najm-auth 2.0.12 → 2.0.14

package/README.md

@@ -746,6 +746,12 @@ const options = {
 // Verify the password without minting access/refresh tokens.
 const user = await authService.verifyCredentials({ identifier, password });
 
+// Or narrowly accept only an unverified pending account with one exact role.
+const pendingSponsor = await authService.verifyPendingCredentials(
+  { identifier, password },
+  'sponsor',
+);
+
 if (await appRequiresPasswordSetup(user.id)) {
   // Revokes normal sessions and writes only an HttpOnly, SameSite=Strict,
   // browser-session cookie. The database stores only its SHA-256 hash.

package/dist/{NajmAuthClient-0yzFb9CR.d.ts → NajmAuthClient-Cn9bObLB.d.ts}

@@ -222,6 +222,14 @@ declare class NajmAuthClient {
      */
     hydrate(session: HydrateSession | null): void;
     isHydrated(): boolean;
+    /**
+     * A fresh client with the same config — unhydrated, and without tab sync.
+     *
+     * Server rendering needs one client per request. A single process serves
+     * every user, so the hydration latch on a shared client would otherwise pin
+     * every later render to the first request's session.
+     */
+    fork(): NajmAuthClient;
     on<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
     off<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
     subscribe(listener: (state: AuthState) => void): () => void;

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-0yzFb9CR.js';
-export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-0yzFb9CR.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-Cn9bObLB.js';
+export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-Cn9bObLB.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/index.js

@@ -422,6 +422,16 @@ var NajmAuthClient = class _NajmAuthClient {
   isHydrated() {
     return this._hydrated;
   }
+  /**
+   * A fresh client with the same config — unhydrated, and without tab sync.
+   *
+   * Server rendering needs one client per request. A single process serves
+   * every user, so the hydration latch on a shared client would otherwise pin
+   * every later render to the first request's session.
+   */
+  fork() {
+    return new _NajmAuthClient({ ...this.config, tabSync: false });
+  }
   // =========================================================================
   // Events
   // =========================================================================
@@ -505,6 +515,7 @@ var NajmAuthClient = class _NajmAuthClient {
   }
   scheduleRefresh(decoded) {
     this.clearRefreshTimer();
+    if (typeof window === "undefined") return;
     const ttl = getTokenTTL(decoded);
     if (ttl <= 0) return;
     const delay = ttl * this.threshold * 1e3;

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-0yzFb9CR.js';
+import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-Cn9bObLB.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;

package/dist/client/react/index.js

@@ -3,7 +3,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/client/react/AuthProvider.tsx
-import { useEffect, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 // src/client/react/context.ts
 import { createContext, useContext } from "react";
@@ -49,12 +49,15 @@ function AuthProvider({
   initialSession,
   autoRefresh = true
 }) {
+  const [active] = useState(
+    () => typeof window === "undefined" && initialSession !== void 0 ? client.fork() : client
+  );
   const hydrated = useRef(false);
   if (!hydrated.current && initialSession !== void 0) {
-    client.hydrate(initialSession);
+    active.hydrate(initialSession);
     hydrated.current = true;
   }
-  return /* @__PURE__ */ jsxs(AuthClientContext.Provider, { value: client, children: [
+  return /* @__PURE__ */ jsxs(AuthClientContext.Provider, { value: active, children: [
     autoRefresh ? /* @__PURE__ */ jsx(AutoRefresh, {}) : null,
     children
   ] });
@@ -98,11 +101,11 @@ function useUser() {
 __name(useUser, "useUser");
 
 // src/client/react/useSession.ts
-import { useEffect as useEffect2, useRef as useRef2, useState } from "react";
+import { useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 function useSession(opts) {
   const client = useAuthClient();
   const state = useAuth();
-  const [isLoading, setIsLoading] = useState(() => !client.isHydrated());
+  const [isLoading, setIsLoading] = useState2(() => !client.isHydrated());
   const didInit = useRef2(false);
   useEffect2(() => {
     if (didInit.current) return;
@@ -145,11 +148,11 @@ function usePermissions() {
 __name(usePermissions, "usePermissions");
 
 // src/client/react/useLogin.ts
-import { useCallback, useState as useState2 } from "react";
+import { useCallback, useState as useState3 } from "react";
 function useLogin(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState2(false);
-  const [error, setError] = useState2(null);
+  const [isLoading, setIsLoading] = useState3(false);
+  const [error, setError] = useState3(null);
   const login = useCallback(async (credentials) => {
     setIsLoading(true);
     setError(null);
@@ -169,11 +172,11 @@ function useLogin(opts) {
 __name(useLogin, "useLogin");
 
 // src/client/react/useRegister.ts
-import { useCallback as useCallback2, useState as useState3 } from "react";
+import { useCallback as useCallback2, useState as useState4 } from "react";
 function useRegister(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState3(false);
-  const [error, setError] = useState3(null);
+  const [isLoading, setIsLoading] = useState4(false);
+  const [error, setError] = useState4(null);
   const register = useCallback2(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -193,10 +196,10 @@ function useRegister(opts) {
 __name(useRegister, "useRegister");
 
 // src/client/react/useLogout.ts
-import { useCallback as useCallback3, useState as useState4 } from "react";
+import { useCallback as useCallback3, useState as useState5 } from "react";
 function useLogout(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState4(false);
+  const [isLoading, setIsLoading] = useState5(false);
   const logout = useCallback3(async () => {
     setIsLoading(true);
     try {
@@ -218,12 +221,12 @@ function useLogout(opts) {
 __name(useLogout, "useLogout");
 
 // src/client/react/useForgotPassword.ts
-import { useCallback as useCallback4, useState as useState5 } from "react";
+import { useCallback as useCallback4, useState as useState6 } from "react";
 function useForgotPassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState5(false);
-  const [error, setError] = useState5(null);
-  const [isSuccess, setIsSuccess] = useState5(false);
+  const [isLoading, setIsLoading] = useState6(false);
+  const [error, setError] = useState6(null);
+  const [isSuccess, setIsSuccess] = useState6(false);
   const forgotPassword = useCallback4(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -249,12 +252,12 @@ function useForgotPassword(opts) {
 __name(useForgotPassword, "useForgotPassword");
 
 // src/client/react/useResetPassword.ts
-import { useCallback as useCallback5, useState as useState6 } from "react";
+import { useCallback as useCallback5, useState as useState7 } from "react";
 function useResetPassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState6(false);
-  const [error, setError] = useState6(null);
-  const [isSuccess, setIsSuccess] = useState6(false);
+  const [isLoading, setIsLoading] = useState7(false);
+  const [error, setError] = useState7(null);
+  const [isSuccess, setIsSuccess] = useState7(false);
   const resetPassword = useCallback5(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -280,12 +283,12 @@ function useResetPassword(opts) {
 __name(useResetPassword, "useResetPassword");
 
 // src/client/react/useChangePassword.ts
-import { useCallback as useCallback6, useState as useState7 } from "react";
+import { useCallback as useCallback6, useState as useState8 } from "react";
 function useChangePassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState7(false);
-  const [error, setError] = useState7(null);
-  const [isSuccess, setIsSuccess] = useState7(false);
+  const [isLoading, setIsLoading] = useState8(false);
+  const [error, setError] = useState8(null);
+  const [isSuccess, setIsSuccess] = useState8(false);
   const changePassword = useCallback6(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -311,11 +314,11 @@ function useChangePassword(opts) {
 __name(useChangePassword, "useChangePassword");
 
 // src/client/react/useGoogleLogin.ts
-import { useCallback as useCallback7, useState as useState8 } from "react";
+import { useCallback as useCallback7, useState as useState9 } from "react";
 function useGoogleLogin(options) {
   const client = useAuthClient();
-  const [isRedirecting, setIsRedirecting] = useState8(false);
-  const [error, setError] = useState8(null);
+  const [isRedirecting, setIsRedirecting] = useState9(false);
+  const [error, setError] = useState9(null);
   const fail = useCallback7((value) => {
     const next = value instanceof Error ? value : new Error(String(value));
     setIsRedirecting(false);
@@ -345,12 +348,12 @@ function useGoogleLogin(options) {
 __name(useGoogleLogin, "useGoogleLogin");
 
 // src/client/react/useOAuthCallback.ts
-import { useCallback as useCallback8, useRef as useRef3, useState as useState9 } from "react";
+import { useCallback as useCallback8, useRef as useRef3, useState as useState10 } from "react";
 function useOAuthCallback(options) {
   const client = useAuthClient();
   const promise = useRef3(null);
-  const [isLoading, setIsLoading] = useState9(false);
-  const [error, setError] = useState9(null);
+  const [isLoading, setIsLoading] = useState10(false);
+  const [error, setError] = useState10(null);
   const complete = useCallback8(async () => {
     if (promise.current) return promise.current;
     setIsLoading(true);
@@ -388,7 +391,7 @@ function useAuthEvent(event, handler) {
 __name(useAuthEvent, "useAuthEvent");
 
