najm-auth 4.0.8 → 4.1.0

package/README.md

@@ -508,44 +508,36 @@ export const Product = own(products)
     join(products.userId, _users.id),
     where(_users.id)
   )
-  .writeBy(products.userId);  // Enforce on create/update
+  .writeBy(products.userId);  // Metadata for consumers; not an automatic write guard
 ```
 
 ### Using @Policy and @Owned
 
 ```typescript
-import { configureOwnership, Policy, CanList, CanRead, CanCreate, CanUpdate, CanDelete } from 'najm-auth';
-
-const config = configureOwnership({
-  adminRoles: ['admin'],
-  rules: {
-    'user': {
-      'products': Product.getRules()['user']
-    }
-  }
-});
+import { Owned, Policy, CanList, CanRead, CanCreate, CanUpdate, CanDelete } from 'najm-auth';
+import { and, eq, type SQL } from 'drizzle-orm';
 
 @Policy(Product)
 @Controller('/api/products')
 export class ProductController {
   @Get('/')
-  @CanList()                   // List only owned products
-  getAll(@GuardParams() filter: any) { }
+  @CanList()                   // Checks read permission; repository scopes rows
+  getAll() { /* delegate to a scoped service/repository read */ }
 
   @Get('/:id')
-  @CanRead()                   // Read only if owner
+  @CanRead()                   // Checks read permission; lookup must scope the ID
   getOne() { }
 
   @Post('/')
-  @CanCreate()                 // Create (ownership assigned automatically)
+  @CanCreate()                 // Service must validate/assign ownership
   create(@Body() data: any) { }
 
   @Put('/:id')
-  @CanUpdate()                 // Update only if owner
+  @CanUpdate()                 // Service must load an owned record before writing
   update(@Body() data: any) { }
 
   @Delete('/:id')
-  @CanDelete()                 // Delete only if owner
+  @CanDelete()                 // Service must load an owned record before deleting
   delete() { }
 }
 
@@ -554,21 +546,54 @@ export class ProductController {
 export class ProductRepository {
   @DB() db!: Database;
 
-  // Auto-scoped to current user
-  async findMany(opts?: { where?: any; limit?: number }) {
-    return this.findMany(opts);  // Only returns owned products
-  }
-
-  async findOne(opts: { where: any }) {
-    return this.findOne(opts);   // Returns null if not owned
-  }
+  // These methods are supplied by @Owned; do not define recursive wrappers.
+  declare ownershipCondition: () => SQL | undefined;
+  declare findMany: (opts?: { where?: SQL; limit?: number }) => Promise<ProductRow[]>;
+  declare findOne: (opts: { where: SQL }) => Promise<ProductRow | null>;
 
-  async scopedQuery() {
-    return this.scopedQuery();   // Raw scoped query builder
+  async getById(id: string) {
+    const [row] = await this.db.select().from(products)
+      .where(and(this.ownershipCondition(), eq(products.id, id))).limit(1);
+    return row ?? null;
   }
 }
 ```
 
+### Composable ownership (4.1+)
+
+`@Owned(Product)` now provides `ownershipCondition()` for custom queries.
+It returns a parameterized `id IN (authorized IDs)` predicate; join-based rules
+do not multiply outer rows. Combine it with filters in one
+`.where(and(this.ownershipCondition(), filter))`. The owned table must have an
+`id` column. A standalone `ownershipCondition(db, tokens, context)` and the
+`OwnershipReadContext` / `OwnershipConditionMethods` types are also exported.
+
+`@Owned(Product, SharedProduct)` grants either rule (OR), then your query's
+filters apply (AND). Every alternative must reference the same table object.
+Alternatives work with `ownershipCondition`, `findMany`, `findOne`, and
+`scopedQuery`. Single-token helpers retain their existing behavior.
+
+Configure school-wide, tenant-wide, or other privileged roles in the app:
+
+```typescript
+const Product = own(products, { adminRoles: ['admin', 'operations'] })
+  .for('member', where(products.userId));
+```
+
+Those roles bypass row ownership only; route permissions still apply. Unknown
+roles and anonymous active requests get no rows. Outside request context,
+seed/job reads remain unscoped for compatibility; never treat a manually
+constructed repository without request injection as an authenticated boundary.
+
+**Migrating custom queries:** replace `this.scope(query).where(filter)` with
+`query.where(and(this.ownershipCondition(), filter))`. Drizzle replaces an
+earlier WHERE when another `.where()` is called. The legacy `scope()` and
+`scopedQuery()` APIs remain for compatibility, but their result must not be
+followed by `.where()`; for simple reads use `findMany({ where: filter })`.
+An upgrade alone does not rewrite unsafe queries in consumers. Keep role
+and cross-user integration tests in each app. `@Policy` and `@CanRead` check
+permissions, not the ownership of a requested record ID.
+
 ### Advanced Ownership: Multi-Role Scoping
 
