najm-auth 4.1.0 → 4.2.0

package/README.md

@@ -561,6 +561,36 @@ export class ProductRepository {
 
 ### Composable ownership (4.1+)
 
+For custom queries, the property form puts the rules and type together:
+
+```typescript
+import { Owned, type OwnedWhere } from 'najm-auth';
+
+@Repository('default')
+export class ProductRepository {
+  @DB() db!: Database;
+
+  @Owned(Product, SharedProduct)
+  private ownedWhere!: OwnedWhere;
+
+  async getById(id: string) {
+    const [row] = await this.db.select().from(products)
+      .where(and(this.ownedWhere(), eq(products.id, id))).limit(1);
+    return row ?? null;
+  }
+}
+```
+
+Use any instance property name; `OwnedWhere` is the shared function type.
+Resolve the repository through Najm's container before calling it. Context
+injection installs the function after construction, including when TypeScript
+emits native class fields. The function reads the current request on every call,
+so a singleton repository can safely serve different actors. Multiple decorated
+properties may use independent rules, including on inherited repositories.
+The class form and its `ownershipCondition`, `findMany`, `findOne`, and
+`scopedQuery` helpers remain available. The property form supplies only the
+decorated predicate; it does not rewrite queries or add CRUD helpers.
+
 `@Owned(Product)` now provides `ownershipCondition()` for custom queries.
 It returns a parameterized `id IN (authorized IDs)` predicate; join-based rules
 do not multiply outer rows. Combine it with filters in one

package/dist/index.d.ts

@@ -2856,8 +2856,11 @@ declare class ScopeContext {
         role: string;
     } | null;
 }
-declare function Owned(token: OwnershipToken, ...alternatives: OwnershipToken[]): (target: Function) => void;
+/** Decorate a repository class, or an `ownedWhere!: OwnedWhere` property. */
+declare function Owned(token: OwnershipToken, ...alternatives: OwnershipToken[]): ClassDecorator & PropertyDecorator;
 
+/** Request-aware ownership predicate supplied by an @Owned property. */
+type OwnedWhere = () => SQL | undefined;
 /** Request context consumed by ownershipCondition; ScopeContext implements it. */
 interface OwnershipReadContext {
     hasActiveContext(): boolean;
@@ -3203,4 +3206,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConditionMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipReadContext, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, ownershipCondition, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnedWhere, type OwnershipConditionMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipReadContext, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, ownershipCondition, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -6435,6 +6435,43 @@ var __metadata33 = function(k, v) {
 };
 var _a21;
 var OWNED_META = Symbol.for("najm:owned");
+var OWNED_PROPERTIES = Symbol.for("najm:owned-properties");
+var propertyContexts = /* @__PURE__ */ new WeakMap();
+function ownedProperty(proto, key, tokens) {
+  const inherited = Reflect.getMetadata(OWNED_PROPERTIES, proto) ?? [];
+  const properties = [...inherited.filter((property) => property.key !== key), { key, tokens }];
+  Reflect.defineMetadata(OWNED_PROPERTIES, properties, proto);
+  Object.defineProperty(proto, key, {
+    value() {
+      return ownershipCondition(this.db, tokens, this._scopeCtx);
+    },
+    configurable: true,
+    enumerable: false
+  });
+  if (!Reflect.hasOwnMetadata(OWNED_PROPERTIES, proto, "_scopeCtx")) {
+    Inject17(ScopeContext)(proto, "_scopeCtx");
+    Reflect.defineMetadata(OWNED_PROPERTIES, true, proto, "_scopeCtx");
+    Object.defineProperty(proto, "_scopeCtx", {
+      get() {
+        return propertyContexts.get(this);
+      },
+      set(context) {
+        propertyContexts.set(this, context);
+        const properties2 = Reflect.getMetadata(OWNED_PROPERTIES, this) ?? [];
+        for (const property of properties2) {
+          Object.defineProperty(this, property.key, {
+            value: /* @__PURE__ */ __name(() => ownershipCondition(this.db, property.tokens, this._scopeCtx), "value"),
+            configurable: true,
+            enumerable: false
+          });
+        }
+      },
+      configurable: true,
+      enumerable: false
+    });
+  }
+}
+__name(ownedProperty, "ownedProperty");
 var ScopeContext = class ScopeContext2 {
   static {
     __name(this, "ScopeContext");
@@ -6475,7 +6512,15 @@ ScopeContext = __decorate33([
 function Owned(token, ...alternatives) {
   const tokens = [token, ...alternatives];
   validateOwnershipAlternatives(tokens);
-  return function(target) {
+  return function(target, propertyKey) {
+    if (propertyKey !== void 0) {
+      if (typeof target === "function")
+        throw new Error("@Owned requires an instance property");
+      ownedProperty(target, propertyKey, tokens);
+      return;
+    }
+    if (typeof target !== "function")
+      throw new Error("@Owned requires a repository class");
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
     Inject17(ScopeContext)(proto, "_scopeCtx");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -92,7 +92,7 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.6",
+    "najm-core": "^2.1.0",
     "najm-database": "^2.0.4",
     "najm-guard": "^2.0.2",
     "najm-i18n": "^2.1.2",