najm-auth 3.2.0 → 3.3.0

package/dist/index.js

@@ -3254,19 +3254,16 @@ var AuthService = class AuthService2 {
       user.failedLoginAttempts = 0;
       user.lockoutUntil = null;
     }
-    if (user && this.isLockoutActive(user.lockoutUntil)) {
-      Err12(this.t("errors.accountLocked"), 423);
-    }
+    const isLocked = Boolean(user && this.isLockoutActive(user.lockoutUntil));
     const requirement = await this.credentialSetupRequirements?.find(user?.id ?? "", PASSWORD_SETUP_PURPOSE);
     const { credential, kindUnavailable } = this.resolveLoginCredential(body.password, requirement);
     const storedHash = kindUnavailable || !user?.password ? await this.getDummyHash() : user.password;
     const isValid = await this.userValidator.comparePassword(credential, storedHash);
-    if (!user || !isValid) {
-      if (user) {
+    if (!user || !isValid || isLocked) {
+      if (user && !isLocked) {
         const attempts = await this.userService.incrementFailedAttempts(user.id);
         if (attempts >= this.config.lockout.maxAttempts) {
           await this.userService.setLockout(user.id, this.nextLockoutUntil());
-          Err12(this.t("errors.accountLocked"), 423);
         }
       }
       Err12(this.t("errors.invalidCredentials"), 401);
@@ -3564,7 +3561,7 @@ var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
 // src/auth/AuthController.ts
 import { Validate } from "najm-validation";
-import { RateLimit } from "najm-rate";
+import { RateLimit, UNRESOLVED_CLIENT_ADDRESS } from "najm-rate";
 import { createHash as createHash3 } from "crypto";
 
 // src/identity/requestResolver.ts
@@ -3742,14 +3739,13 @@ var __param5 = function(paramIndex, decorator) {
 };
 var _a12;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash3("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
-var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx, { clientIp }) => {
   const cookie = ctx.req.raw.headers.get("cookie") ?? "";
   const fingerprint = cookie ? hashKeyPart(cookie) : "none";
-  return `${ip}:${fingerprint}`;
+  return `${clientIp}:${fingerprint}`;
 }, "cookieFingerprint");
-var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx, keyContext) => {
+  const ip = keyContext?.clientIp ?? UNRESOLVED_CLIENT_ADDRESS;
   try {
     const body = await ctx.req.json();
     const identity = body?.identifier ?? body?.email;
@@ -3770,9 +3766,6 @@ var AuthController = class AuthController2 {
   constructor(authService) {
     this.authService = authService;
   }
-  async registerUser(body) {
-    return this.authService.registerUser(body);
-  }
   async loginUser(body) {
     return this.authService.loginUser(body);
   }
@@ -3806,16 +3799,6 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate20([
-  Post("/register"),
-  RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey }),
-  Validate(registerDto),
-  ResMsg("auth.success.register"),
-  __param5(0, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [Object]),
-  __metadata20("design:returntype", Promise)
-], AuthController.prototype, "registerUser", null);
 __decorate20([
   Post("/login"),
   RateLimit({
@@ -4110,6 +4093,52 @@ AuthIdentityContextService = __decorate22([
   __metadata22("design:paramtypes", [Object])
 ], AuthIdentityContextService);
 
+// src/auth/RegistrationController.ts
+import { Body as Body2, Controller as Controller2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { RateLimit as RateLimit2 } from "najm-rate";
+import { Validate as Validate2 } from "najm-validation";
+var __decorate23 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata23 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param7 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a14;
+var RegistrationController = class RegistrationController2 {
+  static {
+    __name(this, "RegistrationController");
+  }
+  authService;
+  constructor(authService) {
+    this.authService = authService;
+  }
+  async registerUser(body) {
+    return this.authService.registerUser(body);
+  }
+};
+__decorate23([
+  Post2("/register"),
+  RateLimit2({ limit: 5, window: "15m", key: authIdentityRateLimitKey }),
+  Validate2(registerDto),
+  ResMsg2("auth.success.register"),
+  __param7(0, Body2()),
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
+], RegistrationController.prototype, "registerUser", null);
+RegistrationController = __decorate23([
+  Controller2("/auth"),
+  __metadata23("design:paramtypes", [typeof (_a14 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a14 : Object])
+], RegistrationController);
+
 // src/auth/runAsUser.ts
 import { randomUUID } from "crypto";
 function runAsUser(container, user, fn) {
@@ -4134,7 +4163,7 @@ function runAsUser(container, user, fn) {
 __name(runAsUser, "runAsUser");
 
 // src/auth/index.ts
-var AUTH_MODULE = [
+var AUTH_CORE_MODULE = [
   AuthService,
   AuthSessionService,
   CookieManager,
@@ -4144,6 +4173,11 @@ var AUTH_MODULE = [
   AuthResolver,
   AuthIdentityContextService
 ];
+var PUBLIC_REGISTRATION_MODULE = [RegistrationController];
+var AUTH_MODULE = [
+  ...AUTH_CORE_MODULE,
+  ...PUBLIC_REGISTRATION_MODULE
+];
 
 // src/users/index.ts
 var users_exports = {};
@@ -4169,9 +4203,9 @@ __export(users_exports, {
 });
 
 // src/users/UserController.ts
-import { Controller as Controller3 } from "najm-core";
-import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
-import { Params as Params2, Body as Body3, Query } from "najm-core";
+import { Controller as Controller4 } from "najm-core";
+import { Get as Get3, Post as Post4, Put as Put2, Delete as Delete2, ResMsg as ResMsg4 } from "najm-core";
+import { Params as Params2, Body as Body4, Query } from "najm-core";
 