 ```typescript

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { CredentialSetupRequirement, CredentialSetupSession, NewCredentialSetupR
 import { CookieService } from 'najm-cookies';
 import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
-import 'drizzle-orm';
+import { SQL } from 'drizzle-orm';
 import 'drizzle-orm/pg-core';
 
 interface CredentialSetupOptions {
@@ -2856,7 +2856,29 @@ declare class ScopeContext {
         role: string;
     } | null;
 }
-declare function Owned(token: OwnershipToken): (target: Function) => void;
+declare function Owned(token: OwnershipToken, ...alternatives: OwnershipToken[]): (target: Function) => void;
+
+/** Request context consumed by ownershipCondition; ScopeContext implements it. */
+interface OwnershipReadContext {
+    hasActiveContext(): boolean;
+    getUser(): {
+        id: string;
+        role: string;
+    } | null;
+}
+/** Additional custom-query method installed by @Owned. */
+interface OwnershipConditionMethods {
+    ownershipCondition(): SQL | undefined;
+}
+/**
+ * Compose this predicate with application filters in ONE .where(and(...)).
+ * Each token grants alternative access to the same table through an ID
+ * subquery, so joins cannot duplicate outer rows or collide with outer joins.
+ * The table must expose an `id` column. Roles and ownership rules remain
+ * application-owned. Unknown roles and anonymous active requests deny all.
+ * Outside a request, reads remain unscoped for seed/job compatibility.
+ */
+declare function ownershipCondition(db: any, tokens: readonly OwnershipToken[], context: OwnershipReadContext | undefined): SQL | undefined;
 
 /**
  * Shared query builders used across auth repositories.
@@ -3181,4 +3203,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConditionMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipReadContext, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, ownershipCondition, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -1993,9 +1993,7 @@ var UserService = class UserService2 {
     if (!config?.email || !config?.password) {
       Err5("Admin email and password must be provided via config parameter");
     }
-    if (config.password.length < 12) {
-      Err5("Admin password must be at least 12 characters");
-    }
+    this.userValidator.validatePasswordStrength(config.password);
     const adminRole = await this.roleValidator.checkAdminRoleExists();
     const existingUser = await this.userRepository.getByEmail(config.email);
     if (existingUser) {
@@ -5973,7 +5971,7 @@ var OwnershipToken = class {
   symbol;
   name;
   table;
-  _rules = {};
+  _rules = /* @__PURE__ */ Object.create(null);
   _writeScopeCol;
   _adminRoles;
   constructor(table, opts) {
@@ -6385,9 +6383,47 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql5, and as and5 } from "drizzle-orm";
+import { sql as sql6, and as and5 } from "drizzle-orm";
 import { Injectable as Injectable17, Inject as Inject17, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
+
+// src/ownership/ownershipCondition.ts
+import { inArray, or, sql as sql5 } from "drizzle-orm";
+function validateOwnershipAlternatives(tokens) {
+  if (!tokens.length)
+    throw new Error("Ownership requires at least one token");
+  const table = tokens[0].table;
+  if (tokens.some((token) => token.table !== table)) {
+    throw new Error("Ownership alternatives must refer to the same table");
+  }
+}
+__name(validateOwnershipAlternatives, "validateOwnershipAlternatives");
+function ownershipCondition(db, tokens, context) {
+  validateOwnershipAlternatives(tokens);
+  const idColumn = tokens[0].table.id;
+  if (!idColumn)
+    throw new Error("ownershipCondition requires a table with an id column");
+  if (!context?.hasActiveContext())
+    return void 0;
+  const user = context.getUser();
+  if (!user)
+    return sql5`1 = 0`;
+  const conditions = [];
+  for (const token of tokens) {
+    const { query, condition } = token.applyScopeSplit(user.id, user.role, db.select({ id: idColumn }).from(token.table));
+    if (condition === null)
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(token.getRules(), user.role))
+      continue;
+    conditions.push(inArray(idColumn, query.where(condition)));
+  }
+  if (!conditions.length)
+    return sql5`1 = 0`;
+  return conditions.length === 1 ? conditions[0] : or(...conditions);
+}
+__name(ownershipCondition, "ownershipCondition");
+
+// src/ownership/OwnedDecorator.ts
 var __decorate33 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -6436,11 +6472,20 @@ __decorate33([
 ScopeContext = __decorate33([
   Injectable17()
 ], ScopeContext);
-function Owned(token) {
+function Owned(token, ...alternatives) {
+  const tokens = [token, ...alternatives];
+  validateOwnershipAlternatives(tokens);
   return function(target) {
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
     Inject17(ScopeContext)(proto, "_scopeCtx");
+    Object.defineProperty(proto, "ownershipCondition", {
+      value() {
+        return ownershipCondition(this.db, tokens, this._scopeCtx);
+      },
+      configurable: true,
+      enumerable: false
+    });
     function getUser(self) {
       return self._scopeCtx?.getUser() ?? null;
     }
@@ -6472,9 +6517,11 @@ function Owned(token) {
         return (query) => {
           if (!hasActiveContext(this))
             return query;
+          if (alternatives.length)
+            return query.where(this.ownershipCondition());
           const user = getUser(this);
           if (!user)
-            return query.where(sql5`1 = 0`);
+            return query.where(sql6`1 = 0`);
           return token.applyScope(user.id, user.role, query);
         };
       },
@@ -6491,6 +6538,9 @@ function Owned(token) {
         if (!user)
           return [];
         const base = this.db.select().from(token.table);
+        if (alternatives.length) {
+          return applyQueryOptions(base, opts, combineConditions(this.ownershipCondition(), opts.where));
+        }
         const { query: q, condition: scopeCondition } = token.applyScopeSplit(user.id, user.role, base);
         return applyQueryOptions(q, opts, combineConditions(scopeCondition, opts.where));
       };
@@ -8115,6 +8165,7 @@ export {
   normalizeTunisianPhone,
   oauthAccountsTable,
   own,
+  ownershipCondition,
   parseSchema,
   permissionIdParam,
   permissionsTable,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.0.8",
+  "version": "4.1.0",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [