hazo_auth 10.4.11 → 10.5.0

package/README.md

@@ -2,6 +2,10 @@
 
 A reusable authentication UI component package powered by Next.js, TailwindCSS, and shadcn. It integrates `hazo_config` for configuration management and `hazo_connect` for data access, enabling future components to stay aligned with platform conventions.
 
+### What's New in v10.4.13
+
+- **`validate_session_secret_config()`** exported from `hazo_auth/server-lib` — hard startup validator that throws `HazoConfigError` (code `HAZO_AUTH_CONFIG`) when `JWT_SECRET` is unset or shorter than 32 chars. Call it from a Next.js `instrumentation.ts` `register()` hook to fail boot loudly instead of hitting the silent split-brain a bad/missing secret otherwise causes (edge proxy bounces to `/login` while server-side auth falls back to unsigned cookies and still considers the user authenticated).
+
 ### What's New in v10.4.5
 
 - **Pre-fill login credentials** — `LoginPage`, `LoginClientWrapper`, and `LoginLayout` now accept a `default_values` / `defaultValues` prop (`{ email?: string; password?: string }`) to pre-populate the login form. Useful for demo and test environments (gate with `process.env.DEMO_EMAIL` etc.).

package/SETUP_CHECKLIST.md

@@ -424,9 +424,10 @@ from_name = Your App Name
 **Checklist:**
 - [ ] `.env.local` file created
 - [ ] `HAZO_AUTH_COOKIE_PREFIX` set (REQUIRED - must match config file)
-- [ ] `JWT_SECRET` set (required for JWT session tokens)
+- [ ] `JWT_SECRET` set (required for JWT session tokens, >= 32 chars)
 - [ ] `ZEPTOMAIL_API_KEY` set (or email will not work)
 - [ ] `from_email` configured in `hazo_notify_config.ini`
+- [ ] Call `validate_session_secret_config()` (from `hazo_auth/server-lib`) in your `instrumentation.ts` `register()` hook — hard-fails boot with a descriptive banner if `JWT_SECRET` is missing or too short, instead of the silent split-brain (logged-in on `/login` but bounced on every protected route) that a bad secret otherwise causes.
 
 ---
 

package/cli-src/cli/generate.ts

@@ -64,6 +64,10 @@ const ROUTES: RouteDefinition[] = [
   { name: "nextauth_post", path: "api/auth/[...nextauth]", method: "POST", export_name: "nextauthPOST" },
   { name: "oauth_google_callback", path: "api/hazo_auth/oauth/google/callback", method: "GET", export_name: "oauthGoogleCallbackGET" },
   { name: "set_password", path: "api/hazo_auth/set_password", method: "POST", export_name: "setPasswordPOST" },
+  // Static assets (default auth-page images served from the package's dist/assets/images).
+  // Without this route the default image_src (/api/hazo_auth/assets/login_default.jpg) 404s
+  // and login/register/etc. render with an empty image panel.
+  { name: "assets", path: "api/hazo_auth/assets/[name]", method: "GET", export_name: "assetGET" },
 ];
 
 const PAGES: PageDefinition[] = [

package/cli-src/lib/validate_session_secret.server.ts

@@ -0,0 +1,83 @@
+// file_description: startup validator for the JWT session signing secret — hard-fails boot with a descriptive banner if JWT_SECRET is missing or too short
+// section: server-only-guard
+import "server-only";
+
+// section: imports
+import { HazoConfigError } from "hazo_core";
+
+// section: constants
+/**
+ * Minimum acceptable length for JWT_SECRET. jose/HS256 accepts shorter keys,
+ * but anything under 32 chars is trivially brute-forceable for a session
+ * signing secret. Matches the threshold the validate CLI enforces.
+ */
+const MIN_JWT_SECRET_LEN = 32;
+
+// section: validate
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export function validate_session_secret_config(): void {
+  const jwt_secret = process.env.JWT_SECRET;
+
+  if (!jwt_secret || jwt_secret.trim().length === 0) {
+    console.error("=".repeat(60));
+    console.error("FATAL: JWT_SECRET is not set");
+    console.error("=".repeat(60));
+    console.error("hazo_auth signs session cookies with JWT_SECRET. Without it:");
+    console.error("  - the edge proxy rejects every session and bounces");
+    console.error("    logged-in users to /login;");
+    console.error("  - server-side auth silently falls back to unsigned");
+    console.error("    cookies, so the app looks logged in but every");
+    console.error("    protected route bounces.");
+    console.error("");
+    console.error("Fix — add to .env.local:");
+    console.error("  JWT_SECRET=<random string, at least 32 chars>");
+    console.error("Generate one:");
+    console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+    console.error("=".repeat(60));
+
+    throw new HazoConfigError({
+      code: "HAZO_AUTH_CONFIG",
+      pkg: "hazo_auth",
+      message:
+        "JWT_SECRET environment variable is required to sign session cookies. " +
+        "Without it the edge proxy bounces authenticated users to /login while " +
+        "server-side auth falls back to unsigned cookies. Set JWT_SECRET (>= 32 chars) in .env.local.",
+    });
+  }
+
+  if (jwt_secret.trim().length < MIN_JWT_SECRET_LEN) {
+    console.error("=".repeat(60));
+    console.error("FATAL: JWT_SECRET is too short");
+    console.error("=".repeat(60));
+    console.error(
+      `JWT_SECRET is ${jwt_secret.trim().length} chars; at least ${MIN_JWT_SECRET_LEN} are required.`,
+    );
+    console.error("Generate a strong one:");
+    console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+    console.error("=".repeat(60));
+
+    throw new HazoConfigError({
+      code: "HAZO_AUTH_CONFIG",
+      pkg: "hazo_auth",
+      message:
+        `JWT_SECRET is too short (${jwt_secret.trim().length} chars). ` +
+        `Use at least ${MIN_JWT_SECRET_LEN} characters for the session signing secret.`,
+    });
+  }
+}

package/dist/cli/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAiMF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAqMF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}

package/dist/cli/generate.js

@@ -41,6 +41,10 @@ const ROUTES = [
     { name: "nextauth_post", path: "api/auth/[...nextauth]", method: "POST", export_name: "nextauthPOST" },
     { name: "oauth_google_callback", path: "api/hazo_auth/oauth/google/callback", method: "GET", export_name: "oauthGoogleCallbackGET" },
     { name: "set_password", path: "api/hazo_auth/set_password", method: "POST", export_name: "setPasswordPOST" },
+    // Static assets (default auth-page images served from the package's dist/assets/images).
+    // Without this route the default image_src (/api/hazo_auth/assets/login_default.jpg) 404s
+    // and login/register/etc. render with an empty image panel.
+    { name: "assets", path: "api/hazo_auth/assets/[name]", method: "GET", export_name: "assetGET" },
 ];
 const PAGES = [
     { name: "login", path: "hazo_auth/login", component_name: "LoginPage", import_path: "hazo_auth/pages/login" },

package/dist/client.d.ts

@@ -12,6 +12,8 @@ export * from "./components/layouts/shared/utils/validation.js";
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";
 export { PermissionDeniedDialog } from "./components/permission_denied_dialog.client.js";
 export type { PermissionDeniedDialogProps, PermissionDeniedDetails } from "./components/permission_denied_dialog.client";
+export { UserPickerSelect, UserAvatar, userDisplayName } from "./components/user_picker_select.js";
+export type { UserPickerSelectProps, UserAvatarProps, PickableUser, } from "./components/user_picker_select";
 export { AuthIssueCard, registerAuthIssueCardRenderer } from './admin-issues/plugin.client.js';
 export { PermissionDeniedProvider, showPermissionDeniedDialog, handlePermissionDenied, fetchWithPermissionCapture, } from './admin-issues/permission_denied_provider.client.js';
 export type { PermissionDeniedProviderProps } from './admin-issues/permission_denied_provider.client';

