nuxt-users 1.48.2 → 1.49.1

package/README.md

@@ -4,11 +4,10 @@
 [![npm downloads](https://img.shields.io/npm/dm/nuxt-users.svg)](https://www.npmjs.com/package/nuxt-users)
 [![License](https://img.shields.io/npm/l/nuxt-users.svg)](https://github.com/rrd108/nuxt-users/blob/main/LICENSE)
 [![ci](https://github.com/rrd108/nuxt-users/actions/workflows/ci.yml/badge.svg)](https://github.com/rrd108/nuxt-users/actions/workflows/ci.yml)
-[![Nuxt 3](https://img.shields.io/badge/Nuxt-3-00DC82.svg?logo=nuxt.js&logoColor=white)](https://nuxt.com)
-[![Nuxt 4](https://img.shields.io/badge/Nuxt-4-00DC82.svg?logo=nuxt.js&logoColor=white)](https://nuxt.com)
+[![Nuxt](https://img.shields.io/badge/Nuxt-00DC82.svg?logo=nuxt.js&logoColor=white)](https://nuxt.com)
 
 
-A user authentication module for Nuxt 3 and Nuxt 4 with database support for SQLite, MySQL, and PostgreSQL.
+A user authentication module for Nuxt with database support for SQLite, MySQL, and PostgreSQL.
 
 ## Features
 
@@ -36,7 +35,7 @@ A user authentication module for Nuxt 3 and Nuxt 4 with database support for SQL
 - ⚡ **Developer Experience**
   - Zero-config setup with sensible defaults
   - TypeScript support throughout
-  - Nuxt 3 & 4 compatibility
+  - Nuxt compatibility
   - Easy customization and extension
 
 ## Agent Skill

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain } from 'citty';
 import { readFileSync } from 'node:fs';
-import { d as defaultOptions } from './shared/nuxt-users.BsNZbqYb.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
 import { defu } from 'defu';
 import { runMigrations, getAppliedMigrations } from '../dist/runtime/server/utils/migrate.js';
 import { createUser as createUser$1 } from '../dist/runtime/server/utils/user.js';

package/dist/module.d.mts

@@ -1,9 +1,9 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { ModuleOptions } from './utils.mjs';
+import { ModuleOptions, RuntimeModuleOptions } from './utils.mjs';
 export * from '../dist/runtime/server/internal/index.js';
 
 declare const defaultOptions: ModuleOptions;
 
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.d.ts

@@ -1,9 +1,9 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { ModuleOptions } from './utils.js';
+import { ModuleOptions, RuntimeModuleOptions } from './utils.js';
 export * from '../dist/runtime/server/internal/index.js';
 
 declare const defaultOptions: ModuleOptions;
 
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.0.0"
   },
-  "version": "1.48.2",
+  "version": "1.49.1",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,6 +1,6 @@
 import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addServerImportsDir, addServerScanDir, addServerHandler, addServerPlugin, addRouteMiddleware, addComponentsDir } from '@nuxt/kit';
 import { defu } from 'defu';
-import { d as defaultOptions } from './shared/nuxt-users.BsNZbqYb.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
 export * from '../dist/runtime/server/internal/index.js';
 
