najm-auth 4.0.3 → 4.0.5

package/README.md

@@ -140,6 +140,13 @@ auth({
 
   // Frontend
   frontendUrl?: string                     // Password reset link base URL
+  appName?: string                         // Security email brand (default: 'Your app')
+  accountInviteLogo?: {                    // Optional CID-backed inline mark
+    alt?: string
+    contentBase64: string
+    contentType: string
+    filename: string
+  }
 
   // Login identifier normalization (see "Identity presets")
   identity?: {
@@ -601,7 +608,7 @@ users
 
 roles
 ├── id (string, primary key)
-├── name (string, unique)
+├── name (string, unique — `roles_name_unique` in both dialects)
 ├── description (string, nullable)
 ├── createdAt (timestamp)
 └── updatedAt (timestamp)
@@ -693,6 +700,21 @@ const customUsers = sqliteTable('users', {
 
 ## Seeding
 
+Role names are database-enforced identities. `authSeed()` reconciles the `roles`
+entry **by name**, not by the primary key it proposes, so a role that already
+exists under a legacy or randomly generated ID is reused rather than inserted a
+second time. Downstream resolvers receive the row the database actually holds,
+which keeps `users.role_id` and `role_permissions.role_id` pointing at the live
+ID. Repeat seeding is idempotent and never rewrites a role's primary key —
+`users.role_id` carries no `ON UPDATE CASCADE` contract.
+
+> **Adopting this from an earlier version:** the unique index is a persistence
+> invariant, not only a validation change. Consolidate any duplicate role names
+> **before** you apply a migration that adds it, or the migration fails. Consumer
+> migrations are application-owned; this package ships the schema declaration,
+> not your migration.
+
+
 ### Low-Level Seeding (authSeed)
 
 ```typescript
@@ -1142,6 +1164,17 @@ activates the account when its status is `pending`. An ordinary password reset
 changes neither verification nor lifecycle status, and an explicitly inactive
 invited account remains inactive.
 
+Set `appName` on `auth()` to brand the invitation subject and email card. The
+provisioned role is presented as the account type, so a sponsor invitation can
+say “Activate your sponsor account” without application-owned HTML. The shared
+template uses inline critical styles for Gmail and keeps the raw token URL out
+of visible fallback copy.
+
+For a branded mark that works in email clients without a public asset URL, set
+`accountInviteLogo` to base64 content plus its MIME type and filename. Najm
+attaches it inline and points the shared template at a stable CID; when omitted,
+the template renders `appName` as text.
+
 The built-in memory and Redis drivers implement the required atomic primitive.
 A custom cache driver may omit `compareAndDelete()` for compatibility with
 unrelated cache usage, but reset and invite consumption then fails closed. Do

package/dist/client/edge.d.ts

@@ -18,13 +18,13 @@ interface AuthProxyOptions {
 }
 interface AuthMiddlewareConfig {
     /** Routes that require authentication (glob patterns) */
-    protectedRoutes?: string[];
+    protectedRoutes?: readonly string[];
     /** Always-public routes (glob patterns) */
-    publicRoutes?: string[];
+    publicRoutes?: readonly string[];
     /** Route to redirect unauthenticated users to */
     loginRoute?: string;
     /** Routes restricted to specific roles: { '/admin/*': ['admin'] } */
-    roleRoutes?: Record<string, string[]>;
+    roleRoutes?: Readonly<Record<string, readonly string[]>>;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
     /** API base URL used by session recovery (default: '/api'). */

package/dist/client/server/index.d.ts

@@ -158,6 +158,8 @@ interface DefineAuthConfig {
     authPrefix?: string;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
+    /** Remember Me preference cookie used by routeHandlers; per-handler options override it. */
+    rememberCookieName?: string;
     /** Proactive refresh at this fraction of token lifetime (default: 0.8) */
     refreshThreshold?: number;
     /** Enable multi-tab sync via BroadcastChannel (default: true) */
@@ -183,11 +185,11 @@ interface DefineAuthConfig {
      */
     forbiddenRoute?: string;
     /** Routes that are always public (glob patterns) */
-    publicRoutes?: string[];
+    publicRoutes?: readonly string[];
     /** Routes that require authentication (glob patterns) */
-    protectedRoutes?: string[];
+    protectedRoutes?: readonly string[];
     /** Routes restricted to specific roles: { '/admin/:path*': ['admin'] } */
-    roleRoutes?: Record<string, string[]>;
+    roleRoutes?: Readonly<Record<string, readonly string[]>>;
     /** Session cookie name (default: 'najm.session') */
     sessionCookieName?: string;
     /** Secret for verifying session cookie HMAC. Falls back to env vars. */

package/dist/client/server/index.js

@@ -1734,6 +1734,7 @@ function defineAuth(authConfig = {}) {
   const routeHandlers = /* @__PURE__ */ __name((handler, options = {}) => {
     const persistentHandler = withAuthCookiePersistence(handler, {
       ...options,
+      rememberCookieName: options.rememberCookieName ?? authConfig.rememberCookieName,
       authCookieNames: options.authCookieNames ?? [cookieName2, sessionCookieName]
     });
     return {

package/dist/index.d.ts

@@ -198,6 +198,15 @@ interface AuthConfig {
     defaultRole: string | null;
     /** Frontend URL for password reset links (default: 'http://localhost:3000') */
     frontendUrl: string;
+    /** Product name used in security email subjects and templates. */
+    appName: string;
+    /** Optional inline logo embedded in account invitation emails. */
+    accountInviteLogo?: {
+        alt?: string;
+        contentBase64: string;
+        contentType: string;
+        filename: string;
+    };
     /** Registration mode: 'active' auto-activates, 'pending' requires admin approval (default: 'active') */
     registrationMode: 'active' | 'pending';
     /** Whether the unauthenticated POST /auth/register route is mounted. */
@@ -265,6 +274,15 @@ type AuthPluginConfig = {
     defaultRole?: string | null;
     /** Frontend URL for password reset links. Falls back to FRONTEND_URL env var, then 'http://localhost:3000' */
     frontendUrl?: string;
+    /** Product name used in account invitation emails (default: 'Your app'). */
+    appName?: string;
+    /** Optional inline logo embedded in account invitation emails. */
+    accountInviteLogo?: {
+        alt?: string;
+        contentBase64: string;
+        contentType: string;
+        filename: string;
+    };
     /** Registration mode: 'active' auto-activates new users, 'pending' requires admin approval (default: 'active') */
     registrationMode?: 'active' | 'pending';
     /**
@@ -432,7 +450,7 @@ var auth = {
 			subject: "Reset your password"
 		},
 		accountInvite: {
-			subject: "You've been invited — set up your account"
+			subject: "{{appName}}: activate your {{accountLabel}}"
 		}
 	}
 };
@@ -959,6 +977,13 @@ declare class RoleService {
         updatedAt: string;
     }[]>;
     getRoleIdByName(name: any): Promise<string>;
+    /**
+     * checkNameUnique() reads before it writes, so two concurrent requests can
+     * both pass it and race to insert the same name. The database rejects the
+     * loser; answer it with the same 409 the validator would have given rather
+     * than leaking a raw driver error as a 500.
+     */
+    private onDuplicateName;
 }
 
 declare class TokenRepository {

package/dist/index.js

@@ -40,7 +40,12 @@ var rolesTable = pgTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // A role name is a domain identity: guards match `admin` by name, and seeding
+  // reconciles roles by name. Two rows sharing a name make authorization
+  // ambiguous, so the database — not a check-then-insert query — enforces it.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),
@@ -144,7 +149,10 @@ var rolesTable2 = sqliteTable("roles", {
   ...baseFields2(5),
   name: text2("name").notNull(),
   description: text2("description")
-});
+}, (table) => ({
+  // Same domain identity as the PostgreSQL dialect; see schema/pg.ts.
+  nameUnique: uniqueIndex2("roles_name_unique").on(table.name)
+}));
 var usersTable2 = sqliteTable("users", {
   ...baseFields2(8),
   name: text2("name"),
@@ -1096,7 +1104,7 @@ var RoleService = class RoleService2 {
   }
   async create(data) {
     await this.roleValidator.checkNameUnique(data.name);
-    return await this.roleRepository.create(data);
+    return await this.onDuplicateName(() => this.roleRepository.create(data));
   }
   async update(id, data) {
     const role = await this.roleValidator.checkRoleExists(id);
@@ -1104,7 +1112,7 @@ var RoleService = class RoleService2 {
       Err3(this.t("errors.cannotRenameSystem"), 403);
     }
     await this.roleValidator.checkNameUnique(data.name, id);
-    return await this.roleRepository.update(id, data);
+    return await this.onDuplicateName(() => this.roleRepository.update(id, data));
   }
   async delete(id) {
     const role = await this.roleValidator.checkRoleExists(id);
@@ -1131,6 +1139,22 @@ var RoleService = class RoleService2 {
     const role = await this.getByName(name);
     return role?.id;
   }
+  /**
+   * checkNameUnique() reads before it writes, so two concurrent requests can
+   * both pass it and race to insert the same name. The database rejects the
+   * loser; answer it with the same 409 the validator would have given rather
+   * than leaking a raw driver error as a 500.
+   */
+  async onDuplicateName(write) {
+    try {
+      return await write();
+    } catch (error) {
+      if (isDuplicateRoleName(error)) {
+        Err3(this.t("errors.exists"), 409);
+      }
+      throw error;
+    }
+  }
 };
 __decorate7([
   I18n3("roles"),
@@ -1140,6 +1164,18 @@ RoleService = __decorate7([
   Injectable4(),
   __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
 ], RoleService);
+function isDuplicateRoleName(error) {
+  if (!error || typeof error !== "object")
+    return false;
+  const candidate = error;
+  if (candidate.code === "23505")
+    return true;
+  if (candidate.code === "SQLITE_CONSTRAINT_UNIQUE")
+    return true;
+  const message = typeof candidate.message === "string" ? candidate.message : "";
+  return /unique constraint failed/i.test(message) || /duplicate key value violates unique constraint/i.test(message);
+}
+__name(isDuplicateRoleName, "isDuplicateRoleName");
 
 // src/users/UserService.ts
 import { nanoid as nanoid3 } from "nanoid";
@@ -3488,13 +3524,36 @@ var AuthService = class AuthService2 {
     });
     const { token } = await this.tokenService.generateInviteToken(user.id);
     const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    const accountType = body.role?.trim().toLowerCase();
+    const accountLabel = accountType ? `${accountType} account` : "account";
     let emailSent = false;
     try {
-      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
-        inviteLink,
-        userName: user.name || body.email
-      }));
-      emailSent = true;
+      const logo = this.config.accountInviteLogo;
+      const logoCid = logo ? "najm-account-invite-logo" : void 0;
+      const result = await this.emailService.send({
+        to: body.email,
+        subject: this.t("emails.accountInvite.subject", {
+          accountLabel,
+          appName: this.config.appName
+        }),
+        html: accountInviteTemplate({
+          accountType,
+          appName: this.config.appName,
+          inviteLink,
+          logoAlt: logo?.alt,
+          logoSrc: logoCid ? `cid:${logoCid}` : void 0,
+          userName: user.name || body.email
+        }),
+        attachments: logo ? [{
+          filename: logo.filename,
+          content: logo.contentBase64,
+          contentType: logo.contentType,
+          cid: logoCid,
+          disposition: "inline",
+          encoding: "base64"
+        }] : void 0
+      });
+      emailSent = result.success;
     } catch (error) {
       this.logger.warn("Account invite email failed", { email: body.email, error });
     }
@@ -6346,7 +6405,7 @@ var en_default = {
         subject: "Reset your password"
       },
       accountInvite: {
-        subject: "You've been invited \u2014 set up your account"
+        subject: "{{appName}}: activate your {{accountLabel}}"
       }
     }
   },
@@ -7478,6 +7537,13 @@ var validateCallbackUrl = /* @__PURE__ */ __name((value, name) => {
   }
   return callback.toString();
 }, "validateCallbackUrl");
+var resolveAppName = /* @__PURE__ */ __name((value) => {
+  const appName = value?.trim() || "Your app";
+  if (appName.length > 80 || /[\u0000-\u001f\u007f]/.test(appName)) {
+    throw new Error("auth.appName must be at most 80 characters without control characters");
+  }
+  return appName;
+}, "resolveAppName");
 var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const configuredGoogle = config?.oauth?.google;
   if (!configuredGoogle)
@@ -7554,6 +7620,8 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     blacklistPrefix: config?.blacklistPrefix ?? "auth:blacklist:",
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
+    appName: resolveAppName(config?.appName),
+    accountInviteLogo: config?.accountInviteLogo,
     registrationMode: config?.registrationMode ?? "active",
     publicRegistration: config?.publicRegistration ?? true,
     requireVerifiedEmail: config?.requireVerifiedEmail ?? false,
@@ -7619,6 +7687,13 @@ var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
 var authSeed = /* @__PURE__ */ __name((config) => ({
   roles: {
     schema: createRoleDto,
+    // Roles are identified by name, not by the proposed primary key. Without
+    // this the seeder falls back to the primary key, and a role that already
+    // exists under a legacy/random ID is inserted a second time under the
+    // deterministic one. Query-back by name then hands downstream resolvers the
+    // live row, so users and role_permissions reference the ID the database
+    // actually holds — never a proposed ID that was skipped on conflict.
+    by: ["name"],
     rows: (config.roles ?? [
       { name: "admin", description: "System administrator with full access" },
       { name: "user", description: "Regular user with limited access" }

package/dist/schema/pg.js

@@ -24,7 +24,12 @@ var rolesTable = pgTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // A role name is a domain identity: guards match `admin` by name, and seeding
+  // reconciles roles by name. Two rows sharing a name make authorization
+  // ambiguous, so the database — not a check-then-insert query — enforces it.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),

package/dist/schema/sqlite.js

@@ -14,7 +14,10 @@ var rolesTable = sqliteTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // Same domain identity as the PostgreSQL dialect; see schema/pg.ts.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = sqliteTable("users", {
   ...baseFields(8),
   name: text("name"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -97,7 +97,7 @@
     "najm-guard": "^2.0.2",
     "najm-i18n": "^2.1.2",
     "najm-cache": "^2.2.0",
-    "najm-email": "^2.0.3",
+    "najm-email": "^2.0.4",
     "najm-rate": "^2.1.1",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",