nucleus-core-ts 0.9.702 → 0.9.704

package/dist/src/Client/Proxy/wsProxy.js

@@ -25,23 +25,36 @@ export function createWsProxyHandler(config) {
             url = `${url}?${queryString}`;
         }
         if (target.injectTokenFromCookie) {
-            let token = cookies[target.injectTokenFromCookie.cookieName];
-            let tokenSource = target.injectTokenFromCookie.cookieName;
-            if (!token && target.injectTokenFromCookie.fallbackCookieNames) {
-                for (const fallback of target.injectTokenFromCookie.fallbackCookieNames){
-                    if (cookies[fallback]) {
-                        token = cookies[fallback];
-                        tokenSource = `${fallback} (fallback)`;
-                        break;
+            const paramName = target.injectTokenFromCookie.queryParam ?? 'token';
+            // PRECEDENCE: respect a token the client already supplied in the URL.
+            // The frontend fetches/refreshes a FRESH access_token server-side and puts
+            // it in `?token=`. The browser ALSO auto-sends the spanning HttpOnly
+            // `access_token` COOKIE on the WS handshake — but on a sibling subdomain
+            // (e.g. acta./ace.) that cookie is STALE/expired (only www activity
+            // refreshes it), and a fallback `session_token` isn't a valid bearer for
+            // the backend. Injecting the cookie therefore OVERRODE the fresh client
+            // token → backend closed the WS with "Not authenticated". Only inject from
+            // the cookie when the client supplied no token.
+            if (query.get(paramName)) {
+                logger.info(`[WS:auth] Using client-supplied ${paramName} for ${path}`);
+            } else {
+                let token = cookies[target.injectTokenFromCookie.cookieName];
+                let tokenSource = target.injectTokenFromCookie.cookieName;
+                if (!token && target.injectTokenFromCookie.fallbackCookieNames) {
+                    for (const fallback of target.injectTokenFromCookie.fallbackCookieNames){
+                        if (cookies[fallback]) {
+                            token = cookies[fallback];
+                            tokenSource = `${fallback} (fallback)`;
+                            break;
+                        }
                     }
                 }
-            }
-            if (token) {
-                const paramName = target.injectTokenFromCookie.queryParam ?? 'token';
-                url = addQueryParam(url, paramName, token);
-                logger.info(`[WS:auth] Token injected from ${tokenSource} for ${path}`);
-            } else {
-                logger.warn(`[WS:auth] No token found for ${path} — tried: ${target.injectTokenFromCookie.cookieName}${target.injectTokenFromCookie.fallbackCookieNames ? `, ${target.injectTokenFromCookie.fallbackCookieNames.join(', ')}` : ''}`);
+                if (token) {
+                    url = addQueryParam(url, paramName, token);
+                    logger.info(`[WS:auth] Token injected from ${tokenSource} for ${path}`);
+                } else {
+                    logger.warn(`[WS:auth] No token found for ${path} — tried: ${target.injectTokenFromCookie.cookieName}${target.injectTokenFromCookie.fallbackCookieNames ? `, ${target.injectTokenFromCookie.fallbackCookieNames.join(', ')}` : ''}`);
+                }
             }
         }
         return url;

package/dist/src/ElysiaPlugin/routes/auth/register/types.d.ts

@@ -2,6 +2,9 @@ export declare const RegisterBodySchema: import("@sinclair/typebox").TObject<{
     email: import("@sinclair/typebox").TString;
     password: import("@sinclair/typebox").TString;
     confirmPassword: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    firstName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    lastName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    createProfile: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export declare const RegisterResponseSchema: import("@sinclair/typebox").TObject<{
     success: import("@sinclair/typebox").TBoolean;

package/dist/src/ElysiaPlugin/routes/auth/types.d.ts

@@ -114,6 +114,11 @@ export interface RegisterConfig {
     isPublic: boolean;
     enabled: boolean;
     emailVerification?: EmailVerificationConfig;
+    /** Show first/last name fields on the register form (FE) — informational here. */
+    showFirstName?: boolean;
+    showLastName?: boolean;
+    /** Persist a profile row (firstName/lastName) when a user self-registers. */
+    createProfileOnRegister?: boolean;
 }
 export interface LogoutConfig {
     route?: string;

package/dist/src/Services/Authorization/Middleware/index.d.ts

@@ -1,6 +1,7 @@
+import { type SQL } from 'drizzle-orm';
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import type { Logger } from '../../Logger';
-import { type AuthorizationCheckResult, type HttpMethod, type ParsedScope, type ResolvedScope } from '../types';
+import { type AuthorizationCheckResult, type HttpMethod, type ParsedScope, type ParsedScopeWithSelf, type ResolvedScope } from '../types';
 interface CheckAuthorizationParams {
     userId: string;
     method: HttpMethod;
@@ -26,6 +27,22 @@ interface CheckAuthorizationParams {
     requireClaimSpecificity?: boolean;
 }
 export declare function parseScope(scope: string | null): ParsedScope;
+/**
+ * Resolves a parsed scope's `self:<field>` refs against the caller's user row.
+ *
+ * SECURITY (fail-closed): a `self:` ref that CANNOT be resolved — because the
+ * user row is missing (getUserData returned undefined / threw) or the named
+ * field is absent from it — must NOT be silently dropped. Dropping it would
+ * leave the scope key out of `scopeFilters` entirely, and downstream a by-id
+ * GET/PATCH/DELETE would then run UNSCOPED — i.e. touch ANY row by id (IDOR).
+ * Such keys are reported in `unresolved` so the caller can DENY the request.
+ * Static (non-`self:`) scope values always resolve and are never reported.
+ * Exported for unit tests.
+ */
+export declare function resolveScopeWithSelf(parsedScope: ParsedScopeWithSelf, userData: Record<string, unknown> | undefined, logger: Logger): {
+    resolved: ResolvedScope;
+    unresolved: string[];
+};
 /**
  * Claim patterns are dot-separated `method.entity[.field | .with.relation]`. A
  * shorter claim is a prefix grant of longer patterns (`get.users` grants
@@ -60,5 +77,29 @@ interface CheckAuthorizationViaIDPParams {
 export declare function checkAuthorizationViaIDP(params: CheckAuthorizationViaIDPParams): Promise<AuthorizationCheckResult>;
 export declare function filterResponseFields<T extends Record<string, unknown>>(data: T | T[], allowedFields?: string[]): Partial<T> | Partial<T>[];
 export declare function filterResponseRelations<T extends Record<string, unknown>>(data: T | T[], allowedRelations?: string[]): T | T[];
+export interface ScopeConditions {
+    /** WHERE predicates to AND onto the query (one per scope entry). */
+    conditions: SQL[];
+    /**
+     * Scope fields that did NOT resolve to a column on the target entity. A
+     * non-empty list means at least one always-false predicate was emitted so
+     * the query fails closed; callers should log this loudly — it signals a
+     * misconfigured or stale scope.
+     */
+    unresolvedFields: string[];
+}
+/**
+ * Translate resolved scope filters into Drizzle WHERE predicates, FAILING
+ * CLOSED on any scope field whose column is absent from the target entity.
+ *
+ * SECURITY: a scope like `created_by=self:id` restricts a query to rows the
+ * caller owns. If the named column does not exist on the entity (a renamed or
+ * removed column, or a typo'd / stale scope), silently dropping the predicate
+ * would run the query UNSCOPED — returning every row across tenants (read) or
+ * letting a scoped write touch any row (IDOR). Instead we emit an always-false
+ * predicate so the query matches ZERO rows, and report the offending field so
+ * the caller can log/deny. An unenforceable scope is NEVER dropped.
+ */
+export declare function buildScopeConditions(scopeFilters: Record<string, unknown> | undefined, resolveColumn: (field: string) => unknown): ScopeConditions;
 export declare function applyScopeFilters(scopeFilters: ResolvedScope | undefined): Record<string, unknown> | undefined;
 export {};

package/dist/src/Services/Authorization/Middleware/scopeFailClosed.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/Services/Authorization/Middleware/scopeSelfFailClosed.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/Services/Authorization/SeedRunner/index.d.ts

@@ -24,6 +24,8 @@ type SeedResult = {
     claimsExisting: number;
     assignmentsCreated: number;
     assignmentsExisting: number;
+    /** Existing assignments whose scope drifted from config and was reconciled. */
+    assignmentsUpdated: number;
 };
 /**
  * Seeds custom roles, claims, and role-claim assignments from config.

package/dist/src/Services/Authorization/SeedRunner/scopeReconcile.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "nucleus-core-ts",
-  "version": "0.9.702",
+  "version": "0.9.704",
   "description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
-  "author": "Hidayet Can \u00d6zcan <hidayetcan@gmail.com>",
+  "author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
   "license": "SEE LICENSE IN LICENSE",
   "keywords": [
     "backend",