najm-auth 3.2.1 → 3.3.0

package/dist/client/react/index.d.ts

@@ -1,4 +1,3 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
 import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-ZtXTIUSF.js';
@@ -20,7 +19,7 @@ interface AuthProviderProps {
      */
     autoRefresh?: boolean;
 }
-declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react_jsx_runtime.JSX.Element;
+declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react.JSX.Element;
 
 interface AuthBoundaryProps {
     children: ReactNode;
@@ -28,7 +27,7 @@ interface AuthBoundaryProps {
     /** Only gate while we truly have no identity; default false. */
     requireToken?: boolean;
 }
-declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react_jsx_runtime.JSX.Element;
+declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react.JSX.Element;
 
 declare function useAuthClient(): NajmAuthClient;
 
@@ -240,7 +239,7 @@ interface SignedInProps {
  * </SignedIn>
  * ```
  */
-declare function SignedIn({ children }: SignedInProps): react_jsx_runtime.JSX.Element;
+declare function SignedIn({ children }: SignedInProps): react.JSX.Element;
 
 interface SignedOutProps {
     children: ReactNode;
@@ -256,7 +255,7 @@ interface SignedOutProps {
  * </SignedOut>
  * ```
  */
-declare function SignedOut({ children }: SignedOutProps): react_jsx_runtime.JSX.Element;
+declare function SignedOut({ children }: SignedOutProps): react.JSX.Element;
 
 interface AuthLoadingProps {
     children: ReactNode;
@@ -274,7 +273,7 @@ interface AuthLoadingProps {
  * <SignedOut>...</SignedOut>
  * ```
  */
-declare function AuthLoading({ children }: AuthLoadingProps): react_jsx_runtime.JSX.Element;
+declare function AuthLoading({ children }: AuthLoadingProps): react.JSX.Element;
 
 interface CanProps {
     /** Required permission (e.g., 'read:posts') */
@@ -300,7 +299,7 @@ interface CanProps {
  * </Can>
  * ```
  */
-declare function Can({ permission, role, children, fallback }: CanProps): react_jsx_runtime.JSX.Element;
+declare function Can({ permission, role, children, fallback }: CanProps): react.JSX.Element;
 
 interface RoleProps {
     /** Required role name */
@@ -324,7 +323,7 @@ interface RoleProps {
  * </Role>
  * ```
  */
-declare function Role(props: RoleProps): react_jsx_runtime.JSX.Element;
+declare function Role(props: RoleProps): react.JSX.Element;
 
 interface IfAuthProps {
     /** Render when authenticated — receives user */
@@ -346,7 +345,7 @@ interface IfAuthProps {
  * />
  * ```
  */
-declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react_jsx_runtime.JSX.Element;
+declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react.JSX.Element;
 
 interface ProtectedProps {
     children: ReactNode;
@@ -377,7 +376,7 @@ interface ProtectedProps {
  * </Protected>
  * ```
  */
-declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react_jsx_runtime.JSX.Element;
+declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react.JSX.Element;
 
 interface AuthGateProps {
     children: ReactNode;
@@ -407,7 +406,7 @@ interface AuthGateProps {
  * **Without SSR hydration** (client-side nav, hard reload without initialSession):
  * Shows `loader` while attempting a token refresh, then either opens or redirects.
  */
-declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react_jsx_runtime.JSX.Element;
+declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react.JSX.Element;
 
 interface UserNameProps {
     /** Optional fallback shown when no user is loaded */
@@ -422,7 +421,7 @@ interface UserNameProps {
  * <span>Hi, <UserName fallback="guest" />!</span>
  * ```
  */
-declare function UserName({ fallback }: UserNameProps): react_jsx_runtime.JSX.Element;
+declare function UserName({ fallback }: UserNameProps): react.JSX.Element;
 
 interface UserEmailProps {
     fallback?: string;
@@ -435,7 +434,7 @@ interface UserEmailProps {
  * <p>Email: <UserEmail fallback="Not available" /></p>
  * ```
  */
-declare function UserEmail({ fallback }: UserEmailProps): react_jsx_runtime.JSX.Element;
+declare function UserEmail({ fallback }: UserEmailProps): react.JSX.Element;
 
 interface UserRoleProps {
     fallback?: string;
@@ -448,7 +447,7 @@ interface UserRoleProps {
  * <span>Role: <UserRole fallback="none" /></span>
  * ```
  */
-declare function UserRole({ fallback }: UserRoleProps): react_jsx_runtime.JSX.Element;
+declare function UserRole({ fallback }: UserRoleProps): react.JSX.Element;
 
 interface UserAvatarProps {
     /** Pixel size of the avatar (default: 32) */
@@ -474,7 +473,7 @@ interface UserAvatarProps {
  * <UserAvatar className="my-avatar" />
  * ```
  */
-declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react_jsx_runtime.JSX.Element;
+declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react.JSX.Element;
 
 interface PermissionListProps {
     /** Render function for each permission */
@@ -492,7 +491,7 @@ interface PermissionListProps {
  * </PermissionList>
  * ```
  */
-declare function PermissionList({ children, fallback }: PermissionListProps): react_jsx_runtime.JSX.Element;
+declare function PermissionList({ children, fallback }: PermissionListProps): react.JSX.Element;
 
 interface SignOutButtonProps {
     /** A single clickable child element. Its `onClick` will be wired to logout. */
@@ -579,6 +578,6 @@ interface OAuthCallbackProps {
     }) => ReactNode);
     defaultRedirect?: string;
 }
-declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react_jsx_runtime.JSX.Element;
+declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react.JSX.Element;
 
