najm-auth 4.2.0 → 4.2.2

package/README.md

@@ -220,7 +220,8 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 Applications with an approval-owned onboarding flow should set
 `publicRegistration: false`. This removes the unauthenticated route while
 retaining `AuthService.registerUser()`, `provisionUser()`, and other internal
-account-management APIs for trusted application services.
+account-management APIs for trusted application services. The registration
+controller also answers 404 when disabled if an older core mounts it anyway.
 
 ### Identity presets
 

package/dist/index.d.ts

@@ -2170,6 +2170,7 @@ declare class AuthIdentityContextService {
  */
 declare class RegistrationController {
     private authService;
+    private config;
     constructor(authService: AuthService);
     registerUser(body: RegisterDto): Promise<SanitizedUser>;
 }

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err16, plugin } from "najm-core";
+import { Err as Err17, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -2118,6 +2118,24 @@ CredentialSetupRequirementRepository = __decorate11([
 // src/credentialSetup/types.ts
 var PASSWORD_SETUP_PURPOSE = "password";
 
+// src/shared/storedTime.ts
+function storedTimeMs(value) {
+  if (value instanceof Date)
+    return value.getTime();
+  const text3 = value.trim().replace(" ", "T");
+  const time = text3.split("T")[1];
+  if (!time)
+    return Date.parse(text3);
+  if (/Z$/i.test(time))
+    return Date.parse(text3);
+  const offset = /([+-])(\d{2}):?(\d{2})?$/.exec(time);
+  if (!offset)
+    return Date.parse(`${text3}Z`);
+  const [zone, sign, hours, minutes = "00"] = offset;
+  return Date.parse(`${text3.slice(0, -zone.length)}${sign}${hours}:${minutes}`);
+}
+__name(storedTimeMs, "storedTimeMs");
+
 // src/tokens/TokenService.ts
 import { Err as Err7 } from "najm-core";
 var __decorate12 = function(decorators, target, key, desc) {
@@ -2297,7 +2315,7 @@ var TokenService = class TokenService2 {
     if (presentedHash === stored.token) {
       return { userId, tokenFamily };
     }
-    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
       return { userId, tokenFamily };
     }
@@ -2557,7 +2575,7 @@ var TokenService = class TokenService2 {
     if (presentedHash === stored.token) {
       return this.rotateTokens(userId, tokenFamily, stored.token);
     }
-    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
@@ -2695,7 +2713,7 @@ var TokenService = class TokenService2 {
       if (presentedHash === stored.token) {
         return decoded.tokenFamily;
       }
-      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
       return canRecover ? decoded.tokenFamily : null;
     } catch {
       return null;
@@ -3503,7 +3521,7 @@ var AuthService = class AuthService2 {
   isLockoutActive(lockoutUntil) {
     if (!lockoutUntil)
       return false;
-    return new Date(lockoutUntil).getTime() > Date.now();
+    return storedTimeMs(lockoutUntil) > Date.now();
   }
   nextLockoutUntil() {
     const durationMs = timestring4(this.config.lockout.duration, "ms");
@@ -4194,6 +4212,7 @@ var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
 var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
 // src/auth/AuthController.ts
+import { Public } from "najm-guard";
 import { Validate } from "najm-validation";
 import { RateLimit, UNRESOLVED_CLIENT_ADDRESS } from "najm-rate";
 import { createHash as createHash3 } from "crypto";
@@ -4447,6 +4466,7 @@ var AuthController = class AuthController2 {
 };
 __decorate21([
   Post("/login"),
+  Public(),
   RateLimit({
     limit: loginRateLimit.limit,
     window: loginRateLimit.window,
@@ -4474,6 +4494,7 @@ __decorate21([
 ], AuthController.prototype, "inviteUser", null);
 __decorate21([
   Post("/refresh"),
+  Public(),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
   ResMsg("auth.success.tokenRefreshed"),
   __metadata21("design:type", Function),
@@ -4482,6 +4503,7 @@ __decorate21([
 ], AuthController.prototype, "refreshTokens", null);
 __decorate21([
   Post("/session/recover"),
+  Public(),
   RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.success.sessionRecovered"),
   __param5(0, Headers("x-najm-session-recovery")),
@@ -4492,6 +4514,7 @@ __decorate21([
 ], AuthController.prototype, "recoverSession", null);
 __decorate21([
   Post("/logout"),
+  Public(),
   __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
   __metadata21("design:type", Function),
@@ -4511,6 +4534,7 @@ __decorate21([
 ], AuthController.prototype, "changePassword", null);
 __decorate21([
   Get("/me"),
+  Public(),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.users.success.retrieved"),
   __param5(0, Headers("authorization")),
@@ -4520,6 +4544,7 @@ __decorate21([
 ], AuthController.prototype, "userProfile", null);
 __decorate21([
   Post("/forgot-password"),
+  Public(),
   RateLimit({ limit: 3, window: "15m", key: authEmailRateLimitKey, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
@@ -4530,6 +4555,7 @@ __decorate21([
 ], AuthController.prototype, "forgotPassword", null);
 __decorate21([
   Post("/reset-password"),
+  Public(),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
   Validate(confirmResetPasswordDto),
   ResMsg("auth.success.passwordReset"),
@@ -4744,8 +4770,9 @@ AuthIdentityContextService = __decorate23([
 ], AuthIdentityContextService);
 
 // src/auth/RegistrationController.ts
-import { Body as Body2, Controller as Controller2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { Body as Body2, Controller as Controller2, Err as Err14, Inject as Inject15, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
+import { Public as Public2 } from "najm-guard";
 import { Validate as Validate2 } from "najm-validation";
 var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -4767,15 +4794,23 @@ var RegistrationController = class RegistrationController2 {
     __name(this, "RegistrationController");
   }
   authService;
+  config;
   constructor(authService) {
     this.authService = authService;
   }
   async registerUser(body) {
+    if (this.config.publicRegistration === false)
+      Err14("Not Found", 404);
     return this.authService.registerUser(body);
   }
 };
+__decorate24([
+  Inject15(AUTH_CONFIG),
+  __metadata24("design:type", Object)
+], RegistrationController.prototype, "config", void 0);
 __decorate24([
   Post2("/register"),
+  Public2(),
   RateLimit2({ limit: 5, window: "15m", key: authEmailRateLimitKey }),
   Validate2(registerDto),
   ResMsg2("auth.success.register"),
@@ -5239,7 +5274,7 @@ __export(permissions_exports, {
 
 // src/permissions/PermissionRepository.ts
 import { eq as eq7, and as and4 } from "drizzle-orm";
-import { Repository as Repository6, Inject as Inject15 } from "najm-core";
+import { Repository as Repository6, Inject as Inject16 } from "najm-core";
 import { DB as DB6 } from "najm-database";
 var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -5330,7 +5365,7 @@ __decorate27([
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
 __decorate27([
-  Inject15(AUTH_SCHEMA),
+  Inject16(AUTH_SCHEMA),
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
 PermissionRepository = __decorate27([
@@ -5407,7 +5442,7 @@ import { Injectable as Injectable15 } from "najm-core";
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable14 } from "najm-core";
 import { I18n as I18n9 } from "najm-i18n";
-import { Err as Err14 } from "najm-core";
+import { Err as Err15 } from "najm-core";
 var __decorate29 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -5436,7 +5471,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err14(this.t("errors.notFound"), 404);
+      Err15(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -5446,7 +5481,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err14(this.t("errors.notFound"), 404);
+      Err15(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -5458,7 +5493,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err14(this.t("errors.nameExists"), 409);
+      Err15(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -5481,7 +5516,7 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err14(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err15(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
@@ -6034,7 +6069,7 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable16, Inject as Inject16, User as User4, Body as Body6, Params as Params4 } from "najm-core";
+import { Injectable as Injectable16, Inject as Inject17, User as User4, Body as Body6, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
 var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6075,7 +6110,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject16(ownershipClass),
+    Inject17(ownershipClass),
     __metadata32("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6099,7 +6134,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject16(ownershipClass),
+    Inject17(ownershipClass),
     __metadata32("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6258,7 +6293,7 @@ function configureOwnership(config) {
       }
     };
     __decorate32([
-      Inject16(GeneratedOwnershipService),
+      Inject17(GeneratedOwnershipService),
       __metadata32("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
     __decorate32([
@@ -6384,7 +6419,7 @@ __name(Policy, "Policy");
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
 import { sql as sql6, and as and5 } from "drizzle-orm";
-import { Injectable as Injectable17, Inject as Inject17, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
+import { Injectable as Injectable17, Inject as Inject18, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 
 // src/ownership/ownershipCondition.ts
@@ -6449,7 +6484,7 @@ function ownedProperty(proto, key, tokens) {
     enumerable: false
   });
   if (!Reflect.hasOwnMetadata(OWNED_PROPERTIES, proto, "_scopeCtx")) {
-    Inject17(ScopeContext)(proto, "_scopeCtx");
+    Inject18(ScopeContext)(proto, "_scopeCtx");
     Reflect.defineMetadata(OWNED_PROPERTIES, true, proto, "_scopeCtx");
     Object.defineProperty(proto, "_scopeCtx", {
       get() {
@@ -6523,7 +6558,7 @@ function Owned(token, ...alternatives) {
       throw new Error("@Owned requires a repository class");
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
-    Inject17(ScopeContext)(proto, "_scopeCtx");
+    Inject18(ScopeContext)(proto, "_scopeCtx");
     Object.defineProperty(proto, "ownershipCondition", {
       value() {
         return ownershipCondition(this.db, tokens, this._scopeCtx);
@@ -6745,7 +6780,7 @@ __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-import { Inject as Inject19, Injectable as Injectable19 } from "najm-core";
+import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
 
 // src/oauth/types.ts
 var OAuthFlowError = class extends Error {
@@ -6763,7 +6798,7 @@ var OAuthFlowError = class extends Error {
 };
 
 // src/oauth/google/GoogleTokenVerifier.ts
-import { Inject as Inject18, Injectable as Injectable18 } from "najm-core";
+import { Inject as Inject19, Injectable as Injectable18 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6824,7 +6859,7 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
   }
 };
 __decorate34([
-  Inject18(AUTH_CONFIG),
+  Inject19(AUTH_CONFIG),
   __metadata34("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
 GoogleTokenVerifier = __decorate34([
@@ -6910,7 +6945,7 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
   }
 };
 __decorate35([
-  Inject19(AUTH_CONFIG),
+  Inject20(AUTH_CONFIG),
   __metadata35("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
 GoogleOAuthProvider = __decorate35([
@@ -6919,7 +6954,7 @@ GoogleOAuthProvider = __decorate35([
 ], GoogleOAuthProvider);
 
 // src/oauth/github/GitHubOAuthProvider.ts
-import { Inject as Inject20, Injectable as Injectable20 } from "najm-core";
+import { Inject as Inject21, Injectable as Injectable20 } from "najm-core";
 var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -7043,7 +7078,7 @@ var GitHubOAuthProvider = class GitHubOAuthProvider2 {
   }
 };
 __decorate36([
-  Inject20(AUTH_CONFIG),
+  Inject21(AUTH_CONFIG),
   __metadata36("design:type", Object)
 ], GitHubOAuthProvider.prototype, "config", void 0);
 GitHubOAuthProvider = __decorate36([
@@ -7054,18 +7089,19 @@ GitHubOAuthProvider = __decorate36([
 import { createHash as createHash5 } from "crypto";
 import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit3 } from "najm-rate";
+import { Public as Public3 } from "najm-guard";
 
 // src/oauth/OAuthService.ts
-import { Err as Err15, Inject as Inject23, Injectable as Injectable23, Log as Log2 } from "najm-core";
+import { Err as Err16, Inject as Inject24, Injectable as Injectable23, Log as Log2 } from "najm-core";
 
 // src/oauth/OAuthAccountService.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { Inject as Inject22, Injectable as Injectable21 } from "najm-core";
+import { Inject as Inject23, Injectable as Injectable21 } from "najm-core";
 import { Transaction as Transaction5 } from "najm-database";
 
 // src/oauth/OAuthAccountRepository.ts
 import { and as and6, eq as eq9 } from "drizzle-orm";
-import { Inject as Inject21, Repository as Repository7 } from "najm-core";
+import { Inject as Inject22, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
 var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -7106,7 +7142,7 @@ __decorate37([
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
 __decorate37([
-  Inject21(AUTH_SCHEMA),
+  Inject22(AUTH_SCHEMA),
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
 OAuthAccountRepository = __decorate37([
@@ -7203,7 +7239,7 @@ var OAuthAccountService = class OAuthAccountService2 {
   }
 };
 __decorate38([
-  Inject22(AUTH_CONFIG),
+  Inject23(AUTH_CONFIG),
   __metadata38("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
 __decorate38([
@@ -7407,7 +7443,7 @@ var OAuthService = class OAuthService2 {
    */
   failStart(error) {
     if (error instanceof OAuthFlowError) {
-      Err15(error.oauthCode, error.status);
+      Err16(error.oauthCode, error.status);
     }
     throw error;
   }
@@ -7514,7 +7550,7 @@ var OAuthService = class OAuthService2 {
   }
 };
 __decorate40([
-  Inject23(AUTH_CONFIG),
+  Inject24(AUTH_CONFIG),
   __metadata40("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
 __decorate40([
@@ -7568,6 +7604,7 @@ var GitHubOAuthController = class GitHubOAuthController2 {
 };
 __decorate41([
   Get5("/start"),
+  Public3(),
   RateLimit3({ limit: 20, window: "15m", key: "ip" }),
   __param13(0, Ctx2()),
   __param13(1, Query2("returnTo")),
@@ -7577,6 +7614,7 @@ __decorate41([
 ], GitHubOAuthController.prototype, "start", null);
 __decorate41([
   Get5("/callback"),
+  Public3(),
   RateLimit3({ limit: 20, window: "15m", key: callbackKey }),
   __param13(0, Ctx2()),
   __param13(1, Query2("code")),
@@ -7605,6 +7643,7 @@ GitHubOAuthController = __decorate41([
 import { createHash as createHash6 } from "crypto";
 import { Controller as Controller7, Ctx as Ctx3, Get as Get6, Post as Post7, Query as Query3, User as User6 } from "najm-core";
 import { RateLimit as RateLimit4 } from "najm-rate";
+import { Public as Public4 } from "najm-guard";
 var __decorate42 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -7647,6 +7686,7 @@ var OAuthController = class OAuthController2 {
 };
 __decorate42([
   Get6("/start"),
+  Public4(),
   RateLimit4({ limit: 20, window: "15m", key: "ip" }),
   __param14(0, Ctx3()),
   __param14(1, Query3("returnTo")),
@@ -7656,6 +7696,7 @@ __decorate42([
 ], OAuthController.prototype, "start", null);
 __decorate42([
   Get6("/callback"),
+  Public4(),
   RateLimit4({ limit: 20, window: "15m", key: callbackKey2 }),
   __param14(0, Ctx3()),
   __param14(1, Query3("code")),
@@ -7696,6 +7737,7 @@ var OAUTH_MODULE = [
 // src/credentialSetup/CredentialSetupController.ts
 import { Body as Body7, Controller as Controller8, Get as Get7, Post as Post8, ResMsg as ResMsg6 } from "najm-core";
 import { RateLimit as RateLimit5 } from "najm-rate";
+import { Public as Public5 } from "najm-guard";
 import { Validate as Validate6 } from "najm-validation";
 
 // src/credentialSetup/CredentialSetupDto.ts
@@ -7741,6 +7783,7 @@ var CredentialSetupController = class CredentialSetupController2 {
 };
 __decorate43([
   Get7("/setup"),
+  Public5(),
   RateLimit5({ limit: 30, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupPending"),
   __metadata43("design:type", Function),
@@ -7749,6 +7792,7 @@ __decorate43([
 ], CredentialSetupController.prototype, "status", null);
 __decorate43([
   Post8("/change"),
+  Public5(),
   RateLimit5({ limit: 5, window: "15m", key: "ip" }),
   Validate6(credentialSetupChangeDto),
   ResMsg6("auth.success.credentialSetupPasswordReplaced"),
@@ -7759,6 +7803,7 @@ __decorate43([
 ], CredentialSetupController.prototype, "change", null);
 __decorate43([
   Post8("/cancel"),
+  Public5(),
   RateLimit5({ limit: 10, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupCancelled"),
   __metadata43("design:type", Function),
@@ -7821,9 +7866,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err17.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err17.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   return {
@@ -7845,9 +7890,9 @@ var resolveGitHubConfig = /* @__PURE__ */ __name((config) => {
   const clientId = github.clientId ?? process.env.GITHUB_CLIENT_ID ?? "";
   const clientSecret = github.clientSecret ?? process.env.GITHUB_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
+    throw Err17.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
   if (!clientSecret)
-    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
+    throw Err17.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = github.callbackUrl ?? process.env.GITHUB_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/github/callback`;
   return {
@@ -7917,10 +7962,10 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err16.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err17.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err16.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err17.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -92,9 +92,9 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.1.0",
+    "najm-core": "^3.0.0",
     "najm-database": "^2.0.4",
-    "najm-guard": "^2.0.2",
+    "najm-guard": "^2.1.0",
     "najm-i18n": "^2.1.2",
     "najm-cache": "^2.2.0",
     "najm-email": "^2.0.4",