taleem-kernel 1.0.1 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taleem-kernel",
-  "version": "1.0.1",
+  "version": "1.3.0",
   "description": "Taleem data and business-logic kernel. HTTP is only an adapter.",
   "type": "module",
   "main": "./src/ServerKernel.js",
@@ -11,7 +11,7 @@
     "taleem-kernel": "./bin/cli.js"
   },
   "scripts": {
-    "test": "vitest run"
+    "test": "vitest run --no-file-parallelism"
   },
   "files": [
     "src",

package/prisma/migrations/20260824120405_add_group_model/migration.sql

@@ -0,0 +1,39 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `groupings` on the `Course` table. All the data in the column will be lost.
+
+*/
+-- CreateTable
+CREATE TABLE "Group" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "courseSlug" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "thumbnail" TEXT,
+    "items" JSONB NOT NULL
+);
+
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_Course" (
+    "slug" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "description" TEXT,
+    "thumbnail" TEXT,
+    "access" TEXT NOT NULL DEFAULT 'OPEN',
+    "price" INTEGER NOT NULL DEFAULT 0
+);
+INSERT INTO "new_Course" ("access", "description", "price", "slug", "thumbnail", "title") SELECT "access", "description", "price", "slug", "thumbnail", "title" FROM "Course";
+DROP TABLE "Course";
+ALTER TABLE "new_Course" RENAME TO "Course";
+CREATE UNIQUE INDEX "Course_slug_key" ON "Course"("slug");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;
+
+-- CreateIndex
+CREATE INDEX "Group_courseSlug_idx" ON "Group"("courseSlug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Group_courseSlug_slug_key" ON "Group"("courseSlug", "slug");

package/prisma/migrations/20260824182316_add_library_status/migration.sql

@@ -0,0 +1,24 @@
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_Library" (
+    "slug" TEXT NOT NULL PRIMARY KEY,
+    "title" TEXT NOT NULL,
+    "description" TEXT,
+    "thumbnail" TEXT,
+    "type" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'DRAFT',
+    "body" TEXT,
+    "courseSlug" TEXT NOT NULL,
+    "groupSlug" TEXT NOT NULL,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "allowCommunication" BOOLEAN NOT NULL DEFAULT true,
+    "meta" TEXT,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+INSERT INTO "new_Library" ("allowCommunication", "body", "courseSlug", "createdAt", "description", "groupSlug", "meta", "slug", "sortOrder", "thumbnail", "title", "type", "updatedAt") SELECT "allowCommunication", "body", "courseSlug", "createdAt", "description", "groupSlug", "meta", "slug", "sortOrder", "thumbnail", "title", "type", "updatedAt" FROM "Library";
+DROP TABLE "Library";
+ALTER TABLE "new_Library" RENAME TO "Library";
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/prisma/schema.prisma

@@ -13,6 +13,12 @@ enum ContentType {
   MCQ
 }
 
+enum LibraryStatus {
+  DRAFT
+  PUBLISHED
+  ARCHIVED
+}
+
 enum CourseAccess {
   OPEN
   MEMBERS
@@ -24,6 +30,18 @@ enum AdminRole {
   SUPER_ADMIN
 }
 
+model Group {
+  id         Int     @id @default(autoincrement())
+  courseSlug String
+  slug       String
+  title      String
+  thumbnail  String?
+  items      Json
+
+  @@unique([courseSlug, slug])
+  @@index([courseSlug])
+}
+
 model Course {
   slug        String       @unique
   title       String
@@ -31,19 +49,18 @@ model Course {
   thumbnail   String?
   access      CourseAccess @default(OPEN)
   price       Int          @default(0)
-  groupings   String       @default("[]")
 }
 
 model User {
-  id              Int              @id @default(autoincrement())
-  email           String           @unique
-  password        String
-  name            String?
-  role            String           @default("student")
-  resource        String?
-  createdAt       DateTime         @default(now())
-  subscriptions   Subscription[]
-  communications  Communication[]
+  id             Int             @id @default(autoincrement())
+  email          String          @unique
+  password       String
+  name           String?
+  role           String          @default("student")
+  resource       String?
+  createdAt      DateTime        @default(now())
+  subscriptions  Subscription[]
+  communications Communication[]
 }
 
 model Admin {
@@ -58,19 +75,20 @@ model Admin {
 }
 
 model Library {
-  slug               String      @id
+  slug               String        @id
   title              String
   description        String?
   thumbnail          String?
   type               ContentType
+  status             LibraryStatus @default(DRAFT)
   body               String?
   courseSlug         String
   groupSlug          String
-  sortOrder          Int         @default(0)
-  allowCommunication Boolean     @default(true)
+  sortOrder          Int           @default(0)
+  allowCommunication Boolean       @default(true)
   meta               String?
-  createdAt          DateTime    @default(now())
-  updatedAt          DateTime    @updatedAt
+  createdAt          DateTime      @default(now())
+  updatedAt          DateTime      @updatedAt
 }
 
 model Subscription {
@@ -99,50 +117,46 @@ model Communication {
   readAt         DateTime?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
-  user           User     @relation(fields: [userId], references: [id])
+  user           User      @relation(fields: [userId], references: [id])
 
   @@index([userId])
   @@index([librarySlug])
 }
-model Svg {
 
-  slug      String   @id
+model Svg {
+  slug String @id
 
-  title     String
+  title String
 
-  body      String
+  body String
 
-  tags      String   @default("[]")
+  tags String @default("[]")
 
   createdAt DateTime @default(now())
 
   updatedAt DateTime @updatedAt
-
 }
 
 model Image {
+  slug String @id
 
-  slug      String   @id
-
-  title     String
+  title String
 
-  tags      String   @default("[]")
+  tags String @default("[]")
 
   createdAt DateTime @default(now())
 
   updatedAt DateTime @updatedAt
-
 }
-model Audio  {
 
-  slug      String   @id
+model Audio {
+  slug String @id
 
-  title     String
+  title String
 
-  tags      String   @default("[]")
+  tags String @default("[]")
 
   createdAt DateTime @default(now())
 
   updatedAt DateTime @updatedAt
-
-}
+}

package/readme.md

@@ -1,97 +1,505 @@
-## Taleem Kernel API
+
+
+# Taleem Kernel API
 
 ```js
 import kernel from "taleem-kernel";
-```
+````
+
+`taleem-kernel` is the shared DB/domain layer for Taleem applications.
 
-`taleem-kernel` is the shared DB/domain layer for Taleem applications. It provides Prisma/SQLite access and Taleem-specific modules.
+It owns the canonical Taleem Prisma/SQLite schema and provides the domain modules used by Taleem Server, Taleem Studio, and other Taleem applications.
 
-### Core
+The kernel is intentionally small: modules expose operations that make sense for Taleem rather than blindly exposing Prisma CRUD.
+
+---
+
+## Core
 
 ```js
-kernel.db              // Prisma client
-kernel.config          // configuration
-kernel.auth            // authentication/JWT
+kernel.db
+
+kernel.config
+
+kernel.jwt
+
 kernel.communicationPolicy
+
 kernel.shutdown()
 ```
 
-### Modules
+`kernel.jwt` is the low-level JWT utility used by the User and Admin modules.
+
+Applications normally should not create or verify application identity tokens directly through `kernel.jwt`. Instead, use the authentication methods on the appropriate domain module.
+
+---
+
+## Modules
 
 ```js
 kernel.user
+
 kernel.admin
+
 kernel.course
+
 kernel.library
+
 kernel.communication
+
 kernel.subscription
+
 kernel.svg
+
 kernel.image
+
 kernel.audio
 ```
 
-Each module provides simple DB/domain operations such as:
+---
+
+## User
+
+Users are the normal Taleem application users.
+
+User registration and authentication are owned directly by the User module.
+
+### User API
 
 ```js
-list()
-get(...)
-create(data)
-update(id, data)
-delete(id)
+kernel.user.list()
+
+kernel.user.get(id)
+
+kernel.user.getByEmail(email)
+
+kernel.user.emailToId(email)
+
+kernel.user.register(data)
+
+kernel.user.login(email, password)
+
+kernel.user.createToken(user)
+
+kernel.user.authenticate(token)
+
+kernel.user.update(id, data)
+
+kernel.user.delete(id)
 ```
 
-with additional module-specific methods such as:
+Registration creates a User and hashes the supplied password:
 
 ```js
-kernel.user.login()
-kernel.user.register()
-kernel.admin.isAdmin()
-kernel.library.listByCourse()
-kernel.communication.listUnanswered()
-kernel.communication.countUserOpenQuestions()
+const user = await kernel.user.register({
+  email: "student@example.com",
+  password: "12345678"
+});
 ```
 
-### Schema
+Login returns a User JWT:
 
-The kernel owns the **canonical Taleem Prisma/SQLite schema**. Applications using Taleem DB should use the kernel rather than maintaining their own DB layer.
+```js
+const token = await kernel.user.login(
+  "student@example.com",
+  "12345678"
+);
+```
+
+The token can then be authenticated:
+
+```js
+const user = await kernel.user.authenticate(token);
+```
+
+User authentication accepts only tokens with:
+
+```js
+{
+  type: "user"
+}
+```
+
+The User module creates its own tokens using the kernel JWT utility.
+
+---
+
+## Admin
+
+Admins are independent of Course structure.
+
+An Admin may be assigned one or more course slugs through `courseSlugs`.
+
+Admin accounts are provisioned separately from normal User registration.
+
+### Admin API
+
+```js
+kernel.admin.list()
+
+kernel.admin.get(email)
+
+kernel.admin.login(email, password)
+
+kernel.admin.createToken(admin)
+
+kernel.admin.authenticate(token)
+
+kernel.admin.create(data)
+
+kernel.admin.update(email, data)
+
+kernel.admin.delete(email)
+
+kernel.admin.isAdmin(email, courseSlug)
+```
+
+Admin login returns an Admin JWT:
+
+```js
+const token = await kernel.admin.login(
+  "admin@example.com",
+  "12345678"
+);
+```
+
+The token can then be authenticated:
+
+```js
+const admin = await kernel.admin.authenticate(token);
+```
+
+Admin authentication accepts only tokens with:
+
+```js
+{
+  type: "admin"
+}
+```
+
+Admin authorization is handled separately:
+
+```js
+const allowed = await kernel.admin.isAdmin(
+  admin.email,
+  courseSlug
+);
+```
+
+Authentication and authorization are separate concerns.
+
+An authenticated Admin is not automatically authorized for every Course.
+
+---
+
+## JWT
+
+JWT is the low-level token utility used by the User and Admin modules.
+
+```js
+kernel.jwt.sign(payload)
+
+kernel.jwt.verify(token)
+```
+
+User and Admin own their respective identity tokens.
+
+Applications should normally use:
+
+```js
+kernel.user.login(...)
+kernel.user.authenticate(...)
+
+kernel.admin.login(...)
+kernel.admin.authenticate(...)
+```
+
+rather than calling `kernel.jwt` directly.
+
+The important architectural rule is:
+
+```text
+JWT
+ ↓
+ ├── User
+ │    ├── login()
+ │    ├── createToken()
+ │    └── authenticate()
+ │
+ └── Admin
+      ├── login()
+      ├── createToken()
+      └── authenticate()
+```
+
+There is no shared identity/authentication module routing between User and Admin.
+
+---
+
+## Course
+
+Course is **not a CRUD entity**.
+
+A Course originates as a static course artifact (`course.json`). The artifact is the source of truth and is materialized into the database by the kernel.
+
+Internally, a Course is represented by two tables:
+
+```text
+Course
+  |
+  +-- Group
+       |
+       +-- items[]  // library slugs
+```
+
+There are intentionally no Prisma relationships between Course, Group, and Library. Their relationship is maintained through Taleem slugs.
+
+### Course API
 
 ```js
-kernel.auth.authenticate(token)
-kernel.user.login(email, password)
 kernel.course.list()
+
+kernel.course.get(courseSlug)
+
+kernel.course.getGroups(courseSlug)
+
+kernel.course.getGroup(courseSlug, groupSlug)
+
+kernel.course.getGroupItems(courseSlug, groupSlug)
+
+kernel.course.seed(course)
+
+kernel.course.wipe()
+```
+
+`seed()` materializes a complete course artifact:
+
+```js
+await kernel.course.seed(course);
+```
+
+`wipe()` removes the materialized Course and Group data before rebuilding from the source artifacts:
+
+```js
+await kernel.course.wipe();
+```
+
+There are deliberately no:
+
+```js
+course.create()
+
+course.update()
+
+course.delete()
+```
+
+because a Course is an artifact, not an independently edited CRUD record.
+
+---
+
+## Library
+
+Library contains the actual authored Taleem content.
+
+Library items belong logically to a Course and Group through string slugs:
+
+```text
+Library.courseSlug → Course.slug
+
+Library.groupSlug  → Group.slug
+
+Library.slug       → Group.items[]
+```
+
+These are application-level relationships, not Prisma foreign keys.
+
+### Library API
+
+```js
+kernel.library.list()
+
+kernel.library.listByCourse(courseSlug)
+
+kernel.library.listByGroup(courseSlug, groupSlug)
+
 kernel.library.get(slug)
-kernel.svg.get(slug)
+
+kernel.library.create(data)
+
+kernel.library.update(slug, data)
+
+kernel.library.delete(slug)
+```
+
+Filtering:
+
+```js
+kernel.library.list({
+  type,
+  courseSlug,
+  groupSlug
+});
+```
+
+`list()` returns the library metadata needed by applications without requiring the full content body.
+
+Library items also have a lifecycle status:
+
+```text
+DRAFT
+PUBLISHED
+ARCHIVED
+```
+
+The default status for a new Library item is:
+
+```text
+DRAFT
+```
+
+---
+
+## Assets
+
+SVG, Image, and Audio are independent reusable assets.
+
+They are not tied to Courses, Groups, or Library records at the database level.
+
+Their metadata is intentionally small:
+
+```text
+slug
+
+title
+
+tags
+```
+
+Assets can be discovered through tags and referenced by content where appropriate.
+
+```js
+kernel.svg
+
+kernel.image
+
+kernel.audio
+```
+
+These modules provide the normal asset operations such as:
+
+```js
+list()
+
+get()
+
+create()
+
+update()
+
+delete()
 ```
 
-`kernel.shutdown()` disconnects Prisma when the application exits.
+---
+
+## Schema
+
+The kernel owns the **canonical Taleem Prisma/SQLite schema**.
+
+Applications using the Taleem database should use the kernel rather than maintaining their own DB/domain layer.
+
+The important architectural rule is:
+
+```text
+Kernel
+
+  ↓
+
+Canonical schema + Taleem domain operations
+
+  ↓
+
+Applications
+```
+
+Applications should not bypass the kernel for normal Taleem DB operations.
+
+---
 
 ## Schema Management
 
-The kernel provides two CLI commands for maintaining schema compatibility:
+The kernel provides CLI commands for maintaining schema compatibility:
 
 ```bash
 npx taleem-kernel schema-check
+
 npx taleem-kernel schema-update
 ```
 
-`schema-check` compares the application's `prisma/schema.prisma` with the canonical schema shipped with `taleem-kernel`.
+`schema-check` compares the application's Prisma schema with the canonical schema shipped with `taleem-kernel`.
 
-`schema-update` copies the kernel's canonical schema into the application's `prisma/schema.prisma`.
+`schema-update` copies the kernel's canonical schema into the application's Prisma schema.
 
 After updating the schema, run the application's normal Prisma migration/generation process as required.
 
+---
+
 ## Server Dependencies
 
 `taleem-server` should use `taleem-kernel` for all Taleem database access.
 
-The server provides the HTTP/API layer on top of the kernel:
+The server provides the HTTP/API layer on top of the kernel.
 
-```text
-    "@prisma/client": "^6.19.3",
-    "bcrypt": "^6.0.0",
-    "dotenv": "^17.4.2",
-    "jsonwebtoken": "^9.0.3",
-    "zod": "^4.4.3"
+The server should **not maintain its own Taleem Prisma models or duplicate DB modules**.
+
+Authentication at the server layer should use the appropriate Kernel identity module:
+
+```js
+const user = await kernel.user.authenticate(token);
 ```
 
-The server should **not maintain its own Taleem Prisma models or DB modules**.
+or:
+
+```js
+const admin = await kernel.admin.authenticate(token);
+```
+
+Course-level Admin authorization can then be checked separately:
+
+```js
+const allowed = await kernel.admin.isAdmin(
+  admin.email,
+  courseSlug
+);
+```
+
+---
+
+## Design Principles
+
+The kernel follows a few important Taleem-specific rules:
+
+1. **Course artifacts are the source of truth.**
+
+2. **Course is not generic CRUD.** It is materialized from the course artifact.
+
+3. **Course and Group are internally separate tables but one domain concept.**
+
+4. **Course, Group, and Library are connected by slugs, not Prisma relationships.**
+
+5. **Relational integrity is enforced by the Taleem build/application layer.**
+
+6. **Library contains authored content; Course defines the expected structure and item slugs.**
+
+7. **Library content has an explicit lifecycle: DRAFT, PUBLISHED, and ARCHIVED.**
+
+8. **SVG, Image, and Audio are independent reusable assets.**
+
+9. **User and Admin authentication are separate domain concerns.**
+
+10. **JWT is a low-level utility; User and Admin own their identity token lifecycle.**
+
+11. **The kernel exposes domain operations only where they represent real Taleem behavior.**
+
+The goal is a small, stable kernel that owns the Taleem contract without pretending to be a generic CRUD framework.
+

package/src/ServerKernel.js

@@ -2,7 +2,7 @@
 
 import { PrismaClient } from "@prisma/client";
 import Config from "./Config.js";
-import Auth from "./Auth.js";
+// import Auth from "./Auth.js";
 import CommunicationPolicy from "./CommunicationPolicy.js";
 import User from "./modules/User.js";
 import Admin from "./modules/Admin.js";
@@ -18,7 +18,7 @@ class ServerKernel {
 	constructor() {
 		this.config = new Config();
 		this.db = new PrismaClient();
-		this.auth = new Auth(this);
+		// this.auth = new Auth(this);
 		this.communicationPolicy = new CommunicationPolicy(this);
 		this.user = new User(this);
 		this.admin = new Admin(this);

package/src/modules/Admin.js

@@ -1,9 +1,13 @@
-// src/serverKernel/modules/Admin.js
+// /home/bilal-tariq/00--TALEEM/taleem-kernel/src/modules/Admin.js
 
 import bcrypt from "bcrypt";
+import JWT from "../utils/JWT.js";
 
 export default class Admin {
-	constructor(kernel) { this.kernel = kernel; }
+	constructor(kernel) {
+		this.kernel = kernel;
+		this.jwt = new JWT(kernel);
+	}
 
 	async list(filters = {}) {
 		const where = {};
@@ -15,37 +19,95 @@ export default class Admin {
 		return this.kernel.db.admin.findUnique({ where: { email } });
 	}
 
+	// Authentication
+
 	async login(email, password) {
 		const admin = await this.get(email);
-		if (!admin) throw new Error(`Admin.login(): Admin '${email}' not found.`);
-		if (!admin.isActive) throw new Error(`Admin.login(): Admin '${email}' is inactive.`);
+
+		if (!admin) {
+			throw new Error(`Admin.login(): Admin '${email}' not found.`);
+		}
+
+		if (!admin.isActive) {
+			throw new Error(`Admin.login(): Admin '${email}' is inactive.`);
+		}
 
 		const ok = await bcrypt.compare(password, admin.password);
-		if (!ok) throw new Error(`Admin.login(): Invalid password.`);
 
-		return this.kernel.auth.createAdminToken(admin);
+		if (!ok) {
+			throw new Error(`Admin.login(): Invalid password.`);
+		}
+
+		return this.createToken(admin);
+	}
+
+	async createToken(admin) {
+		return this.jwt.sign({
+			email: admin.email,
+			type: "admin"
+		});
+	}
+
+	async authenticate(token) {
+		const payload = this.jwt.verify(token);
+
+		if (payload.type !== "admin") {
+			throw new Error("Admin token required.");
+		}
+
+		const admin = await this.get(payload.email);
+
+		if (!admin) {
+			throw new Error("Admin not found.");
+		}
+
+		if (!admin.isActive) {
+			throw new Error("Admin is inactive.");
+		}
+
+		return admin;
 	}
 
+	// CRUD
+
 	async create(data) {
 		const createData = { ...data };
-		if (createData.password) createData.password = await bcrypt.hash(createData.password, 10);
-		return this.kernel.db.admin.create({ data: createData });
+
+		if (createData.password) {
+			createData.password = await bcrypt.hash(createData.password, 10);
+		}
+
+		return this.kernel.db.admin.create({
+			data: createData
+		});
 	}
 
 	async update(email, data) {
 		const updateData = { ...data };
-		if (updateData.password) updateData.password = await bcrypt.hash(updateData.password, 10);
-		return this.kernel.db.admin.update({ where: { email }, data: updateData });
+
+		if (updateData.password) {
+			updateData.password = await bcrypt.hash(updateData.password, 10);
+		}
+
+		return this.kernel.db.admin.update({
+			where: { email },
+			data: updateData
+		});
 	}
 
 	async delete(email) {
-		return this.kernel.db.admin.delete({ where: { email } });
+		return this.kernel.db.admin.delete({
+			where: { email }
+		});
 	}
 
 	async isAdmin(email, courseSlug) {
 		const admin = await this.get(email);
+
 		if (!admin) return false;
+
 		const courseSlugs = JSON.parse(admin.courseSlugs || "[]");
+
 		return courseSlugs.includes(courseSlug);
 	}
 }

package/src/modules/Course.js

@@ -6,21 +6,49 @@ export default class Course {
 		if (filters.access) where.access = filters.access;
 		return this.kernel.db.course.findMany({ where });
 	}
-
 	async get(slug) {
 		return this.kernel.db.course.findUnique({ where: { slug } });
 	}
-
-	async create(data) {
-		return this.kernel.db.course.create({ data });
+	async getGroups(courseSlug) {
+		return this.kernel.db.group.findMany({
+			where: { courseSlug },
+			orderBy: { id: 'asc' }
+		});
 	}
-
-	async update(slug, data) {
-		return this.kernel.db.course.update({ where: { slug }, data });
+	async getGroup(courseSlug, groupSlug) {
+		return this.kernel.db.group.findUnique({
+			where: {
+				courseSlug_slug: { courseSlug, slug: groupSlug }
+			}
+		});
 	}
-
-	async delete(slug) {
-		return this.kernel.db.course.delete({ where: { slug } });
+	async getGroupItems(courseSlug, groupSlug) {
+		const group = await this.getGroup(courseSlug, groupSlug);
+		return group?.items ?? [];
 	}
+	async wipe() {
+	await this.kernel.db.group.deleteMany();
+	await this.kernel.db.course.deleteMany();
+	}
+	async seed(course) {
+		const { groupings = [], ...courseData } = course;
+
+		const created = await this.kernel.db.course.create({
+			data: courseData
+		});
 
+		for (const group of groupings) {
+			await this.kernel.db.group.create({
+				data: {
+					courseSlug: created.slug,
+					slug: group.slug,
+					title: group.title,
+					thumbnail: group.thumbnail ?? null,
+					items: group.items ?? []
+				}
+			});
+		}
+
+		return created;
+	}
 }

package/src/modules/Library.js

@@ -56,4 +56,13 @@ export default class Library {
 			where: { slug }
 		});
 	}
+		async createFromSlot(slug, courseSlug, groupSlug, type) {
+		return this.create({
+			slug,
+			courseSlug,
+			groupSlug,
+			type,
+			title: slug
+		});
+	}
 }

package/src/modules/User.js

@@ -1,10 +1,12 @@
 // src/serverKernel/modules/User.js
 
 import bcrypt from "bcrypt";
+import JWT from "../utils/JWT.js";
 
 export default class User {
 	constructor(kernel) {
 		this.kernel = kernel;
+		this.jwt = new JWT(kernel);
 	}
 
 	// Queries
@@ -31,28 +33,69 @@ export default class User {
 
 	async register(data) {
 		const password = await bcrypt.hash(data.password, 10);
-		return this.kernel.db.user.create({ data: { ...data, password } });
+
+		return this.kernel.db.user.create({
+			data: { ...data, password }
+		});
 	}
 
 	async login(email, password) {
 		const user = await this.getByEmail(email);
-		if (!user) throw new Error(`User.login(): User '${email}' not found.`);
+
+		if (!user) {
+			throw new Error(`User.login(): User '${email}' not found.`);
+		}
 
 		const ok = await bcrypt.compare(password, user.password);
-		if (!ok) throw new Error(`User.login(): Invalid password.`);
 
-		return this.kernel.auth.createUserToken(user);
+		if (!ok) {
+			throw new Error(`User.login(): Invalid password.`);
+		}
+
+		return this.createToken(user);
+	}
+
+	async createToken(user) {
+		return this.jwt.sign({
+			id: user.id,
+			type: "user"
+		});
+	}
+
+	async authenticate(token) {
+		const payload = this.jwt.verify(token);
+
+		if (payload.type !== "user") {
+			throw new Error("User token required.");
+		}
+
+		const user = await this.get(payload.id);
+
+		if (!user) {
+			throw new Error("User not found.");
+		}
+
+		return user;
 	}
 
 	// CRUD
 
 	async update(id, data) {
 		const updateData = { ...data };
-		if (updateData.password) updateData.password = await bcrypt.hash(updateData.password, 10);
-		return this.kernel.db.user.update({ where: { id }, data: updateData });
+
+		if (updateData.password) {
+			updateData.password = await bcrypt.hash(updateData.password, 10);
+		}
+
+		return this.kernel.db.user.update({
+			where: { id },
+			data: updateData
+		});
 	}
 
 	async delete(id) {
-		return this.kernel.db.user.delete({ where: { id } });
+		return this.kernel.db.user.delete({
+			where: { id }
+		});
 	}
 }

package/src/utils/JWT.js

@@ -0,0 +1,31 @@
+// /home/bilal-tariq/00--TALEEM/taleem-kernel/src/utils/JWT.js
+
+import jwt from "jsonwebtoken";
+
+export default class JWT {
+
+	constructor(kernel) {
+
+		this.kernel = kernel;
+
+	}
+
+	sign(payload) {
+
+		return jwt.sign(
+			payload,
+			this.kernel.config.jwtSecret
+		);
+
+	}
+
+	verify(token) {
+
+		return jwt.verify(
+			token,
+			this.kernel.config.jwtSecret
+		);
+
+	}
+
+}

package/src/Auth.js

@@ -1,105 +0,0 @@
-///home/bilal-tariq/00--TALEEM/taleem-server/src/serverKernel/Auth.js
-
-import JWT from "./JWT.js";
-
-export default class Auth {
-
-	constructor(kernel) {
-		this.kernel = kernel;
-		this.jwt = new JWT(kernel);
-	}
-	// --------------------------------------------------
-	// Token Creation
-	// --------------------------------------------------
-	createUserToken(user) {
-
-		return this.jwt.sign({ id: user.id, type: "user" });
-
-	}
-
-	createAdminToken(admin) {
-
-		return this.jwt.sign({ id: admin.id, type: "admin" });
-
-	}
-
-	// --------------------------------------------------
-	// Authentication
-	// --------------------------------------------------
-
-	async authenticate(token) {
-
-		const { id, type } = this.verifyToken(token);
-
-		if (type === "user") return this.authenticateUser(id);
-
-		if (type === "admin") return this.authenticateAdmin(id);
-
-		this.fail("authenticate()", `Unknown identity type '${type}'.`);
-
-	}
-
-async authenticateUser(id) {
-
-	const user = await this.kernel.user.get(id);
-
-	if (!user)
-		this.fail(
-			"authenticateUser()",
-			`User '${id}' does not exist.`
-		);
-
-	return user;
-
-}
-
-async authenticateAdmin(id) {
-
-	const admin = await this.kernel.admin.get(id);
-
-	if (!admin)
-		this.fail(
-			"authenticateAdmin()",
-			`Admin '${id}' does not exist.`
-		);
-
-	return admin;
-
-}
-
-	verifyToken(token) {
-
-		try {
-
-			return this.jwt.verify(token);
-
-		}
-		catch (error) {
-
-			this.fail("verifyToken()", error.message);
-
-		}
-
-	}
-
-	// --------------------------------------------------
-	// Helpers
-	// --------------------------------------------------
-
-	fail(method, reason) {
-
-		throw new Error(
-			[
-				"",
-				"========================================",
-				"AUTHENTICATION FAILED",
-				"----------------------------------------",
-				`Method : Auth.${method}`,
-				`Reason : ${reason}`,
-				"========================================"
-			].join("\n")
-		);
-
-	}
-
-}