najm-auth 1.1.44 → 2.0.1

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err8, plugin } from "najm-core";
+import { Err as Err9, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -290,6 +290,9 @@ var CookieManager = class CookieManager2 {
   get cookieName() {
     return this.config.refreshCookieName || "refreshToken";
   }
+  get refreshCookiePath() {
+    return this.config.refreshCookiePath || "/";
+  }
   get sessionCookieName() {
     return this.config.session.name;
   }
@@ -304,10 +307,10 @@ var CookieManager = class CookieManager2 {
   // =========================================================================
   setRefreshToken(refreshToken) {
     const maxAge = timestring(this.config.jwt.refreshExpiresIn, "s");
-    this.cookieService.set(this.cookieName, refreshToken, { maxAge });
+    this.cookieService.set(this.cookieName, refreshToken, { maxAge, path: this.refreshCookiePath });
   }
   clearRefreshToken() {
-    this.cookieService.delete(this.cookieName);
+    this.cookieService.delete(this.cookieName, { path: this.refreshCookiePath });
   }
   getRefreshToken() {
     return this.cookieService.get(this.cookieName);
@@ -373,14 +376,14 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller as Controller2 } from "najm-core";
-import { Get as Get2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
-import { Body as Body2, User as User3, Headers } from "najm-core";
+import { Controller } from "najm-core";
+import { Get, Post, ResMsg } from "najm-core";
+import { Body, User as User3, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
-import { Err as Err6, Log } from "najm-core";
-import { I18n as I18n5, I18nService as I18nService2 } from "najm-i18n";
+import { Err as Err7, Log } from "najm-core";
+import { I18n as I18n6, I18nService as I18nService2 } from "najm-i18n";
 import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
 import { nanoid as nanoid5 } from "nanoid";
 
@@ -388,7 +391,7 @@ import { nanoid as nanoid5 } from "nanoid";
 import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
 import { Transaction } from "najm-database";
 import { I18nService } from "najm-i18n";
-import { I18n as I18n3 } from "najm-i18n";
+import { I18n as I18n4 } from "najm-i18n";
 
 // src/users/UserRepository.ts
 import { eq as eq2, ne, sql as sql3 } from "drizzle-orm";
@@ -758,7 +761,8 @@ UserValidator = __decorate4([
 ], UserValidator);
 
 // src/roles/RoleService.ts
-import { Injectable as Injectable4 } from "najm-core";
+import { Injectable as Injectable4, Err as Err3 } from "najm-core";
+import { I18n as I18n3 } from "najm-i18n";
 
 // src/roles/RoleRepository.ts
 import { eq as eq3 } from "drizzle-orm";
@@ -782,6 +786,14 @@ var RoleRepository = class RoleRepository2 {
   get roles() {
     return this.schema.roles;
   }
+  get users() {
+    return this.schema.users;
+  }
+  /** True if any user currently references this role (blocks deletion). */
+  async hasUsers(roleId) {
+    const rows = await this.db.select({ id: this.users.id }).from(this.users).where(eq3(this.users.roleId, roleId)).limit(1);
+    return rows.length > 0;
+  }
   async getAll() {
     return await this.db.select().from(this.roles);
   }
@@ -917,6 +929,7 @@ var RoleService = class RoleService2 {
   }
   roleRepository;
   roleValidator;
+  t;
   constructor(roleRepository, roleValidator) {
     this.roleRepository = roleRepository;
     this.roleValidator = roleValidator;
@@ -936,12 +949,21 @@ var RoleService = class RoleService2 {
     return await this.roleRepository.create(data);
   }
   async update(id, data) {
-    await this.roleValidator.checkRoleExists(id);
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN && data.name && data.name !== ROLES.ADMIN) {
+      Err3(this.t("errors.cannotRenameSystem"), 403);
+    }
     await this.roleValidator.checkNameUnique(data.name, id);
     return await this.roleRepository.update(id, data);
   }
   async delete(id) {
-    await this.roleValidator.checkRoleExists(id);
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN) {
+      Err3(this.t("errors.cannotDeleteSystem"), 403);
+    }
+    if (await this.roleRepository.hasUsers(id)) {
+      Err3(this.t("errors.roleInUse"), 409);
+    }
     return await this.roleRepository.delete(id);
   }
   async seedDefaultRoles(defaultRoles) {
@@ -960,6 +982,10 @@ var RoleService = class RoleService2 {
     return role?.id;
   }
 };
+__decorate7([
+  I18n3("roles"),
+  __metadata7("design:type", Object)
+], RoleService.prototype, "t", void 0);
 RoleService = __decorate7([
   Injectable4(),
   __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
@@ -972,7 +998,7 @@ import { nanoid as nanoid3 } from "nanoid";
 import * as fs from "fs/promises";
 import * as path from "path";
 import _isEmpty from "lodash.isempty";
-import { Err as Err3 } from "najm-core";
+import { Err as Err4 } from "najm-core";
 var avatarsPath = path.join(process.cwd(), "avatars");
 var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
   try {
@@ -980,7 +1006,7 @@ var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
   } catch (error) {
     const errors = error.issues || error.errors || [];
     const errorMessage = errors.map((err) => `${err.path.join(".")}: ${err.message}`).join("; ");
-    Err3(errorMessage);
+    Err4(errorMessage);
   }
 }, "parseSchema");
 var clean = /* @__PURE__ */ __name((obj) => {
@@ -1066,7 +1092,7 @@ var isPath = /* @__PURE__ */ __name((img) => typeof img === "string" && img.trim
 var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" && img instanceof File, "isFile");
 
 // src/users/UserService.ts
-import { Err as Err4 } from "najm-core";
+import { Err as Err5 } from "najm-core";
 var __decorate8 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1121,7 +1147,7 @@ var UserService = class UserService2 {
   }
   requireUser(user) {
     if (!user) {
-      Err4(this.t("errors.notFound"), 404);
+      Err5(this.t("errors.notFound"), 404);
     }
     return user;
   }
@@ -1135,12 +1161,12 @@ var UserService = class UserService2 {
       if (roleByName) {
         return roleByName.id;
       }
-      Err4(`Role '${roleName}' not found`);
+      Err5(`Role '${roleName}' not found`);
     }
     if (this.authConfig.defaultRole) {
       const defaultRole = await this.roleService.getByName(this.authConfig.defaultRole);
       if (!defaultRole) {
-        Err4(`Default role '${this.authConfig.defaultRole}' not found. Create it first or set defaultRole to null in auth config.`);
+        Err5(`Default role '${this.authConfig.defaultRole}' not found. Create it first or set defaultRole to null in auth config.`);
       }
       return defaultRole.id;
     }
@@ -1173,7 +1199,7 @@ var UserService = class UserService2 {
   async create(data) {
     const { id, email: email2, name, image, emailVerified, password, roleId, role } = data;
     if (!password || typeof password !== "string" || password.trim().length === 0) {
-      Err4("Password is required");
+      Err5("Password is required");
     }
     this.userValidator.validatePasswordStrength(password);
     let userId = id || nanoid3(10);
@@ -1247,10 +1273,10 @@ var UserService = class UserService2 {
   }
   async seedAdminUser(config) {
     if (!config?.email || !config?.password) {
-      Err4("Admin email and password must be provided via config parameter");
+      Err5("Admin email and password must be provided via config parameter");
     }
     if (config.password.length < 12) {
-      Err4("Admin password must be at least 12 characters");
+      Err5("Admin password must be at least 12 characters");
     }
     const adminRole = await this.roleValidator.checkAdminRoleExists();
     const existingUser = await this.userRepository.getByEmail(config.email);
@@ -1279,7 +1305,7 @@ var UserService = class UserService2 {
   }
 };
 __decorate8([
-  I18n3("users"),
+  I18n4("users"),
   __metadata8("design:type", Object)
 ], UserService.prototype, "t", void 0);
 __decorate8([
@@ -1296,7 +1322,7 @@ UserService = __decorate8([
 
 // src/tokens/TokenService.ts
 import { Injectable as Injectable6, Inject as Inject7 } from "najm-core";
-import { I18n as I18n4 } from "najm-i18n";
+import { I18n as I18n5 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
@@ -1413,7 +1439,7 @@ TokenRepository = __decorate9([
 
 // src/tokens/TokenService.ts
 import timestring2 from "timestring";
-import { Err as Err5 } from "najm-core";
+import { Err as Err6 } from "najm-core";
 var __decorate10 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1482,7 +1508,7 @@ var TokenService = class TokenService2 {
     if (authorization?.startsWith("Bearer ")) {
       return authorization.split(" ")[1];
     }
-    Err5(this.t("errors.tokenMissing"));
+    Err6(this.t("errors.tokenMissing"));
   }
   /**
    * Verify access token and check blacklist
@@ -1493,7 +1519,7 @@ var TokenService = class TokenService2 {
     try {
       payload = jwt.verify(token, this.config.jwt.accessSecret);
     } catch {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
@@ -1506,15 +1532,15 @@ var TokenService = class TokenService2 {
     const values = await this.getCacheValues(keys);
     const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
     if (blacklistKey && valueByKey.get(blacklistKey) != null) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     if (familyKey && valueByKey.get(familyKey) != null) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     return payload;
   }
@@ -1523,13 +1549,13 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     if (decoded.type && decoded.type !== "refresh") {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     if (!decoded.tokenFamily) {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
@@ -1548,12 +1574,12 @@ var TokenService = class TokenService2 {
   async resolveUserFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err5(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"));
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1563,7 +1589,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return userId;
     }
-    Err5(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"));
   }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
   async getUser(auth2) {
@@ -1604,7 +1630,15 @@ var TokenService = class TokenService2 {
       await this.cache.set(this.sessionVersionKey(data.userId), String(sessionVersion), this.accessTokenTtlMs());
     }
     const token = jwt.sign({ ...data, jti, sessionVersion, exp: expiresAt }, this.config.jwt.accessSecret);
-    return { token, expiresAt };
+    return { token, expiresAt, sessionVersion };
+  }
+  /**
+   * Current per-user session version (0 when never invalidated). The signed
+   * session cookie stamps this so a fast-path reader can reject a cookie whose
+   * session was invalidated after it was written.
+   */
+  async getSessionVersion(userId) {
+    return this.getUserSessionVersion(userId);
   }
   /**
    * Generate access token with unique jti for blacklist support.
@@ -1643,6 +1677,7 @@ var TokenService = class TokenService2 {
       tokenFamily: family,
       roles: accessTokenData.roles,
       permissions: accessTokenData.permissions,
+      sessionVersion: access.sessionVersion,
       accessToken: access.token,
       refreshToken: refresh.token,
       accessTokenExpiresAt: access.expiresAt,
@@ -1710,12 +1745,12 @@ var TokenService = class TokenService2 {
   async refreshTokens() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err5(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"));
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1725,12 +1760,12 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
-        Err5(this.t("errors.refreshTokenInvalid"));
+        Err6(this.t("errors.refreshTokenInvalid"));
       }
       return this.generateTokens(userId, tokenFamily);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err5(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"));
   }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
@@ -1762,7 +1797,7 @@ var TokenService = class TokenService2 {
     const userId = await this.resolveUserFromCookie();
     const user = await this.getUserById(userId);
     if (!user) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     return user;
   }
@@ -1904,15 +1939,15 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err5(this.t("errors.resetTokenExpired"));
+      Err6(this.t("errors.resetTokenExpired"));
     }
     if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
-      Err5(this.t("errors.invalidResetToken"));
+      Err6(this.t("errors.invalidResetToken"));
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
     const storedJti = await this.cache.get(key);
     if (!storedJti || storedJti !== decoded.jti) {
-      Err5(this.t("errors.invalidResetToken"));
+      Err6(this.t("errors.invalidResetToken"));
     }
     await this.cache.del(key);
     return decoded.userId;
@@ -1926,7 +1961,7 @@ __decorate10([
   __metadata10("design:type", Object)
 ], TokenService.prototype, "config", void 0);
 __decorate10([
-  I18n4("auth"),
+  I18n5("auth"),
   __metadata10("design:type", Object)
 ], TokenService.prototype, "t", void 0);
 TokenService = TokenService_1 = __decorate10([
@@ -1993,7 +2028,13 @@ var AuthService = class AuthService2 {
     await this.getDummyHash();
   }
   async registerUser(body) {
-    return await this.userService.create(body);
+    return await this.userService.create({
+      name: body.name,
+      email: body.email,
+      password: body.password,
+      image: body.image,
+      emailVerified: false
+    });
   }
   /**
    * Admin-initiated account creation. The user is created with a random,
@@ -2019,15 +2060,17 @@ var AuthService = class AuthService2 {
     });
     const { token } = await this.tokenService.generateInviteToken(user.id);
     const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    let emailSent = false;
     try {
       await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
         inviteLink,
         userName: user.name || body.email
       }));
+      emailSent = true;
     } catch (error) {
       this.logger.warn("Account invite email failed", { email: body.email, error });
     }
-    return user;
+    return { ...user, emailSent };
   }
   /**
    * Create a login for a person record. The branch is intentional and is the
@@ -2062,7 +2105,7 @@ var AuthService = class AuthService2 {
       user.lockoutUntil = null;
     }
     if (user && this.isLockoutActive(user.lockoutUntil)) {
-      Err6(this.t("errors.accountLocked"), 423);
+      Err7(this.t("errors.accountLocked"), 423);
     }
     const storedHash = user?.password ?? await this.getDummyHash();
     const isValid = await this.userValidator.comparePassword(password, storedHash);
@@ -2071,13 +2114,16 @@ var AuthService = class AuthService2 {
         const attempts = await this.userService.incrementFailedAttempts(user.id);
         if (attempts >= this.config.lockout.maxAttempts) {
           await this.userService.setLockout(user.id, this.nextLockoutUntil());
-          Err6(this.t("errors.accountLocked"), 423);
+          Err7(this.t("errors.accountLocked"), 423);
         }
       }
-      Err6(this.t("errors.invalidCredentials"));
+      Err7(this.t("errors.invalidCredentials"));
     }
     if (user.status !== "active") {
-      Err6(this.t("errors.accountInactive"));
+      Err7(this.t("errors.accountInactive"));
+    }
+    if (this.config.requireVerifiedEmail && !user.emailVerified) {
+      Err7(this.t("errors.emailNotVerified"), 403);
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
@@ -2087,13 +2133,14 @@ var AuthService = class AuthService2 {
     this.cookieManager.setRefreshToken(generated.refreshToken);
     await this.userService.updateLastLogin(user.id);
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
-    const { roles, permissions } = generated;
+    const { roles, permissions, sessionVersion } = generated;
     this.cookieManager.setSessionCookie({
       user: { id: sanitized.id, email: sanitized.email, name: sanitized.name, role: sanitized.role, status: sanitized.status ?? void 0 },
       roles,
-      permissions
+      permissions,
+      sessionVersion
     });
-    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
     return { ...tokens, user: sanitized };
   }
   async refreshTokens() {
@@ -2104,10 +2151,11 @@ var AuthService = class AuthService2 {
       this.cookieManager.setSessionCookie({
         user: { id: user.id, email: user.email, name: user.name, role: user.role, status: user.status ?? void 0 },
         roles: generated.roles,
-        permissions: generated.permissions
+        permissions: generated.permissions,
+        sessionVersion: generated.sessionVersion
       });
     }
-    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
     return tokens;
   }
   async logoutUser(userId, authorization) {
@@ -2153,7 +2201,7 @@ var AuthService = class AuthService2 {
         const lang = this.i18nService.getCurrentLanguage();
         result = { ...user, language: lang };
         const token = this.tokenService.decodeAccessToken(authorization.replace(/^Bearer\s+/i, ""));
-        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [] };
+        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [], sessionVersion: token?.sessionVersion ?? 0 };
       } else {
         result = await this.getUserFromCookie();
       }
@@ -2164,7 +2212,8 @@ var AuthService = class AuthService2 {
       this.cookieManager.setSessionCookie({
         user: { id: result.id, email: result.email, name: result.name, role: result.role, status: result.status ?? void 0 },
         roles: cachePayload.roles,
-        permissions: cachePayload.permissions
+        permissions: cachePayload.permissions,
+        sessionVersion: cachePayload.sessionVersion
       });
     }
     return result;
@@ -2188,11 +2237,11 @@ var AuthService = class AuthService2 {
   async changePassword(userId, currentPassword, newPassword) {
     const user = await this.userService.getAuthRecordById(userId);
     if (!user?.password) {
-      Err6(this.t("errors.invalidCredentials"));
+      Err7(this.t("errors.invalidCredentials"));
     }
     const isValid = await this.userValidator.comparePassword(currentPassword, user.password);
     if (!isValid) {
-      Err6(this.t("errors.invalidCredentials"));
+      Err7(this.t("errors.invalidCredentials"));
     }
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
@@ -2218,7 +2267,7 @@ __decorate11([
   __metadata11("design:type", Object)
 ], AuthService.prototype, "config", void 0);
 __decorate11([
-  I18n5("auth"),
+  I18n6("auth"),
   __metadata11("design:type", Object)
 ], AuthService.prototype, "t", void 0);
 __decorate11([
@@ -2266,29 +2315,6 @@ AuthGuard = __decorate12([
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
 
-// src/roles/index.ts
-var roles_exports = {};
-__export(roles_exports, {
-  ROLES: () => ROLES,
-  ROLE_GROUPS: () => ROLE_GROUPS,
-  Role: () => Role,
-  RoleController: () => RoleController,
-  RoleGuard: () => RoleGuard,
-  RoleRepository: () => RoleRepository,
-  RoleService: () => RoleService,
-  RoleValidator: () => RoleValidator,
-  assignRoleDto: () => assignRoleDto,
-  createRoleDto: () => createRoleDto,
-  defineRoles: () => defineRoles,
-  isAdmin: () => isAdmin,
-  isAdministrator: () => isAdministrator,
-  roleIdParam: () => roleIdParam,
-  updateRoleDto: () => updateRoleDto
-});
-
-// src/roles/defineRoles.ts
-import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
-
 // src/roles/RoleGuards.ts
 import { Service as Service3 } from "najm-core";
 import { GuardParams, User as User2 } from "najm-core";
@@ -2336,239 +2362,90 @@ var Role = createGuard2(RoleGuard);
 var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
 var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
-// src/roles/defineRoles.ts
-var Role2 = createGuard3(RoleGuard);
-function defineRoles(roles, options) {
-  const ROLES2 = roles;
-  const superRoleKeys = options?.superRoles ?? [];
-  function resolveRoleValues(keys) {
-    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
-  }
-  __name(resolveRoleValues, "resolveRoleValues");
-  const guards2 = {};
-  for (const [key, value] of Object.entries(roles)) {
-    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
-    const allowedValues = resolveRoleValues([key]);
-    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
-  }
-  function createGroupGuard(keys) {
-    const values = resolveRoleValues(keys);
-    return composeGuards2(isAuth(), Role2(values));
-  }
-  __name(createGroupGuard, "createGroupGuard");
-  function hasRole(userRole, ...keys) {
-    if (!userRole)
-      return false;
-    const normalized = userRole.toLowerCase();
-    return resolveRoleValues(keys).some((role) => role === normalized);
-  }
-  __name(hasRole, "hasRole");
-  function isInGroup(userRole, keys) {
-    return hasRole(userRole, ...keys);
-  }
-  __name(isInGroup, "isInGroup");
-  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
-}
-__name(defineRoles, "defineRoles");
-
-// src/roles/RoleController.ts
-import { Controller } from "najm-core";
-import { Get, Post, Put, Delete, ResMsg } from "najm-core";
-import { Params, Body } from "najm-core";
-import { Validate } from "najm-validation";
-
-// src/roles/RoleDto.ts
-import { z } from "zod";
-var nameField = z.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
-var descriptionField = z.string().max(255, "Description too long").optional();
-var createRoleDto = z.object({
-  name: nameField,
-  description: descriptionField
-});
-var updateRoleDto = createRoleDto.partial();
-var roleIdParam = z.object({
-  id: z.string().length(5, "Role ID must be 5 characters")
-});
-var assignRoleDto = z.object({
-  userId: z.string().length(8, "User ID must be 8 characters"),
-  roleId: z.string().length(5, "Role ID must be 5 characters")
-});
-
-// src/roles/RoleController.ts
-var __decorate14 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata14 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param5 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var _a8;
-var RoleController = class RoleController2 {
-  static {
-    __name(this, "RoleController");
-  }
-  roleService;
-  constructor(roleService) {
-    this.roleService = roleService;
-  }
-  async getRoles() {
-    return this.roleService.getAll();
-  }
-  async getRole(params) {
-    return this.roleService.getById(params.id);
-  }
-  async createRole(body) {
-    return this.roleService.create(body);
-  }
-  async updateRole(params, body) {
-    return this.roleService.update(params.id, body);
-  }
-  async deleteRole(params) {
-    return this.roleService.delete(params.id);
-  }
-};
-__decorate14([
-  Get(),
-  isAdmin(),
-  ResMsg("roles.success.retrieved"),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", []),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "getRoles", null);
-__decorate14([
-  Get("/:id"),
-  isAdmin(),
-  Validate({ params: roleIdParam }),
-  ResMsg("roles.success.retrieved"),
-  __param5(0, Params()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "getRole", null);
-__decorate14([
-  Post(),
-  isAdmin(),
-  Validate(createRoleDto),
-  ResMsg("roles.success.created"),
-  __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "createRole", null);
-__decorate14([
-  Put("/:id"),
-  isAdmin(),
-  Validate({
-    params: roleIdParam,
-    body: updateRoleDto
-  }),
-  ResMsg("roles.success.updated"),
-  __param5(0, Params()),
-  __param5(1, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object, Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "updateRole", null);
-__decorate14([
-  Delete("/:id"),
-  isAdmin(),
-  Validate({ params: roleIdParam }),
-  ResMsg("roles.success.deleted"),
-  __param5(0, Params()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate14([
-  Controller("/roles"),
-  __metadata14("design:paramtypes", [typeof (_a8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a8 : Object])
-], RoleController);
-
 // src/auth/AuthController.ts
-import { Validate as Validate2 } from "najm-validation";
+import { Validate } from "najm-validation";
 import { RateLimit } from "najm-rate";
 import { createHash as createHash2 } from "crypto";
 
 // src/users/UserDto.ts
-import { z as z2 } from "zod";
-var emailField = z2.string().email("Invalid email format");
-var passwordField = z2.string().min(8, "Password must be at least 8 characters");
-var optionalDateField = z2.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
-var createUserDto = z2.object({
-  name: z2.string().max(100).optional(),
+import { z } from "zod";
+var emailField = z.string().email("Invalid email format");
+var passwordField = z.string().min(8, "Password must be at least 8 characters").refine((v) => new TextEncoder().encode(v).length <= 72, "Password must be at most 72 bytes").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/\d/, "Password must contain at least one number");
+var optionalDateField = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
+var createUserDto = z.object({
+  name: z.string().max(100).optional(),
   email: emailField,
   password: passwordField,
-  roleId: z2.string().min(1).optional(),
-  image: z2.string().nullish(),
-  emailVerified: z2.boolean().default(false),
-  status: z2.enum(["active", "inactive", "pending"]).optional()
+  roleId: z.string().min(1).optional(),
+  image: z.string().nullish(),
+  emailVerified: z.boolean().default(false),
+  status: z.enum(["active", "inactive", "pending"]).optional()
 });
 var updateUserDto = createUserDto.partial();
-var inviteUserDto = z2.object({
-  name: z2.string().max(100).optional(),
+var registerDto = z.object({
+  name: z.string().max(100).optional(),
   email: emailField,
-  roleId: z2.string().min(1).optional(),
-  image: z2.string().nullish()
+  password: passwordField,
+  image: z.string().nullish()
 });
-var userIdParam = z2.object({
-  id: z2.string().min(1, "User ID is required")
+var inviteUserDto = z.object({
+  name: z.string().max(100).optional(),
+  email: emailField,
+  roleId: z.string().min(1).optional(),
+  image: z.string().nullish()
 });
-var loginDto = z2.object({
+var userIdParam = z.object({
+  id: z.string().min(1, "User ID is required")
+});
+var loginDto = z.object({
   email: emailField,
   password: passwordField
 });
-var changePasswordDto = z2.object({
+var changePasswordDto = z.object({
   currentPassword: passwordField,
   newPassword: passwordField
 });
-var resetPasswordDto = z2.object({
+var resetPasswordDto = z.object({
   email: emailField
 });
-var confirmResetPasswordDto = z2.object({
-  token: z2.string().min(10, "Invalid reset token"),
+var confirmResetPasswordDto = z.object({
+  token: z.string().min(10, "Invalid reset token"),
   newPassword: passwordField
 });
-var languageParam = z2.object({
-  language: z2.string().min(2)
+var languageParam = z.object({
+  language: z.string().min(2)
 });
-var emailParam = z2.object({
+var emailParam = z.object({
   email: emailField
 });
-var userIdInParam = z2.object({
-  userId: z2.string().min(1, "User ID is required")
+var userIdInParam = z.object({
+  userId: z.string().min(1, "User ID is required")
 });
-var assignRoleParams = z2.object({
-  userId: z2.string().min(1, "User ID is required"),
-  roleId: z2.string().min(1)
+var assignRoleParams = z.object({
+  userId: z.string().min(1, "User ID is required"),
+  roleId: z.string().min(1)
 });
-var userListQuery = z2.object({
-  limit: z2.coerce.number().int().min(1).max(100).default(50),
-  offset: z2.coerce.number().int().min(0).default(0)
+var userListQuery = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+  offset: z.coerce.number().int().min(0).default(0)
 });
 
 // src/auth/AuthController.ts
-var __decorate15 = function(decorators, target, key, desc) {
+var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata15 = function(k, v) {
+var __metadata14 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param6 = function(paramIndex, decorator) {
+var __param5 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a9;
+var _a8;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
 var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
@@ -2625,113 +2502,113 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate15([
-  Post2("/register"),
+__decorate14([
+  Post("/register"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
-  Validate2(createUserDto),
-  ResMsg2("auth.success.register"),
-  __param6(0, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(registerDto),
+  ResMsg("auth.success.register"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "registerUser", null);
-__decorate15([
-  Post2("/login"),
+__decorate14([
+  Post("/login"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
-  Validate2(loginDto),
-  ResMsg2("auth.success.login"),
-  __param6(0, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(loginDto),
+  ResMsg("auth.success.login"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
-__decorate15([
-  Post2("/invite"),
+__decorate14([
+  Post("/invite"),
   isAdmin(),
   RateLimit({ limit: 20, window: "15m", key: "user" }),
-  Validate2(inviteUserDto),
-  ResMsg2("auth.success.accountInviteSent"),
-  __param6(0, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(inviteUserDto),
+  ResMsg("auth.success.accountInviteSent"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "inviteUser", null);
-__decorate15([
-  Post2("/refresh"),
+__decorate14([
+  Post("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
-  ResMsg2("auth.success.tokenRefreshed"),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", []),
-  __metadata15("design:returntype", Promise)
+  ResMsg("auth.success.tokenRefreshed"),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", []),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate15([
-  Post2("/logout"),
+__decorate14([
+  Post("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
-  __param6(0, User3("id")),
-  __param6(1, Headers("authorization")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, String]),
-  __metadata15("design:returntype", Promise)
+  __param5(0, User3("id")),
+  __param5(1, Headers("authorization")),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [String, String]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate15([
-  Post2("/change-password"),
+__decorate14([
+  Post("/change-password"),
   isAuth(),
-  Validate2(changePasswordDto),
-  ResMsg2("auth.success.passwordChanged"),
-  __param6(0, User3("id")),
-  __param6(1, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(changePasswordDto),
+  ResMsg("auth.success.passwordChanged"),
+  __param5(0, User3("id")),
+  __param5(1, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [String, Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate15([
-  Get2("/me"),
+__decorate14([
+  Get("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
-  ResMsg2("auth.users.success.retrieved"),
-  __param6(0, Headers("authorization")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String]),
-  __metadata15("design:returntype", Promise)
+  ResMsg("auth.users.success.retrieved"),
+  __param5(0, Headers("authorization")),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [String]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate15([
-  Post2("/forgot-password"),
+__decorate14([
+  Post("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
-  Validate2(resetPasswordDto),
-  ResMsg2("auth.success.passwordResetSent"),
-  __param6(0, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(resetPasswordDto),
+  ResMsg("auth.success.passwordResetSent"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate15([
-  Post2("/reset-password"),
+__decorate14([
+  Post("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
-  Validate2(confirmResetPasswordDto),
-  ResMsg2("auth.success.passwordReset"),
-  __param6(0, Body2()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  Validate(confirmResetPasswordDto),
+  ResMsg("auth.success.passwordReset"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate15([
-  Controller2("/auth"),
-  __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
+AuthController = __decorate14([
+  Controller("/auth"),
+  __metadata14("design:paramtypes", [typeof (_a8 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a8 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
 import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate16 = function(decorators, target, key, desc) {
+var __decorate15 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata16 = function(k, v) {
+var __metadata15 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a10;
+var _a9;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -2778,6 +2655,10 @@ var AuthResolver = class AuthResolver2 {
       const session = cookieManager.getSessionCookie();
       if (!session)
         return false;
+      const tokenService = await this.container.resolve(TokenService);
+      const currentVersion = await tokenService.getSessionVersion(session.user.id);
+      if ((session.sessionVersion ?? 0) !== currentVersion)
+        return false;
       return {
         user: { ...session.user, permissions: session.permissions },
         role: session.user.role ?? session.roles[0],
@@ -2843,19 +2724,19 @@ var AuthResolver = class AuthResolver2 {
     await authService.warmupPasswordHash();
   }
 };
-__decorate16([
+__decorate15([
   DI(),
-  __metadata16("design:type", typeof (_a10 = typeof Container !== "undefined" && Container) === "function" ? _a10 : Object)
+  __metadata15("design:type", typeof (_a9 = typeof Container !== "undefined" && Container) === "function" ? _a9 : Object)
 ], AuthResolver.prototype, "container", void 0);
-__decorate16([
+__decorate15([
   Inject9(APP),
-  __metadata16("design:type", Object)
+  __metadata15("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
-__decorate16([
+__decorate15([
   Inject9(LOGGER),
-  __metadata16("design:type", Object)
+  __metadata15("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate16([
+AuthResolver = __decorate15([
   Service4(),
   Meta({ layer: "plugin", order: 30 })
 ], AuthResolver);
@@ -2908,6 +2789,7 @@ __export(users_exports, {
   inviteUserDto: () => inviteUserDto,
   languageParam: () => languageParam,
   loginDto: () => loginDto,
+  registerDto: () => registerDto,
   resetPasswordDto: () => resetPasswordDto,
   updateUserDto: () => updateUserDto,
   userIdInParam: () => userIdInParam,
@@ -2919,6 +2801,184 @@ __export(users_exports, {
 import { Controller as Controller3 } from "najm-core";
 import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
 import { Params as Params2, Body as Body3, Query } from "najm-core";
+
+// src/roles/index.ts
+var roles_exports = {};
+__export(roles_exports, {
+  ROLES: () => ROLES,
+  ROLE_GROUPS: () => ROLE_GROUPS,
+  Role: () => Role,
+  RoleController: () => RoleController,
+  RoleGuard: () => RoleGuard,
+  RoleRepository: () => RoleRepository,
+  RoleService: () => RoleService,
+  RoleValidator: () => RoleValidator,
+  assignRoleDto: () => assignRoleDto,
+  createRoleDto: () => createRoleDto,
+  defineRoles: () => defineRoles,
+  isAdmin: () => isAdmin,
+  isAdministrator: () => isAdministrator,
+  roleIdParam: () => roleIdParam,
+  updateRoleDto: () => updateRoleDto
+});
+
+// src/roles/defineRoles.ts
+import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
+var Role2 = createGuard3(RoleGuard);
+function defineRoles(roles, options) {
+  const ROLES2 = roles;
+  const superRoleKeys = options?.superRoles ?? [];
+  function resolveRoleValues(keys) {
+    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
+  }
+  __name(resolveRoleValues, "resolveRoleValues");
+  const guards2 = {};
+  for (const [key, value] of Object.entries(roles)) {
+    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
+    const allowedValues = resolveRoleValues([key]);
+    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
+  }
+  function createGroupGuard(keys) {
+    const values = resolveRoleValues(keys);
+    return composeGuards2(isAuth(), Role2(values));
+  }
+  __name(createGroupGuard, "createGroupGuard");
+  function hasRole(userRole, ...keys) {
+    if (!userRole)
+      return false;
+    const normalized = userRole.toLowerCase();
+    return resolveRoleValues(keys).some((role) => role === normalized);
+  }
+  __name(hasRole, "hasRole");
+  function isInGroup(userRole, keys) {
+    return hasRole(userRole, ...keys);
+  }
+  __name(isInGroup, "isInGroup");
+  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
+}
+__name(defineRoles, "defineRoles");
+
+// src/roles/RoleController.ts
+import { Controller as Controller2 } from "najm-core";
+import { Get as Get2, Post as Post2, Put, Delete, ResMsg as ResMsg2 } from "najm-core";
+import { Params, Body as Body2 } from "najm-core";
+import { Validate as Validate2 } from "najm-validation";
+
+// src/roles/RoleDto.ts
+import { z as z2 } from "zod";
+var nameField = z2.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
+var descriptionField = z2.string().max(255, "Description too long").optional();
+var createRoleDto = z2.object({
+  name: nameField,
+  description: descriptionField
+});
+var updateRoleDto = createRoleDto.partial();
+var roleIdParam = z2.object({
+  id: z2.string().length(5, "Role ID must be 5 characters")
+});
+var assignRoleDto = z2.object({
+  userId: z2.string().length(8, "User ID must be 8 characters"),
+  roleId: z2.string().length(5, "Role ID must be 5 characters")
+});
+
+// src/roles/RoleController.ts
+var __decorate16 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata16 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param6 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a10;
+var RoleController = class RoleController2 {
+  static {
+    __name(this, "RoleController");
+  }
+  roleService;
+  constructor(roleService) {
+    this.roleService = roleService;
+  }
+  async getRoles() {
+    return this.roleService.getAll();
+  }
+  async getRole(params) {
+    return this.roleService.getById(params.id);
+  }
+  async createRole(body) {
+    return this.roleService.create(body);
+  }
+  async updateRole(params, body) {
+    return this.roleService.update(params.id, body);
+  }
+  async deleteRole(params) {
+    return this.roleService.delete(params.id);
+  }
+};
+__decorate16([
+  Get2(),
+  isAdmin(),
+  ResMsg2("roles.success.retrieved"),
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", []),
+  __metadata16("design:returntype", Promise)
+], RoleController.prototype, "getRoles", null);
+__decorate16([
+  Get2("/:id"),
+  isAdmin(),
+  Validate2({ params: roleIdParam }),
+  ResMsg2("roles.success.retrieved"),
+  __param6(0, Params()),
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object]),
+  __metadata16("design:returntype", Promise)
+], RoleController.prototype, "getRole", null);
+__decorate16([
+  Post2(),
+  isAdmin(),
+  Validate2(createRoleDto),
+  ResMsg2("roles.success.created"),
+  __param6(0, Body2()),
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object]),
+  __metadata16("design:returntype", Promise)
+], RoleController.prototype, "createRole", null);
+__decorate16([
+  Put("/:id"),
+  isAdmin(),
+  Validate2({
+    params: roleIdParam,
+    body: updateRoleDto
+  }),
+  ResMsg2("roles.success.updated"),
+  __param6(0, Params()),
+  __param6(1, Body2()),
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object, Object]),
+  __metadata16("design:returntype", Promise)
+], RoleController.prototype, "updateRole", null);
+__decorate16([
+  Delete("/:id"),
+  isAdmin(),
+  Validate2({ params: roleIdParam }),
+  ResMsg2("roles.success.deleted"),
+  __param6(0, Params()),
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object]),
+  __metadata16("design:returntype", Promise)
+], RoleController.prototype, "deleteRole", null);
+RoleController = __decorate16([
+  Controller2("/roles"),
+  __metadata16("design:paramtypes", [typeof (_a10 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a10 : Object])
+], RoleController);
+
+// src/users/UserController.ts
 import { Validate as Validate3 } from "najm-validation";
 var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3291,8 +3351,8 @@ import { Injectable as Injectable10 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable9 } from "najm-core";
-import { I18n as I18n6 } from "najm-i18n";
-import { Err as Err7 } from "najm-core";
+import { I18n as I18n7 } from "najm-i18n";
+import { Err as Err8 } from "najm-core";
 var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3321,7 +3381,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err7(this.t("errors.notFound"), 404);
+      Err8(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3331,7 +3391,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err7(this.t("errors.notFound"), 404);
+      Err8(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3343,7 +3403,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err7(this.t("errors.nameExists"), 409);
+      Err8(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3366,12 +3426,12 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err7(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err8(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
 __decorate20([
-  I18n6("permissions"),
+  I18n7("permissions"),
   __metadata20("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
 PermissionValidator = __decorate20([
@@ -4393,7 +4453,8 @@ var en_default = {
       unauthorized: "Unauthorized access",
       sessionExpired: "Session has expired",
       accountLocked: "Account is temporarily locked. Please try again later.",
-      accountInactive: "Account is inactive. Please contact support."
+      accountInactive: "Account is inactive. Please contact support.",
+      emailNotVerified: "Please verify your email address before signing in."
     },
     success: {
       login: "Login successful",
@@ -4436,7 +4497,9 @@ var en_default = {
       notFound: "Role not found",
       exists: "Role already exists",
       nameRequired: "Role name is required",
-      cannotDeleteSystem: "Cannot delete system role"
+      cannotDeleteSystem: "Cannot delete system role",
+      cannotRenameSystem: "Cannot rename the system admin role",
+      roleInUse: "Cannot delete a role that is assigned to users"
     },
     success: {
       created: "Role created successfully",
@@ -4500,6 +4563,8 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
     registrationMode: config?.registrationMode ?? "active",
+    requireVerifiedEmail: config?.requireVerifiedEmail ?? false,
+    refreshCookiePath: config?.refreshCookiePath ?? "/",
     lockout: {
       maxAttempts: config?.lockout?.maxAttempts ?? 5,
       duration: config?.lockout?.duration ?? "15m"
@@ -4513,10 +4578,10 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err8.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err9.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err8.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err9.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "mergeConfig");
@@ -4752,6 +4817,7 @@ export {
   permissionsTable,
   pickProps,
   refreshTokenDto,
+  registerDto,
   resetPasswordDto,
   revokeTokenDto,
   roleIdParam,