@shipfox/api-auth-context 10.2.0 → 11.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 1 file with swc (236.73ms)
+Successfully compiled: 1 file with swc (173.9ms)

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @shipfox/api-auth-context
 
+## 11.0.0
+
+### Major Changes
+
+- 25158c8: Carry workspace lifecycle status in JWT membership claims and enforce suspended or inactive access at the stateless workspace gate while keeping access-token verification stateless.
+
+  `getAuthenticatedSessionContext()` now reads refresh-session metadata from verified access-token claims without checking active refresh-session state; revoking a refresh session does not invalidate an already-issued access token.
+
+### Patch Changes
+
+- Updated dependencies [25158c8]
+  - @shipfox/api-workspaces-dto@11.0.0
+
 ## 10.2.0
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import type { JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 import type { WorkspaceRole } from '@shipfox/api-workspaces-dto';
+import { ClientError } from '@shipfox/node-fastify';
 export declare const AUTH_USER = "user";
 export declare const AUTH_RUNNER_REGISTRATION_TOKEN = "runner-registration-token";
 export declare const AUTH_RUNNER_SESSION = "runner-session";
@@ -10,6 +11,7 @@ export type WorkspaceStatus = 'active' | 'suspended' | 'deleted';
 export interface UserContextMembership {
     workspaceId: string;
     role: WorkspaceRole;
+    workspaceStatus: WorkspaceStatus;
 }
 export interface UserContext {
     userId: string;
@@ -60,6 +62,16 @@ export interface RequireWorkspaceAccessResult {
  * stateless and does not read the database on the request path.
  */
 export declare function requireWorkspaceAccess(params: RequireWorkspaceAccessParams): RequireWorkspaceAccessResult;
+/**
+ * Applies the workspace lifecycle gate to a resource that has already been loaded. Missing
+ * membership remains resource-shaped 404 to avoid leaking the resource's existence, while
+ * suspended and deleted claims retain their stable lifecycle errors.
+ */
+export declare function requireWorkspaceResourceAccess(params: {
+    request: RequestWithContext;
+    workspaceId: string;
+    notFoundError: ClientError;
+}): RequireWorkspaceAccessResult;
 export declare function setProvisionerContext(request: RequestWithContext, context: ProvisionerContext): void;
 export declare function getProvisionerContext(request: RequestWithContext): ProvisionerContext | null;
 export declare function requireProvisionerContext(request: RequestWithContext): ProvisionerContext;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAG/D,eAAO,MAAM,SAAS,SAAS,CAAC;AAChC,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAC1E,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAClD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACxC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;CAC5D;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAW5E;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAC,GACnD;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC5D,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,kBAAkB,GAAG,MAAM,CAAC;AAUjC,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAEtF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,GAAG,IAAI,CAI9E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAM3E;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,4BAA4B,CAY9B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAEN;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,IAAI,CAM5F;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,CAMzF;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,EAAE;IAAC,KAAK,EAAE,WAAW,CAAA;CAAC,CAAC,CAMnD;AAED,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,EAAE;IAAC,KAAK,EAAE,cAAc,CAAA;CAAC,CAAC,CAQtD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAEhG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAMxF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,CAMrF;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAEN;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,IAAI,CAMhG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,GAAG,oBAAoB,CAM7F;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAEN;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,GAC1B,2BAA2B,CAM7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAElD,eAAO,MAAM,SAAS,SAAS,CAAC;AAChC,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAC1E,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,aAAa,CAAC;IACpB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAClD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACxC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;CAC5D;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAc5E;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAC,GACnD;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC5D,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,kBAAkB,GAAG,MAAM,CAAC;AAUjC,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAEtF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,GAAG,IAAI,CAI9E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAM3E;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,4BAA4B,CAmB9B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,kBAAkB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,WAAW,CAAC;CAC5B,GAAG,4BAA4B,CAS/B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAEN;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,IAAI,CAM5F;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,CAMzF;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,EAAE;IAAC,KAAK,EAAE,WAAW,CAAA;CAAC,CAAC,CAMnD;AAED,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,EAAE;IAAC,KAAK,EAAE,cAAc,CAAA;CAAC,CAAC,CAQtD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAEhG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAMxF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,CAMrF;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAEN;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,IAAI,CAMhG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,GAAG,oBAAoB,CAM7F;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAEN;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,GAC1B,2BAA2B,CAM7B"}

package/dist/index.js

@@ -12,8 +12,8 @@ export function buildUserContext(params) {
         email: params.email,
         name: params.name ?? null,
         memberships,
-        canAccess: (workspaceId)=>memberships.some((m)=>m.workspaceId === workspaceId),
-        hasRole: (workspaceId, role)=>memberships.some((m)=>m.workspaceId === workspaceId && m.role === role)
+        canAccess: (workspaceId)=>memberships.some((m)=>m.workspaceId === workspaceId && m.workspaceStatus === 'active'),
+        hasRole: (workspaceId, role)=>memberships.some((m)=>m.workspaceId === workspaceId && m.workspaceStatus === 'active' && m.role === role)
     };
 }
 const USER_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/user');
@@ -51,12 +51,36 @@ export function requireUserContext(request) {
             status: 403
         });
     }
+    if (membership.workspaceStatus === 'suspended') {
+        throw new ClientError('Workspace is suspended', 'workspace-suspended', {
+            status: 409
+        });
+    }
+    if (membership.workspaceStatus === 'deleted') {
+        throw new ClientError('Workspace is not active', 'workspace-inactive', {
+            status: 403
+        });
+    }
     return {
         workspaceId: params.workspaceId,
         userId: context.userId,
         role: membership.role
     };
 }
+/**
+ * Applies the workspace lifecycle gate to a resource that has already been loaded. Missing
+ * membership remains resource-shaped 404 to avoid leaking the resource's existence, while
+ * suspended and deleted claims retain their stable lifecycle errors.
+ */ export function requireWorkspaceResourceAccess(params) {
+    try {
+        return requireWorkspaceAccess(params);
+    } catch (error) {
+        if (error instanceof ClientError && error.code === 'forbidden') {
+            throw params.notFoundError;
+        }
+        throw error;
+    }
+}
 export function setProvisionerContext(request, context) {
     request[PROVISIONER_CONTEXT_KEY] = context;
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nimport type {WorkspaceRole} from '@shipfox/api-workspaces-dto';\nimport {ClientError} from '@shipfox/node-fastify';\n\nexport const AUTH_USER = 'user';\nexport const AUTH_RUNNER_REGISTRATION_TOKEN = 'runner-registration-token';\nexport const AUTH_RUNNER_SESSION = 'runner-session';\nexport const AUTH_RUNNER_CONTROL_SESSION = 'runner-control-session';\nexport const AUTH_LEASED_JOB = 'leased-job';\nexport const AUTH_PROVISIONER_TOKEN = 'provisioner-token';\n\nexport type WorkspaceStatus = 'active' | 'suspended' | 'deleted';\n\nexport interface UserContextMembership {\n  workspaceId: string;\n  role: WorkspaceRole;\n}\n\nexport interface UserContext {\n  userId: string;\n  email: string;\n  name: string | null;\n  memberships: ReadonlyArray<UserContextMembership>;\n  canAccess(workspaceId: string): boolean;\n  hasRole(workspaceId: string, role: WorkspaceRole): boolean;\n}\n\nexport interface BuildUserContextParams {\n  userId: string;\n  email: string;\n  name?: string | null | undefined;\n  memberships?: ReadonlyArray<UserContextMembership> | undefined;\n}\n\nexport function buildUserContext(params: BuildUserContextParams): UserContext {\n  const memberships = params.memberships ?? [];\n  return {\n    userId: params.userId,\n    email: params.email,\n    name: params.name ?? null,\n    memberships,\n    canAccess: (workspaceId) => memberships.some((m) => m.workspaceId === workspaceId),\n    hasRole: (workspaceId, role) =>\n      memberships.some((m) => m.workspaceId === workspaceId && m.role === role),\n  };\n}\n\nexport type ProvisionerContext =\n  | {provisionerTokenId: string; scope: 'installation'}\n  | {provisionerTokenId: string; scope: 'workspace'; workspaceId: string};\n\nexport type LeasedJobContext = JobLeaseTokenClaims;\nexport type RunnerSessionContext = RunnerSessionTokenClaims;\nexport interface RunnerControlSessionContext {\n  runnerControlSessionId: string;\n  runnerInstanceId: string;\n  provisionerId: string;\n}\n\ntype RequestWithContext = object;\n\nconst USER_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/user');\nconst LEASED_JOB_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/leased-job');\nconst PROVISIONER_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/provisioner');\nconst RUNNER_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/runner-session');\nconst RUNNER_CONTROL_SESSION_CONTEXT_KEY = Symbol.for(\n  '@shipfox/api-auth-context/runner-control-session',\n);\n\nexport function setUserContext(request: RequestWithContext, context: UserContext): void {\n  (request as Record<symbol, unknown>)[USER_CONTEXT_KEY] = context;\n}\n\nexport function getUserContext(request: RequestWithContext): UserContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[USER_CONTEXT_KEY] as UserContext | undefined) ?? null\n  );\n}\n\nexport function requireUserContext(request: RequestWithContext): UserContext {\n  const context = getUserContext(request);\n  if (!context) {\n    throw new Error('User context is not available on this request');\n  }\n  return context;\n}\n\nexport interface RequireWorkspaceAccessParams {\n  request: RequestWithContext;\n  workspaceId: string;\n}\n\nexport interface RequireWorkspaceAccessResult {\n  workspaceId: string;\n  userId: string;\n  role: WorkspaceRole;\n}\n\n/**\n * Authorizes the request's user for a workspace using only the verified session\n * token. Membership and role come from the token claims, so the check stays\n * stateless and does not read the database on the request path.\n */\nexport function requireWorkspaceAccess(\n  params: RequireWorkspaceAccessParams,\n): RequireWorkspaceAccessResult {\n  const context = getUserContext(params.request);\n  if (!context) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n\n  const membership = context.memberships.find((m) => m.workspaceId === params.workspaceId);\n  if (!membership) {\n    throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});\n  }\n\n  return {workspaceId: params.workspaceId, userId: context.userId, role: membership.role};\n}\n\nexport function setProvisionerContext(\n  request: RequestWithContext,\n  context: ProvisionerContext,\n): void {\n  (request as Record<symbol, unknown>)[PROVISIONER_CONTEXT_KEY] = context;\n}\n\nexport function getProvisionerContext(request: RequestWithContext): ProvisionerContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[PROVISIONER_CONTEXT_KEY] as\n      | ProvisionerContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireProvisionerContext(request: RequestWithContext): ProvisionerContext {\n  const context = getProvisionerContext(request);\n  if (!context) {\n    throw new Error('Provisioner context is not available on this request');\n  }\n  return context;\n}\n\nexport function requireWorkspaceProvisionerContext(\n  request: RequestWithContext,\n): Extract<ProvisionerContext, {scope: 'workspace'}> {\n  const context = requireProvisionerContext(request);\n  if (context.scope !== 'workspace') {\n    throw new ClientError('Workspace provisioner credential required', 'forbidden', {status: 403});\n  }\n  return context;\n}\n\nexport function requireInstallationProvisionerContext(\n  request: RequestWithContext,\n): Extract<ProvisionerContext, {scope: 'installation'}> {\n  const context = requireProvisionerContext(request);\n  if (context.scope !== 'installation') {\n    throw new ClientError('Installation provisioner credential required', 'forbidden', {\n      status: 403,\n    });\n  }\n  return context;\n}\n\nexport function setLeasedJobContext(request: RequestWithContext, context: LeasedJobContext): void {\n  (request as Record<symbol, unknown>)[LEASED_JOB_CONTEXT_KEY] = context;\n}\n\nexport function getLeasedJobContext(request: RequestWithContext): LeasedJobContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[LEASED_JOB_CONTEXT_KEY] as\n      | LeasedJobContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireLeasedJobContext(request: RequestWithContext): LeasedJobContext {\n  const context = getLeasedJobContext(request);\n  if (!context) {\n    throw new Error('Leased job context is not available on this request');\n  }\n  return context;\n}\n\nexport function setRunnerSessionContext(\n  request: RequestWithContext,\n  context: RunnerSessionContext,\n): void {\n  (request as Record<symbol, unknown>)[RUNNER_SESSION_CONTEXT_KEY] = context;\n}\n\nexport function getRunnerSessionContext(request: RequestWithContext): RunnerSessionContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[RUNNER_SESSION_CONTEXT_KEY] as\n      | RunnerSessionContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireRunnerSessionContext(request: RequestWithContext): RunnerSessionContext {\n  const context = getRunnerSessionContext(request);\n  if (!context) {\n    throw new Error('Runner session context is not available on this request');\n  }\n  return context;\n}\n\nexport function setRunnerControlSessionContext(\n  request: RequestWithContext,\n  context: RunnerControlSessionContext,\n): void {\n  (request as Record<symbol, unknown>)[RUNNER_CONTROL_SESSION_CONTEXT_KEY] = context;\n}\n\nexport function requireRunnerControlSessionContext(\n  request: RequestWithContext,\n): RunnerControlSessionContext {\n  const context = (request as Record<symbol, unknown>)[RUNNER_CONTROL_SESSION_CONTEXT_KEY] as\n    | RunnerControlSessionContext\n    | undefined;\n  if (!context) throw new Error('Runner control session context is not available on this request');\n  return context;\n}\n"],"names":["ClientError","AUTH_USER","AUTH_RUNNER_REGISTRATION_TOKEN","AUTH_RUNNER_SESSION","AUTH_RUNNER_CONTROL_SESSION","AUTH_LEASED_JOB","AUTH_PROVISIONER_TOKEN","buildUserContext","params","memberships","userId","email","name","canAccess","workspaceId","some","m","hasRole","role","USER_CONTEXT_KEY","Symbol","for","LEASED_JOB_CONTEXT_KEY","PROVISIONER_CONTEXT_KEY","RUNNER_SESSION_CONTEXT_KEY","RUNNER_CONTROL_SESSION_CONTEXT_KEY","setUserContext","request","context","getUserContext","requireUserContext","Error","requireWorkspaceAccess","status","membership","find","setProvisionerContext","getProvisionerContext","requireProvisionerContext","requireWorkspaceProvisionerContext","scope","requireInstallationProvisionerContext","setLeasedJobContext","getLeasedJobContext","requireLeasedJobContext","setRunnerSessionContext","getRunnerSessionContext","requireRunnerSessionContext","setRunnerControlSessionContext","requireRunnerControlSessionContext"],"mappings":"AAEA,SAAQA,WAAW,QAAO,wBAAwB;AAElD,OAAO,MAAMC,YAAY,OAAO;AAChC,OAAO,MAAMC,iCAAiC,4BAA4B;AAC1E,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,8BAA8B,yBAAyB;AACpE,OAAO,MAAMC,kBAAkB,aAAa;AAC5C,OAAO,MAAMC,yBAAyB,oBAAoB;AAyB1D,OAAO,SAASC,iBAAiBC,MAA8B;IAC7D,MAAMC,cAAcD,OAAOC,WAAW,IAAI,EAAE;IAC5C,OAAO;QACLC,QAAQF,OAAOE,MAAM;QACrBC,OAAOH,OAAOG,KAAK;QACnBC,MAAMJ,OAAOI,IAAI,IAAI;QACrBH;QACAI,WAAW,CAACC,cAAgBL,YAAYM,IAAI,CAAC,CAACC,IAAMA,EAAEF,WAAW,KAAKA;QACtEG,SAAS,CAACH,aAAaI,OACrBT,YAAYM,IAAI,CAAC,CAACC,IAAMA,EAAEF,WAAW,KAAKA,eAAeE,EAAEE,IAAI,KAAKA;IACxE;AACF;AAgBA,MAAMC,mBAAmBC,OAAOC,GAAG,CAAC;AACpC,MAAMC,yBAAyBF,OAAOC,GAAG,CAAC;AAC1C,MAAME,0BAA0BH,OAAOC,GAAG,CAAC;AAC3C,MAAMG,6BAA6BJ,OAAOC,GAAG,CAAC;AAC9C,MAAMI,qCAAqCL,OAAOC,GAAG,CACnD;AAGF,OAAO,SAASK,eAAeC,OAA2B,EAAEC,OAAoB;IAC7ED,OAAmC,CAACR,iBAAiB,GAAGS;AAC3D;AAEA,OAAO,SAASC,eAAeF,OAA2B;IACxD,OACE,AAAC,AAACA,OAAmC,CAACR,iBAAiB,IAAgC;AAE3F;AAEA,OAAO,SAASW,mBAAmBH,OAA2B;IAC5D,MAAMC,UAAUC,eAAeF;IAC/B,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAaA;;;;CAIC,GACD,OAAO,SAASI,uBACdxB,MAAoC;IAEpC,MAAMoB,UAAUC,eAAerB,OAAOmB,OAAO;IAC7C,IAAI,CAACC,SAAS;QACZ,MAAM,IAAI5B,YAAY,2BAA2B,gBAAgB;YAACiC,QAAQ;QAAG;IAC/E;IAEA,MAAMC,aAAaN,QAAQnB,WAAW,CAAC0B,IAAI,CAAC,CAACnB,IAAMA,EAAEF,WAAW,KAAKN,OAAOM,WAAW;IACvF,IAAI,CAACoB,YAAY;QACf,MAAM,IAAIlC,YAAY,kCAAkC,aAAa;YAACiC,QAAQ;QAAG;IACnF;IAEA,OAAO;QAACnB,aAAaN,OAAOM,WAAW;QAAEJ,QAAQkB,QAAQlB,MAAM;QAAEQ,MAAMgB,WAAWhB,IAAI;IAAA;AACxF;AAEA,OAAO,SAASkB,sBACdT,OAA2B,EAC3BC,OAA2B;IAE1BD,OAAmC,CAACJ,wBAAwB,GAAGK;AAClE;AAEA,OAAO,SAASS,sBAAsBV,OAA2B;IAC/D,OACE,AAAC,AAACA,OAAmC,CAACJ,wBAAwB,IAE5C;AAEtB;AAEA,OAAO,SAASe,0BAA0BX,OAA2B;IACnE,MAAMC,UAAUS,sBAAsBV;IACtC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASW,mCACdZ,OAA2B;IAE3B,MAAMC,UAAUU,0BAA0BX;IAC1C,IAAIC,QAAQY,KAAK,KAAK,aAAa;QACjC,MAAM,IAAIxC,YAAY,6CAA6C,aAAa;YAACiC,QAAQ;QAAG;IAC9F;IACA,OAAOL;AACT;AAEA,OAAO,SAASa,sCACdd,OAA2B;IAE3B,MAAMC,UAAUU,0BAA0BX;IAC1C,IAAIC,QAAQY,KAAK,KAAK,gBAAgB;QACpC,MAAM,IAAIxC,YAAY,gDAAgD,aAAa;YACjFiC,QAAQ;QACV;IACF;IACA,OAAOL;AACT;AAEA,OAAO,SAASc,oBAAoBf,OAA2B,EAAEC,OAAyB;IACvFD,OAAmC,CAACL,uBAAuB,GAAGM;AACjE;AAEA,OAAO,SAASe,oBAAoBhB,OAA2B;IAC7D,OACE,AAAC,AAACA,OAAmC,CAACL,uBAAuB,IAE3C;AAEtB;AAEA,OAAO,SAASsB,wBAAwBjB,OAA2B;IACjE,MAAMC,UAAUe,oBAAoBhB;IACpC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASiB,wBACdlB,OAA2B,EAC3BC,OAA6B;IAE5BD,OAAmC,CAACH,2BAA2B,GAAGI;AACrE;AAEA,OAAO,SAASkB,wBAAwBnB,OAA2B;IACjE,OACE,AAAC,AAACA,OAAmC,CAACH,2BAA2B,IAE/C;AAEtB;AAEA,OAAO,SAASuB,4BAA4BpB,OAA2B;IACrE,MAAMC,UAAUkB,wBAAwBnB;IACxC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASoB,+BACdrB,OAA2B,EAC3BC,OAAoC;IAEnCD,OAAmC,CAACF,mCAAmC,GAAGG;AAC7E;AAEA,OAAO,SAASqB,mCACdtB,OAA2B;IAE3B,MAAMC,UAAU,AAACD,OAAmC,CAACF,mCAAmC;IAGxF,IAAI,CAACG,SAAS,MAAM,IAAIG,MAAM;IAC9B,OAAOH;AACT"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nimport type {WorkspaceRole} from '@shipfox/api-workspaces-dto';\nimport {ClientError} from '@shipfox/node-fastify';\n\nexport const AUTH_USER = 'user';\nexport const AUTH_RUNNER_REGISTRATION_TOKEN = 'runner-registration-token';\nexport const AUTH_RUNNER_SESSION = 'runner-session';\nexport const AUTH_RUNNER_CONTROL_SESSION = 'runner-control-session';\nexport const AUTH_LEASED_JOB = 'leased-job';\nexport const AUTH_PROVISIONER_TOKEN = 'provisioner-token';\n\nexport type WorkspaceStatus = 'active' | 'suspended' | 'deleted';\n\nexport interface UserContextMembership {\n  workspaceId: string;\n  role: WorkspaceRole;\n  workspaceStatus: WorkspaceStatus;\n}\n\nexport interface UserContext {\n  userId: string;\n  email: string;\n  name: string | null;\n  memberships: ReadonlyArray<UserContextMembership>;\n  canAccess(workspaceId: string): boolean;\n  hasRole(workspaceId: string, role: WorkspaceRole): boolean;\n}\n\nexport interface BuildUserContextParams {\n  userId: string;\n  email: string;\n  name?: string | null | undefined;\n  memberships?: ReadonlyArray<UserContextMembership> | undefined;\n}\n\nexport function buildUserContext(params: BuildUserContextParams): UserContext {\n  const memberships = params.memberships ?? [];\n  return {\n    userId: params.userId,\n    email: params.email,\n    name: params.name ?? null,\n    memberships,\n    canAccess: (workspaceId) =>\n      memberships.some((m) => m.workspaceId === workspaceId && m.workspaceStatus === 'active'),\n    hasRole: (workspaceId, role) =>\n      memberships.some(\n        (m) => m.workspaceId === workspaceId && m.workspaceStatus === 'active' && m.role === role,\n      ),\n  };\n}\n\nexport type ProvisionerContext =\n  | {provisionerTokenId: string; scope: 'installation'}\n  | {provisionerTokenId: string; scope: 'workspace'; workspaceId: string};\n\nexport type LeasedJobContext = JobLeaseTokenClaims;\nexport type RunnerSessionContext = RunnerSessionTokenClaims;\nexport interface RunnerControlSessionContext {\n  runnerControlSessionId: string;\n  runnerInstanceId: string;\n  provisionerId: string;\n}\n\ntype RequestWithContext = object;\n\nconst USER_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/user');\nconst LEASED_JOB_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/leased-job');\nconst PROVISIONER_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/provisioner');\nconst RUNNER_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth-context/runner-session');\nconst RUNNER_CONTROL_SESSION_CONTEXT_KEY = Symbol.for(\n  '@shipfox/api-auth-context/runner-control-session',\n);\n\nexport function setUserContext(request: RequestWithContext, context: UserContext): void {\n  (request as Record<symbol, unknown>)[USER_CONTEXT_KEY] = context;\n}\n\nexport function getUserContext(request: RequestWithContext): UserContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[USER_CONTEXT_KEY] as UserContext | undefined) ?? null\n  );\n}\n\nexport function requireUserContext(request: RequestWithContext): UserContext {\n  const context = getUserContext(request);\n  if (!context) {\n    throw new Error('User context is not available on this request');\n  }\n  return context;\n}\n\nexport interface RequireWorkspaceAccessParams {\n  request: RequestWithContext;\n  workspaceId: string;\n}\n\nexport interface RequireWorkspaceAccessResult {\n  workspaceId: string;\n  userId: string;\n  role: WorkspaceRole;\n}\n\n/**\n * Authorizes the request's user for a workspace using only the verified session\n * token. Membership and role come from the token claims, so the check stays\n * stateless and does not read the database on the request path.\n */\nexport function requireWorkspaceAccess(\n  params: RequireWorkspaceAccessParams,\n): RequireWorkspaceAccessResult {\n  const context = getUserContext(params.request);\n  if (!context) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n\n  const membership = context.memberships.find((m) => m.workspaceId === params.workspaceId);\n  if (!membership) {\n    throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});\n  }\n\n  if (membership.workspaceStatus === 'suspended') {\n    throw new ClientError('Workspace is suspended', 'workspace-suspended', {status: 409});\n  }\n  if (membership.workspaceStatus === 'deleted') {\n    throw new ClientError('Workspace is not active', 'workspace-inactive', {status: 403});\n  }\n\n  return {workspaceId: params.workspaceId, userId: context.userId, role: membership.role};\n}\n\n/**\n * Applies the workspace lifecycle gate to a resource that has already been loaded. Missing\n * membership remains resource-shaped 404 to avoid leaking the resource's existence, while\n * suspended and deleted claims retain their stable lifecycle errors.\n */\nexport function requireWorkspaceResourceAccess(params: {\n  request: RequestWithContext;\n  workspaceId: string;\n  notFoundError: ClientError;\n}): RequireWorkspaceAccessResult {\n  try {\n    return requireWorkspaceAccess(params);\n  } catch (error) {\n    if (error instanceof ClientError && error.code === 'forbidden') {\n      throw params.notFoundError;\n    }\n    throw error;\n  }\n}\n\nexport function setProvisionerContext(\n  request: RequestWithContext,\n  context: ProvisionerContext,\n): void {\n  (request as Record<symbol, unknown>)[PROVISIONER_CONTEXT_KEY] = context;\n}\n\nexport function getProvisionerContext(request: RequestWithContext): ProvisionerContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[PROVISIONER_CONTEXT_KEY] as\n      | ProvisionerContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireProvisionerContext(request: RequestWithContext): ProvisionerContext {\n  const context = getProvisionerContext(request);\n  if (!context) {\n    throw new Error('Provisioner context is not available on this request');\n  }\n  return context;\n}\n\nexport function requireWorkspaceProvisionerContext(\n  request: RequestWithContext,\n): Extract<ProvisionerContext, {scope: 'workspace'}> {\n  const context = requireProvisionerContext(request);\n  if (context.scope !== 'workspace') {\n    throw new ClientError('Workspace provisioner credential required', 'forbidden', {status: 403});\n  }\n  return context;\n}\n\nexport function requireInstallationProvisionerContext(\n  request: RequestWithContext,\n): Extract<ProvisionerContext, {scope: 'installation'}> {\n  const context = requireProvisionerContext(request);\n  if (context.scope !== 'installation') {\n    throw new ClientError('Installation provisioner credential required', 'forbidden', {\n      status: 403,\n    });\n  }\n  return context;\n}\n\nexport function setLeasedJobContext(request: RequestWithContext, context: LeasedJobContext): void {\n  (request as Record<symbol, unknown>)[LEASED_JOB_CONTEXT_KEY] = context;\n}\n\nexport function getLeasedJobContext(request: RequestWithContext): LeasedJobContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[LEASED_JOB_CONTEXT_KEY] as\n      | LeasedJobContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireLeasedJobContext(request: RequestWithContext): LeasedJobContext {\n  const context = getLeasedJobContext(request);\n  if (!context) {\n    throw new Error('Leased job context is not available on this request');\n  }\n  return context;\n}\n\nexport function setRunnerSessionContext(\n  request: RequestWithContext,\n  context: RunnerSessionContext,\n): void {\n  (request as Record<symbol, unknown>)[RUNNER_SESSION_CONTEXT_KEY] = context;\n}\n\nexport function getRunnerSessionContext(request: RequestWithContext): RunnerSessionContext | null {\n  return (\n    ((request as Record<symbol, unknown>)[RUNNER_SESSION_CONTEXT_KEY] as\n      | RunnerSessionContext\n      | undefined) ?? null\n  );\n}\n\nexport function requireRunnerSessionContext(request: RequestWithContext): RunnerSessionContext {\n  const context = getRunnerSessionContext(request);\n  if (!context) {\n    throw new Error('Runner session context is not available on this request');\n  }\n  return context;\n}\n\nexport function setRunnerControlSessionContext(\n  request: RequestWithContext,\n  context: RunnerControlSessionContext,\n): void {\n  (request as Record<symbol, unknown>)[RUNNER_CONTROL_SESSION_CONTEXT_KEY] = context;\n}\n\nexport function requireRunnerControlSessionContext(\n  request: RequestWithContext,\n): RunnerControlSessionContext {\n  const context = (request as Record<symbol, unknown>)[RUNNER_CONTROL_SESSION_CONTEXT_KEY] as\n    | RunnerControlSessionContext\n    | undefined;\n  if (!context) throw new Error('Runner control session context is not available on this request');\n  return context;\n}\n"],"names":["ClientError","AUTH_USER","AUTH_RUNNER_REGISTRATION_TOKEN","AUTH_RUNNER_SESSION","AUTH_RUNNER_CONTROL_SESSION","AUTH_LEASED_JOB","AUTH_PROVISIONER_TOKEN","buildUserContext","params","memberships","userId","email","name","canAccess","workspaceId","some","m","workspaceStatus","hasRole","role","USER_CONTEXT_KEY","Symbol","for","LEASED_JOB_CONTEXT_KEY","PROVISIONER_CONTEXT_KEY","RUNNER_SESSION_CONTEXT_KEY","RUNNER_CONTROL_SESSION_CONTEXT_KEY","setUserContext","request","context","getUserContext","requireUserContext","Error","requireWorkspaceAccess","status","membership","find","requireWorkspaceResourceAccess","error","code","notFoundError","setProvisionerContext","getProvisionerContext","requireProvisionerContext","requireWorkspaceProvisionerContext","scope","requireInstallationProvisionerContext","setLeasedJobContext","getLeasedJobContext","requireLeasedJobContext","setRunnerSessionContext","getRunnerSessionContext","requireRunnerSessionContext","setRunnerControlSessionContext","requireRunnerControlSessionContext"],"mappings":"AAEA,SAAQA,WAAW,QAAO,wBAAwB;AAElD,OAAO,MAAMC,YAAY,OAAO;AAChC,OAAO,MAAMC,iCAAiC,4BAA4B;AAC1E,OAAO,MAAMC,sBAAsB,iBAAiB;AACpD,OAAO,MAAMC,8BAA8B,yBAAyB;AACpE,OAAO,MAAMC,kBAAkB,aAAa;AAC5C,OAAO,MAAMC,yBAAyB,oBAAoB;AA0B1D,OAAO,SAASC,iBAAiBC,MAA8B;IAC7D,MAAMC,cAAcD,OAAOC,WAAW,IAAI,EAAE;IAC5C,OAAO;QACLC,QAAQF,OAAOE,MAAM;QACrBC,OAAOH,OAAOG,KAAK;QACnBC,MAAMJ,OAAOI,IAAI,IAAI;QACrBH;QACAI,WAAW,CAACC,cACVL,YAAYM,IAAI,CAAC,CAACC,IAAMA,EAAEF,WAAW,KAAKA,eAAeE,EAAEC,eAAe,KAAK;QACjFC,SAAS,CAACJ,aAAaK,OACrBV,YAAYM,IAAI,CACd,CAACC,IAAMA,EAAEF,WAAW,KAAKA,eAAeE,EAAEC,eAAe,KAAK,YAAYD,EAAEG,IAAI,KAAKA;IAE3F;AACF;AAgBA,MAAMC,mBAAmBC,OAAOC,GAAG,CAAC;AACpC,MAAMC,yBAAyBF,OAAOC,GAAG,CAAC;AAC1C,MAAME,0BAA0BH,OAAOC,GAAG,CAAC;AAC3C,MAAMG,6BAA6BJ,OAAOC,GAAG,CAAC;AAC9C,MAAMI,qCAAqCL,OAAOC,GAAG,CACnD;AAGF,OAAO,SAASK,eAAeC,OAA2B,EAAEC,OAAoB;IAC7ED,OAAmC,CAACR,iBAAiB,GAAGS;AAC3D;AAEA,OAAO,SAASC,eAAeF,OAA2B;IACxD,OACE,AAAC,AAACA,OAAmC,CAACR,iBAAiB,IAAgC;AAE3F;AAEA,OAAO,SAASW,mBAAmBH,OAA2B;IAC5D,MAAMC,UAAUC,eAAeF;IAC/B,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAaA;;;;CAIC,GACD,OAAO,SAASI,uBACdzB,MAAoC;IAEpC,MAAMqB,UAAUC,eAAetB,OAAOoB,OAAO;IAC7C,IAAI,CAACC,SAAS;QACZ,MAAM,IAAI7B,YAAY,2BAA2B,gBAAgB;YAACkC,QAAQ;QAAG;IAC/E;IAEA,MAAMC,aAAaN,QAAQpB,WAAW,CAAC2B,IAAI,CAAC,CAACpB,IAAMA,EAAEF,WAAW,KAAKN,OAAOM,WAAW;IACvF,IAAI,CAACqB,YAAY;QACf,MAAM,IAAInC,YAAY,kCAAkC,aAAa;YAACkC,QAAQ;QAAG;IACnF;IAEA,IAAIC,WAAWlB,eAAe,KAAK,aAAa;QAC9C,MAAM,IAAIjB,YAAY,0BAA0B,uBAAuB;YAACkC,QAAQ;QAAG;IACrF;IACA,IAAIC,WAAWlB,eAAe,KAAK,WAAW;QAC5C,MAAM,IAAIjB,YAAY,2BAA2B,sBAAsB;YAACkC,QAAQ;QAAG;IACrF;IAEA,OAAO;QAACpB,aAAaN,OAAOM,WAAW;QAAEJ,QAAQmB,QAAQnB,MAAM;QAAES,MAAMgB,WAAWhB,IAAI;IAAA;AACxF;AAEA;;;;CAIC,GACD,OAAO,SAASkB,+BAA+B7B,MAI9C;IACC,IAAI;QACF,OAAOyB,uBAAuBzB;IAChC,EAAE,OAAO8B,OAAO;QACd,IAAIA,iBAAiBtC,eAAesC,MAAMC,IAAI,KAAK,aAAa;YAC9D,MAAM/B,OAAOgC,aAAa;QAC5B;QACA,MAAMF;IACR;AACF;AAEA,OAAO,SAASG,sBACdb,OAA2B,EAC3BC,OAA2B;IAE1BD,OAAmC,CAACJ,wBAAwB,GAAGK;AAClE;AAEA,OAAO,SAASa,sBAAsBd,OAA2B;IAC/D,OACE,AAAC,AAACA,OAAmC,CAACJ,wBAAwB,IAE5C;AAEtB;AAEA,OAAO,SAASmB,0BAA0Bf,OAA2B;IACnE,MAAMC,UAAUa,sBAAsBd;IACtC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASe,mCACdhB,OAA2B;IAE3B,MAAMC,UAAUc,0BAA0Bf;IAC1C,IAAIC,QAAQgB,KAAK,KAAK,aAAa;QACjC,MAAM,IAAI7C,YAAY,6CAA6C,aAAa;YAACkC,QAAQ;QAAG;IAC9F;IACA,OAAOL;AACT;AAEA,OAAO,SAASiB,sCACdlB,OAA2B;IAE3B,MAAMC,UAAUc,0BAA0Bf;IAC1C,IAAIC,QAAQgB,KAAK,KAAK,gBAAgB;QACpC,MAAM,IAAI7C,YAAY,gDAAgD,aAAa;YACjFkC,QAAQ;QACV;IACF;IACA,OAAOL;AACT;AAEA,OAAO,SAASkB,oBAAoBnB,OAA2B,EAAEC,OAAyB;IACvFD,OAAmC,CAACL,uBAAuB,GAAGM;AACjE;AAEA,OAAO,SAASmB,oBAAoBpB,OAA2B;IAC7D,OACE,AAAC,AAACA,OAAmC,CAACL,uBAAuB,IAE3C;AAEtB;AAEA,OAAO,SAAS0B,wBAAwBrB,OAA2B;IACjE,MAAMC,UAAUmB,oBAAoBpB;IACpC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASqB,wBACdtB,OAA2B,EAC3BC,OAA6B;IAE5BD,OAAmC,CAACH,2BAA2B,GAAGI;AACrE;AAEA,OAAO,SAASsB,wBAAwBvB,OAA2B;IACjE,OACE,AAAC,AAACA,OAAmC,CAACH,2BAA2B,IAE/C;AAEtB;AAEA,OAAO,SAAS2B,4BAA4BxB,OAA2B;IACrE,MAAMC,UAAUsB,wBAAwBvB;IACxC,IAAI,CAACC,SAAS;QACZ,MAAM,IAAIG,MAAM;IAClB;IACA,OAAOH;AACT;AAEA,OAAO,SAASwB,+BACdzB,OAA2B,EAC3BC,OAAoC;IAEnCD,OAAmC,CAACF,mCAAmC,GAAGG;AAC7E;AAEA,OAAO,SAASyB,mCACd1B,OAA2B;IAE3B,MAAMC,UAAU,AAACD,OAAmC,CAACF,mCAAmC;IAGxF,IAAI,CAACG,SAAS,MAAM,IAAIG,MAAM;IAC9B,OAAOH;AACT"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth-context",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "11.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@shipfox/api-auth-dto": "10.2.0",
-    "@shipfox/api-workspaces-dto": "10.2.0",
+    "@shipfox/api-workspaces-dto": "11.0.0",
     "@shipfox/node-fastify": "0.4.0"
   },
   "shipfox": {

package/src/index.ts

@@ -14,6 +14,7 @@ export type WorkspaceStatus = 'active' | 'suspended' | 'deleted';
 export interface UserContextMembership {
   workspaceId: string;
   role: WorkspaceRole;
+  workspaceStatus: WorkspaceStatus;
 }
 
 export interface UserContext {
@@ -39,9 +40,12 @@ export function buildUserContext(params: BuildUserContextParams): UserContext {
     email: params.email,
     name: params.name ?? null,
     memberships,
-    canAccess: (workspaceId) => memberships.some((m) => m.workspaceId === workspaceId),
+    canAccess: (workspaceId) =>
+      memberships.some((m) => m.workspaceId === workspaceId && m.workspaceStatus === 'active'),
     hasRole: (workspaceId, role) =>
-      memberships.some((m) => m.workspaceId === workspaceId && m.role === role),
+      memberships.some(
+        (m) => m.workspaceId === workspaceId && m.workspaceStatus === 'active' && m.role === role,
+      ),
   };
 }
 
@@ -114,9 +118,36 @@ export function requireWorkspaceAccess(
     throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
   }
 
+  if (membership.workspaceStatus === 'suspended') {
+    throw new ClientError('Workspace is suspended', 'workspace-suspended', {status: 409});
+  }
+  if (membership.workspaceStatus === 'deleted') {
+    throw new ClientError('Workspace is not active', 'workspace-inactive', {status: 403});
+  }
+
   return {workspaceId: params.workspaceId, userId: context.userId, role: membership.role};
 }
 
+/**
+ * Applies the workspace lifecycle gate to a resource that has already been loaded. Missing
+ * membership remains resource-shaped 404 to avoid leaking the resource's existence, while
+ * suspended and deleted claims retain their stable lifecycle errors.
+ */
+export function requireWorkspaceResourceAccess(params: {
+  request: RequestWithContext;
+  workspaceId: string;
+  notFoundError: ClientError;
+}): RequireWorkspaceAccessResult {
+  try {
+    return requireWorkspaceAccess(params);
+  } catch (error) {
+    if (error instanceof ClientError && error.code === 'forbidden') {
+      throw params.notFoundError;
+    }
+    throw error;
+  }
+}
+
 export function setProvisionerContext(
   request: RequestWithContext,
   context: ProvisionerContext,

package/src/require-workspace-access.test.ts

@@ -26,7 +26,10 @@ describe('requireWorkspaceAccess', () => {
   test('returns workspaceId, userId, and role when the token grants access', () => {
     const userId = crypto.randomUUID();
     const workspaceId = crypto.randomUUID();
-    const request = requestWith({userId, memberships: [{workspaceId, role: 'admin'}]});
+    const request = requestWith({
+      userId,
+      memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
+    });
 
     const result = requireWorkspaceAccess({request, workspaceId});
 
@@ -38,7 +41,7 @@ describe('requireWorkspaceAccess', () => {
   test('throws 403 when the token does not include the workspace', () => {
     const request = requestWith({
       userId: crypto.randomUUID(),
-      memberships: [{workspaceId: crypto.randomUUID(), role: 'admin'}],
+      memberships: [{workspaceId: crypto.randomUUID(), role: 'admin', workspaceStatus: 'active'}],
     });
 
     const act = () => requireWorkspaceAccess({request, workspaceId: crypto.randomUUID()});
@@ -53,4 +56,35 @@ describe('requireWorkspaceAccess', () => {
     expect(act).toThrow(ClientError);
     expect(act).toThrow(expect.objectContaining({status: 401}));
   });
+
+  test.each([
+    ['suspended', 'workspace-suspended', 409],
+    ['deleted', 'workspace-inactive', 403],
+  ] as const)('maps a %s workspace claim to the stable access error', (workspaceStatus, code, status) => {
+    const workspaceId = crypto.randomUUID();
+    const request = requestWith({
+      userId: crypto.randomUUID(),
+      memberships: [{workspaceId, role: 'admin', workspaceStatus}],
+    });
+
+    const act = () => requireWorkspaceAccess({request, workspaceId});
+
+    expect(act).toThrow(ClientError);
+    expect(act).toThrow(expect.objectContaining({code, status}));
+  });
+});
+
+test('context access helpers only authorize active memberships', () => {
+  const workspaceId = crypto.randomUUID();
+  const context = buildUserContext({
+    userId: crypto.randomUUID(),
+    email: 'user@example.com',
+    memberships: [
+      {workspaceId, role: 'admin', workspaceStatus: 'suspended'},
+      {workspaceId: crypto.randomUUID(), role: 'admin', workspaceStatus: 'deleted'},
+    ],
+  });
+
+  expect(context.canAccess(workspaceId)).toBe(false);
+  expect(context.hasRole(workspaceId, 'admin')).toBe(false);
 });