najm-auth 2.0.14 → 3.0.0

package/dist/ma-sNHnUGLO.d.ts

@@ -0,0 +1,88 @@
+/**
+ * A normalizer turns one raw login identifier into the canonical form stored on
+ * the user record. Returning `null`/`undefined` means "not mine" and hands the
+ * value to the next normalizer in the pipeline.
+ */
+type IdentityNormalizer = (value: string) => string | null | undefined;
+interface IdentityPreset {
+    /** Stable preset name, e.g. `ma`. */
+    name: string;
+    /** Local-format normalization for that country. */
+    normalize: IdentityNormalizer;
+}
+/** Built-in country presets. */
+type IdentityPresetName = 'ma' | 'tn';
+interface IdentityConfig {
+    /**
+     * Country preset for local phone numbers (default: `'ma'`). Pass another
+     * preset to replace Morocco, or `null` to keep only generic email/E.164
+     * handling. Local numbers are country-ambiguous, so presets replace each
+     * other instead of stacking.
+     */
+    preset?: IdentityPresetName | IdentityPreset | null;
+    /**
+     * Project-specific identifiers (employee number, student number…). These run
+     * before the selected country preset.
+     */
+    extend?: IdentityNormalizer[];
+}
+/** Identity policy resolved once for one auth plugin/server instance. */
+interface ResolvedIdentityConfig {
+    resolve(value: unknown): string | null;
+}
+
+/** Strips the separators people type into phone fields, keeping a leading `+`. */
+declare const compactPhone: (value: string) => string;
+/** `06…` / `212…` / `+212…` → `+212…`. */
+declare const normalizeMoroccanPhone: IdentityNormalizer;
+declare const moroccoIdentityPreset: IdentityPreset;
+/** `71234567` / `216…` / `+216…` → `+216…`. */
+declare const normalizeTunisianPhone: IdentityNormalizer;
+declare const tunisiaIdentityPreset: IdentityPreset;
+declare const IDENTITY_PRESETS: Record<IdentityPresetName, IdentityPreset>;
+declare const DEFAULT_IDENTITY_PRESET: IdentityPresetName;
+
+/**
+ * A temporary credential is the value a provisioned user signs in with exactly
+ * once, before Najm forces them to replace it. It is hashed like any password;
+ * the only difference is that its *kind* decides how the submitted value is
+ * canonicalized before comparison.
+ */
+interface TemporaryCredential {
+    kind: string;
+    value: string;
+}
+type TemporaryCredentialInput = string | TemporaryCredential;
+interface TemporaryCredentialKind {
+    name: string;
+    /** Canonical form hashed at provisioning and compared at login. */
+    normalize(value: string): string;
+    /**
+     * True when a proposed replacement password still has the temporary shape.
+     * Used to refuse "replacing" a CIN with another CIN.
+     */
+    isTemporaryShape?(value: string): boolean;
+}
+/** Default kind: byte-for-byte, case-sensitive, no transformation. */
+declare const EXACT_TEMPORARY_CREDENTIAL_KIND = "exact";
+declare const MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
+/** A Moroccan CIN is 1–3 letters followed by digits, 8–20 characters overall. */
+declare function isMoroccanCin(value: string): boolean;
+/**
+ * People type their CIN in either case. Anything that is not a CIN is left
+ * exactly as submitted, so a user-chosen password is never lowercased.
+ */
+declare function normalizeMoroccanCin(value: string): string;
+/**
+ * Resolve a stored kind. Fails closed: an unknown kind never falls back to a
+ * different normalizer, because that would silently widen what the stored hash
+ * accepts.
+ */
+declare function resolveTemporaryCredentialKind(name?: string | null): TemporaryCredentialKind;
+declare function isTemporaryCredentialKind(name: string): boolean;
+/** Normalize provisioning input into `{ kind, value }`; strings mean `exact`. */
+declare function toTemporaryCredential(input: TemporaryCredentialInput): TemporaryCredential;
+/** The structured `ma-cin` temporary credential used by provisioning. */
+declare function moroccanCinTemporaryCredential(value: string): TemporaryCredential;
+
+export { DEFAULT_IDENTITY_PRESET as D, EXACT_TEMPORARY_CREDENTIAL_KIND as E, type IdentityConfig as I, MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND as M, type ResolvedIdentityConfig as R, type TemporaryCredentialInput as T, IDENTITY_PRESETS as a, type IdentityNormalizer as b, type IdentityPreset as c, type IdentityPresetName as d, type TemporaryCredential as e, type TemporaryCredentialKind as f, compactPhone as g, isTemporaryCredentialKind as h, isMoroccanCin as i, moroccoIdentityPreset as j, normalizeMoroccanPhone as k, normalizeTunisianPhone as l, moroccanCinTemporaryCredential as m, normalizeMoroccanCin as n, tunisiaIdentityPreset as o, resolveTemporaryCredentialKind as r, toTemporaryCredential as t };

package/dist/schema/pg.d.ts

@@ -987,6 +987,137 @@ declare const credentialSetupSessionsTable: drizzle_orm_pg_core.PgTableWithColum
     };
     dialect: "pg";
 }>;
+/**
+ * Durable record that a user still owes a credential-setup purpose. Survives
+ * browser sessions, unlike credential_setup_sessions — the composite key lets
+ * one user owe more than one purpose at a time.
+ */
+declare const credentialSetupRequirementsTable: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "credential_setup_requirements";
+    schema: undefined;
+    columns: {
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: "user_id";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        purpose: drizzle_orm_pg_core.PgColumn<{
+            name: "purpose";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        temporaryCredentialKind: drizzle_orm_pg_core.PgColumn<{
+            name: "temporary_credential_kind";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        required: drizzle_orm_pg_core.PgColumn<{
+            name: "required";
+            tableName: "credential_setup_requirements";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        completedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "completed_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "created_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 /**
  * Junction table for many-to-many relationship between roles and permissions
  */
@@ -1791,6 +1922,132 @@ declare const authSchema: {
         };
         dialect: "pg";
     }>;
+    readonly credentialSetupRequirements: drizzle_orm_pg_core.PgTableWithColumns<{
+        name: "credential_setup_requirements";
+        schema: undefined;
+        columns: {
+            userId: drizzle_orm_pg_core.PgColumn<{
+                name: "user_id";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            purpose: drizzle_orm_pg_core.PgColumn<{
+                name: "purpose";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            temporaryCredentialKind: drizzle_orm_pg_core.PgColumn<{
+                name: "temporary_credential_kind";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            required: drizzle_orm_pg_core.PgColumn<{
+                name: "required";
+                tableName: "credential_setup_requirements";
+                dataType: "boolean";
+                columnType: "PgBoolean";
+                data: boolean;
+                driverParam: boolean;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            completedAt: drizzle_orm_pg_core.PgColumn<{
+                name: "completed_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgTimestampString";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            createdAt: drizzle_orm_pg_core.PgColumn<{
+                name: "created_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgTimestampString";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: drizzle_orm_pg_core.PgColumn<{
+                name: "updated_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "PgTimestampString";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     readonly roles: drizzle_orm_pg_core.PgTableWithColumns<{
         name: "roles";
         schema: undefined;
@@ -2080,7 +2337,9 @@ type Token = typeof tokensTable.$inferSelect;
 type NewToken = typeof tokensTable.$inferInsert;
 type CredentialSetupSession = typeof credentialSetupSessionsTable.$inferSelect;
 type NewCredentialSetupSession = typeof credentialSetupSessionsTable.$inferInsert;
+type CredentialSetupRequirement = typeof credentialSetupRequirementsTable.$inferSelect;
+type NewCredentialSetupRequirement = typeof credentialSetupRequirementsTable.$inferInsert;
 type RolePermission = typeof rolePermissionsTable.$inferSelect;
 type NewRolePermission = typeof rolePermissionsTable.$inferInsert;
 
-export { type CredentialSetupSession, type NewCredentialSetupSession, type NewOAuthAccount, type NewPermission, type NewRoleEntity, type NewRolePermission, type NewToken, type NewUser, type OAuthAccount, type Permission, type RoleEntity, type RolePermission, type Token, type User, authSchema, baseFields, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable };
+export { type CredentialSetupRequirement, type CredentialSetupSession, type NewCredentialSetupRequirement, type NewCredentialSetupSession, type NewOAuthAccount, type NewPermission, type NewRoleEntity, type NewRolePermission, type NewToken, type NewUser, type OAuthAccount, type Permission, type RoleEntity, type RolePermission, type Token, type User, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable };

package/dist/schema/pg.js

@@ -86,6 +86,17 @@ var credentialSetupSessionsTable = pgTable("credential_setup_sessions", {
   userPurposeIdx: index("credential_setup_sessions_user_purpose_idx").on(table.userId, table.purpose),
   expiresAtIdx: index("credential_setup_sessions_expires_at_idx").on(table.expiresAt)
 }));
+var credentialSetupRequirementsTable = pgTable("credential_setup_requirements", {
+  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).notNull(),
+  purpose: text("purpose").notNull(),
+  temporaryCredentialKind: text("temporary_credential_kind"),
+  required: boolean("required").default(true).notNull(),
+  completedAt: timestamp("completed_at", { mode: "string" }),
+  createdAt: timestamp("created_at", { mode: "string" }).defaultNow(),
+  updatedAt: timestamp("updated_at", { mode: "string" }).defaultNow().$onUpdate(() => sql`CURRENT_TIMESTAMP`)
+}, (table) => ({
+  pk: primaryKey({ columns: [table.userId, table.purpose] })
+}));
 var rolePermissionsTable = pgTable("role_permissions", {
   roleId: text("role_id").notNull().references(() => rolesTable.id, { onDelete: "cascade" }),
   permissionId: text("permission_id").notNull().references(() => permissionsTable.id, { onDelete: "cascade" }),
@@ -98,6 +109,7 @@ var authSchema = {
   oauthAccounts: oauthAccountsTable,
   tokens: tokensTable,
   credentialSetupSessions: credentialSetupSessionsTable,
+  credentialSetupRequirements: credentialSetupRequirementsTable,
   roles: rolesTable,
   permissions: permissionsTable,
   rolePermissions: rolePermissionsTable
@@ -105,6 +117,7 @@ var authSchema = {
 export {
   authSchema,
   baseFields,
+  credentialSetupRequirementsTable,
   credentialSetupSessionsTable,
   oauthAccountsTable,
   permissionsTable,