najm-auth 3.1.5 → 3.2.1

package/dist/client/server/index.js

@@ -756,11 +756,13 @@ function withAuthMiddleware(config) {
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
-    verifyAlways = false,
+    verifyAlways: legacyVerifyAlways = false,
+    proxySessionMode,
     recoveryURL,
     internalRecoveryURL,
     onRecoveryFailure
   } = config;
+  const verifyAlways = proxySessionMode === void 0 ? legacyVerifyAlways : proxySessionMode === "authoritative";
   const resolvedInternalRecoveryURL = resolveInternalRecoveryURL(internalRecoveryURL);
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
@@ -1442,157 +1444,6 @@ function attachReactServerInternals(kit, internals) {
 }
 __name(attachReactServerInternals, "attachReactServerInternals");
 
-// src/client/server/defineAuth.ts
-function defineAuth(authConfig = {}) {
-  const {
-    apiBaseURL = "/api",
-    authPrefix = "/auth",
-    loginRoute = "/login",
-    forbiddenRoute = "/forbidden",
-    publicRoutes = [],
-    protectedRoutes = [],
-    roleRoutes = {},
-    cookieName: cookieName2 = "refreshToken",
-    sessionCookieName = "najm.session",
-    sessionSecret,
-    sessionMaxAge,
-    recoveryURL,
-    internalRecoveryURL,
-    matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
-    verifyAlways = false,
-    onRecoveryFailure,
-    refreshThreshold,
-    tabSync,
-    channelName,
-    timeout,
-    retry
-  } = authConfig;
-  const sessionConfig = {
-    baseURL: apiBaseURL,
-    authPrefix,
-    cookieName: cookieName2,
-    sessionCookieName,
-    sessionSecret,
-    sessionMaxAge,
-    recoveryURL,
-    internalRecoveryURL,
-    onRecoveryFailure
-  };
-  let _client = null;
-  const getClient = /* @__PURE__ */ __name(() => {
-    if (_client) return _client;
-    _client = createAuthClient({
-      baseURL: apiBaseURL,
-      authPrefix,
-      refreshThreshold,
-      tabSync,
-      channelName,
-      timeout,
-      retry
-    });
-    return _client;
-  }, "getClient");
-  const getSession2 = /* @__PURE__ */ __name(async (opts) => {
-    const { getSession: resolveSession } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
-    return resolveSession({ ...sessionConfig, ...opts });
-  }, "getSession");
-  const resolveSessionOutcome2 = /* @__PURE__ */ __name(async () => {
-    const { resolveSessionOutcome: resolve } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
-    return resolve(sessionConfig);
-  }, "resolveSessionOutcome");
-  const requireSession = /* @__PURE__ */ __name(async () => {
-    const outcome = await resolveSessionOutcome2();
-    if (outcome.status === "authenticated") return outcome.session;
-    if (redirectsToLogin(outcome)) {
-      const { redirect } = await import("next/navigation");
-      redirect(loginRoute);
-    }
-    throw outcome.error;
-  }, "requireSession");
-  const requireRole = /* @__PURE__ */ __name(async (roles) => {
-    const session = await requireSession();
-    if (!heldRoles(session).some((role) => roles.includes(role))) {
-      const { redirect } = await import("next/navigation");
-      redirect(forbiddenRoute);
-    }
-    return session;
-  }, "requireRole");
-  const middleware = withAuthMiddleware({
-    protectedRoutes,
-    publicRoutes,
-    loginRoute,
-    roleRoutes,
-    cookieName: cookieName2,
-    apiBaseURL,
-    authPrefix,
-    sessionCookieName,
-    sessionSecret,
-    sessionMaxAge,
-    recoveryURL,
-    internalRecoveryURL,
-    verifyAlways,
-    onRecoveryFailure
-  });
-  const protect = /* @__PURE__ */ __name((Page, options) => {
-    return /* @__PURE__ */ __name(async function ProtectedPage(props) {
-      const session = await getSession2();
-      if (!session) {
-        const { redirect } = await import("next/navigation");
-        redirect(loginRoute);
-      }
-      if (options?.role) {
-        if (!heldRoles(session).includes(options.role)) {
-          const { redirect } = await import("next/navigation");
-          redirect(forbiddenRoute);
-        }
-      }
-      if (options?.permission) {
-        const { matchPermission: matchPermission2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
-        const perms = session.permissions ?? session.user.permissions ?? [];
-        if (!matchPermission2(perms, options.permission)) {
-          const { redirect } = await import("next/navigation");
-          redirect(forbiddenRoute);
-        }
-      }
-      return Page({ session, ...props });
-    }, "ProtectedPage");
-  }, "protect");
-  return attachReactServerInternals({
-    get client() {
-      return getClient();
-    },
-    get api() {
-      return getClient().api;
-    },
-    getSession: getSession2,
-    requireSession,
-    requireRole,
-    middleware,
-    config: { matcher },
-    protect
-  }, { resolveSessionOutcome: resolveSessionOutcome2, loginRoute, forbiddenRoute });
-}
-__name(defineAuth, "defineAuth");
-
-// src/client/server/safeRedirect.ts
-var DEFAULT_BLOCKED_PREFIXES = ["/api", "/login", "/_next"];
-var ASSET_EXTENSIONS = /\.(?:css|gif|ico|jpe?g|js|json|map|png|svg|webmanifest|webp)$/i;
-function getSafeRedirectPath(value, options = {}) {
-  const {
-    fallback = "/dashboard",
-    blockedPrefixes = DEFAULT_BLOCKED_PREFIXES
-  } = typeof options === "string" ? { fallback: options } : options;
-  const path = Array.isArray(value) ? value[0] : value;
-  if (!path || !path.startsWith("/") || // Protocol-relative: the browser treats `//host/x` as off-site.
-  path.startsWith("//") || // A backslash is normalized to a forward slash by some browsers, so
-  // `/\evil.test` is another way to spell the case above.
-  path.startsWith("/\\") || blockedPrefixes.some((prefix) => path.startsWith(prefix)) || ASSET_EXTENSIONS.test(path.split("?")[0] ?? path)) {
-    return fallback;
-  }
-  return path;
-}
-__name(getSafeRedirectPath, "getSafeRedirectPath");
-
 // src/client/server/authCookiePersistence.ts
 var DEFAULTS = {
   authCookieNames: ["refreshToken", "najm.session"],
@@ -1742,9 +1593,9 @@ function withAuthCookiePersistence(handler, options = {}) {
       statusText: response.statusText
     });
   }, "applyAction");
-  return async (request) => {
+  return async (request, ...args) => {
     let action = await resolveAction(request);
-    const response = await handler(request);
+    const response = await handler(request, ...args);
     if (!response.ok) return response;
     if (action?.type === "apply" && loginPaths.includes(new URL(request.url).pathname)) {
       const payload = await response.clone().json().catch(() => null);
@@ -1761,6 +1612,176 @@ function withAuthCookiePersistence(handler, options = {}) {
   };
 }
 __name(withAuthCookiePersistence, "withAuthCookiePersistence");
+
+// src/client/server/defineAuth.ts
+function defineAuth(authConfig = {}) {
+  const {
+    apiBaseURL = "/api",
+    authPrefix = "/auth",
+    loginRoute = "/login",
+    forbiddenRoute = "/forbidden",
+    publicRoutes = [],
+    protectedRoutes = [],
+    roleRoutes = {},
+    cookieName: cookieName2 = "refreshToken",
+    sessionCookieName = "najm.session",
+    sessionSecret,
+    sessionMaxAge,
+    recoveryURL,
+    internalRecoveryURL,
+    matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
+    verifyAlways,
+    proxySessionMode,
+    onRecoveryFailure,
+    refreshThreshold,
+    tabSync,
+    channelName,
+    timeout,
+    retry
+  } = authConfig;
+  const sessionConfig = {
+    baseURL: apiBaseURL,
+    authPrefix,
+    cookieName: cookieName2,
+    sessionCookieName,
+    sessionSecret,
+    sessionMaxAge,
+    recoveryURL,
+    internalRecoveryURL,
+    onRecoveryFailure
+  };
+  let _client = null;
+  const getClient = /* @__PURE__ */ __name(() => {
+    if (_client) return _client;
+    _client = createAuthClient({
+      baseURL: apiBaseURL,
+      authPrefix,
+      refreshThreshold,
+      tabSync,
+      channelName,
+      timeout,
+      retry
+    });
+    return _client;
+  }, "getClient");
+  const getSession2 = /* @__PURE__ */ __name(async (opts) => {
+    const { getSession: resolveSession } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
+    return resolveSession({ ...sessionConfig, ...opts });
+  }, "getSession");
+  const resolveSessionOutcome2 = /* @__PURE__ */ __name(async () => {
+    const { resolveSessionOutcome: resolve } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
+    return resolve(sessionConfig);
+  }, "resolveSessionOutcome");
+  const requireSession = /* @__PURE__ */ __name(async () => {
+    const outcome = await resolveSessionOutcome2();
+    if (outcome.status === "authenticated") return outcome.session;
+    if (redirectsToLogin(outcome)) {
+      const { redirect } = await import("next/navigation");
+      redirect(loginRoute);
+    }
+    throw outcome.error;
+  }, "requireSession");
+  const requireRole = /* @__PURE__ */ __name(async (roles) => {
+    const session = await requireSession();
+    if (!heldRoles(session).some((role) => roles.includes(role))) {
+      const { redirect } = await import("next/navigation");
+      redirect(forbiddenRoute);
+    }
+    return session;
+  }, "requireRole");
+  const middleware = withAuthMiddleware({
+    protectedRoutes,
+    publicRoutes,
+    loginRoute,
+    roleRoutes,
+    cookieName: cookieName2,
+    apiBaseURL,
+    authPrefix,
+    sessionCookieName,
+    sessionSecret,
+    sessionMaxAge,
+    recoveryURL,
+    internalRecoveryURL,
+    verifyAlways,
+    proxySessionMode,
+    onRecoveryFailure
+  });
+  const routeHandlers = /* @__PURE__ */ __name((handler, options = {}) => {
+    const persistentHandler = withAuthCookiePersistence(handler, {
+      ...options,
+      authCookieNames: options.authCookieNames ?? [cookieName2, sessionCookieName]
+    });
+    return {
+      GET: persistentHandler,
+      POST: persistentHandler,
+      PUT: persistentHandler,
+      PATCH: persistentHandler,
+      DELETE: persistentHandler,
+      HEAD: persistentHandler,
+      OPTIONS: persistentHandler
+    };
+  }, "routeHandlers");
+  const protect = /* @__PURE__ */ __name((Page, options) => {
+    return /* @__PURE__ */ __name(async function ProtectedPage(props) {
+      const session = await getSession2();
+      if (!session) {
+        const { redirect } = await import("next/navigation");
+        redirect(loginRoute);
+      }
+      if (options?.role) {
+        if (!heldRoles(session).includes(options.role)) {
+          const { redirect } = await import("next/navigation");
+          redirect(forbiddenRoute);
+        }
+      }
+      if (options?.permission) {
+        const { matchPermission: matchPermission2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
+        const perms = session.permissions ?? session.user.permissions ?? [];
+        if (!matchPermission2(perms, options.permission)) {
+          const { redirect } = await import("next/navigation");
+          redirect(forbiddenRoute);
+        }
+      }
+      return Page({ session, ...props });
+    }, "ProtectedPage");
+  }, "protect");
+  return attachReactServerInternals({
+    get client() {
+      return getClient();
+    },
+    get api() {
+      return getClient().api;
+    },
+    getSession: getSession2,
+    requireSession,
+    requireRole,
+    proxy: middleware,
+    middleware,
+    config: { matcher },
+    routeHandlers,
+    protect
+  }, { resolveSessionOutcome: resolveSessionOutcome2, loginRoute, forbiddenRoute });
+}
+__name(defineAuth, "defineAuth");
+
+// src/client/server/safeRedirect.ts
+var DEFAULT_BLOCKED_PREFIXES = ["/api", "/login", "/_next"];
+var ASSET_EXTENSIONS = /\.(?:css|gif|ico|jpe?g|js|json|map|png|svg|webmanifest|webp)$/i;
+function getSafeRedirectPath(value, options = {}) {
+  const {
+    fallback = "/dashboard",
+    blockedPrefixes = DEFAULT_BLOCKED_PREFIXES
+  } = typeof options === "string" ? { fallback: options } : options;
+  const path = Array.isArray(value) ? value[0] : value;
+  if (!path || !path.startsWith("/") || // Protocol-relative: the browser treats `//host/x` as off-site.
+  path.startsWith("//") || // A backslash is normalized to a forward slash by some browsers, so
+  // `/\evil.test` is another way to spell the case above.
+  path.startsWith("/\\") || blockedPrefixes.some((prefix) => path.startsWith(prefix)) || ASSET_EXTENSIONS.test(path.split("?")[0] ?? path)) {
+    return fallback;
+  }
+  return path;
+}
+__name(getSafeRedirectPath, "getSafeRedirectPath");
 export {
   AuthConfigError,
   AuthTransportError,

package/dist/index.d.ts

@@ -169,6 +169,8 @@ interface AuthConfig {
     frontendUrl: string;
     /** Registration mode: 'active' auto-activates, 'pending' requires admin approval (default: 'active') */
     registrationMode: 'active' | 'pending';
+    /** Whether the unauthenticated POST /auth/register route is mounted. */
+    publicRegistration: boolean;
     /** When true, users with emailVerified=false are blocked from logging in (default: false) */
     requireVerifiedEmail: boolean;
     /** Cookie path for the refresh token. Scope to the refresh endpoint to limit exposure (default: '/') */
@@ -234,6 +236,13 @@ type AuthPluginConfig = {
     frontendUrl?: string;
     /** Registration mode: 'active' auto-activates new users, 'pending' requires admin approval (default: 'active') */
     registrationMode?: 'active' | 'pending';
+    /**
+     * Mount the unauthenticated POST /auth/register route (default: true for
+     * backwards compatibility). Set false when onboarding belongs to an
+     * application-owned approval flow. Internal AuthService provisioning stays
+     * available.
+     */
+    publicRegistration?: boolean;
     /** Block login for users whose email is not verified (default: false) */
     requireVerifiedEmail?: boolean;
     /** Cookie path for the refresh token (default: '/'). Set e.g. '/auth' to keep it off unrelated routes. */
@@ -705,6 +714,7 @@ declare class UserValidator {
      * Check if user exists by email
      */
     checkUserExistsByEmail(email: string): Promise<{
+        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -713,9 +723,8 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
-        password: string;
         image: string;
-        status: "active" | "inactive" | "pending";
+        status: "active" | "pending" | "inactive";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -727,6 +736,7 @@ declare class UserValidator {
      * Check if email exists in database
      */
     checkEmailExists(email: string): Promise<{
+        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -735,9 +745,8 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
-        password: string;
         image: string;
-        status: "active" | "inactive" | "pending";
+        status: "active" | "pending" | "inactive";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1260,8 +1269,8 @@ declare const createUserDto: z.ZodObject<{
     emailVerified: z.ZodDefault<z.ZodBoolean>;
     status: z.ZodOptional<z.ZodEnum<{
         active: "active";
-        inactive: "inactive";
         pending: "pending";
+        inactive: "inactive";
     }>>;
 }, z.core.$strip>;
 declare const updateUserDto: z.ZodObject<{
@@ -1273,8 +1282,8 @@ declare const updateUserDto: z.ZodObject<{
     emailVerified: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
     status: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
         active: "active";
-        inactive: "inactive";
         pending: "pending";
+        inactive: "inactive";
     }>>>;
 }, z.core.$strip>;
 declare const registerDto: z.ZodObject<{
@@ -1652,9 +1661,9 @@ declare const authIdentityRateLimitKey: (ctx: Context) => Promise<string>;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);
-    registerUser(body: RegisterDto): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<LoginResult>;
     inviteUser(body: InviteUserDto): Promise<Omit<{
+        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1663,9 +1672,8 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
-        password: string;
         image: string;
-        status: "active" | "inactive" | "pending";
+        status: "active" | "pending" | "inactive";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1688,6 +1696,7 @@ declare class AuthController {
         message: string;
     }>;
     userProfile(authorization?: string): Promise<Omit<{
+        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1696,9 +1705,8 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
-        password: string;
         image: string;
-        status: "active" | "inactive" | "pending";
+        status: "active" | "pending" | "inactive";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1772,6 +1780,17 @@ declare class AuthIdentityContextService {
     configure(): Promise<void>;
 }
 
+/**
+ * Public self-registration is isolated from the rest of the auth transport so
+ * applications can omit this controller without disabling internal account
+ * provisioning through AuthService.
+ */
+declare class RegistrationController {
+    private authService;
+    constructor(authService: AuthService);
+    registerUser(body: RegisterDto): Promise<SanitizedUser>;
+}
+
 type IdentityResolver = (value: unknown) => string | null;
 /**
  * Build the identifier pipeline used by login lookup, lockout accounting, and
@@ -1811,7 +1830,10 @@ interface RunAsUser {
 }
 declare function runAsUser<T>(container: Container, user: RunAsUser, fn: () => Promise<T> | T): Promise<T>;
 
-declare const AUTH_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService];
+declare const AUTH_CORE_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService];
+declare const PUBLIC_REGISTRATION_MODULE: readonly [typeof RegistrationController];
+/** Full module retained for consumers that register the exported module directly. */
+declare const AUTH_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService, typeof RegistrationController];
 
 declare class PermissionRepository {
     db: TDb;
@@ -2765,4 +2787,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };