hazo_auth 5.1.38 → 5.1.40

package/README.md

@@ -2,6 +2,16 @@
 
 A reusable authentication UI component package powered by Next.js, TailwindCSS, and shadcn. It integrates `hazo_config` for configuration management and `hazo_connect` for data access, enabling future components to stay aligned with platform conventions.
 
+### What's New in v5.1.39 🔧
+
+**Postgres-Compatibility Schema Alignment** — fixes two long-standing drifts between the canonical SQLite schema and what the runtime actually writes. SQLite consumers see no behaviour change; Postgres + PostgREST consumers can now sign-up users without bespoke schema patches.
+
+- **`hazo_refresh_tokens.token_hash`** — `token_service.ts` writes the argon2-hashed token, but the canonical schema only declared `token`. Added `token_hash TEXT` column and an index on it; relaxed the legacy plaintext `token` column to nullable. Runtime no longer writes plaintext, so this is purely additive for new installs.
+- **Boolean-typed columns** — `hazo_users.email_verified` and the four flags on `hazo_user_relationships` (`can_view_progress`, `can_edit_profile`, `can_delete`, `is_self`) are now declared `BOOLEAN` instead of `INTEGER`. SQLite tolerates `BOOLEAN` as a NUMERIC affinity (existing 0/1 data evaluates correctly). PostgreSQL via PostgREST was previously rejecting the runtime's `email_verified: false` payload with `400 — invalid input syntax for type integer: "false"`; now it accepts the boolean cleanly.
+- **Migration `014_align_schema_with_runtime.sql`** — applies the two changes above to existing deployments. SQLite version is active (additive `ADD COLUMN`); PostgreSQL ALTERs are commented blocks for consumers to opt in (with `NOTIFY pgrst, 'reload schema';` reminders).
+
+Reported by Kinstripe (Postgres + PostgREST consumer) during sign-up smoke tests on 2026-04-28.
+
 ### What's New in v5.1.28
 
 **Schema Validation, Permission Constants & DX Improvements**

package/cli-src/lib/schema/sqlite_schema.ts

@@ -12,7 +12,7 @@ CREATE TABLE IF NOT EXISTS hazo_users (
   email_address TEXT NOT NULL UNIQUE,
   password_hash TEXT,
   name TEXT,
-  email_verified INTEGER DEFAULT 0,
+  email_verified BOOLEAN DEFAULT false,
   login_attempts INTEGER DEFAULT 0,
   last_logon TEXT,
   profile_picture_url TEXT,
@@ -35,10 +35,15 @@ CREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);
 CREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);
 
 -- Refresh tokens table
+-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on
+-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.
+-- The plaintext "token" column is retained nullable for legacy compatibility
+-- but new writes only set token_hash.
 CREATE TABLE IF NOT EXISTS hazo_refresh_tokens (
   id TEXT PRIMARY KEY,
   user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
-  token TEXT NOT NULL UNIQUE,
+  token TEXT UNIQUE,
+  token_hash TEXT,
   token_type TEXT DEFAULT 'refresh',
   expires_at TEXT NOT NULL,
   created_at TEXT NOT NULL DEFAULT (datetime('now'))
@@ -46,6 +51,7 @@ CREATE TABLE IF NOT EXISTS hazo_refresh_tokens (
 
 CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);
 CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);
+CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);
 
 -- Roles table
 CREATE TABLE IF NOT EXISTS hazo_roles (
@@ -145,10 +151,10 @@ CREATE TABLE IF NOT EXISTS hazo_user_relationships (
   parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
   child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
   relationship_type TEXT NOT NULL DEFAULT 'parent',
-  can_view_progress INTEGER DEFAULT 1,
-  can_edit_profile INTEGER DEFAULT 1,
-  can_delete INTEGER DEFAULT 0,
-  is_self INTEGER DEFAULT 0,
+  can_view_progress BOOLEAN DEFAULT true,
+  can_edit_profile BOOLEAN DEFAULT true,
+  can_delete BOOLEAN DEFAULT false,
+  is_self BOOLEAN DEFAULT false,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   UNIQUE(parent_user_id, child_user_id)
 );

package/dist/lib/schema/sqlite_schema.d.ts

@@ -1,2 +1,2 @@
-export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified INTEGER DEFAULT 0,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT NOT NULL UNIQUE,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Super admin scope\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000000', NULL, 'Super Admin', 'system', datetime('now'), datetime('now'));\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress INTEGER DEFAULT 1,\n  can_edit_profile INTEGER DEFAULT 1,\n  can_delete INTEGER DEFAULT 0,\n  is_self INTEGER DEFAULT 0,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n";
+export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified BOOLEAN DEFAULT false,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\n-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on\n-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.\n-- The plaintext \"token\" column is retained nullable for legacy compatibility\n-- but new writes only set token_hash.\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT UNIQUE,\n  token_hash TEXT,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Super admin scope\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000000', NULL, 'Super Admin', 'system', datetime('now'), datetime('now'));\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress BOOLEAN DEFAULT true,\n  can_edit_profile BOOLEAN DEFAULT true,\n  can_delete BOOLEAN DEFAULT false,\n  is_self BOOLEAN DEFAULT false,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n";
 //# sourceMappingURL=sqlite_schema.d.ts.map

package/dist/lib/schema/sqlite_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,80NA6JzB,CAAC"}
+{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,uuOAmKzB,CAAC"}

package/dist/lib/schema/sqlite_schema.js

@@ -11,7 +11,7 @@ CREATE TABLE IF NOT EXISTS hazo_users (
   email_address TEXT NOT NULL UNIQUE,
   password_hash TEXT,
   name TEXT,
-  email_verified INTEGER DEFAULT 0,
+  email_verified BOOLEAN DEFAULT false,
   login_attempts INTEGER DEFAULT 0,
   last_logon TEXT,
   profile_picture_url TEXT,
@@ -34,10 +34,15 @@ CREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);
 CREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);
 
 -- Refresh tokens table
+-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on
+-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.
+-- The plaintext "token" column is retained nullable for legacy compatibility
+-- but new writes only set token_hash.
 CREATE TABLE IF NOT EXISTS hazo_refresh_tokens (
   id TEXT PRIMARY KEY,
   user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
-  token TEXT NOT NULL UNIQUE,
+  token TEXT UNIQUE,
+  token_hash TEXT,
   token_type TEXT DEFAULT 'refresh',
   expires_at TEXT NOT NULL,
   created_at TEXT NOT NULL DEFAULT (datetime('now'))
@@ -45,6 +50,7 @@ CREATE TABLE IF NOT EXISTS hazo_refresh_tokens (
 
 CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);
 CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);
+CREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);
 
 -- Roles table
 CREATE TABLE IF NOT EXISTS hazo_roles (
@@ -144,10 +150,10 @@ CREATE TABLE IF NOT EXISTS hazo_user_relationships (
   parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
   child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
   relationship_type TEXT NOT NULL DEFAULT 'parent',
-  can_view_progress INTEGER DEFAULT 1,
-  can_edit_profile INTEGER DEFAULT 1,
-  can_delete INTEGER DEFAULT 0,
-  is_self INTEGER DEFAULT 0,
+  can_view_progress BOOLEAN DEFAULT true,
+  can_edit_profile BOOLEAN DEFAULT true,
+  can_delete BOOLEAN DEFAULT false,
+  is_self BOOLEAN DEFAULT false,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   UNIQUE(parent_user_id, child_user_id)
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "5.1.38",
+  "version": "5.1.40",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -230,17 +230,6 @@
     "multer": "^2.0.2"
   },
   "peerDependencies": {
-    "hazo_config": "^1.4.0 || ^2.0.0",
-    "hazo_connect": "^2.4.0",
-    "hazo_logs": "^1.0.10",
-    "hazo_notify": "^1.0.0",
-    "hazo_ui": "^2.0.0",
-    "next": ">=14.0.0",
-    "next-auth": "^4.24.0",
-    "next-themes": "^0.4.0",
-    "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0",
-    "sonner": "^2.0.0",
     "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-alert-dialog": "^1.1.0",
     "@radix-ui/react-avatar": "^1.1.0",
@@ -255,7 +244,18 @@
     "@radix-ui/react-switch": "^1.2.0",
     "@radix-ui/react-tabs": "^1.1.0",
     "@radix-ui/react-tooltip": "^1.2.0",
-    "lucide-react": ">=0.400.0"
+    "hazo_config": "^1.4.0 || ^2.0.0",
+    "hazo_connect": "^2.4.0",
+    "hazo_logs": "^1.0.10",
+    "hazo_notify": "^1.0.0",
+    "hazo_ui": "^2.0.0",
+    "lucide-react": ">=0.400.0",
+    "next": ">=14.0.0",
+    "next-auth": "^4.24.0",
+    "next-themes": "^0.4.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "sonner": "^2.0.0"
   },
   "peerDependenciesMeta": {
     "hazo_config": {
@@ -326,18 +326,7 @@
     }
   },
   "devDependencies": {
-    "hazo_config": "^1.4.2",
-    "hazo_connect": "^2.4.2",
-    "hazo_logs": "^1.0.10",
-    "hazo_notify": "^1.0.0",
-    "hazo_ui": "^2.0.0",
-    "next": "^16.0.7",
-    "next-auth": "^4.24.13",
-    "next-themes": "^0.4.6",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "sonner": "^2.0.7",
-    "lucide-react": "^0.553.0",
+    "@chromatic-com/storybook": "^4.1.2",
     "@radix-ui/react-accordion": "^1.2.12",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-avatar": "^1.1.11",
@@ -352,7 +341,6 @@
     "@radix-ui/react-switch": "^1.2.6",
     "@radix-ui/react-tabs": "^1.1.13",
     "@radix-ui/react-tooltip": "^1.2.8",
-    "@chromatic-com/storybook": "^4.1.2",
     "@storybook/addon-a11y": "^10.0.6",
     "@storybook/addon-docs": "^10.0.6",
     "@storybook/addon-onboarding": "^10.0.6",
@@ -375,14 +363,27 @@
     "@types/react-dom": "^18",
     "better-sqlite3": "^12.4.1",
     "cross-env": "^10.1.0",
+    "dotenv": "^17.4.2",
     "eslint": "^9.39.1",
     "eslint-config-next": "^16.0.4",
     "eslint-plugin-storybook": "^10.0.6",
+    "hazo_config": "^1.4.2",
+    "hazo_connect": "^2.4.2",
+    "hazo_logs": "^1.0.10",
+    "hazo_notify": "^1.0.0",
+    "hazo_ui": "^2.0.0",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^29.7.0",
+    "lucide-react": "^0.553.0",
+    "next": "^16.0.7",
+    "next-auth": "^4.24.13",
+    "next-themes": "^0.4.6",
     "patch-package": "^8.0.1",
     "playwright": "^1.57.0",
     "postcss": "^8",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "sonner": "^2.0.7",
     "storybook": "^10.0.6",
     "supertest": "^7.1.4",
     "tailwindcss": "^3.4.1",