najm-auth 1.1.41 → 1.1.43

package/dist/index.d.ts

@@ -208,7 +208,16 @@ var auth = {
 		passwordChanged: "Password changed successfully",
 		passwordResetSent: "If that email exists, a reset link has been sent",
 		passwordReset: "Password has been reset successfully",
+		accountInviteSent: "Invitation sent successfully",
 		tokenRefreshed: "Token refreshed successfully"
+	},
+	emails: {
+		passwordReset: {
+			subject: "Reset your password"
+		},
+		accountInvite: {
+			subject: "You've been invited — set up your account"
+		}
 	}
 };
 var users = {
@@ -301,8 +310,17 @@ declare const AUTH_LOCALES: {
                 passwordChanged: string;
                 passwordResetSent: string;
                 passwordReset: string;
+                accountInviteSent: string;
                 tokenRefreshed: string;
             };
+            emails: {
+                passwordReset: {
+                    subject: string;
+                };
+                accountInvite: {
+                    subject: string;
+                };
+            };
         };
         users: {
             errors: {
@@ -920,6 +938,12 @@ declare class TokenService {
      * without throwing, because logout can still fall back to revoke-all.
      */
     private resolveRefreshCookieFamily;
+    /**
+     * Generate a one-time set-password token (used by both password reset and
+     * account invites). Stores the jti in cache so the token can only be used
+     * once, with a TTL matching the JWT expiry.
+     */
+    private generateSetPasswordToken;
     /**
      * Generate secure password reset token
      * Returns both the plain token (to send via email) and userId for identification
@@ -928,6 +952,15 @@ declare class TokenService {
         token: string;
         userId: string;
     }>;
+    /**
+     * Generate secure account-invite token.
+     * Longer expiry (3d) than reset because an invited user may not check
+     * their email immediately. Consumed via the same reset-password endpoint.
+     */
+    generateInviteToken(userId: string): Promise<{
+        token: string;
+        userId: string;
+    }>;
     /**
      * Verify password reset token
      * Returns userId if valid, throws error if expired/invalid
@@ -962,6 +995,12 @@ declare const updateUserDto: z.ZodObject<{
         inactive: "inactive";
     }>>>;
 }, z.core.$strip>;
+declare const inviteUserDto: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodString;
+    roleId: z.ZodOptional<z.ZodString>;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
 declare const userIdParam: z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>;
@@ -999,6 +1038,7 @@ declare const userListQuery: z.ZodObject<{
 }, z.core.$strip>;
 type CreateUserDto = z.infer<typeof createUserDto>;
 type UpdateUserDto = z.infer<typeof updateUserDto>;
+type InviteUserDto = z.infer<typeof inviteUserDto>;
 type UserIdParam = z.infer<typeof userIdParam>;
 type LoginDto = z.infer<typeof loginDto>;
 type ChangePasswordDto = z.infer<typeof changePasswordDto>;
@@ -1010,6 +1050,19 @@ type UserIdInParam = z.infer<typeof userIdInParam>;
 type AssignRoleParams = z.infer<typeof assignRoleParams>;
 type UserListQuery = z.infer<typeof userListQuery>;
 
+/**
+ * Identity fields for creating a user behind a person record (parent, student,
+ * teacher, staff…). Role can be given by name (`role`) or id (`roleId`).
+ */
+type ProvisionUserInput = {
+    id?: string;
+    name?: string;
+    email: string;
+    role?: string;
+    roleId?: string;
+    image?: string | null;
+    status?: 'active' | 'inactive' | 'pending';
+};
 declare class AuthService {
     private tokenService;
     private userService;
@@ -1028,6 +1081,27 @@ declare class AuthService {
     private getDummyHash;
     warmupPasswordHash(): Promise<void>;
     registerUser(body: CreateUserDto): Promise<SanitizedUser>;
+    /**
+     * Admin-initiated account creation. The user is created with a random,
+     * unusable password (the schema requires one) and then emailed a one-time
+     * link to set their own. They can't log in until they do, since they never
+     * learn the random password.
