najm-auth 4.0.4 → 4.0.6

package/dist/client/edge.d.ts

@@ -18,13 +18,13 @@ interface AuthProxyOptions {
 }
 interface AuthMiddlewareConfig {
     /** Routes that require authentication (glob patterns) */
-    protectedRoutes?: string[];
+    protectedRoutes?: readonly string[];
     /** Always-public routes (glob patterns) */
-    publicRoutes?: string[];
+    publicRoutes?: readonly string[];
     /** Route to redirect unauthenticated users to */
     loginRoute?: string;
     /** Routes restricted to specific roles: { '/admin/*': ['admin'] } */
-    roleRoutes?: Record<string, string[]>;
+    roleRoutes?: Readonly<Record<string, readonly string[]>>;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
     /** API base URL used by session recovery (default: '/api'). */

package/dist/client/server/index.d.ts

@@ -158,6 +158,8 @@ interface DefineAuthConfig {
     authPrefix?: string;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
+    /** Remember Me preference cookie used by routeHandlers; per-handler options override it. */
+    rememberCookieName?: string;
     /** Proactive refresh at this fraction of token lifetime (default: 0.8) */
     refreshThreshold?: number;
     /** Enable multi-tab sync via BroadcastChannel (default: true) */
@@ -183,11 +185,11 @@ interface DefineAuthConfig {
      */
     forbiddenRoute?: string;
     /** Routes that are always public (glob patterns) */
-    publicRoutes?: string[];
+    publicRoutes?: readonly string[];
     /** Routes that require authentication (glob patterns) */
-    protectedRoutes?: string[];
+    protectedRoutes?: readonly string[];
     /** Routes restricted to specific roles: { '/admin/:path*': ['admin'] } */
-    roleRoutes?: Record<string, string[]>;
+    roleRoutes?: Readonly<Record<string, readonly string[]>>;
     /** Session cookie name (default: 'najm.session') */
     sessionCookieName?: string;
     /** Secret for verifying session cookie HMAC. Falls back to env vars. */

package/dist/client/server/index.js

@@ -1734,6 +1734,7 @@ function defineAuth(authConfig = {}) {
   const routeHandlers = /* @__PURE__ */ __name((handler, options = {}) => {
     const persistentHandler = withAuthCookiePersistence(handler, {
       ...options,
+      rememberCookieName: options.rememberCookieName ?? authConfig.rememberCookieName,
       authCookieNames: options.authCookieNames ?? [cookieName2, sessionCookieName]
     });
     return {

package/dist/identity/ma.d.ts

@@ -1 +1 @@
-export { M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, T as TemporaryCredentialInput, i as isMoroccanCin, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone } from '../ma-sNHnUGLO.js';
+export { M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, T as TemporaryCredentialInput, i as isMoroccanCin, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone } from '../ma-Cu6xUMez.js';

package/dist/identity/ma.js

@@ -31,7 +31,7 @@ var MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
 var MOROCCAN_CIN = /^[a-z]{1,3}\d{5,17}$/i;
 function isMoroccanCin(value) {
   const trimmed = value.trim();
-  return trimmed.length >= 8 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
+  return trimmed.length >= 7 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
 }
 __name(isMoroccanCin, "isMoroccanCin");
 function normalizeMoroccanCin(value) {

package/dist/index.d.ts

@@ -4,8 +4,8 @@ import { ValidationPluginConfig } from 'najm-validation';
 import { RateLimitPluginConfig, RateLimitKeyContext, TimeWindow } from 'najm-rate';
 import { CachePluginConfig, CacheService } from 'najm-cache';
 import { EmailPluginConfig, EmailService } from 'najm-email';
-import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
-export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
+import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-Cu6xUMez.js';
+export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-Cu6xUMez.js';
 import { ZodType, z } from 'zod';
 import { I18nService } from 'najm-i18n';
 import { TDb, SeedEntry } from 'najm-database';
@@ -977,6 +977,13 @@ declare class RoleService {
         updatedAt: string;
     }[]>;
     getRoleIdByName(name: any): Promise<string>;
+    /**
+     * checkNameUnique() reads before it writes, so two concurrent requests can
+     * both pass it and race to insert the same name. The database rejects the
+     * loser; answer it with the same 409 the validator would have given rather
+     * than leaking a raw driver error as a 500.
+     */
+    private onDuplicateName;
 }
 
 declare class TokenRepository {

package/dist/index.js

@@ -40,7 +40,12 @@ var rolesTable = pgTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // A role name is a domain identity: guards match `admin` by name, and seeding
+  // reconciles roles by name. Two rows sharing a name make authorization
+  // ambiguous, so the database — not a check-then-insert query — enforces it.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),
@@ -144,7 +149,10 @@ var rolesTable2 = sqliteTable("roles", {
   ...baseFields2(5),
   name: text2("name").notNull(),
   description: text2("description")
-});
+}, (table) => ({
+  // Same domain identity as the PostgreSQL dialect; see schema/pg.ts.
+  nameUnique: uniqueIndex2("roles_name_unique").on(table.name)
+}));
 var usersTable2 = sqliteTable("users", {
   ...baseFields2(8),
   name: text2("name"),
@@ -1096,7 +1104,7 @@ var RoleService = class RoleService2 {
   }
   async create(data) {
     await this.roleValidator.checkNameUnique(data.name);
-    return await this.roleRepository.create(data);
+    return await this.onDuplicateName(() => this.roleRepository.create(data));
   }
   async update(id, data) {
     const role = await this.roleValidator.checkRoleExists(id);
@@ -1104,7 +1112,7 @@ var RoleService = class RoleService2 {
       Err3(this.t("errors.cannotRenameSystem"), 403);
     }
     await this.roleValidator.checkNameUnique(data.name, id);
-    return await this.roleRepository.update(id, data);
+    return await this.onDuplicateName(() => this.roleRepository.update(id, data));
   }
   async delete(id) {
     const role = await this.roleValidator.checkRoleExists(id);
@@ -1131,6 +1139,22 @@ var RoleService = class RoleService2 {
     const role = await this.getByName(name);
     return role?.id;
   }
+  /**
+   * checkNameUnique() reads before it writes, so two concurrent requests can
+   * both pass it and race to insert the same name. The database rejects the
+   * loser; answer it with the same 409 the validator would have given rather
+   * than leaking a raw driver error as a 500.
+   */
+  async onDuplicateName(write) {
+    try {
+      return await write();
+    } catch (error) {
+      if (isDuplicateRoleName(error)) {
+        Err3(this.t("errors.exists"), 409);
+      }
+      throw error;
+    }
+  }
 };
 __decorate7([
   I18n3("roles"),
@@ -1140,6 +1164,18 @@ RoleService = __decorate7([
   Injectable4(),
   __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
 ], RoleService);
+function isDuplicateRoleName(error) {
+  if (!error || typeof error !== "object")
+    return false;
+  const candidate = error;
+  if (candidate.code === "23505")
+    return true;
+  if (candidate.code === "SQLITE_CONSTRAINT_UNIQUE")
+    return true;
+  const message = typeof candidate.message === "string" ? candidate.message : "";
+  return /unique constraint failed/i.test(message) || /duplicate key value violates unique constraint/i.test(message);
+}
+__name(isDuplicateRoleName, "isDuplicateRoleName");
 
 // src/users/UserService.ts
 import { nanoid as nanoid3 } from "nanoid";
@@ -2777,7 +2813,7 @@ var MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
 var MOROCCAN_CIN = /^[a-z]{1,3}\d{5,17}$/i;
 function isMoroccanCin(value) {
   const trimmed = value.trim();
-  return trimmed.length >= 8 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
+  return trimmed.length >= 7 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
 }
 __name(isMoroccanCin, "isMoroccanCin");
 function normalizeMoroccanCin(value) {
@@ -7651,6 +7687,13 @@ var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
 var authSeed = /* @__PURE__ */ __name((config) => ({
   roles: {
     schema: createRoleDto,
+    // Roles are identified by name, not by the proposed primary key. Without
+    // this the seeder falls back to the primary key, and a role that already
+    // exists under a legacy/random ID is inserted a second time under the
+    // deterministic one. Query-back by name then hands downstream resolvers the
+    // live row, so users and role_permissions reference the ID the database
+    // actually holds — never a proposed ID that was skipped on conflict.
+    by: ["name"],
     rows: (config.roles ?? [
       { name: "admin", description: "System administrator with full access" },
       { name: "user", description: "Regular user with limited access" }

package/dist/{ma-sNHnUGLO.d.ts → ma-Cu6xUMez.d.ts}

@@ -66,7 +66,12 @@ interface TemporaryCredentialKind {
 /** Default kind: byte-for-byte, case-sensitive, no transformation. */
 declare const EXACT_TEMPORARY_CREDENTIAL_KIND = "exact";
 declare const MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
-/** A Moroccan CIN is 1–3 letters followed by digits, 8–20 characters overall. */
+/**
+ * A Moroccan CIN is 1–3 letters followed by digits, 7–20 characters overall.
+ * The floor is 7, not 8: the issued formats are one or two letters followed
+ * by five or six digits, so `BB46123` and `A123456` are real cards that an
+ * 8 floor turned away.
+ */
 declare function isMoroccanCin(value: string): boolean;
 /**
  * People type their CIN in either case. Anything that is not a CIN is left

package/dist/schema/pg.js

@@ -24,7 +24,12 @@ var rolesTable = pgTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // A role name is a domain identity: guards match `admin` by name, and seeding
+  // reconciles roles by name. Two rows sharing a name make authorization
+  // ambiguous, so the database — not a check-then-insert query — enforces it.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),

package/dist/schema/sqlite.js

@@ -14,7 +14,10 @@ var rolesTable = sqliteTable("roles", {
   ...baseFields(5),
   name: text("name").notNull(),
   description: text("description")
-});
+}, (table) => ({
+  // Same domain identity as the PostgreSQL dialect; see schema/pg.ts.
+  nameUnique: uniqueIndex("roles_name_unique").on(table.name)
+}));
 var usersTable = sqliteTable("users", {
   ...baseFields(8),
   name: text("name"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [