najm-auth 2.0.15 → 3.1.0

package/dist/schema/sqlite.d.ts

@@ -1089,6 +1089,149 @@ declare const credentialSetupSessionsTable: drizzle_orm_sqlite_core.SQLiteTableW
     };
     dialect: "sqlite";
 }>;
+/**
+ * Durable record that a user still owes a credential-setup purpose. Survives
+ * browser sessions, unlike credential_setup_sessions — the composite key lets
+ * one user owe more than one purpose at a time.
+ */
+declare const credentialSetupRequirementsTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "credential_setup_requirements";
+    schema: undefined;
+    columns: {
+        userId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "user_id";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        purpose: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "purpose";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        temporaryCredentialKind: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "temporary_credential_kind";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        required: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "required";
+            tableName: "credential_setup_requirements";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        completedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "completed_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        updatedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "updated_at";
+            tableName: "credential_setup_requirements";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
 /**
  * Junction table for many-to-many relationship between roles and permissions
  */
@@ -2018,6 +2161,144 @@ declare const authSchema: {
         };
         dialect: "sqlite";
     }>;
+    readonly credentialSetupRequirements: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+        name: "credential_setup_requirements";
+        schema: undefined;
+        columns: {
+            userId: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "user_id";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+            purpose: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "purpose";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+            temporaryCredentialKind: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "temporary_credential_kind";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+            required: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "required";
+                tableName: "credential_setup_requirements";
+                dataType: "boolean";
+                columnType: "SQLiteBoolean";
+                data: boolean;
+                driverParam: number;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            completedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "completed_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+            createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "created_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: true;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+            updatedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+                name: "updated_at";
+                tableName: "credential_setup_requirements";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: true;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number;
+            }>;
+        };
+        dialect: "sqlite";
+    }>;
     readonly roles: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
         name: "roles";
         schema: undefined;
@@ -2375,7 +2656,9 @@ type Token = typeof tokensTable.$inferSelect;
 type NewToken = typeof tokensTable.$inferInsert;
 type CredentialSetupSession = typeof credentialSetupSessionsTable.$inferSelect;
 type NewCredentialSetupSession = typeof credentialSetupSessionsTable.$inferInsert;
+type CredentialSetupRequirement = typeof credentialSetupRequirementsTable.$inferSelect;
+type NewCredentialSetupRequirement = typeof credentialSetupRequirementsTable.$inferInsert;
 type RolePermission = typeof rolePermissionsTable.$inferSelect;
 type NewRolePermission = typeof rolePermissionsTable.$inferInsert;
 
-export { type CredentialSetupSession, type NewCredentialSetupSession, type NewOAuthAccount, type NewPermission, type NewRoleEntity, type NewRolePermission, type NewToken, type NewUser, type OAuthAccount, type Permission, type RoleEntity, type RolePermission, type Token, type User, authSchema, baseFields, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokensTable, usersTable };
+export { type CredentialSetupRequirement, type CredentialSetupSession, type NewCredentialSetupRequirement, type NewCredentialSetupSession, type NewOAuthAccount, type NewPermission, type NewRoleEntity, type NewRolePermission, type NewToken, type NewUser, type OAuthAccount, type Permission, type RoleEntity, type RolePermission, type Token, type User, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokensTable, usersTable };

package/dist/schema/sqlite.js

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/schema/sqlite.ts
-import { sqliteTable, text, integer, uniqueIndex, index } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text, integer, primaryKey, uniqueIndex, index } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 var baseFields = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -76,6 +76,17 @@ var credentialSetupSessionsTable = sqliteTable("credential_setup_sessions", {
   userPurposeIdx: index("credential_setup_sessions_user_purpose_idx").on(table.userId, table.purpose),
   expiresAtIdx: index("credential_setup_sessions_expires_at_idx").on(table.expiresAt)
 }));
+var credentialSetupRequirementsTable = sqliteTable("credential_setup_requirements", {
+  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).notNull(),
+  purpose: text("purpose").notNull(),
+  temporaryCredentialKind: text("temporary_credential_kind"),
+  required: integer("required", { mode: "boolean" }).default(true).notNull(),
+  completedAt: text("completed_at"),
+  createdAt: text("created_at").$defaultFn(() => (/* @__PURE__ */ new Date()).toISOString()),
+  updatedAt: text("updated_at").$defaultFn(() => (/* @__PURE__ */ new Date()).toISOString()).$onUpdate(() => sql`(datetime('now'))`)
+}, (table) => ({
+  pk: primaryKey({ columns: [table.userId, table.purpose] })
+}));
 var rolePermissionsTable = sqliteTable("role_permissions", {
   ...baseFields(10),
   roleId: text("role_id").notNull().references(() => rolesTable.id, { onDelete: "cascade" }),
@@ -88,6 +99,7 @@ var authSchema = {
   oauthAccounts: oauthAccountsTable,
   tokens: tokensTable,
   credentialSetupSessions: credentialSetupSessionsTable,
+  credentialSetupRequirements: credentialSetupRequirementsTable,
   roles: rolesTable,
   permissions: permissionsTable,
   rolePermissions: rolePermissionsTable
@@ -95,6 +107,7 @@ var authSchema = {
 export {
   authSchema,
   baseFields,
+  credentialSetupRequirementsTable,
   credentialSetupSessionsTable,
   oauthAccountsTable,
   permissionsTable,

package/dist/sessionRecovery-D5Fa0yZ1.d.ts

@@ -0,0 +1,18 @@
+type SessionRecoveryFailureReason = 'invalid-cookie-name' | 'invalid-refresh-cookie' | 'invalid-endpoint' | 'fetch-error' | 'http-status' | 'missing-set-cookie' | 'session-cookie-parse' | 'session-cookie-hmac' | 'session-cookie-payload';
+interface SessionRecoveryErrorDetails {
+    name: string;
+    message: string;
+    code?: string;
+    cause?: {
+        name: string;
+        message: string;
+        code?: string;
+    };
+}
+interface SessionRecoveryFailure {
+    reason: SessionRecoveryFailureReason;
+    httpStatus?: number;
+    error?: SessionRecoveryErrorDetails;
+}
+
+export type { SessionRecoveryFailure as S, SessionRecoveryErrorDetails as a, SessionRecoveryFailureReason as b };

package/dist/types-BaSfgxqE.d.ts

@@ -0,0 +1,166 @@
+/**
+ * User data from the auth server
+ */
+interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    role?: string | null;
+    permissions?: string[];
+    [key: string]: unknown;
+}
+/**
+ * Full auth state snapshot
+ */
+interface AuthState {
+    user: AuthUser | null;
+    accessToken: string | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    roles: string[];
+    permissions: string[];
+}
+/**
+ * Decoded JWT payload (client-side, no verification)
+ */
+interface DecodedToken {
+    userId: string;
+    jti?: string;
+    sessionVersion?: number;
+    roles?: string[];
+    permissions?: string[];
+    exp?: number;
+    iat?: number;
+    [key: string]: unknown;
+}
+/**
+ * Server response envelope
+ */
+interface ServerResponse<T = unknown> {
+    data: T;
+    message?: string;
+    status?: string;
+}
+/**
+ * Token pair from login/refresh (internal — refresh token is httpOnly cookie)
+ */
+interface TokenPair {
+    accessToken: string;
+    refreshToken?: string;
+    accessTokenExpiresAt?: number;
+    refreshTokenExpiresAt?: number;
+}
+/**
+ * Login credentials. `identifier` accepts an email address or a phone number;
+ * `email` stays supported for existing callers.
+ */
+interface LoginCredentials {
+    identifier?: string;
+    email?: string;
+    password: string;
+    /** Persist the auth cookies past the browser closing. */
+    rememberMe?: boolean;
+    [key: string]: unknown;
+}
+/** The account must replace its credential before it gets a session. */
+interface CredentialSetupPending {
+    nextStep: 'credential_setup';
+    setupRequired: true;
+    purpose: string;
+    expiresAt: string;
+}
+interface AuthenticatedLogin {
+    nextStep: 'authenticated';
+    user: AuthUser;
+}
+/**
+ * Login answer. Branch on `nextStep`: `credential_setup` carries no tokens and
+ * leaves the client unauthenticated.
+ */
+type LoginResult = AuthenticatedLogin | CredentialSetupPending;
+/**
+ * Retry configuration
+ */
+interface RetryConfig {
+    maxRetries?: number;
+    backoff?: 'exponential' | 'linear';
+    baseDelay?: number;
+}
+/**
+ * Auth client configuration
+ */
+interface AuthClientConfig {
+    /** API base URL (e.g., '/api' or 'https://api.example.com') */
+    baseURL: string;
+    /** Auth endpoints prefix (default: '/auth') */
+    authPrefix?: string;
+    /** Proactive refresh at this fraction of token lifetime (default: 0.8) */
+    refreshThreshold?: number;
+    /** Enable multi-tab sync via BroadcastChannel (default: true) */
+    tabSync?: boolean;
+    /** BroadcastChannel name (default: 'najm-auth') */
+    channelName?: string;
+    /** Network retry configuration */
+    retry?: RetryConfig;
+    /** Request timeout in milliseconds (default: 30000) */
+    timeout?: number;
+}
+type OAuthProvider = 'google';
+interface OAuthLoginOptions {
+    /** Same-origin frontend path after OAuth completes. */
+    returnTo?: string;
+}
+/**
+ * Auth event types
+ */
+interface AuthEventMap {
+    login: AuthUser;
+    logout: null;
+    /** Emitted when server-side logout invalidation fails (state was already cleared) */
+    logoutError: unknown;
+    tokenRefresh: null;
+    sessionExpired: null;
+    stateChange: AuthState;
+    userUpdated: AuthUser;
+}
+type AuthEvent = keyof AuthEventMap;
+type AuthEventHandler<K extends AuthEvent = AuthEvent> = (data: AuthEventMap[K]) => void;
+/**
+ * Tab sync message types
+ */
+type TabSyncMessage = {
+    type: 'logout';
+} | {
+    type: 'sync';
+    state: SyncPayload;
+};
+interface SyncPayload {
+    accessToken: string | null;
+    user: AuthUser | null;
+    roles: string[];
+    permissions: string[];
+    isAuthenticated: boolean;
+}
+/**
+ * FetchClient request options
+ */
+interface RequestOptions {
+    body?: unknown;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+    timeout?: number;
+    /** Skip auth header attachment (for public endpoints like /login, /register) */
+    skipAuth?: boolean;
+    /** @internal Prevents 401-refresh loop after a single retry */
+    _retried?: boolean;
+}
+/**
+ * Auth error thrown by the client
+ */
+declare class AuthError extends Error {
+    status: number;
+    body?: unknown;
+    constructor(status: number, message: string, body?: unknown);
+}
+
+export { type AuthUser as A, type CredentialSetupPending as C, type DecodedToken as D, type LoginCredentials as L, type OAuthProvider as O, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type RequestOptions as a, type AuthClientConfig as b, type LoginResult as c, type OAuthLoginOptions as d, type AuthState as e, type AuthEvent as f, type AuthEventHandler as g, AuthError as h, type AuthEventMap as i, type AuthenticatedLogin as j, type ServerResponse as k, type TokenPair as l };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.15",
+  "version": "3.1.0",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -34,6 +34,18 @@
       "import": "./dist/client/server/index.js",
       "default": "./dist/client/server/index.js"
     },
+    "./client/server/react": {
+      "types": "./dist/client/server/react.d.ts",
+      "react-server": "./dist/client/server/react.js",
+      "browser": "./dist/client/server/reactClientGuard.js",
+      "import": "./dist/client/server/react.js",
+      "default": "./dist/client/server/react.js"
+    },
+    "./identity/ma": {
+      "types": "./dist/identity/ma.d.ts",
+      "import": "./dist/identity/ma.js",
+      "default": "./dist/identity/ma.js"
+    },
     "./pg": {
       "types": "./dist/schema/pg.d.ts",
       "import": "./dist/schema/pg.js",
@@ -47,7 +59,8 @@
   },
   "scripts": {
     "build": "tsup",
-    "test": "bun test",
+    "test": "bun test && bun run test:rsc",
+    "test:rsc": "bun test --conditions react-server test/react-server-auth.test.ts",
     "test:next16": "bun run build && bun integration/next16-proxy/run.ts",
     "test:watch": "bun test --watch",
     "start": "bun --watch src/main.ts",