+     *
+     * Email is best-effort: a send failure logs a warning but never rolls back
+     * account creation (and with the console provider, nothing is actually sent).
+     */
+    inviteUser(body: ProvisionUserInput): Promise<SanitizedUser>;
+    /**
+     * Create a login for a person record. The branch is intentional and is the
+     * single rule callers rely on:
+     *   - password provided  → set it directly, NO email (seeding / imports)
+     *   - no password        → random password + emailed set-password invite
+     *
+     * Returns the created (sanitized) user so the caller can link `userId`.
+     */
+    provisionUser(body: ProvisionUserInput & {
+        password?: string | null;
+    }): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<TokenPair & {
         user: SanitizedUser;
     }>;
@@ -1077,6 +1151,7 @@ declare class AuthController {
     loginUser(body: LoginDto): Promise<TokenPair & {
         user: SanitizedUser;
     }>;
+    inviteUser(body: InviteUserDto): Promise<SanitizedUser>;
     refreshTokens(): Promise<TokenPair>;
     logoutUser(userId: string, authorization?: string): Promise<{
         data: any;
@@ -2049,4 +2124,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -373,15 +373,16 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller } from "najm-core";
-import { Get, Post, ResMsg } from "najm-core";
-import { Body, User as User2, Headers } from "najm-core";
+import { Controller as Controller2 } from "najm-core";
+import { Get as Get2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { Body as Body2, User as User3, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
 import { Err as Err6, Log } from "najm-core";
 import { I18n as I18n5, I18nService as I18nService2 } from "najm-i18n";
-import { EmailService, passwordResetTemplate } from "najm-email";
+import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
+import { nanoid as nanoid5 } from "nanoid";
 
 // src/users/UserService.ts
 import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
@@ -1861,23 +1862,39 @@ var TokenService = class TokenService2 {
   }
   // ============ PASSWORD RESET TOKENS ============
   /**
-   * Generate secure password reset token
-   * Returns both the plain token (to send via email) and userId for identification
+   * Generate a one-time set-password token (used by both password reset and
+   * account invites). Stores the jti in cache so the token can only be used
+   * once, with a TTL matching the JWT expiry.
    */
-  async generateResetToken(userId) {
+  async generateSetPasswordToken(userId, type, expiresIn) {
     const jti = nanoid4(16);
-    const resetData = {
+    const data = {
       userId,
-      type: "reset",
+      type,
       jti,
       timestamp: Date.now()
     };
-    const token = jwt.sign(resetData, this.config.jwt.refreshSecret, {
-      expiresIn: "1h"
+    const token = jwt.sign(data, this.config.jwt.refreshSecret, {
+      expiresIn
     });
-    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, 36e5);
+    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, timestring2(expiresIn, "ms"));
     return { token, userId };
   }
+  /**
+   * Generate secure password reset token
+   * Returns both the plain token (to send via email) and userId for identification
+   */
+  async generateResetToken(userId) {
+    return this.generateSetPasswordToken(userId, "reset", "1h");
+  }
+  /**
+   * Generate secure account-invite token.
+   * Longer expiry (3d) than reset because an invited user may not check
+   * their email immediately. Consumed via the same reset-password endpoint.
+   */
+  async generateInviteToken(userId) {
+    return this.generateSetPasswordToken(userId, "invite", "3d");
+  }
   /**
    * Verify password reset token
    * Returns userId if valid, throws error if expired/invalid
@@ -1889,7 +1906,7 @@ var TokenService = class TokenService2 {
     } catch {
       Err5(this.t("errors.resetTokenExpired"));
     }
-    if (decoded.type !== "reset" || !decoded.jti) {
+    if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
       Err5(this.t("errors.invalidResetToken"));
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
@@ -1978,6 +1995,64 @@ var AuthService = class AuthService2 {
   async registerUser(body) {
     return await this.userService.create(body);
   }
+  /**
+   * Admin-initiated account creation. The user is created with a random,
+   * unusable password (the schema requires one) and then emailed a one-time
+   * link to set their own. They can't log in until they do, since they never
+   * learn the random password.
+   *
+   * Email is best-effort: a send failure logs a warning but never rolls back
+   * account creation (and with the console provider, nothing is actually sent).
+   */
+  async inviteUser(body) {
+    const randomPassword = `${nanoid5(24)}Aa1!`;
+    const user = await this.userService.create({
+      id: body.id,
+      name: body.name,
+      email: body.email,
+      role: body.role,
+      roleId: body.roleId,
+      image: body.image,
+      password: randomPassword,
+      status: body.status ?? "active",
+      emailVerified: false
+    });
+    const { token } = await this.tokenService.generateInviteToken(user.id);
+    const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    try {
+      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
+        inviteLink,
+        userName: user.name || body.email
+      }));
+    } catch (error) {
+      this.logger.warn("Account invite email failed", { email: body.email, error });
+    }
+    return user;
+  }
+  /**
+   * Create a login for a person record. The branch is intentional and is the
+   * single rule callers rely on:
+   *   - password provided  → set it directly, NO email (seeding / imports)
+   *   - no password        → random password + emailed set-password invite
+   *
+   * Returns the created (sanitized) user so the caller can link `userId`.
+   */
+  async provisionUser(body) {
+    const password = typeof body.password === "string" ? body.password.trim() : "";
+    if (password) {
+      return this.userService.create({
+        id: body.id,
+        name: body.name,
+        email: body.email,
+        role: body.role,
+        roleId: body.roleId,
+        image: body.image,
+        password,
+        status: body.status ?? "active"
+      });
+    }
+    return this.inviteUser(body);
+  }
   async loginUser(body) {
     const { email: email2, password } = body;
     const user = await this.userService.findByEmail(email2);
@@ -2191,78 +2266,309 @@ AuthGuard = __decorate12([
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
 
-// src/auth/AuthController.ts
+// src/roles/index.ts
+var roles_exports = {};
+__export(roles_exports, {
+  ROLES: () => ROLES,
+  ROLE_GROUPS: () => ROLE_GROUPS,
+  Role: () => Role,
+  RoleController: () => RoleController,
+  RoleGuard: () => RoleGuard,
+  RoleRepository: () => RoleRepository,
+  RoleService: () => RoleService,
+  RoleValidator: () => RoleValidator,
+  assignRoleDto: () => assignRoleDto,
+  createRoleDto: () => createRoleDto,
+  defineRoles: () => defineRoles,
+  isAdmin: () => isAdmin,
+  isAdministrator: () => isAdministrator,
+  roleIdParam: () => roleIdParam,
+  updateRoleDto: () => updateRoleDto
+});
+
+// src/roles/defineRoles.ts
+import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
+
+// src/roles/RoleGuards.ts
+import { Service as Service3 } from "najm-core";
+import { GuardParams, User as User2 } from "najm-core";
+import { composeGuards, createGuard as createGuard2 } from "najm-guard";
+var __decorate13 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata13 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param4 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var RoleGuard = class RoleGuard2 {
+  static {
+    __name(this, "RoleGuard");
+  }
+  canActivate(allowedRoles, userRole) {
+    if (!userRole)
+      return false;
+    const requiredRoles = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
+    const hasRole = requiredRoles.some((r) => r.toLowerCase() === userRole.toLowerCase());
+    if (hasRole) {
+      return { role: userRole };
+    }
+    return false;
+  }
+};
+__decorate13([
+  __param4(0, GuardParams()),
+  __param4(1, User2("role")),
+  __metadata13("design:type", Function),
+  __metadata13("design:paramtypes", [Object, String]),
+  __metadata13("design:returntype", void 0)
+], RoleGuard.prototype, "canActivate", null);
+RoleGuard = __decorate13([
+  Service3()
+], RoleGuard);
+var Role = createGuard2(RoleGuard);
+var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
+var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
+
+// src/roles/defineRoles.ts
+var Role2 = createGuard3(RoleGuard);
+function defineRoles(roles, options) {
+  const ROLES2 = roles;
+  const superRoleKeys = options?.superRoles ?? [];
+  function resolveRoleValues(keys) {
+    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
+  }
+  __name(resolveRoleValues, "resolveRoleValues");
+  const guards2 = {};
+  for (const [key, value] of Object.entries(roles)) {
+    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
+    const allowedValues = resolveRoleValues([key]);
+    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
+  }
+  function createGroupGuard(keys) {
+    const values = resolveRoleValues(keys);
+    return composeGuards2(isAuth(), Role2(values));
+  }
+  __name(createGroupGuard, "createGroupGuard");
+  function hasRole(userRole, ...keys) {
+    if (!userRole)
+      return false;
+    const normalized = userRole.toLowerCase();
+    return resolveRoleValues(keys).some((role) => role === normalized);
+  }
+  __name(hasRole, "hasRole");
+  function isInGroup(userRole, keys) {
+    return hasRole(userRole, ...keys);
+  }
+  __name(isInGroup, "isInGroup");
+  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
+}
+__name(defineRoles, "defineRoles");
+
+// src/roles/RoleController.ts
+import { Controller } from "najm-core";
+import { Get, Post, Put, Delete, ResMsg } from "najm-core";
+import { Params, Body } from "najm-core";
 import { Validate } from "najm-validation";
+
+// src/roles/RoleDto.ts
+import { z } from "zod";
+var nameField = z.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
+var descriptionField = z.string().max(255, "Description too long").optional();
+var createRoleDto = z.object({
+  name: nameField,
+  description: descriptionField
+});
+var updateRoleDto = createRoleDto.partial();
+var roleIdParam = z.object({
+  id: z.string().length(5, "Role ID must be 5 characters")
+});
+var assignRoleDto = z.object({
+  userId: z.string().length(8, "User ID must be 8 characters"),
+  roleId: z.string().length(5, "Role ID must be 5 characters")
+});
+
+// src/roles/RoleController.ts
+var __decorate14 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata14 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param5 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a8;
+var RoleController = class RoleController2 {
+  static {
+    __name(this, "RoleController");
+  }
+  roleService;
+  constructor(roleService) {
+    this.roleService = roleService;
+  }
+  async getRoles() {
+    return this.roleService.getAll();
+  }
+  async getRole(params) {
+    return this.roleService.getById(params.id);
+  }
+  async createRole(body) {
+    return this.roleService.create(body);
+  }
+  async updateRole(params, body) {
+    return this.roleService.update(params.id, body);
+  }
+  async deleteRole(params) {
+    return this.roleService.delete(params.id);
+  }
+};
+__decorate14([
+  Get(),
+  isAdmin(),
+  ResMsg("roles.success.retrieved"),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", []),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "getRoles", null);
+__decorate14([
+  Get("/:id"),
+  isAdmin(),
+  Validate({ params: roleIdParam }),
+  ResMsg("roles.success.retrieved"),
+  __param5(0, Params()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "getRole", null);
+__decorate14([
+  Post(),
+  isAdmin(),
+  Validate(createRoleDto),
+  ResMsg("roles.success.created"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "createRole", null);
+__decorate14([
+  Put("/:id"),
+  isAdmin(),
+  Validate({
+    params: roleIdParam,
+    body: updateRoleDto
+  }),
+  ResMsg("roles.success.updated"),
+  __param5(0, Params()),
+  __param5(1, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object, Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "updateRole", null);
+__decorate14([
+  Delete("/:id"),
+  isAdmin(),
+  Validate({ params: roleIdParam }),
+  ResMsg("roles.success.deleted"),
+  __param5(0, Params()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "deleteRole", null);
+RoleController = __decorate14([
+  Controller("/roles"),
+  __metadata14("design:paramtypes", [typeof (_a8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a8 : Object])
+], RoleController);
+
+// src/auth/AuthController.ts
+import { Validate as Validate2 } from "najm-validation";
 import { RateLimit } from "najm-rate";
 import { createHash as createHash2 } from "crypto";
 
 // src/users/UserDto.ts
-import { z } from "zod";
-var emailField = z.string().email("Invalid email format");
-var passwordField = z.string().min(8, "Password must be at least 8 characters");
-var optionalDateField = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
-var createUserDto = z.object({
-  name: z.string().max(100).optional(),
+import { z as z2 } from "zod";
+var emailField = z2.string().email("Invalid email format");
+var passwordField = z2.string().min(8, "Password must be at least 8 characters");
+var optionalDateField = z2.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
+var createUserDto = z2.object({
+  name: z2.string().max(100).optional(),
   email: emailField,
   password: passwordField,
-  roleId: z.string().min(1).optional(),
-  image: z.string().nullish(),
-  emailVerified: z.boolean().default(false),
-  status: z.enum(["active", "inactive", "pending"]).optional()
+  roleId: z2.string().min(1).optional(),
+  image: z2.string().nullish(),
+  emailVerified: z2.boolean().default(false),
+  status: z2.enum(["active", "inactive", "pending"]).optional()
 });
 var updateUserDto = createUserDto.partial();
-var userIdParam = z.object({
-  id: z.string().min(1, "User ID is required")
+var inviteUserDto = z2.object({
+  name: z2.string().max(100).optional(),
+  email: emailField,
+  roleId: z2.string().min(1).optional(),
+  image: z2.string().nullish()
 });
-var loginDto = z.object({
+var userIdParam = z2.object({
+  id: z2.string().min(1, "User ID is required")
+});
+var loginDto = z2.object({
   email: emailField,
   password: passwordField
 });
-var changePasswordDto = z.object({
+var changePasswordDto = z2.object({
   currentPassword: passwordField,
   newPassword: passwordField
 });
-var resetPasswordDto = z.object({
+var resetPasswordDto = z2.object({
   email: emailField
 });
-var confirmResetPasswordDto = z.object({
-  token: z.string().min(10, "Invalid reset token"),
+var confirmResetPasswordDto = z2.object({
+  token: z2.string().min(10, "Invalid reset token"),
   newPassword: passwordField
 });
-var languageParam = z.object({
-  language: z.string().min(2)
+var languageParam = z2.object({
+  language: z2.string().min(2)
 });
-var emailParam = z.object({
+var emailParam = z2.object({
   email: emailField
 });
-var userIdInParam = z.object({
-  userId: z.string().min(1, "User ID is required")
+var userIdInParam = z2.object({
+  userId: z2.string().min(1, "User ID is required")
 });
-var assignRoleParams = z.object({
-  userId: z.string().min(1, "User ID is required"),
-  roleId: z.string().min(1)
+var assignRoleParams = z2.object({
+  userId: z2.string().min(1, "User ID is required"),
+  roleId: z2.string().min(1)
 });
-var userListQuery = z.object({
-  limit: z.coerce.number().int().min(1).max(100).default(50),
-  offset: z.coerce.number().int().min(0).default(0)
+var userListQuery = z2.object({
+  limit: z2.coerce.number().int().min(1).max(100).default(50),
+  offset: z2.coerce.number().int().min(0).default(0)
 });
 
 // src/auth/AuthController.ts
-var __decorate13 = function(decorators, target, key, desc) {
+var __decorate15 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata13 = function(k, v) {
+var __metadata15 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param4 = function(paramIndex, decorator) {
+var __param6 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a8;
+var _a9;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
 var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
@@ -2297,6 +2603,9 @@ var AuthController = class AuthController2 {
   async loginUser(body) {
     return this.authService.loginUser(body);
   }
+  async inviteUser(body) {
+    return this.authService.inviteUser(body);
+  }
   async refreshTokens() {
     return this.authService.refreshTokens();
   }
@@ -2316,102 +2625,113 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate13([
-  Post("/register"),
+__decorate15([
+  Post2("/register"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
-  Validate(createUserDto),
-  ResMsg("auth.success.register"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(createUserDto),
+  ResMsg2("auth.success.register"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "registerUser", null);
-__decorate13([
-  Post("/login"),
+__decorate15([
+  Post2("/login"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
-  Validate(loginDto),
-  ResMsg("auth.success.login"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(loginDto),
+  ResMsg2("auth.success.login"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
-__decorate13([
-  Post("/refresh"),
+__decorate15([
+  Post2("/invite"),
+  isAdmin(),
+  RateLimit({ limit: 20, window: "15m", key: "user" }),
+  Validate2(inviteUserDto),
+  ResMsg2("auth.success.accountInviteSent"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "inviteUser", null);
+__decorate15([
+  Post2("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
-  ResMsg("auth.success.tokenRefreshed"),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", []),
-  __metadata13("design:returntype", Promise)
+  ResMsg2("auth.success.tokenRefreshed"),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", []),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate13([
-  Post("/logout"),
+__decorate15([
+  Post2("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
-  __param4(0, User2("id")),
-  __param4(1, Headers("authorization")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String, String]),
-  __metadata13("design:returntype", Promise)
+  __param6(0, User3("id")),
+  __param6(1, Headers("authorization")),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate13([
-  Post("/change-password"),
+__decorate15([
+  Post2("/change-password"),
   isAuth(),
-  Validate(changePasswordDto),
-  ResMsg("auth.success.passwordChanged"),
-  __param4(0, User2("id")),
-  __param4(1, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String, Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(changePasswordDto),
+  ResMsg2("auth.success.passwordChanged"),
+  __param6(0, User3("id")),
+  __param6(1, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate13([
-  Get("/me"),
+__decorate15([
+  Get2("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
-  ResMsg("auth.users.success.retrieved"),
-  __param4(0, Headers("authorization")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String]),
-  __metadata13("design:returntype", Promise)
+  ResMsg2("auth.users.success.retrieved"),
+  __param6(0, Headers("authorization")),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate13([
-  Post("/forgot-password"),
+__decorate15([
+  Post2("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
-  Validate(resetPasswordDto),
-  ResMsg("auth.success.passwordResetSent"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(resetPasswordDto),
+  ResMsg2("auth.success.passwordResetSent"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate13([
-  Post("/reset-password"),
+__decorate15([
+  Post2("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
-  Validate(confirmResetPasswordDto),
-  ResMsg("auth.success.passwordReset"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(confirmResetPasswordDto),
+  ResMsg2("auth.success.passwordReset"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate13([
-  Controller("/auth"),
-  __metadata13("design:paramtypes", [typeof (_a8 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a8 : Object])
+AuthController = __decorate15([
+  Controller2("/auth"),
+  __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
-import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service3 } from "najm-core";
+import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate14 = function(decorators, target, key, desc) {
+var __decorate16 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata16 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a9;
+var _a10;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -2509,20 +2829,20 @@ var AuthResolver = class AuthResolver2 {
     await authService.warmupPasswordHash();
   }
 };
-__decorate14([
+__decorate16([
   DI(),
-  __metadata14("design:type", typeof (_a9 = typeof Container !== "undefined" && Container) === "function" ? _a9 : Object)
+  __metadata16("design:type", typeof (_a10 = typeof Container !== "undefined" && Container) === "function" ? _a10 : Object)
 ], AuthResolver.prototype, "container", void 0);
-__decorate14([
+__decorate16([
   Inject9(APP),
-  __metadata14("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
-__decorate14([
+__decorate16([
   Inject9(LOGGER),
-  __metadata14("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate14([
-  Service3(),
+AuthResolver = __decorate16([
+  Service4(),
   Meta({ layer: "plugin", order: 30 })
 ], AuthResolver);
 
@@ -2571,6 +2891,7 @@ __export(users_exports, {
   confirmResetPasswordDto: () => confirmResetPasswordDto,
   createUserDto: () => createUserDto,
   emailParam: () => emailParam,
+  inviteUserDto: () => inviteUserDto,
   languageParam: () => languageParam,
   loginDto: () => loginDto,
   resetPasswordDto: () => resetPasswordDto,
@@ -2584,233 +2905,6 @@ __export(users_exports, {
 import { Controller as Controller3 } from "najm-core";
 import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
 import { Params as Params2, Body as Body3, Query } from "najm-core";
-
-// src/roles/index.ts
-var roles_exports = {};
-__export(roles_exports, {
-  ROLES: () => ROLES,
-  ROLE_GROUPS: () => ROLE_GROUPS,
-  Role: () => Role,
-  RoleController: () => RoleController,
-  RoleGuard: () => RoleGuard,
-  RoleRepository: () => RoleRepository,
-  RoleService: () => RoleService,
-  RoleValidator: () => RoleValidator,
-  assignRoleDto: () => assignRoleDto,
-  createRoleDto: () => createRoleDto,
-  defineRoles: () => defineRoles,
-  isAdmin: () => isAdmin,
-  isAdministrator: () => isAdministrator,
-  roleIdParam: () => roleIdParam,
-  updateRoleDto: () => updateRoleDto
-});
-
-// src/roles/defineRoles.ts
-import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
-
-// src/roles/RoleGuards.ts
-import { Service as Service4 } from "najm-core";
-import { GuardParams, User as User3 } from "najm-core";
-import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate15 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata15 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param5 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var RoleGuard = class RoleGuard2 {
-  static {
-    __name(this, "RoleGuard");
-  }
-  canActivate(allowedRoles, userRole) {
-    if (!userRole)
-      return false;
-    const requiredRoles = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
-    const hasRole = requiredRoles.some((r) => r.toLowerCase() === userRole.toLowerCase());
-    if (hasRole) {
-      return { role: userRole };
-    }
-    return false;
-  }
-};
-__decorate15([
-  __param5(0, GuardParams()),
-  __param5(1, User3("role")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object, String]),
-  __metadata15("design:returntype", void 0)
-], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate15([
-  Service4()
-], RoleGuard);
-var Role = createGuard2(RoleGuard);
-var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
-var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
-
-// src/roles/defineRoles.ts
-var Role2 = createGuard3(RoleGuard);
-function defineRoles(roles, options) {
-  const ROLES2 = roles;
-  const superRoleKeys = options?.superRoles ?? [];
-  function resolveRoleValues(keys) {
-    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
-  }
-  __name(resolveRoleValues, "resolveRoleValues");
-  const guards2 = {};
-  for (const [key, value] of Object.entries(roles)) {
-    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
-    const allowedValues = resolveRoleValues([key]);
-    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
-  }
-  function createGroupGuard(keys) {
-    const values = resolveRoleValues(keys);
-    return composeGuards2(isAuth(), Role2(values));
-  }
-  __name(createGroupGuard, "createGroupGuard");
-  function hasRole(userRole, ...keys) {
-    if (!userRole)
-      return false;
-    const normalized = userRole.toLowerCase();
-    return resolveRoleValues(keys).some((role) => role === normalized);
-  }
-  __name(hasRole, "hasRole");
-  function isInGroup(userRole, keys) {
-    return hasRole(userRole, ...keys);
-  }
-  __name(isInGroup, "isInGroup");
-  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
-}
-__name(defineRoles, "defineRoles");
-
-// src/roles/RoleController.ts
-import { Controller as Controller2 } from "najm-core";
-import { Get as Get2, Post as Post2, Put, Delete, ResMsg as ResMsg2 } from "najm-core";
-import { Params, Body as Body2 } from "najm-core";
-import { Validate as Validate2 } from "najm-validation";
-
-// src/roles/RoleDto.ts
-import { z as z2 } from "zod";
-var nameField = z2.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
-var descriptionField = z2.string().max(255, "Description too long").optional();
-var createRoleDto = z2.object({
-  name: nameField,
-  description: descriptionField
-});
-var updateRoleDto = createRoleDto.partial();
-var roleIdParam = z2.object({
-  id: z2.string().length(5, "Role ID must be 5 characters")
-});
-var assignRoleDto = z2.object({
-  userId: z2.string().length(8, "User ID must be 8 characters"),
-  roleId: z2.string().length(5, "Role ID must be 5 characters")
-});
-
-// src/roles/RoleController.ts
-var __decorate16 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata16 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param6 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var _a10;
-var RoleController = class RoleController2 {
-  static {
-    __name(this, "RoleController");
-  }
-  roleService;
-  constructor(roleService) {
-    this.roleService = roleService;
-  }
-  async getRoles() {
-    return this.roleService.getAll();
-  }
-  async getRole(params) {
-    return this.roleService.getById(params.id);
-  }
-  async createRole(body) {
-    return this.roleService.create(body);
-  }
-  async updateRole(params, body) {
-    return this.roleService.update(params.id, body);
-  }
-  async deleteRole(params) {
-    return this.roleService.delete(params.id);
-  }
-};
-__decorate16([
-  Get2(),
-  isAdmin(),
-  ResMsg2("roles.success.retrieved"),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", []),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "getRoles", null);
-__decorate16([
-  Get2("/:id"),
-  isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.retrieved"),
-  __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "getRole", null);
-__decorate16([
-  Post2(),
-  isAdmin(),
-  Validate2(createRoleDto),
-  ResMsg2("roles.success.created"),
-  __param6(0, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "createRole", null);
-__decorate16([
-  Put("/:id"),
-  isAdmin(),
-  Validate2({
-    params: roleIdParam,
-    body: updateRoleDto
-  }),
-  ResMsg2("roles.success.updated"),
-  __param6(0, Params()),
-  __param6(1, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object, Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "updateRole", null);
-__decorate16([
-  Delete("/:id"),
-  isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.deleted"),
-  __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate16([
-  Controller2("/roles"),
-  __metadata16("design:paramtypes", [typeof (_a10 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a10 : Object])
-], RoleController);
-
-// src/users/UserController.ts
 import { Validate as Validate3 } from "najm-validation";
 var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -4294,7 +4388,16 @@ var en_default = {
       passwordChanged: "Password changed successfully",
       passwordResetSent: "If that email exists, a reset link has been sent",
       passwordReset: "Password has been reset successfully",
+      accountInviteSent: "Invitation sent successfully",
       tokenRefreshed: "Token refreshed successfully"
+    },
+    emails: {
+      passwordReset: {
+        subject: "Reset your password"
+      },
+      accountInvite: {
+        subject: "You've been invited \u2014 set up your account"
+      }
     }
   },
   users: {
@@ -4619,6 +4722,7 @@ export {
   formatDate,
   getAuthLocale,
   getAvatarFile,
+  inviteUserDto,
   isAdmin,
   isAdministrator,
   isAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "1.1.41",
+  "version": "1.1.43",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -74,12 +74,12 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^1.1.14",
-    "najm-core": "^1.2.12",
+    "najm-core": "^1.2.14",
     "najm-database": "^1.1.16",
     "najm-guard": "^1.1.14",
     "najm-i18n": "^1.1.14",
     "najm-cache": "^1.2.11",
-    "najm-email": "^1.1.14",
+    "najm-email": "^1.1.15",
     "najm-rate": "^1.1.14",
     "najm-validation": "^1.1.15",
     "jsonwebtoken": "^9.0.3",