 // src/roles/index.ts
 var roles_exports = {};
@@ -4230,10 +4264,10 @@ function defineRoles(roles, options) {
 __name(defineRoles, "defineRoles");
 
 // src/roles/RoleController.ts
-import { Controller as Controller2 } from "najm-core";
-import { Get as Get2, Post as Post2, Put, Delete, ResMsg as ResMsg2 } from "najm-core";
-import { Params, Body as Body2 } from "najm-core";
-import { Validate as Validate2 } from "najm-validation";
+import { Controller as Controller3 } from "najm-core";
+import { Get as Get2, Post as Post3, Put, Delete, ResMsg as ResMsg3 } from "najm-core";
+import { Params, Body as Body3 } from "najm-core";
+import { Validate as Validate3 } from "najm-validation";
 
 // src/roles/RoleDto.ts
 import { z as z2 } from "zod";
@@ -4253,21 +4287,21 @@ var assignRoleDto = z2.object({
 });
 
 // src/roles/RoleController.ts
-var __decorate23 = function(decorators, target, key, desc) {
+var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata23 = function(k, v) {
+var __metadata24 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param7 = function(paramIndex, decorator) {
+var __param8 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a14;
+var _a15;
 var RoleController = class RoleController2 {
   static {
     __name(this, "RoleController");
@@ -4292,80 +4326,80 @@ var RoleController = class RoleController2 {
     return this.roleService.delete(params.id);
   }
 };
-__decorate23([
+__decorate24([
   Get2(),
   isAdmin(),
-  ResMsg2("roles.success.retrieved"),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", []),
-  __metadata23("design:returntype", Promise)
+  ResMsg3("roles.success.retrieved"),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", []),
+  __metadata24("design:returntype", Promise)
 ], RoleController.prototype, "getRoles", null);
-__decorate23([
+__decorate24([
   Get2("/:id"),
   isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.retrieved"),
-  __param7(0, Params()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  Validate3({ params: roleIdParam }),
+  ResMsg3("roles.success.retrieved"),
+  __param8(0, Params()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], RoleController.prototype, "getRole", null);
-__decorate23([
-  Post2(),
+__decorate24([
+  Post3(),
   isAdmin(),
-  Validate2(createRoleDto),
-  ResMsg2("roles.success.created"),
-  __param7(0, Body2()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  Validate3(createRoleDto),
+  ResMsg3("roles.success.created"),
+  __param8(0, Body3()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], RoleController.prototype, "createRole", null);
-__decorate23([
+__decorate24([
   Put("/:id"),
   isAdmin(),
-  Validate2({
+  Validate3({
     params: roleIdParam,
     body: updateRoleDto
   }),
-  ResMsg2("roles.success.updated"),
-  __param7(0, Params()),
-  __param7(1, Body2()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object, Object]),
-  __metadata23("design:returntype", Promise)
+  ResMsg3("roles.success.updated"),
+  __param8(0, Params()),
+  __param8(1, Body3()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object, Object]),
+  __metadata24("design:returntype", Promise)
 ], RoleController.prototype, "updateRole", null);
-__decorate23([
+__decorate24([
   Delete("/:id"),
   isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.deleted"),
-  __param7(0, Params()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  Validate3({ params: roleIdParam }),
+  ResMsg3("roles.success.deleted"),
+  __param8(0, Params()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate23([
-  Controller2("/roles"),
-  __metadata23("design:paramtypes", [typeof (_a14 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a14 : Object])
+RoleController = __decorate24([
+  Controller3("/roles"),
+  __metadata24("design:paramtypes", [typeof (_a15 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a15 : Object])
 ], RoleController);
 
