najm-auth 3.1.3 → 3.1.5

package/README.md

@@ -272,9 +272,13 @@ login, `AuthSessionService.establish()`, Google OAuth (which redirects with
 recovery — so verified-email OAuth linking cannot skip it. Marking a new
 requirement also revokes the user's current sessions.
 
-`withAuthCookiePersistence` recognizes the setup response on its own: it drops
-any session cookies the response carried, clears the remembered preference, and
-leaves the opaque setup cookie alone.
+`withAuthCookiePersistence` recognizes logout and setup boundaries on its own.
+After a successful logout it drops stale auth-cookie issuances and guarantees
+exactly one deletion for each configured auth cookie. It preserves a valid
+upstream deletion (including a custom cookie path), or synthesizes a canonical
+deletion when one is missing. A setup response gets the same auth-cookie
+deletions, clears the remembered preference, and leaves the opaque setup cookie
+alone.
 
 ### Google Sign-In
 
@@ -721,7 +725,7 @@ limits are active when `auth()` is registered.
 | Route | Limit | Window | Key Strategy |
 |-------|-------|--------|--------------|
 | `POST /auth/register` | 5 | 15 minutes | IP |
-| `POST /auth/login` | 5 | 15 minutes | IP |
+| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
 | `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
 | `POST /auth/session/recover` | 120 | 1 minute | Cookie fingerprint |
 | `POST /auth/logout` | 10 | 15 minutes | User ID |
@@ -731,6 +735,23 @@ limits are active when `auth()` is registered.
 
 ### Customizing Rate Limits
 
+The login route has strict environment overrides. Values are read when the
+server imports `najm-auth`, so restart the process after changing them. Invalid
+values fail startup rather than silently weakening the limiter.
+
+```bash
+NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
+NAJM_AUTH_LOGIN_RATE_LIMIT=8
+NAJM_AUTH_LOGIN_RATE_WINDOW=10m
+```
+
+`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
+limiter. Keep it enabled on public production deployments; a shorter window is
+the safer setting for a disposable production-built demo.
+
+The generic plugin configuration remains available for global limits and skip
+rules:
+
 ```typescript
 auth({
   rateLimit: {

package/dist/client/server/index.d.ts

@@ -248,8 +248,8 @@ interface AuthCookiePersistenceOptions {
      * Najm's own setup response is recognized without this — supply it only to
      * cover an application-specific shape. Such a response may carry auth
      * cookies anyway, and persisting them would leave a half-authenticated
-     * browser that skips the setup step on reload. Returning `true` strips them
-     * and clears the stored choice.
+     * browser that skips the setup step on reload. Returning `true` replaces
+     * them with deletions and clears the stored choice.
      */
     isSetupResponse?: (payload: unknown) => boolean;
 }

package/dist/client/server/index.js

@@ -1661,6 +1661,18 @@ function clearedRememberCookie(name, secure) {
   ].join("; ");
 }
 __name(clearedRememberCookie, "clearedRememberCookie");
+function clearedAuthCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedAuthCookie, "clearedAuthCookie");
 function withAuthCookiePersistence(handler, options = {}) {
   const {
     authCookieNames = DEFAULTS.authCookieNames,
@@ -1697,8 +1709,15 @@ function withAuthCookiePersistence(handler, options = {}) {
     const headers = new Headers(response.headers);
     const setCookies = headers.getSetCookie();
     headers.delete("set-cookie");
+    const clearedAuthCookies = /* @__PURE__ */ new Set();
     for (const setCookie of setCookies) {
-      if (action.type === "setup" && authCookieNames.includes(cookieName(setCookie)) && !isDeletionCookie(setCookie)) {
+      const name = cookieName(setCookie);
+      const isAuthCookie = authCookieNames.includes(name);
+      if ((action.type === "clear" || action.type === "setup") && isAuthCookie) {
+        if (isDeletionCookie(setCookie) && !clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", setCookie);
+          clearedAuthCookies.add(name);
+        }
         continue;
       }
       headers.append(
@@ -1706,6 +1725,13 @@ function withAuthCookiePersistence(handler, options = {}) {
         action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
       );
     }
+    if (action.type === "clear" || action.type === "setup") {
+      for (const name of authCookieNames) {
+        if (!clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", clearedAuthCookie(name, secure));
+        }
+      }
+    }
     headers.append(
       "set-cookie",
       action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as najm_core from 'najm-core';
 import { Container } from 'najm-core';
 import { ValidationPluginConfig } from 'najm-validation';
-import { RateLimitPluginConfig } from 'najm-rate';
+import { RateLimitPluginConfig, TimeWindow } from 'najm-rate';
 import { EmailPluginConfig, EmailService } from 'najm-email';
 import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
@@ -705,7 +705,6 @@ declare class UserValidator {
      * Check if user exists by email
      */
     checkUserExistsByEmail(email: string): Promise<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -714,8 +713,9 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -727,7 +727,6 @@ declare class UserValidator {
      * Check if email exists in database
      */
     checkEmailExists(email: string): Promise<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -736,8 +735,9 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1260,8 +1260,8 @@ declare const createUserDto: z.ZodObject<{
     emailVerified: z.ZodDefault<z.ZodBoolean>;
     status: z.ZodOptional<z.ZodEnum<{
         active: "active";
-        pending: "pending";
         inactive: "inactive";
+        pending: "pending";
     }>>;
 }, z.core.$strip>;
 declare const updateUserDto: z.ZodObject<{
@@ -1273,8 +1273,8 @@ declare const updateUserDto: z.ZodObject<{
     emailVerified: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
     status: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
         active: "active";
-        pending: "pending";
         inactive: "inactive";
+        pending: "pending";
     }>>>;
 }, z.core.$strip>;
 declare const registerDto: z.ZodObject<{
@@ -1655,7 +1655,6 @@ declare class AuthController {
     registerUser(body: RegisterDto): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<LoginResult>;
     inviteUser(body: InviteUserDto): Promise<Omit<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1664,8 +1663,9 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1688,7 +1688,6 @@ declare class AuthController {
         message: string;
     }>;
     userProfile(authorization?: string): Promise<Omit<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1697,8 +1696,9 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1786,6 +1786,24 @@ declare function createIdentityResolver(config?: IdentityConfig): IdentityResolv
 declare function normalizeAuthIdentifier(value: unknown): string | null;
 declare function isEmailIdentifier(value: string): boolean;
 
+declare const AUTH_LOGIN_RATE_LIMIT_ENV: {
+    readonly enabled: "NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED";
+    readonly limit: "NAJM_AUTH_LOGIN_RATE_LIMIT";
+    readonly window: "NAJM_AUTH_LOGIN_RATE_WINDOW";
+};
+interface AuthLoginRateLimitConfig {
+    enabled: boolean;
+    limit: number;
+    window: TimeWindow;
+}
+type AuthRateLimitEnvironment = Record<string, string | undefined>;
+declare const DEFAULT_AUTH_LOGIN_RATE_LIMIT: {
+    readonly enabled: true;
+    readonly limit: 8;
+    readonly window: "10m";
+};
+declare function resolveAuthLoginRateLimitConfig(env?: AuthRateLimitEnvironment): AuthLoginRateLimitConfig;
+
 interface RunAsUser {
     id: string;
     role?: string | null;
@@ -2747,4 +2765,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -3583,6 +3583,75 @@ function getRequestIdentityResolver(context) {
 }
 __name(getRequestIdentityResolver, "getRequestIdentityResolver");
 
+// src/auth/authLoginRateLimitConfig.ts
+var AUTH_LOGIN_RATE_LIMIT_ENV = {
+  enabled: "NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED",
+  limit: "NAJM_AUTH_LOGIN_RATE_LIMIT",
+  window: "NAJM_AUTH_LOGIN_RATE_WINDOW"
+};
+var DEFAULT_AUTH_LOGIN_RATE_LIMIT = {
+  enabled: true,
+  limit: 8,
+  window: "10m"
+};
+function parseEnabled(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.enabled;
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "true")
+    return true;
+  if (normalized === "false")
+    return false;
+  throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.enabled} must be true or false`);
+}
+__name(parseEnabled, "parseEnabled");
+function parseLimit(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.limit;
+  }
+  const normalized = raw.trim();
+  if (!/^\d+$/.test(normalized)) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.limit} must be a positive safe integer`);
+  }
+  const limit = Number(normalized);
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.limit} must be a positive safe integer`);
+  }
+  return limit;
+}
+__name(parseLimit, "parseLimit");
+function parseWindow(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.window;
+  }
+  const normalized = raw.trim().toLowerCase();
+  const match = normalized.match(/^([1-9]\d*)(s|m|h|d)$/);
+  if (!match) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.window} must be a positive duration such as 30s, 10m, 1h, or 1d`);
+  }
+  const amount = Number(match[1]);
+  const multiplier = {
+    s: 1e3,
+    m: 6e4,
+    h: 36e5,
+    d: 864e5
+  }[match[2]];
+  if (!Number.isSafeInteger(amount) || !Number.isSafeInteger(amount * multiplier)) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.window} is too large`);
+  }
+  return normalized;
+}
+__name(parseWindow, "parseWindow");
+function resolveAuthLoginRateLimitConfig(env = process.env) {
+  return {
+    enabled: parseEnabled(env[AUTH_LOGIN_RATE_LIMIT_ENV.enabled]),
+    limit: parseLimit(env[AUTH_LOGIN_RATE_LIMIT_ENV.limit]),
+    window: parseWindow(env[AUTH_LOGIN_RATE_LIMIT_ENV.window])
+  };
+}
+__name(resolveAuthLoginRateLimitConfig, "resolveAuthLoginRateLimitConfig");
+
 // src/users/UserDto.ts
 import { z } from "zod";
 var emailField = z.string().email("Invalid email format");
@@ -3692,6 +3761,7 @@ var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
   }
   return ip;
 }, "authIdentityRateLimitKey");
+var loginRateLimit = resolveAuthLoginRateLimitConfig();
 var AuthController = class AuthController2 {
   static {
     __name(this, "AuthController");
@@ -3748,7 +3818,13 @@ __decorate20([
 ], AuthController.prototype, "registerUser", null);
 __decorate20([
   Post("/login"),
-  RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey, message: "Too many login attempts. Please try again later." }),
+  RateLimit({
+    limit: loginRateLimit.limit,
+    window: loginRateLimit.window,
+    key: authIdentityRateLimitKey,
+    message: "Too many login attempts. Please try again later.",
+    skip: !loginRateLimit.enabled
+  }),
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
@@ -6885,6 +6961,7 @@ export {
   AUTH_CONFIG,
   en_default as AUTH_EN,
   AUTH_LOCALES,
+  AUTH_LOGIN_RATE_LIMIT_ENV,
   AUTH_MODULE,
   AUTH_PERMISSIONS,
   AUTH_ROLE,
@@ -6911,6 +6988,7 @@ export {
   CredentialSetupRequirementRepository,
   CredentialSetupRequirementService,
   CredentialSetupService,
+  DEFAULT_AUTH_LOGIN_RATE_LIMIT,
   DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME,
   DEFAULT_CREDENTIAL_SETUP_TTL_MS,
   DEFAULT_IDENTITY_PRESET,
@@ -7007,6 +7085,7 @@ export {
   refreshTokenDto,
   registerDto,
   resetPasswordDto,
+  resolveAuthLoginRateLimitConfig,
   resolveTemporaryCredentialKind,
   revokeTokenDto,
   roleIdParam,

package/dist/schema/pg.d.ts

@@ -235,7 +235,7 @@ declare const usersTable: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "users";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "active" | "pending" | "inactive";
+            data: "active" | "inactive" | "pending";
             driverParam: string;
             notNull: false;
             hasDefault: true;
@@ -1308,7 +1308,7 @@ declare const authSchema: {
                 tableName: "users";
                 dataType: "string";
                 columnType: "PgEnumColumn";
-                data: "active" | "pending" | "inactive";
+                data: "active" | "inactive" | "pending";
                 driverParam: string;
                 notNull: false;
                 hasDefault: true;

package/dist/schema/sqlite.d.ts

@@ -252,7 +252,7 @@ declare const usersTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             tableName: "users";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "active" | "pending" | "inactive";
+            data: "active" | "inactive" | "pending";
             driverParam: string;
             notNull: false;
             hasDefault: true;
@@ -265,7 +265,7 @@ declare const usersTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             generated: undefined;
         }, {}, {
             length: number;
-            $type: "active" | "pending" | "inactive";
+            $type: "active" | "inactive" | "pending";
         }>;
         roleId: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: "role_id";
@@ -1476,7 +1476,7 @@ declare const authSchema: {
                 tableName: "users";
                 dataType: "string";
                 columnType: "SQLiteText";
-                data: "active" | "pending" | "inactive";
+                data: "active" | "inactive" | "pending";
                 driverParam: string;
                 notNull: false;
                 hasDefault: true;
@@ -1489,7 +1489,7 @@ declare const authSchema: {
                 generated: undefined;
             }, {}, {
                 length: number;
-                $type: "active" | "pending" | "inactive";
+                $type: "active" | "inactive" | "pending";
             }>;
             roleId: drizzle_orm_sqlite_core.SQLiteColumn<{
                 name: "role_id";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -97,7 +97,7 @@
     "najm-i18n": "^2.0.3",
     "najm-cache": "^2.0.2",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.0.2",
+    "najm-rate": "^2.0.3",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",