najm-auth 4.0.2 → 4.0.4

package/README.md

@@ -138,9 +138,15 @@ auth({
   publicRegistration?: boolean             // Default: true; mounts POST /auth/register
   bcryptRounds?: number                    // Default: 10 (valid: 4-31)
 
-  // Frontend
+  // Frontend
   frontendUrl?: string                     // Password reset link base URL
   appName?: string                         // Security email brand (default: 'Your app')
+  accountInviteLogo?: {                    // Optional CID-backed inline mark
+    alt?: string
+    contentBase64: string
+    contentType: string
+    filename: string
+  }
 
   // Login identifier normalization (see "Identity presets")
   identity?: {
@@ -875,6 +881,13 @@ the successful Next.js render receives. Attempts to override `cookie` or
 `authorization` fail closed; only Najm's validated recovery path may replace
 the cookie after it authorizes the recovered session.
 
+Speculative/prefetch requests (`next-router-prefetch`, `purpose: prefetch`,
+`sec-purpose` containing `prefetch`, `next-router-state-tree` metadata-only)
+receive the same treatment as direct navigation: a valid signed snapshot or
+non-rotating `/session/recover` validation is still required. Refresh-cookie
+presence is never authorization, so do not bypass `auth.proxy` when a refresh
+cookie is present on a prefetch. Recovery never rotates refresh tokens.
+
 ```typescript
 // src/app/api/[...route]/route.ts
 import { handle } from 'najm-core';
@@ -1131,16 +1144,21 @@ consumption. Once consumed, a token stays consumed even if the later user
 mutation fails; restoring it would make the link replayable, so the user must
 request a new one.
 
-Accepting an account invitation also marks the destination email verified and
-activates the account when its status is `pending`. An ordinary password reset
-changes neither verification nor lifecycle status, and an explicitly inactive
-invited account remains inactive.
-
-Set `appName` on `auth()` to brand the invitation subject and email card. The
-provisioned role is presented as the account type, so a sponsor invitation can
-say “Activate your sponsor account” without application-owned HTML. The shared
+Accepting an account invitation also marks the destination email verified and
+activates the account when its status is `pending`. An ordinary password reset
+changes neither verification nor lifecycle status, and an explicitly inactive
+invited account remains inactive.
+
+Set `appName` on `auth()` to brand the invitation subject and email card. The
+provisioned role is presented as the account type, so a sponsor invitation can
+say “Activate your sponsor account” without application-owned HTML. The shared
 template uses inline critical styles for Gmail and keeps the raw token URL out
 of visible fallback copy.
+
+For a branded mark that works in email clients without a public asset URL, set
+`accountInviteLogo` to base64 content plus its MIME type and filename. Najm
+attaches it inline and points the shared template at a stable CID; when omitted,
+the template renders `appName` as text.
 
 The built-in memory and Redis drivers implement the required atomic primitive.
 A custom cache driver may omit `compareAndDelete()` for compatibility with

package/dist/index.d.ts

@@ -200,6 +200,13 @@ interface AuthConfig {
     frontendUrl: string;
     /** Product name used in security email subjects and templates. */
     appName: string;
+    /** Optional inline logo embedded in account invitation emails. */
+    accountInviteLogo?: {
+        alt?: string;
+        contentBase64: string;
+        contentType: string;
+        filename: string;
+    };
     /** Registration mode: 'active' auto-activates, 'pending' requires admin approval (default: 'active') */
     registrationMode: 'active' | 'pending';
     /** Whether the unauthenticated POST /auth/register route is mounted. */
@@ -269,6 +276,13 @@ type AuthPluginConfig = {
     frontendUrl?: string;
     /** Product name used in account invitation emails (default: 'Your app'). */
     appName?: string;
+    /** Optional inline logo embedded in account invitation emails. */
+    accountInviteLogo?: {
+        alt?: string;
+        contentBase64: string;
+        contentType: string;
+        filename: string;
+    };
     /** Registration mode: 'active' auto-activates new users, 'pending' requires admin approval (default: 'active') */
     registrationMode?: 'active' | 'pending';
     /**

package/dist/index.js

@@ -2212,7 +2212,7 @@ var TokenService = class TokenService2 {
   }
   rejectRefreshSession(messageKey = "errors.refreshTokenInvalid") {
     this.clearRefreshSessionCookies();
-    Err7(this.t(messageKey), 401);
+    return Err7(this.t(messageKey), 401);
   }
   async assertRefreshFamilyAllowed(tokenFamily, userId) {
     if (await this.invalidation.familyStatus(tokenFamily, userId) === "revoked") {
@@ -3492,16 +3492,32 @@ var AuthService = class AuthService2 {
     const accountLabel = accountType ? `${accountType} account` : "account";
     let emailSent = false;
     try {
-      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject", {
-        accountLabel,
-        appName: this.config.appName
-      }), accountInviteTemplate({
-        accountType,
-        appName: this.config.appName,
-        inviteLink,
-        userName: user.name || body.email
-      }));
-      emailSent = true;
+      const logo = this.config.accountInviteLogo;
+      const logoCid = logo ? "najm-account-invite-logo" : void 0;
+      const result = await this.emailService.send({
+        to: body.email,
+        subject: this.t("emails.accountInvite.subject", {
+          accountLabel,
+          appName: this.config.appName
+        }),
+        html: accountInviteTemplate({
+          accountType,
+          appName: this.config.appName,
+          inviteLink,
+          logoAlt: logo?.alt,
+          logoSrc: logoCid ? `cid:${logoCid}` : void 0,
+          userName: user.name || body.email
+        }),
+        attachments: logo ? [{
+          filename: logo.filename,
+          content: logo.contentBase64,
+          contentType: logo.contentType,
+          cid: logoCid,
+          disposition: "inline",
+          encoding: "base64"
+        }] : void 0
+      });
+      emailSent = result.success;
     } catch (error) {
       this.logger.warn("Account invite email failed", { email: body.email, error });
     }
@@ -7569,6 +7585,7 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
     appName: resolveAppName(config?.appName),
+    accountInviteLogo: config?.accountInviteLogo,
     registrationMode: config?.registrationMode ?? "active",
     publicRegistration: config?.publicRegistration ?? true,
     requireVerifiedEmail: config?.requireVerifiedEmail ?? false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [