najm-auth 6.3.1 → 6.4.1

package/dist/{NajmAuthClient-BygfBCpF.d.ts → NajmAuthClient-B1Gv8PIw.d.ts}

@@ -1,4 +1,4 @@
-import { R as RetryConfig, a as RequestOptions, A as AuthUser, b as AuthClientConfig, L as LoginCredentials, c as LoginResult, O as OAuthProvider, d as OAuthLoginOptions, e as AuthState, f as AuthEvent, g as AuthEventHandler } from './types-CI2t8wpJ.js';
+import { R as RetryConfig, a as RequestOptions, A as AuthUser, b as AuthClientConfig, L as LoginCredentials, c as LoginResult, O as OAuthProvider, d as OAuthLoginOptions, e as AuthState, f as AuthEvent, g as AuthEventHandler } from './types-axhOL6D1.js';
 
 interface FetchClientConfig {
     baseURL: string;

package/dist/client/edge.js

@@ -139,7 +139,7 @@ function isRecord(value) {
 }
 __name(isRecord, "isRecord");
 function isValidUser(value) {
-  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && (value.email === null || typeof value.email === "string" && value.email.length > 0) && (value.role === void 0 || value.role === null || typeof value.role === "string");
 }
 __name(isValidUser, "isValidUser");
 function isStringArray(value) {

package/dist/client/index.d.ts

@@ -1,6 +1,6 @@
-export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-BygfBCpF.js';
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../types-CI2t8wpJ.js';
-export { b as AuthClientConfig, h as AuthError, f as AuthEvent, g as AuthEventHandler, i as AuthEventMap, e as AuthState, A as AuthUser, j as AuthenticatedLogin, C as CredentialSetupPending, L as LoginCredentials, c as LoginResult, d as OAuthLoginOptions, O as OAuthProvider, a as RequestOptions, R as RetryConfig, k as ServerResponse, l as TokenPair } from '../types-CI2t8wpJ.js';
+export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-B1Gv8PIw.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../types-axhOL6D1.js';
+export { b as AuthClientConfig, h as AuthError, f as AuthEvent, g as AuthEventHandler, i as AuthEventMap, e as AuthState, A as AuthUser, j as AuthenticatedLogin, C as CredentialSetupPending, L as LoginCredentials, c as LoginResult, d as OAuthLoginOptions, O as OAuthProvider, a as RequestOptions, R as RetryConfig, k as ServerResponse, l as TokenPair } from '../types-axhOL6D1.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-BygfBCpF.js';
-import { e as AuthState, A as AuthUser, c as LoginResult, h as AuthError, L as LoginCredentials, d as OAuthLoginOptions, f as AuthEvent, i as AuthEventMap } from '../../types-CI2t8wpJ.js';
+import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-B1Gv8PIw.js';
+import { e as AuthState, A as AuthUser, c as LoginResult, h as AuthError, L as LoginCredentials, d as OAuthLoginOptions, f as AuthEvent, i as AuthEventMap } from '../../types-axhOL6D1.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;

package/dist/client/server/index.d.ts

@@ -1,9 +1,9 @@
-import { A as AuthUser, R as RetryConfig } from '../../types-CI2t8wpJ.js';
-import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-BygfBCpF.js';
+import { A as AuthUser, R as RetryConfig } from '../../types-axhOL6D1.js';
+import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-B1Gv8PIw.js';
 import { AuthProxyOptions, ProxySessionMode } from '../edge.js';
 export { withAuthMiddleware } from '../edge.js';
-import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-DBX8XpsR.js';
-export { A as AuthConfigError, a as AuthTransportError, N as NoSessionError, g as getSession } from '../../getSession-DBX8XpsR.js';
+import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-DAQCguP3.js';
+export { A as AuthConfigError, a as AuthTransportError, N as NoSessionError, g as getSession } from '../../getSession-DAQCguP3.js';
 import { S as SessionRecoveryFailure } from '../../sessionRecovery-D5Fa0yZ1.js';
 export { a as SessionRecoveryErrorDetails, b as SessionRecoveryFailureReason } from '../../sessionRecovery-D5Fa0yZ1.js';
 import 'next/server';

package/dist/client/server/index.js

@@ -134,7 +134,7 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isValidUser(value) {
-  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && (value.email === null || typeof value.email === "string" && value.email.length > 0) && (value.role === void 0 || value.role === null || typeof value.role === "string");
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");

package/dist/client/server/react.d.ts

@@ -1,5 +1,5 @@
-import { S as ServerSession } from '../../getSession-DBX8XpsR.js';
-import '../../types-CI2t8wpJ.js';
+import { S as ServerSession } from '../../getSession-DAQCguP3.js';
+import '../../types-axhOL6D1.js';
 import '../../sessionRecovery-D5Fa0yZ1.js';
 
 /**

package/dist/{getSession-DBX8XpsR.d.ts → getSession-DAQCguP3.d.ts}

@@ -1,4 +1,4 @@
-import { A as AuthUser } from './types-CI2t8wpJ.js';
+import { A as AuthUser } from './types-axhOL6D1.js';
 import { S as SessionRecoveryFailure } from './sessionRecovery-D5Fa0yZ1.js';
 
 interface ServerSession {

package/dist/index.d.ts

@@ -379,7 +379,8 @@ interface TokenPair {
  */
 interface AuthUser {
     id: string;
-    email: string;
+    /** Null for an account reached by phone only. */
+    email: string | null;
     name?: string | null;
     role?: string;
     status?: string;
@@ -462,6 +463,7 @@ var users = {
 		notFound: "User not found",
 		idExists: "User ID already exists",
 		emailRequired: "Email is required",
+		emailOrPhoneRequired: "An email address or a phone number is required",
 		phoneExists: "Phone number already registered",
 		passwordRequired: "Password is required",
 		invalidEmail: "Invalid email format",
@@ -592,6 +594,7 @@ declare const AUTH_LOCALES: {
                 notFound: string;
                 idExists: string;
                 emailRequired: string;
+                emailOrPhoneRequired: string;
                 phoneExists: string;
                 passwordRequired: string;
                 invalidEmail: string;
@@ -667,7 +670,7 @@ interface SessionCookieData {
     /** Must satisfy the AuthUser contract — see AuthUser in ../types. */
     user: {
         id: string;
-        email: string;
+        email: string | null;
         name?: string | null;
         role?: string;
         status?: string;
@@ -744,6 +747,10 @@ declare class UserRepository {
     getByEmailInsensitive(email: string): Promise<(User & {
         role?: string | null;
     }) | undefined>;
+    /** Login by phone reads the row it matched; the account may have no email. */
+    getByPhoneWithCredentials(phone: string): Promise<(User & {
+        role?: string | null;
+    }) | undefined>;
     create(data: NewUser): Promise<User>;
     /**
      * Ids of everyone holding a role. Used to end sessions when the role's
@@ -779,11 +786,17 @@ declare class UserValidator {
     /**
      * Check if email already exists in database
      */
-    checkEmailUnique(email: string, excludeId?: string): Promise<void>;
+    checkEmailUnique(email: string | null | undefined, excludeId?: string): Promise<void>;
     /**
      * Check that a normalized phone number is not already taken.
      */
     checkPhoneUnique(phone: string, excludeId?: string): Promise<void>;
+    /**
+     * An account is reached by its email, its phone, or both. Refused here with
+     * a message the caller can show; the `users_email_or_phone` check is the
+     * database's own copy of the rule.
+     */
+    checkHasIdentity(email: string | null | undefined, phone: string | null | undefined): void;
     /** The database remains authoritative when two validation reads both pass. */
     writeUnique<T>(write: () => Promise<T>): Promise<T>;
     checkCredentialUnchanged(updated: unknown): void;
@@ -1219,6 +1232,11 @@ declare class UserService {
      * so, and a second call is harmless.
      */
     private invalidateSessions;
+    /**
+     * Stored in the same normalized form login lookup resolves to, or phone
+     * login would never find the row. Blank means no phone.
+     */
+    private normalizePhone;
     private sanitizeUser;
     private sanitizeUsers;
     private requireUser;
@@ -1240,6 +1258,10 @@ declare class UserService {
         role?: string | null;
     }) | undefined>;
     findByPhone(phone: string): Promise<UserWithPermissions>;
+    /** The credential row behind a phone login, for timing-safe authentication. */
+    findCredentialsByPhone(phone: string): Promise<(User & {
+        role?: string | null;
+    }) | undefined>;
     getAuthRecordById(id: string): Promise<User | undefined>;
     create(data: Record<string, any>, options?: {
         validatePasswordStrength?: boolean;
@@ -1599,7 +1621,8 @@ declare class TokenService {
 
 declare const createUserDto: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    email: z.ZodString;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     password: z.ZodString;
     roleId: z.ZodOptional<z.ZodString>;
     image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1612,7 +1635,8 @@ declare const createUserDto: z.ZodObject<{
 }, z.core.$strip>;
 declare const updateUserDto: z.ZodObject<{
     name: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    email: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    phone: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
     password: z.ZodOptional<z.ZodString>;
     roleId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     image: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -1837,9 +1861,13 @@ declare class PasswordSetupService {
 type ProvisionUserInput = {
     id?: string;
     name?: string;
-    email: string;
+    /**
+     * At least one of `email` and `phone` is required. Blank counts as absent;
+     * an account with no email is created without an invitation mail.
+     */
+    email?: string | null;
     /** Normalized through the configured identity preset before it is stored. */
-    phone?: string;
+    phone?: string | null;
     role?: string;
     roleId?: string;
     image?: string | null;
@@ -2970,6 +2998,8 @@ declare class AuthQueries {
         name: any;
         email: any;
         emailVerified: any;
+        phone: any;
+        phoneVerified: any;
         image: any;
         status: any;
         roleId: any;

package/dist/index.js

@@ -18,7 +18,7 @@ var AUTH_PERMISSIONS = Symbol.for("najm:auth:permissions");
 var AUTH_ENCRYPTION_KEY = Symbol.for("najm:auth:encryption-key");
 
 // src/schema/pg.ts
-import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
+import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex, check } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 
@@ -49,7 +49,10 @@ var rolesTable = pgTable("roles", {
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),
-  email: text("email").notNull().unique(),
+  // An account is reached by its email, its phone, or both — never neither.
+  // Email is nullable so several phone-only accounts can coexist: a NOT NULL
+  // column forced them all to "" and the second one broke the unique index.
+  email: text("email").unique(),
   emailVerified: boolean("email_verified").default(false),
   phone: text("phone").unique(),
   phoneVerified: boolean("phone_verified").default(false),
@@ -61,7 +64,8 @@ var usersTable = pgTable("users", {
   failedLoginAttempts: integer("failed_login_attempts").default(0),
   lockoutUntil: timestamp("lockout_until", { mode: "string" })
 }, (table) => ({
-  roleIdx: index("users_role_id_idx").on(table.roleId)
+  roleIdx: index("users_role_id_idx").on(table.roleId),
+  emailOrPhone: check("users_email_or_phone", sql`${table.email} is not null or ${table.phone} is not null`)
 }));
 var oauthAccountsTable = pgTable("oauth_accounts", {
   ...baseFields(10),
@@ -137,7 +141,7 @@ var authSchema = {
 };
 
 // src/schema/sqlite.ts
-import { sqliteTable, text as text2, integer as integer2, primaryKey as primaryKey2, uniqueIndex as uniqueIndex2, index as index2 } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text as text2, integer as integer2, primaryKey as primaryKey2, uniqueIndex as uniqueIndex2, index as index2, check as check2 } from "drizzle-orm/sqlite-core";
 import { sql as sql2 } from "drizzle-orm";
 import { nanoid as nanoid2 } from "nanoid";
 var baseFields2 = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -156,7 +160,8 @@ var rolesTable2 = sqliteTable("roles", {
 var usersTable2 = sqliteTable("users", {
   ...baseFields2(8),
   name: text2("name"),
-  email: text2("email").notNull().unique(),
+  // Nullable, with at least one of email or phone; see schema/pg.ts.
+  email: text2("email").unique(),
   emailVerified: integer2("email_verified", { mode: "boolean" }).default(false),
   phone: text2("phone").unique(),
   phoneVerified: integer2("phone_verified", { mode: "boolean" }).default(false),
@@ -168,7 +173,8 @@ var usersTable2 = sqliteTable("users", {
   failedLoginAttempts: integer2("failed_login_attempts").default(0),
   lockoutUntil: text2("lockout_until")
 }, (table) => ({
-  roleIdx: index2("users_role_id_idx").on(table.roleId)
+  roleIdx: index2("users_role_id_idx").on(table.roleId),
+  emailOrPhone: check2("users_email_or_phone", sql2`${table.email} is not null or ${table.phone} is not null`)
 }));
 var oauthAccountsTable2 = sqliteTable("oauth_accounts", {
   ...baseFields2(10),
@@ -385,7 +391,7 @@ function isRecord(value) {
 }
 __name(isRecord, "isRecord");
 function isValidUser(value) {
-  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && (value.email === null || typeof value.email === "string" && value.email.length > 0) && (value.role === void 0 || value.role === null || typeof value.role === "string");
 }
 __name(isValidUser, "isValidUser");
 function isStringArray(value) {
@@ -537,6 +543,10 @@ var AuthQueries = class {
       name: this.schema.users.name,
       email: this.schema.users.email,
       emailVerified: this.schema.users.emailVerified,
+      // An account may be reached by phone only; without this the user list
+      // and profile showed no way to reach it at all.
+      phone: this.schema.users.phone,
+      phoneVerified: this.schema.users.phoneVerified,
       image: this.schema.users.image,
       status: this.schema.users.status,
       roleId: this.schema.users.roleId,
@@ -682,6 +692,16 @@ var UserRepository = class UserRepository2 {
     }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(sql3`lower(${this.users.email}) = ${email2.trim().toLowerCase()}`).limit(1);
     return existingUser;
   }
+  /** Login by phone reads the row it matched; the account may have no email. */
+  async getByPhoneWithCredentials(phone) {
+    const [existingUser] = await this.db.select({
+      ...this.q.userSelection(),
+      password: this.users.password,
+      failedLoginAttempts: this.users.failedLoginAttempts,
+      lockoutUntil: this.users.lockoutUntil
+    }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(eq2(this.users.phone, phone)).limit(1);
+    return existingUser;
+  }
   async create(data) {
     const [newUser] = await this.db.insert(this.users).values(data).returning();
     return newUser;
@@ -701,7 +721,7 @@ var UserRepository = class UserRepository2 {
   }
   /** The credential that authorized a delayed write must still own the account. */
   async updateWithCredential(id, data, expected) {
-    const [updated] = await this.db.update(this.users).set(data).where(and(eq2(this.users.id, id), eq2(this.users.password, expected.password), eq2(this.users.email, expected.email), expected.status == null ? isNull(this.users.status) : eq2(this.users.status, expected.status), expected.emailVerified == null ? isNull(this.users.emailVerified) : eq2(this.users.emailVerified, expected.emailVerified))).returning();
+    const [updated] = await this.db.update(this.users).set(data).where(and(eq2(this.users.id, id), eq2(this.users.password, expected.password), expected.email == null ? isNull(this.users.email) : eq2(this.users.email, expected.email), expected.status == null ? isNull(this.users.status) : eq2(this.users.status, expected.status), expected.emailVerified == null ? isNull(this.users.emailVerified) : eq2(this.users.emailVerified, expected.emailVerified))).returning();
     return updated;
   }
   async updateLastLogin(id) {
@@ -779,6 +799,21 @@ function isUniqueViolation(error) {
   return false;
 }
 __name(isUniqueViolation, "isUniqueViolation");
+function isMissingIdentityViolation(error) {
+  const visited = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !visited.has(error)) {
+    visited.add(error);
+    const candidate = error;
+    const constraint = candidate.constraint ?? candidate.constraint_name;
+    if (constraint === "users_email_or_phone")
+      return true;
+    if (typeof candidate.message === "string" && candidate.message.includes("users_email_or_phone"))
+      return true;
+    error = candidate.cause;
+  }
+  return false;
+}
+__name(isMissingIdentityViolation, "isMissingIdentityViolation");
 
 // src/users/UserValidator.ts
 var __decorate4 = function(decorators, target, key, desc) {
@@ -825,6 +860,16 @@ var UserValidator = class UserValidator2 {
       Err(this.t("errors.phoneExists"), 409);
     }
   }
+  /**
+   * An account is reached by its email, its phone, or both. Refused here with
+   * a message the caller can show; the `users_email_or_phone` check is the
+   * database's own copy of the rule.
+   */
+  checkHasIdentity(email2, phone) {
+    if (!email2 && !phone) {
+      Err(this.t("errors.emailOrPhoneRequired"), 400);
+    }
+  }
   /** The database remains authoritative when two validation reads both pass. */
   async writeUnique(write) {
     try {
@@ -832,6 +877,8 @@ var UserValidator = class UserValidator2 {
     } catch (error) {
       if (isUniqueViolation(error))
         Err("User identity already exists", 409);
+      if (isMissingIdentityViolation(error))
+        Err(this.t("errors.emailOrPhoneRequired"), 400);
       throw error;
     }
   }
@@ -1862,6 +1909,10 @@ var _g;
 var _h;
 var _j;
 var E164_PHONE = /^\+[1-9]\d{7,14}$/;
+function normalizeEmail(value) {
+  return typeof value === "string" && value.trim() ? value.trim().toLowerCase() : null;
+}
+__name(normalizeEmail, "normalizeEmail");
 var UserService = class UserService2 {
   static {
     __name(this, "UserService");
@@ -1897,6 +1948,18 @@ var UserService = class UserService2 {
   async invalidateSessions(userId) {
     await this.sessionInvalidation?.invalidateUser(userId);
   }
+  /**
+   * Stored in the same normalized form login lookup resolves to, or phone
+   * login would never find the row. Blank means no phone.
+   */
+  normalizePhone(phone) {
+    if (phone == null || typeof phone === "string" && !phone.trim())
+      return null;
+    const normalized = this.authConfig.identity?.resolve(phone) ?? normalizeAuthIdentifier(phone);
+    if (!normalized || !E164_PHONE.test(normalized))
+      Err5("A valid phone number is required", 400);
+    return normalized;
+  }
   sanitizeUser(user) {
     if (!user)
       return user;
@@ -1960,6 +2023,10 @@ var UserService = class UserService2 {
   async findByPhone(phone) {
     return await this.userRepository.findByPhone(phone);
   }
+  /** The credential row behind a phone login, for timing-safe authentication. */
+  async findCredentialsByPhone(phone) {
+    return await this.userRepository.getByPhoneWithCredentials(phone);
+  }
   async getAuthRecordById(id) {
     return await this.userRepository.getRawById(id);
   }
@@ -1973,12 +2040,11 @@ var UserService = class UserService2 {
       this.userValidator.validatePasswordStrength(password);
     }
     let userId = id || nanoid3(10);
-    await this.userValidator.checkEmailUnique(data.email);
+    const normalizedEmail = normalizeEmail(email2);
+    const normalizedPhone = this.normalizePhone(phone);
+    this.userValidator.checkHasIdentity(normalizedEmail, normalizedPhone);
+    await this.userValidator.checkEmailUnique(normalizedEmail);
     await this.userValidator.checkUserIdIsUnique(userId);
-    const normalizedPhone = phone == null ? null : this.authConfig.identity?.resolve(phone) ?? normalizeAuthIdentifier(phone);
-    if (phone != null && (!normalizedPhone || !E164_PHONE.test(normalizedPhone))) {
-      Err5("A valid phone number is required", 400);
-    }
     if (normalizedPhone) {
       await this.userValidator.checkPhoneUnique(normalizedPhone, userId);
     }
@@ -1987,7 +2053,7 @@ var UserService = class UserService2 {
     const userDetails = {
       id: userId,
       name: name || null,
-      email: email2.trim().toLowerCase(),
+      email: normalizedEmail,
       image,
       password: hashedPassword,
       roleId: resolvedRoleId,
@@ -2006,7 +2072,17 @@ var UserService = class UserService2 {
    */
   async update(id, data, options = {}) {
     const { password, image } = data;
-    await this.userValidator.checkEmailUnique(data.email, id);
+    const touchesEmail = data.email !== void 0;
+    const touchesPhone = data.phone !== void 0;
+    const email2 = touchesEmail ? normalizeEmail(data.email) : void 0;
+    const phone = touchesPhone ? this.normalizePhone(data.phone) : void 0;
+    if (touchesEmail && !email2 || touchesPhone && !phone) {
+      const current = this.requireUser(await this.userRepository.getRawById(id));
+      this.userValidator.checkHasIdentity(touchesEmail ? email2 : current.email, touchesPhone ? phone : current.phone);
+    }
+    await this.userValidator.checkEmailUnique(email2, id);
+    if (phone)
+      await this.userValidator.checkPhoneUnique(phone, id);
     let hashedPassword;
     if (password) {
       if (options.validatePasswordStrength === false) {
@@ -2021,15 +2097,10 @@ var UserService = class UserService2 {
       image,
       ...hashedPassword && { password: hashedPassword }
     };
-    if (typeof data.email === "string")
-      updateData.email = data.email.trim().toLowerCase();
-    if (data.phone !== void 0 && data.phone !== null) {
-      const phone = this.authConfig.identity?.resolve(data.phone) ?? normalizeAuthIdentifier(data.phone);
-      if (!phone || !E164_PHONE.test(phone))
-        Err5("A valid phone number is required", 400);
-      await this.userValidator.checkPhoneUnique(phone, id);
+    if (touchesEmail)
+      updateData.email = email2;
+    if (touchesPhone)
       updateData.phone = phone;
-    }
     const cleanedUpdateData = clean(updateData);
     const updatedUser = await this.userValidator.writeUnique(() => options.expectedCredential ? this.userRepository.updateWithCredential(id, cleanedUpdateData, options.expectedCredential) : this.userRepository.update(id, cleanedUpdateData));
     if (options.expectedCredential)
@@ -2891,7 +2962,7 @@ var TokenService = class TokenService2 {
    */
   async generateSetPasswordToken(userId, type, expiresIn, expectedEmail) {
     const user = await this.tokenRepository.getCredentialState(userId);
-    if (!user || expectedEmail !== void 0 && user.email.trim().toLowerCase() !== expectedEmail.trim().toLowerCase()) {
+    if (!user || expectedEmail !== void 0 && (user.email ?? "").trim().toLowerCase() !== expectedEmail.trim().toLowerCase()) {
       Err7(this.t("errors.invalidResetToken"), 401);
     }
     const credentialState = credentialFingerprint(this.config.jwt.refreshSecret, user);
@@ -3960,8 +4031,7 @@ var AuthService = class AuthService2 {
     if (identifier && isEmailIdentifier(identifier)) {
       user = await this.userService.findByEmailInsensitive(identifier);
     } else if (identifier) {
-      const phoneUser = await this.userService.findByPhone(identifier);
-      user = phoneUser ? await this.userService.findByEmail(phoneUser.email) : void 0;
+      user = await this.userService.findCredentialsByPhone(identifier);
     }
     if (user?.lockoutUntil && !this.isLockoutActive(user.lockoutUntil)) {
       await this.userService.resetFailedAttempts(user.id);
@@ -4542,7 +4612,8 @@ var passwordField = z.string().min(8, "Password must be at least 8 characters").
 var optionalDateField = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
 var createUserDto = z.object({
   name: z.string().max(100).optional(),
-  email: emailField,
+  email: emailField.nullish(),
+  phone: z.string().trim().max(32).nullish(),
   password: passwordField,
   roleId: z.string().min(1).optional(),
   image: z.string().nullish(),
@@ -7042,6 +7113,7 @@ var en_default = {
       notFound: "User not found",
       idExists: "User ID already exists",
       emailRequired: "Email is required",
+      emailOrPhoneRequired: "An email address or a phone number is required",
       phoneExists: "Phone number already registered",
       passwordRequired: "Password is required",
       invalidEmail: "Invalid email format",
@@ -8374,7 +8446,7 @@ var authSeed = /* @__PURE__ */ __name((config) => ({
   users: {
     by: ["email"],
     rows: /* @__PURE__ */ __name(async (seeded) => {
-      createUserDto.pick({ email: true, password: true }).parse({
+      registerDto.pick({ email: true, password: true }).parse({
         email: config.adminEmail,
         password: config.adminPass
       });
@@ -8392,7 +8464,7 @@ var authSeed = /* @__PURE__ */ __name((config) => ({
       ];
       if (config.additionalUsers) {
         for (const user of config.additionalUsers) {
-          createUserDto.pick({ email: true, password: true }).parse({
+          registerDto.pick({ email: true, password: true }).parse({
             email: user.email,
             password: user.password
           });

package/dist/schema/pg.d.ts

@@ -135,7 +135,7 @@ declare const usersTable: drizzle_orm_pg_core.PgTableWithColumns<{
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1208,7 +1208,7 @@ declare const authSchema: {
                 columnType: "PgText";
                 data: string;
                 driverParam: string;
-                notNull: true;
+                notNull: false;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;

package/dist/schema/pg.js

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/schema/pg.ts
-import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
+import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex, check } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 
@@ -33,7 +33,10 @@ var rolesTable = pgTable("roles", {
 var usersTable = pgTable("users", {
   ...baseFields(8),
   name: text("name"),
-  email: text("email").notNull().unique(),
+  // An account is reached by its email, its phone, or both — never neither.
+  // Email is nullable so several phone-only accounts can coexist: a NOT NULL
+  // column forced them all to "" and the second one broke the unique index.
+  email: text("email").unique(),
   emailVerified: boolean("email_verified").default(false),
   phone: text("phone").unique(),
   phoneVerified: boolean("phone_verified").default(false),
@@ -45,7 +48,8 @@ var usersTable = pgTable("users", {
   failedLoginAttempts: integer("failed_login_attempts").default(0),
   lockoutUntil: timestamp("lockout_until", { mode: "string" })
 }, (table) => ({
-  roleIdx: index("users_role_id_idx").on(table.roleId)
+  roleIdx: index("users_role_id_idx").on(table.roleId),
+  emailOrPhone: check("users_email_or_phone", sql`${table.email} is not null or ${table.phone} is not null`)
 }));
 var oauthAccountsTable = pgTable("oauth_accounts", {
   ...baseFields(10),

package/dist/schema/sqlite.d.ts

@@ -144,7 +144,7 @@ declare const usersTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             columnType: "SQLiteText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1368,7 +1368,7 @@ declare const authSchema: {
                 columnType: "SQLiteText";
                 data: string;
                 driverParam: string;
-                notNull: true;
+                notNull: false;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;

package/dist/schema/sqlite.js

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/schema/sqlite.ts
-import { sqliteTable, text, integer, primaryKey, uniqueIndex, index } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text, integer, primaryKey, uniqueIndex, index, check } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 var baseFields = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -21,7 +21,8 @@ var rolesTable = sqliteTable("roles", {
 var usersTable = sqliteTable("users", {
   ...baseFields(8),
   name: text("name"),
-  email: text("email").notNull().unique(),
+  // Nullable, with at least one of email or phone; see schema/pg.ts.
+  email: text("email").unique(),
   emailVerified: integer("email_verified", { mode: "boolean" }).default(false),
   phone: text("phone").unique(),
   phoneVerified: integer("phone_verified", { mode: "boolean" }).default(false),
@@ -33,7 +34,8 @@ var usersTable = sqliteTable("users", {
   failedLoginAttempts: integer("failed_login_attempts").default(0),
   lockoutUntil: text("lockout_until")
 }, (table) => ({
-  roleIdx: index("users_role_id_idx").on(table.roleId)
+  roleIdx: index("users_role_id_idx").on(table.roleId),
+  emailOrPhone: check("users_email_or_phone", sql`${table.email} is not null or ${table.phone} is not null`)
 }));
 var oauthAccountsTable = sqliteTable("oauth_accounts", {
   ...baseFields(10),

package/dist/{types-CI2t8wpJ.d.ts → types-axhOL6D1.d.ts}

@@ -3,7 +3,8 @@
  */
 interface AuthUser {
     id: string;
-    email: string;
+    /** Null for an account reached by phone only. */
+    email: string | null;
     name?: string;
     role?: string | null;
     permissions?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "6.3.1",
+  "version": "6.4.1",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [