najm-auth 1.1.38 → 1.1.41

package/README.md

@@ -9,7 +9,7 @@ Production-ready authentication and authorization library for the Najm framework
 - ✅ Permission-based access control (PBAC) with wildcards
 - ✅ Row-level ownership scoping for multi-tenant apps
 - ✅ Built-in password reset flow with email support
-- ✅ Multi-dialect support (PostgreSQL, SQLite, MySQL)
+- ✅ Multi-dialect support (PostgreSQL, SQLite)
 - ✅ Type-safe decorators with TypeScript
 - ✅ Rate limiting on auth endpoints
 - ✅ Internationalization (i18n) for all messages
@@ -103,7 +103,7 @@ FRONTEND_URL=https://app.example.com
 ```typescript
 auth({
   // Database
-  dialect?: 'pg' | 'sqlite' | 'mysql'    // Default: 'pg'
+  dialect?: 'pg' | 'sqlite'              // Default: 'pg' (RETURNING-capable engines only)
   schema?: AuthSchema                      // Override dialect schema
 
   // JWT
@@ -123,6 +123,7 @@ auth({
 
   // Registration
   defaultRole?: string | null              // Auto-assign role to new users
+  bcryptRounds?: number                    // Default: 10 (valid: 4-31)
 
   // Frontend
   frontendUrl?: string                     // Password reset link base URL
@@ -155,7 +156,7 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 
 | Method | Path | Description |
 |--------|------|-------------|
-| `GET` | `/users` | List all users |
+| `GET` | `/users?limit=50&offset=0` | List users (limit 1-100) |
 | `GET` | `/users/:id` | Get user by ID |
 | `POST` | `/users` | Create new user |
 | `PUT` | `/users/:id` | Update user |
@@ -510,8 +511,8 @@ Auth routes have built-in rate limiting to prevent brute force attacks.
 |-------|-------|--------|--------------|
 | `POST /auth/register` | 5 | 15 minutes | IP |
 | `POST /auth/login` | 5 | 15 minutes | IP |
-| `GET /auth/refresh` | 10 | 15 minutes | IP |
-| `GET /auth/logout` | 10 | 15 minutes | User ID |
+| `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
+| `POST /auth/logout` | 10 | 15 minutes | User ID |
 | `GET /auth/me` | 30 | 1 minute | User ID |
 | `POST /auth/forgot-password` | 3 | 15 minutes | IP |
 | `POST /auth/reset-password` | 5 | 15 minutes | IP |
@@ -592,15 +593,18 @@ async resetPassword(token: string, newPassword: string) {
 
 ### Session Management
 
-- Single refresh token per user (upsert on login)
-- Previous sessions invalidated on new login
+- Sessions are multi-device: the token table stores one refresh row per login session (keyed by a unique `tokenFamily`), so a user can stay logged in on several devices at once. Logout and rotation are scoped to the current session; password change/reset revoke every session
+- A stale refresh token presented after the 120-second rotation grace window revokes only that session's family as reuse protection
+- The signed session cookie is accepted for up to its configured TTL (5 minutes by default) without a database or revocation-cache read
 - Use `@RateLimit` on logout for DDoS protection
 
 ### Token Blacklist
 
 - Built-in cache-based blacklist for immediate revocation
 - Supports Redis via `cache()` plugin configuration
-- Default: in-memory store (suitable for single-instance servers)
+- Default: in-memory store (development/single-process only; entries are lost on restart)
+- Use Redis in production when immediate revocation must survive restarts or propagate across instances
+- Session-version revocation keys are cache-backed and TTL-bound to active access tokens
 
 ### Timing Attack Prevention
 
@@ -635,7 +639,8 @@ Test files include:
 - ✅ Set `FRONTEND_URL` environment variable
 - ✅ Enable HTTPS in production
 - ✅ Store secrets in environment variables (never in code)
-- ✅ Use Redis for token blacklist in distributed systems
+- ✅ Use Redis for token blacklist/session-version revocation in production and distributed systems
+- ✅ Trust forwarded IP headers only behind a known proxy; otherwise provide a custom rate-limit key generator
 - ✅ Enable rate limiting on all auth routes
 - ✅ Log authentication events for audit trails
 - ✅ Test ownership scoping rules with multi-user scenarios

package/dist/index.d.ts

@@ -65,6 +65,8 @@ interface AuthConfig {
     registrationMode: 'active' | 'pending';
     /** Per-account lockout settings */
     lockout: LockoutConfig;
+    /** Bcrypt work factor (default: 10) */
+    bcryptRounds: number;
     /** Session cookie cache settings */
     session: SessionCookieConfig;
 }
@@ -74,7 +76,7 @@ interface AuthConfig {
  */
 /**
  * Auth schema shape (dialect-agnostic)
- * Import from 'najm-auth/pg', 'najm-auth/sqlite', or 'najm-auth/mysql'
+ * Import from 'najm-auth/pg' or 'najm-auth/sqlite'.
  */
 interface AuthSchema {
     users: any;
@@ -84,9 +86,17 @@ interface AuthSchema {
     rolePermissions: any;
 }
 type AuthPluginConfig = {
-    /** Database dialect (default: 'pg'). Auto-selects the correct schema. */
-    dialect?: 'pg' | 'sqlite' | 'mysql';
-    /** Database schema tables (optional, overrides dialect). Use authSchema from 'najm-auth/sqlite' or 'najm-auth/mysql' */
+    /**
+     * Database dialect (default: 'pg'). Auto-selects the correct schema.
+     * Only RETURNING-capable engines are supported — the auth data layer
+     * relies on `.returning()` for every write. MySQL is not supported.
+     */
+    dialect?: 'pg' | 'sqlite';
+    /**
+     * Database schema tables (optional, overrides dialect). Use authSchema
+     * from 'najm-auth/pg' or 'najm-auth/sqlite'. A custom schema must still be
+     * backed by a RETURNING-capable engine (Postgres or SQLite).
+     */
     schema?: AuthSchema;
     /** JWT configuration (secrets can be set via env vars) */
     jwt?: Partial<JwtConfig>;
@@ -104,6 +114,8 @@ type AuthPluginConfig = {
     registrationMode?: 'active' | 'pending';
     /** Per-account lockout settings */
     lockout?: Partial<LockoutConfig>;
+    /** Bcrypt work factor (default: 10, valid range: 4-31) */
+    bcryptRounds?: number;
     /** Session cookie cache settings (optional — sensible defaults applied) */
     session?: Partial<SessionCookieConfig>;
     /** Optional config forwarded to validation() dependency */
@@ -120,6 +132,12 @@ interface JwtPayload {
     userId: string;
     /** Unique token ID for blacklist-based revocation */
     jti: string;
+    /**
+     * Refresh-token session/family identifier. Present on both refresh tokens
+     * (required) and access tokens (so a single family's revocation can reject
+     * every access token minted for that session, not just the presented one).
+     */
+    tokenFamily?: string;
     /** Per-user access token generation version for mass invalidation */
     sessionVersion?: number;
     /** User roles (included for client-side RBAC) */
@@ -139,13 +157,20 @@ interface TokenPair {
     refreshTokenExpiresAt?: number;
 }
 /**
- * User data structure for authentication
+ * User data structure for authentication.
+ *
+ * This is the minimal contract the `USER` ALS token is guaranteed to satisfy
+ * on every resolution path (Bearer token, refresh cookie, and the signed
+ * session-cookie hot path). Guards and handlers must not rely on fields
+ * outside this contract — the DB-backed paths include more, the session
+ * cookie does not.
  */
 interface AuthUser {
     id: string;
     email: string;
     name?: string | null;
     role?: string;
+    status?: string;
     permissions?: string[];
 }
 
@@ -343,6 +368,7 @@ declare function getAuthLocale(lang: string): Record<string, any>;
 declare const AUTH_SUPPORTED_LANGUAGES: string[];
 
 declare class EncryptionService {
+    private config?;
     private encryptionKey;
     constructor(encryptionKey?: string | null);
     hashPassword(password: string): Promise<string>;
@@ -352,11 +378,13 @@ declare class EncryptionService {
 }
 
 interface SessionCookieData {
+    /** Must satisfy the AuthUser contract — see AuthUser in ../types. */
     user: {
         id: string;
         email: string;
         name?: string | null;
         role?: string;
+        status?: string;
     };
     roles: string[];
     permissions: string[];
@@ -402,24 +430,25 @@ declare class UserRepository {
     private get users();
     private get roles();
     /** Shared query helper */
+    private queryHelper?;
     private get q();
-    getAll(): Promise<UserWithPermissions[]>;
+    getAll(limit?: number, offset?: number): Promise<UserWithPermissions[]>;
     getById(id: string): Promise<UserWithPermissions | undefined>;
+    existsById(id: string): Promise<boolean>;
     getRawById(id: string): Promise<User | undefined>;
     getByEmail(email: string): Promise<(User & {
         role?: string | null;
     }) | undefined>;
     create(data: NewUser): Promise<User>;
-    update(id: string, data: Partial<NewUser>): Promise<User>;
+    update(id: string, data: Partial<NewUser>): Promise<User | undefined>;
     updateLastLogin(id: string): Promise<User>;
     incrementFailedAttempts(id: string): Promise<User>;
     resetFailedAttempts(id: string): Promise<User>;
     setLockout(id: string, until: string): Promise<User>;
-    delete(id: string): Promise<User>;
+    delete(id: string): Promise<User | undefined>;
     deleteAll(): Promise<User[]>;
     getRoleNameById(userId: string): Promise<string | null>;
     findByPhone(phone: string): Promise<UserWithPermissions | undefined>;
-    getUserPassword(email: string): Promise<string | undefined>;
     getUserPermissions(userId: string): Promise<string[]>;
     updatePhone(id: string, phone: string): Promise<User>;
 }
@@ -441,7 +470,7 @@ declare class UserValidator {
     /**
      * Check if user exists by ID
      */
-    checkUserExists(id: string): Promise<UserWithPermissions>;
+    checkUserExists(id: string): Promise<boolean>;
     /**
      * Check if user exists by email
      */
@@ -643,11 +672,16 @@ declare class UserService {
     private encryptionService;
     private i18nService;
     private authConfig;
+    private t;
     constructor(roleValidator: RoleValidator, roleService: RoleService, userRepository: UserRepository, userValidator: UserValidator, encryptionService: EncryptionService, i18nService: I18nService, authConfig: AuthConfig);
     private sanitizeUser;
     private sanitizeUsers;
+    private requireUser;
     private resolveUserRole;
-    getAll(): Promise<SanitizedUser[]>;
+    getAll(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<SanitizedUser[]>;
     getById(id: string): Promise<SanitizedUser>;
     getByEmail(email: string): Promise<SanitizedUser>;
     /**
@@ -663,7 +697,6 @@ declare class UserService {
     delete(id: string): Promise<SanitizedUser>;
     deleteAll(): Promise<SanitizedUser[]>;
     getRoleName(id: string): Promise<string | null>;
-    getPassword(email: string): Promise<string | undefined>;
     updateLastLogin(id: string): Promise<void>;
     incrementFailedAttempts(id: string): Promise<number>;
     resetFailedAttempts(id: string): Promise<void>;
@@ -684,9 +717,15 @@ declare class TokenRepository {
     private schema;
     private get tokens();
     private get users();
-    private get roles();
     /** Shared query helper */
+    private queryHelper?;
     private get q();
+    /**
+     * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
+     * per-login session identifier, unique). A brand-new login inserts a fresh
+     * family row; a refresh rotation updates only that family's row, leaving the
+     * user's other sessions untouched.
+     */
     storeRefreshToken(tokenData: {
         userId: string;
         token: string;
@@ -696,10 +735,27 @@ declare class TokenRepository {
         previousValidUntil?: string | null;
         previousUsedAt?: string | null;
     }): Promise<any>;
-    markPreviousUsed(userId: string): Promise<any>;
-    getRefreshTokenWithFamily(userId: string): Promise<any>;
-    revokeToken(userId: string): Promise<any>;
-    revokeByFamily(tokenFamily: string): Promise<any>;
+    /**
+     * Claim the previous-token grace slot for a single family. Conditional on
+     * BOTH the stored previousHash still matching the presented token AND
+     * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
+     * the rotation race: the winner's rotation rewrites previousHash via
+     * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
+     * UPDATE lands after that rotation no longer matches and gets zero rows —
+     * exactly one caller ever claims the slot.
+     */
+    markPreviousUsed(tokenFamily: string, previousHash: string): Promise<any>;
+    /** Look up a single session's token row by its family identifier. */
+    getByFamily(tokenFamily: string): Promise<any>;
+    /** Revoke a single session (one family). */
+    revokeFamily(tokenFamily: string): Promise<any>;
+    /** Revoke every session for a user (password change/reset, logout-all). */
+    revokeAllForUser(userId: string): Promise<any>;
+    /**
+     * Opportunistic cleanup: with one row per family (no unique userId), expired
+     * and abandoned sessions accumulate. Delete every expired row.
+     */
+    deleteExpired(): Promise<any>;
     isUserExists(userId: string): Promise<boolean>;
     getRoleNameById(userId: string): Promise<string>;
     getUserPermissions(userId: string): Promise<string[]>;
@@ -723,37 +779,40 @@ declare class TokenService {
     private get blacklistPrefix();
     private get resetTokenPrefix();
     private get sessionVersionPrefix();
+    private sessionVersionKey;
+    private accessTokenTtlMs;
+    private expiresAt;
+    private getCacheValues;
+    private parseSessionVersion;
     extractAccessToken(authorization: string): string;
     /**
      * Verify access token and check blacklist
      * Throws error if token is invalid, expired, or blacklisted
      */
     verifyAccessToken(token: string): Promise<JwtPayload>;
-    verifyRefreshToken(token: string): string;
-    private static readonly PREVIOUS_GRACE_SECONDS;
-    /**
-     * Validate a refresh token as an active session:
-     * 1. Verify JWT signature and type claim
-     * 2. Compare hash against current stored token
-     * 3. If mismatch, check previous hash within short grace window
-     * 4. Reject anything older or outside the grace window
-     */
-    validateRefreshSession(refreshToken: string): Promise<{
+    verifyRefreshToken(token: string): {
         userId: string;
-        rotatedTokens?: {
-            refreshToken: string;
-            tokenFamily: string;
-        };
-    }>;
+        tokenFamily: string;
+    };
+    private static readonly PREVIOUS_GRACE_SECONDS;
     /**
      * Read the refresh cookie and return the userId it belongs to.
      * Validates against current/previous token state with bounded recovery.
      * Throws if the cookie is missing, invalid, or outside the grace window.
+     *
+     * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
+     * does NOT revoke the suspect family. This is a read path (e.g. GET
+     * /auth/me) — a stray stale cookie on a read must not be able to destroy
+     * the active session. Reuse detection and revocation belong to the
+     * rotation path only.
      */
     resolveUserFromCookie(): Promise<string>;
     getUser(auth: string): Promise<any>;
+    getUserById(userId: string): Promise<any>;
     private hashToken;
     getTokenExpire(token: string): number | undefined;
+    decodeAccessToken(token: string): JwtPayload | null;
+    private signAccessToken;
     /**
      * Generate access token with unique jti for blacklist support.
      * Includes roles/permissions for client-side RBAC/PBAC.
@@ -762,14 +821,22 @@ declare class TokenService {
         userId: string;
         roles?: string[];
         permissions?: string[];
+        tokenFamily?: string;
     }): Promise<string>;
     /**
-     * Generate refresh token with unique jti
+     * Generate refresh token with unique jti. The token carries its session's
+     * family so rotation/revocation can target a single session.
