arkos 2.0.0-next.3 → 2.0.0-next.30

package/dist/types/exports/services/index.d.ts

@@ -2,9 +2,9 @@ import { getFileUploadServices, FileUploadService } from "../../modules/file-upl
 import { EmailOptions } from "../../modules/email/email.service";
 import authService, { AuthService } from "../../modules/auth/auth.service";
 import emailService, { EmailService } from "../../modules/email/email.service";
-import { BaseService } from "../../modules/base/base.service";
+import { ArkosPrismaService } from "../../modules/base/base.service";
 import authActionService from "../../modules/auth/utils/services/auth-action.service";
-import { ServiceHookContext, BeforeCreateOneHookArgs, AfterCreateOneHookArgs, BeforeCreateManyHookArgs, AfterCreateManyHookArgs, BeforeCountHookArgs, AfterCountHookArgs, BeforeFindManyHookArgs, AfterFindManyHookArgs, BeforeFindOneHookArgs, AfterFindOneHookArgs, BeforeUpdateOneHookArgs, AfterUpdateOneHookArgs, BeforeUpdateManyHookArgs, AfterUpdateManyHookArgs, BeforeDeleteOneHookArgs, AfterDeleteOneHookArgs, BeforeDeleteManyHookArgs, AfterDeleteManyHookArgs, OnCreateOneErrorHookArgs, OnCreateManyErrorHookArgs, OnCountErrorHookArgs, OnFindManyErrorHookArgs, OnFindByIdErrorHookArgs, OnFindOneErrorHookArgs, OnUpdateOneErrorHookArgs, OnUpdateManyErrorHookArgs, OnDeleteOneErrorHookArgs, OnDeleteManyErrorHookArgs } from "../../components/arkos-service-hook/types";
+import { ServiceHookContext } from "../../modules/base/types/base.service.types";
 /**
  * Authentication service.
  */
@@ -12,7 +12,7 @@ export { authService, AuthService, authActionService };
 /**
  * Base service.
  */
-export { BaseService, ServiceHookContext, BeforeCreateOneHookArgs, AfterCreateOneHookArgs, BeforeCreateManyHookArgs, AfterCreateManyHookArgs, BeforeCountHookArgs, AfterCountHookArgs, BeforeFindManyHookArgs, AfterFindManyHookArgs, BeforeFindOneHookArgs, AfterFindOneHookArgs, BeforeUpdateOneHookArgs, AfterUpdateOneHookArgs, BeforeUpdateManyHookArgs, AfterUpdateManyHookArgs, BeforeDeleteOneHookArgs, AfterDeleteOneHookArgs, BeforeDeleteManyHookArgs, AfterDeleteManyHookArgs, OnCreateOneErrorHookArgs, OnCreateManyErrorHookArgs, OnCountErrorHookArgs, OnFindManyErrorHookArgs, OnFindByIdErrorHookArgs, OnFindOneErrorHookArgs, OnUpdateOneErrorHookArgs, OnUpdateManyErrorHookArgs, OnDeleteOneErrorHookArgs, OnDeleteManyErrorHookArgs, };
+export { ArkosPrismaService, ServiceHookContext, };
 /**
  * Email service.
  */

package/dist/types/exports/websockets.d.ts

@@ -0,0 +1,5 @@
+import ArkosGateway from "../components/arkos-gateway/arkos-gateway";
+export { IArkosGateway } from "../components/arkos-gateway/arkos-gateway";
+export { ArkosGatewayController } from "../components/arkos-gateway/types";
+export type { ArkosSocket, ArkosGatewayConfig, ArkosGatewayEventConfig, ArkosGatewayHandler, ArkosGatewayPipe, ArkosGatewayMiddleware, ArkosGatewayConnectionHandler, ArkosGatewayErrorHandler, ArkosGatewayAckFn, ArkosBroadcastOperator, } from "../components/arkos-gateway/types";
+export { ArkosGateway };

package/dist/types/modules/auth/auth.controller.d.ts

@@ -8,8 +8,12 @@ export declare const defaultExcludedUserFields: {
  * Authentication controller class handling all auth-related operations
  */
 export declare class AuthController {
-    private userService?;
-    private getUserService;
+    /**
+     * Resolves the `AuthService` to use, an instance passed as `service` through
+     * `ArkosRouteHook("auth", { service })` takes precedence over the default one.
+     */
+    private getAuthService;
+    private callService;
     /**
      * Retrieves the current authenticated user's information
      */
@@ -24,6 +28,9 @@ export declare class AuthController {
     logout: any;
     /**
      * Authenticates a user using configurable username field and password
+     * Username field can be specified in query parameter or config
+     *
+     * Supports nested fields and array queries (e.g., "profile.nickname", "phones.some.number")
      */
     login: any;
     /**
@@ -31,7 +38,7 @@ export declare class AuthController {
      */
     signup: any;
     /**
-     * Marks user account as self-deleted
+     * Marks user account as self-deleted by setting deletedSelfAccountAt timestamp
      */
     deleteMe: any;
     /**

package/dist/types/modules/auth/auth.service.d.ts

@@ -1,7 +1,11 @@
-import { User } from "../../types";
-import { ArkosRequest, ArkosRequestHandler } from "../../types";
-import { AuthJwtPayload, AccessAction, AccessControlConfig, AuthenticationControlConfig } from "../../types/auth";
-import { MsDuration } from "./utils/helpers/auth.controller.helpers";
+import { User } from '../../types';
+import { ArkosRequest, ArkosRequestHandler } from '../../types';
+import { AuthJwtPayload, AccessAction, AccessControlConfig, DetailedAccessControlRule } from '../../types/auth';
+import { MsDuration } from './utils/helpers/auth.controller.helpers';
+import { ArkosPrismaService } from '../base/base.service';
+import { AuthUser, DeleteMeOptions, GetMeOptions, LoginInput, LoginOptions, SignupDto, SignupOptions, UpdateMeDto, UpdateMeOptions, UpdatePasswordInput } from './auth.types';
+import { CookieOptions } from 'express';
+import { ArkosSocket } from '../../components/arkos-gateway/types';
 /**
  * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.
  */
@@ -10,6 +14,8 @@ export declare class AuthService {
      * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint
      */
     actionsPerResource: Record<string, Set<string>>;
+    private _userService?;
+    protected get userService(): ArkosPrismaService<'user'>;
     /**
      * Signs a JWT token for the user.
      *
@@ -37,18 +43,13 @@ export declare class AuthService {
      * res.cookie('jwt', token, cookieOptions);
      * ```
      */
-    getJwtCookieOptions(req: ArkosRequest): {
-        expires: Date;
-        httpOnly: boolean;
-        secure: boolean;
-        sameSite: "none" | "strict" | "lax";
-    };
+    getJwtCookieOptions(req: ArkosRequest): CookieOptions;
     /**
-     * Is used by default internally by Arkos under `BaseService` class to check if the password is already hashed.
+     * Is used by default internally by Arkos under `ArkosPrismaService` class to check if the password is already hashed.
      *
-     * This was just added to prevent unwanted errors when someone just forgets that the `BaseService` class will automatically hash the password field using `authService.hashPassword` by default.
+     * This was just added to prevent unwanted errors when someone just forgets that the `ArkosPrismaService` class will automatically hash the password field using `authService.hashPassword` by default.
      *
-     * So now before `BaseService` hashes it will test it.
+     * So now before `ArkosPrismaService` hashes it will test it.
      *
      *
      * @param password The password to be tested if is hashed
@@ -70,24 +71,6 @@ export declare class AuthService {
      * @returns {Promise<string>} Returns the hashed password.
      */
     hashPassword(password: string): Promise<string>;
-    /**
-     * Checks if a password is strong, requiring uppercase, lowercase, and numeric characters as the default.
-     *
-     * **NB**: You must pay attention when using custom validation with zod or class-validator, try to use the same regex always.
-     *
-     * **Note**: You can define it when calling arkos.init()
-     * ```ts
-     * arkos.init({
-     *  authentication: {
-     *    passwordValidation:{ regex: /your-desired-regex/, message: 'password must contain...'}
-     *  }
-     * })
-     * ```
-     *
-     * @param {string} password - The password to check.
-     * @returns {boolean} Returns true if the password meets the strength criteria, otherwise false.
-     */
-    isPasswordStrong(password: string): boolean;
     /**
      * Checks if a user has changed their password after the JWT was issued.
      *
@@ -120,7 +103,7 @@ export declare class AuthService {
      * @returns True if user has permission, false otherwise
      * @throws Error if user doesn't have role/roles field
      */
-    protected checkStaticAccessControl(user: User, action: string, accessControl: AccessControlConfig): boolean;
+    checkStaticAccessControl(user: User, action: string, accessControl: AccessControlConfig): boolean;
     /**
      * Checks if a user has permission for a specific action and resource using dynamic access control.
      * Queries the database to verify user's role permissions.
@@ -130,40 +113,176 @@ export declare class AuthService {
      * @param resource - The resource being accessed
      * @returns Promise resolving to true if user has permission, false otherwise
      */
-    protected checkDynamicAccessControl(userId: string, action: string, resource: string): Promise<boolean>;
+    checkDynamicAccessControl(userId: string, action: string, resource: string): Promise<boolean>;
+    private sanitizeUser;
+    private withPasswordIncluded;
+    /**
+     * Retrieves the authenticated user by id without the password field.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
+     *
+     * @param userId - The id of the authenticated user
+     * @param queryOptions - Optional Prisma query options (select, include, etc.)
+     * @since 1.8.0-rc
+     */
+    getMe(userId: User["id"], queryOptions?: GetMeOptions): Promise<AuthUser | null>;
+    /**
+     * Updates the authenticated user without the password field in the result.
+     * Password changes are rejected, use `updatePassword` instead.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
+     *
+     * @param userId - The id of the authenticated user
+     * @param data - The fields to update
+     * @param queryOptions - Optional Prisma query options (select, include, etc.)
+     * @since 1.8.0-rc
+     */
+    updateMe(userId: User["id"], data: UpdateMeDto, queryOptions?: UpdateMeOptions): Promise<AuthUser>;
     /**
-     * Middleware function to handle access control based on user roles and permissions.
+     * Creates a new user account without the password field in the result.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
+     *
+     * @param data - The user data, the password is hashed automatically
+     * @param queryOptions - Optional Prisma query options (select, include, etc.)
+     * @since 1.8.0-rc
+     */
+    signup(data: SignupDto, queryOptions?: SignupOptions): Promise<AuthUser>;
+    /**
+     * Marks the authenticated user's account as self-deleted by setting
+     * `deletedSelfAccountAt`, the result never includes the password field.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
+     *
+     * @param userId - The id of the authenticated user
+     * @param queryOptions - Optional Prisma query options (select, include, etc.)
+     * @since 1.8.0-rc
+     */
+    deleteMe(userId: User["id"], queryOptions?: DeleteMeOptions): Promise<AuthUser>;
+    /**
+     * Authenticates a user with the given username field and password.
+     *
+     * The username field is inferred from the username key present in `input`
+     * (the only key besides `password`), can be overridden explicitly with
+     * `usernameField` for nested paths such as `"profile.nickname"`, and falls
+     * back to `authentication.login.allowedUsernames[0] || "username"`. When
+     * `authentication.login.allowedUsernames` is configured, the resolved field
+     * must be one of its entries. The password is always loaded for the
+     * comparison and never returned.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
+     *
+     * @param input - Its username key and the password
+     * @param queryOptions - Optional Prisma query options (select, include, etc.)
+     * @returns The sanitized user and a signed access token
+     * @since 1.8.0-rc
+     */
+    login(input: LoginInput, queryOptions?: LoginOptions): Promise<{
+        user: AuthUser;
+        accessToken: string;
+    }>;
+    /**
+     * Updates the password of the given user after validating the current one.
+     *
+     * Can be overridden through `ArkosRouteHook("auth", { service })`.
      *
-     * @param {AccessAction} action - The action being performed (e.g., create, update, delete, view).
-     * @param {string} resource - The resource name that the action is being performed on (e.g., "User", "Post").
-     * @param {AccessControlConfig} accessControl - The access control configuration.
-     * @returns {ArkosRequestHandler} The middleware function that checks if the user has permission to perform the action.
+     * @param userId - The id of the authenticated user
+     * @param input - The current and the new password
+     * @returns A fresh access token valid after the password change
+     * @since 1.8.0-rc
      */
-    handleAccessControl(action: AccessAction, resource: string, accessControl?: AccessControlConfig): ArkosRequestHandler;
+    updatePassword(userId: User["id"], input: UpdatePasswordInput): Promise<{
+        accessToken: string;
+    }>;
+    /**
+     * Runs on logout. Override through `ArkosRouteHook("auth", { service })`.
+     *
+     * @since 1.8.0-rc
+     */
+    logout(_userId: User["id"], _accessToken: string): Promise<void>;
+    private extractRequestToken;
+    private extractSocketToken;
+    validateDecodedUser(decoded: AuthJwtPayload, action?: 'logout' | 'default'): Promise<User>;
     /**
      * Processes the cookies or authoriation token and returns the user.
-     * @param req
+     *
+     * @param ctx | socket
      * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null
      * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.
      */
-    getAuthenticatedUser(req: ArkosRequest): Promise<User | null>;
+    getAuthenticatedUser(ctx: ArkosRequest | ArkosSocket, action?: 'logout' | 'default'): Promise<User | null>;
     /**
-     * Middleware function to authenticate the user based on the JWT token.
+     * Middleware to authenticate the request by extracting and verifying the JWT token and setting `req.user`.
+     *
+     * Runs `authentication.hooks.authenticate` before/after the authentication logic.
+     *
+     * Hook execution flow:
+     * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,
+     *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.
+     * - Core logic runs — extracts and verifies the JWT token, sets `req.user`.
+     * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.
+     * - `onError` hooks run if core logic throws — call `ctx.skip()` to suppress the error and jump to
+     *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.
+     *
+     * On custom routes, hooks defined in `arkosConfig` still apply since they are baked into this method.
+     *
+     * @example
+     * ```ts
+     * // custom route - hooks still run
+     * router.get("/custom", authService.authenticate, handler);
+     * ```
+     *
+     * @example
+     * ```ts
+     * // skip built-in auth from a before hook
+     * before: (ctx) => {
+     *   ctx.req.user = myCustomAuth(ctx.req);
+     *   ctx.skip();
+     * }
+     * ```
      *
-     * @param {ArkosRequest} req - The request object.
-     * @param {ArkosResponse} res - The response object.
-     * @param {ArkosNextFunction} next - The next middleware function to be called.
-     * @returns {void}
+     * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks}
      */
     authenticate: any;
     /**
-     * Handles authentication control by checking the `authenticationControl` configuration in the `authConfigs`.
+     * Middleware to authorize the authenticated user for a given action on a resource.
+     *
+     * Runs `authentication.hooks.authorize` before/after the authorization logic.
+     *
+     * Hook execution flow:
+     * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,
+     *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.
+     * - Core logic runs — checks user role/permissions against the access control rules.
+     * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.
+     * - `onError` hooks run if authorization fails — call `ctx.skip()` to suppress the error and jump to
+     *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.
+     *
+     * @param resource - The resource being accessed, in kebabCase (e.g. `"product"`, `"cart-item"`)
+     * @param action - The action being performed (e.g. `"View"`, `"Create"`, `"Delete"`)
+     * @param rule - Access control rules for this action. Accepts a role list, a wildcard, or a `DetailedAccessControlRule`.
+     *
+     * @example
+     * ```ts
+     * router.delete("/products/:id",
+     *   authService.authenticate,
+     *   authService.authorize("product", "Delete", ["admin"]),
+     *   handler
+     * );
+     * ```
+     *
+     * @example
+     * ```ts
+     * // skip built-in authorization from a before hook
+     * before: (ctx) => {
+     *   ctx.req.user.role = myCustomRoleResolver(ctx.req);
+     *   ctx.skip();
+     * }
+     * ```
      *
-     * @param {ControllerActions} action - The action being performed (e.g., create, update, delete, view).
-     * @param {AuthenticationControlConfig} authenticationControl - The authentication configuration object.
-     * @returns {ArkosRequestHandler} The middleware function that checks if authentication is required.
+     * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks#authorize}
+     * @since v1.6.0-beta
      */
-    handleAuthenticationControl(action: AccessAction, authenticationControl?: AuthenticationControlConfig | undefined): ArkosRequestHandler;
+    authorize(action: AccessAction, resource: string, rule?: string[] | DetailedAccessControlRule | '*'): ArkosRequestHandler;
     /**
      * Creates a permission checker function for a specific action and resource.
      *

package/dist/types/modules/auth/auth.types.d.ts

@@ -0,0 +1,72 @@
+import { ExtractPrismaData, ExtractPrismaQueryOptions, PrismaModels, RuntimeArkosConfig } from "../../generated";
+import { ArkosPrismaInput } from "../../types/arkos-prisma-input";
+import { User } from "../../types";
+type UserModel = PrismaModels<any>["user"];
+export type AuthUser = Omit<User, "password">;
+export type GetMeOptions = ExtractPrismaQueryOptions<UserModel["FindFirstArgs"], "where">;
+export type LoginOptions = GetMeOptions;
+export type UpdateMeOptions = ExtractPrismaQueryOptions<UserModel["UpdateArgs"], "where" | "data">;
+export type DeleteMeOptions = UpdateMeOptions;
+export type SignupOptions = ExtractPrismaQueryOptions<UserModel["CreateArgs"], "data">;
+export type SignupDto = ExtractPrismaData<UserModel["CreateArgs"]> | ArkosPrismaInput<ExtractPrismaData<UserModel["CreateArgs"]>>;
+export type UpdateMeDto = ExtractPrismaData<UserModel["UpdateArgs"]> | ArkosPrismaInput<ExtractPrismaData<UserModel["UpdateArgs"]>>;
+export type OverridableAuthMethod = "getMe" | "updateMe" | "signup" | "deleteMe" | "login" | "updatePassword" | "logout";
+export interface UpdatePasswordInput {
+    currentPassword: string;
+    newPassword: string;
+}
+type ListOperator = "some" | "every" | "none";
+type LastSegment<P extends string> = P extends `${string}.${infer R}` ? LastSegment<R> : P;
+type PathSelect<P extends string> = P extends `${infer H}.${infer T}` ? H extends ListOperator ? PathSelect<T> : {
+    [K in H]: {
+        select: PathSelect<T>;
+    };
+} : {
+    [K in P]: true;
+};
+type ElementOf<T> = T extends readonly (infer E)[] ? E : T;
+type PathValue<T, P extends string> = P extends `${infer H}.${infer R}` ? H extends ListOperator ? PathValue<T, R> : H extends keyof T ? PathValue<ElementOf<NonNullable<T[H]>>, R> : never : P extends keyof T ? T[P] : never;
+/**
+ * The username fields accepted by the built-in login, derived from
+ * `authentication.login.allowedUsernames` in the user's `arkos.config`.
+ *
+ * The generated `RuntimeArkosConfig` is a literal-typed view of the config;
+ * when `allowedUsernames` is not configured it falls back to the runtime
+ * default, `"username"` (see `getDefaultUsernameField`).
+ */
+export type LoginUsernames = RuntimeArkosConfig extends {
+    authentication: {
+        login: {
+            allowedUsernames: readonly (infer U extends string)[];
+        };
+    };
+} ? U : "username";
+/**
+ * The union of fields accepted as the login username.
+ *
+ * @deprecated Use `LoginUsernames`.
+ */
+export type LoginUsernameField = LoginUsernames;
+type LoginUsernameValue<F extends string> = NonNullable<PathValue<PrismaModels<{
+    select: PathSelect<F>;
+}>["user"]["GetPayload"], F>>;
+type LoginInputFor<F extends string> = {
+    password: string;
+} & (F extends `${string}.${string}` ? {
+    /** Required for nested paths so the full dot-path is queried. */
+    usernameField: F;
+} : {
+    /** Only needed for nested paths; otherwise inferred from the username key. */
+    usernameField?: F;
+}) & {
+    [K in LastSegment<F>]: LoginUsernameValue<F>;
+};
+type DistributiveLoginInput<F extends string> = F extends any ? LoginInputFor<F> : never;
+/**
+ * Login payload for the configured username fields. Every entry in
+ * `authentication.login.allowedUsernames` is accepted as an alternative, and the
+ * key holding the username is the last segment of the field path, typed from the
+ * Prisma schema.
+ */
+export type LoginInput = DistributiveLoginInput<LoginUsernames>;
+export {};

package/dist/types/modules/auth/utils/auth-hooks-manager.d.ts

@@ -0,0 +1,63 @@
+import { ArkosSocket } from "../../../components/arkos-gateway/types";
+import { ArkosRequest, User } from "../../../types";
+import { AuthAction } from "./services/auth-action.service";
+type ArkosBaseContext = ArkosRequest | ArkosSocket;
+interface ArkosMiddlewareAdapter<TContext extends ArkosBaseContext> {
+    context: TContext;
+    done: (error?: unknown | any) => void;
+}
+declare class AuthHookManager {
+    /**
+     * Runs the full authenticate pipeline — before hooks, core user resolution,
+     * after hooks — and calls `done` when finished.
+     *
+     * Shared by the HTTP authenticate middleware and the WebSocket auth ns.use().
+     *
+     * @param adapter.context - The request or socket being authenticated.
+     * @param adapter.done - Called with no args on success, or with an error to propagate.
+     * @param getUser - Async function that resolves the user from the context.
+     */
+    runAuthenticate<TContext extends ArkosBaseContext>(adapter: ArkosMiddlewareAdapter<TContext>, getUser: (context: TContext) => Promise<User | null>, keyName?: "user" | "currentUser"): Promise<void>;
+    /**
+     * Runs the full authorize pipeline — before hooks, core permission check,
+     * after hooks — and calls `done` when finished.
+     *
+     * Shared by the HTTP `authorize()` middleware and WebSocket per-event authorization.
+     *
+     * @param adapter.context - The request or socket being authorized.
+     * @param authAction {AuthAction}
+     * @param keyName {"user" | "currentUser"}
+     */
+    runAuthorize<TContext extends ArkosBaseContext>(adapter: ArkosMiddlewareAdapter<TContext>, authAction: Required<AuthAction>, keyName?: "user" | "currentUser"): Promise<void>;
+    /**
+     * Runs a chain of `after` hooks in sequence.
+     *
+     * - If a hook throws — chain aborts, error is forwarded to the global error handler.
+     * - If a hook returns — next hook in chain runs.
+     *
+     * @returns Promise resolving to `{ error? }`
+     */
+    private runAfterHooks;
+    /**
+     * Runs a chain of `before` hooks in sequence.
+     *
+     * - If a hook throws — chain aborts, error is forwarded to `onError` hooks.
+     * - If a hook calls `skip()` — chain stops, core logic is bypassed, jumps to `after` hooks.
+     * - If a hook returns — next hook in chain runs.
+     *
+     * @returns Promise resolving to `{ skipped, error? }`
+     */
+    private runHooks;
+    /**
+     * Runs a chain of `onError` hooks in sequence.
+     *
+     * - If a hook throws — chain aborts, error is forwarded to the global error handler.
+     * - If a hook calls `skip()` — suppresses the error and jumps to `after` hooks.
+     * - If a hook returns — next hook in chain runs.
+     *
+     * @returns Promise resolving to `{ skipped, error? }`
+     */
+    private runErrorHooks;
+}
+declare const authHookManager: AuthHookManager;
+export default authHookManager;

package/dist/types/modules/auth/utils/auth-openapi-generator.d.ts

@@ -0,0 +1,9 @@
+import { AuthRouterEndpoint } from "../../../types/router-config";
+import { ArkosRouteConfig } from "../../../exports";
+import { ExtendedOperationObject } from "../../../utils/arkos-router/types/openapi-config";
+declare class AuthOpenAPIGenerator {
+    getOpenApiConfig(endpointRouterConfig: Omit<ArkosRouteConfig, "path"> | undefined, endpoint: AuthRouterEndpoint): Partial<ExtendedOperationObject>;
+    private getAuthActionSchema;
+}
+declare const authOpenAPIGenerator: AuthOpenAPIGenerator;
+export default authOpenAPIGenerator;

package/dist/types/modules/auth/utils/auth-prisma-json-schema-generator.d.ts

@@ -0,0 +1,13 @@
+import { JsonSchema } from "../../../utils/prisma/types";
+declare class AuthPrismaJsonSchemaGenerator {
+    private userModel?;
+    private getUserModel;
+    private getPrismaArgs;
+    generateGetMeResponse(): JsonSchema;
+    generateUpdatePasswordSchema(): JsonSchema;
+    generateUpdateMeSchema(): JsonSchema;
+    generateSignupSchema(): JsonSchema;
+    generateLoginSchema(): JsonSchema;
+}
+declare const authPrismaJsonSchemaGenerator: AuthPrismaJsonSchemaGenerator;
+export default authPrismaJsonSchemaGenerator;

package/dist/types/modules/auth/utils/docs-links.d.ts

@@ -0,0 +1,3 @@
+export declare const authenticationDocsLinks: {
+    setup: string;
+};

package/dist/types/modules/auth/utils/helpers/auth.controller.helpers.d.ts

@@ -1,4 +1,5 @@
 import { ArkosRequest } from "../../../../types";
+export declare const getDefaultUsernameField: () => string;
 /**
  * Determines the username field to use for authentication and supports nested paths
  * Priority:

package/dist/types/modules/auth/utils/services/auth-action.service.d.ts

@@ -1,5 +1,5 @@
 import { AccessControlConfig } from "../../../../types/auth";
-interface AuthAction {
+export interface AuthAction {
     roles?: string[] | "*";
     action: string;
     resource: string;
@@ -9,7 +9,7 @@ interface AuthAction {
 }
 declare class AuthActionService {
     authActions: AuthAction[];
-    add(action: string, resource: string, accessControl?: AccessControlConfig): void;
+    add(action: string, resource: string, accessControl?: AccessControlConfig): Required<AuthAction>;
     remove(action: string, resource: string): void;
     getAll(): AuthAction[];
     getOne(action: string, resource: string): AuthAction | undefined;

package/dist/types/modules/auth/utils/token-extraction.d.ts

@@ -0,0 +1,53 @@
+export declare const ACCESS_TOKEN_COOKIE_NAME = "arkos_access_token";
+export declare const NO_TOKEN_SENTINEL = "no-token";
+export type CookieMap = Record<string, string>;
+/** Returns the trimmed token if it is non-empty, otherwise `null`. */
+export declare function normalizeToken(value: unknown): string | null;
+/**
+ * Reads a token from an already-parsed cookie map (e.g. Express's `req.cookies`).
+ * Arkos writes the `no-token` sentinel on logout, so it counts as absent.
+ */
+export declare function getCookieToken(cookies: Record<string, unknown> | undefined, cookieName?: string): string | null;
+/**
+ * Parses a raw `Cookie` header without requiring cookie-parser.
+ * Values may contain `=`; malformed pairs are skipped.
+ */
+export declare function parseCookieHeader(cookieHeader?: string | null): CookieMap;
+/**
+ * Extracts a bearer token from an `Authorization` header.
+ *
+ * The default mode is case-insensitive and tolerates a missing space after
+ * `Bearer`. Pass `{ caseInsensitive: false }` to preserve the legacy HTTP
+ * behavior exactly.
+ */
+export declare function extractBearerToken(authorization?: string | null, { caseInsensitive }?: {
+    caseInsensitive?: boolean;
+}): string | null;
+export interface RequestTokenSources {
+    authorization?: string;
+    cookies?: Record<string, unknown>;
+    cookieName?: string;
+}
+/**
+ * Resolves the token for an HTTP request-like object.
+ * Precedence: `Authorization` header, then the access-token cookie.
+ */
+export declare function resolveRequestToken({ authorization, cookies, cookieName, }: RequestTokenSources): string | null;
+export interface SocketTokenSources {
+    auth?: Record<string, unknown>;
+    key?: string;
+    headers?: {
+        authorization?: string;
+        cookie?: string;
+    };
+    /** Pre-parsed cookies, when available. */
+    cookies?: CookieMap;
+    /** Raw `Cookie` header, used when `cookies` is not provided. */
+    cookieHeader?: string;
+    cookieName?: string;
+}
+/**
+ * Resolves the token for a Socket.IO connection.
+ * Precedence: `handshake.auth.token`, `Authorization` header, access-token cookie.
+ */
+export declare function resolveSocketToken({ auth, key, headers, cookies, cookieHeader, cookieName, }: SocketTokenSources): string | null;

package/dist/types/modules/base/base.controller.d.ts

@@ -1,6 +1,6 @@
-import { ArkosRequest } from "../../types";
-import { BaseService } from "./base.service";
-import { PrismaModels } from "../../generated";
+import { ArkosRequest } from '../../types';
+import { ArkosPrismaService } from './base.service';
+import { PrismaModels } from '../../generated';
 export interface OperationHooks {
     beforeQuery?: (req: ArkosRequest) => void | Promise<void>;
     afterQuery?: (queryData: {
@@ -31,22 +31,23 @@ export interface OperationHooks {
  *
  * @param {string} modelName - The Prisma model name this controller handles.
  *
- * @see {@link https://www.arkosjs.com/docs/api-reference/the-base-controller-class}
+ * @see {@link https://www.arkosjs.com/docs/reference/base-controller}
  *--
  * **See about how Arkos handles routers**
- * @see {@link https://www.arkosjs.com/docs/guide/adding-custom-routers}
+ * @see {@link https://www.arkosjs.com/docs/core-concepts/routing/setup}
  */
 export declare class BaseController<TModuleName extends keyof PrismaModels<any>> {
     /**
      * Service instance to handle business logic operations
      * @public
      */
-    service: BaseService<TModuleName>;
+    service: ArkosPrismaService<TModuleName>;
     /**
      * Name of the model this controller handles
      * @private
      */
     private modelName;
+    private get hasCustomService();
     /**
      * Creates a new BaseController instance
      * @param {string} modelName - The name of the model for which this controller will handle operations

package/dist/types/modules/base/base.middlewares.d.ts

@@ -1,10 +1,6 @@
-import { NextFunction, Request, Response } from "express";
-import { PrismaQueryOptions, ArkosRequest, ArkosRequestHandler, ArkosResponse, AuthPrismaQueryOptions } from "../../types";
-import { ZodSchema } from "zod";
-import { ClassConstructor } from "class-transformer";
-import { ValidatorOptions } from "class-validator";
-import { ArkosRouteConfig } from "../../utils/arkos-router/types";
-export declare function callNext(_: Request, _1: Response, next: NextFunction): void;
+import { NextFunction, Request, Response } from 'express';
+import { PrismaQueryOptions, ArkosRequest, ArkosResponse, AuthPrismaQueryOptions } from '../../types';
+import { ArkosRouteConfig } from '../../utils/arkos-router/types';
 /**
  * Sends response with backward compatibility support
  * Compares current values against original values to detect middleware changes
@@ -30,6 +26,4 @@ export declare function addPrismaQueryOptionsToRequest<T extends Record<string,
  *
  */
 export declare function handleRequestLogs(req: Request, res: Response, next: NextFunction): void;
-export declare function handleRequestBodyValidationAndTransformation<T extends object>(schemaOrDtoClass?: ClassConstructor<T>, classValidatorValidationOptions?: ValidatorOptions): ArkosRequestHandler;
-export declare function handleRequestBodyValidationAndTransformation<T extends object>(schemaOrDtoClass?: ZodSchema<T>): ArkosRequestHandler;
 export declare function validateRequestInputs(routeConfig: ArkosRouteConfig): any;