us which secret to use (decoupled from the connection name):
+    //   --connection <encrypted> | --connection-env <ENV_NAME>. Omit → legacy
+    //   <connectionName>_CONNECTION fallback inside resolveConfig.
+    var connSource = args.connection ||
+      (args['connection-env'] && process.env[args['connection-env']]) || undefined;
+    await resolveConfig(options.connectionName, connSource);
+  }
+
   switch (command) {
     case 'up': {
       const result = await up(options);
       if (result.migrations.length === 0) {
         console.log('Already up to date');
       } else {
-        console.log(`Batch ${result.batch} ran ${result.migrations.length} migrations:`);
-        result.migrations.forEach(m => console.log(`  - ${m}`));
-      }
-      break;
-    }
-    case 'rollback': {
-      const result = await rollback(options);
-      if (result.migrations.length === 0) {
-        console.log('Nothing to rollback');
-      } else {
-        console.log(`Rolled back ${result.migrations.length} migrations:`);
+        console.log(`Ran ${result.migrations.length} migrations:`);
         result.migrations.forEach(m => console.log(`  - ${m}`));
       }
       break;
@@ -71,21 +82,29 @@ async function main() {
       } else {
         console.log('No pending migrations');
       }
+      if (result.drift.length) {
+        console.log('WARNING - applied migrations edited after the fact (checksum mismatch):');
+        result.drift.forEach(m => console.log(`  ! ${m}`));
+      }
       break;
     }
     default:
       console.log('xeplr-auth-migrate - Auth database migrations');
       console.log('');
       console.log('Commands:');
-      console.log('  up [--db <name>]       Run pending migrations');
-      console.log('  rollback [--db <name>]  Rollback last batch');
-      console.log('  status [--db <name>]    Show migration status');
+      console.log('  up [--extDir <dir>]     Run base + app extension migrations');
+      console.log('  status [--extDir <dir>] Show migration status');
+      console.log('');
+      console.log('  App extension dir: --extDir or AUTH_EXT_MIGRATIONS_DIR env');
       console.log('');
       console.log('Options:');
-      console.log('  --db        Database name (or DB_AUTH env)');
+      console.log('  --db        Database name (or AUTH_DB_NAME env)');
       console.log('  --host      DB host (default: DB_HOST env or localhost)');
       console.log('  --user      DB user (default: DB_USER env or root)');
       console.log('  --password  DB password (default: DB_PASSWORD env)');
+      console.log('');
+      console.log('Migrations are hand-written .sql files (see migrations/), applied once,');
+      console.log('no down(). 0007_seed_super_admin.sql requires SUPER_ADMIN_PASSWORD in env.');
   }
 }
 

package/bin/server.js

@@ -1,35 +1,17 @@
 #!/usr/bin/env node
 
 /**
- * Standalone auth server entry point.
- * Designed to be forked as a child process or run directly.
+ * Standalone auth service. Reads AUTH_* env — the LAUNCHER provides it; this bin
+ * reads process.env only and loads no .env of its own. The consuming app does:
+ *   "start-auth": "dotenv -e development.env -- xeplr-auth-server"
  *
- * Reads config from AUTH_CONFIG env var (JSON) or individual env vars.
+ * env: ENCRYPTION_KEY · AUTH_DB_CONNECTION_INFO_ENCRYPTED · AUTH_DB_NAME ·
+ *      AUTH_JWT_SECRET · AUTH_PORT · AUTH_ACTIVATION_BASE_URL ·
+ *      AUTH_ACCESS_TOKEN_TTL_MINUTES · AUTH_EXT_MIGRATIONS_DIR · email vars · REDIS_*
  */
-var auth = require('../index');
-
-var config = {};
-
-if (process.env.AUTH_CONFIG) {
-  try {
-    config = JSON.parse(process.env.AUTH_CONFIG);
-  } catch (e) {
-    console.error('Failed to parse AUTH_CONFIG:', e.message);
-    process.exit(1);
-  }
-}
-
-config.port = config.port || process.env.AUTH_PORT || 19001;
-config.database = config.database || process.env.DB_AUTH || 'architects_auth';
-
-if (process.env.JWT_SECRET) {
-  config.jwt = config.jwt || {};
-  config.jwt.secret = config.jwt.secret || process.env.JWT_SECRET;
-}
-
-auth.start(config);
-
-// Notify parent process (if forked) that auth is ready
-if (process.send) {
-  process.send({ status: 'ready', port: config.port });
-}
+require('../index').boot().then(function () {
+  if (process.send) process.send({ status: 'ready' });
+}).catch(function (err) {
+  console.error('[auth] startup failed:', err.stack || err.message);
+  process.exit(1);
+});