      */
+    private signRefreshToken;
     generateRefreshToken(data: {
         userId: string;
+        tokenFamily?: string;
     }): string;
     generateTokens(userId: string, tokenFamily?: string): Promise<{
+        userId: string;
+        tokenFamily: string;
+        roles: string[];
+        permissions: string[];
         accessToken: string;
         refreshToken: string;
         accessTokenExpiresAt: number;
@@ -799,17 +866,60 @@ declare class TokenService {
      * Compares provided token with hashed version in database
      */
     refreshTokens(): Promise<{
+        userId: string;
+        tokenFamily: string;
+        roles: string[];
+        permissions: string[];
         accessToken: string;
         refreshToken: string;
         accessTokenExpiresAt: number;
         refreshTokenExpiresAt: number;
     }>;
-    revokeToken(userId: string): Promise<any>;
+    /** Revoke every refresh session for a user (password change/reset, logout-all). */
+    revokeAllForUser(userId: string): Promise<any>;
+    /** Revoke a single refresh session (one family). */
+    revokeFamily(tokenFamily: string): Promise<any>;
+    /**
+     * Opportunistic cleanup of expired/abandoned sessions. With one row per
+     * family (no unique userId), abandoned logins would otherwise accumulate.
+     * Best-effort — never let cleanup failure break the calling flow.
+     */
+    deleteExpiredSessions(): Promise<void>;
     invalidateUserAccessTokens(userId: string): Promise<number>;
+    getUserFromCookie(): Promise<any>;
+    private get revokedFamilyPrefix();
+    private revokedFamilyKey;
+    /**
+     * Mark a family as revoked in cache for the access-token TTL, so every
+     * access token minted for that family (not just the presented one) is
+     * rejected by verifyAccessToken until it would have expired anyway.
+     */
+    private markFamilyRevoked;
     /**
-     * Logout user - blacklist access token and revoke refresh token
+     * Revoke only the suspect family — NOT the whole user. Bumping the global
+     * per-user session version here would kill every device's access tokens on a
+     * single family's reuse detection. Instead drop the family's refresh row and
+     * mark the family revoked so its access tokens stop verifying.
+     */
+    private revokeSuspectRefreshFamily;
+    /**
+     * Logout the CURRENT session only — blacklist the presented access token,
+     * mark its family revoked, and delete that family's refresh row. Other
+     * devices/sessions for the same user keep working. Use a password change or
+     * reset (revoke-all) to terminate every session.
+     *
+     * The family is resolved from, in order: a verified Bearer access token's
+     * `tokenFamily` claim, then a verified refresh cookie whose hash still
+     * matches the current family row. If neither is available, fall back to
+     * revoke-all.
      */
     logout(userId: string, authorization?: string): Promise<void>;
+    /**
+     * Resolve a logout target from the refresh cookie only if the cookie maps to
+     * the user's current/valid family row. This mirrors resolveUserFromCookie()
+     * without throwing, because logout can still fall back to revoke-all.
+     */
+    private resolveRefreshCookieFamily;
     /**
      * Generate secure password reset token
      * Returns both the plain token (to send via email) and userId for identification
@@ -883,6 +993,10 @@ declare const assignRoleParams: z.ZodObject<{
     userId: z.ZodString;
     roleId: z.ZodString;
 }, z.core.$strip>;
+declare const userListQuery: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
 type CreateUserDto = z.infer<typeof createUserDto>;
 type UpdateUserDto = z.infer<typeof updateUserDto>;
 type UserIdParam = z.infer<typeof userIdParam>;
@@ -894,26 +1008,25 @@ type LanguageParam = z.infer<typeof languageParam>;
 type EmailParam = z.infer<typeof emailParam>;
 type UserIdInParam = z.infer<typeof userIdInParam>;
 type AssignRoleParams = z.infer<typeof assignRoleParams>;
+type UserListQuery = z.infer<typeof userListQuery>;
 
 declare class AuthService {
     private tokenService;
     private userService;
     private userValidator;
+    private encryptionService;
     private cookieManager;
     private i18nService;
     private emailService;
     private config;
     private t;
     private logger;
-    private static readonly DUMMY_HASH;
-    constructor(tokenService: TokenService, userService: UserService, userValidator: UserValidator, cookieManager: CookieManager, i18nService: I18nService, emailService: EmailService);
+    private dummyHash?;
+    constructor(tokenService: TokenService, userService: UserService, userValidator: UserValidator, encryptionService: EncryptionService, cookieManager: CookieManager, i18nService: I18nService, emailService: EmailService);
     private isLockoutActive;
     private nextLockoutUntil;
-    /**
-     * Decode JWT payload without verification (token was just generated by us).
-     * Used to extract accurate roles/permissions for the session cookie cache.
-     */
-    private decodeAccessToken;
+    private getDummyHash;
+    warmupPasswordHash(): Promise<void>;
     registerUser(body: CreateUserDto): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<TokenPair & {
         user: SanitizedUser;
@@ -923,6 +1036,13 @@ declare class AuthService {
         data: any;
         message: string;
     }>;
+    /**
+     * Prune expired refresh sessions for every user. Login already prunes
+     * opportunistically; expose this so consumers can also run it from a
+     * scheduled job (cron / queue) to reclaim rows from users who never return.
+     * Best-effort — safe to call repeatedly.
+     */
+    pruneExpiredSessions(): Promise<void>;
     getUserProfile(userData: AuthUser): Promise<AuthUser & {
         language: string;
     }>;
@@ -934,10 +1054,7 @@ declare class AuthService {
      * fall back to cookie when no Authorization header is present.
      *
      * Refreshes the session cookie cache only when authoritative roles/permissions
-     * are available (from the access token JWT). When called via the refresh-cookie
-     * fallback, we cannot reliably populate permissions without a DB round-trip,
-     * so we leave the existing cache alone — it will be refreshed by the next
-     * login/refresh cycle.
+     * are available from the access token.
      */
     getMe(authorization?: string): Promise<SanitizedUser & {
         language: string;
@@ -953,7 +1070,6 @@ declare class AuthService {
     }>;
 }
 
-declare const setConfiguredCookieName: (name: string) => void;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);
@@ -1013,6 +1129,11 @@ declare class AuthResolver {
         role?: string;
         permissions?: string[];
     } | false>;
+    resolveFromSessionCookie(): Promise<{
+        user: any;
+        role?: string;
+        permissions?: string[];
+    } | false>;
     /**
      * Resolve the current user from the refresh cookie (cookie-only flow,
      * e.g. Next.js Server Components calling /auth/me with just the cookie).
@@ -1027,6 +1148,7 @@ declare class AuthResolver {
         permissions?: string[];
     } | false>;
     activate(): Promise<void>;
+    onReady(): Promise<void>;
 }
 
 interface RunAsUser {
@@ -1691,6 +1813,7 @@ declare class AuthQueries {
         createdAt: any;
         updatedAt: any;
     };
+    getUserWithPermissions(where: any): Promise<any | undefined>;
     /**
      * Get permissions for a user by their userId
      */
@@ -1769,7 +1892,7 @@ type RevokeTokenDto = z.infer<typeof revokeTokenDto>;
 declare class UserController {
     private userService;
     constructor(userService: UserService);
-    getUsers(): Promise<SanitizedUser[]>;
+    getUsers(query: UserListQuery): Promise<SanitizedUser[]>;
     getLang(): Promise<{
         language: string;
     }>;
@@ -1808,6 +1931,8 @@ interface SeedUserConfig {
 interface AuthSeedConfig {
     adminEmail: string;
     adminPass: string;
+    /** Bcrypt work factor (default: 10) */
+    bcryptRounds?: number;
     roles?: Array<{
         name: string;
         description?: string;
@@ -1830,6 +1955,8 @@ interface SeedAuthDataConfig {
     adminEmail: string;
     /** Admin password (required) */
     adminPassword: string;
+    /** Bcrypt work factor (default: 10) */
+    bcryptRounds?: number;
     /** Additional users to seed (optional) */
     users?: SeedUserConfig[];
     /** Custom roles (optional - uses defaults if omitted) */
@@ -1922,4 +2049,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, setConfiguredCookieName, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };