najm-auth 4.1.0 → 4.2.1

package/README.md

@@ -220,7 +220,8 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 Applications with an approval-owned onboarding flow should set
 `publicRegistration: false`. This removes the unauthenticated route while
 retaining `AuthService.registerUser()`, `provisionUser()`, and other internal
-account-management APIs for trusted application services.
+account-management APIs for trusted application services. The registration
+controller also answers 404 when disabled if an older core mounts it anyway.
 
 ### Identity presets
 
@@ -561,6 +562,36 @@ export class ProductRepository {
 
 ### Composable ownership (4.1+)
 
+For custom queries, the property form puts the rules and type together:
+
+```typescript
+import { Owned, type OwnedWhere } from 'najm-auth';
+
+@Repository('default')
+export class ProductRepository {
+  @DB() db!: Database;
+
+  @Owned(Product, SharedProduct)
+  private ownedWhere!: OwnedWhere;
+
+  async getById(id: string) {
+    const [row] = await this.db.select().from(products)
+      .where(and(this.ownedWhere(), eq(products.id, id))).limit(1);
+    return row ?? null;
+  }
+}
+```
+
+Use any instance property name; `OwnedWhere` is the shared function type.
+Resolve the repository through Najm's container before calling it. Context
+injection installs the function after construction, including when TypeScript
+emits native class fields. The function reads the current request on every call,
+so a singleton repository can safely serve different actors. Multiple decorated
+properties may use independent rules, including on inherited repositories.
+The class form and its `ownershipCondition`, `findMany`, `findOne`, and
+`scopedQuery` helpers remain available. The property form supplies only the
+decorated predicate; it does not rewrite queries or add CRUD helpers.
+
 `@Owned(Product)` now provides `ownershipCondition()` for custom queries.
 It returns a parameterized `id IN (authorized IDs)` predicate; join-based rules
 do not multiply outer rows. Combine it with filters in one

package/dist/index.d.ts

@@ -2170,6 +2170,7 @@ declare class AuthIdentityContextService {
  */
 declare class RegistrationController {
     private authService;
+    private config;
     constructor(authService: AuthService);
     registerUser(body: RegisterDto): Promise<SanitizedUser>;
 }
@@ -2856,8 +2857,11 @@ declare class ScopeContext {
         role: string;
     } | null;
 }
-declare function Owned(token: OwnershipToken, ...alternatives: OwnershipToken[]): (target: Function) => void;
+/** Decorate a repository class, or an `ownedWhere!: OwnedWhere` property. */
+declare function Owned(token: OwnershipToken, ...alternatives: OwnershipToken[]): ClassDecorator & PropertyDecorator;
 
+/** Request-aware ownership predicate supplied by an @Owned property. */
+type OwnedWhere = () => SQL | undefined;
 /** Request context consumed by ownershipCondition; ScopeContext implements it. */
 interface OwnershipReadContext {
     hasActiveContext(): boolean;
@@ -3203,4 +3207,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConditionMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipReadContext, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, ownershipCondition, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AdministrativeDelivery, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, type ConsumedSetPasswordToken, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GitHubOAuthConfig, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnedWhere, type OwnershipConditionMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipReadContext, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, SessionInvalidationService, type SetPasswordToken, type SetPasswordTokenType, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TemporaryCredentialReset, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authEmailRateLimitKey, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, ownershipCondition, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err16, plugin } from "najm-core";
+import { Err as Err17, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -4194,6 +4194,7 @@ var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
 var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
 // src/auth/AuthController.ts
+import { Public } from "najm-guard";
 import { Validate } from "najm-validation";
 import { RateLimit, UNRESOLVED_CLIENT_ADDRESS } from "najm-rate";
 import { createHash as createHash3 } from "crypto";
@@ -4447,6 +4448,7 @@ var AuthController = class AuthController2 {
 };
 __decorate21([
   Post("/login"),
+  Public(),
   RateLimit({
     limit: loginRateLimit.limit,
     window: loginRateLimit.window,
@@ -4474,6 +4476,7 @@ __decorate21([
 ], AuthController.prototype, "inviteUser", null);
 __decorate21([
   Post("/refresh"),
+  Public(),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
   ResMsg("auth.success.tokenRefreshed"),
   __metadata21("design:type", Function),
@@ -4482,6 +4485,7 @@ __decorate21([
 ], AuthController.prototype, "refreshTokens", null);
 __decorate21([
   Post("/session/recover"),
+  Public(),
   RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.success.sessionRecovered"),
   __param5(0, Headers("x-najm-session-recovery")),
@@ -4492,6 +4496,7 @@ __decorate21([
 ], AuthController.prototype, "recoverSession", null);
 __decorate21([
   Post("/logout"),
+  Public(),
   __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
   __metadata21("design:type", Function),
@@ -4511,6 +4516,7 @@ __decorate21([
 ], AuthController.prototype, "changePassword", null);
 __decorate21([
   Get("/me"),
+  Public(),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.users.success.retrieved"),
   __param5(0, Headers("authorization")),
@@ -4520,6 +4526,7 @@ __decorate21([
 ], AuthController.prototype, "userProfile", null);
 __decorate21([
   Post("/forgot-password"),
+  Public(),
   RateLimit({ limit: 3, window: "15m", key: authEmailRateLimitKey, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
@@ -4530,6 +4537,7 @@ __decorate21([
 ], AuthController.prototype, "forgotPassword", null);
 __decorate21([
   Post("/reset-password"),
+  Public(),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
   Validate(confirmResetPasswordDto),
   ResMsg("auth.success.passwordReset"),
@@ -4744,8 +4752,9 @@ AuthIdentityContextService = __decorate23([
 ], AuthIdentityContextService);
 
 // src/auth/RegistrationController.ts
-import { Body as Body2, Controller as Controller2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { Body as Body2, Controller as Controller2, Err as Err14, Inject as Inject15, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
+import { Public as Public2 } from "najm-guard";
 import { Validate as Validate2 } from "najm-validation";
 var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -4767,15 +4776,23 @@ var RegistrationController = class RegistrationController2 {
     __name(this, "RegistrationController");
   }
   authService;
+  config;
   constructor(authService) {
     this.authService = authService;
   }
   async registerUser(body) {
+    if (this.config.publicRegistration === false)
+      Err14("Not Found", 404);
     return this.authService.registerUser(body);
   }
 };
+__decorate24([
+  Inject15(AUTH_CONFIG),
+  __metadata24("design:type", Object)
+], RegistrationController.prototype, "config", void 0);
 __decorate24([
   Post2("/register"),
+  Public2(),
   RateLimit2({ limit: 5, window: "15m", key: authEmailRateLimitKey }),
   Validate2(registerDto),
   ResMsg2("auth.success.register"),
@@ -5239,7 +5256,7 @@ __export(permissions_exports, {
 
 // src/permissions/PermissionRepository.ts
 import { eq as eq7, and as and4 } from "drizzle-orm";
-import { Repository as Repository6, Inject as Inject15 } from "najm-core";
+import { Repository as Repository6, Inject as Inject16 } from "najm-core";
 import { DB as DB6 } from "najm-database";
 var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -5330,7 +5347,7 @@ __decorate27([
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
 __decorate27([
-  Inject15(AUTH_SCHEMA),
+  Inject16(AUTH_SCHEMA),
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
 PermissionRepository = __decorate27([
@@ -5407,7 +5424,7 @@ import { Injectable as Injectable15 } from "najm-core";
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable14 } from "najm-core";
 import { I18n as I18n9 } from "najm-i18n";
-import { Err as Err14 } from "najm-core";
+import { Err as Err15 } from "najm-core";
 var __decorate29 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -5436,7 +5453,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err14(this.t("errors.notFound"), 404);
+      Err15(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -5446,7 +5463,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err14(this.t("errors.notFound"), 404);
+      Err15(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -5458,7 +5475,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err14(this.t("errors.nameExists"), 409);
+      Err15(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -5481,7 +5498,7 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err14(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err15(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
@@ -6034,7 +6051,7 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable16, Inject as Inject16, User as User4, Body as Body6, Params as Params4 } from "najm-core";
+import { Injectable as Injectable16, Inject as Inject17, User as User4, Body as Body6, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
 var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6075,7 +6092,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject16(ownershipClass),
+    Inject17(ownershipClass),
     __metadata32("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6099,7 +6116,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject16(ownershipClass),
+    Inject17(ownershipClass),
     __metadata32("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6258,7 +6275,7 @@ function configureOwnership(config) {
       }
     };
     __decorate32([
-      Inject16(GeneratedOwnershipService),
+      Inject17(GeneratedOwnershipService),
       __metadata32("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
     __decorate32([
@@ -6384,7 +6401,7 @@ __name(Policy, "Policy");
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
 import { sql as sql6, and as and5 } from "drizzle-orm";
-import { Injectable as Injectable17, Inject as Inject17, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
+import { Injectable as Injectable17, Inject as Inject18, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 
 // src/ownership/ownershipCondition.ts
@@ -6435,6 +6452,43 @@ var __metadata33 = function(k, v) {
 };
 var _a21;
 var OWNED_META = Symbol.for("najm:owned");
+var OWNED_PROPERTIES = Symbol.for("najm:owned-properties");
+var propertyContexts = /* @__PURE__ */ new WeakMap();
+function ownedProperty(proto, key, tokens) {
+  const inherited = Reflect.getMetadata(OWNED_PROPERTIES, proto) ?? [];
+  const properties = [...inherited.filter((property) => property.key !== key), { key, tokens }];
+  Reflect.defineMetadata(OWNED_PROPERTIES, properties, proto);
+  Object.defineProperty(proto, key, {
+    value() {
+      return ownershipCondition(this.db, tokens, this._scopeCtx);
+    },
+    configurable: true,
+    enumerable: false
+  });
+  if (!Reflect.hasOwnMetadata(OWNED_PROPERTIES, proto, "_scopeCtx")) {
+    Inject18(ScopeContext)(proto, "_scopeCtx");
+    Reflect.defineMetadata(OWNED_PROPERTIES, true, proto, "_scopeCtx");
+    Object.defineProperty(proto, "_scopeCtx", {
+      get() {
+        return propertyContexts.get(this);
+      },
+      set(context) {
+        propertyContexts.set(this, context);
+        const properties2 = Reflect.getMetadata(OWNED_PROPERTIES, this) ?? [];
+        for (const property of properties2) {
+          Object.defineProperty(this, property.key, {
+            value: /* @__PURE__ */ __name(() => ownershipCondition(this.db, property.tokens, this._scopeCtx), "value"),
+            configurable: true,
+            enumerable: false
+          });
+        }
+      },
+      configurable: true,
+      enumerable: false
+    });
+  }
+}
+__name(ownedProperty, "ownedProperty");
 var ScopeContext = class ScopeContext2 {
   static {
     __name(this, "ScopeContext");
@@ -6475,10 +6529,18 @@ ScopeContext = __decorate33([
 function Owned(token, ...alternatives) {
   const tokens = [token, ...alternatives];
   validateOwnershipAlternatives(tokens);
-  return function(target) {
+  return function(target, propertyKey) {
+    if (propertyKey !== void 0) {
+      if (typeof target === "function")
+        throw new Error("@Owned requires an instance property");
+      ownedProperty(target, propertyKey, tokens);
+      return;
+    }
+    if (typeof target !== "function")
+      throw new Error("@Owned requires a repository class");
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
-    Inject17(ScopeContext)(proto, "_scopeCtx");
+    Inject18(ScopeContext)(proto, "_scopeCtx");
     Object.defineProperty(proto, "ownershipCondition", {
       value() {
         return ownershipCondition(this.db, tokens, this._scopeCtx);
@@ -6700,7 +6762,7 @@ __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-import { Inject as Inject19, Injectable as Injectable19 } from "najm-core";
+import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
 
 // src/oauth/types.ts
 var OAuthFlowError = class extends Error {
@@ -6718,7 +6780,7 @@ var OAuthFlowError = class extends Error {
 };
 
 // src/oauth/google/GoogleTokenVerifier.ts
-import { Inject as Inject18, Injectable as Injectable18 } from "najm-core";
+import { Inject as Inject19, Injectable as Injectable18 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6779,7 +6841,7 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
   }
 };
 __decorate34([
-  Inject18(AUTH_CONFIG),
+  Inject19(AUTH_CONFIG),
   __metadata34("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
 GoogleTokenVerifier = __decorate34([
@@ -6865,7 +6927,7 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
   }
 };
 __decorate35([
-  Inject19(AUTH_CONFIG),
+  Inject20(AUTH_CONFIG),
   __metadata35("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
 GoogleOAuthProvider = __decorate35([
@@ -6874,7 +6936,7 @@ GoogleOAuthProvider = __decorate35([
 ], GoogleOAuthProvider);
 
 // src/oauth/github/GitHubOAuthProvider.ts
-import { Inject as Inject20, Injectable as Injectable20 } from "najm-core";
+import { Inject as Inject21, Injectable as Injectable20 } from "najm-core";
 var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -6998,7 +7060,7 @@ var GitHubOAuthProvider = class GitHubOAuthProvider2 {
   }
 };
 __decorate36([
-  Inject20(AUTH_CONFIG),
+  Inject21(AUTH_CONFIG),
   __metadata36("design:type", Object)
 ], GitHubOAuthProvider.prototype, "config", void 0);
 GitHubOAuthProvider = __decorate36([
@@ -7009,18 +7071,19 @@ GitHubOAuthProvider = __decorate36([
 import { createHash as createHash5 } from "crypto";
 import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit3 } from "najm-rate";
+import { Public as Public3 } from "najm-guard";
 
 // src/oauth/OAuthService.ts
-import { Err as Err15, Inject as Inject23, Injectable as Injectable23, Log as Log2 } from "najm-core";
+import { Err as Err16, Inject as Inject24, Injectable as Injectable23, Log as Log2 } from "najm-core";
 
 // src/oauth/OAuthAccountService.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { Inject as Inject22, Injectable as Injectable21 } from "najm-core";
+import { Inject as Inject23, Injectable as Injectable21 } from "najm-core";
 import { Transaction as Transaction5 } from "najm-database";
 
 // src/oauth/OAuthAccountRepository.ts
 import { and as and6, eq as eq9 } from "drizzle-orm";
-import { Inject as Inject21, Repository as Repository7 } from "najm-core";
+import { Inject as Inject22, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
 var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -7061,7 +7124,7 @@ __decorate37([
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
 __decorate37([
-  Inject21(AUTH_SCHEMA),
+  Inject22(AUTH_SCHEMA),
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
 OAuthAccountRepository = __decorate37([
@@ -7158,7 +7221,7 @@ var OAuthAccountService = class OAuthAccountService2 {
   }
 };
 __decorate38([
-  Inject22(AUTH_CONFIG),
+  Inject23(AUTH_CONFIG),
   __metadata38("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
 __decorate38([
@@ -7362,7 +7425,7 @@ var OAuthService = class OAuthService2 {
    */
   failStart(error) {
     if (error instanceof OAuthFlowError) {
-      Err15(error.oauthCode, error.status);
+      Err16(error.oauthCode, error.status);
     }
     throw error;
   }
@@ -7469,7 +7532,7 @@ var OAuthService = class OAuthService2 {
   }
 };
 __decorate40([
-  Inject23(AUTH_CONFIG),
+  Inject24(AUTH_CONFIG),
   __metadata40("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
 __decorate40([
@@ -7523,6 +7586,7 @@ var GitHubOAuthController = class GitHubOAuthController2 {
 };
 __decorate41([
   Get5("/start"),
+  Public3(),
   RateLimit3({ limit: 20, window: "15m", key: "ip" }),
   __param13(0, Ctx2()),
   __param13(1, Query2("returnTo")),
@@ -7532,6 +7596,7 @@ __decorate41([
 ], GitHubOAuthController.prototype, "start", null);
 __decorate41([
   Get5("/callback"),
+  Public3(),
   RateLimit3({ limit: 20, window: "15m", key: callbackKey }),
   __param13(0, Ctx2()),
   __param13(1, Query2("code")),
@@ -7560,6 +7625,7 @@ GitHubOAuthController = __decorate41([
 import { createHash as createHash6 } from "crypto";
 import { Controller as Controller7, Ctx as Ctx3, Get as Get6, Post as Post7, Query as Query3, User as User6 } from "najm-core";
 import { RateLimit as RateLimit4 } from "najm-rate";
+import { Public as Public4 } from "najm-guard";
 var __decorate42 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -7602,6 +7668,7 @@ var OAuthController = class OAuthController2 {
 };
 __decorate42([
   Get6("/start"),
+  Public4(),
   RateLimit4({ limit: 20, window: "15m", key: "ip" }),
   __param14(0, Ctx3()),
   __param14(1, Query3("returnTo")),
@@ -7611,6 +7678,7 @@ __decorate42([
 ], OAuthController.prototype, "start", null);
 __decorate42([
   Get6("/callback"),
+  Public4(),
   RateLimit4({ limit: 20, window: "15m", key: callbackKey2 }),
   __param14(0, Ctx3()),
   __param14(1, Query3("code")),
@@ -7651,6 +7719,7 @@ var OAUTH_MODULE = [
 // src/credentialSetup/CredentialSetupController.ts
 import { Body as Body7, Controller as Controller8, Get as Get7, Post as Post8, ResMsg as ResMsg6 } from "najm-core";
 import { RateLimit as RateLimit5 } from "najm-rate";
+import { Public as Public5 } from "najm-guard";
 import { Validate as Validate6 } from "najm-validation";
 
 // src/credentialSetup/CredentialSetupDto.ts
@@ -7696,6 +7765,7 @@ var CredentialSetupController = class CredentialSetupController2 {
 };
 __decorate43([
   Get7("/setup"),
+  Public5(),
   RateLimit5({ limit: 30, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupPending"),
   __metadata43("design:type", Function),
@@ -7704,6 +7774,7 @@ __decorate43([
 ], CredentialSetupController.prototype, "status", null);
 __decorate43([
   Post8("/change"),
+  Public5(),
   RateLimit5({ limit: 5, window: "15m", key: "ip" }),
   Validate6(credentialSetupChangeDto),
   ResMsg6("auth.success.credentialSetupPasswordReplaced"),
@@ -7714,6 +7785,7 @@ __decorate43([
 ], CredentialSetupController.prototype, "change", null);
 __decorate43([
   Post8("/cancel"),
+  Public5(),
   RateLimit5({ limit: 10, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupCancelled"),
   __metadata43("design:type", Function),
@@ -7776,9 +7848,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err17.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err17.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   return {
@@ -7800,9 +7872,9 @@ var resolveGitHubConfig = /* @__PURE__ */ __name((config) => {
   const clientId = github.clientId ?? process.env.GITHUB_CLIENT_ID ?? "";
   const clientSecret = github.clientSecret ?? process.env.GITHUB_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
+    throw Err17.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
   if (!clientSecret)
-    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
+    throw Err17.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = github.callbackUrl ?? process.env.GITHUB_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/github/callback`;
   return {
@@ -7872,10 +7944,10 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err16.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err17.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err16.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err17.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -92,9 +92,9 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.6",
+    "najm-core": "^3.0.0",
     "najm-database": "^2.0.4",
-    "najm-guard": "^2.0.2",
+    "najm-guard": "^2.1.0",
     "najm-i18n": "^2.1.2",
     "najm-cache": "^2.2.0",
     "najm-email": "^2.0.4",