 // src/users/UserController.ts
-import { Validate as Validate3 } from "najm-validation";
-var __decorate24 = function(decorators, target, key, desc) {
+import { Validate as Validate4 } from "najm-validation";
+var __decorate25 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata24 = function(k, v) {
+var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param8 = function(paramIndex, decorator) {
+var __param9 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a15;
+var _a16;
 var UserController = class UserController2 {
   static {
     __name(this, "UserController");
@@ -4412,129 +4446,129 @@ var UserController = class UserController2 {
     return this.userService.removeRole(params.userId);
   }
 };
-__decorate24([
+__decorate25([
   Get3(),
   isAdmin(),
-  Validate3({ query: userListQuery }),
-  ResMsg3("users.success.retrieved"),
-  __param8(0, Query()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ query: userListQuery }),
+  ResMsg4("users.success.retrieved"),
+  __param9(0, Query()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
-__decorate24([
+__decorate25([
   Get3("/lang"),
   isAuth(),
-  ResMsg3("users.success.retrieved"),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", []),
-  __metadata24("design:returntype", Promise)
+  ResMsg4("users.success.retrieved"),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", []),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "getLang", null);
-__decorate24([
-  Post3("/lang/:language"),
+__decorate25([
+  Post4("/lang/:language"),
   isAuth(),
-  Validate3({ params: languageParam }),
-  ResMsg3("users.success.updated"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: languageParam }),
+  ResMsg4("users.success.updated"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "updateLang", null);
-__decorate24([
+__decorate25([
   Get3("/:id"),
   isAdmin(),
-  Validate3({ params: userIdParam }),
-  ResMsg3("users.success.retrieved"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: userIdParam }),
+  ResMsg4("users.success.retrieved"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "getUser", null);
-__decorate24([
+__decorate25([
   Get3("/email/:email"),
   isAdmin(),
-  Validate3({ params: emailParam }),
-  ResMsg3("users.success.retrieved"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: emailParam }),
+  ResMsg4("users.success.retrieved"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "getByEmail", null);
-__decorate24([
+__decorate25([
   Get3("/role/:userId"),
   isAdmin(),
-  Validate3({ params: userIdInParam }),
-  ResMsg3("users.success.retrieved"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: userIdInParam }),
+  ResMsg4("users.success.retrieved"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "getRole", null);
-__decorate24([
-  Post3(),
+__decorate25([
+  Post4(),
   isAdmin(),
-  Validate3(createUserDto),
-  ResMsg3("users.success.created"),
-  __param8(0, Body3()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4(createUserDto),
+  ResMsg4("users.success.created"),
+  __param9(0, Body4()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "create", null);
-__decorate24([
+__decorate25([
   Put2("/:id"),
   isAdmin(),
-  Validate3({
+  Validate4({
     params: userIdParam,
     body: updateUserDto
   }),
-  ResMsg3("users.success.updated"),
-  __param8(0, Params2()),
-  __param8(1, Body3()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object, Object]),
-  __metadata24("design:returntype", Promise)
+  ResMsg4("users.success.updated"),
+  __param9(0, Params2()),
+  __param9(1, Body4()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object, Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "update", null);
-__decorate24([
+__decorate25([
   Delete2("/:id"),
   isAdmin(),
-  Validate3({ params: userIdParam }),
-  ResMsg3("users.success.deleted"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: userIdParam }),
+  ResMsg4("users.success.deleted"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "delete", null);
-__decorate24([
+__decorate25([
   Delete2(),
   isAdmin(),
-  ResMsg3("users.success.allDeleted"),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", []),
-  __metadata24("design:returntype", Promise)
+  ResMsg4("users.success.allDeleted"),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", []),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "deleteAll", null);
-__decorate24([
-  Post3("/assign/:userId/:roleId"),
+__decorate25([
+  Post4("/assign/:userId/:roleId"),
   isAdmin(),
-  Validate3({ params: assignRoleParams }),
-  ResMsg3("users.success.updated"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: assignRoleParams }),
+  ResMsg4("users.success.updated"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "assignRole", null);
-__decorate24([
+__decorate25([
   Delete2("/remove/:userId"),
   isAdmin(),
-  Validate3({ params: userIdInParam }),
-  ResMsg3("users.success.updated"),
-  __param8(0, Params2()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  Validate4({ params: userIdInParam }),
+  ResMsg4("users.success.updated"),
+  __param9(0, Params2()),
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], UserController.prototype, "removeRole", null);
-UserController = __decorate24([
-  Controller3("/users"),
-  __metadata24("design:paramtypes", [typeof (_a15 = typeof UserService !== "undefined" && UserService) === "function" ? _a15 : Object])
+UserController = __decorate25([
+  Controller4("/users"),
+  __metadata25("design:paramtypes", [typeof (_a16 = typeof UserService !== "undefined" && UserService) === "function" ? _a16 : Object])
 ], UserController);
 
 // src/permissions/index.ts
@@ -4557,13 +4591,13 @@ __export(permissions_exports, {
 import { eq as eq7, and as and4 } from "drizzle-orm";
 import { Repository as Repository6, Inject as Inject14 } from "najm-core";
 import { DB as DB6 } from "najm-database";
-var __decorate25 = function(decorators, target, key, desc) {
+var __decorate26 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata25 = function(k, v) {
+var __metadata26 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var PermissionRepository = class PermissionRepository2 {
@@ -4641,15 +4675,15 @@ var PermissionRepository = class PermissionRepository2 {
     return deletedPermissions;
   }
 };
-__decorate25([
+__decorate26([
   DB6(),
-  __metadata25("design:type", Object)
+  __metadata26("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
-__decorate25([
+__decorate26([
   Inject14(AUTH_SCHEMA),
-  __metadata25("design:type", Object)
+  __metadata26("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
-PermissionRepository = __decorate25([
+PermissionRepository = __decorate26([
   Repository6()
 ], PermissionRepository);
 
@@ -4657,16 +4691,16 @@ PermissionRepository = __decorate25([
 import { Injectable as Injectable12 } from "najm-core";
 import { GuardParams as GuardParams2, User as User3 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
-var __decorate26 = function(decorators, target, key, desc) {
+var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata26 = function(k, v) {
+var __metadata27 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param9 = function(paramIndex, decorator) {
+var __param10 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
@@ -4699,23 +4733,23 @@ var PermissionGuard = class PermissionGuard2 {
     return false;
   }
 };
-__decorate26([
-  __param9(0, GuardParams2()),
-  __param9(1, User3("permissions")),
-  __metadata26("design:type", Function),
-  __metadata26("design:paramtypes", [String, Array]),
-  __metadata26("design:returntype", Object)
+__decorate27([
+  __param10(0, GuardParams2()),
+  __param10(1, User3("permissions")),
+  __metadata27("design:type", Function),
+  __metadata27("design:paramtypes", [String, Array]),
+  __metadata27("design:returntype", Object)
 ], PermissionGuard.prototype, "canActivate", null);
-PermissionGuard = __decorate26([
+PermissionGuard = __decorate27([
   Injectable12()
 ], PermissionGuard);
 var Permission = createGuard4(PermissionGuard);
 var Can = /* @__PURE__ */ __name((permission) => composeGuards3(isAuth(), Permission(permission))(), "Can");
 
 // src/permissions/PermissionController.ts
-import { Controller as Controller4 } from "najm-core";
-import { Get as Get4, Post as Post4, Put as Put3, Delete as Delete3, ResMsg as ResMsg4 } from "najm-core";
-import { Params as Params3, Body as Body4 } from "najm-core";
+import { Controller as Controller5 } from "najm-core";
+import { Get as Get4, Post as Post5, Put as Put3, Delete as Delete3, ResMsg as ResMsg5 } from "najm-core";
+import { Params as Params3, Body as Body5 } from "najm-core";
 
 // src/permissions/PermissionService.ts
 import { Injectable as Injectable14 } from "najm-core";
@@ -4724,16 +4758,16 @@ import { Injectable as Injectable14 } from "najm-core";
 import { Injectable as Injectable13 } from "najm-core";
 import { I18n as I18n9 } from "najm-i18n";
 import { Err as Err14 } from "najm-core";
-var __decorate27 = function(decorators, target, key, desc) {
+var __decorate28 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata27 = function(k, v) {
+var __metadata28 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a16;
+var _a17;
 var _b10;
 var PermissionValidator = class PermissionValidator2 {
   static {
@@ -4801,26 +4835,26 @@ var PermissionValidator = class PermissionValidator2 {
     }
   }
 };
-__decorate27([
+__decorate28([
   I18n9("permissions"),
-  __metadata27("design:type", Object)
+  __metadata28("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
-PermissionValidator = __decorate27([
+PermissionValidator = __decorate28([
   Injectable13(),
-  __metadata27("design:paramtypes", [typeof (_a16 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a16 : Object, typeof (_b10 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b10 : Object])
+  __metadata28("design:paramtypes", [typeof (_a17 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a17 : Object, typeof (_b10 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b10 : Object])
 ], PermissionValidator);
 
 // src/permissions/PermissionService.ts
-var __decorate28 = function(decorators, target, key, desc) {
+var __decorate29 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata28 = function(k, v) {
+var __metadata29 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a17;
+var _a18;
 var _b11;
 var _c8;
 var PermissionService = class PermissionService2 {
@@ -4927,13 +4961,13 @@ var PermissionService = class PermissionService2 {
     return await this.permissionRepository.deleteAll();
   }
 };
-PermissionService = __decorate28([
+PermissionService = __decorate29([
   Injectable14(),
-  __metadata28("design:paramtypes", [typeof (_a17 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a17 : Object, typeof (_b11 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b11 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object])
+  __metadata29("design:paramtypes", [typeof (_a18 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a18 : Object, typeof (_b11 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b11 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
-import { Validate as Validate4 } from "najm-validation";
+import { Validate as Validate5 } from "najm-validation";
 
 // src/permissions/PermissionDto.ts
 import { z as z3 } from "zod";
@@ -4962,21 +4996,21 @@ var checkPermissionDto = z3.object({
 });
 
 // src/permissions/PermissionController.ts
-var __decorate29 = function(decorators, target, key, desc) {
+var __decorate30 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata29 = function(k, v) {
+var __metadata30 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param10 = function(paramIndex, decorator) {
+var __param11 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a18;
+var _a19;
 var PermissionController = class PermissionController2 {
   static {
     __name(this, "PermissionController");
@@ -5022,101 +5056,101 @@ var PermissionController = class PermissionController2 {
     return this.permissionService.deleteAll();
   }
 };
-__decorate29([
+__decorate30([
   Get4(),
-  ResMsg4("permissions.success.retrieved"),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", []),
-  __metadata29("design:returntype", Promise)
+  ResMsg5("permissions.success.retrieved"),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", []),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "getPermissions", null);
-__decorate29([
+__decorate30([
   Get4("/:id"),
-  Validate4({ params: permissionIdParam }),
-  ResMsg4("permissions.success.retrieved"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+  Validate5({ params: permissionIdParam }),
+  ResMsg5("permissions.success.retrieved"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "getPermission", null);
-__decorate29([
-  Post4(),
-  Validate4(createPermissionDto),
-  ResMsg4({ message: "Permission created successfully", status: 201 }),
-  __param10(0, Body4()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+__decorate30([
+  Post5(),
+  Validate5(createPermissionDto),
+  ResMsg5({ message: "Permission created successfully", status: 201 }),
+  __param11(0, Body5()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "create", null);
-__decorate29([
+__decorate30([
   Put3("/:id"),
-  Validate4({
+  Validate5({
     params: permissionIdParam,
     body: updatePermissionDto
   }),
-  ResMsg4("permissions.success.updated"),
-  __param10(0, Params3()),
-  __param10(1, Body4()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object, Object]),
-  __metadata29("design:returntype", Promise)
+  ResMsg5("permissions.success.updated"),
+  __param11(0, Params3()),
+  __param11(1, Body5()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object, Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "update", null);
-__decorate29([
+__decorate30([
   Delete3("/:id"),
-  Validate4({ params: permissionIdParam }),
-  ResMsg4("permissions.success.deleted"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+  Validate5({ params: permissionIdParam }),
+  ResMsg5("permissions.success.deleted"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "delete", null);
-__decorate29([
+__decorate30([
   Get4("/role/:id"),
-  Validate4({ params: roleIdParam }),
-  ResMsg4("permissions.success.retrieved"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+  Validate5({ params: roleIdParam }),
+  ResMsg5("permissions.success.retrieved"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "getByRole", null);
-__decorate29([
+__decorate30([
   Get4("/roles/:id"),
-  Validate4({ params: permissionIdParam }),
-  ResMsg4("permissions.success.retrieved"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+  Validate5({ params: permissionIdParam }),
+  ResMsg5("permissions.success.retrieved"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "getRolesByPermission", null);
-__decorate29([
-  Post4("/assign/:roleId/:permissionId"),
-  Validate4({ params: assignPermissionDto }),
-  ResMsg4("permissions.success.assigned"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+__decorate30([
+  Post5("/assign/:roleId/:permissionId"),
+  Validate5({ params: assignPermissionDto }),
+  ResMsg5("permissions.success.assigned"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "assignToRole", null);
-__decorate29([
+__decorate30([
   Delete3("/remove/:roleId/:permissionId"),
-  Validate4({ params: assignPermissionDto }),
-  ResMsg4("permissions.success.removed"),
-  __param10(0, Params3()),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", Promise)
+  Validate5({ params: assignPermissionDto }),
+  ResMsg5("permissions.success.removed"),
+  __param11(0, Params3()),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", [Object]),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "removeFromRole", null);
-__decorate29([
+__decorate30([
   Delete3(),
   isAdmin(),
-  ResMsg4("permissions.success.allDeleted"),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", []),
-  __metadata29("design:returntype", Promise)
+  ResMsg5("permissions.success.allDeleted"),
+  __metadata30("design:type", Function),
+  __metadata30("design:paramtypes", []),
+  __metadata30("design:returntype", Promise)
 ], PermissionController.prototype, "deleteAll", null);
-PermissionController = __decorate29([
-  Controller4("/permissions"),
+PermissionController = __decorate30([
+  Controller5("/permissions"),
   isAdmin(),
-  __metadata29("design:paramtypes", [typeof (_a18 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a18 : Object])
+  __metadata30("design:paramtypes", [typeof (_a19 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a19 : Object])
 ], PermissionController);
 