 // src/client/react/useAuthEvents.ts
-import { useEffect as useEffect4, useRef as useRef5, useState as useState10 } from "react";
+import { useEffect as useEffect4, useRef as useRef5, useState as useState11 } from "react";
 var ALL_EVENTS = [
   "login",
   "logout",
@@ -401,7 +404,7 @@ var ALL_EVENTS = [
 function useAuthEvents(opts) {
   const client = useAuthClient();
   const max = opts?.maxEntries ?? 100;
-  const [entries, setEntries] = useState10([]);
+  const [entries, setEntries] = useState11([]);
   const maxRef = useRef5(max);
   maxRef.current = max;
   useEffect4(() => {

package/dist/client/server/index.d.ts

@@ -1,4 +1,4 @@
-import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-0yzFb9CR.js';
+import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-Cn9bObLB.js';
 import { SessionRecoveryFailure } from '../edge.js';
 export { SessionRecoveryErrorDetails, SessionRecoveryFailureReason, withAuthMiddleware } from '../edge.js';
 import 'next/server';

package/dist/client/server/index.js

@@ -1119,6 +1119,16 @@ var NajmAuthClient = class _NajmAuthClient {
   isHydrated() {
     return this._hydrated;
   }
+  /**
+   * A fresh client with the same config — unhydrated, and without tab sync.
+   *
+   * Server rendering needs one client per request. A single process serves
+   * every user, so the hydration latch on a shared client would otherwise pin
+   * every later render to the first request's session.
+   */
+  fork() {
+    return new _NajmAuthClient({ ...this.config, tabSync: false });
+  }
   // =========================================================================
   // Events
   // =========================================================================
@@ -1202,6 +1212,7 @@ var NajmAuthClient = class _NajmAuthClient {
   }
   scheduleRefresh(decoded) {
     this.clearRefreshTimer();
+    if (typeof window === "undefined") return;
     const ttl = getTokenTTL(decoded);
     if (ttl <= 0) return;
     const delay = ttl * this.threshold * 1e3;

package/dist/index.d.ts

@@ -1272,6 +1272,13 @@ declare class AuthService {
      * this before issuing a purpose-bound CredentialSetupService session.
      */
     verifyCredentials(body: LoginDto): Promise<SanitizedUser>;
+    /**
+     * Verify a pending, unverified account for one exact application role.
+     * This deliberately does not establish a normal auth session. Applications
+     * should exchange the result for a short-lived, purpose-bound setup session.
+     */
+    verifyPendingCredentials(body: LoginDto, expectedRole: string): Promise<SanitizedUser>;
+    private verifyCredentialsForPolicy;
     /** Establish a complete normal auth session for an already verified user. */
     establishSession(user: SanitizedUser): Promise<TokenPair & {
         user: SanitizedUser;

package/dist/index.js

@@ -2323,6 +2323,23 @@ var AuthService = class AuthService2 {
    * this before issuing a purpose-bound CredentialSetupService session.
    */
   async verifyCredentials(body) {
+    return this.verifyCredentialsForPolicy(body, { kind: "active" });
+  }
+  /**
+   * Verify a pending, unverified account for one exact application role.
+   * This deliberately does not establish a normal auth session. Applications
+   * should exchange the result for a short-lived, purpose-bound setup session.
+   */
+  async verifyPendingCredentials(body, expectedRole) {
+    if (!expectedRole.trim()) {
+      Err8(this.t("errors.invalidCredentials"), 401);
+    }
+    return this.verifyCredentialsForPolicy(body, {
+      kind: "pending",
+      expectedRole: expectedRole.trim().toLowerCase()
+    });
+  }
+  async verifyCredentialsForPolicy(body, policy) {
     const password = body.password;
     const rawIdentifier = "identifier" in body ? body.identifier : body.email;
     const identifier = normalizeAuthIdentifier(rawIdentifier);
@@ -2353,11 +2370,18 @@ var AuthService = class AuthService2 {
       }
       Err8(this.t("errors.invalidCredentials"), 401);
     }
-    if (user.status !== "active") {
-      Err8(this.t("errors.accountInactive"), 403);
-    }
-    if (this.config.requireVerifiedEmail && !user.emailVerified) {
-      Err8(this.t("errors.emailNotVerified"), 403);
+    if (policy.kind === "pending") {
+      const role = typeof user.role === "string" ? user.role.toLowerCase() : "";
+      if (user.status !== "pending" || user.emailVerified || role !== policy.expectedRole) {
+        Err8(this.t("errors.invalidCredentials"), 401);
+      }
+    } else {
+      if (user.status !== "active") {
+        Err8(this.t("errors.accountInactive"), 403);
+      }
+      if (this.config.requireVerifiedEmail && !user.emailVerified) {
+        Err8(this.t("errors.emailNotVerified"), 403);
+      }
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -78,10 +78,10 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.4",
+    "najm-core": "^2.0.5",
     "najm-database": "^2.0.3",
     "najm-guard": "^2.0.2",
-    "najm-i18n": "^2.0.2",
+    "najm-i18n": "^2.0.3",
     "najm-cache": "^2.0.2",
     "najm-email": "^2.0.2",
     "najm-rate": "^2.0.2",