 export { AuthBoundary, type AuthEventEntry, AuthGate, AuthLoading, AuthProvider, Can, GoogleLoginButton, IfAuth, LoginButton, OAuthCallback, PermissionList, Protected, RedirectToLogin, Role, type SessionStatus, SignOutButton, SignedIn, SignedOut, UserAvatar, UserEmail, UserName, UserRole, useAuth, useAuthClient, useAuthEvent, useAuthEvents, useChangePassword, useForgotPassword, useGoogleLogin, useLogin, useLogout, useOAuthCallback, usePermissions, useRegister, useResetPassword, useSession, useUser };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import * as najm_core from 'najm-core';
 import { Container } from 'najm-core';
 import { ValidationPluginConfig } from 'najm-validation';
-import { RateLimitPluginConfig, TimeWindow } from 'najm-rate';
+import { RateLimitPluginConfig, RateLimitKeyContext, TimeWindow } from 'najm-rate';
+import { CachePluginConfig, CacheService } from 'najm-cache';
 import { EmailPluginConfig, EmailService } from 'najm-email';
 import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
@@ -10,7 +11,6 @@ import { I18nService } from 'najm-i18n';
 import { TDb, SeedEntry } from 'najm-database';
 import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, RolePermission } from './schema/pg.js';
 export { CredentialSetupRequirement, CredentialSetupSession, NewCredentialSetupRequirement, NewCredentialSetupSession, NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
-import { CacheService } from 'najm-cache';
 import { CookieService } from 'najm-cookies';
 import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
@@ -269,6 +269,15 @@ type AuthPluginConfig = {
     validation?: ValidationPluginConfig;
     /** Optional config forwarded to rateLimit() dependency */
     rateLimit?: RateLimitPluginConfig;
+    /**
+     * Optional config forwarded to the package-owned cache() dependency.
+     *
+     * Auth registers cache() itself, so a consumer cannot configure the store by
+     * registering its own plugin first. Pass it here to select a shared, durable
+     * backend — required in production wherever the cache backs rate limiting,
+     * since a per-process memory bucket resets on every restart.
+     */
+    cache?: CachePluginConfig;
     /** Email transport used by password reset and verification flows. */
     email?: EmailPluginConfig;
     /** AES-256-GCM key for reversible encryption (e.g. API keys). Falls back to NAJM_ENCRYPTION_KEY env var. */
@@ -1653,11 +1662,14 @@ declare class AuthService {
 }
 
 /**
- * Composite key: IP + hashed normalized login/registration identity.
- * Buckets rate limits per IP+credential combo so different users
- * on the same IP (e.g. localhost, NAT) don't share a single bucket.
+ * Composite key: resolved client address + hashed normalized identity.
+ * Buckets rate limits per client+credential combo so different users
+ * on the same address (e.g. localhost, NAT) don't share a single bucket.
+ *
+ * The address arrives already resolved through the configured trusted-proxy
+ * boundary; this module must never parse forwarding headers itself.
  */
-declare const authIdentityRateLimitKey: (ctx: Context) => Promise<string>;
+declare const authIdentityRateLimitKey: (ctx: Context, keyContext?: RateLimitKeyContext) => Promise<string>;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);

package/dist/index.js

@@ -3561,7 +3561,7 @@ var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
 // src/auth/AuthController.ts
 import { Validate } from "najm-validation";
-import { RateLimit } from "najm-rate";
+import { RateLimit, UNRESOLVED_CLIENT_ADDRESS } from "najm-rate";
 import { createHash as createHash3 } from "crypto";
 
 // src/identity/requestResolver.ts
@@ -3739,14 +3739,13 @@ var __param5 = function(paramIndex, decorator) {
 };
 var _a12;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash3("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
-var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx, { clientIp }) => {
   const cookie = ctx.req.raw.headers.get("cookie") ?? "";
   const fingerprint = cookie ? hashKeyPart(cookie) : "none";
-  return `${ip}:${fingerprint}`;
+  return `${clientIp}:${fingerprint}`;
 }, "cookieFingerprint");
-var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx, keyContext) => {
+  const ip = keyContext?.clientIp ?? UNRESOLVED_CLIENT_ADDRESS;
   try {
     const body = await ctx.req.json();
     const identity = body?.identifier ?? body?.email;
@@ -6574,8 +6573,8 @@ var __param13 = function(paramIndex, decorator) {
   };
 };
 var _a25;
-var callbackKey = /* @__PURE__ */ __name((ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var callbackKey = /* @__PURE__ */ __name((ctx, { clientIp }) => {
+  const ip = clientIp;
   const state = ctx.req.query("state") ?? "none";
   const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
   return `${ip}:${fingerprint}`;
@@ -6862,7 +6861,7 @@ var selectAuthSchema = /* @__PURE__ */ __name((config) => {
       return authSchema;
   }
 }, "selectAuthSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_CORE_MODULE, config?.publicRegistration === false ? [] : PUBLIC_REGISTRATION_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(config?.cache), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_CORE_MODULE, config?.publicRegistration === false ? [] : PUBLIC_REGISTRATION_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -95,9 +95,9 @@
     "najm-database": "^2.0.3",
     "najm-guard": "^2.0.2",
     "najm-i18n": "^2.0.3",
-    "najm-cache": "^2.0.2",
+    "najm-cache": "^2.1.0",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.0.3",
+    "najm-rate": "^2.1.0",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",