 // src/tokens/index.ts
@@ -5323,18 +5357,18 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable15, Inject as Inject15, User as User4, Body as Body5, Params as Params4 } from "najm-core";
+import { Injectable as Injectable15, Inject as Inject15, User as User4, Body as Body6, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
-var __decorate30 = function(decorators, target, key, desc) {
+var __decorate31 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata30 = function(k, v) {
+var __metadata31 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param11 = function(paramIndex, decorator) {
+var __param12 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
@@ -5351,7 +5385,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a26, _b15;
+  var _a27, _b15;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -5363,18 +5397,18 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return allowed ? { owner: user } : false;
     }
   };
-  __decorate30([
+  __decorate31([
     Inject15(ownershipClass),
-    __metadata30("design:type", Object)
+    __metadata31("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
-  __decorate30([
-    __param11(0, User4()),
-    __param11(1, Params4("id")),
-    __metadata30("design:type", Function),
-    __metadata30("design:paramtypes", [Object, String]),
-    __metadata30("design:returntype", typeof (_a26 = typeof Promise !== "undefined" && Promise) === "function" ? _a26 : Object)
+  __decorate31([
+    __param12(0, User4()),
+    __param12(1, Params4("id")),
+    __metadata31("design:type", Function),
+    __metadata31("design:paramtypes", [Object, String]),
+    __metadata31("design:returntype", typeof (_a27 = typeof Promise !== "undefined" && Promise) === "function" ? _a27 : Object)
   ], AccessGuard.prototype, "canActivate", null);
-  AccessGuard = __decorate30([
+  AccessGuard = __decorate31([
     Injectable15()
   ], AccessGuard);
   let ListGuard = class ListGuard {
@@ -5387,17 +5421,17 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return { filter: ids };
     }
   };
-  __decorate30([
+  __decorate31([
     Inject15(ownershipClass),
-    __metadata30("design:type", Object)
+    __metadata31("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
-  __decorate30([
-    __param11(0, User4()),
-    __metadata30("design:type", Function),
-    __metadata30("design:paramtypes", [Object]),
-    __metadata30("design:returntype", typeof (_b15 = typeof Promise !== "undefined" && Promise) === "function" ? _b15 : Object)
+  __decorate31([
+    __param12(0, User4()),
+    __metadata31("design:type", Function),
+    __metadata31("design:paramtypes", [Object]),
+    __metadata31("design:returntype", typeof (_b15 = typeof Promise !== "undefined" && Promise) === "function" ? _b15 : Object)
   ], ListGuard.prototype, "canActivate", null);
-  ListGuard = __decorate30([
+  ListGuard = __decorate31([
     Injectable15()
   ], ListGuard);
   const access = createGuard5(AccessGuard);
@@ -5529,11 +5563,11 @@ function configureOwnership(config) {
       }
     }
   };
-  GeneratedOwnershipService = __decorate30([
+  GeneratedOwnershipService = __decorate31([
     Injectable15()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a26;
+    var _a27;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -5546,18 +5580,18 @@ function configureOwnership(config) {
         return this.ownership.canAccess(user, resourceType, id);
       }
     };
-    __decorate30([
+    __decorate31([
       Inject15(GeneratedOwnershipService),
-      __metadata30("design:type", GeneratedOwnershipService)
+      __metadata31("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
-    __decorate30([
-      __param11(0, User4()),
-      __param11(1, Body5()),
-      __metadata30("design:type", Function),
-      __metadata30("design:paramtypes", [Object, Object]),
-      __metadata30("design:returntype", typeof (_a26 = typeof Promise !== "undefined" && Promise) === "function" ? _a26 : Object)
+    __decorate31([
+      __param12(0, User4()),
+      __param12(1, Body6()),
+      __metadata31("design:type", Function),
+      __metadata31("design:paramtypes", [Object, Object]),
+      __metadata31("design:returntype", typeof (_a27 = typeof Promise !== "undefined" && Promise) === "function" ? _a27 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
-    BodyAccessGuard = __decorate30([
+    BodyAccessGuard = __decorate31([
       Injectable15()
     ], BodyAccessGuard);
     return createGuard5(BodyAccessGuard);
@@ -5675,16 +5709,16 @@ import "reflect-metadata";
 import { sql as sql5, and as and5 } from "drizzle-orm";
 import { Injectable as Injectable16, Inject as Inject16, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
-var __decorate31 = function(decorators, target, key, desc) {
+var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata31 = function(k, v) {
+var __metadata32 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a19;
+var _a20;
 var OWNED_META = Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
@@ -5716,11 +5750,11 @@ var ScopeContext = class ScopeContext2 {
     }
   }
 };
-__decorate31([
+__decorate32([
   DI3(),
-  __metadata31("design:type", typeof (_a19 = typeof Container2 !== "undefined" && Container2) === "function" ? _a19 : Object)
+  __metadata32("design:type", typeof (_a20 = typeof Container2 !== "undefined" && Container2) === "function" ? _a20 : Object)
 ], ScopeContext.prototype, "container", void 0);
-ScopeContext = __decorate31([
+ScopeContext = __decorate32([
   Injectable16()
 ], ScopeContext);
 function Owned(token) {
@@ -5957,13 +5991,13 @@ var OAuthFlowError = class extends Error {
 // src/oauth/google/GoogleTokenVerifier.ts
 import { Inject as Inject17, Injectable as Injectable17 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-var __decorate32 = function(decorators, target, key, desc) {
+var __decorate33 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata32 = function(k, v) {
+var __metadata33 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
@@ -6015,25 +6049,25 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
     return google;
   }
 };
-__decorate32([
+__decorate33([
   Inject17(AUTH_CONFIG),
-  __metadata32("design:type", Object)
+  __metadata33("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
-GoogleTokenVerifier = __decorate32([
+GoogleTokenVerifier = __decorate33([
   Injectable17()
 ], GoogleTokenVerifier);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-var __decorate33 = function(decorators, target, key, desc) {
+var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata33 = function(k, v) {
+var __metadata34 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a20;
+var _a21;
 var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 var GoogleOAuthProvider = class GoogleOAuthProvider2 {
@@ -6101,26 +6135,26 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
     return google;
   }
 };
-__decorate33([
+__decorate34([
   Inject18(AUTH_CONFIG),
-  __metadata33("design:type", Object)
+  __metadata34("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
-GoogleOAuthProvider = __decorate33([
+GoogleOAuthProvider = __decorate34([
   Injectable18(),
-  __metadata33("design:paramtypes", [typeof (_a20 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a20 : Object])
+  __metadata34("design:paramtypes", [typeof (_a21 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a21 : Object])
 ], GoogleOAuthProvider);
 
 // src/oauth/OAuthAccountRepository.ts
 import { and as and6, eq as eq9 } from "drizzle-orm";
 import { Inject as Inject19, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
-var __decorate34 = function(decorators, target, key, desc) {
+var __decorate35 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata34 = function(k, v) {
+var __metadata35 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var OAuthAccountRepository = class OAuthAccountRepository2 {
@@ -6148,15 +6182,15 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return account;
   }
 };
-__decorate34([
+__decorate35([
   DB7(),
-  __metadata34("design:type", Object)
+  __metadata35("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
-__decorate34([
+__decorate35([
   Inject19(AUTH_SCHEMA),
-  __metadata34("design:type", Object)
+  __metadata35("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
-OAuthAccountRepository = __decorate34([
+OAuthAccountRepository = __decorate35([
   Repository7()
 ], OAuthAccountRepository);
 
@@ -6164,16 +6198,16 @@ OAuthAccountRepository = __decorate34([
 import { randomBytes as randomBytes3 } from "crypto";
 import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
 import { Transaction as Transaction5 } from "najm-database";
-var __decorate35 = function(decorators, target, key, desc) {
+var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata35 = function(k, v) {
+var __metadata36 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a21;
+var _a22;
 var _b12;
 var _c9;
 var _d7;
@@ -6252,31 +6286,31 @@ var OAuthAccountService = class OAuthAccountService2 {
     return google;
   }
 };
-__decorate35([
+__decorate36([
   Inject20(AUTH_CONFIG),
-  __metadata35("design:type", Object)
+  __metadata36("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
-__decorate35([
+__decorate36([
   Transaction5(),
-  __metadata35("design:type", Function),
-  __metadata35("design:paramtypes", [Object]),
-  __metadata35("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
+  __metadata36("design:type", Function),
+  __metadata36("design:paramtypes", [Object]),
+  __metadata36("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
 ], OAuthAccountService.prototype, "resolveForLogin", null);
-__decorate35([
+__decorate36([
   Transaction5(),
-  __metadata35("design:type", Function),
-  __metadata35("design:paramtypes", [String, Object]),
-  __metadata35("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
+  __metadata36("design:type", Function),
+  __metadata36("design:paramtypes", [String, Object]),
+  __metadata36("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
 ], OAuthAccountService.prototype, "linkUser", null);
-OAuthAccountService = __decorate35([
+OAuthAccountService = __decorate36([
   Injectable19(),
-  __metadata35("design:paramtypes", [typeof (_a21 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a21 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
+  __metadata36("design:paramtypes", [typeof (_a22 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a22 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
 ], OAuthAccountService);
 
 // src/oauth/OAuthController.ts
 import { createHash as createHash5 } from "crypto";
-import { Controller as Controller5, Ctx as Ctx2, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
-import { RateLimit as RateLimit2 } from "najm-rate";
+import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Query as Query2, User as User5 } from "najm-core";
+import { RateLimit as RateLimit3 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
 import { Inject as Inject21, Injectable as Injectable21, Log as Log2 } from "najm-core";
@@ -6285,16 +6319,16 @@ import { Inject as Inject21, Injectable as Injectable21, Log as Log2 } from "naj
 import { createHash as createHash4, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
 import { Injectable as Injectable20 } from "najm-core";
 import { CookieService as CookieService3 } from "najm-cookies";
-var __decorate36 = function(decorators, target, key, desc) {
+var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata36 = function(k, v) {
+var __metadata37 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a22;
+var _a23;
 var _b13;
 var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
 var COOKIE_PREFIX = "najm.oauth.google.";
@@ -6384,22 +6418,22 @@ var OAuthStateService = class OAuthStateService2 {
     return /^[A-Za-z0-9_-]{40,128}$/.test(state);
   }
 };
-OAuthStateService = __decorate36([
+OAuthStateService = __decorate37([
   Injectable20(),
-  __metadata36("design:paramtypes", [typeof (_a22 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a22 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
+  __metadata37("design:paramtypes", [typeof (_a23 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a23 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
 ], OAuthStateService);
 
 // src/oauth/OAuthService.ts
-var __decorate37 = function(decorators, target, key, desc) {
+var __decorate38 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata37 = function(k, v) {
+var __metadata38 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a23;
+var _a24;
 var _b14;
 var _c10;
 var _d8;
@@ -6510,37 +6544,37 @@ var OAuthService = class OAuthService2 {
     return google;
   }
 };
-__decorate37([
+__decorate38([
   Inject21(AUTH_CONFIG),
-  __metadata37("design:type", Object)
+  __metadata38("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
-__decorate37([
+__decorate38([
   Log2(),
-  __metadata37("design:type", Object)
+  __metadata38("design:type", Object)
 ], OAuthService.prototype, "logger", void 0);
-OAuthService = __decorate37([
+OAuthService = __decorate38([
   Injectable21(),
-  __metadata37("design:paramtypes", [typeof (_a23 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a23 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c10 : Object, typeof (_d8 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d8 : Object, typeof (_e5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e5 : Object, typeof (_f5 = typeof UserService !== "undefined" && UserService) === "function" ? _f5 : Object, typeof (_g4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _g4 : Object])
+  __metadata38("design:paramtypes", [typeof (_a24 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a24 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c10 : Object, typeof (_d8 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d8 : Object, typeof (_e5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e5 : Object, typeof (_f5 = typeof UserService !== "undefined" && UserService) === "function" ? _f5 : Object, typeof (_g4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _g4 : Object])
 ], OAuthService);
 
 // src/oauth/OAuthController.ts
-var __decorate38 = function(decorators, target, key, desc) {
+var __decorate39 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata38 = function(k, v) {
+var __metadata39 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param12 = function(paramIndex, decorator) {
+var __param13 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a24;
-var callbackKey = /* @__PURE__ */ __name((ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var _a25;
+var callbackKey = /* @__PURE__ */ __name((ctx, { clientIp }) => {
+  const ip = clientIp;
   const state = ctx.req.query("state") ?? "none";
   const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
   return `${ip}:${fingerprint}`;
@@ -6564,39 +6598,39 @@ var OAuthController = class OAuthController2 {
     return this.oauth.startGoogleLink(userId, returnTo);
   }
 };
-__decorate38([
+__decorate39([
   Get5("/start"),
-  RateLimit2({ limit: 20, window: "15m", key: "ip" }),
-  __param12(0, Ctx2()),
-  __param12(1, Query2("returnTo")),
-  __metadata38("design:type", Function),
-  __metadata38("design:paramtypes", [Object, String]),
-  __metadata38("design:returntype", void 0)
+  RateLimit3({ limit: 20, window: "15m", key: "ip" }),
+  __param13(0, Ctx2()),
+  __param13(1, Query2("returnTo")),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", [Object, String]),
+  __metadata39("design:returntype", void 0)
 ], OAuthController.prototype, "start", null);
-__decorate38([
+__decorate39([
   Get5("/callback"),
-  RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
-  __param12(0, Ctx2()),
-  __param12(1, Query2("code")),
-  __param12(2, Query2("state")),
-  __param12(3, Query2("error")),
-  __metadata38("design:type", Function),
-  __metadata38("design:paramtypes", [Object, String, String, String]),
-  __metadata38("design:returntype", Promise)
+  RateLimit3({ limit: 20, window: "15m", key: callbackKey }),
+  __param13(0, Ctx2()),
+  __param13(1, Query2("code")),
+  __param13(2, Query2("state")),
+  __param13(3, Query2("error")),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", [Object, String, String, String]),
+  __metadata39("design:returntype", Promise)
 ], OAuthController.prototype, "callback", null);
-__decorate38([
-  Post5("/link"),
+__decorate39([
+  Post6("/link"),
   isAuth(),
-  RateLimit2({ limit: 10, window: "15m", key: "user" }),
-  __param12(0, User5("id")),
-  __param12(1, Query2("returnTo")),
-  __metadata38("design:type", Function),
-  __metadata38("design:paramtypes", [String, String]),
-  __metadata38("design:returntype", void 0)
+  RateLimit3({ limit: 10, window: "15m", key: "user" }),
+  __param13(0, User5("id")),
+  __param13(1, Query2("returnTo")),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", [String, String]),
+  __metadata39("design:returntype", void 0)
 ], OAuthController.prototype, "link", null);
-OAuthController = __decorate38([
-  Controller5("/auth/oauth/google"),
-  __metadata38("design:paramtypes", [typeof (_a24 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a24 : Object])
+OAuthController = __decorate39([
+  Controller6("/auth/oauth/google"),
+  __metadata39("design:paramtypes", [typeof (_a25 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a25 : Object])
 ], OAuthController);
 
 // src/oauth/index.ts
@@ -6611,9 +6645,9 @@ var OAUTH_MODULE = [
 ];
 
 // src/credentialSetup/CredentialSetupController.ts
-import { Body as Body6, Controller as Controller6, Get as Get6, Post as Post6, ResMsg as ResMsg5 } from "najm-core";
-import { RateLimit as RateLimit3 } from "najm-rate";
-import { Validate as Validate5 } from "najm-validation";
+import { Body as Body7, Controller as Controller7, Get as Get6, Post as Post7, ResMsg as ResMsg6 } from "najm-core";
+import { RateLimit as RateLimit4 } from "najm-rate";
+import { Validate as Validate6 } from "najm-validation";
 
 // src/credentialSetup/CredentialSetupDto.ts
 import { z as z5 } from "zod";
@@ -6623,21 +6657,21 @@ var credentialSetupChangeDto = z5.object({
 });
 
 // src/credentialSetup/CredentialSetupController.ts
-var __decorate39 = function(decorators, target, key, desc) {
+var __decorate40 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata39 = function(k, v) {
+var __metadata40 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param13 = function(paramIndex, decorator) {
+var __param14 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a25;
+var _a26;
 var CredentialSetupController = class CredentialSetupController2 {
   static {
     __name(this, "CredentialSetupController");
@@ -6656,35 +6690,35 @@ var CredentialSetupController = class CredentialSetupController2 {
     return this.passwords.cancel();
   }
 };
-__decorate39([
+__decorate40([
   Get6("/setup"),
-  RateLimit3({ limit: 30, window: "15m", key: "ip" }),
-  ResMsg5("auth.success.credentialSetupPending"),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", []),
-  __metadata39("design:returntype", void 0)
+  RateLimit4({ limit: 30, window: "15m", key: "ip" }),
+  ResMsg6("auth.success.credentialSetupPending"),
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", []),
+  __metadata40("design:returntype", void 0)
 ], CredentialSetupController.prototype, "status", null);
-__decorate39([
-  Post6("/change"),
-  RateLimit3({ limit: 5, window: "15m", key: "ip" }),
-  Validate5(credentialSetupChangeDto),
-  ResMsg5("auth.success.credentialSetupPasswordReplaced"),
-  __param13(0, Body6()),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", [Object]),
-  __metadata39("design:returntype", void 0)
+__decorate40([
+  Post7("/change"),
+  RateLimit4({ limit: 5, window: "15m", key: "ip" }),
+  Validate6(credentialSetupChangeDto),
+  ResMsg6("auth.success.credentialSetupPasswordReplaced"),
+  __param14(0, Body7()),
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", [Object]),
+  __metadata40("design:returntype", void 0)
 ], CredentialSetupController.prototype, "change", null);
-__decorate39([
-  Post6("/cancel"),
-  RateLimit3({ limit: 10, window: "15m", key: "ip" }),
-  ResMsg5("auth.success.credentialSetupCancelled"),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", []),
-  __metadata39("design:returntype", void 0)
+__decorate40([
+  Post7("/cancel"),
+  RateLimit4({ limit: 10, window: "15m", key: "ip" }),
+  ResMsg6("auth.success.credentialSetupCancelled"),
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", []),
+  __metadata40("design:returntype", void 0)
 ], CredentialSetupController.prototype, "cancel", null);
-CredentialSetupController = __decorate39([
-  Controller6("/auth/credential-setup"),
-  __metadata39("design:paramtypes", [typeof (_a25 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a25 : Object])
+CredentialSetupController = __decorate40([
+  Controller7("/auth/credential-setup"),
+  __metadata40("design:paramtypes", [typeof (_a26 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a26 : Object])
 ], CredentialSetupController);
 
 // src/credentialSetup/index.ts
@@ -6774,6 +6808,7 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
     registrationMode: config?.registrationMode ?? "active",
+    publicRegistration: config?.publicRegistration ?? true,
     requireVerifiedEmail: config?.requireVerifiedEmail ?? false,
     refreshCookiePath: config?.refreshCookiePath ?? "/",
     lockout: {
@@ -6826,7 +6861,7 @@ var selectAuthSchema = /* @__PURE__ */ __name((config) => {
       return authSchema;
   }
 }, "selectAuthSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(config?.cache), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_CORE_MODULE, config?.publicRegistration === false ? [] : PUBLIC_REGISTRATION_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
@@ -6959,6 +6994,7 @@ async function seedAuthData(config) {
 __name(seedAuthData, "seedAuthData");
 export {
   AUTH_CONFIG,
+  AUTH_CORE_MODULE,
   en_default as AUTH_EN,
   AUTH_LOCALES,
   AUTH_LOGIN_RATE_LIMIT_ENV,
@@ -6999,6 +7035,7 @@ export {
   Owned,
   OwnershipToken,
   PASSWORD_SETUP_PURPOSE,
+  PUBLIC_REGISTRATION_MODULE,
   PasswordSetupService,
   PermissionController,
   PermissionGuard,
@@ -7008,6 +7045,7 @@ export {
   Policy,
   ROLES,
   ROLE_GROUPS,
+  RegistrationController,
   Role,
   RoleController,
   RoleGuard,