najm-auth 4.0.1 → 4.0.2

package/README.md

@@ -138,8 +138,9 @@ auth({
   publicRegistration?: boolean             // Default: true; mounts POST /auth/register
   bcryptRounds?: number                    // Default: 10 (valid: 4-31)
 
-  // Frontend
-  frontendUrl?: string                     // Password reset link base URL
+  // Frontend
+  frontendUrl?: string                     // Password reset link base URL
+  appName?: string                         // Security email brand (default: 'Your app')
 
   // Login identifier normalization (see "Identity presets")
   identity?: {
@@ -1130,10 +1131,16 @@ consumption. Once consumed, a token stays consumed even if the later user
 mutation fails; restoring it would make the link replayable, so the user must
 request a new one.
 
-Accepting an account invitation also marks the destination email verified and
-activates the account when its status is `pending`. An ordinary password reset
-changes neither verification nor lifecycle status, and an explicitly inactive
-invited account remains inactive.
+Accepting an account invitation also marks the destination email verified and
+activates the account when its status is `pending`. An ordinary password reset
+changes neither verification nor lifecycle status, and an explicitly inactive
+invited account remains inactive.
+
+Set `appName` on `auth()` to brand the invitation subject and email card. The
+provisioned role is presented as the account type, so a sponsor invitation can
+say “Activate your sponsor account” without application-owned HTML. The shared
+template uses inline critical styles for Gmail and keeps the raw token URL out
+of visible fallback copy.
 
 The built-in memory and Redis drivers implement the required atomic primitive.
 A custom cache driver may omit `compareAndDelete()` for compatibility with

package/dist/index.d.ts

@@ -198,6 +198,8 @@ interface AuthConfig {
     defaultRole: string | null;
     /** Frontend URL for password reset links (default: 'http://localhost:3000') */
     frontendUrl: string;
+    /** Product name used in security email subjects and templates. */
+    appName: string;
     /** Registration mode: 'active' auto-activates, 'pending' requires admin approval (default: 'active') */
     registrationMode: 'active' | 'pending';
     /** Whether the unauthenticated POST /auth/register route is mounted. */
@@ -265,6 +267,8 @@ type AuthPluginConfig = {
     defaultRole?: string | null;
     /** Frontend URL for password reset links. Falls back to FRONTEND_URL env var, then 'http://localhost:3000' */
     frontendUrl?: string;
+    /** Product name used in account invitation emails (default: 'Your app'). */
+    appName?: string;
     /** Registration mode: 'active' auto-activates new users, 'pending' requires admin approval (default: 'active') */
     registrationMode?: 'active' | 'pending';
     /**
@@ -432,7 +436,7 @@ var auth = {
 			subject: "Reset your password"
 		},
 		accountInvite: {
-			subject: "You've been invited — set up your account"
+			subject: "{{appName}}: activate your {{accountLabel}}"
 		}
 	}
 };

package/dist/index.js

@@ -3488,9 +3488,16 @@ var AuthService = class AuthService2 {
     });
     const { token } = await this.tokenService.generateInviteToken(user.id);
     const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    const accountType = body.role?.trim().toLowerCase();
+    const accountLabel = accountType ? `${accountType} account` : "account";
     let emailSent = false;
     try {
-      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
+      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject", {
+        accountLabel,
+        appName: this.config.appName
+      }), accountInviteTemplate({
+        accountType,
+        appName: this.config.appName,
         inviteLink,
         userName: user.name || body.email
       }));
@@ -6346,7 +6353,7 @@ var en_default = {
         subject: "Reset your password"
       },
       accountInvite: {
-        subject: "You've been invited \u2014 set up your account"
+        subject: "{{appName}}: activate your {{accountLabel}}"
       }
     }
   },
@@ -7478,6 +7485,13 @@ var validateCallbackUrl = /* @__PURE__ */ __name((value, name) => {
   }
   return callback.toString();
 }, "validateCallbackUrl");
+var resolveAppName = /* @__PURE__ */ __name((value) => {
+  const appName = value?.trim() || "Your app";
+  if (appName.length > 80 || /[\u0000-\u001f\u007f]/.test(appName)) {
+    throw new Error("auth.appName must be at most 80 characters without control characters");
+  }
+  return appName;
+}, "resolveAppName");
 var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const configuredGoogle = config?.oauth?.google;
   if (!configuredGoogle)
@@ -7554,6 +7568,7 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     blacklistPrefix: config?.blacklistPrefix ?? "auth:blacklist:",
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
+    appName: resolveAppName(config?.appName),
     registrationMode: config?.registrationMode ?? "active",
     publicRegistration: config?.publicRegistration ?? true,
     requireVerifiedEmail: config?.requireVerifiedEmail ?? false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -97,7 +97,7 @@
     "najm-guard": "^2.0.2",
     "najm-i18n": "^2.1.2",
     "najm-cache": "^2.2.0",
-    "najm-email": "^2.0.3",
+    "najm-email": "^2.0.4",
     "najm-rate": "^2.1.1",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",