 const module$1 = defineNuxtModule({
@@ -22,12 +22,14 @@ const module$1 = defineNuxtModule({
     }
     const configuredConnector = nuxt.options.runtimeConfig.nuxtUsers?.connector || options.connector;
     runtimeConfigOptions.connector = configuredConnector || defaultOptions.connector;
+    runtimeConfigOptions.auth.allowCustomRoles = runtimeConfigOptions.auth.allowCustomRoles ?? defaultOptions.auth.allowCustomRoles;
     nuxt.options.runtimeConfig.nuxtUsers = {
       ...runtimeConfigOptions,
       auth: {
         tokenExpiration: runtimeConfigOptions.auth.tokenExpiration,
         rememberMeExpiration: runtimeConfigOptions.auth.rememberMeExpiration,
         permissions: runtimeConfigOptions.auth.permissions,
+        allowCustomRoles: runtimeConfigOptions.auth.allowCustomRoles,
         ...runtimeConfigOptions.auth.google && { google: runtimeConfigOptions.auth.google },
         whitelist: (() => {
           const combinedWhitelist = [...defaultOptions.auth?.whitelist || [], ...runtimeConfigOptions.auth?.whitelist || []];
@@ -99,7 +101,8 @@ const module$1 = defineNuxtModule({
           }
           return combinedWhitelist;
         })(),
-        permissions: runtimeConfigOptions.auth?.permissions || defaultOptions.auth.permissions
+        permissions: runtimeConfigOptions.auth?.permissions || defaultOptions.auth.permissions,
+        allowCustomRoles: runtimeConfigOptions.auth.allowCustomRoles
       },
       apiBasePath: runtimeConfigOptions.apiBasePath || defaultOptions.apiBasePath
     };

package/dist/runtime/components/NUsersUserForm.vue

@@ -1,7 +1,10 @@
 <script setup>
 import { ref, computed, watch } from "vue";
+import { getAvailableRoles, MAX_ROLE_LENGTH } from "nuxt-users/utils";
 import { usePasswordValidation } from "../composables/usePasswordValidation";
+import { useNuxtUsersLocale } from "../composables/useNuxtUsersLocale";
 import { useRuntimeConfig } from "#imports";
+const CUSTOM_ROLE_OPTION = "__custom__";
 const props = defineProps({
   user: { type: null, required: false }
 });
@@ -12,19 +15,55 @@ const emptyFormData = {
   role: "user",
   password: ""
 };
-const formData = ref(props.user ?? emptyFormData);
+const formData = ref(props.user ?? { ...emptyFormData });
 const { public: { nuxtUsers } } = useRuntimeConfig();
 const moduleOptions = nuxtUsers;
 const passwordValidation = usePasswordValidation(moduleOptions);
+const { t } = useNuxtUsersLocale();
 const nameError = ref("");
+const roleError = ref("");
+const roleSelectValue = ref("");
 const isEditMode = computed(() => !!props.user);
 const title = computed(() => isEditMode.value ? "Edit User" : "Create User");
 const submitText = computed(() => isEditMode.value ? "Update" : "Create");
+const availableRoles = computed(() => getAvailableRoles(moduleOptions.auth?.permissions));
+const allowCustomRoles = computed(() => moduleOptions.auth?.allowCustomRoles === true);
+const useRoleSelect = computed(() => availableRoles.value.length > 0);
+const roleOptions = computed(() => {
+  const roles = [...availableRoles.value];
+  const currentRole = formData.value.role;
+  if (currentRole && !roles.includes(currentRole) && currentRole !== CUSTOM_ROLE_OPTION) {
+    roles.push(currentRole);
+  }
+  return roles;
+});
+const isCustomRoleSelected = computed(() => roleSelectValue.value === CUSTOM_ROLE_OPTION);
+const syncRoleSelectFromForm = () => {
+  if (!useRoleSelect.value) {
+    roleSelectValue.value = "";
+    return;
+  }
+  const currentRole = formData.value.role || "";
+  if (roleOptions.value.includes(currentRole)) {
+    roleSelectValue.value = currentRole;
+    return;
+  }
+  if (allowCustomRoles.value) {
+    roleSelectValue.value = CUSTOM_ROLE_OPTION;
+    return;
+  }
+  roleSelectValue.value = roleOptions.value[0] || "user";
+  formData.value.role = roleSelectValue.value;
+};
 watch(() => props.user, (newUser) => {
   if (newUser) {
     formData.value = { ...newUser };
   }
-});
+  if (!newUser) {
+    formData.value = { ...emptyFormData };
+  }
+  syncRoleSelectFromForm();
+}, { immediate: true });
 watch(() => formData.value.name, (name) => {
   nameError.value = "";
   if (!name || name.trim().length < 3) {
@@ -39,12 +78,55 @@ watch(() => formData.value.password, (newPassword) => {
     passwordValidation.clearValidation();
   }
 });
+watch(roleSelectValue, (value) => {
+  roleError.value = "";
+  if (!useRoleSelect.value) {
+    return;
+  }
+  if (value === CUSTOM_ROLE_OPTION) {
+    if (!allowCustomRoles.value) {
+      return;
+    }
+    if (roleOptions.value.includes(formData.value.role)) {
+      formData.value.role = "";
+    }
+    return;
+  }
+  formData.value.role = value;
+});
+const validateRole = () => {
+  roleError.value = "";
+  const role = (formData.value.role || "").trim();
+  if (!role) {
+    roleError.value = "Role is required";
+    return false;
+  }
+  if (role.length > MAX_ROLE_LENGTH) {
+    roleError.value = `Role must be at most ${MAX_ROLE_LENGTH} characters`;
+    return false;
+  }
+  if (!useRoleSelect.value) {
+    return true;
+  }
+  if (allowCustomRoles.value && isCustomRoleSelected.value) {
+    return true;
+  }
+  if (roleOptions.value.includes(role)) {
+    return true;
+  }
+  roleError.value = `Invalid role. Allowed roles: ${availableRoles.value.join(", ")}`;
+  return false;
+};
 const handleSubmit = async () => {
   const userData = { ...formData.value };
   if (!userData.name || userData.name.trim().length < 3) {
     console.log("name is too short");
     return;
   }
+  if (!validateRole()) {
+    return;
+  }
+  userData.role = (userData.role || "").trim();
   if (isEditMode.value && !userData.password) {
     delete userData.password;
   }
@@ -67,6 +149,7 @@ const handleSubmit = async () => {
     }
     emit("submit", userData);
     formData.value = { ...emptyFormData };
+    syncRoleSelectFromForm();
   } catch (error) {
     console.error("Failed to save user:", error);
     emit("error", error);
@@ -82,6 +165,7 @@ const handleSubmit = async () => {
       <div class="n-users-form-group">
         <label for="name">Name:</label>
         <input
+          id="name"
           v-model="formData.name"
           name="name"
           type="text"
@@ -100,6 +184,7 @@ const handleSubmit = async () => {
       <div class="n-users-form-group">
         <label for="email">Email:</label>
         <input
+          id="email"
           v-model="formData.email"
           type="email"
           required
@@ -108,10 +193,60 @@ const handleSubmit = async () => {
 
       <div class="n-users-form-group">
         <label for="role">Role:</label>
+
+        <template v-if="useRoleSelect">
+          <select
+            id="role"
+            v-model="roleSelectValue"
+            name="role"
+            required
+            :class="{ error: roleError }"
+          >
+            <option
+              v-for="role in roleOptions"
+              :key="role"
+              :value="role"
+            >
+              {{ role }}
+            </option>
+            <option
+              v-if="allowCustomRoles"
+              :value="CUSTOM_ROLE_OPTION"
+            >
+              {{ t("userForm.customRoleOption") }}
+            </option>
+          </select>
+
+          <input
+            v-if="allowCustomRoles && isCustomRoleSelected"
+            id="custom-role"
+            v-model="formData.role"
+            type="text"
+            name="custom-role"
+            :maxlength="MAX_ROLE_LENGTH"
+            required
+            :placeholder="t('userForm.customRolePlaceholder')"
+            :class="{ error: roleError }"
+          >
+        </template>
+
         <input
+          v-else
+          id="role"
           v-model="formData.role"
           type="text"
+          name="role"
+          :maxlength="MAX_ROLE_LENGTH"
+          required
+          :class="{ error: roleError }"
         >
+
+        <small
+          v-if="roleError"
+          class="n-users-error-text"
+        >
+          {{ roleError }}
+        </small>
       </div>
 
       <div class="n-users-form-group">

package/dist/runtime/composables/useUsers.js

@@ -1,8 +1,8 @@
 import { useState, useRuntimeConfig } from "#imports";
-const usersState = useState("users", () => []);
-const paginationState = useState("users-pagination", () => null);
 export const useUsers = () => {
   const { public: { nuxtUsers } } = useRuntimeConfig();
+  const usersState = useState("users", () => []);
+  const paginationState = useState("users-pagination", () => null);
   const loading = useState("users-loading", () => false);
   const error = useState("users-error", () => null);
   const fetchUsers = async (page = 1, limit = 100) => {

package/dist/runtime/locales/en.js

@@ -148,5 +148,9 @@ export const en = {
     users: "users",
     previous: "Previous",
     next: "Next"
+  },
+  userForm: {
+    customRoleOption: "Custom\u2026",
+    customRolePlaceholder: "Enter custom role"
   }
 };

package/dist/runtime/locales/hu.js

@@ -130,6 +130,9 @@ const huBase = {
     users: "felhaszn\xE1l\xF3",
     previous: "El\u0151z\u0151",
     next: "K\xF6vetkez\u0151"
+  },
+  userForm: {
+    customRoleOption: "Egyedi\u2026"
   }
 };
 const huInformalOverrides = {
@@ -167,6 +170,9 @@ const huInformalOverrides = {
     processingMessage: "K\xE9rj\xFCk, v\xE1rj, am\xEDg feldolgozzuk az e-mail meger\u0151s\xEDt\xE9s\xE9t.",
     successMessage: "Az e-mail c\xEDmed meger\u0151s\xEDt\xE9sre ker\xFClt \xE9s a fi\xF3kod akt\xEDv.",
     errorMessage: "A meger\u0151s\xEDt\u0151 link \xE9rv\xE9nytelen vagy lej\xE1rt. K\xE9rj\xFCk, pr\xF3b\xE1ld \xFAjra regisztr\xE1lni vagy l\xE9pj kapcsolatba az \xFCgyf\xE9lszolg\xE1lattal."
+  },
+  userForm: {
+    customRolePlaceholder: "Add meg az egyedi szerepk\xF6rt"
   }
 };
 const huFormalOverrides = {
@@ -204,6 +210,9 @@ const huFormalOverrides = {
     processingMessage: "K\xE9rj\xFCk, v\xE1rjon, am\xEDg feldolgozzuk az e-mail meger\u0151s\xEDt\xE9s\xE9t.",
     successMessage: "Az e-mail c\xEDme meger\u0151s\xEDt\xE9sre ker\xFClt \xE9s a fi\xF3kja akt\xEDv.",
     errorMessage: "A meger\u0151s\xEDt\u0151 link \xE9rv\xE9nytelen vagy lej\xE1rt. K\xE9rj\xFCk, pr\xF3b\xE1ljon meg \xFAjra regisztr\xE1lni vagy l\xE9pjen kapcsolatba az \xFCgyf\xE9lszolg\xE1lattal."
+  },
+  userForm: {
+    customRolePlaceholder: "Adja meg az egyedi szerepk\xF6rt"
   }
 };
 export const hu = deepMerge(huBase, huInformalOverrides);

package/dist/runtime/server/api/nuxt-users/[id].patch.js

@@ -23,9 +23,11 @@ export default defineEventHandler(async (event) => {
     const updatedUser = await updateUser(userId, body, options);
     return { user: updatedUser };
   } catch (error) {
+    const message = error?.message || "Unknown error";
+    const isClientError = typeof message === "string" && (message.startsWith("Invalid role") || message.startsWith("Role ") || message === "User not found.");
     throw createError({
-      statusCode: 500,
-      statusMessage: `Error updating user: ${error.message}`
+      statusCode: isClientError ? message === "User not found." ? 404 : 400 : 500,
+      statusMessage: `Error updating user: ${message}`
     });
   }
 });

package/dist/runtime/server/api/nuxt-users/index.post.js

@@ -15,13 +15,16 @@ export default defineEventHandler(async (event) => {
     const newUser = await createUser({
       email: body.email,
       name: body.name,
-      password: body.password
+      password: body.password,
+      role: body.role
     }, options);
     return { user: newUser };
   } catch (error) {
+    const message = error?.message || "Unknown error";
+    const isClientError = typeof message === "string" && (message.startsWith("Invalid role") || message.startsWith("Role ") || message.startsWith("Password validation"));
     throw createError({
-      statusCode: 500,
-      statusMessage: `Error creating user: ${error.message}`
+      statusCode: isClientError ? 400 : 500,
+      statusMessage: `Error creating user: ${message}`
     });
   }
 });

package/dist/runtime/server/utils/db.js

@@ -26,7 +26,7 @@ export const getConnector = async (name) => {
       throw new Error(`Database connector "${name}" not found. Please install the required peer dependency:
 - For sqlite: yarn add better-sqlite3
 - For mysql: yarn add mysql2
-- For postgresql: yarn add pg`);
+- For postgresql: yarn add pg`, { cause: error });
     }
     throw error;
   }

package/dist/runtime/server/utils/user.js

@@ -1,6 +1,6 @@
 import { useDb } from "./db.js";
 import bcrypt from "bcrypt";
-import { validatePassword, getPasswordValidationOptions } from "nuxt-users/utils";
+import { validatePassword, getPasswordValidationOptions, assertValidRole } from "nuxt-users/utils";
 export const createUser = async (userData, options) => {
   const db = await useDb(options);
   const usersTable = options.tables.users;
@@ -10,7 +10,10 @@ export const createUser = async (userData, options) => {
     throw new Error(`Password validation failed: ${passwordValidation.errors.join(", ")}`);
   }
   const hashedPassword = await bcrypt.hash(userData.password, 10);
-  const role = userData.role || "user";
+  const role = assertValidRole(userData.role || "user", {
+    permissions: options.auth.permissions,
+    allowCustomRoles: options.auth.allowCustomRoles
+  });
   await db.sql`
     INSERT INTO {${usersTable}} (email, name, password, role, created_at, updated_at)
     VALUES (${userData.email}, ${userData.name}, ${hashedPassword}, ${role}, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
@@ -89,6 +92,12 @@ export const updateUser = async (id, userData, options) => {
     }
     return currentUser;
   }
+  if (userData.role !== void 0) {
+    userData.role = assertValidRole(userData.role, {
+      permissions: options.auth.permissions,
+      allowCustomRoles: options.auth.allowCustomRoles
+    });
+  }
   if (userData.active === false) {
     await revokeUserTokens(id, options);
   }

package/dist/shared/{nuxt-users.bLYb3Bz5.d.mts → nuxt-users.DtwPhils.d.mts}

@@ -140,6 +140,13 @@ interface RuntimeModuleOptions {
          * }
          */
         permissions?: Record<string, (string | Permission)[]>;
+        /**
+         * Allow assigning roles that are not defined in auth.permissions
+         * When false (default), create/update user role must be a key of permissions
+         * (or any role if permissions is empty / not yet configured)
+         * @default false
+         */
+        allowCustomRoles?: boolean;
         /**
          * Google OAuth configuration
          * Enable Google OAuth login/registration
@@ -225,6 +232,11 @@ interface ModuleOptions {
         tokenExpiration: number;
         rememberMeExpiration: number;
         permissions: Record<string, (string | Permission)[]>;
+        /**
+         * Allow assigning roles that are not defined in auth.permissions
+         * @default false
+         */
+        allowCustomRoles: boolean;
         google?: GoogleOAuthOptions;
     };
     passwordValidation: {
@@ -337,4 +349,4 @@ declare const defaultFieldLabels: {
 };
 
 export { defaultDisplayFields as j, defaultFieldLabels as k };
-export type { DatabaseConfig as D, GoogleOAuthOptions as G, LocaleMessages as L, ModuleOptions as M, PasswordResetToken as P, ResetPasswordFormProps as R, User as U, DatabaseType as a, DisplayFieldsProps as b, LocaleOptions as c, LoginFormData as d, LoginFormProps as e, Permission as f, PersonalAccessToken as g, RuntimeModuleOptions as h, UserWithoutPassword as i };
+export type { DatabaseConfig as D, GoogleOAuthOptions as G, LocaleMessages as L, ModuleOptions as M, Permission as P, RuntimeModuleOptions as R, User as U, DatabaseType as a, DisplayFieldsProps as b, LocaleOptions as c, LoginFormData as d, LoginFormProps as e, PasswordResetToken as f, PersonalAccessToken as g, ResetPasswordFormProps as h, UserWithoutPassword as i };

package/dist/shared/{nuxt-users.bLYb3Bz5.d.ts → nuxt-users.DtwPhils.d.ts}

@@ -140,6 +140,13 @@ interface RuntimeModuleOptions {
          * }
          */
         permissions?: Record<string, (string | Permission)[]>;
+        /**
+         * Allow assigning roles that are not defined in auth.permissions
+         * When false (default), create/update user role must be a key of permissions
+         * (or any role if permissions is empty / not yet configured)
+         * @default false
+         */
+        allowCustomRoles?: boolean;
         /**
          * Google OAuth configuration
          * Enable Google OAuth login/registration
@@ -225,6 +232,11 @@ interface ModuleOptions {
         tokenExpiration: number;
         rememberMeExpiration: number;
         permissions: Record<string, (string | Permission)[]>;
+        /**
+         * Allow assigning roles that are not defined in auth.permissions
+         * @default false
+         */
+        allowCustomRoles: boolean;
         google?: GoogleOAuthOptions;
     };
     passwordValidation: {
@@ -337,4 +349,4 @@ declare const defaultFieldLabels: {
 };
 
 export { defaultDisplayFields as j, defaultFieldLabels as k };
-export type { DatabaseConfig as D, GoogleOAuthOptions as G, LocaleMessages as L, ModuleOptions as M, PasswordResetToken as P, ResetPasswordFormProps as R, User as U, DatabaseType as a, DisplayFieldsProps as b, LocaleOptions as c, LoginFormData as d, LoginFormProps as e, Permission as f, PersonalAccessToken as g, RuntimeModuleOptions as h, UserWithoutPassword as i };
+export type { DatabaseConfig as D, GoogleOAuthOptions as G, LocaleMessages as L, ModuleOptions as M, Permission as P, RuntimeModuleOptions as R, User as U, DatabaseType as a, DisplayFieldsProps as b, LocaleOptions as c, LoginFormData as d, LoginFormProps as e, PasswordResetToken as f, PersonalAccessToken as g, ResetPasswordFormProps as h, UserWithoutPassword as i };

package/dist/shared/{nuxt-users.BsNZbqYb.mjs → nuxt-users.KrHIaTTL.mjs}

@@ -30,7 +30,8 @@ const defaultOptions = {
     whitelist: [],
     tokenExpiration: 24 * 60,
     rememberMeExpiration: 30,
-    permissions: {}
+    permissions: {},
+    allowCustomRoles: false
   },
   passwordValidation: {
     minLength: 8,

package/dist/utils.d.mts

@@ -1,7 +1,8 @@
+import { P as Permission } from './shared/nuxt-users.DtwPhils.mjs';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.mjs';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, P as PasswordResetToken, f as Permission, g as PersonalAccessToken, R as ResetPasswordFormProps, h as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.bLYb3Bz5.mjs';
 
 interface PasswordValidationResult {
     isValid: boolean;
@@ -28,5 +29,27 @@ declare const validatePassword: (password: string, options?: PasswordValidationO
 declare const getPasswordStrengthColor: (strength: "weak" | "medium" | "strong") => string;
 declare const getPasswordStrengthText: (strength: "weak" | "medium" | "strong") => string;
 
-export { getPasswordStrengthColor, getPasswordStrengthText, getPasswordValidationOptions, validatePassword };
-export type { PasswordValidationOptions, PasswordValidationResult };
+declare const MAX_ROLE_LENGTH = 32;
+type RoleValidationOptions = {
+    permissions?: Record<string, (string | Permission)[]>;
+    allowCustomRoles?: boolean;
+};
+/**
+ * Returns role names defined in auth.permissions (the predefined role catalog).
+ */
+declare const getAvailableRoles: (permissions?: Record<string, (string | Permission)[]>) => string[];
+/**
+ * Validates a role against permissions and allowCustomRoles.
+ * - Empty permissions: any non-empty role is allowed (bootstrap before RBAC is configured)
+ * - allowCustomRoles true: any non-empty role is allowed
+ * - otherwise: role must be a key of permissions
+ */
+declare const isValidRole: (role: string | undefined | null, options?: RoleValidationOptions) => boolean;
+/**
+ * Asserts role is valid or throws with a clear error message.
+ * Returns the trimmed role string.
+ */
+declare const assertValidRole: (role: string | undefined | null, options?: RoleValidationOptions) => string;
+
+export { MAX_ROLE_LENGTH, Permission, assertValidRole, getAvailableRoles, getPasswordStrengthColor, getPasswordStrengthText, getPasswordValidationOptions, isValidRole, validatePassword };
+export type { PasswordValidationOptions, PasswordValidationResult, RoleValidationOptions };

package/dist/utils.d.ts

@@ -1,7 +1,8 @@
+import { P as Permission } from './shared/nuxt-users.DtwPhils.js';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.js';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, P as PasswordResetToken, f as Permission, g as PersonalAccessToken, R as ResetPasswordFormProps, h as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.bLYb3Bz5.js';
 
 interface PasswordValidationResult {
     isValid: boolean;
@@ -28,5 +29,27 @@ declare const validatePassword: (password: string, options?: PasswordValidationO
 declare const getPasswordStrengthColor: (strength: "weak" | "medium" | "strong") => string;
 declare const getPasswordStrengthText: (strength: "weak" | "medium" | "strong") => string;
 
-export { getPasswordStrengthColor, getPasswordStrengthText, getPasswordValidationOptions, validatePassword };
-export type { PasswordValidationOptions, PasswordValidationResult };
+declare const MAX_ROLE_LENGTH = 32;
+type RoleValidationOptions = {
+    permissions?: Record<string, (string | Permission)[]>;
+    allowCustomRoles?: boolean;
+};
+/**
+ * Returns role names defined in auth.permissions (the predefined role catalog).
+ */
+declare const getAvailableRoles: (permissions?: Record<string, (string | Permission)[]>) => string[];
+/**
+ * Validates a role against permissions and allowCustomRoles.
+ * - Empty permissions: any non-empty role is allowed (bootstrap before RBAC is configured)
+ * - allowCustomRoles true: any non-empty role is allowed
+ * - otherwise: role must be a key of permissions
+ */
+declare const isValidRole: (role: string | undefined | null, options?: RoleValidationOptions) => boolean;
+/**
+ * Asserts role is valid or throws with a clear error message.
+ * Returns the trimmed role string.
+ */
+declare const assertValidRole: (role: string | undefined | null, options?: RoleValidationOptions) => string;
+
+export { MAX_ROLE_LENGTH, Permission, assertValidRole, getAvailableRoles, getPasswordStrengthColor, getPasswordStrengthText, getPasswordValidationOptions, isValidRole, validatePassword };
+export type { PasswordValidationOptions, PasswordValidationResult, RoleValidationOptions };

package/dist/utils.mjs

@@ -3,6 +3,53 @@ export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';
 
+const MAX_ROLE_LENGTH = 32;
+const getAvailableRoles = (permissions) => {
+  if (!permissions) {
+    return [];
+  }
+  return Object.keys(permissions);
+};
+const isValidRole = (role, options = {}) => {
+  if (role === void 0 || role === null) {
+    return false;
+  }
+  const trimmed = typeof role === "string" ? role.trim() : "";
+  if (!trimmed) {
+    return false;
+  }
+  if (trimmed.length > MAX_ROLE_LENGTH) {
+    return false;
+  }
+  if (options.allowCustomRoles) {
+    return true;
+  }
+  const availableRoles = getAvailableRoles(options.permissions);
+  if (availableRoles.length === 0) {
+    return true;
+  }
+  return availableRoles.includes(trimmed);
+};
+const assertValidRole = (role, options = {}) => {
+  if (role === void 0 || role === null || typeof role !== "string") {
+    throw new Error("Role is required");
+  }
+  const trimmed = role.trim();
+  if (!trimmed) {
+    throw new Error("Role is required");
+  }
+  if (trimmed.length > MAX_ROLE_LENGTH) {
+    throw new Error(`Role must be at most ${MAX_ROLE_LENGTH} characters`);
+  }
+  if (isValidRole(trimmed, options)) {
+    return trimmed;
+  }
+  const availableRoles = getAvailableRoles(options.permissions);
+  throw new Error(
+    `Invalid role "${trimmed}". Allowed roles: ${availableRoles.join(", ")}`
+  );
+};
+
 const defaultDisplayFields = ["id", "name", "email", "role", "active", "created_at", "updated_at", "last_login_at"];
 const defaultFieldLabels = {
   id: "ID",
@@ -15,4 +62,4 @@ const defaultFieldLabels = {
   last_login_at: "Last Login"
 };
 
-export { defaultDisplayFields, defaultFieldLabels };
+export { MAX_ROLE_LENGTH, assertValidRole, defaultDisplayFields, defaultFieldLabels, getAvailableRoles, isValidRole };

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "nuxt-users",
-  "version": "1.48.2",
-  "description": "A comprehensive user management module for Nuxt 3 and Nuxt 4 applications with authentication, authorization, database support, and CLI tools",
+  "version": "1.49.1",
+  "description": "A comprehensive user management module for Nuxt applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
-    "nuxt3",
     "nuxt-module",
     "users",
     "authentication",
@@ -83,7 +82,7 @@
     "test:postgresql": "./scripts/test-postgresql.sh",
     "test:nuxt3": "./scripts/test-nuxt3.sh unit && ./scripts/test-nuxt3.sh integration && ./scripts/test-nuxt3.sh sqlite && ./scripts/test-nuxt3.sh mysql && ./scripts/test-nuxt3.sh postgresql",
     "test:nuxt4": "yarn test:types && yarn test:unit && yarn test:integration && yarn test:sqlite && yarn test:mysql && yarn test:postgresql",
-    "test": "yarn lint && yarn test:nuxt3 && yarn test:nuxt4",
+    "test": "yarn lint && yarn test:nuxt4",
     "test:watch": "vitest watch",
     "db:create-users-table": "tsx src/cli/create-users-table.ts",
     "db:create-user": "tsx src/cli/create-user.ts",
@@ -100,7 +99,7 @@
   "dependencies": {
     "bcrypt": "^6.0.0",
     "citty": "^0.2.0",
-    "db0": "^0.3.4",
+    "db0": "^0.4.0",
     "defu": "^6.1.4",
     "google-auth-library": "^10.4.0",
     "nodemailer": "^7.0.5"
@@ -144,5 +143,8 @@
     "vitepress": "^1.6.3",
     "vitest": "^4.0.0",
     "vue-tsc": "^3.0.1"
+  },
+  "resolutions": {
+    "entities": "^7.0.0"
   }
 }