package/index.js

@@ -1,12 +1,16 @@
 const path = require('path');
-const { getConnection, bindModels, resolveConfig, migrator } = require('@xeplr/db');
+const { getConnection, bindModels, resolveConfig, sqlMigrator } = require('@xeplr/db');
 const { createApp } = require('@xeplr/base-apis');
 const authHelper = require('./lib/authHelper');
+const { seedSuperAdmin } = require('./lib/seed');
 const authMiddleware = require('./lib/authMiddleware');
 const authService = require('./lib/authService');
 const accessService = require('./lib/accessService');
 const { accessMiddleware, requireRole } = require('./lib/accessMiddleware');
 const sessionService = require('./lib/sessionService');
+const ticketService = require('./lib/ticketService');
+const hooks = require('./lib/hooks');
+const mtMembershipMiddleware = require('./lib/mtMembershipMiddleware');
 const createAuthRouter = require('./lib/authRouter');
 const createAdminRouter = require('./lib/adminRouter');
 const models = require('./models');
@@ -23,12 +27,12 @@ let _initialized = false;
  * @param {object} [config.email] - Email config { provider, smtp, aws, azure, brevo }
  * @param {string} [config.resetBaseUrl] - Base URL for password reset links
  */
-function init(config = {}) {
-  // Setup database connection
-  const dbName = config.database || process.env.DB_AUTH || 'auth';
-  const dbOptions = Object.assign({ connectionName: config.connectionName || 'auth' }, config.db || {});
-  const connection = getConnection(dbName, dbOptions);
-  bindModels(connection);
+async function init(config = {}) {
+  // One call: decrypt the app-supplied connection, connect, and bind the models.
+  const dbName = config.database || process.env.AUTH_DB_NAME || 'auth';
+  const connection = await getConnection(dbName, config.connection || config.db, {
+    connectionName: config.connectionName || 'auth'
+  });
 
   // Configure JWT
   if (config.jwt) {
@@ -78,8 +82,8 @@ function adminRouter() {
  * @param {Function[]} [config.middleware] - Additional middleware
  * @returns {http.Server}
  */
-function start(config = {}) {
-  init(config);
+async function start(config = {}) {
+  await init(config);
 
   const port = config.port || process.env.AUTH_PORT || 19001;
   const authRouter = createAuthRouter({ resetBaseUrl: config.resetBaseUrl });
@@ -93,63 +97,139 @@ function start(config = {}) {
 }
 
 /**
- * Boot xeplr-auth as a fully independent service.
- * Resolves DB config, runs migrations/seeds, and starts the server.
+ * Boot xeplr-auth as a fully independent service. ENV-DRIVEN — no config; there
+ * is always one auth system, so it reads everything from AUTH_* env. Resolves the
+ * connection, self-migrates, configures email/jwt/activation, starts the server.
  *
- * @param {object} config
- * @param {number|string} config.port - Port to listen on (default: AUTH_PORT env or 19001)
- * @param {string} config.database - Database name for auth tables
- * @param {string} [config.connectionName] - Named connection identifier (default: 'auth')
- * @param {object} [config.db] - DB connection options { host, user, password, port }
- * @param {object} [config.jwt] - JWT options { secret, accessTokenExpiresIn }
- * @param {object} [config.email] - Email config { provider, smtp, aws, azure, brevo }
- * @param {string} [config.resetBaseUrl] - Base URL for reset links
- * @param {string} [config.migrationsDir] - Additional project-specific migrations directory
- * @param {string} [config.seedsDir] - Additional project-specific seeds directory
- * @param {object} [config.corsOptions] - CORS options
- * @param {Function[]} [config.middleware] - Additional middleware
  * @returns {Promise<http.Server>}
  */
-async function boot(config = {}) {
-  var connName = config.connectionName || 'auth';
-  var database = config.database || process.env.DB_AUTH || 'auth';
-  var authPkgDir = path.join(__dirname);
-
-  await resolveConfig(connName);
-
-  // Run migrations
-  var migrationResult = await migrator.up({
+// Boot the auth service. ENV-DRIVEN, no config — there is always a single auth
+// system, so it reads its whole setup from AUTH_* env (see requiredEnv + README):
+//   connection AUTH_DB_CONNECTION_INFO_ENCRYPTED · db AUTH_DB_NAME · AUTH_JWT_SECRET
+//   AUTH_PORT · AUTH_ACTIVATION_BASE_URL · AUTH_ACCESS_TOKEN_TTL_MINUTES
+//   AUTH_EXT_MIGRATIONS_DIR · email vars · REDIS_*
+async function boot() {
+  var connName = 'auth';
+  var database = process.env.AUTH_DB_NAME || 'auth';
+
+  await resolveConfig(connName, process.env.AUTH_DB_CONNECTION_INFO_ENCRYPTED);
+
+  // Self-migrate: auth's own .sql migrations (schema + base data), then the
+  // app's extension dir. Idempotent — same as `xeplr-auth-migrate up`.
+  var migrationResult = await sqlMigrator.up({
     db: database,
-    dir: path.join(authPkgDir, 'migrations'),
-    extDir: config.migrationsDir || null,
+    dir: path.join(__dirname, 'migrations'),
+    extDir: process.env.AUTH_EXT_MIGRATIONS_DIR || null,
     type: 'precede',
     connectionName: connName
   });
+  console.log(migrationResult.migrations.length
+    ? '[xeplr-auth] ran ' + migrationResult.migrations.length + ' migrations'
+    : '[xeplr-auth] migrations up to date');
+
+  // Configure email (via @xeplr/utils, the engine auth uses) + activation links.
+  require('@xeplr/utils').configureFromEnv();
+  if (process.env.AUTH_ACTIVATION_BASE_URL) authService.configureActivation(process.env.AUTH_ACTIVATION_BASE_URL);
+
+  var server = await start({
+    database: database,
+    connectionName: connName,
+    connection: process.env.AUTH_DB_CONNECTION_INFO_ENCRYPTED,
+    port: process.env.AUTH_PORT,
+    jwt: {
+      secret: process.env.AUTH_JWT_SECRET,
+      accessTokenExpiresIn: (process.env.AUTH_ACCESS_TOKEN_TTL_MINUTES || '15') + 'm'
+    }
+  });
 
-  if (migrationResult.migrations.length > 0) {
-    console.log('[xeplr-auth] ran ' + migrationResult.migrations.length + ' migrations');
-  } else {
-    console.log('[xeplr-auth] migrations up to date');
-  }
+  banner();
+  return server;
+}
 
-  // Run seeds (auth's own seeds always run, project seeds if provided)
-  var seedResult = await migrator.seed({
-    db: database,
-    seedsDir: path.join(authPkgDir, 'seeds'),
-    extSeedsDir: config.seedsDir || null,
-    type: 'precede',
-    connectionName: connName
-  });
+// Startup summary — the EFFECTIVE config (defaults resolved) so you can see what
+// the service is actually running with. Secrets are masked, never printed.
+function banner() {
+  var set = function (v) { return v ? '✓ set' : '✗ MISSING'; };
+  var rows = [
+    ['port',               process.env.AUTH_PORT || '19001'],
+    ['database',           process.env.AUTH_DB_NAME || 'auth'],
+    ['ext migrations',     process.env.AUTH_EXT_MIGRATIONS_DIR || '(none)'],
+    ['activation url',     process.env.AUTH_ACTIVATION_BASE_URL || '(none)'],
+    ['access token ttl',   (process.env.AUTH_ACCESS_TOKEN_TTL_MINUTES || '15') + 'm'],
+    ['refresh token ttl',  (process.env.AUTH_REFRESH_TOKEN_TTL_DAYS || '7') + 'd'],
+    ['slide tolerance',    (process.env.AUTH_ACCESS_TOKEN_TOLERANCE_SECONDS || '0') + 's'],
+    ['max sessions/user',  process.env.AUTH_MAX_SESSIONS_PER_USER || '5'],
+    ['redis',              (process.env.REDIS_HOST || 'localhost') + ':' + (process.env.REDIS_PORT || '6379')],
+    ['email',              process.env.EMAIL_PROVIDER || '(not configured)'],
+    ['connection',         set(process.env.AUTH_DB_CONNECTION_INFO_ENCRYPTED)],
+    ['encryption key',     set(process.env.ENCRYPTION_KEY)],
+    ['jwt secret',         process.env.AUTH_JWT_SECRET ? '✓ set' : '✗ INSECURE DEFAULT']
+  ];
+  var lines = rows.map(function (r) { return r[0].padEnd(19) + String(r[1]); });
+  var title = 'xeplr-auth · running';
+  var inner = Math.max.apply(null, [title.length].concat(lines.map(function (l) { return l.length; }))) + 2;
+  var bar = '─'.repeat(inner);
+  console.log('\n┌' + bar + '┐');
+  console.log('│ ' + title.padEnd(inner - 1) + '│');
+  console.log('├' + bar + '┤');
+  lines.forEach(function (l) { console.log('│ ' + l.padEnd(inner - 1) + '│'); });
+  console.log('└' + bar + '┘\n');
+}
 
-  if (seedResult.length > 0) {
-    console.log('[xeplr-auth] ran ' + seedResult.length + ' seeds');
+/**
+ * Attach to the auth database from ANOTHER process (e.g. the api service), so it
+ * can act on auth tables — invite users, assign roles. ENV-DRIVEN
+ * (AUTH_DB_NAME + AUTH_DB_CONNECTION_INFO_ENCRYPTED). Opens a SECONDARY connection
+ * (bind:false, so it never hijacks the api's global model binding) and hands back
+ * model/service accessors.
+ *
+ *   const auth = require('@xeplr/auth').attach();
+ *   await auth.ready();
+ *   await auth.model('User').query()...      // auth-package model bound to the auth DB
+ *   auth.service.invite(...)                  // authService
+ *
+ * @returns {{ ready: () => Promise, conn: () => Knex, model: (name:string) => Model, service: object }}
+ */
+function attach() {
+  var _conn = null;
+  var _ready = (async function () {
+    _conn = await getConnection(
+      process.env.AUTH_DB_NAME || 'auth',
+      process.env.AUTH_DB_CONNECTION_INFO_ENCRYPTED,
+      { bind: false, connectionName: 'auth' }
+    );
+    if (process.env.AUTH_ACTIVATION_BASE_URL) authService.configureActivation(process.env.AUTH_ACTIVATION_BASE_URL);
+    return _conn;
+  })();
+
+  function conn() {
+    if (!_conn) throw new Error('auth.attach(): connection not ready — await ready() first');
+    return _conn;
   }
-
-  return start(Object.assign({ database, connectionName: connName }, config));
+  function model(name) {
+    var M = models[name];
+    if (!M) throw new Error('auth.attach(): unknown auth model "' + name + '"');
+    return M.bindKnex(conn());
+  }
+  return { ready: function () { return _ready; }, conn: conn, model: model, service: authService };
 }
 
+// Env vars this library needs — apps spread this into their env.required.js so
+// the names live here (change once, every app picks it up), not re-listed per app.
+var requiredEnv = [
+  'ENCRYPTION_KEY',
+  'AUTH_JWT_SECRET',
+  'AUTH_ACTIVATION_BASE_URL',
+  'AUTH_PORT',
+  'AUTH_DB_NAME',                        // auth db (api reaches it via attach())
+  'AUTH_DB_CONNECTION_INFO_ENCRYPTED',   // auth DB login (for attach())
+  'AUTH_EXT_MIGRATIONS_DIR',             // migrations run via migrate:up
+];
+
 module.exports = {
+  requiredEnv,
   init,
+  attach,
   router,
   adminRouter,
   start,
@@ -157,9 +237,13 @@ module.exports = {
   authMiddleware,
   accessMiddleware,
   requireRole,
+  mtMembershipMiddleware,
   authHelper,
+  seedSuperAdmin,
   authService,
   accessService,
   sessionService,
+  ticketService,
+  hooks,
   models
 };

package/lib/adminRouter.js

@@ -1,6 +1,8 @@
 var express = require('express');
 var { generateId } = require('./authHelper');
 var { clearUserAccess, clearAccessRules } = require('./accessService');
+var authMiddleware = require('./authMiddleware');
+var hooks = require('./hooks');
 var User = require('../models/User');
 var Role = require('../models/Role');
 var Api = require('../models/Api');
@@ -12,8 +14,6 @@ var ApisRolesMapping = require('../models/ApisRolesMapping');
 var UiPagesRolesMapping = require('../models/UiPagesRolesMapping');
 var UiElementsRolesMapping = require('../models/UiElementsRolesMapping');
 var MenuRolesMapping = require('../models/MenuRolesMapping');
-var Tenant = require('../models/Tenant');
-var UserTenantsMapping = require('../models/UserTenantsMapping');
 
 // Group field names per type
 var GROUP_FIELDS = {
@@ -33,12 +33,15 @@ function isModuleGroup(group) {
 function createAdminRouter() {
   var router = express.Router();
 
+  // Every admin route requires a valid JWT — populates req.user (with roles).
+  router.use(authMiddleware);
+
   // ─── Users with their roles ───
   router.get('/users', async function(req, res) {
     try {
       var users = await User.query()
         .select('id', 'email', 'name', 'isActive', 'isActivated')
-        .withGraphFetched('[roles, tenants]');
+        .withGraphFetched('roles');
       res.json(users);
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -97,6 +100,7 @@ function createAdminRouter() {
       }
 
       await clearUserAccess(userId);
+      await hooks.fire('userRolesMapping', assign ? 'create' : 'delete', userId);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -143,6 +147,7 @@ function createAdminRouter() {
       }
 
       await clearAccessRules();
+      await hooks.fire(type + 'RolesMapping', assign ? 'create' : 'delete', itemId);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -162,10 +167,10 @@ function createAdminRouter() {
       var createdBy = req.user ? req.user.id : null;
 
       var types = [
-        { Model: Api, MappingModel: ApisRolesMapping, fk: 'apiId', groupField: 'apiGroup' },
-        { Model: UiPage, MappingModel: UiPagesRolesMapping, fk: 'uiPageId', groupField: 'uiPagesGroup' },
-        { Model: UiElement, MappingModel: UiElementsRolesMapping, fk: 'uiElementId', groupField: 'uiElementsGroup' },
-        { Model: Menu, MappingModel: MenuRolesMapping, fk: 'menuId', groupField: 'menuGroup' }
+        { type: 'apis', Model: Api, MappingModel: ApisRolesMapping, fk: 'apiId', groupField: 'apiGroup' },
+        { type: 'pages', Model: UiPage, MappingModel: UiPagesRolesMapping, fk: 'uiPageId', groupField: 'uiPagesGroup' },
+        { type: 'elements', Model: UiElement, MappingModel: UiElementsRolesMapping, fk: 'uiElementId', groupField: 'uiElementsGroup' },
+        { type: 'menus', Model: Menu, MappingModel: MenuRolesMapping, fk: 'menuId', groupField: 'menuGroup' }
       ];
 
       var promises = types.map(async function(cfg) {
@@ -187,6 +192,8 @@ function createAdminRouter() {
           } else {
             await cfg.MappingModel.query().delete().where(itemWhere);
           }
+
+          await hooks.fire(cfg.type + 'RolesMapping', assign ? 'create' : 'delete', items[i].id);
         }
       });
 
@@ -215,10 +222,12 @@ function createAdminRouter() {
 
       if (id) {
         await Role.query().findById(id).patch({ name: name });
+        await hooks.fire('roles', 'update', id);
         res.json({ id: id });
       } else {
         var newId = generateId();
         await Role.query().insert({ id: newId, name: name });
+        await hooks.fire('roles', 'create', newId);
         res.json({ id: newId });
       }
     } catch (err) {
@@ -232,6 +241,7 @@ function createAdminRouter() {
       if (!id) return res.status(400).json({ error: 'id is required' });
       await Role.query().deleteById(id);
       await clearAccessRules();
+      await hooks.fire('roles', 'delete', id);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -271,11 +281,13 @@ function createAdminRouter() {
 
         if (id) {
           await cfg.Model.query().findById(id).patch(data);
+          await hooks.fire(typeKey, 'update', id);
           res.json({ id: id });
         } else {
           var newId = generateId();
           data.id = newId;
           await cfg.Model.query().insert(data);
+          await hooks.fire(typeKey, 'create', newId);
           res.json({ id: newId });
         }
       } catch (err) {
@@ -289,6 +301,7 @@ function createAdminRouter() {
         if (!id) return res.status(400).json({ error: 'id is required' });
         await cfg.Model.query().deleteById(id);
         await clearAccessRules();
+        await hooks.fire(typeKey, 'delete', id);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: 'Something went wrong' });
@@ -296,91 +309,6 @@ function createAdminRouter() {
     });
   });
 
