najm-auth 4.2.4 → 6.0.0

package/dist/client/index.js

@@ -228,6 +228,20 @@ var TabSync = class {
   }
 };
 
+// src/client/redirectPath.ts
+function normalizeLocalRedirectPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) return null;
+  try {
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(value, base);
+    if (parsed.origin !== base.origin || parsed.pathname.startsWith("//")) return null;
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return null;
+  }
+}
+__name(normalizeLocalRedirectPath, "normalizeLocalRedirectPath");
+
 // src/client/NajmAuthClient.ts
 function isCredentialSetupPending(payload) {
   return typeof payload === "object" && payload !== null && payload.nextStep === "credential_setup";
@@ -702,16 +716,9 @@ var NajmAuthClient = class _NajmAuthClient {
     }
   }
   validateReturnTo(value) {
-    const candidate = value.trim();
-    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
-      throw new Error("returnTo must be a same-origin path");
-    }
-    const base = new URL("https://najm.invalid");
-    const parsed = new URL(candidate, base);
-    if (parsed.origin !== base.origin || parsed.username || parsed.password) {
-      throw new Error("returnTo must be a same-origin path");
-    }
-    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    const path = normalizeLocalRedirectPath(value.trim());
+    if (!path) throw new Error("returnTo must be a same-origin path");
+    return path;
   }
 };
 function createAuthClient(config) {

package/dist/client/react/index.js

@@ -771,18 +771,25 @@ __name(GitHubLoginButton, "GitHubLoginButton");
 
 // src/client/react/OAuthCallback.tsx
 import { useEffect as useEffect7 } from "react";
-import { Fragment as Fragment14, jsx as jsx16 } from "react/jsx-runtime";
-var safeReturnTo = /* @__PURE__ */ __name((value, fallback) => {
-  const safeFallback = fallback.startsWith("/") && !fallback.startsWith("//") && !fallback.includes("\\") ? fallback : "/";
-  if (!value || !value.startsWith("/") || value.startsWith("//") || value.includes("\\")) return safeFallback;
+
+// src/client/redirectPath.ts
+function normalizeLocalRedirectPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) return null;
   try {
     const base = new URL("https://najm.invalid");
     const parsed = new URL(value, base);
-    if (parsed.origin !== base.origin) return safeFallback;
+    if (parsed.origin !== base.origin || parsed.pathname.startsWith("//")) return null;
     return `${parsed.pathname}${parsed.search}${parsed.hash}`;
   } catch {
-    return safeFallback;
+    return null;
   }
+}
+__name(normalizeLocalRedirectPath, "normalizeLocalRedirectPath");
+
+// src/client/react/OAuthCallback.tsx
+import { Fragment as Fragment14, jsx as jsx16 } from "react/jsx-runtime";
+var safeReturnTo = /* @__PURE__ */ __name((value, fallback) => {
+  return normalizeLocalRedirectPath(value) ?? normalizeLocalRedirectPath(fallback) ?? "/";
 }, "safeReturnTo");
 function OAuthCallback({
   fallback = null,

package/dist/client/server/index.js

@@ -957,6 +957,20 @@ var TabSync = class {
   }
 };
 
+// src/client/redirectPath.ts
+function normalizeLocalRedirectPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) return null;
+  try {
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(value, base);
+    if (parsed.origin !== base.origin || parsed.pathname.startsWith("//")) return null;
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return null;
+  }
+}
+__name(normalizeLocalRedirectPath, "normalizeLocalRedirectPath");
+
 // src/client/NajmAuthClient.ts
 function isCredentialSetupPending(payload) {
   return typeof payload === "object" && payload !== null && payload.nextStep === "credential_setup";
@@ -1431,16 +1445,9 @@ var NajmAuthClient = class _NajmAuthClient {
     }
   }
   validateReturnTo(value) {
-    const candidate = value.trim();
-    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
-      throw new Error("returnTo must be a same-origin path");
-    }
-    const base = new URL("https://najm.invalid");
-    const parsed = new URL(candidate, base);
-    if (parsed.origin !== base.origin || parsed.username || parsed.password) {
-      throw new Error("returnTo must be a same-origin path");
-    }
-    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    const path = normalizeLocalRedirectPath(value.trim());
+    if (!path) throw new Error("returnTo must be a same-origin path");
+    return path;
   }
 };
 function createAuthClient(config) {
@@ -1800,13 +1807,9 @@ function getSafeRedirectPath(value, options = {}) {
     fallback = "/dashboard",
     blockedPrefixes = DEFAULT_BLOCKED_PREFIXES
   } = typeof options === "string" ? { fallback: options } : options;
-  const path = Array.isArray(value) ? value[0] : value;
-  if (!path || !path.startsWith("/") || // Protocol-relative: the browser treats `//host/x` as off-site.
-  path.startsWith("//") || // A backslash is normalized to a forward slash by some browsers, so
-  // `/\evil.test` is another way to spell the case above.
-  path.startsWith("/\\") || blockedPrefixes.some((prefix) => path.startsWith(prefix)) || ASSET_EXTENSIONS.test(path.split("?")[0] ?? path)) {
-    return fallback;
-  }
+  const path = normalizeLocalRedirectPath(Array.isArray(value) ? value[0] : value);
+  const pathname = path?.split(/[?#]/)[0] ?? "";
+  if (!path || blockedPrefixes.some((prefix) => pathname.startsWith(prefix)) || ASSET_EXTENSIONS.test(pathname)) return fallback;
   return path;
 }
 __name(getSafeRedirectPath, "getSafeRedirectPath");

package/dist/index.d.ts

@@ -8,7 +8,7 @@ import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredent
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-Cu6xUMez.js';
 import { ZodType, z } from 'zod';
 import { I18nService } from 'najm-i18n';
-import { TDb, SeedEntry } from 'najm-database';
+import { TDb, TransactionService, SeedEntry } from 'najm-database';
 import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, RolePermission } from './schema/pg.js';
 export { CredentialSetupRequirement, CredentialSetupSession, NewCredentialSetupRequirement, NewCredentialSetupSession, NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
 import { CookieService } from 'najm-cookies';
@@ -61,6 +61,7 @@ interface CredentialSetupPasswordOptions {
      * Replacement-password schema. Default: 8–72 bytes with at least one letter
      * and one digit — deliberately case-agnostic, because a first-login
      * replacement is typed by someone who just proved they own the account.
+     * Every policy is still subject to the 1-72 UTF-8 byte limit for bcrypt.
      */
     passwordSchema?: ZodType<string>;
     /** Setup-session lifetime in milliseconds (default: 10 minutes). */
@@ -717,6 +718,8 @@ declare class CookieManager {
     clearSessionCookie(): void;
 }
 
+type CredentialState = Pick<User, 'id' | 'password' | 'email' | 'status' | 'emailVerified'>;
+
 interface UserWithPermissions extends Omit<User, 'password'> {
     role?: string | null;
     permissions: string[];
@@ -747,6 +750,8 @@ declare class UserRepository {
      */
     getIdsByRole(roleId: string): Promise<string[]>;
     update(id: string, data: Partial<NewUser>): Promise<User | undefined>;
+    /** The credential that authorized a delayed write must still own the account. */
+    updateWithCredential(id: string, data: Partial<NewUser>, expected: CredentialState): Promise<User | undefined>;
     updateLastLogin(id: string): Promise<User>;
     incrementFailedAttempts(id: string): Promise<User>;
     resetFailedAttempts(id: string): Promise<User>;
@@ -777,6 +782,9 @@ declare class UserValidator {
      * Check that a normalized phone number is not already taken.
      */
     checkPhoneUnique(phone: string, excludeId?: string): Promise<void>;
+    /** The database remains authoritative when two validation reads both pass. */
+    writeUnique<T>(write: () => Promise<T>): Promise<T>;
+    checkCredentialUnchanged(updated: unknown): void;
     /**
      * Check if user exists by ID
      */
@@ -919,78 +927,12 @@ declare class RoleValidator {
     isRoleNameExists(roleName: string): Promise<boolean>;
 }
 
-declare class RoleService {
-    private roleRepository;
-    private roleValidator;
-    private t;
-    constructor(roleRepository: RoleRepository, roleValidator: RoleValidator);
-    getAll(): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }[]>;
-    getById(id: any): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-    getByName(name: any): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-    create(data: any): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-    update(id: string, data: {
-        name?: string;
-        description?: string;
-    }): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-    delete(id: string): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-    seedDefaultRoles(defaultRoles: any): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-    }[]>;
-    getRoleIdByName(name: any): Promise<string>;
-    /**
-     * checkNameUnique() reads before it writes, so two concurrent requests can
-     * both pass it and race to insert the same name. The database rejects the
-     * loser; answer it with the same 409 the validator would have given rather
-     * than leaking a raw driver error as a 500.
-     */
-    private onDuplicateName;
-}
-
 declare class TokenRepository {
     db: TDb;
     private schema;
     private get tokens();
     private get users();
+    getCredentialState(userId: string): Promise<any>;
     /** Shared query helper, scoped to the current database/transaction identity. */
     private queryHelper?;
     private get q();
@@ -1073,8 +1015,9 @@ declare class TokenRepository {
 declare class SessionInvalidationService {
     private cache;
     private tokens;
+    private transactions?;
     private config;
-    constructor(cache: CacheService, tokens: TokenRepository);
+    constructor(cache: CacheService, tokens: TokenRepository, transactions?: TransactionService);
     /**
      * Fields whose change ends existing sessions. Everything absent from this set
      * — display name, avatar, language — is a profile edit and must leave the
@@ -1117,17 +1060,20 @@ declare class SessionInvalidationService {
      * the same version and write the same successor back.
      */
     invalidateAccessTokens(userId: string): Promise<number>;
+    private invalidateAccessTokensNow;
     dropUserCache(userId: string): Promise<void>;
     /**
      * End every session a user holds: access tokens by version, refresh sessions
      * by row, and each family's liveness marker.
      *
-     * Callers run this AFTER their database mutation has committed. Running it
-     * before would leave a window in which a concurrent login re-established a
-     * session against the state the mutation was about to remove; running it
-     * after a rollback merely signs the user out again, which is safe.
+     * Repeat invalidation when a caller-owned transaction completes. Readers can
+     * recover from the previous committed state before commit, or from transient
+     * state on a shared connection before rollback. Neither snapshot may survive.
      */
     invalidateUser(userId: string): Promise<void>;
+    revokeAllForUser(userId: string): Promise<any>;
+    private afterTransaction;
+    private revokeAllForUserNow;
     /**
      * Record that a family is live, and whose it is. Called wherever the family's
      * refresh row is written.
@@ -1177,6 +1123,75 @@ declare class SessionInvalidationService {
     isFamilyRevoked(tokenFamily: string): Promise<boolean>;
 }
 
+declare class RoleService {
+    private roleRepository;
+    private roleValidator;
+    private userRepository?;
+    private sessionInvalidation?;
+    private t;
+    constructor(roleRepository: RoleRepository, roleValidator: RoleValidator, userRepository?: UserRepository, sessionInvalidation?: SessionInvalidationService);
+    getAll(): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }[]>;
+    getById(id: any): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    getByName(name: any): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    create(data: any): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    update(id: string, data: {
+        name?: string;
+        description?: string;
+    }): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    delete(id: string): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    seedDefaultRoles(defaultRoles: any): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        createdAt: string;
+        updatedAt: string;
+    }[]>;
+    getRoleIdByName(name: any): Promise<string>;
+    /**
+     * checkNameUnique() reads before it writes, so two concurrent requests can
+     * both pass it and race to insert the same name. The database rejects the
+     * loser; answer it with the same 409 the validator would have given rather
+     * than leaking a raw driver error as a 500.
+     */
+    private onDuplicateName;
+}
+
 type SanitizedUser = Omit<User, 'password' | 'failedLoginAttempts' | 'lockoutUntil'> & {
     role?: string | null;
     permissions?: string[];
@@ -1235,6 +1250,7 @@ declare class UserService {
      */
     update(id: string, data: Record<string, any>, options?: {
         validatePasswordStrength?: boolean;
+        expectedCredential?: CredentialState;
     }): Promise<SanitizedUser>;
     delete(id: string): Promise<SanitizedUser>;
     deleteAll(): Promise<SanitizedUser[]>;
@@ -1270,6 +1286,7 @@ type SetPasswordTokenType = 'reset' | 'invite';
 interface ConsumedSetPasswordToken {
     userId: string;
     type: SetPasswordTokenType;
+    credentialState: string;
 }
 /**
  * A freshly minted one-time set-password token. `jti` identifies this exact
@@ -1422,7 +1439,7 @@ declare class TokenService {
         tokenFamily?: string;
     }): string;
     private createTokenPair;
-    generateTokens(userId: string, tokenFamily?: string): Promise<{
+    generateTokens(userId: string, tokenFamily?: string, capturedVersion?: number): Promise<{
         userId: string;
         tokenFamily: string;
         roles: string[];
@@ -1433,6 +1450,7 @@ declare class TokenService {
         accessTokenExpiresAt: number;
         refreshTokenExpiresAt: number;
     }>;
+    private assertSessionVersion;
     /**
      * Blacklist an access token by its jti
      * Token will be rejected until it naturally expires
@@ -1533,13 +1551,13 @@ declare class TokenService {
      * Generate secure password reset token
      * Returns both the plain token (to send via email) and userId for identification
      */
-    generateResetToken(userId: string): Promise<SetPasswordToken>;
+    generateResetToken(userId: string, expectedEmail?: string): Promise<SetPasswordToken>;
     /**
      * Generate secure account-invite token.
      * Longer expiry (3d) than reset because an invited user may not check
      * their email immediately. Consumed via the same reset-password endpoint.
      */
-    generateInviteToken(userId: string): Promise<SetPasswordToken>;
+    generateInviteToken(userId: string, expectedEmail?: string): Promise<SetPasswordToken>;
     /**
      * Discard a set-password token this process just minted, identified by the
      * `jti` its generator returned. For the caller whose email send failed:
@@ -1728,8 +1746,10 @@ declare class CredentialSetupService {
     private readonly tokens;
     private readonly authCookies;
     private readonly cookies;
+    private readonly users;
     private t?;
-    constructor(repository: CredentialSetupRepository, tokens: TokenService, authCookies: CookieManager, cookies: CookieService);
+    private config;
+    constructor(repository: CredentialSetupRepository, tokens: TokenService, authCookies: CookieManager, cookies: CookieService, users: UserRepository);
     /**
      * Revoke normal auth sessions and issue a single-purpose, short-lived,
      * browser-session cookie. No access or refresh token is minted.
@@ -1743,6 +1763,7 @@ declare class CredentialSetupService {
      * fails, consumption rolls back and the browser may safely retry.
      */
     consume<T>(options: CredentialSetupOptions, complete: (session: CredentialSetupSessionInfo) => Promise<T> | T): Promise<T>;
+    private requireCurrentCredential;
     cancel(options: CredentialSetupOptions): Promise<{
         cancelled: true;
     }>;
@@ -2272,6 +2293,22 @@ declare class PermissionRepository {
     delete(id: string): Promise<Permission>;
     getPermissionsByRole(roleId: string): Promise<Array<Pick<Permission, 'id' | 'name' | 'description' | 'resource' | 'action'>>>;
     getRolesByPermission(permissionId: string): Promise<Array<Pick<RoleEntity, 'id' | 'name' | 'description'>>>;
+    /**
+     * Capture grants and mutate their parent in one database transaction. A
+     * PostgreSQL parent-row lock conflicts with the FK check of a concurrent
+     * grant. SQLite executes the whole callback synchronously under its write
+     * lock; an async callback would commit before its awaited queries finish.
+     */
+    private mutateWithRoles;
+    updateWithRoles(id: string, data: Partial<NewPermission>): Promise<{
+        permission: any;
+        roleIds: any;
+    }>;
+    deleteWithRoles(id: string): Promise<{
+        permission: any;
+        roleIds: any;
+    }>;
+    deleteAllWithRoles(): Promise<any>;
     assignPermissionToRole(roleId: string, permissionId: string): Promise<RolePermission>;
     removePermissionFromRole(roleId: string, permissionId: string): Promise<RolePermission>;
     checkRoleHasPermission(roleId: string, permissionId: string): Promise<boolean>;
@@ -2529,24 +2566,8 @@ declare class PermissionService {
         resource: string;
         action: string;
     }>;
-    update(id: string, data: any): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }>;
-    delete(id: string): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }>;
+    update(id: string, data: any): Promise<any>;
+    delete(id: string): Promise<any>;
     getPermissionsByRole(roleId: string): Promise<Pick<{
         id: string;
         name: string;
@@ -2581,15 +2602,7 @@ declare class PermissionService {
         assigned: any[];
         skipped: any[];
     }>;
-    deleteAll(): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }[]>;
+    deleteAll(): Promise<any>;
 }
 
 declare const createPermissionDto: z.ZodObject<{
@@ -2652,24 +2665,8 @@ declare class PermissionController {
         resource: string;
         action: string;
     }>;
-    update(params: PermissionIdParam, body: UpdatePermissionDto): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }>;
-    delete(params: PermissionIdParam): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }>;
+    update(params: PermissionIdParam, body: UpdatePermissionDto): Promise<any>;
+    delete(params: PermissionIdParam): Promise<any>;
     getByRole(params: RoleIdParam): Promise<Pick<{
         id: string;
         name: string;
@@ -2696,15 +2693,7 @@ declare class PermissionController {
         roleId: string;
         permissionId: string;
     }>;
-    deleteAll(): Promise<{
-        id: string;
-        name: string;
-        description: string;
-        createdAt: string;
-        updatedAt: string;
-        resource: string;
-        action: string;
-    }[]>;
+    deleteAll(): Promise<any>;
 }
 
 interface JoinStep {