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAInI,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpD,cAAc,uBAAuB,CAAC;AAItC,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC3G,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACnH,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAIxG,cAAc,8CAA8C,CAAC;AAG7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,YAAY,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAGzH,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAC1D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAInI,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpD,cAAc,uBAAuB,CAAC;AAItC,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC3G,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACnH,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAIxG,cAAc,8CAA8C,CAAC;AAG7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,YAAY,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAKzH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAChG,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,YAAY,GACb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAC1D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC"}

package/dist/client.js

@@ -33,6 +33,10 @@ export * from "./components/layouts/shared/utils/validation.js";
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";
 // section: permission_denied_dialog_exports
 export { PermissionDeniedDialog } from "./components/permission_denied_dialog.client.js";
+// section: user_picker_exports
+// Reusable avatar + username dropdown for choosing a user (issue owner,
+// assignee, mention, etc.). Data-agnostic — caller supplies the candidate list.
+export { UserPickerSelect, UserAvatar, userDisplayName } from "./components/user_picker_select.js";
 // admin-issues plugin (client card renderer)
 export { AuthIssueCard, registerAuthIssueCardRenderer } from './admin-issues/plugin.client.js';
 // permission-denied provider + fetch helper

package/dist/components/user_picker_select.d.ts

@@ -0,0 +1,58 @@
+import * as React from "react";
+export interface PickableUser {
+    /** Stable id — the value the picker commits. */
+    user_id: string;
+    /** Display name; falls back to email, then the id. */
+    name?: string | null;
+    email?: string | null;
+    /** Profile picture URL; absent/failed → tinted initials. */
+    profile_picture_url?: string | null;
+}
+export interface UserPickerSelectProps {
+    /** Candidate users to choose from. */
+    users: PickableUser[];
+    /** Selected user_id; null (or "") means unassigned. */
+    value: string | null;
+    /** Fired with the new user_id, or null when the unassigned row is picked. */
+    onChange: (userId: string | null) => void;
+    /** Prepend an "Unassigned" row. Default true. */
+    includeUnassigned?: boolean;
+    /** Label for the unassigned row. Default "Unassigned". */
+    unassignedLabel?: string;
+    /** Placeholder shown when nothing is selected. Default "Select user". */
+    placeholder?: string;
+    disabled?: boolean;
+    /** Control + avatar sizing. Default "default". */
+    size?: "sm" | "default";
+    /** Extra classes for the trigger. */
+    className?: string;
+    /**
+     * Classes for the portalled dropdown panel. The list renders in a body-level
+     * portal, so it escapes any theme tokens scoped to an ancestor — pass classes
+     * here when the surrounding surface pins its own tokens.
+     */
+    contentClassName?: string;
+    /** Inline styles for the portalled dropdown panel (e.g. pinned CSS token vars). */
+    contentStyle?: React.CSSProperties;
+    "aria-label"?: string;
+}
+/** name → email → id, so a row is never blank. */
+export declare function userDisplayName(u: PickableUser): string;
+export interface UserAvatarProps {
+    user?: PickableUser | null;
+    size?: "sm" | "default";
+    className?: string;
+}
+/**
+ * Standalone avatar: the profile picture when present, else tinted initials,
+ * else a muted person glyph for the empty/unassigned slot. Exported so callers
+ * can reuse the exact same avatar outside the picker (cards, headers, etc.).
+ */
+export declare function UserAvatar({ user, size, className }: UserAvatarProps): React.JSX.Element;
+/**
+ * A Select whose rows show a profile picture + username. The trigger mirrors the
+ * selected row (Radix `SelectValue` copies the item's children), so the chosen
+ * user's avatar + name show in the closed control automatically.
+ */
+export declare function UserPickerSelect({ users, value, onChange, includeUnassigned, unassignedLabel, placeholder, disabled, size, className, contentClassName, contentStyle, "aria-label": ariaLabel, }: UserPickerSelectProps): React.JSX.Element;
+//# sourceMappingURL=user_picker_select.d.ts.map

package/dist/components/user_picker_select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user_picker_select.d.ts","sourceRoot":"","sources":["../../src/components/user_picker_select.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAa/B,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC1C,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kDAAkD;IAClD,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACxB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,YAAY,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAEvD;AA+BD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,IAAgB,EAAE,SAAS,EAAE,EAAE,eAAe,qBAsBhF;AAGD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,KAAK,EACL,QAAQ,EACR,iBAAwB,EACxB,eAA8B,EAC9B,WAA2B,EAC3B,QAAQ,EACR,IAAgB,EAChB,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,YAAY,EAAE,SAAS,GACxB,EAAE,qBAAqB,qBAqCvB"}

package/dist/components/user_picker_select.js

@@ -0,0 +1,76 @@
+// file_description: reusable user-picker dropdown — a Select whose rows render a
+// profile picture (or tinted initials) beside the user's name. Client-safe;
+// built on the shadcn Avatar + Select primitives. Data-agnostic: the caller
+// supplies the candidate users and owns fetching them (e.g. via
+// hazo_get_user_profiles server-side).
+// section: client_directive
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { UserRound } from "lucide-react";
+import { Avatar, AvatarImage, AvatarFallback } from "./ui/avatar.js";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from "./ui/select.js";
+import { cn } from "../lib/utils.js";
+// Radix Select forbids an empty-string item value, so the unassigned row uses a
+// sentinel that is mapped back to null across the component boundary.
+const UNASSIGNED = "__hazo_unassigned__";
+// section: helpers
+/** name → email → id, so a row is never blank. */
+export function userDisplayName(u) {
+    return (u.name && u.name.trim()) || (u.email && u.email.trim()) || u.user_id;
+}
+/** Up-to-two-letter initials from a label. */
+function initialsOf(label) {
+    const s = label.trim();
+    if (!s)
+        return "?";
+    const parts = s.split(/[\s@._-]+/).filter(Boolean);
+    if (parts.length === 0)
+        return s.slice(0, 2).toUpperCase();
+    if (parts.length === 1)
+        return parts[0].slice(0, 2).toUpperCase();
+    return (parts[0][0] + parts[1][0]).toUpperCase();
+}
+// Deterministic fallback tint from a key, so the same user keeps one colour.
+const TINTS = [
+    "bg-indigo-500 text-white",
+    "bg-emerald-500 text-white",
+    "bg-violet-500 text-white",
+    "bg-amber-500 text-white",
+    "bg-rose-500 text-white",
+    "bg-cyan-500 text-white",
+    "bg-sky-500 text-white",
+    "bg-fuchsia-500 text-white",
+];
+function tintOf(key) {
+    let hash = 0;
+    for (let i = 0; i < key.length; i++)
+        hash = (hash * 31 + key.charCodeAt(i)) | 0;
+    return TINTS[Math.abs(hash) % TINTS.length];
+}
+/**
+ * Standalone avatar: the profile picture when present, else tinted initials,
+ * else a muted person glyph for the empty/unassigned slot. Exported so callers
+ * can reuse the exact same avatar outside the picker (cards, headers, etc.).
+ */
+export function UserAvatar({ user, size = "default", className }) {
+    const dim = size === "sm" ? "h-5 w-5" : "h-6 w-6";
+    if (!user) {
+        return (_jsx(Avatar, { className: cn(dim, "bg-muted text-muted-foreground", className), children: _jsx(AvatarFallback, { className: "bg-transparent", children: _jsx(UserRound, { className: size === "sm" ? "h-3 w-3" : "h-3.5 w-3.5" }) }) }));
+    }
+    const label = userDisplayName(user);
+    return (_jsxs(Avatar, { className: cn(dim, className), children: [user.profile_picture_url ? (_jsx(AvatarImage, { src: user.profile_picture_url, alt: "" })) : null, _jsx(AvatarFallback, { className: cn("text-[9px] font-semibold", tintOf(user.user_id)), children: initialsOf(label) })] }));
+}
+// section: user_picker_select
+/**
+ * A Select whose rows show a profile picture + username. The trigger mirrors the
+ * selected row (Radix `SelectValue` copies the item's children), so the chosen
+ * user's avatar + name show in the closed control automatically.
+ */
+export function UserPickerSelect({ users, value, onChange, includeUnassigned = true, unassignedLabel = "Unassigned", placeholder = "Select user", disabled, size = "default", className, contentClassName, contentStyle, "aria-label": ariaLabel, }) {
+    const current = value ? value : includeUnassigned ? UNASSIGNED : "";
+    const handleChange = (next) => {
+        onChange(next === UNASSIGNED ? null : next);
+    };
+    const triggerSize = size === "sm" ? "h-7 gap-1.5 text-xs" : "h-9 gap-2 text-sm";
+    return (_jsxs(Select, { value: current || undefined, onValueChange: handleChange, disabled: disabled, children: [_jsx(SelectTrigger, { "aria-label": ariaLabel !== null && ariaLabel !== void 0 ? ariaLabel : "Select user", className: cn(triggerSize, "min-w-0 [&>span]:truncate", className), children: _jsx(SelectValue, { placeholder: placeholder }) }), _jsxs(SelectContent, { className: contentClassName, style: contentStyle, children: [includeUnassigned ? (_jsx(SelectItem, { value: UNASSIGNED, children: _jsxs("span", { className: "flex items-center gap-2", children: [_jsx(UserAvatar, { user: null, size: size }), _jsx("span", { className: "truncate", children: unassignedLabel })] }) })) : null, users.map((u) => (_jsx(SelectItem, { value: u.user_id, children: _jsxs("span", { className: "flex items-center gap-2", children: [_jsx(UserAvatar, { user: u, size: size }), _jsx("span", { className: "truncate", children: userDisplayName(u) })] }) }, u.user_id)))] })] }));
+}

package/dist/lib/validate_session_secret.server.d.ts

@@ -0,0 +1,20 @@
+import "server-only";
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export declare function validate_session_secret_config(): void;
+//# sourceMappingURL=validate_session_secret.server.d.ts.map

package/dist/lib/validate_session_secret.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate_session_secret.server.d.ts","sourceRoot":"","sources":["../../src/lib/validate_session_secret.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAcrB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAiDrD"}

package/dist/lib/validate_session_secret.server.js

@@ -0,0 +1,72 @@
+// file_description: startup validator for the JWT session signing secret — hard-fails boot with a descriptive banner if JWT_SECRET is missing or too short
+// section: server-only-guard
+import "server-only";
+// section: imports
+import { HazoConfigError } from "hazo_core";
+// section: constants
+/**
+ * Minimum acceptable length for JWT_SECRET. jose/HS256 accepts shorter keys,
+ * but anything under 32 chars is trivially brute-forceable for a session
+ * signing secret. Matches the threshold the validate CLI enforces.
+ */
+const MIN_JWT_SECRET_LEN = 32;
+// section: validate
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export function validate_session_secret_config() {
+    const jwt_secret = process.env.JWT_SECRET;
+    if (!jwt_secret || jwt_secret.trim().length === 0) {
+        console.error("=".repeat(60));
+        console.error("FATAL: JWT_SECRET is not set");
+        console.error("=".repeat(60));
+        console.error("hazo_auth signs session cookies with JWT_SECRET. Without it:");
+        console.error("  - the edge proxy rejects every session and bounces");
+        console.error("    logged-in users to /login;");
+        console.error("  - server-side auth silently falls back to unsigned");
+        console.error("    cookies, so the app looks logged in but every");
+        console.error("    protected route bounces.");
+        console.error("");
+        console.error("Fix — add to .env.local:");
+        console.error("  JWT_SECRET=<random string, at least 32 chars>");
+        console.error("Generate one:");
+        console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+        console.error("=".repeat(60));
+        throw new HazoConfigError({
+            code: "HAZO_AUTH_CONFIG",
+            pkg: "hazo_auth",
+            message: "JWT_SECRET environment variable is required to sign session cookies. " +
+                "Without it the edge proxy bounces authenticated users to /login while " +
+                "server-side auth falls back to unsigned cookies. Set JWT_SECRET (>= 32 chars) in .env.local.",
+        });
+    }
+    if (jwt_secret.trim().length < MIN_JWT_SECRET_LEN) {
+        console.error("=".repeat(60));
+        console.error("FATAL: JWT_SECRET is too short");
+        console.error("=".repeat(60));
+        console.error(`JWT_SECRET is ${jwt_secret.trim().length} chars; at least ${MIN_JWT_SECRET_LEN} are required.`);
+        console.error("Generate a strong one:");
+        console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+        console.error("=".repeat(60));
+        throw new HazoConfigError({
+            code: "HAZO_AUTH_CONFIG",
+            pkg: "hazo_auth",
+            message: `JWT_SECRET is too short (${jwt_secret.trim().length} chars). ` +
+                `Use at least ${MIN_JWT_SECRET_LEN} characters for the session signing secret.`,
+        });
+    }
+}

package/dist/server/routes/user_management_users.d.ts

@@ -26,7 +26,7 @@ export declare function GET(request: NextRequest): Promise<NextResponse<{
         profile_source: {} | null;
         user_type: string | null;
         app_user_data: Record<string, unknown> | null;
-        legal_acceptance_status: "current" | "none" | "outdated";
+        legal_acceptance_status: "current" | "outdated" | "none";
     }[];
 }>>;
 /**

package/dist/server-lib.d.ts

@@ -26,6 +26,7 @@ export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_m
 export type { FirmBrandingConfig } from "./lib/branding_config.server";
 export { create_sqlite_hazo_connect } from "./lib/hazo_connect_setup.js";
 export { validate_hazo_connect_config } from "./lib/validate_hazo_connect_config.server.js";
+export { validate_session_secret_config } from "./lib/validate_session_secret.server.js";
 export { get_hazo_connect_instance, set_hazo_connect_instance, reset_hazo_connect_instance, } from "./lib/hazo_connect_instance.server.js";
 export { create_app_logger } from "./lib/app_logger.js";
 export { sanitize_error_for_user } from "./lib/utils/error_sanitizer.js";

package/dist/server-lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-lib.d.ts","sourceRoot":"","sources":["../src/server-lib.ts"],"names":[],"mappings":"AAYA,OAAO,aAAa,CAAC;AAGrB,cAAc,kBAAkB,CAAC;AAGjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAGrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,cAAc,+BAA+B,CAAC;AAG9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAK7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"server-lib.d.ts","sourceRoot":"","sources":["../src/server-lib.ts"],"names":[],"mappings":"AAYA,OAAO,aAAa,CAAC;AAGrB,cAAc,kBAAkB,CAAC;AAGjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAGrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,cAAc,+BAA+B,CAAC;AAG9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAK7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,8BAA8B,CAAC"}

package/dist/server-lib.js

@@ -40,6 +40,7 @@ export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_m
 // section: hazo_connect_exports
 export { create_sqlite_hazo_connect } from "./lib/hazo_connect_setup.js";
 export { validate_hazo_connect_config } from "./lib/validate_hazo_connect_config.server.js";
+export { validate_session_secret_config } from "./lib/validate_session_secret.server.js";
 export { get_hazo_connect_instance, set_hazo_connect_instance, reset_hazo_connect_instance, } from "./lib/hazo_connect_instance.server.js";
 // section: logger_exports
 export { create_app_logger } from "./lib/app_logger.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.11",
+  "version": "10.5.0",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -408,7 +408,7 @@
     "hazo_core": "^1.2.1",
     "hazo_logs": "^2.1.1",
     "hazo_notify": "^6.1.4",
-    "hazo_ui": "^4.6.2",
+    "hazo_ui": "^4.7.0",
     "input-otp": "^1.4.0",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.0.0",