-  // ─── Tenants (Super Admin only) ───
-
-  function requireSuperAdmin(req, res, next) {
-    if (!req.user || !req.user.roles || req.user.roles.indexOf('Super Admin') === -1) {
-      return res.status(403).json({ error: 'Super Admin access required' });
-    }
-    next();
-  }
-
-  router.get('/tenants', requireSuperAdmin, async function(req, res) {
-    try {
-      var level = req.query.level ? parseInt(req.query.level) : null;
-      var query = Tenant.query().select('id', 'name', 'code', 'level', 'parentId', 'description');
-      if (level) query = query.where('level', level);
-      var tenants = await query;
-      res.json(tenants);
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  router.post('/tenants', requireSuperAdmin, async function(req, res) {
-    try {
-      var { id, name, code, level, parentId, description } = req.body;
-      if (!name) return res.status(400).json({ error: 'name is required' });
-
-      var data = { name: name };
-      if (code !== undefined) data.code = code;
-      if (level !== undefined) data.level = level;
-      if (parentId !== undefined) data.parentId = parentId;
-      if (description !== undefined) data.description = description;
-
-      if (id) {
-        await Tenant.query().findById(id).patch(data);
-        res.json({ id: id });
-      } else {
-        var newId = generateId();
-        data.id = newId;
-        await Tenant.query().insert(data);
-        res.json({ id: newId });
-      }
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  router.post('/tenants/delete', requireSuperAdmin, async function(req, res) {
-    try {
-      var { id } = req.body;
-      if (!id) return res.status(400).json({ error: 'id is required' });
-      await Tenant.query().findById(id).patch({ isActive: false });
-      res.json({ ok: true });
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  // Assign/unassign tenant to a user (via mapping table)
-  // Access controlled via Access Matrix (tenants:edit group), not hardcoded to Super Admin
-  router.post('/tenants/assign-user', async function(req, res) {
-    try {
-      var { userId, tenantId, assign } = req.body;
-      if (!userId || !tenantId) return res.status(400).json({ error: 'userId and tenantId are required' });
-
-      if (assign === false) {
-        await UserTenantsMapping.query().delete().where({ userId: userId, tenantId: tenantId });
-      } else {
-        var existing = await UserTenantsMapping.query().findOne({ userId: userId, tenantId: tenantId });
-        if (!existing) {
-          await UserTenantsMapping.query().insert({
-            id: generateId(),
-            userId: userId,
-            tenantId: tenantId,
-            recordCreatedBy: req.user ? req.user.id : null
-          });
-        }
-      }
-
-      await clearUserAccess(userId);
-      res.json({ ok: true });
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
   return router;
 }
 

package/lib/authHelper.js

@@ -16,7 +16,7 @@ function configure(config) {
 }
 
 function getSecret() {
-  return _config.jwtSecret || process.env.JWT_SECRET || 'change_me_in_production';
+  return _config.jwtSecret || process.env.AUTH_JWT_SECRET || 'change_me_in_production';
 }
 
 function generateId() {
@@ -35,10 +35,13 @@ async function comparePassword(password, hash) {
 }
 
 function generateAccessToken(user) {
+  // Caller is responsible for providing `roles` as an array of role names
+  // (see authService.login → withGraphFetched('roles'))
   const payload = {
     id: user.id,
     email: user.email,
-    name: user.name
+    name: user.name,
+    roles: Array.isArray(user.roles) ? user.roles : []
   };
   const expiresIn = _config.accessTokenExpiresIn || '15m';
   return jwt.sign(payload, getSecret(), { expiresIn });
@@ -52,6 +55,24 @@ function verifyToken(token) {
   return jwt.verify(token, getSecret());
 }
 
+// Verify the SIGNATURE but ignore expiry — the middleware decides on expiry
+// itself (so it can apply the tolerance window). Returns { decoded, signatureValid }.
+function decodeVerified(token) {
+  try {
+    return { decoded: jwt.verify(token, getSecret(), { ignoreExpiration: true }), signatureValid: true };
+  } catch (err) {
+    return { decoded: null, signatureValid: false };
+  }
+}
+
+// Grace window (seconds) during which an expired access token is still honored
+// and slid to a fresh one. 0 = strict (reject on expiry) = default / back-compat.
+function getToleranceSeconds() {
+  var t = _config.accessTokenToleranceSeconds;
+  if (t === undefined || t === null) t = parseInt(process.env.AUTH_ACCESS_TOKEN_TOLERANCE_SECONDS || '0', 10);
+  return (Number.isFinite(t) && t > 0) ? t : 0;
+}
+
 module.exports = {
   configure,
   generateId,
@@ -59,5 +80,7 @@ module.exports = {
   comparePassword,
   generateAccessToken,
   generateRefreshToken,
-  verifyToken
+  verifyToken,
+  decodeVerified,
+  getToleranceSeconds
 };