@shipfox/api-auth-dto 15.0.0 → 18.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth-dto",
   "license": "MIT",
-  "version": "15.0.0",
+  "version": "18.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",

package/src/schemas/admin.ts

@@ -95,6 +95,12 @@ export const suspendAdministratorUserBodySchema = z.object({
 
 export type SuspendAdministratorUserBodyDto = z.infer<typeof suspendAdministratorUserBodySchema>;
 
+export const impersonateUserBodySchema = z.object({
+  reason: reasonSchema,
+});
+
+export type ImpersonateUserBodyDto = z.infer<typeof impersonateUserBodySchema>;
+
 export const reactivateAdministratorUserBodySchema = z
   .object({
     reason: reasonSchema.optional(),

package/src/schemas/auth.ts

@@ -72,6 +72,36 @@ export const loginResponseSchema = z.object({
 
 export type LoginResponseDto = z.infer<typeof loginResponseSchema>;
 
+/**
+ * A session response for an externally minted (adopted) session, which may
+ * carry the optional impersonation mark. The cookie-based login and refresh
+ * responses never set it. The impersonation mint route emits its own
+ * `impersonateResponseSchema`; client shells map that shape into this one.
+ */
+export const sessionResponseSchema = loginResponseSchema.extend({
+  impersonator_id: z.string().uuid().optional(),
+});
+
+export type SessionResponseDto = z.infer<typeof sessionResponseSchema>;
+
+/**
+ * The impersonation mint, replay, and renewal response. Mirrors
+ * `loginResponseSchema` with deliberate deviations: no refresh cookie is set,
+ * no `admin_role` exists (the target can hold none), and `expires_at`,
+ * `server_time`, and `impersonator_id` are explicit so the client never
+ * decodes the JWT. `server_time` is the issuer's clock at response time; the
+ * client anchors countdown and Extend availability on it.
+ */
+export const impersonateResponseSchema = z.object({
+  token: z.string(),
+  expires_at: z.string().datetime(),
+  server_time: z.string().datetime(),
+  impersonator_id: z.string().uuid(),
+  user: userDtoSchema,
+});
+
+export type ImpersonateResponseDto = z.infer<typeof impersonateResponseSchema>;
+
 export const refreshResponseSchema = loginResponseSchema;
 
 export type RefreshResponseDto = z.infer<typeof refreshResponseSchema>;
@@ -79,6 +109,7 @@ export type RefreshResponseDto = z.infer<typeof refreshResponseSchema>;
 export const meResponseSchema = z.object({
   user: userDtoSchema,
   admin_role: adminRoleSchema.nullable().optional(),
+  impersonator_id: z.string().uuid().optional(),
 });
 
 export type MeResponseDto = z.infer<typeof meResponseSchema>;

package/src/schemas/index.ts

@@ -33,6 +33,8 @@ export {
   type GrantAdminRoleResponseDto,
   grantAdminRoleBodySchema,
   grantAdminRoleResponseSchema,
+  type ImpersonateUserBodyDto,
+  impersonateUserBodySchema,
   isAdminRole,
   type ListAdminGrantsQueryDto,
   type ListAdminGrantsResponseDto,
@@ -55,6 +57,8 @@ export {
   type ChangePasswordBodyDto,
   changePasswordBodySchema,
   emailSchema,
+  type ImpersonateResponseDto,
+  impersonateResponseSchema,
   type LoginBodyDto,
   type LoginMethodDto,
   type LoginMethodsResponseDto,
@@ -76,10 +80,12 @@ export {
   passwordSchema,
   type RefreshResponseDto,
   refreshResponseSchema,
+  type SessionResponseDto,
   type SignupAcceptErrorDto,
   type SignupBodyDto,
   type SignupMembershipDto,
   type SignupResponseDto,
+  sessionResponseSchema,
   signupAcceptErrorSchema,
   signupBodySchema,
   signupMembershipSchema,

package/src/schemas/runner-session-token.ts

@@ -13,6 +13,7 @@ export const runnerSessionTokenClaimsSchema = z.object({
   scope: z.literal('workspace'),
   labels: z.array(z.string()).min(1),
   maxClaims: z.number().int().positive().nullable(),
+  lifecycleCapabilities: z.array(z.string()).max(8).optional(),
   aud: z.literal(RUNNER_SESSION_TOKEN_AUDIENCE),
   iat: z.number().int(),
   exp: z.number().int(),