najm-auth 2.0.12 → 2.0.13

package/README.md

@@ -746,6 +746,12 @@ const options = {
 // Verify the password without minting access/refresh tokens.
 const user = await authService.verifyCredentials({ identifier, password });
 
+// Or narrowly accept only an unverified pending account with one exact role.
+const pendingSponsor = await authService.verifyPendingCredentials(
+  { identifier, password },
+  'sponsor',
+);
+
 if (await appRequiresPasswordSetup(user.id)) {
   // Revokes normal sessions and writes only an HttpOnly, SameSite=Strict,
   // browser-session cookie. The database stores only its SHA-256 hash.

package/dist/index.d.ts

@@ -1272,6 +1272,13 @@ declare class AuthService {
      * this before issuing a purpose-bound CredentialSetupService session.
      */
     verifyCredentials(body: LoginDto): Promise<SanitizedUser>;
+    /**
+     * Verify a pending, unverified account for one exact application role.
+     * This deliberately does not establish a normal auth session. Applications
+     * should exchange the result for a short-lived, purpose-bound setup session.
+     */
+    verifyPendingCredentials(body: LoginDto, expectedRole: string): Promise<SanitizedUser>;
+    private verifyCredentialsForPolicy;
     /** Establish a complete normal auth session for an already verified user. */
     establishSession(user: SanitizedUser): Promise<TokenPair & {
         user: SanitizedUser;

package/dist/index.js

@@ -2323,6 +2323,23 @@ var AuthService = class AuthService2 {
    * this before issuing a purpose-bound CredentialSetupService session.
    */
   async verifyCredentials(body) {
+    return this.verifyCredentialsForPolicy(body, { kind: "active" });
+  }
+  /**
+   * Verify a pending, unverified account for one exact application role.
+   * This deliberately does not establish a normal auth session. Applications
+   * should exchange the result for a short-lived, purpose-bound setup session.
+   */
+  async verifyPendingCredentials(body, expectedRole) {
+    if (!expectedRole.trim()) {
+      Err8(this.t("errors.invalidCredentials"), 401);
+    }
+    return this.verifyCredentialsForPolicy(body, {
+      kind: "pending",
+      expectedRole: expectedRole.trim().toLowerCase()
+    });
+  }
+  async verifyCredentialsForPolicy(body, policy) {
     const password = body.password;
     const rawIdentifier = "identifier" in body ? body.identifier : body.email;
     const identifier = normalizeAuthIdentifier(rawIdentifier);
@@ -2353,11 +2370,18 @@ var AuthService = class AuthService2 {
       }
       Err8(this.t("errors.invalidCredentials"), 401);
     }
-    if (user.status !== "active") {
-      Err8(this.t("errors.accountInactive"), 403);
-    }
-    if (this.config.requireVerifiedEmail && !user.emailVerified) {
-      Err8(this.t("errors.emailNotVerified"), 403);
+    if (policy.kind === "pending") {
+      const role = typeof user.role === "string" ? user.role.toLowerCase() : "";
+      if (user.status !== "pending" || user.emailVerified || role !== policy.expectedRole) {
+        Err8(this.t("errors.invalidCredentials"), 401);
+      }
+    } else {
+      if (user.status !== "active") {
+        Err8(this.t("errors.accountInactive"), 403);
+      }
+      if (this.config.requireVerifiedEmail && !user.emailVerified) {
+        Err8(this.t("errors.emailNotVerified"), 403);
+      }
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [