najm-auth 1.1.42 → 1.1.44

package/dist/index.d.ts

@@ -1050,6 +1050,19 @@ type UserIdInParam = z.infer<typeof userIdInParam>;
 type AssignRoleParams = z.infer<typeof assignRoleParams>;
 type UserListQuery = z.infer<typeof userListQuery>;
 
+/**
+ * Identity fields for creating a user behind a person record (parent, student,
+ * teacher, staff…). Role can be given by name (`role`) or id (`roleId`).
+ */
+type ProvisionUserInput = {
+    id?: string;
+    name?: string;
+    email: string;
+    role?: string;
+    roleId?: string;
+    image?: string | null;
+    status?: 'active' | 'inactive' | 'pending';
+};
 declare class AuthService {
     private tokenService;
     private userService;
@@ -1077,7 +1090,18 @@ declare class AuthService {
      * Email is best-effort: a send failure logs a warning but never rolls back
      * account creation (and with the console provider, nothing is actually sent).
      */
-    inviteUser(body: InviteUserDto): Promise<SanitizedUser>;
+    inviteUser(body: ProvisionUserInput): Promise<SanitizedUser>;
+    /**
+     * Create a login for a person record. The branch is intentional and is the
+     * single rule callers rely on:
+     *   - password provided  → set it directly, NO email (seeding / imports)
+     *   - no password        → random password + emailed set-password invite
+     *
+     * Returns the created (sanitized) user so the caller can link `userId`.
+     */
+    provisionUser(body: ProvisionUserInput & {
+        password?: string | null;
+    }): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<TokenPair & {
         user: SanitizedUser;
     }>;
@@ -1175,6 +1199,13 @@ declare class AuthResolver {
     private container;
     private app;
     private log;
+    /**
+     * Missing/stale/invalid credentials (4xx) are an expected client state on
+     * these resolve paths — e.g. a refresh cookie that outlived its DB row
+     * after a reseed or rotation. Log those at debug; reserve warn for
+     * unexpected (5xx/non-HTTP) failures.
+     */
+    private logResolveMiss;
     resolve(token: string): Promise<{
         user: any;
         role?: string;
@@ -2100,4 +2131,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -2007,12 +2007,14 @@ var AuthService = class AuthService2 {
   async inviteUser(body) {
     const randomPassword = `${nanoid5(24)}Aa1!`;
     const user = await this.userService.create({
+      id: body.id,
       name: body.name,
       email: body.email,
+      role: body.role,
       roleId: body.roleId,
       image: body.image,
       password: randomPassword,
-      status: "active",
+      status: body.status ?? "active",
       emailVerified: false
     });
     const { token } = await this.tokenService.generateInviteToken(user.id);
@@ -2027,6 +2029,30 @@ var AuthService = class AuthService2 {
     }
     return user;
   }
+  /**
+   * Create a login for a person record. The branch is intentional and is the
+   * single rule callers rely on:
+   *   - password provided  → set it directly, NO email (seeding / imports)
+   *   - no password        → random password + emailed set-password invite
+   *
+   * Returns the created (sanitized) user so the caller can link `userId`.
+   */
+  async provisionUser(body) {
+    const password = typeof body.password === "string" ? body.password.trim() : "";
+    if (password) {
+      return this.userService.create({
+        id: body.id,
+        name: body.name,
+        email: body.email,
+        role: body.role,
+        roleId: body.roleId,
+        image: body.image,
+        password,
+        status: body.status ?? "active"
+      });
+    }
+    return this.inviteUser(body);
+  }
   async loginUser(body) {
     const { email: email2, password } = body;
     const user = await this.userService.findByEmail(email2);
@@ -2713,6 +2739,20 @@ var AuthResolver = class AuthResolver2 {
   container;
   app;
   log;
+  /**
+   * Missing/stale/invalid credentials (4xx) are an expected client state on
+   * these resolve paths — e.g. a refresh cookie that outlived its DB row
+   * after a reseed or rotation. Log those at debug; reserve warn for
+   * unexpected (5xx/non-HTTP) failures.
+   */
+  logResolveMiss(message, error) {
+    const status = error?.status;
+    if (typeof status === "number" && status < 500) {
+      this.log.debug(message, error);
+    } else {
+      this.log.warn(message, error);
+    }
+  }
   async resolve(token) {
     if (!token)
       return false;
@@ -2728,7 +2768,7 @@ var AuthResolver = class AuthResolver2 {
         permissions: user.permissions
       };
     } catch (error) {
-      this.log.warn("Token verification failed", error);
+      this.logResolveMiss("Token verification failed", error);
       return false;
     }
   }
@@ -2744,7 +2784,7 @@ var AuthResolver = class AuthResolver2 {
         permissions: session.permissions
       };
     } catch (error) {
-      this.log.warn("Session cookie verification failed", error);
+      this.logResolveMiss("Session cookie verification failed", error);
       return false;
     }
   }
@@ -2768,7 +2808,7 @@ var AuthResolver = class AuthResolver2 {
         permissions: user.permissions
       };
     } catch (error) {
-      this.log.warn("Cookie verification failed", error);
+      this.logResolveMiss("Cookie verification failed", error);
       return false;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "1.1.42",
+  "version": "1.1.44",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [